,i  #aafth ,,congress  #ast ,session    
,h4 ,r4 #abhb  ,,in ,,the ,,house ,,of  
,,representatives  ,february #ad1       
#bjai,mr4 ,rush 7for himself1 ,ms4      
,blunt ,rochester1 and ,ms4 ,clarke of  
,new ,york7 introduced the following    
bill2 which was referred to the         
,committee on ,energy and ,commerce  ,a 
,,bill  ,to require certain entities who
 collect and maintain personal          
information of individuals to secure    
such information and to provide notice  
to such individuals in the case of a    
breach of security involving such       
information1 and for other purposes4    
#a4 ,short title ,this ,act may be cited
 as the ,data ,accountability and ,trust
 ,act4  #b4 ,requirements for           
information security  7a7 ,general      
security policies and procedures  7#a7  
,regulations ,not later than #a year    
after the date of enactment of this     
,act1 the ,commission shall promulgate  
regulations under section #eec of title 
#e1 ,united ,states ,code1 that require 

each covered entity to establish and    
implement policies and procedures       
regarding information security practices
 for the treatment and protection of    
personal information taking into        
consideration--  7,a7 the size of and   
the nature1 scope1 and complexity of the
 activities engaged in by such covered  
entity2  7,b7 the sensitivity of any    
personal information at issue2  7,c7 the
 current state of the art in            
administrative1 technical1 and physical 
safeguards for protecting such          
information2 and  7,d7 the cost of      
implementing such safeguards4  7#b7     
,requirements ,the regulations required 
pursuant to paragraph 7#a7 shall include
 a requirement that the policies and    
procedures include the following3  7,a7 
,a written security policy with respect 
to the collection1 use1 sale1 other     
dissemination1 and maintenance of the   
personal information4  7,b7 ,the        
identification of an officer or other   
individual as the point of contact with 

responsibility for the management of    
information security4  7,c7 ,a process  
for identifying and assessing any       
reasonably foreseeable vulnerability in 
any system maintained by the covered    
entity that contains such data1         
including regular monitoring for a      
breach of security of any such system4  
7,d7 ,a process for-- 7i7 taking        
preventive and corrective action to     
mitigate against any vulnerability      
identified in the process required by   
subparagraph 7,c71 which may include    
implementing any changes to security    
practices and the architecture1         
installation1 or implementation of      
network or operating software2 and  7ii7
 regularly testing or otherwise         
monitoring the effectiveness of the key 
controls1 systems1 and procedures of the
 safeguards4  7,e7 ,a process for       
disposing of data containing personal   
information by shredding1 permanently   
erasing1 or otherwise modifying the     
personal information contained in such  

data to make such personal information  
permanently unreadable or               
undecipherable4  7,f7 ,a process for    
overseeing persons to whom personal     
information is disclosed1 or who have   
access to internet-connected devices1   
by--  7i7 taking reasonable steps to    
select and retain persons that are      
capable of maintaining appropriate      
safeguards for the personal information 
or internet-connected devices at issue2 
and  7ii7 requiring all such persons to 
implement and maintain such safeguards4 
7#c7 ,treatment of entities governed by 
other ,federal law ,any covered entity  
who is in compliance with any other     
,federal law that requires the covered  
entity to maintain standards and        
safeguards for information security and 
protection of personal information that1
 taken as a whole and as the ,commission
 shall determine in the rulemaking      
required under this subsection1 provide 
protections substantially similar to1 or
 greater than1 those required under this

 subsection1 shall be deemed to be in   
compliance with this subsection4  7b7   
,special requirements for information   
brokers  7#a7 ,submission of policies to
 the ,,ftc ,the regulations promulgated 
pursuant to subsection 7a7 shall include
 a requirement for an information broker
 to submit each security policy of the  
broker to the ,commission in conjunction
 with a notification of a breach of     
security under section #c or upon       
request of the ,commission4  7#b7       
,post-breach audit ,for any information 
broker required to provide notification 
under section #c1 the ,commission may   
conduct audits of the information       
security practices of such information  
broker1 or require the information      
broker to conduct independent audits of 
such practices 7by an independent       
auditor who has not audited the         
information broker's security practices 
during the preceding #e years74  7#c7   
,accuracy of and individual access to   
personal information ,the regulations   

