,,ii  #aae? ,,congress  #a/ ,session    
,s4 #babd  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,novemb] #ad1 #bjag,mr4
 ,leahy 7= himself1 ,mr4 ,m>key1 ,mr4   
,blum5?al1 ,mr4 ,wyd51 ,mr4 ,frank51    
,ms4 ,baldw91 & ,ms4 ,h>ris7 introduc$ !
 foll[+ bill2 :i* 0 read twice & ref]r$ 
to ! ,committee on ! ,judici>y  ,a      
,,bill  ,to ensure ! privacy & security 
( s5sitive p]sonal in=mation1 to prev5t 
& mitigate id5tity !ft1 to provide      
notice ( security brea*es involv+       
s5sitive p]sonal in=mation1 & to enhance
 law en=cem5t assi/ance & o!r           
protections aga9/ security brea*es1     
fraudul5t access1 & misuse ( p]sonal    
in=mation4  #a4 ,%ort title2 table (    
cont5ts  7a7 ,%ort title ,?is ,act may  
be cit$ z ! ,consum] ,privacy           
,protection ,act ( #bjag4  7b7 ,table ( 
cont5ts ,! table ( cont5ts = ?is ,act is
 z foll[s3 ,sec4 #a4 ,%ort title2 table 
( cont5ts4,sec4 #b4 ,f9d+s4,sec4 #c4    
,def9itions4,,title ,i--,puni%m5t =     
concealm5t ( security brea*es & tools to

 combat cybercrime,sec4 #aja4           
,concealm5t ( security brea*es involv+  
s5sitive p]sonally id5tifiable          
in=mation4,sec4 #ajb4 ,report+ ( c]ta9  
cyb]crimes4,sec4 #ajc4 ,au?ority to %ut 
d[n botnets4,sec4 #ajd4 ,det]r+ !       
developm5t & sale ( comput] & cell phone
 spy+ devices4,,title ,,ii--,consum]    
privacy & security ( s5sitive p]sonally 
id5tifiable information,subtitle        
,a--,consum] privacy & data security    
program,sec4 #bja4 ,purpose &           
applicability ( consum] privacy & data  
security program4,sec4 #bjb4            
,requirem5ts = consum] privacy & data   
security program4,sec4 #bjc4 ,f$]al     
en=cem5t4,sec4 #bjd4 ,en=cem5t by ,/ate 
attorneys g5]al4,sec4 #bje4 ,relation to
 o!r laws4,subtitle ,b--,security brea* 
notification & protection,sec4 #baa4    
,notice to individuals2 protection4,sec4
 #bab4 ,exemptions4,sec4 #bac4 ,me?ods (
 notice4,sec4 #bad4 ,cont5t (           
notification4,sec4 #bae4 ,coord9ation ( 
notification ) cr$it report+            

ag5cies4,sec4 #baf4 ,notice to ! ,f$]al 
,trade ,commission4,sec4 #bag4 ,notice  
to law en=cem5t4,sec4 #bah4 ,f$]al      
en=cem5t4,sec4 #bai4 ,en=cem5t by ,/ate 
attorneys g5]al4,sec4 #bbj4 ,effect on  
,f$]al & ,/ate law4,sec4 #bba4 ,report+ 
on exemptions4,sec4 #bbb4 ,effective    
date4,,title ,,iii--,compliance )       
/atutory ,pay-,z-,y-,g ,act,sec4 #cja4  
,budget compliance4  #b4 ,f9d+s         
,congress f9ds t--  7#a7 databases (    
s5sitive p]sonally id5tifiable in=mation
 are increas+ly prime t>gets ( hack]s1  
nation-/ate actors1 id5tity ?ieves1     
rogue employees1 & o!r crim9als1 includ+
 organiz$ & sophi/icat$ crim9al         
op]ations2  7#b7 security brea*es caus$ 
by su* crim9al acts are a s]i\s ?reat to
 consum] privacy1 consum] confid5ce1    
homel& security1 national security1     
e-comm]ce1 & economic /ability2  7#c7   
misuse ( s5sitive p]sonally id5tifiable 
in=mation has ! pot5tial to cause s]i\s 
or irrep>able h>m to an individual's    
livelihood1 privacy1 & lib]ty & und]m9e 

effici5t & effective bus9ess & gov]nm5t 
op]ations2  7#d7 id5tity !ft is a s]i\s 
?reat to ! ,nation's economic /ability1 
national security1 homel& security1     
cyb]security1 ! developm5t ( e-comm]ce1 
& ! privacy rights ( ,am]icans2  7#e7 x 
is important = bus9ess entities t own1  
use1 /ore1 or lic5se s5sitive p]sonally 
id5tifiable in=mation to adopt          
reasonable policies & proc$ures to help 
ensure ! security & privacy ( s5sitive  
p]sonally id5tifiable in=mation2 &  7#f7
 individuals ^: p]sonal in=mation has   
be5 compromis$ or :o h be5 victims (    
id5tity !ft %\ld receive ! necess>y     
in=mation & assi/ance to mitigate any   
pot5tial damage4  #c4 ,def9itions ,9 ?is
 ,act1 ! foll[+ def9itions %all apply3  
7#a7 ,affiliate ,! t]m affiliate means  
p]sons relat$ by common own]%ip or by   
corporate control4  7#b7 ,ag5cy ,! t]m  
ag5cy has ! same mean+ giv5 su* t]m 9   
section #eea ( title #e1 ,unit$ ,/ates  
,code4  7#c7 ,bus9ess entity ,! t]m     
bus9ess entity means any organization1  

corporation1 tru/1 p>tn]%ip1 sole       
proprietor%ip1 un9corporat$ association1
 or v5ture e/abli%$ to make a pr(it1 or 
a nonpr(it organization4  7#d7 ,consum] 
privacy & data security program ,! t]m  
consum] privacy & data security program 
means ! program describ$ 9 section      
#bjb7;a74  7#e7 ,consum] report+ ag5cy  
,! t]m consum] report+ ag5cy means a    
consum] report+ ag5cy describ$ 9 section
 #fjc7p7 ( ! ,fair ,cr$it ,report+ ,act 
7#ae ,u4,s4,c4 #afha;a7p774  7#f7 ,cov]$
 entity ,! t]m cov]$ entity means any   
bus9ess entity1 o!r ?an a s]vice        
provid]1 t collects1 uses1 accesses1    
transmits1 /ores1 or disposes ( s5sitive
 p]sonally id5tifiable in=mation1       
includ+ a consum] report+ ag5cy4  7#g7  
,designat$ entity ,! t]m designat$      
entity means ! ,f$]al ,gov]nm5t entity  
designat$ by ! ,secret>y ( ,homel&      
,security "u section #bag7;a74  7#h7    
,encryption ,! t]m encryption-- 7,a7    
means ! protection ( data 9 electronic  
=m1 9 /orage or 9 transit1 us+ an       

encryption te*nology t has be5 g5]ally  
accept$ by exp]ts 9 ! field ( in=mation 
security t r5d]s su* data indeciph]able 
9 ! abs5ce ( associat$ cryptographic    
keys necess>y to enable decryption ( su*
 data2 &  7,b7 includes appropriate     
managem5t & safegu>ds ( su*             
cryptographic keys s z to protect !     
integrity ( ! encryption4  7#i7 ,id5tity
 !ft ,! t]m id5tity !ft means a         
violation ( section #ajbh7;a77#g7 (     
title #ah1 ,unit$ ,/ates ,code4  7#aj7  
,security brea*  7,a7 ,9 g5]al ,! t]m   
security brea* means compromise ( !     
privacy1 integrity1 or security (       
comput]iz$ data t results 91 or t !re is
 a reasonable basis to conclude has     
result$ 91 unau?oriz$ access to or      
acquisition ( s5sitive p]sonally        
id5tifiable in=mation4  7,b7 ,exclusion 
,! t]m security brea* does n include--  
7i7 a good fai? access or acquisition ( 
s5sitive p]sonally id5tifiable in=mation
 by a bus9ess entity1 or an employee or 
ag5t ( a bus9ess entity1 if ! s5sitive  

p]sonally id5tifiable in=mation is n    
subject to fur!r unau?oriz$ disclosure2 
7ii7 ! release ( a public record n      
o!rwise subject to confid5tiality or    
nondisclosure requirem5ts2 or  7iii7 any
 lawfully au?oriz$ inve/igative1        
protective1 or intellig5ce activity ( a 
law en=cem5t or intellig5ce ag5cy ( !   
,unit$ ,/ates1 a ,/ate1 or a political  
subdivision ( a ,/ate4  7#aa7 ,s5sitive 
p]sonally id5tifiable in=mation ,! t]m  
s5sitive p]sonally id5tifiable in=mation
 means any in=mation or compilation (   
in=mation1 9 electronic or digital =m t 
id5tifies or c\ld be us$ to id5tify a   
p>ticul> p]son1 includ+ ! foll[+3  7,a7 
,a non-truncat$ ,social ,security numb]1
 a driv]'s lic5se numb]1 passport numb]1
 or ali5 regi/ration numb] or o!r       
gov]nm5t-issu$ unique id5tification     
numb]4  7,b7 ,a f9ancial acc\nt numb] or
 cr$it or debit c>d numb] 9 comb9ation )
 any security code1 access code1 or     
password if requir$ = an individual to  
obta9 cr$it1 )draw funds1 or engage 9   

f9ancial transactions4  7,c7 ,a unique  
electronic acc\nt id5tifi]1 includ+ an  
onl9e us] "n or e-mail address1 9       
comb9ation ) any security code1 access  
code1 password1 or security "q & answ]1 
if requir$ = an individual to obta9     
money1 goods1 s]vices1 access to digital
 photographs1 digital videos or         
electronic communications1 or any o!r ?+
 ( value4  7,d7 ,unique biometric data1 
su* z facepr9t1 f+]pr9t1 voice pr9t1 a  
ret9a or iris image1 or any o!r unique  
physical repres5tation4  7,e7 ,an       
individual's fir/ & la/ "n or fir/      
initial & la/ "n 9 comb9ation ) any     
in=mation t relates to ! individual's   
pa/1 pres5t1 or future physical or m5tal
 heal? or condition1 or to ! provision (
 heal? c>e to or diagnosis ( !          
individual1 includ+ heal? insurance     
in=mation su* z a heal? insurance policy
 numb] or subscrib] id5tification numb]1
 or any in=mation 9 an individual's     
heal? insurance application & claims    
hi/ory4  7,f7 ,in=mation ab\t an        

