,i  #aae? ,,congress  #a/ ,session  ,h4 
,r4 #cige  ,,9 ,,! ,,h\se ,,(           
,,repres5tatives  ,octob] #e1 #bjag,mr4 
,correa 7= himself1 ,ms4 ,norton1 ,ms4  
,hanabusa1 & ,mr4 ,br5dan ,f4 ,boyle (  
,p5nsylvania7 introduc$ ! foll[+ bill2  
:i* 0 ref]r$ to ! ,committee on ,en]gy &
 ,comm]ce  ,a ,,bill  ,to require cov]$ 
entities to provide notification 9 !    
case ( a brea* ( unsecur$ s5sitive      
p]sonally id5tifiable in=mation 9       
electronic or digital =m1 & = o!r       
purposes4  #a4 ,%ort title ,?is ,act may
 be cit$ z ! ,cyb] ,brea* ,notification 
,act ( #bjag4  #b4 ,notification (      
in=mation security brea*  7a7           
,notification requir$  7#a7 ,by cov]$   
entity ,a cov]$ entity t collects1 uses1
 accesses1 transmits1 /ores1 or disposes
 ( unsecur$ s5sitive p]sonally          
id5tifiable in=mation 9 electronic or   
digital =m %all1 9 ! case ( a brea* (   
su* in=mation t is discov]$ by ! cov]$  
entity1 notify--  7,a7 appropriate      
,f$]al ag5cies2  7,b7 ea* individual ^: 

unsecur$ s5sitive p]sonally id5tifiable 
in=mation has be51 or is reasonably     
believ$ by ! cov]$ entity to h be51     
access$1 acquir$1 or disclos$ z a result
 ( su* brea*2  7,c7 ! attorney g5]al (  
ea* ,/ate 9 :i* an individual describ$ 9
 subp>agraph 7,b7 resides2 &  7,d7 if   
!re are #ejj or m individuals describ$ 9
 subp>agraph 7,b7 :o reside 9 a ,/ate or
 o!r jurisdiction1 prom95t m$ia outlets 
s]v+ su* ,/ate or o!r jurisdiction4     
7#b7 ,by ?ird p>ty  7,a7 ,to cov]$      
entity ,a ?ird p>ty t collects1 uses1   
accesses1 transmits1 /ores1 or disposes 
( unsecur$ s5sitive p]sonally           
id5tifiable in=mation 9 electronic or   
digital =m t is own$ or lic5s$ by a     
cov]$ entity %all1 foll[+ ! discov]y ( a
 brea* ( su* in=mation1 notify ! cov]$  
entity ( su* brea*4 ,su* notification   
%all include ! id5tification ( ea*      
individual ^: unsecur$ s5sitive         
p]sonally id5tifiable in=mation has be51
 or is reasonably believ$ by ! ?ird p>ty
 to h be51 access$1 acquir$1 or disclos$

 dur+ su* brea* & ! in=mation describ$ 9
 p>agraphs 7#a71 7#b71 & 7#d7 (         
subsection 7d7 ) respect to su* brea*4  
,! cov]$ entity %all make !             
notifications requir$ by p>agraph 7#a7 )
 respect to su* brea*4  7,b7 ,to ,,ftc &
 ,,fbi ,if !re are #ejj or m individuals
 describ$ 9 subp>agraph 7,a7 ) respect  
to a brea*1 ! ?ird p>ty %all provide !  
notification requir$ by su* subp>agraph 
to ! ,commission & ! ,f$]al ,bureau (   
,inve/igation1 z well z to ! cov]$      
entity4 ,notification by ! ?ird p>ty "u 
?is subp>agraph does n relieve ! cov]$  
entity ( ! requirem5t to notify !       
,commission & ! ,f$]al ,bureau (        
,inve/igation "u p>agraph 7#a77;,a74    
7b7 ,timel9ess ( notification  7#a7 ,9  
g5]al ,all notifications requir$ "u     
subsection 7a7 %all be made 9 ! mo/     
exp$i5t "t possible & )\t unreasonable  
delay1 b 9 no case lat] ?an #cj cal5d>  
days aft] ! discov]y ( a brea* by !     
cov]$ entity involv$ 7or by ! ?ird p>ty 
involv$ 9 ! case ( a notification       

