,,ii #aaeth ,,congress #b;d ,session ,s4 #bbhi ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,january #aj1 #bjah ,ms4 ,warren 7for herself and ,mr4 ,warner7 introduced the following bill2 which was read twice and referred to the ,committee on ,banking1 ,housing1 and ,urban ,affairs ,a ,,bill ,to create an ,office of ,cybersecurity at the ,federal ,trade ,commission for supervision of data security at consumer reporting agencies1 to require the promulgation of regulations establishing standards for effective cybersecurity at consumer reporting agencies1 to impose penalties on credit reporting agencies for cybersecurity breaches that put sensitive consumer data at risk1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,data ,breach ,prevention and ,compensation ,act of #bjah4 #b4 ,definitions ,in this ,act3 7#a7 ,career appointee ,the term career appointee has the meaning given the term in section #cacb7;a7 of title #e1 ,united ,states ,code4 7#b7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#c7 ,covered breach ,the term covered breach means any instance in which at least #a piece of personally identifying information is exposed or is reasonably likely to have been exposed to an unauthorized party4 7#d7 ,covered consumer reporting agency ,the term covered consumer reporting agency means-- 7,a7 a consumer reporting agency described in section #fjc7p7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a7p772 or 7,b7 a consumer reporting agency that earns not less than #g1jjj1jjj in annual revenue from the sales of consumer reports4 7#e7 ,director ,the term ,director means the ,director of the ,office of ,cybersecurity4 7#f7 ,detail ,the term detail means a temporary assignment of an employee to a different position for a specified period1 with the employee returning to his or her regular duties at the end of the detail4 7#g7 ,personally identifying information ,the term personally identifying information means-- 7,a7 a ,social ,security number2 7,b7 a driver's license number2 7,c7 a passport number2 7,d7 an alien registration number or other government-issued unique identification number2 7,e7 unique biometric data1 such as faceprint1 fingerprint1 voice print1 iris image1 or other unique physical representations2 7,f7 an individual's first and last name or first initial and last name in combination with any information that relates to the individual's past1 present1 or future physical or mental health or condition1 or to the provision of health care to or diagnosis of the individual2 7,g7 7i7 a financial account number1 debit card number1 or credit card number of the consumer2 or 7ii7 any passcode required to access an account described in clause 7i72 and 7,h7 such additional information1 as determined by the ,director4 #c4 ,cybersecurity standards and ,,ftc authority 7a7 ,establishment ,there is established in the ,commission an ,office of ,cybersecurity1 which shall be headed by a ,director1 who shall be a career appointee4 7b7 ,duties ,the ,office of ,cybersecurity-- 7#a7 shall-- 7,a7 supervise covered consumer reporting agencies with respect to data security2 7,b7 promulgate regulations for effective data security for covered consumer reporting agencies1 including regulations that require covered consumer reporting agencies to-- 7i7 provide the ,commission with descriptions of technical and organizational security measures1 including-- 7,i7 system and network security measures1 including-- 7aa7 asset management1 including-- 7,,aa7 an inventory of authorized and unauthorized devices2 7,,bb7 an inventory of authorized and unauthorized software1 including application whitelisting2 and 7,,cc7 secure configurations for hardware and software2 7bb7 network management and monitoring1 including-- 7,,aa7 mapped data flows1 including functional mission mapping2 7,,bb7 maintenance1 monitoring1 and analysis of audit logs2 7,,cc7 network segmentation2 and 7,,dd7 local and remote access privileges1 defined and managed2 and 7cc7 application management1 including-- 7,,aa7 continuous vulnerability assessment and remediation2 7,,bb7 server application hardening2 7,,cc7 vulnerability handling such as coordinated vulnerability disclosure policy2 and 7,,dd7 patch management1 including at1 or near1 real-time dashboards of patch implementation across network hosts2 and 7,,ii7 data security1 including-- 7aa7 data-centric security mechanisms such as format-preserving encryption1 cryptographic data-splitting1 and data-tagging and lineage2 7bb7 encryption for data at rest2 7cc7 encryption for data in transit2 7dd7 systemwide data minimization evaluations and policies2 and 7ee7 data recovery capability2 and 7ii7 create and maintain documentation demonstrating that the covered consumer reporting agency is employing reasonable technical measures and corporate governance processes for continuous monitoring of data1 intrusion detection1 and continuous evaluation and timely patching of vulnerabilities2 7,c7 annually examine the data security measures of covered consumer reporting agencies for compliance with the standards promulgated under subparagraph 7,b72 7,d7 