,i #aafth ,,congress #ast ,session ,h4 ,r4 #bede ,,in ,,the ,,house ,,of ,,representatives ,may #g1 #bjai,mr4 ,cummings 7for himself and ,mr4 ,krishnamoorthi7 introduced the following bill2 which was referred to the ,committee on ,financial ,services ,a ,,bill ,to create an ,office of ,cybersecurity at the ,federal ,trade ,commission for supervision of data security at consumer reporting agencies1 to require the promulgation of regulations establishing standards for effective cybersecurity at consumer reporting agencies1 to impose penalties on credit reporting agencies for cybersecurity breaches that put sensitive consumer data at risk1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,data ,breach ,prevention and ,compensation ,act of #bjai4 #b4 ,definitions ,in this ,act3 7#a7 ,affected consumer ,the term affected consumer means any individual to whom personally identifying information pertains that was1 or that may have been1 affected by a covered breach4 7#b7 ,agency ,the term agency has the meaning given the term in section #eea of title #e1 ,united ,states ,code4 7#c7 ,career appointee ,the term career appointee has the meaning given the term in section #cacb7;a7 of title #e1 ,united ,states ,code4 7#d7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#e7 ,consumer report2 consumer reporting agency ,the terms consumer report and consumer reporting agency have the meanings given the terms in section #fjc of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a74 7#f7 ,covered breach ,the term covered breach means any instance in which not less than #a piece of personally identifying information held by a covered consumer reporting agency is exposed1 or is reasonably likely to have been exposed1 to an unauthorized party4 7#g7 ,covered consumer reporting agency ,the term covered consumer reporting agency means-- 7,a7 a consumer reporting agency described in section #fjc7p7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a7p772 or 7,b7 a consumer reporting agency that earns not less than #g1jjj1jjj in annual revenue from the sale of consumer reports4 7#h7 ,detail ,the term detail means a temporary assignment of an employee to a different position for a specified period1 with the employee returning to the regular duties of the employee at the end of the specified period4 7#i7 ,director ,the term ,director means the ,director of the ,office4 7#aj7 ,office ,the term ,office means the ,office of ,cybersecurity established under section #c7;a74 7#aa7 ,personally identifying information ,the term personally identifying information means1 with respect to an individual-- 7,a7 the social security number of the individual2 7,b7 a driver's license number of the individual2 7,c7 a passport number of the individual2 7,d7 an alien registration number or other government-issued unique identification number of the individual2 7,e7 unique biometric data1 such as a faceprint1 a fingerprint1 a voice print1 an iris image1 or any other unique physical representation of the individual2 7,f7 the first and last name of the individual1 or the first initial of the first name and the last name of the individual1 in combination with any information that relates to-- 7i7 the past1 present1 or future physical or mental health or condition of the individual2 or 7ii7 the provision of health care to1 or a diagnosis of1 the individual2 7,g7 7i7 a financial account number1 debit card number1 or credit card number of the individual2 or 7ii7 any passcode required to access an account described in clause 7i72 and 7,h7 such additional information1 as determined by the ,director4 #c4 ,cybersecurity standards and ,,ftc authority 7a7 ,establishment ,there is established in the ,commission an ,office of ,cybersecurity1 which shall be headed by a ,director1 who shall be a career appointee4 7b7 ,duties ,the ,office-- 7#a7 shall-- 7,a7 supervise covered consumer reporting agencies with respect to data security2 7,b7 promulgate regulations1 through notice and comment rulemaking that complies with section #eec of title #e1 ,united ,states ,code1 for effective data security for covered consumer reporting agencies1 including requirements for a covered consumer reporting agency to-- 7i7 provide the ,commission with descriptions of technical and organizational security measures of the consumer reporting agency1 including-- 7,i7 system and network security measures1 including-- 7aa7 asset management1 including-- 7,,aa7 an inventory of devices of the covered consumer reporting agency that are authorized