requir$ "u subsection 7a77#b77;,a774    
7#b7 ,exp$it$ notification to ,,ftc &   
,,fbi ,not)/&+ p>agraph 7#a71 if !re are
 #ejj or m individuals to :i* a cov]$   
entity is requir$ to provide            
notification ( a brea* "u subsection    
7a77#a77;,b71 ! cov]$ entity %all notify
 ! ,commission & ! ,f$]al ,bureau (     
,inve/igation ( su* brea* z requir$ "u  
subsection 7a77#a77;,a7 n lat] ?an #dh  
h\rs aft] ! discov]y ( su* brea* by !   
cov]$ entity4  7#c7 ,exp$it$            
notification by ?ird p>ties ,not)/&+    
p>agraph 7#a71 a ?ird p>ty subject to   
subsection 7a77#b77;,b7 ) respect to a  
brea* %all make ! notifications requir$ 
by su* subsection n lat] ?an #dh h\rs   
aft] discov]y ( ! brea* by ! ?ird p>ty4 
7#d7 ,burd5 ( pro( ,! cov]$ entity      
involv$ 7or ! ?ird p>ty involv$ 9 ! case
 ( a notification requir$ "u subsection 
7a77#b77 %all h ! burd5 ( demon/rat+ t  
all notifications 7 made z requir$ "u   
subsection 7a71 includ+ evid5ce         
demon/rat+ ! necessity ( any delay4     

7#e7 ,brea*es treat$ z discov]$ ,=      
purposes ( ?is section1 a brea* %all be 
treat$ z discov]$ by a cov]$ entity or1 
9 ! case ( a brea* describ$ 9 subsection
 7a77#b71 by a ?ird p>ty1 z ( ! fir/ day
 on :i* su* brea* is kn[n to su* cov]$  
entity or ?ird p>ty1 respectively       
7includ+ any p]son1 o!r ?an ! individual
 committ+ ! brea*1 t is an employee1    
(fic]1 or o!r ag5t ( su* cov]$ entity or
 ?ird p>ty1 respectively7 or %\ld       
reasonably h be5 kn[n to su* cov]$      
entity or ?ird p>ty 7or p]son7 to h     
occurr$4  7c7 ,me?ods ( individual      
notification ,notification requir$ to be
 provid$ to an individual "u subsection 
7a77#a77;,b7 ) respect to a brea* %all  
be provid$ 9 ! foll[+ =m3  7#a7 ,writt5 
notification by fir/-class mail to !    
individual 7or ! next ( k9 ( !          
individual if ! individual is deceas$7  
at ! la/ kn[n address ( ! individual or 
! next ( k91 respectively1 or1 if       
specifi$ z a pref]5ce by ! individual1  
by electronic mail4 ,! notification may 

be provid$ 9 "o or m mail+s z in=mation 
is available4  7#b7 ,9 ! case 9 :i* !re 
is insuffici5t or out-(-date contact    
in=mation 7includ+ a phone numb]1 email 
address1 or any o!r =m ( appropriate    
communication7 t precludes direct writt5
 or 7if specifi$ by ! individual7       
electronic notification to ! individual1
 a sub/itute =m ( notification %all be  
provid$1 includ+1 9 ! case t !re are    
#ejj or m individuals = :i* !re is      
insuffici5t or out-(-date contact       
in=mation1 a conspicu\s po/+ = a m9imum 
( #cj days on ! homepage ( ! website ( !
 cov]$ entity involv$4 ,su* a website   
po/+ %all include a toll-free telephone 
numb] t an individual c call to le>n    
:e!r or n ! individual's unsecur$       
s5sitive p]sonally id5tifiable in=mation
 is possibly includ$ 9 ! brea*4  7#c7 ,9
 any case consid]$ by ! cov]$ entity    
involv$ to require urg5cy because (     
possible imm95t misuse ( unsecur$       
s5sitive p]sonally id5tifiable          
in=mation1 ! cov]$ entity1 9 addition to