promulgated pursuant to subsection 7a7  
shall include a requirement for the     
following3  7,a7 ,accuracy  7i7 ,in     
general ,each information broker to     
establish reasonable procedures to      
assure the maximum possible accuracy of 
the personal information the information
 broker collects1 assembles1 or         
maintains1 and any other information the
 information broker collects1 assembles1
 or maintains that specifically         
identifies an individual1 other than    
information which merely identifies an  
individual's name or address4  7ii7     
,limited exception for fraud databases  
,the requirement in clause 7i7 shall not
 prevent the collection or maintenance  
of information that may be inaccurate   
with respect to a particular individual 
when that information is being collected
 or maintained solely--  7,i7 for the   
purpose of indicating whether there may 
be a discrepancy or irregularity in the 
personal information that is associated 
with an individual2 and  7,,ii7 to help 

identify1 or authenticate the identity  
of1 an individual1 or to protect against
 or investigate fraud or other unlawful 
conduct4  7,b7 ,consumer access to      
information ,each information broker    
to-- 7i7 provide to each individual     
whose personal information the          
information broker maintains 7at the    
individual's request at least once per  
year1 at no cost to the individual1 and 
after verifying the identity of the     
individual71 a means for the individual 
to review any personal information      
regarding such individual maintained by 
the information broker and any other    
information maintained by the           
information broker that specifically    
identifies the individual1 other than   
information which merely identifies an  
individual's name or address2 and  7ii7 
place a conspicuous notice on the       
internet website of the information     
broker 7if the information broker       
maintains such a website7 instructing   
individuals how to request access to the

 information required to be provided    
under clause 7i71 and1 as applicable1   
how to express a preference with respect
 to the use of personal information for 
marketing purposes4  7,c7 ,disputed     
information  7i7 ,in general ,whenever  
an individual whose information the     
information broker maintains makes a    
written request disputing the accuracy  
of the information1 the information     
broker1 after verifying the identity of 
the individual making such request and  
unless there are reasonable grounds to  
believe such request is frivolous or    
irrelevant1 to--  7,i7 correct any      
inaccuracy2 or  7,,ii7 in the case of   
information that is--  7aa7 public      
record information1 inform the          
individual of the source of the         
information1 and1 if reasonably         
available1 where a request for          
correction may be directed and1 if the  
individual provides proof that the      
public record has been corrected or that
 the information broker was reporting   

the information incorrectly1 correct the
 inaccuracy in the information broker's 
records2 or  7bb7 nonpublic information1
 note the information that is disputed1 
including the individual's statement    
disputing such information1 and take    
reasonable steps to independently verify
 such information under the procedures  
outlined in subparagraph 7,a7 if such   
information can be independently        
verified4  7ii7 ,structure for dispute  
process ,a basic structure for the      
dispute process described in clause 7i7 
which shall be in writing1 require an   
online option for the submission of a   
dispute1 and provide an electronic      
receipt acknowledging the submission4   
7,d7 ,limitations ,a provision1         
including the scope of the application1 
that allows an information broker to    
limit the access to information required
 under subparagraph 7,b77i7 and is not  
required to provide notice to           
individuals as required under           
subparagraph 7,b77ii7 in the following  

circumstances3  7i7 ,if access of the   
individual to the information is limited
 by law or legally recognized privilege4
  7ii7 ,if the information is used for a
 legitimate governmental or fraud       
prevention purpose that would be        
compromised by such access4  7iii7 ,if  
the information consists of information 
already made available to the public1   
unless that record has been included in 
a report about an individual shared with
 a third party4  7iv7 ,any other        
circumstance in which an information    
broker may limit access to information  
that the ,commission determines to be   
appropriate4  7,e7 ,,fcra regulated     
persons ,a provision that any           
information broker that is engaged in   
activities subject to the ,fair ,credit 
,reporting ,act and who is in compliance
 with sections #fji1 #faj1 and #faa of  
such ,act 7#ae ,u4,s4,c4 #afha;g2       
#afha;h2 #afha;i7 with respect to       
information subject to such ,act is     
deemed to be in compliance with this    

