,,ii #aaeth ,,congress #ast ,session ,s4 #babd ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,november #ad1 #bjag,mr4 ,leahy 7for himself1 ,mr4 ,markey1 ,mr4 ,blumenthal1 ,mr4 ,wyden1 ,mr4 ,franken1 ,ms4 ,baldwin1 and ,ms4 ,harris7 introduced the following bill2 which was read twice and referred to the ,committee on the ,judiciary ,a ,,bill ,to ensure the privacy and security of sensitive personal information1 to prevent and mitigate identity theft1 to provide notice of security breaches involving sensitive personal information1 and to enhance law enforcement assistance and other protections against security breaches1 fraudulent access1 and misuse of personal information4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,consumer ,privacy ,protection ,act of #bjag4 7b7 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4,sec4 #b4 ,findings4,sec4 #c4 ,definitions4,,title ,i--,punishment for concealment of security breaches and tools to combat cybercrime,sec4 #aja4 ,concealment of security breaches involving sensitive personally identifiable information4,sec4 #ajb4 ,reporting of certain cybercrimes4,sec4 #ajc4 ,authority to shut down botnets4,sec4 #ajd4 ,deterring the development and sale of computer and cell phone spying devices4,,title ,,ii--,consumer privacy and security of sensitive personally identifiable information,subtitle ,a--,consumer privacy and data security program,sec4 #bja4 ,purpose and applicability of consumer privacy and data security program4,sec4 #bjb4 ,requirements for consumer privacy and data security program4,sec4 #bjc4 ,federal enforcement4,sec4 #bjd4 ,enforcement by ,state attorneys general4,sec4 #bje4 ,relation to other laws4,subtitle ,b--,security breach notification and protection,sec4 #baa4 ,notice to individuals2 protection4,sec4 #bab4 ,exemptions4,sec4 #bac4 ,methods of notice4,sec4 #bad4 ,content of notification4,sec4 #bae4 ,coordination of notification with credit reporting agencies4,sec4 #baf4 ,notice to the ,federal ,trade ,commission4,sec4 #bag4 ,notice to law enforcement4,sec4 #bah4 ,federal enforcement4,sec4 #bai4 ,enforcement by ,state attorneys general4,sec4 #bbj4 ,effect on ,federal and ,state law4,sec4 #bba4 ,reporting on exemptions4,sec4 #bbb4 ,effective date4,,title ,,iii--,compliance with statutory ,pay-,as-,you-,go ,act,sec4 #cja4 ,budget compliance4 #b4 ,findings ,congress finds that-- 7#a7 databases of sensitive personally identifiable information are increasingly prime targets of hackers1 nation-state actors1 identity thieves1 rogue employees1 and other criminals1 including organized and sophisticated criminal operations2 7#b7 security breaches caused by such criminal acts are a serious threat to consumer privacy1 consumer confidence1 homeland security1 national security1 e-commerce1 and economic stability2 7#c7 misuse of sensitive personally identifiable information has the potential to cause serious or irreparable harm to an individual's livelihood1 privacy1 and liberty and undermine efficient and effective business and government operations2 7#d7 identity theft is a serious threat to the ,nation's economic stability1 national security1 homeland security1 cybersecurity1 the development of e-commerce1 and the privacy rights of ,americans2 7#e7 it is important for business entities that own1 use1 store1 or license sensitive personally identifiable information to adopt reasonable policies and procedures to help ensure the security and privacy of sensitive personally identifiable information2 and 7#f7 individuals whose personal information has been compromised or who have been victims of identity theft should receive the necessary information and assistance to mitigate any potential damage4 #c4 ,definitions ,in this ,act1 the following definitions shall apply3 7#a7 ,affiliate ,the term affiliate means persons related by common ownership or by corporate control4 7#b7 ,agency ,the term agency has the same meaning given such term in section #eea of title #e1 ,united ,states ,code4 7#c7 ,business entity ,the term business entity means any organization1 corporation1 trust1 partnership1 sole proprietorship1 unincorporated association1 or venture established to make a profit1 or a nonprofit organization4 7#d7 ,consumer privacy and data security program ,the term consumer privacy and data security program means the program described in section #bjb7;a74 7#e7 ,consumer reporting agency ,the term consumer reporting agency means a consumer reporting agency described in section #fjc7p7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a7p774 7#f7 ,covered entity ,the term covered entity means any business entity1 other than a service provider1 that collects1 uses1 accesses1 transmits1 stores1 or disposes of sensitive personally identifiable information1 including a consumer reporting agency4 7#g7 ,designated entity ,the term designated entity means the ,federal ,government entity designated by the ,secretary of ,homeland ,security under section #bag7;a74 7#h7 ,encryption ,the term encryption-- 7,a7 means the protection of data in electronic form1 in storage or in transit1 using an encryption technology that has been generally accepted by experts in the field of information security that renders such data indecipherable in the absence of associated cryptographic keys necessary to enable decryption of such data2 and 7,b7 includes appropriate management and safeguards of such cryptographic keys so as to protect the integrity of the encryption4 7#i7 ,identity theft ,the term identity theft means a violation of section #ajbh7;a77#g7 of title #ah1 ,united ,states ,code4 7#aj7 ,security breach 7,a7 ,in general ,the term security breach means compromise of the privacy1 integrity1 or security of computerized data that results in1 or that there is a reasonable basis to conclude has resulted in1 unauthorized access to or acquisition of sensitive personally identifiable information4 7,b7 ,exclusion ,the term security breach does not include-- 7i7 a good faith access or acquisition of sensitive personally identifiable information by a business entity1 or an employee or agent of a business entity1 if the sensitive personally identifiable information is not subject to further unauthorized disclosure2 7ii7 the release of a public record not otherwise subject to confidentiality or nondisclosure requirements2 or 7iii7 any lawfully authorized investigative1 protective1 or intelligence activity of a law enforcement or intelligence agency of the ,united ,states1 a ,state1 or a political subdivision of a ,state4 7#aa7 ,sensitive personally identifiable information ,the term sensitive personally identifiable information means any information or compilation of information1 in electronic or digital form that identifies or could be used to identify a particular person1 including the following3 7,a7 ,a non-truncated ,social ,security number1 a driver's license number1 passport number1 or alien registration number or other government-issued unique identification number4 7,b7 ,a financial account number or credit or debit card number in combination with any security code1 access code1 or password if required for an individual to obtain credit1 withdraw funds1 or engage in financial transactions4 7,c7 ,a unique electronic account identifier1 including an online user name or e-mail address1 in combination with any security code1 access code1 password1 or security question and answer1 if required for an individual to obtain money1 goods1 services1 access to digital photographs1 digital videos or electronic communications1 or any other thing of value4 7,d7 ,unique biometric data1 such as faceprint1 fingerprint1 voice print1 a retina or iris image1 or any other unique physical representation4 7,e7 ,an individual's first and last name or first initial and last name in combination with any information that relates to the individual's past1 present1 or future physical or mental health or condition1 or to the provision of health care to or diagnosis of the individual1 including health insurance information such as a health insurance policy number or subscriber identification number1 or any information in an individual's health insurance application and claims history4 7,f7 ,information about an individual's geographic location generated by or derived from the operation or use of an