,i #aae? ,,congress #b;d ,session ,h4 ,r4 #echh ,,9 ,,! ,,h\se ,,( ,,repres5tatives ,m>* #bb1 #bjah ,mr4 ,ru% introduc$ ! foll[+ bill2 :i* 0 ref]r$ to ! ,committee on ,en]gy & ,comm]ce ,a ,,bill ,to require c]ta9 entities :o collect & ma9ta9 p]sonal in=mation ( individuals to secure su* in=mation & to provide notice to su* individuals 9 ! case ( a brea* ( security involv+ su* in=mation1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,data ,acc\ntability & ,tru/ ,act4 #b4 ,requirem5ts = in=mation security 7a7 ,g5]al security policies & proc$ures 7#a7 ,regulations ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all promulgate regulations "u section #eec ( title #e1 ,unit$ ,/ates ,code1 to require ea* cov]$ entity to e/abli% & implem5t policies & proc$ures reg>d+ in=mation security practices = ! treatm5t & protection ( p]sonal in=mation tak+ into consid]ation-- 7,a7 ! size (1 & ! nature1 scope1 & complexity ( ! activities engag$ 9 by su* cov]$ entity2 7,b7 ! s5sitivity ( any p]sonal in=mation at issue2 7,c7 ! curr5t /ate ( ! art 9 adm9i/rative1 te*nical1 & physical safegu>ds = protect+ su* in=mation2 & 7,d7 ! co/ ( implem5t+ su* safegu>ds4 7#b7 ,requirem5ts ,su* regulations %all require ! policies & proc$ures to include ! foll[+3 7,a7 ,a writt5 security policy ) respect to ! collection1 use1 sale1 o!r dissem9ation1 & ma9t5ance ( su* p]sonal in=mation4 7,b7 ,! id5tification ( an (fic] or o!r individual z ! po9t ( contact ) responsibility = ! managem5t ( in=mation security4 7,c7 ,a process = id5tify+ & assess+ any reasonably =eseeable vuln]abilities 9 ! sy/em or sy/ems ma9ta9$ by su* cov]$ entity t conta9s su* data1 :i* %all include regul> monitor+ = a brea* ( security ( su* sy/em or sy/ems4 7,d7 ,a process = tak+ prev5tive & corrective action to mitigate aga9/ any vuln]abilities id5tifi$ 9 ! process requir$ by subp>agraph 7,c71 :i* may include implem5t+ any *anges to security practices & ! ar*itecture1 in/allation1 or implem5tation ( network or op]at+ s(tw>e1 & = regul>ly te/+ or o!rwise monitor+ ! effectiv5ess ( ! safegu>ds' key controls1 sy/ems1 & proc$ures4 7,e7 ,a process = dispos+ ( data conta9+ p]sonal in=mation by %r$d+1 p]man5tly eras+1 or o!rwise modify+ ! p]sonal in=mation conta9$ 9 su* data to make su* p]sonal in=mation p]man5tly unreadable or undeciph]able4 7,f7 ,a process = ov]see+ p]sons to :om p]sonal in=mation is disclos$1 or :o h access to int]net-connect$ devices1 by-- 7i7 tak+ reasonable /eps to select & reta9 p]sons t are capable ( ma9ta9+ appropriate safegu>ds = ! p]sonal in=mation or int]net-connect$ devices at issue2 & 7ii7 requir+ all su* p]sons to implem5t & ma9ta9 su* security measures4 7#c7 ,treatm5t ( entities gov]n$ by o!r ,f$]al law ,any cov]$ entity :o is 9 compliance ) any o!r ,f$]al law t requires su* cov]$ entity to ma9ta9 /&>ds & safegu>ds = in=mation security & protection ( p]sonal in=mation t1 tak5 z a :ole & z ! ,commission %all det]m9e 9 ! rulemak+ requir$ "u ?is subsection1 provide protections sub/antially simil> to1 or great] ?an1 ^? requir$ "u ?is subsection1 %all be deem$ to be 9 compliance ) ?is subsection4 7b7 ,special requirem5ts = in=mation brok]s 7#a7 ,submission ( policies to ! ,,ftc ,! regulations promulgat$ "u subsection 7a7 %all require ea* in=mation brok] to submit its security policies to ! ,commission 9 conjunction ) a notification ( a brea* ( security "u section #c or ^u reque/ ( ! ,commission4 7#b7 ,po/-brea* audit ,= any in=mation brok] requir$ to provide notification "u section #c1 ! ,commission may conduct audits ( ! in=mation security practices ( su* in=mation brok]1 or require ! in=mation brok] to conduct indep5d5t audits ( su* practices 7by an indep5d5t auditor :o has n audit$ su* in=mation brok]'s security