paragraph with respect to such          
information4  7,f7 ,requirement of audit
 log of accessed and transmitted        
information ,each information broker to 
establish measures which facilitate the 
auditing or retracing of any internal or
 external access to1 or transmissions   
of1 any data containing personal        
information collected1 assembled1 or    
maintained by such information broker4  
7#d7 ,prohibition on pretexting by      
information brokers ,the regulations    
promulgated pursuant to subsection 7a7  
shall include a prohibition on the      
following3  7,a7 ,prohibition on        
obtaining personal information by false 
pretenses ,an information broker to     
obtain1 attempt to obtain1 cause to be  
disclosed1 or attempt to cause to be    
disclosed to any person1 personal       
information or any other information    
relating to any person by--  7i7 making 
a false1 fictitious1 or fraudulent      
statement or representation to any      
person2 or  7ii7 providing any document 

or other information to any person that 
the information broker knows or should  
know--  7,i7 to be forged1 counterfeit1 
lost1 stolen1 or fraudulently obtained2 
or  7,,ii7 to contain a false1          
fictitious1 or fraudulent statement or  
representation4  7,b7 ,prohibition on   
solicitation to obtain personal         
information under false pretenses ,an   
information broker to request a person  
to obtain personal information or any   
other information relating to any other 
person1 if the information broker knew  
or should have known that the person to 
whom such a request is made will obtain 
or attempt to obtain such information in
 the manner described in subparagraph   
7,a74  #c4 ,notification of information 
security breach  7a7 ,individual        
notification ,not later than #a year    
after the date of enactment of this     
,act1 the ,commission shall promulgate  
regulations under section #eec of title 
#e1 ,united ,states ,code1 that require 
the following3  7#a7 ,in general ,each  

covered entity to1 following the        
discovery of a breach of security1      
notify each individual who is a citizen 
or resident of the ,united ,states whose
 personal information was1 or is        
reasonably believed to have been1       
acquired or accessed by an unauthorized 
person1 or used for an unauthorized     
purpose4  7#b7 ,timeliness of           
notification  7,a7 ,in general ,unless  
subject to a delay authorized under     
subparagraph 7,b71 a notification       
required under paragraph 7#a7 shall be  
made as expeditiously as practicable and
 without unreasonable delay1 but not    
later than #cj days following the       
discovery of a breach of security4  7,b7
 ,delay of notification authorized for  
law enforcement or national security    
purposes  7i7 ,law enforcement ,if a    
,federal or ,state law enforcement      
agency1 including an attorney general of
 a ,state1 determines that the          
notification required under this section
 would impede a civil or criminal       

investigation1 such notification shall  
be delayed upon the written request of  
the law enforcement agency for #cj days 
or such lesser period of time which the 
law enforcement agency determines is    
reasonably necessary and requests in    
writing4 ,such law enforcement agency   
may1 by a subsequent written request1   
revoke such delay or extend the period  
of time set forth in the original       
request made under this clause if       
further delay is necessary4  7ii7       
,national security ,if a ,federal       
national security agency or homeland    
security agency determines that the     
notification required under this section
 would threaten national or homeland    
security1 such notification may be      
delayed for a period of time which the  
national security agency or homeland    
security agency determines is reasonably
 necessary and requests in writing4 ,a  
,federal national security agency or    
homeland security agency may revoke such
 delay or extend the period of time set 

forth in the original request made under
 this clause by a subsequent written    
request if further delay is necessary4  
7#c7 ,coordination of notification with 
credit reporting agencies ,if a covered 
entity is required to provide           
notification to more than #e1jjj        
individuals under paragraph 7#a71 the   
covered entity shall also notify the    
major consumer reporting agencies that  
compile and maintain files on consumers 
on a nationwide basis1 of the timing and
 distribution of the notifications4     
,such notification shall be given to the
 credit reporting agencies without      
unreasonable delay and1 if such         
notification will not delay notification
 to the affected individuals1 prior to  
the distribution of notifications to the
 affected individuals4  7#d7 ,method and
 content of notification  7,a7 ,general 
notification ,a covered entity required 
to provide notification to individuals  
under paragraph 7#a7 shall be in        
compliance with such requirement if the 