 notification z requir$ by p>agraphs    
7#a7 & 7#b71 may provide in=mation to   
individuals by telephone or o!r means1 z
 appropriate4  7d7 ,cont5t (            
notification ,ea* notification ( a brea*
 "u subsection 7a77#a7 %all include1 to 
! ext5t possible1 ! foll[+3  7#a7 ,a    
brief description ( :at happ5$1 includ+ 
! date ( ! brea* & ! date ( ! discov]y (
 ! brea*1 if kn[n4  7#b7 ,a description 
( ! types ( unsecur$ s5sitive p]sonally 
id5tifiable in=mation t 7 involv$ 9 !   
brea*4  7#c7 ,! /eps individuals %\ld   
take to protect !mselves f pot5tial h>m 
result+ f ! brea*4  7#d7 ,a brief       
description ( :at ! entity involv$ is   
do+ to inve/igate ! brea*1 to mitigate  
losses1 & to protect aga9/ any fur!r    
brea*es4  7#e7 ,contact proc$ures =     
individuals to ask que/ions or le>n     
additional in=mation1 :i* %all include a
 toll-free telephone numb]1 an e-mail   
address1 a website1 & a po/al address4  
7e7 ,po/+ on ,,ftc public website ,!    
,commission %all make available to !    

public on ! website ( ! ,commission a   
li/ t id5tifies ea* cov]$ entity t is   
requir$ to notify #ejj or m individuals 
( a brea* "u subsection 7a77#a77;,b71   
except to ! ext5t notification ) respect
 to su* brea* is subject to a delay =   
law en=cem5t or national security       
purposes "u subsection 7f74  7f7 ,delay 
( notification = law en=cem5t or        
national security  7#a7 ,9 g5]al ,if !  
,director ( ! ,f$]al ,bureau (          
,inve/igation det]m9es t ! notifications
 requir$ "u subp>agraphs 7,b71 7,c71 &  
7,d7 ( subsection 7a77#a7 w\ld imp$e a  
crim9al inve/igation or national        
security activity1 ! "t p]iod = su*     
notifications %all be ext5d$ #cj days ^u
 writt5 notice f ! ,director to ! cov]$ 
entity t exp]i5c$ ! brea* & to !        
,commission4  7#b7 ,ext5d$ delay (      
notification ,if ! "t p]iod =           
notification requir$ "u subp>agraphs    
7,b71 7,c71 & 7,d7 ( subsection 7a77#a7 
is ext5d$ pursuant to p>agraph 7#a71 a  
cov]$ entity %all provide ! notification

 )9 su* "t p]iod unless ! ,director ( ! 
,f$]al ,bureau ( ,inve/igation provides 
writt5 notice to ! cov]$ entity & to !  
,commission t fur!r ext5sion ( ! "t     
p]iod is necess>y4 ,! ,director may     
ext5d ! "t p]iod = additional p]iods (  
up to #cj days ea*4  7#c7 ,immunity ,no 
cause ( action = :i* jurisdiction is    
bas$ "u section #acdf7;b7 ( title #bh1  
,unit$ ,/ates ,code1 %all lie aga9/ any 
,f$]al law en=cem5t ag5cy = acts relat+ 
to ! ext5sion ( ! deadl9e = notification
 = law en=cem5t or national security    
purposes "u ?is subsection4  #c4        
,en=cem5t by ,f$]al ,trade ,commission2 
,regulations  7a7 ,unfair or deceptive  
acts or practices ,a violation ( ?is    
,act or a regulation promulgat$ "u ?is  
,act %all be treat$ z a violation ( a   
regulation "u section #ah7;a77#a77;,b7 (
 ! ,f$]al ,trade ,commission ,act 7#ae  
,u4,s4,c4 #eg;a7a77#a77;,b77 reg>d+     
unfair or deceptive acts or practices4  
7b7 ,p[]s ( ,commission ,! ,commission  
%all en=ce ?is ,act & ! regulations     