electronic communications device that is sufficient to identify the street and name of the city or town in which the device is located1 excluding telephone numbers or network or internet protocol addresses4 7,g7 ,password-protected digital photographs and digital videos not otherwise available to the public4 7#ab7 ,service provider ,the term service provider means a business entity that provides electronic data transmission1 routing1 intermediate and transient storage1 or connections to its system or network1 where the business entity providing such services does not select or modify the content of the electronic data1 is not the sender or the intended recipient of the data1 and the business entity transmits1 routes1 or provides connections for sensitive personally identifiable information in a manner that sensitive personally identifiable information is undifferentiated from other types of data that such business entity transmits1 routes1 or provides connections4 ,any such business entity shall be treated as a service provider under this ,act only to the extent that it is engaged in the provision of such transmission1 routing1 intermediate and transient storage or connections4 ,i ,punishment for concealment of security breaches and tools to combat cybercrime #aja4 ,concealment of security breaches involving sensitive personally identifiable information 7a7 ,in general ,chapter #dg of title #ah1 ,united ,states ,code1 is amended by adding at the end the following3 #ajda4 ,concealment of security breaches involving sensitive personally identifiable information 7a7 ,in general ,whoever1 having knowledge of a security breach and of the fact that notice of such security breach is required under title ,,ii of the ,consumer ,privacy ,protection ,act of #bjag1 intentionally and willfully conceals the fact of such security breach1 shall1 in the event that such security breach results in economic harm to any individual in the amount of #a1jjj or more1 be fined under this title or imprisoned for not more than #e years1 or both4 7b7 ,person defined ,for purposes of subsection 7a71 the term person has the meaning given the term in section #ajcj7;e77#ab74 4 7b7 ,conforming and technical amendments ,the table of sections for chapter #dg of title #ah1 ,united ,states ,code1 is amended by adding at the end the following3 #ajda4 ,concealment of security breaches involving sensitive personally identifiable information4 4 7c7 ,enforcement authority 7#a7 ,in general ,the ,united ,states ,secret ,service and the ,federal ,bureau of ,investigation shall have the authority to investigate offenses under section #ajda of title #ah1 ,united ,states ,code1 as added by subsection 7a74 7#b7 ,nonexclusivity ,the authority granted in paragraph 7#a7 shall not be exclusive of any existing authority held by any other ,federal agency4 #ajb4 ,reporting of certain cybercrimes ,section #ajcj of title #ah1 ,united ,states ,code1 is amended by striking subsection 7h7 and inserting the following3 7h7 ,reporting certain criminal cases ,not later than #a year after the date of the enactment of this subsection1 and annually thereafter1 the ,attorney ,general shall report to the ,committee on the ,judiciary of the ,senate and the ,committee on the ,judiciary of the ,house of ,representatives the number of criminal cases brought under subsection 7a7 that involve conduct in which-- 7#a7 the defendant-- 7,a7 exceeded authorized access to a nongovernmental computer2 or 7,b7 accessed a nongovernmental computer without authorization2 and 7#b7 the sole basis for the ,government determining that access to the nongovernmental computer was unauthorized1 or in excess of authorization1 was that the defendant violated a contractual obligation or agreement with a service provider or employer1 such as an acceptable use policy or terms of service agreement4 4 #ajc4 ,authority to shut down botnets 7a7 ,amendment ,section #acde of title #ah1 ,united ,states ,code1 is amended-- 7#a7 in the heading1 by inserting and abuse after fraud2 7#b7 in subsection 7a7-- 7,a7 in paragraph 7#a7-- 7i7 in subparagraph 7,b71 by striking or at the end2 7ii7 in subparagraph 7,c71 by inserting or after the semicolon2 and 7iii7 by inserting after subparagraph 7,c7 the following3 7,d7 violating section #ajcj7;a77#e7 where such conduct would damage 7as defined in section #ajcj71 #ajj or more protected computers 7as defined in section #ajcj7 during any #a-year period1 including by denying access to or operation of the computers1 installing unwanted software on the computers1 using the computers without authorization1 or obtaining information from the computers without authorization2 2 and 7,b7 in paragraph 7#b71 by inserting 1 a violation of section #ajcj7;a77#e7 as described in subsection 7a77#a77;,d71 before or a ,federal2 7#c7 in subsection 7b71 by adding 1 except in the case of a person violating section #ajcj7;a77#e7 in the manner described in subsection 7a77#a77;,d71 before take such other action2 and 7#d7 by adding at the end the following3 7c7 ,a restraining order or prohibition described in subsection 7b71 if issued in circumstances described in subsection 7a77#a77;,d7-- 7#a7 may only authorize action that solely affects persons violating section #ajcj in the manner described in subsection 7a77#a77;,d72 and 7#b7 may1 upon application of the ,attorney ,general-- 7,a7 specify that no cause of action shall lie in any court against a person for complying with the restraining order1 prohibition1 or other action2 and 7,b7 provide that the ,united ,states shall pay to such person a fee for reimbursement for such costs as are reasonably necessary and which have been directly incurred in complying with the restraining order1 prohibition1 or other action4 7d7 ,there are authorized to be appropriated to the ,department of ,justice1 the ,department of ,homeland ,security1 and the ,department of the ,treasury such sums as are necessary to implement this section1 including payments made by the ,united ,states of a fee for reimbursement4 4 7b7 ,technical and conforming amendment ,the table of sections for chapter #fc is amended by striking the item relating to section #acde and inserting the following3 #acde4 ,injunctions against fraud and abuse4 4 #ajd4 ,deterring the development and sale of computer and cell phone spying devices ,section #aief7;c77#g77;,d7 of title #ah1 ,united ,states ,code1 is amended by inserting section #beab 7relating to the manufacture1 distribution1 possession1 and advertising of wire1 oral1 or electronic communication intercepting devices71 before section #dfejb4 ,,ii ,consumer privacy and security of sensitive personally identifiable information ,a ,consumer privacy and data security program #bja4 ,purpose and applicability of consumer privacy and data security program 7a7 ,purpose ,the purpose of this subtitle is to ensure standards for developing and implementing administrative1 technical1 and physical safeguards to protect the security of sensitive personally identifiable information4 7b7 ,applicability ,a covered entity engaging in interstate commerce that collects1 uses1 accesses1 transmits1 stores1 or disposes of sensitive personally identifiable information in electronic or digital form of not less than #aj1jjj ,united ,states persons during any #ab-month period is subject to the requirements for a consumer privacy and data security program for protecting sensitive personally identifiable information4 7c7 ,limitations ,notwithstanding any other obligation under this subtitle1 this subtitle does not apply to the following3 7#a7 ,financial institutions ,financial institutions-- 7,a7 subject to and in compliance with the data security requirements and standards under section #eja7;b7 of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja7;b772 and 7,b7 subject to the jurisdiction of an agency or authority described in section #eje7;a7 of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhje7;a774 7#b7 ,,hipaa and hitech regulated entities ,an entity that is subject to and in compliance with the data security requirements of the following1 with respect to data that is subject to such requirements3 7,a7 ,section #acdja of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agica74 7,b7 ,part #afj or #afd of title #de1 ,code of ,federal ,regulations 7or any