covered entity provides conspicuous and 
clearly identified notification by one  
of the following methods 7provided the  
selected method can reasonably be       
expected to reach the intended          
individual73  7i7 ,written notification 
to the last known home mailing address  
of the individual in the records of the 
covered entity4  7ii7 ,notification by  
email or other electronic means1 if--   
7,i7 the covered entity's primary method
 of communication with the individual is
 by email or such other electronic      
means2 or  7,,ii7 the individual has    
consented to receive such notification  
and the notification is provided in a   
manner that is consistent with the      
provisions permitting electronic        
transmission of notifications under     
section #aja of the ,electronic         
,signatures in ,global ,commerce ,act   
7#ae ,u4,s4,c4 #gjja74  7,b7 ,website   
notification ,the covered entity shall  
also provide conspicuous notification on
 the internet website of the covered    

entity 7if such covered entity maintains
 such a website7 for a period of not    
less than #ij days4  7,c7 ,media        
notification ,if the number of residents
 of a ,state whose personal information 
was1 or is reasonably believed to have  
been acquired or accessed by an         
unauthorized person1 or used for an     
unauthorized purpose exceeds #e1jjj1 the
 covered entity shall also provide      
notification in print and to broadcast  
media1 including major media in         
metropolitan and rural areas where the  
individuals whose personal information  
was1 or is reasonably believed to have  
been1 acquired or accessed by an        
unauthorized person1 or used for an     
unauthorized purpose1 reside4  7,d7     
,content of notification  7i7 ,in       
general ,any notification provided under
 subparagraph 7,a71 7,b71 or 7,c7 shall 
include-- 7,i7 a description of the     
personal information that was1 or is    
reasonably believed to have been1       
acquired or accessed by an unauthorized 

person1 or used for an unauthorized     
purpose2  7,,ii7 a telephone number that
 the individual may use1 at no cost to  
such individual1 to contact the covered 
entity1 or agent of the covered entity1 
to inquire about the breach of security 
or the information the covered entity   
maintained about that individual2       
7,,iii7 notification that the individual
 is entitled to receive1 at no cost to  
such individual1 consumer credit reports
 on a quarterly basis for a period of   
#aj years1 or credit monitoring or other
 service that enables consumers to      
detect the misuse of their personal     
information for a period of #aj years1  
and instructions to the individual on   
requesting such reports or service from 
the covered entity2  7,,iv7 the         
toll-free contact telephone numbers and 
addresses for the major credit reporting
 agencies2 and  7,v7 a toll-free        
telephone number and internet website   
address for the ,commission whereby the 
individual may obtain information       

regarding identity theft4  7ii7 ,direct 
business relationship ,any notification 
provided under this subsection shall    
identify the covered entity that has a  
direct business relationship with the   
individual4  7,e7 ,substitute           
notification ,criteria for determining  
circumstances under which substitute    
notification may be provided in lieu of 
direct notification required by         
subparagraph 7,a71 including criteria   
for determining if notification under   
subparagraph 7,a7 is not feasible due to
 excessive costs to the covered entity  
required to provide such notification   
relative to the resources of such       
covered entity and the form and content 
of substitute notification4  7#e7       
,notification for law enforcement and   
other purposes ,a covered entity to1 as 
expeditiously as practicable and without
 unreasonable delay1 but not later than 
#g days following the discovery of a    
breach of security1 provide notification
 of the breach to--  7,a7 the           