individual's geographic location g5]at$ 
by or d]iv$ f ! op]ation or use ( an    
electronic communications device t is   
suffici5t to id5tify ! /reet & "n ( !   
city or t[n 9 :i* ! device is locat$1   
exclud+ telephone numb]s or network or  
int]net protocol addresses4  7,g7       
,password-protect$ digital photographs &
 digital videos n o!rwise available to !
 public4  7#ab7 ,s]vice provid] ,! t]m  
s]vice provid] means a bus9ess entity t 
provides electronic data transmission1  
r\t+1 int]m$iate & transi5t /orage1 or  
connections to its sy/em or network1 :]e
 ! bus9ess entity provid+ su* s]vices   
does n select or modify ! cont5t ( !    
electronic data1 is n ! s5d] or ! int5d$
 recipi5t ( ! data1 & ! bus9ess entity  
transmits1 r\tes1 or provides           
connections = s5sitive p]sonally        
id5tifiable in=mation 9 a mann] t       
s5sitive p]sonally id5tifiable in=mation
 is undiff]5tiat$ f o!r types ( data t  
su* bus9ess entity transmits1 r\tes1 or 
provides connections4 ,any su* bus9ess  

entity %all be treat$ z a s]vice provid]
 "u ?is ,act only to ! ext5t t x is     
engag$ 9 ! provision ( su* transmission1
 r\t+1 int]m$iate & transi5t /orage or  
connections4  ,i ,puni%m5t = concealm5t 
( security brea*es & tools to combat    
cyb]crime  #aja4 ,concealm5t ( security 
brea*es involv+ s5sitive p]sonally      
id5tifiable in=mation  7a7 ,9 g5]al     
,*apt] #dg ( title #ah1 ,unit$ ,/ates   
,code1 is am5d$ by add+ at ! end !      
foll[+3  #ajda4 ,concealm5t ( security  
brea*es involv+ s5sitive p]sonally      
id5tifiable in=mation  7a7 ,9 g5]al     
,:oev]1 hav+ k ( a security brea* & ( ! 
fact t notice ( su* security brea* is   
requir$ "u title ,,ii ( ! ,consum]      
,privacy ,protection ,act ( #bjag1      
int5tionally & willfully conceals ! fact
 ( su* security brea*1 %all1 9 ! ev5t t 
su* security brea* results 9 economic   
h>m to any individual 9 ! am\nt ( #a1jjj
 or m1 be f9$ "u ?is title or imprison$ 
= n m ?an #e ye>s1 or bo?4  7b7 ,p]son  
def9$ ,= purposes ( subsection 7a71 !   

t]m p]son has ! mean+ giv5 ! t]m 9      
section #ajcj7;e77#ab74  4  7b7 ,con=m+ 
& te*nical am5dm5ts ,! table ( sections 
= *apt] #dg ( title #ah1 ,unit$ ,/ates  
,code1 is am5d$ by add+ at ! end !      
foll[+3  #ajda4 ,concealm5t ( security  
brea*es involv+ s5sitive p]sonally      
id5tifiable in=mation4  4  7c7 ,en=cem5t
 au?ority  7#a7 ,9 g5]al ,! ,unit$      
,/ates ,secret ,s]vice & ! ,f$]al       
,bureau ( ,inve/igation %all h !        
au?ority to inve/igate (f5ses "u section
 #ajda ( title #ah1 ,unit$ ,/ates ,code1
 z add$ by subsection 7a74  7#b7        
,nonexclusivity ,! au?ority grant$ 9    
p>agraph 7#a7 %all n be exclusive ( any 
exi/+ au?ority held by any o!r ,f$]al   
ag5cy4  #ajb4 ,report+ ( c]ta9          
cyb]crimes ,section #ajcj ( title #ah1  
,unit$ ,/ates ,code1 is am5d$ by /rik+  
subsection 7h7 & ins]t+ ! foll[+3  7h7  
,report+ c]ta9 crim9al cases ,n lat] ?an
 #a ye> aft] ! date ( ! enactm5t ( ?is  
subsection1 & annually !reaft]1 !       
,attorney ,g5]al %all report to !       

,committee on ! ,judici>y ( ! ,s5ate & !
 ,committee on ! ,judici>y ( ! ,h\se (  
,repres5tatives ! numb] ( crim9al cases 
br\ght "u subsection 7a7 t involve      
conduct 9 :i*--  7#a7 ! def5dant-- 7,a7 
exce$$ au?oriz$ access to a             
nongov]nm5tal comput]2 or  7,b7 access$ 
a nongov]nm5tal comput] )\t             
au?orization2 &  7#b7 ! sole basis = !  
,gov]nm5t det]m9+ t access to !         
nongov]nm5tal comput] 0 unau?oriz$1 or 9
 excess ( au?orization1 0 t ! def5dant  
violat$ a contractual obligation or     
agreem5t ) a s]vice provid] or employ]1 
su* z an acceptable use policy or t]ms (
 s]vice agreem5t4  4  #ajc4 ,au?ority to
 %ut d[n botnets  7a7 ,am5dm5t ,section 
#acde ( title #ah1 ,unit$ ,/ates ,code1 
is am5d$-- 7#a7 9 ! head+1 by ins]t+ &  
abuse aft] fraud2  7#b7 9 subsection    
7a7-- 7,a7 9 p>agraph 7#a7--  7i7 9     
subp>agraph 7,b71 by /rik+ or at ! end2 
7ii7 9 subp>agraph 7,c71 by ins]t+ or   
aft] ! semicolon2 &  7iii7 by ins]t+    
aft] subp>agraph 7,c7 ! foll[+3  7,d7   

violat+ section #ajcj7;a77#e7 :]e su*   
conduct w\ld damage 7z def9$ 9 section  
#ajcj71 #ajj or m protect$ comput]s 7z  
def9$ 9 section #ajcj7 dur+ any #a-ye>  
p]iod1 includ+ by d5y+ access to or     
op]ation ( ! comput]s1 in/all+ unwant$  
s(tw>e on ! comput]s1 us+ ! comput]s )\t
 au?orization1 or obta9+ in=mation f !  
comput]s )\t au?orization2  2 &  7,b7 9 
p>agraph 7#b71 by ins]t+ 1 a violation (
 section #ajcj7;a77#e7 z describ$ 9     
subsection 7a77#a77;,d71 be=e or a      
,f$]al2  7#c7 9 subsection 7b71 by add+ 
1 except 9 ! case ( a p]son violat+     
section #ajcj7;a77#e7 9 ! mann] describ$
 9 subsection 7a77#a77;,d71 be=e take   
su* o!r action2 &  7#d7 by add+ at ! end
 ! foll[+3  7c7 ,a re/ra9+ ord] or      
prohibition describ$ 9 subsection 7b71  
if issu$ 9 circum/ances describ$ 9      
subsection 7a77#a77;,d7--  7#a7 may only
 au?orize action t solely affects p]sons
 violat+ section #ajcj 9 ! mann]        
describ$ 9 subsection 7a77#a77;,d72 &   
7#b7 may1 ^u application ( ! ,attorney  

,g5]al--  7,a7 specify t no cause (     
action %all lie 9 any c\rt aga9/ a p]son
 = comply+ ) ! re/ra9+ ord]1            
prohibition1 or o!r action2 &  7,b7     
provide t ! ,unit$ ,/ates %all pay to   
su* p]son a fee = reimbursem5t = su*    
co/s z are reasonably necess>y & :i* h  
be5 directly incurr$ 9 comply+ ) !      
re/ra9+ ord]1 prohibition1 or o!r       
action4  7d7 ,!re are au?oriz$ to be    
appropriat$ to ! ,dep>tm5t ( ,ju/ice1 ! 
,dep>tm5t ( ,homel& ,security1 & !      
,dep>tm5t ( ! ,treasury su* sums z are  
necess>y to implem5t ?is section1       
includ+ paym5ts made by ! ,unit$ ,/ates 
( a fee = reimbursem5t4  4  7b7         
,te*nical & con=m+ am5dm5t ,! table (   
sections = *apt] #fc is am5d$ by /rik+ !
 item relat+ to section #acde & ins]t+ !
 foll[+3  #acde4 ,injunctions aga9/     
fraud & abuse4  4  #ajd4 ,det]r+ !      
developm5t & sale ( comput] & cell phone
 spy+ devices ,section                  
#aief7;c77#g77;,d7 ( title #ah1 ,unit$  
,/ates ,code1 is am5d$ by ins]t+ section

 #beab 7relat+ to ! manufacture1        
di/ribution1 possession1 & adv]tis+ (   
wire1 oral1 or electronic communication 
int]cept+ devices71 be=e section #dfejb4
  ,,ii ,consum] privacy & security (    
s5sitive p]sonally id5tifiable in=mation
  ,a ,consum] privacy & data security   
program  #bja4 ,purpose & applicability 
( consum] privacy & data security       
program  7a7 ,purpose ,! purpose ( ?is  
subtitle is to ensure /&>ds = develop+ &
 implem5t+ adm9i/rative1 te*nical1 &    
physical safegu>ds to protect ! security
 ( s5sitive p]sonally id5tifiable       
in=mation4  7b7 ,applicability ,a cov]$ 
entity engag+ 9 int]/ate comm]ce t      
collects1 uses1 accesses1 transmits1    
/ores1 or disposes ( s5sitive p]sonally 
id5tifiable in=mation 9 electronic or   
digital =m ( n less ?an #aj1jjj ,unit$  
,/ates p]sons dur+ any #ab-mon? p]iod is
 subject to ! requirem5ts = a consum]   
privacy & data security program =       
protect+ s5sitive p]sonally id5tifiable 
in=mation4  7c7 ,limitations ,not)/&+   

any o!r obligation "u ?is subtitle1 ?is 
subtitle does n apply to ! foll[+3  7#a7
 ,f9ancial in/itutions ,f9ancial        
in/itutions-- 7,a7 subject to & 9       
compliance ) ! data security requirem5ts
 & /&>ds "u section #eja7;b7 ( !        
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhja7;b772 &  7,b7 subject to !       
jurisdiction ( an ag5cy or au?ority     
describ$ 9 section #eje7;a7 ( !         
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhje7;a774  7#b7 ,,hipaa & hite*      
regulat$ entities ,an entity t is       
subject to & 9 compliance ) ! data      
security requirem5ts ( ! foll[+1 )      
respect to data t is subject to su*     
requirem5ts3  7,a7 ,section #acdja ( !  
,heal? ,in=mation ,te*nology = ,economic
 & ,cl9ical ,heal? ,act 7#db ,u4,s4,c4  
#agica74  7,b7 ,"p #afj or #afd ( title 
#de1 ,code ( ,f$]al ,regulations 7or any
 successor regulations74  7,c7 ,!       
regulations promulgat$ "u section       
#bfd7;c7 ( ! ,heal? ,insurance          
,portability & ,acc\ntability ,act (    