successor regulations74 7,c7 ,the regulations promulgated under section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acbj;d-#b note74 7,d7 ,in the case of a business associate1 as defined in section #acdjj of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agiba71 the applicable privacy and data security requirements of part #a of subtitle ,d of title ,,xiii of division ,a of the ,american ,reinvestment and ,recovery ,act of #bjji 7#db ,u4,s4,c4 #agica et seq474 7#c7 ,service providers ,a service provider for any electronic communication by a third party1 to the extent that the service provider is engaged solely in the transmission1 routing1 or temporary1 intermediate1 or transient storage of that communication4 #bjb4 ,requirements for consumer privacy and data security program 7a7 ,consumer privacy and data security program ,a covered entity subject to this subtitle shall comply with the following safeguards and any other administrative1 technical1 or physical safeguards identified by the ,federal ,trade ,commission for the protection of sensitive personally identifiable information3 7#a7 ,scope ,a covered entity shall implement a comprehensive consumer privacy and data security program that includes administrative1 technical1 and physical safeguards appropriate to the size and complexity1 and the nature and scope1 of the activities of the covered entity4 7#b7 ,design ,the consumer privacy and data security program shall be designed to-- 7,a7 ensure the privacy and security of sensitive personally identifying information2 7,b7 protect against any anticipated vulnerabilities to the privacy and security of sensitive personally identifying information2 and 7,c7 protect against unauthorized access1 destruction1 acquisition1 disclosure1 or use of sensitive personally identifying information4 7#c7 ,risk assessment ,a covered entity shall-- 7,a7 identify reasonably foreseeable internal and external vulnerabilities and internal and external threats that could result in unauthorized access1 destruction1 acquisition1 disclosure1 or use of sensitive personally identifiable information or of systems containing sensitive personally identifiable information2 7,b7 assess the likelihood of and potential damage from unauthorized access1 destruction1 acquisition1 disclosure1 or use of sensitive personally identifiable information2 7,c7 assess the sufficiency of its technical1 physical1 and administrative controls in place to control and minimize risks from unauthorized access1 destruction1 acquisition1 disclosure1 or use of sensitive personally identifiable information2 and 7,d7 assess the vulnerability of sensitive personally identifiable information during destruction and disposal of such information1 including through the disposal or retirement of hardware4 7#d7 ,risk management and control ,each covered entity shall-- 7,a7 design its consumer privacy and data security program to control the risks identified under paragraph 7#c72 7,b7 adopt measures commensurate with the sensitivity of the data as well as the size1 complexity1 nature1 and scope of the activities of the covered entity that-- 7i7 controls access to sensitive personally identifiable information1 including controls to authenticate and permit access only to authorized individuals2 7ii7 detect1 record1 and preserve information relevant to actual and attempted fraudulent1 unlawful1 or unauthorized access1 acquisition1 disclosure1 or use of sensitive personally identifiable information1 including by employees and other individuals otherwise authorized to have access2 7iii7 protect sensitive personally identifiable information during use1 transmission1 storage1 and disposal by encryption1 redaction1 disclosure limitation methodologies1 or access controls1 that are widely accepted as an effective industry practice or industry standard1 or other reasonable means2 7iv7 ensure that sensitive personally identifiable information is properly destroyed and disposed of1 including during the destruction of computers and other electronic media that contain sensitive personally identifiable information2 and 7v7 ensure that no third party is authorized to access or acquire sensitive personally identifiable information in its possession without the covered entity first performing sufficient due diligence to ascertain1 with reasonable certainty1 that such information is being sought for a valid legal purpose2 and 7,c7 establish a plan and procedures for minimizing the amount of sensitive personally identifiable information maintained by the covered entity and the length of time such information is retained1 which shall provide for the retention of sensitive personally identifiable information only as reasonably needed for the business purposes of such business entity or as necessary to comply with any legal obligation and only as long as so needed4 7#e7 ,limitation ,nothing in this subsection shall be construed to permit1 and nothing does permit1 the ,federal ,trade ,commission to issue regulations requiring1 or according greater legal status to1 the implementation of or application of a specific technology or technological specifications for meeting the requirements of this title4 7b7 ,training ,covered entities subject to this subtitle shall take steps to ensure employee training and supervision for implementation of the consumer privacy and data security program of the covered entity4 7c7 ,vulnerability testing 7#a7 ,in general ,covered entities subject to this subtitle shall take steps to ensure regular testing of key technical1 physical1 and administrative controls for information and information systems of the consumer privacy and data security program to detect1 prevent1 and respond to attacks or intrusions1 or other system failures4 7#b7 ,frequency ,the frequency and nature of the tests required under paragraph 7#a7 shall be determined by the risk assessment of the covered entity under subsection 7a77#c74 7d7 ,relationship to certain providers of services ,in the event a covered entity subject to this subtitle engages a person or entity not subject to this subtitle 7other than a service provider7 to receive sensitive personally identifiable information in performing services or functions 7other than the services or functions provided by a service provider7 on behalf of and under the instruction of such covered entity1 the covered entity shall-- 7#a7 exercise appropriate due diligence in selecting the person or entity for responsibilities related to sensitive personally identifiable information1 and take reasonable steps to select and retain a person or entity that is capable of maintaining appropriate controls for the privacy and security of the sensitive personally identifiable information at issue2 and 7#b7 require the person or entity by contract to implement and maintain appropriate measures designed to meet the objectives and requirements governing subtitle ,a4 7e7 ,periodic assessment and consumer privacy and data security modernization ,each covered entity subject to this subtitle shall on a regular basis monitor1 evaluate1 and adjust1 as appropriate its consumer privacy and data security program in light of any relevant changes in-- 7#a7 technology2 7#b7 internal or external threats and vulnerabilities to sensitive personally identifiable information2 and 7#c7 the changing business arrangements of the covered entity1 such as-- 7,a7 mergers and acquisitions2 7,b7 alliances and joint ventures2 7,c7 outsourcing arrangements2 7,d7 bankruptcy2 and 7,e7 changes to sensitive personally identifiable information systems4 7f7 ,consumer notice ,not less frequently than once every calendar year1 a covered entity shall provide1 upon request of a ,united ,states resident and at no cost to that individual1 notice to that individual of what sensitive personally identifiable information of that individual is maintained or shared by the covered entity4 7g7 ,consumer opt-,out 7#a7 ,definitions ,in this subsection1 the terms consumer and file have the meanings given the terms in section #fjc of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a74 7#b7 ,credit freeze ,upon the request of a consumer1 a covered entity that is a consumer reporting agency that compiles or maintains a file on the consumer and has received appropriate proof of the identity of the