,commission2  7,b7 the ,federal ,bureau 
of ,investigation2  7,c7 the ,secret    
,service2  7,d7 for common carriers1 the
 ,federal ,communications ,commission2  
7,e7 for entities that provide a        
consumer financial product or service   
7as defined in section #ajjb of the     
,consumer ,financial ,protection ,act of
 #bjaj 7#ab ,u4,s4,c4 #edha771 the      
,consumer ,financial ,protection        
,bureau2 and  7,f7 the attorney general 
of each ,state in which the personal    
information of a resident or residents  
of the ,state was1 or is reasonably     
believed to have been1 acquired or      
accessed by an unauthorized person1 or  
used for an unauthorized purpose4  7#f7 
,other obligations following breach     
7,a7 ,in general ,a covered entity      
required to provide notification under  
subsection 7a7 to1 upon request of an   
individual whose personal information   
was included in the breach of security1 
provide or arrange for the provision of1
 to each such individual and at no cost 

to such individual--  7i7 consumer      
credit reports from the major credit    
reporting agencies beginning not later  
than #fj days following the individual's
 request and continuing on a quarterly  
basis for a period of #aj years         
thereafter2 or  7ii7 a credit monitoring
 or other service that enables consumers
 to detect the misuse of their personal 
information1 beginning not later than   
#fj days following the individual's     
request and continuing for a period of  
#aj years4  7,b7 ,rulemaking ,the       
circumstances under which a covered     
entity required to provide notification 
under paragraph 7#a7 shall provide or   
arrange for the provision of free       
consumer credit reports or credit       
monitoring or other service to affected 
individuals4  7b7 ,website notification 
7#a7 ,federal ,trade ,commission ,if the
 ,commission1 upon receiving            
notification of any breach of security  
that is reported to the ,commission     
under subsection 7a77#e77;,a71 finds    

that notification of such a breach of   
security through the website of the     
,commission would be in the public      
interest or for the protection of       
consumers1 the ,commission shall place  
such a notification in a clear and      
conspicuous location on the website4    
7#b7 ,other ,federal agency ,if another 
,federal agency 7such as the ,federal   
,communications ,commission1 the        
,consumer ,financial ,protection        
,bureau1 or the ,department of ,justice7
 receives notice of a breach of security
 from a covered entity and finds that   
notification of such a breach of        
security through the website of the     
,commission would be in the public      
interest or for the protection of       
consumers1 that ,federal agency shall   
place such a notification in a clear and
 conspicuous location on the website of 
that agency4  7c7 ,website notification 
of ,state attorneys general ,if a ,state
 attorney general1 upon receiving       
notification of any breach of security  

that is reported to the ,commission     
under subsection 7d77#e71 finds that    
notification of such a breach of        
security through the ,state attorney    
general's internet website would be in  
the public interest or for the          
protection of consumers1 the ,state     
attorney general shall place such a     
notification in a clear and conspicuous 
location on its internet website4  7d7  
,,ftc study on notification in languages
 in addition to ,english ,not later than
 #a year after the date of enactment of 
this ,act1 the ,commission shall conduct
 a study on the practicality and cost   
effectiveness of requiring the          
notification required by subsection     
7c77#a7 to be provided in a language in 
addition to ,english to individuals     
known to speak only such other language4
  7e7 ,education and outreach for small 
businesses ,the ,commission shall       
conduct education and outreach for small
 business concerns on data security     
practices and how to prevent hacking and

 other unauthorized access to1          
acquisition of1 or use of data          
maintained by such small business       
concerns4  7f7 ,website on data security
 best practices ,the ,commission shall  
establish and maintain an internet      
website containing non-binding best     
practices for businesses regarding data 
security and how to prevent hacking and 
other unauthorized access to1           
acquisition of1 or use of data          
maintained by such businesses4  7g7     
,general rulemaking authority  7#a7 ,in 
general ,the ,commission may promulgate 
regulations necessary under section #eec
 of title #e1 ,united ,states ,code1 to 
effectively enforce the requirements of 
this section4  7#b7 ,limitation ,in     
promulgating rules under this ,act1 the 
,commission shall not require the       
deployment or use of any specific       
product or technology1 including any    
specific computer software or hardware4 
7h7 ,treatment of persons governed by   
other law ,a covered entity who is in   