#aiif 7#db ,u4,s4,c4 #acbj;d-#b note74  
7,d7 ,9 ! case ( a bus9ess associate1 z 
def9$ 9 section #acdjj ( ! ,heal?       
,in=mation ,te*nology = ,economic &     
,cl9ical ,heal? ,act 7#db ,u4,s4,c4     
#agiba71 ! applicable privacy & data    
security requirem5ts ( "p #a ( subtitle 
,d ( title ,,xiii ( division ,a ( !     
,am]ican ,re9ve/m5t & ,recov]y ,act (   
#bjji 7#db ,u4,s4,c4 #agica et seq474   
7#c7 ,s]vice provid]s ,a s]vice provid] 
= any electronic communication by a ?ird
 p>ty1 to ! ext5t t ! s]vice provid] is 
engag$ solely 9 ! transmission1 r\t+1 or
 tempor>y1 int]m$iate1 or transi5t      
/orage ( t communication4  #bjb4        
,requirem5ts = consum] privacy & data   
security program  7a7 ,consum] privacy &
 data security program ,a cov]$ entity  
subject to ?is subtitle %all comply ) ! 
foll[+ safegu>ds & any o!r adm9i/rative1
 te*nical1 or physical safegu>ds        
id5tifi$ by ! ,f$]al ,trade ,commission 
= ! protection ( s5sitive p]sonally     
id5tifiable in=mation3  7#a7 ,scope ,a  

cov]$ entity %all implem5t a            
compreh5sive consum] privacy & data     
security program t includes             
adm9i/rative1 te*nical1 & physical      
safegu>ds appropriate to ! size &       
complexity1 & ! nature & scope1 ( !     
activities ( ! cov]$ entity4  7#b7      
,design ,! consum] privacy & data       
security program %all be design$ to--   
7,a7 ensure ! privacy & security (      
s5sitive p]sonally id5tify+ in=mation2  
7,b7 protect aga9/ any anticipat$       
vuln]abilities to ! privacy & security (
 s5sitive p]sonally id5tify+ in=mation2 
&  7,c7 protect aga9/ unau?oriz$ access1
 de/ruction1 acquisition1 disclosure1 or
 use ( s5sitive p]sonally id5tify+      
in=mation4  7#c7 ,risk assessm5t ,a     
cov]$ entity %all-- 7,a7 id5tify        
reasonably =eseeable int]nal & ext]nal  
vuln]abilities & int]nal & ext]nal      
?reats t c\ld result 9 unau?oriz$       
access1 de/ruction1 acquisition1        
disclosure1 or use ( s5sitive p]sonally 
id5tifiable in=mation or ( sy/ems       

conta9+ s5sitive p]sonally id5tifiable  
in=mation2  7,b7 assess ! likelihood ( &
 pot5tial damage f unau?oriz$ access1   
de/ruction1 acquisition1 disclosure1 or 
use ( s5sitive p]sonally id5tifiable    
in=mation2  7,c7 assess ! suffici5cy (  
its te*nical1 physical1 & adm9i/rative  
controls 9 place to control & m9imize   
risks f unau?oriz$ access1 de/ruction1  
acquisition1 disclosure1 or use (       
s5sitive p]sonally id5tifiable          
in=mation2 &  7,d7 assess ! vuln]ability
 ( s5sitive p]sonally id5tifiable       
in=mation dur+ de/ruction & disposal (  
su* in=mation1 includ+ ?r\gh ! disposal 
or retirem5t ( h>dw>e4  7#d7 ,risk      
managem5t & control ,ea* cov]$ entity   
%all-- 7,a7 design its consum] privacy &
 data security program to control !     
risks id5tifi$ "u p>agraph 7#c72  7,b7  
adopt measures comm5surate ) !          
s5sitivity ( ! data z well z ! size1    
complexity1 nature1 & scope ( !         
activities ( ! cov]$ entity t--  7i7    
controls access to s5sitive p]sonally   

id5tifiable in=mation1 includ+ controls 
to au!nticate & p]mit access only to    
au?oriz$ individuals2  7ii7 detect1     
record1 & pres]ve in=mation relevant to 
actual & attempt$ fraudul5t1 unlawful1  
or unau?oriz$ access1 acquisition1      
disclosure1 or use ( s5sitive p]sonally 
id5tifiable in=mation1 includ+ by       
employees & o!r individuals o!rwise     
au?oriz$ to h access2  7iii7 protect    
s5sitive p]sonally id5tifiable in=mation
 dur+ use1 transmission1 /orage1 &      
disposal by encryption1 r$action1       
disclosure limitation me?odologies1 or  
access controls1 t are widely accept$ z 
an effective indu/ry practice or indu/ry
 /&>d1 or o!r reasonable means2  7iv7   
ensure t s5sitive p]sonally id5tifiable 
in=mation is prop]ly de/roy$ & dispos$  
(1 includ+ dur+ ! de/ruction ( comput]s 
& o!r electronic m$ia t conta9 s5sitive 
p]sonally id5tifiable in=mation2 &  7v7 
ensure t no ?ird p>ty is au?oriz$ to    
access or acquire s5sitive p]sonally    
id5tifiable in=mation 9 its possession  

)\t ! cov]$ entity fir/ p]=m+ suffici5t 
due dilig5ce to asc]ta91 ) reasonable   
c]ta9ty1 t su* in=mation is be+ s\ght = 
a valid legal purpose2 &  7,c7 e/abli% a
 plan & proc$ures = m9imiz+ ! am\nt (   
s5sitive p]sonally id5tifiable in=mation
 ma9ta9$ by ! cov]$ entity & ! l5g? ( "t
 su* in=mation is reta9$1 :i* %all      
provide = ! ret5tion ( s5sitive         
p]sonally id5tifiable in=mation only z  
reasonably ne$$ = ! bus9ess purposes (  
su* bus9ess entity or z necess>y to     
comply ) any legal obligation & only z  
long z s ne$$4  7#e7 ,limitation ,no?+ 9
 ?is subsection %all be con/ru$ to      
p]mit1 & no?+ does p]mit1 ! ,f$]al      
,trade ,commission to issue regulations 
requir+1 or accord+ great] legal /atus  
to1 ! implem5tation ( or application ( a
 specific te*nology or te*nological     
specifications = meet+ ! requirem5ts (  
?is title4  7b7 ,tra9+ ,cov]$ entities  
subject to ?is subtitle %all take /eps  
to ensure employee tra9+ & sup]vision = 
implem5tation ( ! consum] privacy & data

 security program ( ! cov]$ entity4  7c7
 ,vuln]ability te/+  7#a7 ,9 g5]al      
,cov]$ entities subject to ?is subtitle 
%all take /eps to ensure regul> te/+ (  
key te*nical1 physical1 & adm9i/rative  
controls = in=mation & in=mation sy/ems 
( ! consum] privacy & data security     
program to detect1 prev5t1 & respond to 
attacks or intrusions1 or o!r sy/em     
failures4  7#b7 ,frequ5cy ,! frequ5cy & 
nature ( ! te/s requir$ "u p>agraph 7#a7
 %all be det]m9$ by ! risk assessm5t ( !
 cov]$ entity "u subsection 7a77#c74    
7d7 ,relation%ip to c]ta9 provid]s (    
s]vices ,9 ! ev5t a cov]$ entity subject
 to ?is subtitle engages a p]son or     
entity n subject to ?is subtitle 7o!r   
?an a s]vice provid]7 to receive        
s5sitive p]sonally id5tifiable in=mation
 9 p]=m+ s]vices or functions 7o!r ?an !
 s]vices or functions provid$ by a      
s]vice provid]7 on behalf ( & "u !      
in/ruction ( su* cov]$ entity1 ! cov]$  
entity %all--  7#a7 ex]cise appropriate 
due dilig5ce 9 select+ ! p]son or entity

 = responsibilities relat$ to s5sitive  
p]sonally id5tifiable in=mation1 & take 
reasonable /eps to select & reta9 a     
p]son or entity t is capable ( ma9ta9+  
appropriate controls = ! privacy &      
security ( ! s5sitive p]sonally         
id5tifiable in=mation at issue2 &  7#b7 
require ! p]son or entity by contract to
 implem5t & ma9ta9 appropriate measures 
design$ to meet ! objectives &          
requirem5ts gov]n+ subtitle ,a4  7e7    
,p]iodic assessm5t & consum] privacy &  
data security mod]nization ,ea* cov]$   
entity subject to ?is subtitle %all on a
 regul> basis monitor1 evaluate1 &      
adju/1 z appropriate its consum] privacy
 & data security program 9 light ( any  
relevant *anges 9--  7#a7 te*nology2    
7#b7 int]nal or ext]nal ?reats &        
vuln]abilities to s5sitive p]sonally    
id5tifiable in=mation2 &  7#c7 ! *ang+  
bus9ess arrangem5ts ( ! cov]$ entity1   
su* z-- 7,a7 m]g]s & acquisitions2  7,b7
 alliances & jo9t v5tures2  7,c7        
outs\rc+ arrangem5ts2  7,d7 bankruptcy2 

&  7,e7 *anges to s5sitive p]sonally    
id5tifiable in=mation sy/ems4  7f7      
,consum] notice ,n less frequ5tly ?an   
once e cal5d> ye>1 a cov]$ entity %all  
provide1 ^u reque/ ( a ,unit$ ,/ates    
resid5t & at no co/ to t individual1    
notice to t individual ( :at s5sitive   
p]sonally id5tifiable in=mation ( t     
individual is ma9ta9$ or %>$ by ! cov]$ 
entity4  7g7 ,consum] opt-,out  7#a7    
,def9itions ,9 ?is subsection1 ! t]ms   
consum] & file h ! mean+s giv5 ! t]ms 9 
section #fjc ( ! ,fair ,cr$it ,report+  
,act 7#ae ,u4,s4,c4 #afha;a74  7#b7     
,cr$it freeze ,^u ! reque/ ( a consum]1 
a cov]$ entity t is a consum] report+   
ag5cy t compiles or ma9ta9s a file on ! 
consum] & has receiv$ appropriate pro( (
 ! id5tity ( ! reque/] %all place or    
lift a cr$it freeze 9 ! file ( ! consum]
 )\t *>ge to ! consum]4  7h7 ,rulemak+  
,n lat] ?an #a ye> aft] ! date (        
enactm5t ( ?is ,act1 ! ,f$]al ,trade    
,commission %all issue regulations 9    
accordance ) section #eec ( title #e1   