promulgat$ "u ?is ,act 9 ! same mann]1  
by ! same means1 & ) ! same             
jurisdiction1 p[]s1 & duties z ?\gh all 
applicable t]ms & provisions ( ! ,f$]al 
,trade ,commission ,act 7#ae ,u4,s4,c4  
#da et seq47 7 incorporat$ into & made a
 "p ( ?is ,act4 ,any p]son :o violates  
?is ,act or a regulation promulgat$ "u  
?is ,act %all be subject to ! p5alties &
 entitl$ to ! privileges & immunities   
provid$ 9 ! ,f$]al ,trade ,commission   
,act4  7c7 ,regulations ,n lat] ?an #ahj
 days aft] ! date ( ! enactm5t ( ?is    
,act1 ! ,commission %all promulgate     
regulations 9 accordance ) section #eec 
( title #e1 ,unit$ ,/ates ,code1 to     
implem5t ?is ,act4  #d4 ,reports to     
,congress  7a7 ,9 g5]al ,n lat] ?an #ab 
mon?s aft] ! date ( ! enactm5t ( ?is    
,act & annually !reaft]1 ! ,commission  
%all prep>e & submit to ! ,committee on 
,en]gy & ,comm]ce ( ! ,h\se (           
,repres5tatives & ! ,committee on       
,comm]ce1 ,sci5ce1 & ,transportation ( !
 ,s5ate a report conta9+ in=mation      

reg>d+ brea*es = :i* notification 0     
provid$ to ! ,commission "u section     
#b7;a77#a77;,a74  7b7 ,in=mation requir$
 ,su* in=mation %all include-- 7#a7 !   
numb] & nature ( su* brea*es2  7#b7 !   
numb] ( individuals affect$2 &  7#c7    
actions tak5 9 response to su* brea*es4 
#e4 ,exclud$ entities ,no?+ 9 ?is ,act1 
or ! regulations promulgat$ "u ?is ,act1
 %all apply to-- 7#a7 cov]$ entities to 
! ext5t t su* entities act z cov]$      
entities or bus9ess associates 7z su*   
t]ms are def9$ 9 section #acdjj ( !     
,heal? ,in=mation ,te*nology = ,economic
 & ,cl9ical ,heal? ,act 7#db ,u4,s4,c4  
#agiba77 t are subject to section #acdjb
 ( su* ,act 7#db ,u4,s4,c4 #agicb72 &   
7#b7 cov]$ entities to ! ext5t t !y act 
z v5dors ( p]sonal heal? records 7z su* 
t]m is def9$ 9 section #acdjj ( su* ,act
 7#db ,u4,s4,c4 #agiba77 & ?ird-p>ty    
s]vice provid]s t are subject to section
 #acdjg ( su* ,act 7#db ,u4,s4,c4       
#agicg74  #f4 ,def9itions ,9 ?is ,act3  
7#a7 ,appropriate ,f$]al ag5cy ,! t]m   

appropriate ,f$]al ag5cy means--  7,a7 !
 ,commission2  7,b7 ! ,f$]al ,bureau (  
,inve/igation2 &  7,c7 any o!r ,f$]al   
ag5cy specifi$ by ! ,commission by      
regulation1 :i* may include a           
specification ( diff]5t ,f$]al ag5cies  
dep5d+ on ! types ( activities 9 :i*    
cov]$ entities are engag$4  7#b7        
,commission ,! t]m ,commission means !  
,f$]al ,trade ,commission4  7#c7 ,cov]$ 
entity ,! t]m cov]$ entity means any    
p]son1 p>tn]%ip1 or corporation ov] :i* 
! ,commission has jurisdiction "u       
section #e7;a77#b7 ( ! ,f$]al ,trade    
,commission ,act 7#ae ,u4,s4,c4         
#de7;a77#b774  7#d7 ,s5sitive p]sonally 
id5tifiable in=mation  7,a7 ,9 g5]al ,! 
t]m s5sitive p]sonally id5tifiable      
in=mation means any in=mation1 or       
compilation ( in=mation1 9 electronic or
 digital =m t includes "o or m ( !      
foll[+3  7i7 ,an individual's fir/ & la/
 "n or fir/ initial & la/ "n 9          
comb9ation ) any two ( ! foll[+ data    
elem5ts3  7,i7 ,home address or         