requester shall place or lift a credit freeze in the file of the consumer without charge to the consumer4 7h7 ,rulemaking ,not later than #a year after the date of enactment of this ,act1 the ,federal ,trade ,commission shall issue regulations in accordance with section #eec of title #e1 ,united ,states ,code1 to implement subsections 7a7 through 7g74 7i7 ,implementation timeline ,not later than #a year after the date on which the ,federal ,trade ,commission issues the final regulations required under subsection 7h71 a covered entity subject to the provisions of this subtitle shall implement a consumer privacy and data security program pursuant to this subtitle4 #bjc4 ,federal enforcement 7a7 ,in general ,the ,attorney ,general and the ,federal ,trade ,commission may enforce civil violations of section #bja or #bjb4 7b7 ,civil actions by the ,attorney ,general of the ,united ,states 7#a7 ,in general ,the ,attorney ,general may bring a civil action in the appropriate ,united ,states district court against any covered entity that engages in conduct constituting a violation of this subtitle and1 upon proof of such conduct by a preponderance of the evidence1 such covered entity shall be subject to a civil penalty in an amount that is not greater than the product of the number of individuals whose sensitive personally identifiable information was placed at risk as a result of the violation and #af1ejj4 7#b7 ,determinations ,the determination of whether a violation of a provision of this subtitle has occurred1 and if so1 the amount of the penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 ,the determination of whether a violation of a provision of this subtitle was willful or intentional1 and if so1 the amount of the additional penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 7#c7 ,additional penalty limit ,if a court determines under paragraph 7#b7 that a violation of a provision of this subtitle was willful or intentional and imposes an additional penalty1 the court may not impose an additional penalty in an amount that exceeds #aj1jjj1jjj4 7c7 ,injunctive actions by the ,attorney ,general 7#a7 ,in general ,if it appears that a covered entity has engaged1 or is engaged1 in any act or practice constituting a violation of this subtitle1 the ,attorney ,general may petition an appropriate district court of the ,united ,states for an order-- 7,a7 enjoining such act or practice2 or 7,b7 enforcing compliance with this subtitle4 7#b7 ,issuance of order ,a court may issue an order under paragraph 7#a71 if the court finds that the conduct in question constitutes a violation of this subtitle4 7d7 ,civil actions by the ,federal ,trade ,commission 7#a7 ,in general ,compliance with the requirements imposed under this subtitle may be enforced under the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 by the ,federal ,trade ,commission with respect to business entities subject to this ,act4 ,all of the functions and powers of the ,federal ,trade ,commission under the ,federal ,trade ,commission ,act are available to the ,commission to enforce compliance by any person with the requirements imposed under this title4 7#b7 ,civil penalties 7,a7 ,in general ,any covered entity that violates the provisions of this subtitle shall be subject to a civil penalty in the amount that is not greater than the product of the number of individuals whose sensitive personally identifiable information was placed at risk as a result of the violation and #af1ejj4 7,b7 ,determinations ,the determination of whether a violation of a provision of this subtitle has occurred1 and if so1 the amount of the penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 ,the determination of whether a violation of a provision of this subtitle was willful or intentional1 and if so1 the amount of the additional penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 7,c7 ,additional penalty limit ,if a court determines under subparagraph 7,b7 that a violation of a provision of this subtitle was willful or intentional and imposes an additional penalty1 the court may not impose an additional penalty in an amount that exceeds #aj1jjj1jjj4 7#c7 ,unfair or deceptive acts or practices ,for the purpose of the exercise by the ,federal ,trade ,commission of its functions and powers under the ,federal ,trade ,commission ,act1 a violation of any requirement or prohibition imposed under this title shall constitute an unfair or deceptive act or practice in commerce in violation of a regulation under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77,i77,b77 regarding unfair or deceptive acts or practices and shall be subject to enforcement by the ,federal ,trade ,commission under that ,act with respect to any business entity1 irrespective of whether that business entity is engaged in commerce or meets any other jurisdictional tests in the ,federal ,trade ,commission ,act4 7e7 ,coordination of enforcement 7#a7 ,in general ,when opening an investigation1 the ,federal ,trade ,commission shall consult with the ,attorney ,general4 7#b7 ,limitation ,the ,federal ,trade ,commission may initiate investigations under this subsection unless the ,attorney ,general determines that such an investigation would impede an ongoing criminal investigation or national security activity4 7#c7 ,coordination agreement 7,a7 ,in general ,in order to avoid conflicts and promote consistency regarding the enforcement and litigation of matters under this ,act1 not later than #ahj days after the date of enactment of this ,act1 the ,attorney ,general and the ,federal ,trade ,commission shall enter into an agreement for coordination regarding the enforcement of this ,act4 7,b7 ,requirement ,the coordination agreement entered into under subparagraph 7,a7 shall include provisions to ensure that parallel investigations and proceedings under this section are conducted in a manner that avoids conflicts and does not impede the ability of the ,attorney ,general to prosecute violations of ,federal criminal laws4 7f7 ,other rights and remedies ,the rights and remedies available under this section are cumulative and shall not affect any other rights and remedies available under law4 #bjd4 ,enforcement by ,state attorneys general 7a7 ,state enforcement 7#a7 ,civil actions ,in any case in which the attorney general of a ,state or any ,state or local law enforcement agency authorized by the ,state attorney general or by ,state statute to prosecute violations of consumer protection law1 has reason to believe that a covered entity has violated section #bja or #bjb1 the ,state1 as parens patriae1 may bring a civil action on behalf of the residents of that ,state to-- 7,a7 enjoin that act or practice2 7,b7 enforce compliance with section #bja or #bjb2 or 7,c7 impose a civil penalty in an amount that is not greater than the product of the number of individuals whose sensitive personally identifiable information was placed at risk as a result of the violation and #af1ejj4 7#b7 ,penalty determination 7,a7 ,determinations ,the determination of whether a violation of a provision of this subtitle has occurred1 and if so1 the amount of the penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 ,the determination of whether a violation of a provision of this subtitle was willful or intentional1 and if so1 the amount of the additional penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 7,b7 ,additional penalty limit ,if a court determines under subparagraph 7,a7 that a violation of a provision of this subtitle was willful or intentional and imposes an additional penalty1 the court may not impose an additional penalty in an amount that exceeds #aj1jjj1jjj4 7#c7 ,notice 7,a7 ,in general ,before filing an action under this subsection1 the attorney general of the ,state involved shall provide to the ,attorney ,general of the ,united ,states and the ,federal ,trade ,commission-- 7i7 a written notice of that action2 and 7ii7 a copy of the complaint for that action4 7,b7 ,exception ,subparagraph 7,a7 shall not apply with respect to the filing of an action by an attorney general of a ,state under this subsection1 if the attorney general of a ,state determines that it is not feasible to provide the notice described in this subparagraph before the filing of the action4 7,c7 ,notification when practicable ,in