,unit$ ,/ates ,code1 to implem5t        
subsections 7a7 ?r\gh 7g74  7i7         
,implem5tation timel9e ,n lat] ?an #a   
ye> aft] ! date on :i* ! ,f$]al ,trade  
,commission issues ! f9al regulations   
requir$ "u subsection 7h71 a cov]$      
entity subject to ! provisions ( ?is    
subtitle %all implem5t a consum] privacy
 & data security program pursuant to ?is
 subtitle4  #bjc4 ,f$]al en=cem5t  7a7  
,9 g5]al ,! ,attorney ,g5]al & ! ,f$]al 
,trade ,commission may en=ce civil      
violations ( section #bja or #bjb4  7b7 
,civil actions by ! ,attorney ,g5]al ( !
 ,unit$ ,/ates  7#a7 ,9 g5]al ,!        
,attorney ,g5]al may br+ a civil action 
9 ! appropriate ,unit$ ,/ates di/rict   
c\rt aga9/ any cov]$ entity t engages 9 
conduct con/itut+ a violation ( ?is     
subtitle &1 ^u pro( ( su* conduct by a  
prepond]ance ( ! evid5ce1 su* cov]$     
entity %all be subject to a civil p5alty
 9 an am\nt t is n great] ?an ! product 
( ! numb] ( individuals ^: s5sitive     
p]sonally id5tifiable in=mation 0 plac$ 

at risk z a result ( ! violation &      
#af1ejj4  7#b7 ,det]m9ations ,!         
det]m9ation ( :e!r a violation ( a      
provision ( ?is subtitle has occurr$1 & 
if s1 ! am\nt ( ! p5alty to be impos$1  
if any1 %all be made by ! c\rt sitt+ z !
 f9d] ( fact4 ,! det]m9ation ( :e!r a   
violation ( a provision ( ?is subtitle 0
 willful or int5tional1 & if s1 ! am\nt 
( ! additional p5alty to be impos$1 if  
any1 %all be made by ! c\rt sitt+ z !   
f9d] ( fact4  7#c7 ,additional p5alty   
limit ,if a c\rt det]m9es "u p>agraph   
7#b7 t a violation ( a provision ( ?is  
subtitle 0 willful or int5tional &      
imposes an additional p5alty1 ! c\rt may
 n impose an additional p5alty 9 an     
am\nt t exce$s #aj1jjj1jjj4  7c7        
,injunctive actions by ! ,attorney      
,g5]al  7#a7 ,9 g5]al ,if x appe>s t a  
cov]$ entity has engag$1 or is engag$1 9
 any act or practice con/itut+ a        
violation ( ?is subtitle1 ! ,attorney   
,g5]al may petition an appropriate      
di/rict c\rt ( ! ,unit$ ,/ates = an     

ord]--  7,a7 enjo9+ su* act or practice2
 or  7,b7 en=c+ compliance ) ?is        
subtitle4  7#b7 ,issuance ( ord] ,a c\rt
 may issue an ord] "u p>agraph 7#a71 if 
! c\rt f9ds t ! conduct 9 "q con/itutes 
a violation ( ?is subtitle4  7d7 ,civil 
actions by ! ,f$]al ,trade ,commission  
7#a7 ,9 g5]al ,compliance ) !           
requirem5ts impos$ "u ?is subtitle may  
be en=c$ "u ! ,f$]al ,trade ,commission 
,act 7#ae ,u4,s4,c4 #da et seq47 by !   
,f$]al ,trade ,commission ) respect to  
bus9ess entities subject to ?is ,act4   
,all ( ! functions & p[]s ( ! ,f$]al    
,trade ,commission "u ! ,f$]al ,trade   
,commission ,act are available to !     
,commission to en=ce compliance by any  
p]son ) ! requirem5ts impos$ "u ?is     
title4  7#b7 ,civil p5alties  7,a7 ,9   
g5]al ,any cov]$ entity t violates !    
provisions ( ?is subtitle %all be       
subject to a civil p5alty 9 ! am\nt t is
 n great] ?an ! product ( ! numb] (     
individuals ^: s5sitive p]sonally       
id5tifiable in=mation 0 plac$ at risk z 

a result ( ! violation & #af1ejj4  7,b7 
,det]m9ations ,! det]m9ation ( :e!r a   
violation ( a provision ( ?is subtitle  
has occurr$1 & if s1 ! am\nt ( ! p5alty 
to be impos$1 if any1 %all be made by ! 
c\rt sitt+ z ! f9d] ( fact4 ,!          
det]m9ation ( :e!r a violation ( a      
provision ( ?is subtitle 0 willful or   
int5tional1 & if s1 ! am\nt ( !         
additional p5alty to be impos$1 if any1 
%all be made by ! c\rt sitt+ z ! f9d] ( 
fact4  7,c7 ,additional p5alty limit ,if
 a c\rt det]m9es "u subp>agraph 7,b7 t a
 violation ( a provision ( ?is subtitle 
0 willful or int5tional & imposes an    
additional p5alty1 ! c\rt may n impose  
an additional p5alty 9 an am\nt t exce$s
 #aj1jjj1jjj4  7#c7 ,unfair or deceptive
 acts or practices ,= ! purpose ( !     
ex]cise by ! ,f$]al ,trade ,commission (
 its functions & p[]s "u ! ,f$]al ,trade
 ,commission ,act1 a violation ( any    
requirem5t or prohibition impos$ "u ?is 
title %all con/itute an unfair or       
deceptive act or practice 9 comm]ce 9   

violation ( a regulation "u section     
#ah7;a77#a77;,b7 ( ! ,f$]al ,trade      
,commission ,act 7#ae ,u4,s4,c4         
#eg;a7a77,i77,b77 reg>d+ unfair or      
deceptive acts or practices & %all be   
subject to en=cem5t by ! ,f$]al ,trade  
,commission "u t ,act ) respect to any  
bus9ess entity1 irrespective ( :e!r t   
bus9ess entity is engag$ 9 comm]ce or   
meets any o!r jurisdictional te/s 9 !   
,f$]al ,trade ,commission ,act4  7e7    
,coord9ation ( en=cem5t  7#a7 ,9 g5]al  
,:5 op5+ an inve/igation1 ! ,f$]al      
,trade ,commission %all consult ) !     
,attorney ,g5]al4  7#b7 ,limitation ,!  
,f$]al ,trade ,commission may initiate  
inve/igations "u ?is subsection unless !
 ,attorney ,g5]al det]m9es t su* an     
inve/igation w\ld imp$e an ongo+ crim9al
 inve/igation or national security      
activity4  7#c7 ,coord9ation agreem5t   
7,a7 ,9 g5]al ,9 ord] to avoid conflicts
 & promote consi/5cy reg>d+ ! en=cem5t &
 litigation ( matt]s "u ?is ,act1 n lat]
 ?an #ahj days aft] ! date ( enactm5t ( 

?is ,act1 ! ,attorney ,g5]al & ! ,f$]al 
,trade ,commission %all ent] into an    
agreem5t = coord9ation reg>d+ ! en=cem5t
 ( ?is ,act4  7,b7 ,requirem5t ,!       
coord9ation agreem5t ent]$ into "u      
subp>agraph 7,a7 %all include provisions
 to ensure t p>allel inve/igations &    
proce$+s "u ?is section are conduct$ 9 a
 mann] t avoids conflicts & does n imp$e
 ! ability ( ! ,attorney ,g5]al to      
prosecute violations ( ,f$]al crim9al   
laws4  7f7 ,o!r rights & rem$ies ,!     
rights & rem$ies available "u ?is       
section are cumulative & %all n affect  
any o!r rights & rem$ies available "u   
law4  #bjd4 ,en=cem5t by ,/ate attorneys
 g5]al  7a7 ,/ate en=cem5t  7#a7 ,civil 
actions ,9 any case 9 :i* ! attorney    
g5]al ( a ,/ate or any ,/ate or local   
law en=cem5t ag5cy au?oriz$ by ! ,/ate  
attorney g5]al or by ,/ate /atute to    
prosecute violations ( consum]          
protection law1 has reason to believe t 
a cov]$ entity has violat$ section #bja 
or #bjb1 ! ,/ate1 z p>5s patriae1 may   

br+ a civil action on behalf ( !        
resid5ts ( t ,/ate to--  7,a7 enjo9 t   
act or practice2  7,b7 en=ce compliance 
) section #bja or #bjb2 or  7,c7 impose 
a civil p5alty 9 an am\nt t is n great] 
?an ! product ( ! numb] ( individuals ^:
 s5sitive p]sonally id5tifiable         
in=mation 0 plac$ at risk z a result ( !
 violation & #af1ejj4  7#b7 ,p5alty     
det]m9ation  7,a7 ,det]m9ations ,!      
det]m9ation ( :e!r a violation ( a      
provision ( ?is subtitle has occurr$1 & 
if s1 ! am\nt ( ! p5alty to be impos$1  
if any1 %all be made by ! c\rt sitt+ z !
 f9d] ( fact4 ,! det]m9ation ( :e!r a   
violation ( a provision ( ?is subtitle 0
 willful or int5tional1 & if s1 ! am\nt 
( ! additional p5alty to be impos$1 if  
any1 %all be made by ! c\rt sitt+ z !   
f9d] ( fact4  7,b7 ,additional p5alty   
limit ,if a c\rt det]m9es "u subp>agraph
 7,a7 t a violation ( a provision ( ?is 
subtitle 0 willful or int5tional &      
imposes an additional p5alty1 ! c\rt may
 n impose an additional p5alty 9 an     

am\nt t exce$s #aj1jjj1jjj4  7#c7       
,notice  7,a7 ,9 g5]al ,be=e fil+ an    
action "u ?is subsection1 ! attorney    
g5]al ( ! ,/ate involv$ %all provide to 
! ,attorney ,g5]al ( ! ,unit$ ,/ates & !
 ,f$]al ,trade ,commission--  7i7 a     
writt5 notice ( t action2 &  7ii7 a copy
 ( ! compla9t = t action4  7,b7         
,exception ,subp>agraph 7,a7 %all n     
apply ) respect to ! fil+ ( an action by
 an attorney g5]al ( a ,/ate "u ?is     
subsection1 if ! attorney g5]al ( a     
,/ate det]m9es t x is n feasible to     
provide ! notice describ$ 9 ?is         
subp>agraph be=e ! fil+ ( ! action4     
7,c7 ,notification :5 practicable ,9 an 
action describ$ "u subp>agraph 7,b71 !  
attorney g5]al ( a ,/ate %all provide ! 
writt5 notice & ! copy ( ! compla9t to !
 ,attorney ,g5]al ( ! ,unit$ ,/ates & ! 
,f$]al ,trade ,commission z soon aft] ! 
fil+ ( ! compla9t z practicable4  7#d7  
,f$]al proce$+s ,^u receiv+ notice "u   
p>agraph 7#b71 ! ,attorney ,g5]al ( !   
,unit$ ,/ates & ! ,f$]al ,trade         