practices dur+ ! prec$+ #e ye>s74 7#c7 ,accuracy ( & individual access to p]sonal in=mation 7,a7 ,accuracy 7i7 ,9 g5]al ,ea* in=mation brok] %all e/abli% reasonable proc$ures to assure ! maximum possible accuracy ( ! p]sonal in=mation ! in=mation brok] collects1 assembles1 or ma9ta9s1 & any o!r in=mation ! in=mation brok] collects1 assembles1 or ma9ta9s t specifically id5tifies an individual1 o!r ?an in=mation :i* m]ely id5tifies an individual's "n or address4 7ii7 ,limit$ exception = fraud databases ,! requirem5t 9 clause 7i7 %all n prev5t ! collection or ma9t5ance ( in=mation t may be inaccurate ) respect to a p>ticul> individual :5 t in=mation is be+ collect$ or ma9ta9$ solely-- 7,i7 = ! purpose ( indicat+ :e!r !re may be a discrepancy or irregul>ity 9 ! p]sonal in=mation t is associat$ ) an individual2 & 7,,ii7 to help id5tify1 or au!nticate ! id5tity (1 an individual1 or to protect aga9/ or inve/igate fraud or o!r unlawful conduct4 7,b7 ,consum] access to in=mation ,ea* in=mation brok] %all-- 7i7 provide to ea* individual ^: p]sonal in=mation ! in=mation brok] ma9ta9s1 at ! individual's reque/ at lea/ once p] ye> & at no co/ to ! individual1 & aft] v]ify+ ! id5tity ( su* individual1 a means = ! individual to review any p]sonal in=mation reg>d+ su* individual ma9ta9$ by ! in=mation brok] & any o!r in=mation ma9ta9$ by ! in=mation brok] t specifically id5tifies su* individual1 o!r ?an in=mation :i* m]ely id5tifies an individual's "n or address2 & 7ii7 place a conspicu\s notice on ! ,int]net website ( ! in=mation brok] 7if ! in=mation brok] ma9ta9s su* a website7 in/ruct+ individuals h[ to reque/ access to ! in=mation requir$ to be provid$ "u clause 7i71 &1 z applicable1 h[ to express a pref]5ce ) respect to ! use ( p]sonal in=mation = m>ket+ purposes "u subp>agraph 7,d74 7,c7 ,disput$ in=mation ,:5ev] an individual ^: in=mation ! in=mation brok] ma9ta9s makes a writt5 reque/ disput+ ! accuracy ( any su* in=mation1 ! in=mation brok]1 aft] v]ify+ ! id5tity ( ! individual mak+ su* reque/ & unless !re are reasonable gr\nds to believe su* reque/ is frivol\s or irrelevant1 %all-- 7i7 correct any inaccuracy2 or 7ii7 9 ! case ( in=mation t is-- 7,i7 public record in=mation1 in=m ! individual ( ! s\rce ( ! in=mation1 &1 if reasonably available1 :]e a reque/ = correction may be direct$ &1 if ! individual provides pro( t ! public record has be5 correct$ or t ! in=mation brok] 0 report+ ! in=mation incorrectly1 correct ! inaccuracy 9 ! in=mation brok]'s records2 or 7,,ii7 nonpublic in=mation1 note ! in=mation t is disput$1 includ+ ! individual's /atem5t disput+ su* in=mation1 & take reasonable /eps to indep5d5tly v]ify su* in=mation "u ! proc$ures outl9$ 9 subp>agraph 7,a7 if su* in=mation c be indep5d5tly v]ifi$4 7,d7 ,alt]native proc$ure = c]ta9 m>ket+ in=mation ,9 accordance ) regulations issu$ "u subp>agraph 7,f71 an in=mation brok] t ma9ta9s any in=mation describ$ 9 subp>agraph 7,a7 :i* is us$1 %>$1 or sold by su* in=mation brok] = m>ket+ purposes1 may1 9 lieu ( comply+ ) ! access & dispute requirem5ts set =? 9 subp>agraphs 7,b7 & 7,c71 provide ea* individual ^: in=mation ! in=mation brok] ma9ta9s ) a reasonable means ( express+ a pref]5ce n to h 8 or h] in=mation us$ = su* purposes4 ,if ! individual expresses su* a pref]5ce1 ! in=mation brok] may n use1 %>e1 or sell ! individual's in=mation = m>ket+ purposes4 7,e7 ,limitations ,an in=mation brok] may limit ! access to in=mation requir$ "u subp>agraph 7,b77i7 & is n requir$ to provide notice to individuals z requir$ "u subp>agraph 7,b77ii7 9 ! foll[+ circum/ances3 7i7 ,if access ( ! individual to ! in=mation is limit$ by law or legally recogniz$ privilege4 7ii7 ,if ! in=mation is us$ = a legitimate gov]nm5tal or fraud