an action described under subparagraph 7,b71 the attorney general of a ,state shall provide the written notice and the copy of the complaint to the ,attorney ,general of the ,united ,states and the ,federal ,trade ,commission as soon after the filing of the complaint as practicable4 7#d7 ,federal proceedings ,upon receiving notice under paragraph 7#b71 the ,attorney ,general of the ,united ,states and the ,federal ,trade ,commission shall have the right to-- 7,a7 move to stay the action1 pending the final disposition of a pending ,federal proceeding or action as described in section #bjc2 7,b7 initiate an action in the appropriate ,united ,states district court under section #bjc and move to consolidate all pending actions1 including ,state actions1 in such court2 7,c7 intervene in an action brought under paragraph 7#a72 and 7,d7 file petitions for appeal4 7#e7 ,pending proceedings ,if the ,attorney ,general of the ,united ,states or the ,federal ,trade ,commission initiates a ,federal civil action for a violation of this subtitle1 or any regulations thereunder1 no attorney general of a ,state may bring an action for a violation of this subtitle that resulted from the same or related acts or omissions against a defendant named in the ,federal civil action initiated by the ,attorney ,general of the ,united ,states or the ,federal ,trade ,commission4 7#f7 ,rule of construction ,for purposes of bringing any civil action under paragraph 7#a7 nothing in this subtitle shall be construed to prevent an attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of that ,state to-- 7,a7 conduct investigations2 7,b7 administer oaths and affirmations2 or 7,c7 compel the attendance of witnesses or the production of documentary and other evidence4 7#g7 ,venue2 service of process 7,a7 ,venue ,any action brought under subsection 7a7 may be brought in-- 7i7 the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code2 or 7ii7 another court of competent jurisdiction4 7,b7 ,service of process ,in an action brought under subsection 7a71 process may be served in any district in which the defendant-- 7i7 is an inhabitant2 or 7ii7 may be found4 7b7 ,no private cause of action ,nothing in this subtitle establishes a private cause of action against a business entity for violation of any provision of this subtitle4 #bje4 ,relation to other laws 7a7 ,preemption ,for any covered entity that is subject to this subtitle1 the provisions of this subtitle shall supersede any other provision of ,federal law1 or any provisions of the law of any ,state or political subdivision of a ,state1 requiring data security practices that are less stringent than the requirements of this subtitle4 7b7 ,consumer protection laws ,except as provided in subsection 7a71 this section shall not be construed to limit the enforcement of any ,state consumer protection law by an attorney general of a ,state4 7c7 ,protection of certain ,state laws ,nothing in this ,act shall be construed to preempt the applicability of-- 7#a7 ,state trespass1 contract1 or tort law2 or 7#b7 any other ,state law to the extent that the law relates to acts of fraud4 7d7 ,preservation of ,,ftc authority ,nothing in this ,act may be construed in any way to limit the authority of the ,federal ,trade ,commission under any other provision of law4 7e7 ,preservation of ,,fcc authority ,nothing in this ,act may be construed in any way to limit the authority of the ,federal ,communications ,commission under any other provision of law4 ,b ,security breach notification and protection #baa4 ,notice to individuals2 protection 7a7 ,in general ,except as provided in section #bab1 a covered entity shall1 following the discovery of a security breach of sensitive personally identifiable information held by that covered entity or any third-party entity contracted to maintain or process data in electronic form containing sensitive personally identifiable information for that covered entity-- 7#a7 notify any resident of the ,united ,states whose sensitive personally identifiable information has been1 or is reasonably believed to have been1 accessed or acquired2 and 7#b7 provide #e years of appropriate identity theft prevention and mitigation services1 if any1 to any individual notified under paragraph 7#a71 upon request of the individual and at no cost to the individual1 under which the individual shall not be-- 7,a7 automatically enrolled1 without the consent of the individual1 into a fee-based identity theft prevention and mitigation service at the end of the #e-year period2 or 7,b7 required to seek arbitration of any claim arising from the identity theft prevention and mitigation service described in subparagraph 7,a74 7b7 ,obligation of third-,party entities 7#a7 ,in general ,in the event of a breach of security of a system maintained by a third-party entity that has been contracted to maintain or process data in electronic form containing sensitive personally identifiable information on behalf of a covered entity who owns or possesses such data1 the third-party entity shall notify the covered entity of the breach of security4 ,upon receiving notification from the third-party entity1 such covered entity shall provide the notification and identify theft prevention and mitigation service required under subsection 7a74 7#b7 ,notice by third-party entities ,nothing in this subtitle shall prevent or abrogate an agreement between a covered entity required to give notice under this section and a third-party entity that has been contracted to maintain or process data in electronic form containing sensitive personally identifiable information for a covered entity1 to provide the notifications required under subsection 7a77#a7 or the identity theft prevention and mitigation service required under subsection 7a77#b74 7#c7 ,service providers ,if a service provider becomes aware of a security breach containing sensitive personally identifiable information that is owned or possessed by a covered entity that connects to or uses a system or network provided by the service provider for the purpose of transmitting1 routing1 or providing intermediate or transient storage of such data1 the service provider shall be required to promptly notify the covered entity who initiated such connection1 transmission1 routing1 or storage of the security breach if the covered entity can be reasonably identified4 ,upon receiving such notification from a service provider1 the covered entity shall be required to provide the notification and identity theft prevention and mitigation service required under subsection 7a74 7c7 ,timeliness of notification 7#a7 ,in general ,all notifications and identity theft prevention and mitigation services required under this section shall be made as expediently as possible and without unreasonable delay following the discovery by the covered entity of a security breach4 7#b7 ,reasonable delay ,reasonable delay under this subsection may include any reasonable time necessary to determine the scope of the security breach1 prevent further disclosures1 and provide notice to law enforcement when required4 ,except as provided in subsection 7d71 delay of notification or provision of identity theft prevention and mitigation service shall not exceed #g days following the discovery of a security breach4 7#c7 ,burden of production ,the covered entity required to provide notice and identity theft prevention and mitigation service under this subtitle shall1 upon the request of the ,attorney ,general of the ,united ,states or the ,federal ,trade ,commission provide records or other evidence of the notifications and identity theft prevention and mitigation service required under this subtitle1 including to the extent applicable1 the reasons for any delay of notification or provision of identity theft prevention and mitigation service4 7d7 ,delay authorized for law enforcement or national security purposes 7#a7 ,in general ,if a ,federal law enforcement agency or intelligence agency determines that the notification or provision of identity theft prevention and mitigation service required under this section would impede a criminal investigation1 or national security activity1 such notification or provision of identity theft prevention and mitigation service1 as the case may be1 shall be delayed upon written notice