telephone numb]4  7,,ii7 ,"m's maid5 "n4
  7,,iii7 ,mon?1 day1 & ye> ( bir?4     
7ii7 ,a ,social ,security numb] 7b n    
includ+ only ! la/ f\r digits ( a       
,social ,security numb]71 driv]'s lic5se
 numb]1 passport numb]1 or ali5         
regi/ration numb] or o!r ,gov]nm5t-issu$
 unique id5tification numb]4  7iii7     
,unique biometric data su* z a f+] pr9t1
 voice pr9t1 a ret9a or iris image1 or  
any o!r unique physical repres5tation4  
7iv7 ,a unique acc\nt id5tifi]1 includ+ 
a f9ancial acc\nt numb] or cr$it or     
debit c>d numb]1 electronic             
id5tification numb]1 us] "n1 or r\t+    
code4  7v7 ,a us] "n or electronic mail 
address1 9 comb9ation ) a password or   
security "q & answ] t w\ld p]mit access 
to an onl9e acc\nt4  7vi7 ,any          
comb9ation ( ! foll[+ data elem5ts3 7,i7
 ,an individual's fir/ & la/ "n or fir/ 
initial & la/ "n4  7,,ii7 ,a unique     
acc\nt id5tifi]1 includ+ a f9ancial     
acc\nt numb] or cr$it or debit c>d      
numb]1 electronic id5tification numb]1  

us] "n1 or r\t+ code4  7,,iii7 ,any     
security code1 access code1 or password1
 or s\rce code t c\ld be us$ to g5]ate  
su* codes or passwords4  7,b7 ,modifi$  
def9ition by rulemak+ ,! ,commission    
may1 by rule promulgat$ "u section #eec 
( title #e1 ,unit$ ,/ates ,code1 am5d ! 
def9ition ( s5sitive p]sonally          
id5tifiable in=mation to ! ext5t t su*  
am5dm5t w accompli% ! purposes ( ?is    
,act4 ,9 am5d+ ! def9ition1 !           
,commission may det]m9e--  7i7 t any    
p>ticul> comb9ations ( in=mation are    
s5sitive p]sonally id5tifiable          
in=mation2 or  7ii7 t any p>ticul> piece
 ( in=mation1 on its own1 is s5sitive   
p]sonally id5tifiable in=mation4  7#e7  
,/ate ,! t]m ,/ate means ea* ,/ate ( !  
,unit$ ,/ates1 ! ,di/rict ( ,columbia1  
ea* commonweal?1 t]ritory1 or possession
 ( ! ,unit$ ,/ates1 & ea* f$]ally       
recogniz$ ,indian tribe4  7#f7 ,unsecur$
 s5sitive p]sonally id5tifiable         
in=mation ,! t]m unsecur$ s5sitive      
p]sonally id5tifiable in=mation means   

s5sitive p]sonally id5tifiable in=mation
 t is n secur$ by a te*nology /&>d t--  
7,a7 r5d]s in=mation unusable1          
unreadable1 or indeciph]able to         
unau?oriz$ individuals2 &  7,b7 is      
develop$ or endors$ by a /&>ds develop+ 
organization t is accr$it$ by ! ,am]ican
 ,national ,/&>ds ,in/itute4  #g4       
,relation%ip to ,/ate law ,?is ,act does
 n annul1 alt]1 or affect1 or exempt any
 p]son subject to ! provisions ( ?is    
,act f comply+ )1 ! laws ( any ,/ate )  
respect to notification ( a brea* (     
p]sonal in=mation 9 electronic or       
digital =m1 except to ! ext5t t ^? laws 
are inconsi/5t ) any provision ( ?is    
,act1 & !n only to ! ext5t ( !          
inconsi/5cy4 ,= purposes ( ?is section1 
a ,/ate law is n inconsi/5t ) ?is ,act  
if ! protection su* law af=ds any       
consum] is great] ?an ! protection      
provid$ by ?is ,act4  #h4 ,effective    
date ,?is ,act %all apply ) respect to  
brea*es t are discov]$ on or aft] ! date
 t is #cj days aft] ! date on :i* !     

,commission promulgates ! regulations   
requir$ by section #c7;c74