prev5tion purpose t w\ld be compromis$ by su* access4 7iii7 ,if ! in=mation consi/s ( a publi%$ m$ia record1 unless t record has be5 includ$ 9 a report ab\t an individual %>$ ) a ?ird p>ty4 7,f7 ,rulemak+ ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all promulgate regulations "u section #eec ( title #e1 ,unit$ ,/ates ,code1 to c>ry out ?is p>agraph & to facilitate ! purposes ( ?is ,act4 ,9 addition1 ! ,commission %all issue regulations1 z necess>y1 "u section #eec ( title #e1 ,unit$ ,/ates ,code1 on ! scope ( ! application ( ! limitations 9 subp>agraph 7,e71 includ+ any additional circum/ances 9 :i* an in=mation brok] may limit access to in=mation "u su* clause t ! ,commission det]m9es to be appropriate4 7,g7 ,,fcra regulat$ p]sons ,any in=mation brok] :o is engag$ 9 activities subject to ! ,fair ,cr$it ,report+ ,act & :o is 9 compliance ) sections #fji1 #faj1 & #faa ( su* ,act 7#ae ,u4,s4,c4 #afha;g2 #afha;h2 #afha;i7 ) respect to in=mation subject to su* ,act1 %all be deem$ to be 9 compliance ) ?is p>agraph ) respect to su* in=mation4 7#d7 ,requirem5t ( audit log ( access$ & transmitt$ in=mation ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all promulgate regulations "u section #eec ( title #e1 ,unit$ ,/ates ,code1 to require in=mation brok]s to e/abli% measures :i* facilitate ! audit+ or retrac+ ( any int]nal or ext]nal access to1 or transmissions (1 any data conta9+ p]sonal in=mation collect$1 assembl$1 or ma9ta9$ by su* in=mation brok]4 7#e7 ,prohibition on pretext+ by in=mation brok]s 7,a7 ,prohibition on obta9+ p]sonal in=mation by false pret5ses ,x %all be unlawful = an in=mation brok] to obta9 or attempt to obta91 or cause to be disclos$ or attempt to cause to be disclos$ to any p]son1 p]sonal in=mation or any o!r in=mation relat+ to any p]son by-- 7i7 mak+ a false1 fictiti\s1 or fraudul5t /atem5t or repres5tation to any p]son2 or 7ii7 provid+ any docum5t or o!r in=mation to any p]son t ! in=mation brok] kn[s or %\ld "k to be =g$1 c\nt]feit1 lo/1 /ol51 or fraudul5tly obta9$1 or to conta9 a false1 fictiti\s1 or fraudul5t /atem5t or repres5tation4 7,b7 ,prohibition on solicitation to obta9 p]sonal in=mation "u false pret5ses ,x %all be unlawful = an in=mation brok] to reque/ a p]son to obta9 p]sonal in=mation or any o!r in=mation relat+ to any o!r p]son1 if ! in=mation brok] knew or %\ld h kn[n t ! p]son to :om su* a reque/ is made w obta9 or attempt to obta9 su* in=mation 9 ! mann] describ$ 9 subp>agraph 7,a74 #c4 ,notification ( in=mation security brea* 7a7 ,individual notification 7#a7 ,9 g5]al ,ea* cov]$ entity %all1 foll[+ ! discov]y ( a brea* ( security1 notify ea* individual :o is a citiz5 or resid5t ( ! ,unit$ ,/ates ^: p]sonal in=mation 01 or is reasonably believ$ to h be51 acquir$ or access$ by an unau?oriz$ p]son1 or us$ = an unau?oriz$ purpose4 7#b7 ,timel9ess ( notification 7,a7 ,9 g5]al ,unless subject to a delay au?oriz$ "u subp>agraph 7,b71 a notification requir$ "u p>agraph 7#a7 %all be made z exp$iti\sly z practicable & )\t unreasonable delay1 b n lat] ?an #cj days foll[+ ! discov]y ( a brea* ( security4 7,b7 ,delay ( notification au?oriz$ = law en=cem5t or national security purposes 7i7 ,law en=cem5t ,if a ,f$]al or ,/ate law en=cem5t ag5cy1 includ+ an attorney g5]al ( a ,/ate1 det]m9es t ! notification requir$ "u ?is section w\ld imp$e a civil or crim9al inve/igation1 su* notification %all be delay$ ^u ! writt5 reque/ ( ! law en=cem5t ag5cy = #cj days or su* less] p]iod ( "t :i* ! law en=cem5t ag5cy det]m9es is reasonably necess>y & reque/s 9 writ+4 ,su* law en=cem5t ag5cy may1 by a subsequ5t writt5 reque/1 revoke su* delay or ext5d ! p]iod ( "t set =? 