from a ,federal law enforcement agency or intelligence agency to the covered entity that experienced the security breach4 ,the notification from a ,federal law enforcement agency or intelligence agency shall specify in writing the period of delay requested for law enforcement or national security purposes4 7#b7 ,extended delay ,if the notification or provision of identity theft prevention and mitigation service required under subsection 7a7 is delayed pursuant to paragraph 7#a71 a covered entity shall give notice or identity theft prevention and mitigation service1 as the case may be1 #ae days after the day such law enforcement or national security delay was invoked unless a ,federal law enforcement or intelligence agency provides written notification that further delay is necessary4 7#c7 ,law enforcement immunity ,no nonconstitutional cause of action shall lie in any court against any agency for acts relating to the delay of notification for law enforcement or national security purposes under this subtitle4 7e7 ,limitations ,notwithstanding any other obligation under this subtitle1 this subtitle does not apply to the following3 7#a7 ,financial institutions ,financial institutions-- 7,a7 subject to and in compliance with the data security requirements and standards under section #eja7;b7 of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja7;b772 and 7,b7 subject to the jurisdiction of an agency or authority described in section #eje7;a7 of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhje7;a774 7#b7 ,,hipaa and hitech regulated entities ,an entity that is subject to and in compliance with the data breach notification of the following1 with respect to data that is subject to such requirements3 7,a7 ,section #acdja of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agica74 7,b7 ,part #afj or #afd of title #de1 ,code of ,federal ,regulations 7or any successor regulations74 7,c7 ,the regulations promulgated under section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7#db ,u4,s4,c4 #acbj;d-#b note74 7,d7 ,in the case of a business entity1 the applicable data breach notification requirements of part #a of subtitle ,d of title ,,xiii of division ,a of the ,american ,reinvestment and ,recovery ,act of #bjji 7#db ,u4,s4,c4 #agica et seq471 if such business entity is acting as a covered entity1 a business associate1 or a vendor of personal health records1 as those terms are defined in section #acdjj of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agiba74 7,e7 ,in the case of a third-party service provider1 section #acdjg of the ,health ,information ,technology for ,economic and ,clinical ,health ,act 7#db ,u4,s4,c4 #agicg74 #bab4 ,exemptions 7a7 ,national security and law enforcement exemption 7#a7 ,in general ,section #baa shall not apply to a covered entity if a ,federal law enforcement agency or intelligence agency-- 7,a7 determines that notification of the security breach-- 7i7 could be expected to reveal sensitive sources and methods or similarly impede the ability of the ,government to conduct law enforcement investigations2 or 7ii7 could be expected to cause damage to the national security2 7,b7 communicates the determination made under subparagraph 7,a7 to the covered entity2 and 7,c7 orders that notification required under section #baa not be made4 7#b7 ,immunity ,no nonconstitutional cause of action shall lie in any court against any ,federal agency for acts relating to the exemption from notification for law enforcement or national security purposes under this title4 7b7 ,safe harbor exemption ,a covered entity shall be exempt from the notice and identity theft prevention and mitigation service requirements under section #baa if the covered entity reasonably determines that sensitive personally identifiable information is rendered unusable1 unreadable1 or indecipherable through data security technology or methodology1 including encryption or redaction1 that is generally accepted by experts in the field of information security1 such that there is no reasonable likelihood that a security breach has resulted in1 or will result in1 the misuse of data4 #bac4 ,methods of notice ,a covered entity shall be in compliance with section #baa if the covered entity provides the following3 7#a7 ,individual notice ,notice to individuals by one of the following means if the method of notification selected can most likely be expected to reach the intended individual3 7,a7 ,written notification to the last known home mailing address of the individual in the records of the covered entity4 7,b7 ,telephone notice to the individual personally1 provided that the telephone notice is made directly to each affected consumer1 and is not made through a prerecorded message4 7,c7 ,e-mail notice1 if-- 7i7 7,i7 the covered entity's primary method of communication with the individual is by e-mail2 or 7,,ii7 the individual has consented to receive such notice and the notice is consistent with the provisions permitting electronic transmission of notices under section #aja of the ,electronic ,signatures in ,global and ,national ,commerce ,act 7#ae ,u4,s4,c4 #gjja72 and 7ii7 the e-mail notice does not request1 or contain a hypertext link to a request1 that the consumer provide personal information in response to the notice4 7#b7 ,media1 website1 and social media notice ,in the event notice is required to more than #e1jjj individuals in #a ,state and individual notice is not feasible due to lack of sufficient contact information for the individuals required to be notified1 a covered entity shall-- 7,a7 provide notice to the major media outlets serving the ,state or jurisdiction of the individuals believed to be affected2 7,b7 place notice in a clear and conspicuous place on the website of the covered entity if the covered entity operates a website2 and 7,c7 place notice on each social media platform on which the covered entity maintains a social media presence1 if any4 #bad4 ,content of notification 7a7 ,in general ,regardless of the method by which notice is provided to individuals under section #bac1 such notice shall include1 to the extent possible-- 7#a7 a general description of the incident and the date or estimated date of the security breach and the date range during which the sensitive personally identifiable information was compromised2 7#b7 a description of the categories of sensitive personally identifiable information that was1 or is reasonably believed to have been1 accessed or acquired by an unauthorized person2 7#c7 the acts the covered entity1 or the agent of the covered entity1 has taken to protect sensitive personally identifiable information from further security breach2 7#d7 at the discretion of the covered entity1 reasonable advice on steps the individual may take to protect himself or herself2 7#e7 if applicable1 an offer to provide appropriate identity theft prevention and mitigation services1 as described in section #baa7;a77#b72 7#f7 a toll-free number-- 7,a7 that the individual may use to contact the covered entity1 or the agent of the covered entity2 and 7,b7 from which the individual may learn what types of sensitive personally identifiable information the covered entity maintained about that individual2 and 7#g7 the toll-free contact telephone numbers and addresses for the major credit reporting agencies if the sensitive personally identifiable information that was breached could be used to commit financial fraud or identity theft4 7b7 ,direct business relationship ,regardless of whether a covered entity or a designated third party provides the notice required pursuant to section #baa7;b71 such notice shall include the name of the covered entity that has the most direct relationship with the individual being notified4 #bae4 ,coordination of notification with credit reporting agencies ,if a covered entity is required to provide notification to more than #e1jjj individuals under section #baa7;a7 and the sensitive personally identifiable information that was breached could be used to commit financial fraud or identity theft1 the covered entity shall also notify all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis 7as defined in section #fjc7p7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a7p777 of the timing and distribution of the notices4 ,such notice shall be given