,commission %all h ! "r to--  7,a7 move 
to /ay ! action1 p5d+ ! f9al disposition
 ( a p5d+ ,f$]al proce$+ or action z    
describ$ 9 section #bjc2  7,b7 initiate 
an action 9 ! appropriate ,unit$ ,/ates 
di/rict c\rt "u section #bjc & move to  
consolidate all p5d+ actions1 includ+   
,/ate actions1 9 su* c\rt2  7,c7 int]v5e
 9 an action br\ght "u p>agraph 7#a72 & 
7,d7 file petitions = appeal4  7#e7     
,p5d+ proce$+s ,if ! ,attorney ,g5]al ( 
! ,unit$ ,/ates or ! ,f$]al ,trade      
,commission initiates a ,f$]al civil    
action = a violation ( ?is subtitle1 or 
any regulations !reund]1 no attorney    
g5]al ( a ,/ate may br+ an action = a   
violation ( ?is subtitle t result$ f !  
same or relat$ acts or omissions aga9/ a
 def5dant nam$ 9 ! ,f$]al civil action  
initiat$ by ! ,attorney ,g5]al ( !      
,unit$ ,/ates or ! ,f$]al ,trade        
,commission4  7#f7 ,rule ( con/ruction  
,= purposes ( br++ any civil action "u  
p>agraph 7#a7 no?+ 9 ?is subtitle %all  
be con/ru$ to prev5t an attorney g5]al (

 a ,/ate f ex]cis+ ! p[]s conf]r$ on !  
attorney g5]al by ! laws ( t ,/ate to-- 
7,a7 conduct inve/igations2  7,b7       
adm9i/] oa?s & affirmations2 or  7,c7   
compel ! att5dance ( witnesses or !     
production ( docum5t>y & o!r evid5ce4   
7#g7 ,v5ue2 s]vice ( process  7,a7 ,v5ue
 ,any action br\ght "u subsection 7a7   
may be br\ght 9--  7i7 ! di/rict c\rt ( 
! ,unit$ ,/ates t meets applicable      
requirem5ts relat+ to v5ue "u section   
#acia ( title #bh1 ,unit$ ,/ates ,code2 
or  7ii7 ano!r c\rt ( compet5t          
jurisdiction4  7,b7 ,s]vice ( process ,9
 an action br\ght "u subsection 7a71    
process may be s]v$ 9 any di/rict 9 :i* 
! def5dant--  7i7 is an inhabitant2 or  
7ii7 may be f\nd4  7b7 ,no private cause
 ( action ,no?+ 9 ?is subtitle e/abli%es
 a private cause ( action aga9/ a       
bus9ess entity = violation ( any        
provision ( ?is subtitle4  #bje4        
,relation to o!r laws  7a7 ,preemption  
,= any cov]$ entity t is subject to ?is 
subtitle1 ! provisions ( ?is subtitle   

%all sup]s$e any o!r provision ( ,f$]al 
law1 or any provisions ( ! law ( any    
,/ate or political subdivision ( a      
,/ate1 requir+ data security practices t
 are less /r+5t ?an ! requirem5ts ( ?is 
subtitle4  7b7 ,consum] protection laws 
,except z provid$ 9 subsection 7a71 ?is 
section %all n be con/ru$ to limit !    
en=cem5t ( any ,/ate consum] protection 
law by an attorney g5]al ( a ,/ate4  7c7
 ,protection ( c]ta9 ,/ate laws ,no?+ 9 
?is ,act %all be con/ru$ to preempt !   
applicability (-- 7#a7 ,/ate trespass1  
contract1 or tort law2 or  7#b7 any o!r 
,/ate law to ! ext5t t ! law relates to 
acts ( fraud4  7d7 ,pres]vation ( ,,ftc 
au?ority ,no?+ 9 ?is ,act may be con/ru$
 9 any way to limit ! au?ority ( !      
,f$]al ,trade ,commission "u any o!r    
provision ( law4  7e7 ,pres]vation (    
,,fcc au?ority ,no?+ 9 ?is ,act may be  
con/ru$ 9 any way to limit ! au?ority ( 
! ,f$]al ,communications ,commission "u 
any o!r provision ( law4  ,b ,security  
brea* notification & protection  #baa4  

,notice to individuals2 protection  7a7 
,9 g5]al ,except z provid$ 9 section    
#bab1 a cov]$ entity %all1 foll[+ !     
discov]y ( a security brea* ( s5sitive  
p]sonally id5tifiable in=mation held by 
t cov]$ entity or any ?ird-p>ty entity  
contract$ to ma9ta9 or process data 9   
electronic =m conta9+ s5sitive p]sonally
 id5tifiable in=mation = t cov]$        
entity--  7#a7 notify any resid5t ( !   
,unit$ ,/ates ^: s5sitive p]sonally     
id5tifiable in=mation has be51 or is    
reasonably believ$ to h be51 access$ or 
acquir$2 &  7#b7 provide #e ye>s (      
appropriate id5tity !ft prev5tion &     
mitigation s]vices1 if any1 to any      
individual notifi$ "u p>agraph 7#a71 ^u 
reque/ ( ! individual & at no co/ to !  
individual1 "u :i* ! individual %all n  
be--  7,a7 automatically enroll$1 )\t ! 
cons5t ( ! individual1 into a fee-bas$  
id5tity !ft prev5tion & mitigation      
s]vice at ! end ( ! #e-ye> p]iod2 or    
7,b7 requir$ to seek arbitration ( any  
claim aris+ f ! id5tity !ft prev5tion & 

mitigation s]vice describ$ 9 subp>agraph
 7,a74  7b7 ,obligation ( ?ird-,p>ty    
entities  7#a7 ,9 g5]al ,9 ! ev5t ( a   
brea* ( security ( a sy/em ma9ta9$ by a 
?ird-p>ty entity t has be5 contract$ to 
ma9ta9 or process data 9 electronic =m  
conta9+ s5sitive p]sonally id5tifiable  
in=mation on behalf ( a cov]$ entity :o 
owns or possesses su* data1 ! ?ird-p>ty 
entity %all notify ! cov]$ entity ( !   
brea* ( security4 ,^u receiv+           
notification f ! ?ird-p>ty entity1 su*  
cov]$ entity %all provide ! notification
 & id5tify !ft prev5tion & mitigation   
s]vice requir$ "u subsection 7a74  7#b7 
,notice by ?ird-p>ty entities ,no?+ 9   
?is subtitle %all prev5t or abrogate an 
agreem5t betwe5 a cov]$ entity requir$  
to give notice "u ?is section & a       
?ird-p>ty entity t has be5 contract$ to 
ma9ta9 or process data 9 electronic =m  
conta9+ s5sitive p]sonally id5tifiable  
in=mation = a cov]$ entity1 to provide !
 notifications requir$ "u subsection    
7a77#a7 or ! id5tity !ft prev5tion &    

mitigation s]vice requir$ "u subsection 
7a77#b74  7#c7 ,s]vice provid]s ,if a   
s]vice provid] becomes aw>e ( a security
 brea* conta9+ s5sitive p]sonally       
id5tifiable in=mation t is own$ or      
possess$ by a cov]$ entity t connects to
 or uses a sy/em or network provid$ by !
 s]vice provid] = ! purpose (           
transmitt+1 r\t+1 or provid+ int]m$iate 
or transi5t /orage ( su* data1 ! s]vice 
provid] %all be requir$ to promptly     
notify ! cov]$ entity :o initiat$ su*   
connection1 transmission1 r\t+1 or      
/orage ( ! security brea* if ! cov]$    
entity c be reasonably id5tifi$4 ,^u    
receiv+ su* notification f a s]vice     
provid]1 ! cov]$ entity %all be requir$ 
to provide ! notification & id5tity !ft 
prev5tion & mitigation s]vice requir$ "u
 subsection 7a74  7c7 ,timel9ess (      
notification  7#a7 ,9 g5]al ,all        
notifications & id5tity !ft prev5tion & 
mitigation s]vices requir$ "u ?is       
section %all be made z exp$i5tly z      
possible & )\t unreasonable delay foll[+

 ! discov]y by ! cov]$ entity ( a       
security brea*4  7#b7 ,reasonable delay 
,reasonable delay "u ?is subsection may 
include any reasonable "t necess>y to   
det]m9e ! scope ( ! security brea*1     
prev5t fur!r disclosures1 & provide     
notice to law en=cem5t :5 requir$4      
,except z provid$ 9 subsection 7d71     
delay ( notification or provision (     
id5tity !ft prev5tion & mitigation      
s]vice %all n exce$ #g days foll[+ !    
discov]y ( a security brea*4  7#c7      
,burd5 ( production ,! cov]$ entity     
requir$ to provide notice & id5tity !ft 
prev5tion & mitigation s]vice "u ?is    
subtitle %all1 ^u ! reque/ ( ! ,attorney
 ,g5]al ( ! ,unit$ ,/ates or ! ,f$]al   
,trade ,commission provide records or   
o!r evid5ce ( ! notifications & id5tity 
!ft prev5tion & mitigation s]vice       
requir$ "u ?is subtitle1 includ+ to !   
ext5t applicable1 ! reasons = any delay 
( notification or provision ( id5tity   
!ft prev5tion & mitigation s]vice4  7d7 
,delay au?oriz$ = law en=cem5t or       