investigate any covered consumer reporting agency if the ,office has reason to suspect a potential covered breach or noncompliance with the standards promulgated under subparagraph 7,b72 7,e7 after consultation with members of the technical and academic communities1 develop a rigorous1 repeatable methodology for evaluating1 testing1 and measuring effective data security practices of covered consumer reporting agencies1 that employs forms of static and dynamic software analysis and penetration testing2 7,f7 submit to ,congress an annual report on the findings on any investigation under subparagraph 7,c72 7,g7 determine whether covered consumer reporting agencies are complying with the regulations promulgated under subparagraph 7,b72 and 7,h7 coordinate with the ,national ,institute of ,standards and ,technology and the ,national ,cybersecurity and ,communications ,integration ,center of the ,department of ,homeland ,security2 and 7#b7 may-- 7,a7 investigate any breach to determine if the covered consumer reporting agency was in compliance with the regulations promulgated under paragraph 7#a77;,b72 and 7,b7 if the ,commission has reason to believe that any covered consumer reporting agency is violating1 or is about to violate1 a regulation promulgated under paragraph 7#a77;,b71 bring a suit in a district court of the ,united ,states to enjoin any such act or practice4 7c7 ,staff 7#a7 ,in general ,the ,director shall1 without regard to the civil service laws and regulations1 appoint such personnel1 including computer security researchers and practitioners with technical expertise in computer science1 engineering1 and cybersecurity1 as the ,director determines are necessary to carry out the duties of the ,office4 7#b7 ,details ,an employee of the ,national ,institute of ,standards and ,technology1 the ,bureau of ,consumer ,financial ,protection1 or the ,national ,cybersecurity and ,communications ,integration ,center of the ,department of ,homeland ,security may be detailed to the ,office1 without reimbursement1 and such detail shall be without interruption or loss of civil service status or privilege4 #d4 ,notification and enforcement 7a7 ,notification ,not later than #aj days after a covered breach1 the covered consumer reporting agency that was subject to the covered breach shall notify the ,commission of the covered breach4 7b7 ,penalty 7#a7 ,in general ,in the event of a covered breach1 the ,commission shall1 not later than #cj days after the date on which the ,commission receives notification of the covered breach1 commence a civil action to recover a civil penalty in a district court of the ,united ,states against the covered consumer reporting agency that was subject to the covered breach4 7#b7 ,determining penalty amount 7,a7 ,in general ,except as provided in subparagraph 7,b71 in determining the amount of a civil penalty under paragraph 7#a71 the court shall impose a civil penalty on a covered consumer reporting agency of-- 7i7 #ajj for each consumer whose first and last name1 or first initial and last name1 and at least #a item of personally identifying information was compromised2 and 7ii7 an additional #ej for each additional item of personally identifying information compromised for each consumer4 7,b7 ,exception 7i7 ,in general ,except as provided in clause 7ii71 a court may not impose a civil penalty under this subsection in an amount greater than #ej percent of the gross revenue of the covered consumer reporting agency for the previous fiscal year before the date on which the covered consumer reporting agency became aware of the covered breach4 7ii7 ,penalty doubled ,a court shall impose a civil penalty on a covered consumer reporting agency double the penalty described in subparagraph 7,a71 but not greater than #ge percent of the gross revenue of the covered consumer reporting agency for the previous fiscal year before the date on which the covered consumer reporting agency became aware of the covered breach if-- 7,i7 the covered consumer reporting agency fails to notify the ,commission of a covered breach before the deadline established under subsection 7a72 or 7,,ii7 the covered consumer reporting agency violates any regulation promulgated under section #c7;b77#a77;,c74 7#c7 ,proceeds of the penalties ,of the penalties assessed under this subsection-- 7,a7 #ej percent shall be used for cybersecurity research and inspections by the ,office of ,cybersecurity2 and 7,b7 #ej percent shall be used by the ,commission to be divided fairly among consumers affected by the covered breach4 7#d7 ,no preemption ,nothing in this subsection shall preclude an action by a consumer under ,state or other ,federal law4 7c7 ,injunctive relief ,the ,commission may bring suit in a district court of the ,united ,states or in the ,united ,states court of any ,territory to enjoin a covered consumer reporting agency to implement or correct a particular security measure in order to promote effective security4 #e4 ,authorization of appropriations ,there are authorized to be appropriated #ajj1jjj1jjj to carry out this ,act1 to remain available until expended4