to the consumer credit reporting agencies without unreasonable delay and1 if it will not delay notice to the affected individuals1 prior to the distribution of notices to the affected individuals4 #baf4 ,notice to the ,federal ,trade ,commission 7a7 ,in general ,a covered entity required to provide notification under section #baa7;a7 shall provide a copy of the notification to the ,federal ,trade ,commission not later than the date on which notice is provided to individuals required to be notified4 ,the ,federal ,trade ,commission shall establish procedures to ensure the attorneys general of each ,state with affected residents receives a copy of the notice provided to it under this section4 7b7 ,public database and report to ,congress ,the ,federal ,trade ,commission shall-- 7#a7 maintain a public database on the website of the ,federal ,trade ,commission of notifications received under subsection 7a72 and 7#b7 on an annual basis1 submit a report to ,congress on the notifications received under subsection 7a74 #bag4 ,notice to law enforcement 7a7 ,designation of government entity ,to receive notice 7#a7 ,in general ,not later than #fj days after the date of enactment of this ,act1 the ,secretary of ,homeland ,security1 in consultation with the ,attorney ,general1 shall designate a ,federal ,government entity to receive the notices required under section #baa and this section4 7#b7 ,responsibilities of the designated entity ,the designated entity shall-- 7,a7 promptly provide the information that it receives to the ,united ,states ,secret ,service or the ,federal ,bureau of ,investigation for law enforcement purposes2 and 7,b7 provide the information described in subparagraph 7,a7 as appropriate to other ,federal agencies for law enforcement1 national security1 or data security purposes4 7b7 ,notice ,a covered entity shall notify the designated entity of the fact that a security breach has occurred if-- 7#a7 the number of individuals whose sensitive personally identifying information was1 or is reasonably believed to have been1 accessed or acquired by an unauthorized person exceeds #e1jjj2 7#b7 the security breach involves a database1 networked or integrated databases1 or other data system containing the sensitive personally identifiable information of more than #ejj1jjj individuals nationwide2 7#c7 the security breach involves databases owned by the ,federal ,government2 or 7#d7 the security breach involves primarily sensitive personally identifiable information of individuals known to the covered entity to be employees and contractors of the ,federal ,government involved in national security or law enforcement4 7c7 ,department of ,justice review of thresholds for notice ,the ,attorney ,general1 in consultation with the ,secretary of ,homeland ,security1 after notice and the opportunity for public comment1 and in a manner consistent with this section1 shall promulgate regulations1 as necessary1 under section #eec of title #e1 ,united ,states ,code1 to adjust the thresholds for notice to law enforcement and national security authorities under subsection 7a7 and to facilitate the purposes of this section4 7d7 ,timing ,the notice required under subsection 7b7 shall be provided as promptly as possible1 but such notice must be provided not less than #dh hours before notice is provided to an individual pursuant to section #baa1 or not later than #g days after the discovery of the events requiring notice1 whichever occurs first4 ,for each breach requiring notice under this subsection1 a copy of the notice to individuals required under section #baa shall also be provided to the designated entity not later than the date on which the notice is provided to affected individuals4 #bah4 ,federal enforcement 7a7 ,in general ,the ,attorney ,general and the ,federal ,trade ,commission may enforce civil violations of this subtitle4 7b7 ,civil actions by the ,attorney ,general of the ,united ,states 7#a7 ,in general ,the ,attorney ,general may bring a civil action in the appropriate ,united ,states district court against any covered entity that engages in conduct constituting a violation of this subtitle and1 upon proof of such conduct by a preponderance of the evidence1 the covered entity shall be subject to a civil penalty in an amount not greater than the product of the number of violations of this subtitle and #af1ejj4 ,each failure to provide notification to an individual as required under this subtitle shall be treated as a separate violation4 7#b7 ,determinations ,the determination of whether a violation of a provision of this subtitle has occurred1 and if so1 the amount of the penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 ,the determination of whether a violation of a provision of this subtitle was willful or intentional1 and if so1 the amount of the additional penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 7#c7 ,additional penalty limit ,if a court determines under paragraph 7#b7 that a violation of a provision of this subtitle was willful or intentional and imposes an additional penalty1 the court may not impose an additional penalty in an amount that exceeds #aj1jjj1jjj4 7c7 ,injunctive actions by the ,attorney ,general 7#a7 ,in general ,if it appears that a covered entity has engaged1 or is engaged1 in any act or practice constituting a violation of this subtitle1 the ,attorney ,general may petition an appropriate district court of the ,united ,states for an order-- 7,a7 enjoining such act or practice2 or 7,b7 enforcing compliance with this subtitle4 7#b7 ,issuance of order ,a court may issue an order under paragraph 7#a71 if the court finds that the conduct in question constitutes a violation of this subtitle4 7d7 ,civil actions by the ,federal ,trade ,commission 7#a7 ,in general ,compliance with the requirements imposed under this subtitle may be enforced under the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 by the ,federal ,trade ,commission with respect to business entities subject to this ,act4 ,all of the functions and powers of the ,federal ,trade ,commission under the ,federal ,trade ,commission ,act are available to the ,commission to enforce compliance by any person with the requirements imposed under this title4 7#b7 ,civil penalties 7,a7 ,in general ,any covered entity that violates this subtitle shall be subject to a civil penalty in the amount that is not greater than the product of the number of violations of this subtitle and #af1ejj4 ,each failure to provide notification to an individual as required under this subtitle shall be treated as a separate violation4 7,b7 ,determinations ,the determination of whether a violation of a provision of this subtitle has occurred1 and if so1 the amount of the penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 ,the determination of whether a violation of a provision of this subtitle was willful or intentional1 and if so1 the amount of the additional penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 7,c7 ,additional penalty limit ,if a court determines under subparagraph 7,b7 that a violation of a provision of this subtitle was willful or intentional and imposes an additional penalty1 the court may not impose an additional penalty in an amount that exceeds #aj1jjj1jjj4 7#c7 ,unfair or deceptive acts or practices ,for the purpose of the exercise by the ,federal ,trade ,commission of its functions and powers under the ,federal ,trade ,commission ,act1 a violation of any requirement or prohibition imposed under this title shall constitute an unfair or deceptive act or practice in commerce in violation of a regulation under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77,i77,b77 regarding unfair or deceptive acts or practices and shall be subject to enforcement by the ,federal ,trade ,commission under that ,act with respect to any business entity1 irrespective of whether that business entity is engaged in commerce or meets any other jurisdictional tests in the ,federal ,trade ,commission ,act4 7e7 ,coordination of enforcement 7#a7 ,in general ,when opening an investigation1 the ,federal ,trade ,commission shall consult with the ,attorney ,general4 7#b7 ,limitation ,the ,federal ,trade ,commission may initiate investigations under this subsection unless the ,attorney ,general determines that such an investigation