,,ii  #aae? ,,congress  #a/ ,session    
,s4 #aijj  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,septemb] #bh1 #bjag   
,mr4 ,blum5?al introduc$ ! foll[+ bill2 
:i* 0 read twice & ref]r$ to !          
,committee on ,comm]ce1 ,sci5ce1 &      
,transportation  ,a ,,bill  ,to require 
all p]sons :o acquire1 ma9ta91 or use   
p]sonal in=mation to h 9 effect         
reasonable cyb]security protections &   
practices :5ev] acquir+1 ma9ta9+1 or us+
 p]sonal in=mation 9 comm]ce1 & = o!r   
purposes4  #a4 ,%ort title  ,?is ,act   
may be cit$ z ! ,data ,brea*            
,acc\ntability & ,en=cem5t ,act ( #bjag4
  #b4 ,requirem5t to implem5t reasonable
 cyb]security protections & practices   
7a7 ,requirem5t ,no cov]$ entity may    
acquire1 ma9ta91 or use p]sonal         
in=mation 9 comm]ce )\t hav+ 9 effect   
reasonable cyb]security protections &   
practices4  7b7 ,en=cem5t by ,f$]al     
,trade ,commission  7#a7 ,unfair or     
deceptive acts or practices ,a violation
 ( subsection 7a7 by a cov]$ entity %all

 be treat$ z a violation ( a rule def9+ 
an unfair or deceptive act or practice  
prescrib$ "u section #ah7;a77#a77;,b7 ( 
! ,f$]al ,trade ,commission ,act 7#ae   
,u4,s4,c4 #eg;a7a77#a77;,b774  7#b7     
,p[]s ( ,commission  7,a7 ,9 g5]al      
,except z provid$ 9 subp>agraph 7,c71 ! 
,f$]al ,trade ,commission %all en=ce ?is
 section 9 ! same mann]1 by ! same      
means1 & ) ! same jurisdiction1 p[]s1 & 
duties z ?\gh all applicable t]ms &     
provisions ( ! ,f$]al ,trade ,commission
 ,act 7#ae ,u4,s4,c4 #da et seq47 7     
incorporat$ into & made a "p ( ?is ,act4
  7,b7 ,privileges & immunities ,except 
z provid$ 9 subp>agraph 7,c71 any p]son 
:o violates ?is section %all be subject 
to ! p5alties & entitl$ to ! privileges 
& immunities provid$ 9 ! ,f$]al ,trade  
,commission ,act 7#ae ,u4,s4,c4 #da et  
seq474  7,c7 ,applicability to all cov]$
 entities  7i7 ,9 g5]al ,! ,f$]al ,trade
 ,commission %all en=ce ?is section )   
respect to a p]son describ$ 9 clause    
7ii7 z if su* p]son 7 a p]son ov] :i* ! 

,commission has au?ority pursuant to    
section #e7;a77#b7 ( ! ,f$]al ,trade    
,commission ,act 7#ae ,u4,s4,c4         
#de7;a77#b77 &1 not)/&+ sections #d1    
#e7;a77#b71 & #f ( su* ,act 7#ae        
,u4,s4,c4 #dd1 #de7;a77#b71 & #df71 n   
jurisdictional limitation ( !           
,commission ) respect to a p]son        
describ$ 9 clause 7ii7 %all apply =     
purposes ( ?is section4  7ii7 ,p]sons   
describ$ ,a p]son describ$ 9 ?is clause 
is-- 7,i7 a bank1 a sav+s & loan        
in/itution1 a ,f$]al cr$it union1 a     
common c>ri]1 an air c>ri] or =eign air 
c>ri]1 or a p]son1 p>tn]%ip1 or         
corporation ins(> z x is subject to !   
,pack]s & ,/ocky>ds ,act1 #aiba1 z      
describ$ 9 section #e7;a77#b7 ( ! ,f$]al
 ,trade ,commission ,act 7#ae ,u4,s4,c4 
#de7;a77#b772 or  7,,ii7 an organization
 :i* is n organiz$ to c>ry on bus9ess = 
its own pr(it or t ( its memb]s4  7#c7  
,regulations  7,a7 ,9 g5]al ,! ,f$]al   
,trade ,commission %all promulgate1 9   
accordance ) section #eec ( title #e1   