9 ! orig9al reque/ made "u ?is p>agraph if fur!r delay is necess>y4 7ii7 ,national security ,if a ,f$]al national security ag5cy or homel& security ag5cy det]m9es t ! notification requir$ "u ?is section w\ld ?reat5 national or homel& security1 su* notification may be delay$ = a p]iod ( "t :i* ! national security ag5cy or homel& security ag5cy det]m9es is reasonably necess>y & reque/s 9 writ+4 ,a ,f$]al national security ag5cy or homel& security ag5cy may revoke su* delay or ext5d ! p]iod ( "t set =? 9 ! orig9al reque/ made "u ?is p>agraph by a subsequ5t writt5 reque/ if fur!r delay is necess>y4 7b7 ,coord9ation ( notification ) cr$it report+ ag5cies ,if a cov]$ entity is requir$ to provide notification to m ?an #e1jjj individuals "u subsection 7a77#a71 ! cov]$ entity %all also notify ! major consum] report+ ag5cies t compile & ma9ta9 files on consum]s on a nationwide basis1 ( ! tim+ & di/ribution ( ! notifications4 ,su* notification %all be giv5 to ! cr$it report+ ag5cies )\t unreasonable delay &1 if su* notification w n delay notification to ! affect$ individuals1 prior to ! di/ribution ( notifications to ! affect$ individuals4 7c7 ,me?od & cont5t ( notification 7#a7 ,g5]al notification ,a cov]$ entity requir$ to provide notification to individuals "u subsection 7a77#a7 %all be 9 compliance ) su* requirem5t if ! cov]$ entity provides conspicu\s & cle>ly id5tifi$ notification by "o ( ! foll[+ me?ods 7provid$ ! select$ me?od c reasonably be expect$ to rea* ! int5d$ individual73 7,a7 ,writt5 notification to ! la/ kn[n home mail+ address ( ! individual 9 ! records ( ! cov]$ entity4 7,b7 ,notification by email or o!r electronic means1 if-- 7i7 ! cov]$ entity's prim>y me?od ( communication ) ! individual is by email or su* o!r electronic means2 or 7ii7 ! individual has cons5t$ to receive su* notification & ! notification is provid$ 9 a mann] t is consi/5t ) ! provisions p]mitt+ electronic transmission ( notifications "u section #aja ( ! ,electronic ,signatures 9 ,global ,comm]ce ,act 7#ae ,u4,s4,c4 #gjja74 7#b7 ,website notification ,! cov]$ entity %all also provide conspicu\s notification on ! ,int]net website ( ! cov]$ entity 7if su* cov]$ entity ma9ta9s su* a website7 = a p]iod ( n less ?an #ij days4 7#c7 ,m$ia notification ,if ! numb] ( resid5ts ( a ,/ate ^: p]sonal in=mation 01 or is reasonably believ$ to h be5 acquir$ or access$ by an unau?oriz$ p]son1 or us$ = an unau?oriz$ purpose exce$s #e1jjj1 ! cov]$ entity %all also provide notification 9 pr9t & to broadca/ m$ia1 includ+ major m$ia 9 metropolitan & rural areas :]e ! individuals ^: p]sonal in=mation 01 or is reasonably believ$ to h be51 acquir$ or access$ by an unau?oriz$ p]son1 or us$ = an unau?oriz$ purpose1 reside4 7#d7 ,cont5t ( notification 7,a7 ,9 g5]al ,reg>dless ( ! me?od by :i* notification is provid$ to an individual "u p>agraphs 7#a71 7#b71 & 7#c71 su* notification %all include-- 7i7 a description ( ! p]sonal in=mation t 01 or is reasonably believ$ to h be51 acquir$ or access$ by an unau?oriz$ p]son1 or us$ = an unau?oriz$ purpose2 7ii7 a telephone numb] t ! individual may use1 at no co/ to su* individual1 to contact ! cov]$ entity1 or ag5t ( ! cov]$ entity1 to inquire ab\t ! brea* ( security or ! in=mation ! cov]$ entity ma9ta9$ ab\t t individual2 7iii7 notification t ! individual is entitl$ to receive1 at no co/ to su* individual1 consum] cr$it reports on a qu>t]ly basis = a p]iod ( #e ye>s1 or cr$it monitor+ or o!r s]vice t enables consum]s to detect ! misuse ( _! p]sonal in=mation = a p]iod ( #e ye>s1 & in/ructions to ! individual on reque/+ su* reports or s]vice f ! cov]$ entity2 7iv7 ! toll-free contact telephone numb]s & addresses = ! major cr$it report+ ag5cies2 & 7v7 a toll-free telephone numb] & ,int]net website address = ! ,commission :]eby ! individual may obta9 in=mation