compliance with any other ,federal law  
that requires such covered entity to    
provide notification to individuals     
following a breach of security1 shall be
 deemed to be in compliance with this   
section with respect to activities and  
information covered under such ,federal 
law4  #d4 ,application and enforcement  
7a7 ,enforcement by the federal ,trade  
,commission  7#a7 ,unfair or deceptive  
acts or practices ,a violation of a     
regulation promulgated under section #b 
or #c shall be treated as an unfair and 
deceptive act or practice in violation  
of a regulation under section           
#ah7;a77#a77;,b7 of the ,federal ,trade 
,commission ,act 7#ae ,u4,s4,c4         
#eg;a7a77#a77;,b77 regarding unfair or  
deceptive acts or practices and shall be
 subject to enforcement by the          
,commission under that ,act with respect
 to any covered entity4 ,all of the     
functions and powers of the ,commission 
under the ,federal ,trade ,commission   
,act are available to the ,commission to

 enforce compliance by any person with  
the requirements imposed under this     
,act4  7#b7 ,coordination with ,federal 
,communications ,commission ,in the case
 of enforcement under this ,act that    
relates to entities subject to the      
authority of the ,federal               
,communications ,commission1 enforcement
 actions by the ,commission shall be    
coordinated with the ,federal           
,communications ,commission4  7#c7      
,coordination with ,consumer ,financial 
,protection ,bureau ,in the case of     
enforcement under this ,act that relates
 to entities that provide a consumer    
financial product or service 7as defined
 in section #ajjb of the ,consumer      
,financial ,protection ,act of #bjaj    
7#ab ,u4,s4,c4 #edha771 enforcement     
actions by the ,commission shall be     
coordinated with the ,consumer          
,financial ,protection ,bureau4  7b7    
,enforcement by ,state attorneys general
  7#a7 ,in general ,if the chief law    
enforcement officer of a ,state1 or an  

official or agency designated by a      
,state1 has reason to believe that any  
covered entity has violated or is       
violating section #b or #c of this ,act1
 the attorney general1 official1 or     
agency of the ,state1 in addition to any
 authority it may have to bring an      
action in ,state court under its        
consumer protection law1 may bring a    
civil action in any appropriate ,united 
,states district court or in any other  
court of competent jurisdiction1        
including a ,state court1 to--  7,a7    
enjoin further such violation by the    
defendant2  7,b7 enforce compliance with
 section #b or #c1 as applicable2  7,c7 
obtain civil penalties in the amount    
determined under paragraph 7#b72 and    
7,d7 obtain damages1 restitution1 or    
other compensation on behalf of         
residents of the ,state4  7#b7 ,civil   
penalties  7,a7 ,calculation  7i7       
,treatment of violations of section #b  
,for purposes of paragraph 7#a77;,c7    
with regard to a violation of section   

#b1 the amount determined under this    
paragraph is the amount calculated by   
multiplying the number of days that a   
covered entity is not in compliance with
 such section by an amount to be        
determined by the ,commission4 ,such    
amount determined by the ,commission    
shall be adjusted as described in the   
,federal ,civil ,penalties ,inflation   
,adjustment ,act of #aiij 7,public ,law 
#aja-daj2 #bh ,u4,s4,c4 #bdfa note74    
7ii7 ,treatment of violations of section
 #c ,for purposes of paragraph 7#a77;,c7
 with regard to a violation of section  
#c1 the amount determined under this    
paragraph is the amount calculated by   
multiplying the number of violations of 
such section by an amount to be         
determined by the ,commission4 ,each    
failure to send notification as required
 under section #c to a citizen or       
resident of the ,united ,states shall be
 treated as a separate violation4  7,b7 
,adjustment for inflation ,beginning on 
the date that the ,consumer ,price      