national security purposes  7#a7 ,9     
g5]al ,if a ,f$]al law en=cem5t ag5cy or
 intellig5ce ag5cy det]m9es t !         
notification or provision ( id5tity !ft 
prev5tion & mitigation s]vice requir$ "u
 ?is section w\ld imp$e a crim9al       
inve/igation1 or national security      
activity1 su* notification or provision 
( id5tity !ft prev5tion & mitigation    
s]vice1 z ! case may be1 %all be delay$ 
^u writt5 notice f a ,f$]al law en=cem5t
 ag5cy or intellig5ce ag5cy to ! cov]$  
entity t exp]i5c$ ! security brea*4 ,!  
notification f a ,f$]al law en=cem5t    
ag5cy or intellig5ce ag5cy %all specify 
9 writ+ ! p]iod ( delay reque/$ = law   
en=cem5t or national security purposes4 
7#b7 ,ext5d$ delay ,if ! notification or
 provision ( id5tity !ft prev5tion &    
mitigation s]vice requir$ "u subsection 
7a7 is delay$ pursuant to p>agraph 7#a71
 a cov]$ entity %all give notice or     
id5tity !ft prev5tion & mitigation      
s]vice1 z ! case may be1 #ae days aft] !
 day su* law en=cem5t or national       

security delay 0 invok$ unless a ,f$]al 
law en=cem5t or intellig5ce ag5cy       
provides writt5 notification t fur!r    
delay is necess>y4  7#c7 ,law en=cem5t  
immunity ,no noncon/itutional cause (   
action %all lie 9 any c\rt aga9/ any    
ag5cy = acts relat+ to ! delay (        
notification = law en=cem5t or national 
security purposes "u ?is subtitle4  7e7 
,limitations ,not)/&+ any o!r obligation
 "u ?is subtitle1 ?is subtitle does n   
apply to ! foll[+3  7#a7 ,f9ancial      
in/itutions ,f9ancial in/itutions-- 7,a7
 subject to & 9 compliance ) ! data     
security requirem5ts & /&>ds "u section 
#eja7;b7 ( ! ,gramm-,lea*-,bliley ,act  
7#ae ,u4,s4,c4 #fhja7;b772 &  7,b7      
subject to ! jurisdiction ( an ag5cy or 
au?ority describ$ 9 section #eje7;a7 ( !
 ,gramm-,lea*-,bliley ,act 7#ae         
,u4,s4,c4 #fhje7;a774  7#b7 ,,hipaa &   
hite* regulat$ entities ,an entity t is 
subject to & 9 compliance ) ! data brea*
 notification ( ! foll[+1 ) respect to  
data t is subject to su* requirem5ts3   

7,a7 ,section #acdja ( ! ,heal?         
,in=mation ,te*nology = ,economic &     
,cl9ical ,heal? ,act 7#db ,u4,s4,c4     
#agica74  7,b7 ,"p #afj or #afd ( title 
#de1 ,code ( ,f$]al ,regulations 7or any
 successor regulations74  7,c7 ,!       
regulations promulgat$ "u section       
#bfd7;c7 ( ! ,heal? ,insurance          
,portability & ,acc\ntability ,act (    
#aiif 7#db ,u4,s4,c4 #acbj;d-#b note74  
7,d7 ,9 ! case ( a bus9ess entity1 !    
applicable data brea* notification      
requirem5ts ( "p #a ( subtitle ,d (     
title ,,xiii ( division ,a ( ! ,am]ican 
,re9ve/m5t & ,recov]y ,act ( #bjji 7#db 
,u4,s4,c4 #agica et seq471 if su*       
bus9ess entity is act+ z a cov]$ entity1
 a bus9ess associate1 or a v5dor (      
p]sonal heal? records1 z ^? t]ms are    
def9$ 9 section #acdjj ( ! ,heal?       
,in=mation ,te*nology = ,economic &     
,cl9ical ,heal? ,act 7#db ,u4,s4,c4     
#agiba74  7,e7 ,9 ! case ( a ?ird-p>ty  
s]vice provid]1 section #acdjg ( !      
,heal? ,in=mation ,te*nology = ,economic

 & ,cl9ical ,heal? ,act 7#db ,u4,s4,c4  
#agicg74  #bab4 ,exemptions  7a7        
,national security & law en=cem5t       
exemption  7#a7 ,9 g5]al ,section #baa  
%all n apply to a cov]$ entity if a     
,f$]al law en=cem5t ag5cy or intellig5ce
 ag5cy--  7,a7 det]m9es t notification (
 ! security brea*--  7i7 c\ld be expect$
 to reveal s5sitive s\rces & me?ods or  
simil>ly imp$e ! ability ( ! ,gov]nm5t  
to conduct law en=cem5t inve/igations2  
or  7ii7 c\ld be expect$ to cause damage
 to ! national security2  7,b7          
communicates ! det]m9ation made "u      
subp>agraph 7,a7 to ! cov]$ entity2 &   
7,c7 ord]s t notification requir$ "u    
section #baa n be made4  7#b7 ,immunity 
,no noncon/itutional cause ( action %all
 lie 9 any c\rt aga9/ any ,f$]al ag5cy =
 acts relat+ to ! exemption f           
notification = law en=cem5t or national 
security purposes "u ?is title4  7b7    
,safe h>bor exemption ,a cov]$ entity   
%all be exempt f ! notice & id5tity !ft 
prev5tion & mitigation s]vice           

requirem5ts "u section #baa if ! cov]$  
entity reasonably det]m9es t s5sitive   
p]sonally id5tifiable in=mation is r5d]$
 unusable1 unreadable1 or indeciph]able 
?r\gh data security te*nology or        
me?odology1 includ+ encryption or       
r$action1 t is g5]ally accept$ by exp]ts
 9 ! field ( in=mation security1 su* t  
!re is no reasonable likelihood t a     
security brea* has result$ 91 or w      
result 91 ! misuse ( data4  #bac4       
,me?ods ( notice ,a cov]$ entity %all be
 9 compliance ) section #baa if ! cov]$ 
entity provides ! foll[+3  7#a7         
,individual notice ,notice to           
individuals by "o ( ! foll[+ means if ! 
me?od ( notification select$ c mo/      
likely be expect$ to rea* ! int5d$      
individual3  7,a7 ,writt5 notification  
to ! la/ kn[n home mail+ address ( !    
individual 9 ! records ( ! cov]$ entity4
  7,b7 ,telephone notice to ! individual
 p]sonally1 provid$ t ! telephone notice
 is made directly to ea* affect$        
consum]1 & is n made ?r\gh a pr]ecord$  

message4  7,c7 ,e-mail notice1 if-- 7i7 
7,i7 ! cov]$ entity's prim>y me?od (    
communication ) ! individual is by      
e-mail2 or  7,,ii7 ! individual has     
cons5t$ to receive su* notice & ! notice
 is consi/5t ) ! provisions p]mitt+     
electronic transmission ( notices "u    
section #aja ( ! ,electronic ,signatures
 9 ,global & ,national ,comm]ce ,act    
7#ae ,u4,s4,c4 #gjja72 &  7ii7 ! e-mail 
notice does n reque/1 or conta9 a       
hyp]text l9k to a reque/1 t ! consum]   
provide p]sonal in=mation 9 response to 
! notice4  7#b7 ,m$ia1 website1 & social
 m$ia notice ,9 ! ev5t notice is requir$
 to m ?an #e1jjj individuals 9 #a ,/ate 
& individual notice is n feasible due to
 lack ( suffici5t contact in=mation = ! 
individuals requir$ to be notifi$1 a    
cov]$ entity %all--  7,a7 provide notice
 to ! major m$ia outlets s]v+ ! ,/ate or
 jurisdiction ( ! individuals believ$ to
 be affect$2  7,b7 place notice 9 a cle>
 & conspicu\s place on ! website ( !    
cov]$ entity if ! cov]$ entity op]ates a

 website2 &  7,c7 place notice on ea*   
social m$ia plat=m on :i* ! cov]$ entity
 ma9ta9s a social m$ia pres5ce1 if any4 
#bad4 ,cont5t ( notification  7a7 ,9    
g5]al ,reg>dless ( ! me?od by :i* notice
 is provid$ to individuals "u section   
#bac1 su* notice %all include1 to !     
ext5t possible--  7#a7 a g5]al          
description ( ! incid5t & ! date or     
e/imat$ date ( ! security brea* & ! date
 range dur+ :i* ! s5sitive p]sonally    
id5tifiable in=mation 0 compromis$2     
7#b7 a description ( ! categories (     
s5sitive p]sonally id5tifiable in=mation
 t 01 or is reasonably believ$ to h be51
 access$ or acquir$ by an unau?oriz$    
p]son2  7#c7 ! acts ! cov]$ entity1 or !
 ag5t ( ! cov]$ entity1 has tak5 to     
protect s5sitive p]sonally id5tifiable  
in=mation f fur!r security brea*2  7#d7 
at ! discretion ( ! cov]$ entity1       
reasonable advice on /eps ! individual  
may take to protect himself or h]self2  
7#e7 if applicable1 an (f] to provide   
appropriate id5tity !ft prev5tion &     

mitigation s]vices1 z describ$ 9 section
 #baa7;a77#b72  7#f7 a toll-free numb]--
 7,a7 t ! individual may use to contact 
! cov]$ entity1 or ! ag5t ( ! cov]$     
entity2 &  7,b7 f :i* ! individual may  
le>n :at types ( s5sitive p]sonally     
id5tifiable in=mation ! cov]$ entity    
ma9ta9$ ab\t t individual2 &  7#g7 !    
toll-free contact telephone numb]s &    
addresses = ! major cr$it report+       
ag5cies if ! s5sitive p]sonally         
id5tifiable in=mation t 0 brea*$ c\ld be
 us$ to commit f9ancial fraud or id5tity
 !ft4  7b7 ,direct bus9ess relation%ip  
,reg>dless ( :e!r a cov]$ entity or a   
designat$ ?ird p>ty provides ! notice   
requir$ pursuant to section #baa7;b71   
su* notice %all include ! "n ( ! cov]$  
entity t has ! mo/ direct relation%ip ) 
! individual be+ notifi$4  #bae4        
,coord9ation ( notification ) cr$it     
report+ ag5cies ,if a cov]$ entity is   
requir$ to provide notification to m ?an
 #e1jjj individuals "u section #baa7;a7 
& ! s5sitive p]sonally id5tifiable      

in=mation t 0 brea*$ c\ld be us$ to     
commit f9ancial fraud or id5tity !ft1 ! 
cov]$ entity %all also notify all       
consum] report+ ag5cies t compile &     
ma9ta9 files on consum]s on a nationwide
 basis 7z def9$ 9 section #fjc7p7 ( !   
,fair ,cr$it ,report+ ,act 7#ae         
,u4,s4,c4 #afha;a7p777 ( ! tim+ &       
di/ribution ( ! notices4 ,su* notice    
%all be giv5 to ! consum] cr$it report+ 
ag5cies )\t unreasonable delay &1 if x w
 n delay notice to ! affect$            
individuals1 prior to ! di/ribution (   
notices to ! affect$ individuals4  #baf4
 ,notice to ! ,f$]al ,trade ,commission 
7a7 ,9 g5]al ,a cov]$ entity requir$ to 
provide notification "u section #baa7;a7
 %all provide a copy ( ! notification to
 ! ,f$]al ,trade ,commission n lat] ?an 
! date on :i* notice is provid$ to      
individuals requir$ to be notifi$4 ,!   
,f$]al ,trade ,commission %all e/abli%  
proc$ures to ensure ! attorneys g5]al ( 
ea* ,/ate ) affect$ resid5ts receives a 
copy ( ! notice provid$ to x "u ?is     