to access data maintained by the covered consumer reporting agency2 7,,bb7 an inventory of software that is authorized by the covered consumer reporting agency to access data maintained by the covered consumer reporting agency1 including application whitelisting2 and 7,,cc7 secure configurations for hardware and software of the covered consumer reporting agency2 7bb7 network management and monitoring1 including-- 7,,aa7 mapped data flows1 including functional mission mapping2 7,,bb7 maintenance1 monitoring1 and analysis of audit logs2 7,,cc7 network segmentation2 and 7,,dd7 local and remote access privileges1 defined and managed2 and 7cc7 application management1 including-- 7,,aa7 continuous vulnerability assessment and remediation2 7,,bb7 server application hardening2 7,,cc7 vulnerability handling1 such as coordinated vulnerability disclosure policy2 and 7,,dd7 patch management1 including at1 or near1 real-time dashboards of patch implementation across network hosts2 and 7,,ii7 data security measures1 including-- 7aa7 data-centric security mechanisms such as format-preserving encryption1 cryptographic data-splitting1 and data-tagging and lineage2 7bb7 encryption for data at rest2 7cc7 encryption for data in transit2 7dd7 systemwide data minimization evaluations and policies2 and 7ee7 data recovery capability2 7ii7 employ reasonable technical measures and corporate governance processes for continuous monitoring of data1 intrusion detection1 and continuous evaluation and timely patching of vulnerabilities2 7iii7 employ reasonable technical measures and corporate governance processes that satisfy and exceed all relevant data security policy recommendations contained in the framework of the ,national ,institute of ,standards and ,technology entitled ,framework for ,improving ,critical ,infrastructure ,cybersecurity1 dated ,february #ab1 #bjad1 or any successor thereto1 as determined appropriate by the ,office2 and 7iv7 create and maintain documentation demonstrating that the covered consumer reporting agency is employing the technical measures and corporate governance processes described in clauses 7ii7 and 7iii72 7,c7 annually examine the data security measures of covered consumer reporting agencies for compliance with the requirements described in clauses 7ii7 and 7iii7 of subparagraph 7,b72 7,d7 investigate any covered consumer reporting agency if the ,office has reason to suspect-- 7i7 a covered breach has occurred and the covered consumer reporting agency was subject to the covered breach2 or 7ii7 the covered consumer reporting agency is not in compliance with the requirements described in clauses 7ii7 and 7iii7 of subparagraph 7,b72 7,e7 after consultation with members of the technical and academic communities1 develop a rigorous1 repeatable methodology-- 7i7 for evaluating1 testing1 and measuring effective data security practices of covered consumer reporting agencies2 and 7ii7 that employs forms of static and dynamic software analysis and penetration testing2 7,f7 submit to ,congress an annual report on the findings of each investigation carried out under subparagraph 7,d7 during the year covered by the report that includes a statement of how ,congress could enhance the authorities of the ,office in order to assist the ,office in carrying out the duties of the ,office under this ,act2 7,g7 determine whether covered consumer reporting agencies are complying with the requirements described in clauses 7ii7 and 7iii7 of subparagraph 7,b72 and 7,h7 coordinate with the ,national ,institute of ,standards and ,technology and the ,national ,cybersecurity and ,communications ,integration ,center of the ,department of ,homeland ,security2 and 7#b7 may-- 7,a7 investigate any covered breach to determine if the covered consumer reporting agency that was subject to the covered breach was in compliance with the requirements described in clauses 7ii7 and 7iii7 of paragraph 7#a77;,b7 as of the date on which the covered breach occurred2 and 7,b7 if the ,director has reason to believe that any covered consumer reporting agency is violating1 or in the immediate future will violate1 a requirement described in clause 7ii7 or 7iii7 of paragraph 7#a71 bring a suit in an appropriate district court of the ,united ,states to enjoin any such act or practice4 7c7 ,staff 7#a7 ,in general ,the ,director shall1 without regard to the civil service laws and regulations1 appoint such personnel1 including computer security researchers and practitioners with technical expertise in computer