,index is first published by the ,bureau
 of ,labor ,statistics that is after #a 
year after the date of enactment of this
 ,act1 and each year thereafter1 the    
amounts specified in clauses 7i7 and    
7ii7 of subparagraph 7,a7 shall be      
increased by the percentage increase in 
the ,consumer ,price ,index published on
 that date from the ,consumer ,price    
,index published the previous year4     
7#c7 ,notice and intervention by the    
,,ftc  7,a7 ,in general ,the attorney   
general of a ,state shall provide prior 
written notice of any action under      
paragraph 7#a7 to the ,commission and   
provide the ,commission with a copy of  
the complaint in the action1 except in  
any case in which such prior notice is  
not feasible1 in which case the attorney
 general shall serve such notice        
immediately upon instituting such       
action4 ,the ,commission shall have the 
right--  7i7 to intervene in the action2
  7ii7 upon so intervening1 to be heard 
on all matters arising therein2 and     

7iii7 to file petitions for appeal4     
7,b7 ,limitation on ,state action while 
,federal action is pending ,if the      
,commission has instituted a civil      
action for a violation of this ,act1 no 
,state attorney general1 or official or 
agency of a ,state1 may bring an action 
under this subsection during the        
pendency of that action against any     
defendant named in the complaint of the 
,commission for any violation of this   
,act alleged in the complaint4  7#d7    
,relationship with ,state-law claims ,if
 the attorney general of a ,state has   
authority to bring an action under      
,state law directed at acts or practices
 that also violate this ,act1 the       
attorney general may assert the         
,state-law claim and a claim under this 
,act in the same civil action4  #e4     
,definitions ,in this ,act3 7#a7 ,breach
 of security ,the term breach of        
security means unauthorized access to1  
acquisition of1 sale of1 release of1 or 
use of data containing personal         

information4  7#b7 ,commission ,the term
 ,commission means the ,federal ,trade  
,commission4  7#c7 ,covered entity ,the 
term covered entity means--  7,a7 any   
person1 partnership1 or corporation over
 which the ,commission has authority    
pursuant to section #e7;a77#b7 of the   
,federal ,trade ,commission ,act 7#ae   
,u4,s4,c4 #de7;a77#b772  7,b7           
notwithstanding section #e7;a77#b7 of   
the ,federal ,trade ,commission ,act    
7#ae ,u4,s4,c4 #de7;a77#b771 common     
carriers subject to the ,communications 
,act of #aicd 7#dg ,u4,s4,c4 #aea et    
seq472 and  7,c7 notwithstanding        
sections #d and #e7;a77#b7 of the       
,federal ,trade ,commission ,act 7#ae   
,u4,s4,c4 #dd and #de7;a77#b771 any     
nonprofit organization4  7#d7 ,nonprofit
 organization ,the term nonprofit       
organization means an organization      
described in section #eja7;c7 of the    
,internal ,revenue ,code of #aihf that  
is exempt from taxation under section   
#eja7;a7 of such ,code4  7#e7           

,information ,broker ,the term          
information broker means any individual1
 person1 partnership1 or corporation    
that collects personal information1     
sells personal information1 or profits  
from personal information in any way4   
7#f7 ,personal information  7,a7        
,definition ,the term personal          
information means any information or    
compilation of information that includes
 any of the following3 7i7 ,an          
individual's first name or initial and  
last name in combination with any of the
 following data elements for that       
individual3  7,i7 ,home address or      
telephone number4  7,,ii7 ,mother's     
maiden name4  7,,iii7 ,month1 day1 and  
year of birth4  7,,iv7 ,user name or    
electronic mail address4  7ii7 ,driver's
 license number1 passport number1       
military identification number1 alien   
registration number1 or other similar   
number issued on a government document  
used to verify identity4  7iii7 ,unique 
account identifier 7including a         

financial account number or credit or   
debit card number71 electronic          
identification number1 user name1 or    
routing code4  7iv7 ,partial or complete
 ,social ,security number4  7v7 ,unique 
biometric or genetic data such as a     
fingerprint1 voice print1 retina or iris
 image1 facial recognition data1 or any 
other unique physical representation4   
7vi7 ,information that could be used to 
access an individual's account1 such as 
user name and password or e-mail address
 and password4  7vii7 ,any security     
code1 access code1 password1 or source  
code that could be used to generate such
 codes or passwords1 in combination with
 either of the following data elements3 
7,i7 ,an individual's first and last    
name or first initial and last name4    
7,,ii7 ,a unique account identifier     
7including a financial account number or
 credit or debit card number71          
electronic identification number1 user  
name1 or routing code4  7viii7          
,information generated or derived from  