section4  7b7 ,public database & report 
to ,congress ,! ,f$]al ,trade           
,commission %all-- 7#a7 ma9ta9 a public 
database on ! website ( ! ,f$]al ,trade 
,commission ( notifications receiv$ "u  
subsection 7a72 &  7#b7 on an annual    
basis1 submit a report to ,congress on !
 notifications receiv$ "u subsection    
7a74  #bag4 ,notice to law en=cem5t  7a7
 ,designation ( gov]nm5t entity ,to     
receive notice  7#a7 ,9 g5]al ,n lat]   
?an #fj days aft] ! date ( enactm5t (   
?is ,act1 ! ,secret>y ( ,homel&         
,security1 9 consultation ) ! ,attorney 
,g5]al1 %all designate a ,f$]al         
,gov]nm5t entity to receive ! notices   
requir$ "u section #baa & ?is section4  
7#b7 ,responsibilities ( ! designat$    
entity ,! designat$ entity %all-- 7,a7  
promptly provide ! in=mation t x        
receives to ! ,unit$ ,/ates ,secret     
,s]vice or ! ,f$]al ,bureau (           
,inve/igation = law en=cem5t purposes2 &
  7,b7 provide ! in=mation describ$ 9   
subp>agraph 7,a7 z appropriate to o!r   

,f$]al ag5cies = law en=cem5t1 national 
security1 or data security purposes4    
7b7 ,notice ,a cov]$ entity %all notify 
! designat$ entity ( ! fact t a security
 brea* has occurr$ if--  7#a7 ! numb] ( 
individuals ^: s5sitive p]sonally       
id5tify+ in=mation 01 or is reasonably  
believ$ to h be51 access$ or acquir$ by 
an unau?oriz$ p]son exce$s #e1jjj2  7#b7
 ! security brea* involves a database1  
network$ or integrat$ databases1 or o!r 
data sy/em conta9+ ! s5sitive p]sonally 
id5tifiable in=mation ( m ?an #ejj1jjj  
individuals nationwide2  7#c7 ! security
 brea* involves databases own$ by !     
,f$]al ,gov]nm5t2 or  7#d7 ! security   
brea* involves prim>ily s5sitive        
p]sonally id5tifiable in=mation (       
individuals kn[n to ! cov]$ entity to be
 employees & contractors ( ! ,f$]al     
,gov]nm5t involv$ 9 national security or
 law en=cem5t4  7c7 ,dep>tm5t ( ,ju/ice 
review ( ?re%olds = notice ,! ,attorney 
,g5]al1 9 consultation ) ! ,secret>y (  
,homel& ,security1 aft] notice & !      

opportunity = public comm5t1 & 9 a mann]
 consi/5t ) ?is section1 %all promulgate
 regulations1 z necess>y1 "u section    
#eec ( title #e1 ,unit$ ,/ates ,code1 to
 adju/ ! ?re%olds = notice to law       
en=cem5t & national security au?orities 
"u subsection 7a7 & to facilitate !     
purposes ( ?is section4  7d7 ,tim+ ,!   
notice requir$ "u subsection 7b7 %all be
 provid$ z promptly z possible1 b su*   
notice mu/ be provid$ n less ?an #dh    
h\rs be=e notice is provid$ to an       
individual pursuant to section #baa1 or 
n lat] ?an #g days aft] ! discov]y ( !  
ev5ts requir+ notice1 :i*ev] occurs     
fir/4 ,= ea* brea* requir+ notice "u ?is
 subsection1 a copy ( ! notice to       
individuals requir$ "u section #baa %all
 also be provid$ to ! designat$ entity n
 lat] ?an ! date on :i* ! notice is     
provid$ to affect$ individuals4  #bah4  
,f$]al en=cem5t  7a7 ,9 g5]al ,!        
,attorney ,g5]al & ! ,f$]al ,trade      
,commission may en=ce civil violations (
 ?is subtitle4  7b7 ,civil actions by ! 

,attorney ,g5]al ( ! ,unit$ ,/ates  7#a7
 ,9 g5]al ,! ,attorney ,g5]al may br+ a 
civil action 9 ! appropriate ,unit$     
,/ates di/rict c\rt aga9/ any cov]$     
entity t engages 9 conduct con/itut+ a  
violation ( ?is subtitle &1 ^u pro( (   
su* conduct by a prepond]ance ( !       
evid5ce1 ! cov]$ entity %all be subject 
to a civil p5alty 9 an am\nt n great]   
?an ! product ( ! numb] ( violations (  
?is subtitle & #af1ejj4 ,ea* failure to 
provide notification to an individual z 
requir$ "u ?is subtitle %all be treat$ z
 a sep>ate violation4  7#b7             
,det]m9ations ,! det]m9ation ( :e!r a   
violation ( a provision ( ?is subtitle  
has occurr$1 & if s1 ! am\nt ( ! p5alty 
to be impos$1 if any1 %all be made by ! 
c\rt sitt+ z ! f9d] ( fact4 ,!          
det]m9ation ( :e!r a violation ( a      
provision ( ?is subtitle 0 willful or   
int5tional1 & if s1 ! am\nt ( !         
additional p5alty to be impos$1 if any1 
%all be made by ! c\rt sitt+ z ! f9d] ( 
fact4  7#c7 ,additional p5alty limit ,if

 a c\rt det]m9es "u p>agraph 7#b7 t a   
violation ( a provision ( ?is subtitle 0
 willful or int5tional & imposes an     
additional p5alty1 ! c\rt may n impose  
an additional p5alty 9 an am\nt t exce$s
 #aj1jjj1jjj4  7c7 ,injunctive actions  
by ! ,attorney ,g5]al  7#a7 ,9 g5]al ,if
 x appe>s t a cov]$ entity has engag$1  
or is engag$1 9 any act or practice     
con/itut+ a violation ( ?is subtitle1 ! 
,attorney ,g5]al may petition an        
appropriate di/rict c\rt ( ! ,unit$     
,/ates = an ord]--  7,a7 enjo9+ su* act 
or practice2 or  7,b7 en=c+ compliance )
 ?is subtitle4  7#b7 ,issuance ( ord] ,a
 c\rt may issue an ord] "u p>agraph     
7#a71 if ! c\rt f9ds t ! conduct 9 "q   
con/itutes a violation ( ?is subtitle4  
7d7 ,civil actions by ! ,f$]al ,trade   
,commission  7#a7 ,9 g5]al ,compliance )
 ! requirem5ts impos$ "u ?is subtitle   
may be en=c$ "u ! ,f$]al ,trade         
,commission ,act 7#ae ,u4,s4,c4 #da et  
seq47 by ! ,f$]al ,trade ,commission )  
respect to bus9ess entities subject to  

?is ,act4 ,all ( ! functions & p[]s ( ! 
,f$]al ,trade ,commission "u ! ,f$]al   
,trade ,commission ,act are available to
 ! ,commission to en=ce compliance by   
any p]son ) ! requirem5ts impos$ "u ?is 
title4  7#b7 ,civil p5alties  7,a7 ,9   
g5]al ,any cov]$ entity t violates ?is  
subtitle %all be subject to a civil     
p5alty 9 ! am\nt t is n great] ?an !    
product ( ! numb] ( violations ( ?is    
subtitle & #af1ejj4 ,ea* failure to     
provide notification to an individual z 
requir$ "u ?is subtitle %all be treat$ z
 a sep>ate violation4  7,b7             
,det]m9ations ,! det]m9ation ( :e!r a   
violation ( a provision ( ?is subtitle  
has occurr$1 & if s1 ! am\nt ( ! p5alty 
to be impos$1 if any1 %all be made by ! 
c\rt sitt+ z ! f9d] ( fact4 ,!          
det]m9ation ( :e!r a violation ( a      
provision ( ?is subtitle 0 willful or   
int5tional1 & if s1 ! am\nt ( !         
additional p5alty to be impos$1 if any1 
%all be made by ! c\rt sitt+ z ! f9d] ( 
fact4  7,c7 ,additional p5alty limit ,if

 a c\rt det]m9es "u subp>agraph 7,b7 t a
 violation ( a provision ( ?is subtitle 
0 willful or int5tional & imposes an    
additional p5alty1 ! c\rt may n impose  
an additional p5alty 9 an am\nt t exce$s
 #aj1jjj1jjj4  7#c7 ,unfair or deceptive
 acts or practices ,= ! purpose ( !     
ex]cise by ! ,f$]al ,trade ,commission (
 its functions & p[]s "u ! ,f$]al ,trade
 ,commission ,act1 a violation ( any    
requirem5t or prohibition impos$ "u ?is 
title %all con/itute an unfair or       
deceptive act or practice 9 comm]ce 9   
violation ( a regulation "u section     
#ah7;a77#a77;,b7 ( ! ,f$]al ,trade      
,commission ,act 7#ae ,u4,s4,c4         
#eg;a7a77,i77,b77 reg>d+ unfair or      
deceptive acts or practices & %all be   
subject to en=cem5t by ! ,f$]al ,trade  
,commission "u t ,act ) respect to any  
bus9ess entity1 irrespective ( :e!r t   
bus9ess entity is engag$ 9 comm]ce or   
meets any o!r jurisdictional te/s 9 !   
,f$]al ,trade ,commission ,act4  7e7    
,coord9ation ( en=cem5t  7#a7 ,9 g5]al  

