,,ii #aaeth ,,congress #ast ,session ,s4 #aijj ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,september #bh1 #bjag ,mr4 ,blumenthal introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to require all persons who acquire1 maintain1 or use personal information to have in effect reasonable cybersecurity protections and practices whenever acquiring1 maintaining1 or using personal information in commerce1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,data ,breach ,accountability and ,enforcement ,act of #bjag4 #b4 ,requirement to implement reasonable cybersecurity protections and practices 7a7 ,requirement ,no covered entity may acquire1 maintain1 or use personal information in commerce without having in effect reasonable cybersecurity protections and practices4 7b7 ,enforcement by ,federal ,trade ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of subsection 7a7 by a covered entity shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,powers of ,commission 7,a7 ,in general ,except as provided in subparagraph 7,c71 the ,federal ,trade ,commission shall enforce this section in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7,b7 ,privileges and immunities ,except as provided in subparagraph 7,c71 any person who violates this section shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7,c7 ,applicability to all covered entities 7i7 ,in general ,the ,federal ,trade ,commission shall enforce this section with respect to a person described in clause 7ii7 as if such person were a person over which the ,commission has authority pursuant to section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b77 and1 notwithstanding sections #d1 #e7;a77#b71 and #f of such ,act 7#ae ,u4,s4,c4 #dd1 #de7;a77#b71 and #df71 not jurisdictional limitation of the ,commission with respect to a person described in clause 7ii7 shall apply for purposes of this section4 7ii7 ,persons described ,a person described in this clause is-- 7,i7 a bank1 a savings and loan institution1 a ,federal credit union1 a common carrier1 an air carrier or foreign air carrier1 or a person1 partnership1 or corporation insofar as it is subject to the ,packers and ,stockyards ,act1 #aiba1 as described in section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b772 or 7,,ii7 an organization which is not organized to carry on business for its own profit or that of its members4 7#c7 ,regulations 7,a7 ,in general ,the ,federal ,trade ,commission shall promulgate1 in accordance with section #eec of title #e1 ,united ,states ,code1 such regulations as may be necessary to carry out this section4 7,b7 ,minimum standards ,in promulgating any standards for cybersecurity protections and practices to carry out this section1 the ,commission shall ensure that any such standards that would safeguard customer information do so as well as or better than the standards set forth under part #cad of title #af1 ,code of ,federal ,regulations1 as in effect on the day before the date of the enactment of this ,act4 7#d7 ,civil penalties ,notwithstanding section #e7m7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7m771 a civil penalty recovered under such section may be in excess of amounts provided for in such section as the court finds appropriate to deter violations of subsection 7a7 of this section4 7c7 ,definitions ,in this section3 7#a7 ,breach of security 7,a7 ,in general ,the term breach of security means compromise of the security1 confidentiality1 or integrity of1 or loss of1 data in electronic form that results in1 or there is a reasonable basis to conclude has resulted in1 unauthorized access to or acquisition of personal information from a covered entity4 7,b7 ,exclusions ,the term breach of security does not include-- 7i7 a good faith acquisition of personal information by a covered entity1 or an employee or agent of a covered entity1 if the personal information is not subject to further use or unauthorized disclosure2 7ii7 any lawfully authorized investigative1 protective1 or intelligence activity of a law enforcement or an intelligence agency of the ,united ,states1 a ,state1 or a political subdivision of a ,state2 or 7iii7 the release of a public record not otherwise subject to confidentiality or nondisclosure requirements4 7#b7 ,covered entity ,the term covered entity means a sole proprietorship1 partnership1 corporation1 trust1 estate1 cooperative1 association1 or other commercial entity1 and any charitable1 educational1 or nonprofit organization1 that acquires1 maintains1 or utilizes personal information4 7#c7 ,data in electronic form ,the term data in electronic form means any data stored electronically or digitally on any computer system or other database1 including recordable tapes and other mass storage devices4 7#d7 ,identity theft ,the term identity theft means the unauthorized use of another person's personal information for the purpose of engaging in commercial transactions under the identity of such other person1 including any contact that violates section #ajbh;,a of title #ah1 ,united ,states ,code4 7#e7 ,personal information 7,a7 ,definition ,the term personal information means any information or compilation of information that includes-- 7i7 a non-truncated ,social ,security number2 7ii7 a financial account number or credit or debit card number in combination with any security code1 access code1 or password that is required for an individual to obtain credit1 withdraw funds1 or engage in a financial transaction2 or 7iii7 an individual's first and last name or first initial and last name in combination with-- 7,i7 a driver's license number1 a passport number1 or an alien registration number1 or other similar number issued on a government document used to verify identity2 7,,ii7 unique biometric data such as a fingerprint1 voice print1 retina or iris image1 or any other unique physical representation2 7,,iii7 a unique account identifier1 electronic identification number1 user name1 or routing code in combination with any associated security code1 access code1 or password that is required for an individual to obtain money1 goods1 services1 or any other thing of value2 or 7,,iv7 #b of the following3 7aa7 ,home address or telephone number4 7bb7 ,mother's maiden name1 if identified as such4 7cc7 ,month1 day1 and year of birth4 7,b7 ,modified definition by rulemaking ,if the ,federal ,trade ,commission determines that the definition under subparagraph 7,a7 is not reasonably sufficient to protect individuals from identity theft1 fraud1 or other unlawful conduct1 the ,commission by rule promulgated under section #eec of title #e1 ,united ,states ,code1 may modify the definition of personal information under subparagraph 7,a7 to the extent the modification will not unreasonably impede interstate commerce4