the operation or use of an electronic   
communications device that is sufficient
 to identify the street name and name of
 the city or town in which the device is
 located4  7ix7 ,any information        
regarding an individual's medical       
history1 mental or physical condition1  
medical treatment or diagnosis by a     
health care professional1 or the        
provision of health care to the         
individual1 including health information
 provided to a website or mobile        
application4  7x7 ,a health insurance   
policy number or subscriber             
identification number and any unique    
identifier used by a health insurer to  
identify the individual or any          
information in an individual's health   
insurance application and claims        
history1 including any appeals records4 
7xi7 ,digitized or other electronic     
signature4  7xii7 ,nonpublic            
communication such as a text1 ,,sms1    
,,mms1 ,,rcs1 and other electronic      
message or other user-created content   

such as an email1 photograph1 or video4 
7xiii7 ,any record or information       
concerning payroll1 income1 financial   
account1 mortgage1 loan1 line of credit1
 utility bill1 accumulated purchase1 or 
any other information regarding a       
financial asset1 obligation1 or spending
 habit4  7xiv7 ,any additional element  
the ,commission defines as personal     
information in accordance with          
subparagraph 7,b74  7,b7 ,modified      
definition by rulemaking ,the           
,commission may1 by rule promulgated    
under section #eec of title #e1 ,united 
,states ,code1 modify the definition of 
personal information under subparagraph 
7,a74  7#g7 ,small business concern ,the
 term small business concern has the    
meaning given that term in section #c of
 the ,small ,business ,act 7#ae         
,u4,s4,c4 #fcb74  7#h7 ,state ,the term 
,state means each of the several        
,states1 the ,district of ,columbia1 the
 ,commonwealth of ,puerto ,rico1 ,guam1 
,american ,samoa1 the ,united ,states   

,virgin ,islands1 the ,commonwealth of  
the ,northern ,mariana ,islands1 any    
other territory or possession of the    
,united ,states1 and each federally     
recognized ,indian ,tribe4  #f4 ,effect 
on other laws  7a7 ,effect on ,state    
data security and breach notification   
laws ,this ,act supersedes any provision
 of a statute or regulation of a ,state 
or political subdivision of a ,state1   
with respect to a covered entity1 that  
expressly--  7#a7 requires information  
security practices for the treatment and
 protection of personal information     
similar to any of those required under  
section #b2 or  7#b7 requires           
notification to individuals of a breach 
of security of personal information4    
7b7 ,effect on other ,state laws ,except
 as provided in subsection 7a71 nothing 
in this ,act shall be construed to--    
7#a7 preempt or limit any provision of  
any law1 rule1 regulation1 requirement1 
standard1 or other provision having the 
force and effect of law of any ,state1  

including any ,state consumer protection
 law1 any ,state law relating to acts of
 fraud or deception1 and any ,state     
trespass1 contract1 or tort law2  7#b7  
prevent or limit the attorney general of
 a ,state from exercising the powers    
conferred upon the attorney general by  
the laws of the ,state1 including       
conducting investigations1 administering
 oaths or affirmations1 or compelling   
the attendance of witnesses or the      
production of documentary and other     
evidence2 or  7#c7 preempt or limit any 
provision of any law1 rule1 regulation1 
requirement1 standard1 or other         
provision having the force and effect of
 law of any ,state with respect to any  
person that is not a covered entity4    
7c7 ,preservation of authority ,nothing 
in this ,act may be construed in any way
 to limit or affect the authority of the
 ,commission1 the ,federal              
,communication ,commission1 or the      
,consumer ,financial ,protection ,bureau
 under any other provision of law4  #g4 

,effective date ,this ,act shall take   
effect #ij days after the date of       
enactment of this ,act4