,:5 op5+ an inve/igation1 ! ,f$]al      
,trade ,commission %all consult ) !     
,attorney ,g5]al4  7#b7 ,limitation ,!  
,f$]al ,trade ,commission may initiate  
inve/igations "u ?is subsection unless !
 ,attorney ,g5]al det]m9es t su* an     
inve/igation w\ld imp$e an ongo+ crim9al
 inve/igation or national security      
activity4  7#c7 ,coord9ation agreem5t   
7,a7 ,9 g5]al ,9 ord] to avoid conflicts
 & promote consi/5cy reg>d+ ! en=cem5t &
 litigation ( matt]s "u ?is ,act1 n lat]
 ?an #ahj days aft] ! enactm5t ( ?is    
,act1 ! ,attorney ,g5]al & ! ,f$]al     
,trade ,commission %all ent] into an    
agreem5t = coord9ation reg>d+ ! en=cem5t
 ( ?is ,act4  7,b7 ,requirem5t ,!       
coord9ation agreem5t ent]$ into "u      
subp>agraph 7,a7 %all include provisions
 to ensure t p>allel inve/igations &    
proce$+s "u ?is section are conduct$ 9 a
 mann] t avoids conflicts & does n imp$e
 ! ability ( ! ,attorney ,g5]al to      
prosecute violations ( ,f$]al crim9al   
laws4  7f7 ,rulemak+ ,! ,f$]al ,trade   

,commission may1 9 consultation ) !     
,attorney ,g5]al1 issue su* o!r         
regulations z x det]m9es to be necess>y 
to c>ry out ?is subtitle4 ,all          
regulations promulgat$ "u ?is ,act %all 
be issu$ 9 accordance ) section #eec (  
title #e1 ,unit$ ,/ates ,code4  7g7 ,o!r
 rights & rem$ies ,! rights & rem$ies   
available "u ?is subtitle are cumulative
 & %all n affect any o!r rights &       
rem$ies available "u law4  7h7 ,fraud   
al]t ,section #fje;,a7b77#a7 ( ! ,fair  
,cr$it ,report+ ,act 7#ae ,u4,s4,c4     
#afha;c-#a7;b77#a77 is am5d$ by ins]t+ 1
 or evid5ce t ! consum] has receiv$     
notice t ! consum]'s f9ancial in=mation 
has or may h be5 compromis$1 aft]       
id5tity !ft report4  #bai4 ,en=cem5t by 
,/ate attorneys g5]al  7a7 ,9 g5]al     
7#a7 ,civil actions  7,a7 ,9 g5]al ,9   
any case 9 :i* ! attorney g5]al ( a     
,/ate or any ,/ate or local law en=cem5t
 ag5cy au?oriz$ by ! ,/ate attorney     
g5]al or by ,/ate /atute to prosecute   
violations ( consum] protection law1 has

 reason to believe t a cov]$ entity has 
violat$ ?is subtitle1 ! ,/ate1 z p>5s   
patriae1 may br+ a civil action on      
behalf ( ! resid5ts ( ! ,/ate to--  7i7 
enjo9 t practice2  7ii7 en=ce compliance
 ) ?is subtitle2 or  7iii7 impose a     
civil p5alty 9 an am\nt n great] ?an !  
product ( ! numb] ( violations ( ?is    
subtitle & #af1ejj4  7,b7 ,failure to   
provide notification ,= purposes (      
subp>agraph 7,a77iii71 ea* failure to   
provide notification to an individual z 
requir$ "u ?is subtitle %all be treat$ z
 a sep>ate violation4  7#b7 ,p5alty     
det]m9ations  7,a7 ,det]m9ations ,!     
det]m9ation ( :e!r a violation ( a      
provision ( ?is subtitle has occurr$1 & 
if s1 ! am\nt ( ! p5alty to be impos$1  
if any1 %all be made by ! c\rt sitt+ z !
 f9d] ( fact4 ,! det]m9ation ( :e!r a   
violation ( a provision ( ?is subtitle 0
 willful or int5tional1 & if s1 ! am\nt 
( ! additional p5alty to be impos$1 if  
any1 %all be made by ! c\rt sitt+ z !   
f9d] ( fact4  7,b7 ,additional p5alty   

limit ,if a c\rt det]m9es "u subp>agraph
 7,a7 t a violation ( a provision ( ?is 
subtitle 0 willful or int5tional &      
imposes an additional p5alty1 ! c\rt may
 n impose an additional p5alty 9 an     
am\nt t exce$s #aj1jjj1jjj4  7#c7       
,notice  7,a7 ,9 g5]al ,be=e fil+ an    
action "u p>agraph 7#a71 ! attorney     
g5]al ( ! ,/ate involv$ %all provide to 
! ,attorney ,g5]al ( ! ,unit$ ,/ates & !
 ,f$]al ,trade ,commission--  7i7 writt5
 notice ( ! action2 &  7ii7 a copy ( !  
compla9t = ! action4  7,b7 ,exemption   
7i7 ,9 g5]al ,subp>agraph 7,a7 %all n   
apply ) respect to ! fil+ ( an action by
 an attorney g5]al ( a ,/ate "u ?is     
subtitle1 if ! ,/ate attorney g5]al     
det]m9es t x is n feasible to provide ! 
notice describ$ 9 su* subp>agraph be=e !
 fil+ ( ! action4  7ii7 ,notification ,9
 an action describ$ 9 clause 7i71 !     
attorney g5]al ( a ,/ate %all provide   
notice & a copy ( ! compla9t to !       
,attorney ,g5]al ( ! ,unit$ ,/ates & !  
,f$]al ,trade ,commission at ! "t !     

,/ate attorney g5]al files ! action4    
7b7 ,f$]al proce$+s ,^u receiv+ notice  
"u subsection 7a77#b71 ! ,attorney      
,g5]al & ! ,f$]al ,trade ,commission    
%all h ! "r to--  7#a7 move to /ay !    
action1 p5d+ ! f9al disposition ( a p5d+
 ,f$]al proce$+ or action2  7#b7        
initiate an action 9 ! appropriate      
,unit$ ,/ates di/rict c\rt "u section   
#bah & move to consolidate all p5d+     
actions1 includ+ ,/ate actions1 9 su*   
c\rt2  7#c7 int]v5e 9 an action br\ght  
"u subsection 7a77#b72 &  7#d7 file     
petitions = appeal4  7c7 ,p5d+ proce$+s 
,if ! ,attorney ,g5]al or ! ,f$]al      
,trade ,commission initiates a crim9al  
proce$+ or civil action = a violation ( 
a provision ( ?is subtitle1 or any      
regulations !reund]1 no attorney g5]al (
 a ,/ate may br+ an action = a violation
 ( a provision ( ?is subtitle aga9/ a   
def5dant nam$ 9 ! ,f$]al crim9al proce$+
 or civil action4  7d7 ,con/ruction ,=  
purposes ( br++ any civil action "u     
subsection 7a71 no?+ 9 ?is subtitle     

reg>d+ notification %all be con/ru$ to  
prev5t an attorney g5]al ( a ,/ate f    
ex]cis+ ! p[]s conf]r$ on su* attorney  
g5]al by ! laws ( t ,/ate to--  7#a7    
conduct inve/igations2  7#b7 adm9i/]    
oa?s or affirmations2 or  7#c7 compel ! 
att5dance ( witnesses or ! production ( 
docum5t>y & o!r evid5ce4  7e7 ,v5ue2    
s]vice ( process  7#a7 ,v5ue ,any action
 br\ght "u subsection 7a7 may be br\ght 
9--  7,a7 ! di/rict c\rt ( ! ,unit$     
,/ates t meets applicable requirem5ts   
relat+ to v5ue "u section #acia ( title 
#bh1 ,unit$ ,/ates ,code2 or  7,b7 ano!r
 c\rt ( compet5t jurisdiction4  7#b7    
,s]vice ( process ,9 an action br\ght "u
 subsection 7a71 process may be s]v$ 9  
any di/rict 9 :i* ! def5dant--  7,a7 is 
an inhabitant2 or  7,b7 may be f\nd4    
7f7 ,no private cause ( action ,no?+ 9  
?is subtitle e/abli%es a private cause (
 action aga9/ a bus9ess entity =        
violation ( any provision ( ?is         
subtitle4  #bbj4 ,effect on ,f$]al &    
,/ate law  7a7 ,preemption ,= a cov]$   

entity t is subject to ?is subtitle1 !  
provisions ( ?is subtitle %all sup]s$e  
any o!r provision ( ,f$]al law1 or any  
provisions ( ! law ( any ,/ate or       
political subdivision ( a ,/ate requir+ 
notification ( a security brea* (       
s5sitive p]sonally id5tifiable          
in=mation1 :i* is less /r+5t ?an !      
requirem5ts ( ?is subtitle4  7b7        
,consum] protection laws ,except z      
provid$ 9 subsection 7a71 ?is section   
%all n be con/ru$ to limit ! en=cem5t ( 
any ,/ate consum] protection law by an  
attorney g5]al ( a ,/ate4  7c7          
,protection ( c]ta9 ,/ate laws ,no?+ 9  
?is ,act %all be con/ru$ to preempt !   
applicability (-- 7#a7 ,/ate trespass1  
contract1 or tort law2 or  7#b7 any o!r 
,/ate law to ! ext5t t ! law relates to 
acts ( fraud4  7d7 ,pres]vation ( ,,ftc 
au?ority ,no?+ 9 ?is ,act may be con/ru$
 9 any way to limit ! au?ority ( !      
,f$]al ,trade ,commission "u any o!r    
provision ( law4  7e7 ,pres]vation (    
,,fcc au?ority ,no?+ 9 ?is ,act may be  

con/ru$ 9 any way to limit ! au?ority ( 
! ,f$]al ,communications ,commission "u 
any o!r provision ( law4  #bba4 ,report+
 on exemptions ,n lat] ?an #ah mon?s    
aft] ! date ( enactm5t ( ?is ,act1 & ^u 
! reque/ by ,congress !reaft]1 !        
,attorney ,g5]al1 9 consultation ) !    
,secret>y ( ,homel& ,security1 %all     
submit a report to ,congress on ! numb] 
& nature ( security brea*es subject to !
 national security & law en=cem5t       
exemptions "u section #bab7;a74  #bbb4  
,effective date ,?is subtitle %all take 
effect on ! expiration ( ! date t is #ij
 days aft] ! date ( enactm5t ( ?is ,act4
  ,,iii ,compliance ) /atutory          
,pay-,z-,y-,g ,act  #cja4 ,budget       
compliance ,! budget>y effects ( ?is    
,act1 = ! purpose ( comply+ ) !         
,/atutory ,pay-,z-,y-,g ,act ( #bjaj1   
%all be det]m9$ by ref]5ce to ! late/   
/atem5t titl$ ,budget>y ,effects (      
,,paygo ,legislation = ?is ,act1        
submitt$ = pr9t+ 9 ! ,congressional     
,record by ! ,*airman ( ! ,s5ate ,budget

 ,committee1 provid$ t su* /atem5t has  
be5 submitt$ prior to ! vote on passage4