would impede an ongoing criminal investigation or national security activity4 7#c7 ,coordination agreement 7,a7 ,in general ,in order to avoid conflicts and promote consistency regarding the enforcement and litigation of matters under this ,act1 not later than #ahj days after the enactment of this ,act1 the ,attorney ,general and the ,federal ,trade ,commission shall enter into an agreement for coordination regarding the enforcement of this ,act4 7,b7 ,requirement ,the coordination agreement entered into under subparagraph 7,a7 shall include provisions to ensure that parallel investigations and proceedings under this section are conducted in a manner that avoids conflicts and does not impede the ability of the ,attorney ,general to prosecute violations of ,federal criminal laws4 7f7 ,rulemaking ,the ,federal ,trade ,commission may1 in consultation with the ,attorney ,general1 issue such other regulations as it determines to be necessary to carry out this subtitle4 ,all regulations promulgated under this ,act shall be issued in accordance with section #eec of title #e1 ,united ,states ,code4 7g7 ,other rights and remedies ,the rights and remedies available under this subtitle are cumulative and shall not affect any other rights and remedies available under law4 7h7 ,fraud alert ,section #fje;,a7b77#a7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;c-#a7;b77#a77 is amended by inserting 1 or evidence that the consumer has received notice that the consumer's financial information has or may have been compromised1 after identity theft report4 #bai4 ,enforcement by ,state attorneys general 7a7 ,in general 7#a7 ,civil actions 7,a7 ,in general ,in any case in which the attorney general of a ,state or any ,state or local law enforcement agency authorized by the ,state attorney general or by ,state statute to prosecute violations of consumer protection law1 has reason to believe that a covered entity has violated this subtitle1 the ,state1 as parens patriae1 may bring a civil action on behalf of the residents of the ,state to-- 7i7 enjoin that practice2 7ii7 enforce compliance with this subtitle2 or 7iii7 impose a civil penalty in an amount not greater than the product of the number of violations of this subtitle and #af1ejj4 7,b7 ,failure to provide notification ,for purposes of subparagraph 7,a77iii71 each failure to provide notification to an individual as required under this subtitle shall be treated as a separate violation4 7#b7 ,penalty determinations 7,a7 ,determinations ,the determination of whether a violation of a provision of this subtitle has occurred1 and if so1 the amount of the penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 ,the determination of whether a violation of a provision of this subtitle was willful or intentional1 and if so1 the amount of the additional penalty to be imposed1 if any1 shall be made by the court sitting as the finder of fact4 7,b7 ,additional penalty limit ,if a court determines under subparagraph 7,a7 that a violation of a provision of this subtitle was willful or intentional and imposes an additional penalty1 the court may not impose an additional penalty in an amount that exceeds #aj1jjj1jjj4 7#c7 ,notice 7,a7 ,in general ,before filing an action under paragraph 7#a71 the attorney general of the ,state involved shall provide to the ,attorney ,general of the ,united ,states and the ,federal ,trade ,commission-- 7i7 written notice of the action2 and 7ii7 a copy of the complaint for the action4 7,b7 ,exemption 7i7 ,in general ,subparagraph 7,a7 shall not apply with respect to the filing of an action by an attorney general of a ,state under this subtitle1 if the ,state attorney general determines that it is not feasible to provide the notice described in such subparagraph before the filing of the action4 7ii7 ,notification ,in an action described in clause 7i71 the attorney general of a ,state shall provide notice and a copy of the complaint to the ,attorney ,general of the ,united ,states and the ,federal ,trade ,commission at the time the ,state attorney general files the action4 7b7 ,federal proceedings ,upon receiving notice under subsection 7a77#b71 the ,attorney ,general and the ,federal ,trade ,commission shall have the right to-- 7#a7 move to stay the action1 pending the final disposition of a pending ,federal proceeding or action2 7#b7 initiate an action in the appropriate ,united ,states district court under section #bah and move to consolidate all pending actions1 including ,state actions1 in such court2 7#c7 intervene in an action brought under subsection 7a77#b72 and 7#d7 file petitions for appeal4 7c7 ,pending proceedings ,if the ,attorney ,general or the ,federal ,trade ,commission initiates a criminal proceeding or civil action for a violation of a provision of this subtitle1 or any regulations thereunder1 no attorney general of a ,state may bring an action for a violation of a provision of this subtitle against a defendant named in the ,federal criminal proceeding or civil action4 7d7 ,construction ,for purposes of bringing any civil action under subsection 7a71 nothing in this subtitle regarding notification shall be construed to prevent an attorney general of a ,state from exercising the powers conferred on such attorney general by the laws of that ,state to-- 7#a7 conduct investigations2 7#b7 administer oaths or affirmations2 or 7#c7 compel the attendance of witnesses or the production of documentary and other evidence4 7e7 ,venue2 service of process 7#a7 ,venue ,any action brought under subsection 7a7 may be brought in-- 7,a7 the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code2 or 7,b7 another court of competent jurisdiction4 7#b7 ,service of process ,in an action brought under subsection 7a71 process may be served in any district in which the defendant-- 7,a7 is an inhabitant2 or 7,b7 may be found4 7f7 ,no private cause of action ,nothing in this subtitle establishes a private cause of action against a business entity for violation of any provision of this subtitle4 #bbj4 ,effect on ,federal and ,state law 7a7 ,preemption ,for a covered entity that is subject to this subtitle1 the provisions of this subtitle shall supersede any other provision of ,federal law1 or any provisions of the law of any ,state or political subdivision of a ,state requiring notification of a security breach of sensitive personally identifiable information1 which is less stringent than the requirements of this subtitle4 7b7 ,consumer protection laws ,except as provided in subsection 7a71 this section shall not be construed to limit the enforcement of any ,state consumer protection law by an attorney general of a ,state4 7c7 ,protection of certain ,state laws ,nothing in this ,act shall be construed to preempt the applicability of-- 7#a7 ,state trespass1 contract1 or tort law2 or 7#b7 any other ,state law to the extent that the law relates to acts of fraud4 7d7 ,preservation of ,,ftc authority ,nothing in this ,act may be construed in any way to limit the authority of the ,federal ,trade ,commission under any other provision of law4 7e7 ,preservation of ,,fcc authority ,nothing in this ,act may be construed in any way to limit the authority of the ,federal ,communications ,commission under any other provision of law4 #bba4 ,reporting on exemptions ,not later than #ah months after the date of enactment of this ,act1 and upon the request by ,congress thereafter1 the ,attorney ,general1 in consultation with the ,secretary of ,homeland ,security1 shall submit a report to ,congress on the number and nature of security breaches subject to the national security and law enforcement exemptions under section #bab7;a74 #bbb4 ,effective date ,this subtitle shall take effect on the expiration of the date that is #ij days after the date of enactment of this ,act4 ,,iii ,compliance with statutory ,pay-,as-,you-,go ,act #cja4 ,budget compliance ,the budgetary effects of this ,act1 for the purpose of complying with the ,statutory ,pay-,as-,you-,go ,act of #bjaj1 shall be determined by reference to the latest statement titled ,budgetary ,effects of ,,paygo ,legislation for this ,act1 submitted for printing in the ,congressional ,record by the ,chairman of the ,senate ,budget ,committee1 provided that such statement has been submitted prior to the vote on passage4