reg>d+ id5tity !ft4 7,b7 ,direct bus9ess relation%ip ,reg>dless ( :e!r ! cov]$ entity or a designat$ ?ird p>ty provides notification "u ?is subsection1 su* notification %all id5tify ! cov]$ entity t has a direct bus9ess relation%ip ) ! individual4 7#e7 ,regulations = sub/itute notification ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all1 by regulation "u section #eec ( title #e1 ,unit$ ,/ates ,code-- 7,a7 e/abli% crit]ia = det]m9+ circum/ances "u :i* sub/itute notification may be provid$ 9 lieu ( direct notification requir$ by p>agraph 7#a71 includ+ crit]ia = det]m9+ if notification "u p>agraph 7#a7 is n feasible due to excessive co/s to ! cov]$ entity requir$ to provid$ su* notification relative to ! res\rces ( su* cov]$ entity2 & 7,b7 e/abli% ! =m & cont5t ( sub/itute notification4 7d7 ,notification = law en=cem5t & o!r purposes ,a cov]$ entity %all1 z exp$iti\sly z practicable & )\t unreasonable delay1 b n lat] ?an #ad days foll[+ ! discov]y ( a brea* ( security1 provide notification ( ! brea* to-- 7#a7 ! ,commission2 7#b7 ! ,f$]al ,bureau ( ,inve/igation2 7#c7 ! ,secret ,s]vice2 7#d7 = common c>ri]s1 ! ,f$]al ,communications ,commission2 7#e7 ! ,consum] ,f9ancial ,protection ,bureau2 & 7#f7 ! attorney g5]al ( ea* ,/ate 9 :i* ! p]sonal in=mation ( a resid5t or resid5ts ( ! ,/ate 01 or is reasonably believ$ to h be51 acquir$ or access$ by an unau?oriz$ p]son1 or us$ = an unau?oriz$ purpose4 7e7 ,o!r obligations foll[+ brea* 7#a7 ,9 g5]al ,a cov]$ entity requir$ to provide notification "u subsection 7a7 %all1 ^u reque/ ( an individual ^: p]sonal in=mation 0 includ$ 9 ! brea* ( security1 provide or arrange = ! provision (1 to ea* su* individual & at no co/ to su* individual-- 7,a7 consum] cr$it reports f ! major cr$it report+ ag5cies beg9n+ n lat] ?an #fj days foll[+ ! individual's reque/ & cont9u+ on a qu>t]ly basis = a p]iod ( #e ye>s !reaft]2 or 7,b7 a cr$it monitor+ or o!r s]vice t enables consum]s to detect ! misuse ( _! p]sonal in=mation1 beg9n+ n lat] ?an #fj days foll[+ ! individual's reque/ & cont9u+ = a p]iod ( #e ye>s4 7#b7 ,rulemak+ ,z "p ( ! ,commission's rulemak+ describ$ 9 subsection 7c77#e71 ! ,commission %all det]m9e ! circum/ances "u :i* a cov]$ entity requir$ to provide notification "u subsection 7a7 %all provide or arrange = ! provision ( free consum] cr$it reports or cr$it monitor+ or o!r s]vice to affect$ individuals4 7f7 ,website notification ( ,f$]al ,trade ,commission ,if ! ,commission1 ^u receiv+ notification ( any brea* ( security t is report$ to ! ,commission "u subsection 7d77#a71 f9ds t notification ( su* a brea* ( security via ! ,commission's ,int]net website w\ld be 9 ! public int]e/ or = ! protection ( consum]s1 ! ,commission %all place su* a notification 9 a cle> & conspicu\s location on its ,int]net website4 7g7 ,website notification ( ,/ate attorneys g5]al ,if a ,/ate attorney g5]al1 ^u receiv+ notification ( any brea* ( security t is report$ to ! ,commission "u subsection 7d77#e71 f9ds t notification ( su* a brea* ( security ?r\gh ! ,/ate attorney g5]al's ,int]net website w\ld be 9 ! public int]e/ or = ! protection ( consum]s1 ! ,/ate attorney g5]al %all place su* a notification 9 a cle> & conspicu\s location on its ,int]net website4 7h7 ,,ftc /udy on notification 9 languages 9 addition to ,engli% ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,commission %all conduct a /udy on ! practicality & co/ effectiv5ess ( requir+ ! notification requir$ by subsection 7c77#a7 to be provid$ 9 a language 9 addition to ,engli% to individuals kn[n to speak only su* o!r language4 7i7 ,education & outrea* = small bus9esses ,! ,commission %all conduct education & outrea* = small bus9ess conc]ns on data security practices & h[ to prev5t