,unit$ ,/ates ,code1 su* regulations z  
may be necess>y to c>ry out ?is section4
  7,b7 ,m9imum /&>ds ,9 promulgat+ any  
/&>ds = cyb]security protections &      
practices to c>ry out ?is section1 !    
,commission %all ensure t any su* /&>ds 
t w\ld safegu>d cu/om] in=mation d s z  
well z or bett] ?an ! /&>ds set =? "u "p
 #cad ( title #af1 ,code ( ,f$]al       
,regulations1 z 9 effect on ! day be=e !
 date ( ! enactm5t ( ?is ,act4  7#d7    
,civil p5alties ,not)/&+ section #e7m7 (
 ! ,f$]al ,trade ,commission ,act 7#ae  
,u4,s4,c4 #de7m771 a civil p5alty       
recov]$ "u su* section may be 9 excess (
 am\nts provid$ = 9 su* section z ! c\rt
 f9ds appropriate to det] violations (  
subsection 7a7 ( ?is section4  7c7      
,def9itions ,9 ?is section3 7#a7 ,brea* 
( security  7,a7 ,9 g5]al ,! t]m brea* (
 security means compromise ( ! security1
 confid5tiality1 or integrity (1 or loss
 (1 data 9 electronic =m t results 91 or
 !re is a reasonable basis to conclude  
has result$ 91 unau?oriz$ access to or  

acquisition ( p]sonal in=mation f a     
cov]$ entity4  7,b7 ,exclusions ,! t]m  
brea* ( security does n include--  7i7 a
 good fai? acquisition ( p]sonal        
in=mation by a cov]$ entity1 or an      
employee or ag5t ( a cov]$ entity1 if ! 
p]sonal in=mation is n subject to fur!r 
use or unau?oriz$ disclosure2  7ii7 any 
lawfully au?oriz$ inve/igative1         
protective1 or intellig5ce activity ( a 
law en=cem5t or an intellig5ce ag5cy ( !
 ,unit$ ,/ates1 a ,/ate1 or a political 
subdivision ( a ,/ate2 or  7iii7 !      
release ( a public record n o!rwise     
subject to confid5tiality or            
nondisclosure requirem5ts4  7#b7 ,cov]$ 
entity ,! t]m cov]$ entity means a sole 
proprietor%ip1 p>tn]%ip1 corporation1   
tru/1 e/ate1 coop]ative1 association1 or
 o!r comm]cial entity1 & any *>itable1  
educational1 or nonpr(it organization1 t
 acquires1 ma9ta9s1 or utilizes p]sonal 
in=mation4  7#c7 ,data 9 electronic =m  
,! t]m data 9 electronic =m means any   
data /or$ electronically or digitally on

 any comput] sy/em or o!r database1     
includ+ recordable tapes & o!r mass     
/orage devices4  7#d7 ,id5tity !ft ,!   
t]m id5tity !ft means ! unau?oriz$ use (
 ano!r p]son's p]sonal in=mation = !    
purpose ( engag+ 9 comm]cial            
transactions "u ! id5tity ( su* o!r     
p]son1 includ+ any contact t violates   
section #ajbh;,a ( title #ah1 ,unit$    
,/ates ,code4  7#e7 ,p]sonal in=mation  
7,a7 ,def9ition ,! t]m p]sonal in=mation
 means any in=mation or compilation (   
in=mation t includes--  7i7 a           
non-truncat$ ,social ,security numb]2   
7ii7 a f9ancial acc\nt numb] or cr$it or
 debit c>d numb] 9 comb9ation ) any     
security code1 access code1 or password 
t is requir$ = an individual to obta9   
cr$it1 )draw funds1 or engage 9 a       
f9ancial transaction2 or  7iii7 an      
individual's fir/ & la/ "n or fir/      
initial & la/ "n 9 comb9ation )--  7,i7 
a driv]'s lic5se numb]1 a passport      
numb]1 or an ali5 regi/ration numb]1 or 
o!r simil> numb] issu$ on a gov]nm5t    

docum5t us$ to v]ify id5tity2  7,,ii7   
unique biometric data su* z a f+]pr9t1  
voice pr9t1 ret9a or iris image1 or any 
o!r unique physical repres5tation2      
7,,iii7 a unique acc\nt id5tifi]1       
electronic id5tification numb]1 us] "n1 
or r\t+ code 9 comb9ation ) any         
associat$ security code1 access code1 or
 password t is requir$ = an individual  
to obta9 money1 goods1 s]vices1 or any  
o!r ?+ ( value2 or  7,,iv7 #b ( !       
foll[+3  7aa7 ,home address or telephone
 numb]4  7bb7 ,"m's maid5 "n1 if        
id5tifi$ z su*4  7cc7 ,mon?1 day1 & ye> 
( bir?4  7,b7 ,modifi$ def9ition by     
rulemak+ ,if ! ,f$]al ,trade ,commission
 det]m9es t ! def9ition "u subp>agraph  
7,a7 is n reasonably suffici5t to       
protect individuals f id5tity !ft1      
fraud1 or o!r unlawful conduct1 !       
,commission by rule promulgat$ "u       
section #eec ( title #e1 ,unit$ ,/ates  
,code1 may modify ! def9ition ( p]sonal 
in=mation "u subp>agraph 7,a7 to ! ext5t
 ! modification w n unreasonably imp$e  

int]/ate comm]ce4