hack+ & o!r unau?oriz$ access to1 acquisition (1 or use ( data ma9ta9$ by su* small bus9ess conc]ns4 7j7 ,website on data security be/ practices ,! ,commission %all e/abli% & ma9ta9 an ,int]net website conta9+ non-b9d+ be/ practices = bus9esses reg>d+ data security & h[ to prev5t hack+ & o!r unau?oriz$ access to1 acquisition (1 or use ( data ma9ta9$ by su* bus9esses4 7k7 ,g5]al rulemak+ au?ority 7#a7 ,9 g5]al ,! ,commission may promulgate regulations necess>y "u section #eec ( title #e1 ,unit$ ,/ates ,code1 to effectively en=ce ! requirem5ts ( ?is section4 7#b7 ,limitation ,9 promulgat+ rules "u ?is ,act1 ! ,commission %all n require ! deploym5t or use ( any specific products or te*nologies1 includ+ any specific comput] s(tw>e or h>dw>e4 7l7 ,treatm5t ( p]sons gov]n$ by o!r law ,a cov]$ entity :o is 9 compliance ) any o!r ,f$]al law t requires su* cov]$ entity to provide notification to individuals foll[+ a brea* ( security1 %all be deem$ to be 9 compliance ) ?is section ) respect to activities & in=mation cov]$ "u su* ,f$]al law4 #d4 ,application & en=cem5t 7a7 ,en=cem5t by ! f$]al ,trade ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation ( section #b or #c %all be treat$ z an unfair & deceptive act or practice 9 violation ( a regulation "u section #ah7;a77#a77;,b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 reg>d+ unfair or deceptive acts or practices & %all be subject to en=cem5t by ! ,commission "u t ,act ) respect to any cov]$ entity4 ,all ( ! functions & p[]s ( ! ,commission "u ! ,f$]al ,trade ,commission ,act are available to ! ,commission to en=ce compliance by any p]son ) ! requirem5ts impos$ "u ?is title1 irrespective ( :e!r t p]son is engag$ 9 comm]ce or meets any o!r jurisdictional te/s "u ! ,f$]al ,trade ,commission ,act4 7#b7 ,coord9ation ) ,f$]al ,communications ,commission ,:]e en=cem5t relates to entities subject to ! au?ority ( ! ,f$]al ,communications ,commission1 en=cem5t actions by ! ,commission w be coord9at$ ) ! ,f$]al ,communications ,commission4 7#c7 ,coord9ation ) ,consum] ,f9ancial ,protection ,bureau ,:]e en=cem5t relates to f9ancial in=mation or in=mation associat$ ) ! provision ( f9ancial products or s]vices1 en=cem5t actions by ! ,commission w be coord9at$ ) ! ,consum] ,f9ancial ,protection ,bureau4 7b7 ,en=cem5t by ,/ate attorneys g5]al 7#a7 ,9 g5]al ,if ! *ief law en=cem5t (fic] ( a ,/ate1 or an (ficial or ag5cy designat$ by a ,/ate1 has reason to believe t any cov]$ entity has violat$ or is violat+ section #b or #c ( ?is ,act1 ! attorney g5]al1 (ficial1 or ag5cy ( ! ,/ate1 9 addition to any au?ority x may h to br+ an action 9 ,/ate c\rt "u its consum] protection law1 may br+ a civil action 9 any appropriate ,unit$ ,/ates di/rict c\rt or 9 any o!r c\rt ( compet5t jurisdiction1 includ+ a ,/ate c\rt1 to-- 7,a7 enjo9 fur!r su* violation by ! def5dant2 7,b7 en=ce compliance ) ?is su* section2 7,c7 obta9 civil p5alties 9 ! am\nt det]m9$ "u p>agraph 7#b72 & 7,d7 obta9 damages1 re/itution1 or o!r comp5sation on behalf ( resid5ts ( ! ,/ate4 7#b7 ,civil p5alties 7,a7 ,calculation 7i7 ,treatm5t ( violations ( section #b ,= purposes ( p>agraph 7#a77;,c7 ) reg>d to a violation ( section #b1 ! am\nt det]m9$ "u ?is p>agraph is ! am\nt calculat$ by multiply+ ! numb] ( days t a cov]$ entity is n 9 compliance ) su* section by an am\nt to be det]m9$ by ! ,commission4 ,su* am\nt det]m9$ by ! ,commission %all be adju/$ z describ$ 9 ! ,f$]al ,civil ,p5alties ,inflation ,adju/m5t ,act ( #aiij 7,public ,law #aja-daj2 #bh ,u4,s4,c4 #bdfa note74 7ii7 ,treatm5t ( violations ( section #c ,= purposes ( p>agraph 7#a77;,c7 ) reg>d to a violation ( section #c1 ! am\nt det]m9$ "u ?is p>agraph is ! am\nt calculat$ by multiply+ ! numb] ( violations ( su* section by an am\nt to be det]m9$ by ! ,commission4 ,ea* failure to s5d notification z requir$ "u section #c to a citiz5 or resid5t ( ! ,unit$ ,/ates %all be treat$ z a sep>ate violation4 7,b7 ,adju/m5t = inflation ,beg9n+ on ! date t ! ,consum] ,price ,index is fir/ publi%$ by ! ,bureau ( ,labor ,/ati/ics t is aft] #a ye> aft] ! date ( enactm5t ( ?is ,act1 & ea* ye> !reaft]1 ! am\nts specifi$ 9 clauses 7i7 & 7ii7 ( subp>agraph 7,a7 %all be increas$ by ! p]c5tage increase 9 ! ,consum] ,price ,index publi%$ on t date f ! ,consum] ,price ,index publi%$ ! previ\s ye>4 7#c7 ,notice & int]v5tion by ! ,,ftc 7,a7 ,! attorney g5]al ( a ,/ate %all provide prior writt5 notice ( any action "u p>agraph 7#a7 to ! ,commission & provide ! ,commission ) a copy ( ! compla9t 9 ! action1 except 9 any case 9 :i* su* prior notice is n feasible1 9 :i* case ! attorney g5]al %all s]ve su* notice imm$iately ^u in/itut+ su* action4 ,! ,commission %all h ! "r-- 7i7 to int]v5e 9 ! action2 7ii7 ^u s int]v5+1 to be he>d on all matt]s aris+ !re92 & 7iii7 to file petitions = appeal4 7,b7 ,limitation on ,/ate action :ile ,f$]al action is p5d+ ,if ! ,commission has in/itut$ a civil action = violation ( ?is ,act1 no ,/ate attorney g5]al1 or (ficial or ag5cy ( a ,/ate1 may br+ an action "u ?is subsection dur+ ! p5d5cy ( t action aga9/ any def5dant nam$ 9 ! compla9t ( ! ,commission = any violation ( ?is ,act alleg$ 9 ! compla9t4 7#d7 ,relation%ip ) ,/ate-law claims ,if ! attorney g5]al ( a ,/ate has au?ority to br+ an action "u ,/ate law direct$ at acts or practices t also violate ?is ,act1 ! attorney g5]al may ass]t ! ,/ate-law claim & a claim "u ?is ,act 9 ! same civil action4 #e4 ,def9itions ,9 ?is ,act3 7#a7 ,brea* ( security ,! t]m brea* ( security means unau?oriz$ access to1 acquisition (1 sale (1 or use ( data conta9+ p]sonal in=mation4 7#b7 ,commission ,! t]m ,commission means ! ,f$]al ,trade ,commission4 7#c7 ,cov]$ entity ,! t]m cov]$ entity means-- 7,a7 any organization1 corporation1 tru/1 p>tn]%ip1 sole proprietor%ip1 un9corporat$ association1 or v5ture ov] :i* ! ,commission has au?ority pursuant to section #e7;a77#b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b772 7,b7 not)/&+ section #e7;a77#b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b771 common c>ri]s subject to ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #aea et seq472 & 7,c7 not)/&+ sections #d & #e7;a77#b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd & #de7;a77#b771 any non-pr(it organization1 includ+ any organization describ$ 9 section #eja7;c7 ( ! ,int]nal ,rev5ue ,code ( #aihf t is exempt f taxation "u section #eja7;a7 ( ! ,int]nal ,rev5ue ,code ( #aihf4 7#d7 ,p]sonal in=mation 7,a7 ,def9ition ,! t]m p]sonal in=mation means any in=mation or compilation ( in=mation t includes any ( ! foll[+3 7i7 ,an individual's fir/ "n or initial & la/ "n 9 comb9ation ) any ( ! foll[+ data elem5ts = t individual3 7,i7 ,home address or telephone numb]4 7,,ii7 ,"m's maid5 "n4 7,,iii7 ,mon?1 day1 & ye> ( bir?4 7,,iv7 ,us] "n or electronic mail address4 7ii7 ,driv]'s lic5se numb]1 passport numb]1 milit>y id5tification numb]1 ali5 regi/ration numb]1 or o!r simil> numb] issu$ on a gov]nm5t docum5t us$ to v]ify id5tity4 7iii7 ,unique acc\nt id5tifi]1 includ+ a f9ancial acc\nt numb]1 or cr$it or debit c>d numb]1 electronic id5tification numb]1 us] "n1 or r\t+ code4 7iv7 ,p>tial or complete ,social ,security numb]4 7v7 ,unique biometric or g5etic data su* z a f+]pr9t1 voice pr9t1 a ret9a or iris image1 or any o!r unique physical repres5tations4 7vi7 ,in=mation t c\ld be us$ to access an individual's acc\nt1 su* z us] "n & password or e-mail address & password4 7vii7 ,any two or m ( ! foll[+ data elem5ts3 7,i7 ,an individual's fir/ & la/ "n or fir/ initial & la/ "n4 7,,ii7 ,a unique acc\nt id5tifi]1 includ+ a f9ancial acc\nt numb] or cr$it or debit c>d numb]1 electronic id5tification numb]1 us] "n1 or r\t+ code4 7,,iii7 ,any security code1 access code1 or password1 or s\rce code t c\ld be us$ to g5]ate su* codes or passwords4 7viii7 ,in=mation g5]at$ or d]iv$ f ! op]ation or use ( an electronic communications device t is suffici5t to id5tify ! /reet "n & "n ( ! city or t[n 9 :i* ! device is locat$4 7ix7 ,any in=mation reg>d+ an individual's m$ical hi/ory1 m5tal or physical condition1 m$ical treatm5t or diagnosis by a heal? c>e pr(essional1 or ! provision ( heal? c>e to ! individual1 includ+ heal? in=mation provid$ to a website or mobile application4 7x7 ,a heal? insurance policy numb] or subscrib] id5tification numb] & any unique id5tifi] us$ by a heal? insur] to id5tify ! individual1 or any in=mation 9 an individual's heal? insurance application & claims hi/ory1 includ+ any appeals records4 7xi7 ,digitiz$ or o!r electronic signature4 7xii7 ,nonpublic communications or o!r us]-creat$ cont5t su* z emails1 photographs1 or videos4 7xiii7 ,any record or in=mation conc]n+ payroll1 income1 f9ancial acc\nts1 mortgages1 loans1 l9es ( cr$it1 utility bills1 accumulat$ pur*ases1 or any o!r in=mation reg>d+ f9ancial assets1 obligations1 or sp5d+ habits4 7xiv7 ,any additional elem5t ! ,commission def9es z p]sonal in=mation4 7,b7 ,modifi$ def9ition by rulemak+ ,! ,commission may1 by rule promulgat$ "u section #eec ( title #e1 ,unit$ ,/ates ,code1 modify ! def9ition ( p]sonal in=mation "u subp>agraph 7,a74 7#e7 ,/ate ,! t]m ,/ate means ea* ( ! sev]al ,/ates1 ! ,di/rict ( ,columbia1 ! ,commonweal? ( ,pu]to ,rico1 ,guam1 ,am]ican ,samoa1 ! ,unit$ ,/ates ,virg9 ,isl&s1 ! ,commonweal? ( ! ,nor!rn ,m>iana ,isl&s1 any o!r t]ritory or possession ( ! ,unit$ ,/ates1 & ea* f$]ally recogniz$ ,indian tribe4 #f4 ,effect on o!r laws 7a7 ,effect on ,/ate data security & brea* notification laws ,?is ,act sup]s$es any provision ( a /atute or regulation ( a ,/ate or political subdivision ( a ,/ate1 ) respect to a cov]$ entity1 t expressly-- 7#a7 requires in=mation security practices = ! treatm5t & protection ( p]sonal in=mation simil> to any ( ^? requir$ "u section #b2 or 7#b7 requires notification to individuals ( a brea* ( security ( p]sonal in=mation4 7b7 ,effect on o!r ,/ate laws ,no?+ 9 ?is ,act %all be con/ru$ to-- 7#a7 preempt or limit any provision ( any law1 rule1 regulation1 requirem5t1 /&>d1 or o!r provision hav+ ! =ce & effect ( law ( any ,/ate1 includ+ any ,/ate consum] protection law1 any ,/ate law relat+ to acts ( fraud or deception1 & any ,/ate trespass1 contract1 or tort law2 7#b7 prev5t or limit ! attorney g5]al ( a ,/ate f ex]cis+ ! p[]s conf]r$ ^u ! attorney g5]al by ! laws ( ! ,/ate1 includ+ conduct+ inve/igations1 adm9i/]+ oa?s or affirmations1 or compell+ ! att5dance ( witnesses or ! production ( docum5t>y & o!r evid5ce2 or 7#c7 preempt or limit any provision ( any law1 rule1 regulation1 requirem5t1 /&>d1 or o!r provision hav+ ! =ce & effect ( law ( any ,/ate ) respect to any p]son t is n a cov]$ entity4 7c7 ,pres]vation ( au?ority 7#a7 ,f$]al ,trade ,commission ,no?+ 9 ?is ,act may be con/ru$ 9 any way to limit ! ,commission's au?ority "u any o!r provision ( law4 7#b7 ,f$]al ,communications ,commission ,no?+ 9 ?is ,act may be con/ru$ 9 any way to limit or affect ! ,f$]al ,communication ,commission's au?ority "u any o!r provision ( law4 7#c7 ,consum] ,f9ancial ,protection ,bureau ,no?+ 9 ?is ,act may be con/ru$ 9 any way to limit or affect ! ,consum] ,f9ancial ,protection ,bureau's au?ority "u any o!r provision ( law4 #g4 ,effective date ,?is ,act %all take effect #ij days aft] ! date ( enactm5t ( ?is ,act4