science1 engineering1 and cybersecurity1 as the ,director determines are necessary to carry out the duties of the ,office4 7#b7 ,details 7,a7 ,in general ,an employee of the ,national ,institute of ,standards and ,technology1 the ,bureau of ,consumer ,financial ,protection1 or the ,national ,cybersecurity and ,communications ,integration ,center of the ,department of ,homeland ,security may be detailed to the ,office1 without reimbursement4 7,b7 ,civil service status and privilege ,detail under subparagraph 7,a7 shall be without interruption or loss of the civil service status or privilege of the employee who is detailed to the ,office4 #d4 ,notification and enforcement 7a7 ,notification 7#a7 ,notification to the ,commission and relevant federal law enforcement and intelligence agencies 7,a7 ,notification to the ,commission ,except as provided in paragraph 7#c71 not later than #aj days after the date on which a covered breach occurs1 any covered consumer reporting agency that was subject to the covered breach shall notify the ,commission of the covered breach4 7,b7 ,notification to relevant federal law enforcement and intelligence agencies ,not later than #aj days after the date on which the ,commission receives a notification under subparagraph 7,a7 that a covered breach has occurred1 the ,commission shall-- 7i7 notify the relevant ,federal law enforcement agencies and intelligence agencies that the covered breach has occurred2 and 7ii7 with respect to the covered breach1 consult with the relevant ,federal law enforcement agencies and intelligence agencies1 as appropriate4 7#b7 ,notification to affected consumers and the public 7,a7 ,in general ,except as provided in paragraph 7#c71 on an expeditious and practical timeline1 as determined appropriate by the ,commission1 a covered consumer reporting agency that is subject to a covered breach shall-- 7i7 submit to each affected consumer with respect to whom the covered consumer reporting agency holds a piece of personally identifying information a notification regarding the covered breach that complies with subparagraph 7,b72 and 7ii7 publish on the internet website of the covered consumer reporting agency a notice that contains a statement of-- 7,i7 the information described in clauses 7i7 and 7ii7 of subparagraph 7,b7 and subclauses 7,i7 and 7,,ii7 of clause 7iii7 of that subparagraph2 and 7,,ii7 the steps that the covered consumer reporting agency is taking to notify the affected consumers described in clause 7i7 regarding the covered breach4 7,b7 ,notification to affected consumers ,in a notification to affected consumers under subparagraph 7,a77i71 the covered consumer reporting agency submitting the notification shall include a statement of-- 7i7 the fact that the covered breach occurred2 7ii7 the approximate date on which the covered breach occurred2 and 7iii7 with respect to the covered breach-- 7,i7 the number of affected consumers2 7,,ii7 the measures that the covered consumer reporting agency is taking to remedy the covered breach2 and 7,,iii7 the potential risks created by the covered breach1 a list of which the covered consumer reporting agency shall develop in consultation with the ,office4 7#c7 ,delay of notification authorized for law enforcement or national security purposes 7,a7 ,notification by law enforcement agency or intelligence agency ,if a ,federal law enforcement agency or intelligence agency to which the ,commission has provided notice under paragraph 7#a77;,b77i7 determines that the notification required under paragraph 7#b7 may impede a criminal investigation or national security activity-- 7i7 the ,federal law enforcement agency or intelligence agency shall provide written notice to the ,commission and the covered consumer reporting agency that was subject to the covered breach that is the subject of the notification that states-- 7,i7 that the notification required under paragraph 7#b7 shall be delayed for law enforcement or national security purposes2 and 7,,ii7 the date on which the delay imposed under subclause 7,i7 shall end2 and 7ii7 subject to subparagraph 7,b71 the covered consumer reporting agency that was subject to the covered breach shall delay notification under paragraph 7#b7 until the date described in clause 7i77,,ii7 of this subparagraph4 7,b7 ,extended delay of notification ,if the notification required under paragraph 7#b7 is delayed under subparagraph 7,a7 of this paragraph1 a covered consumer reporting agency that is required to provide notice under paragraph 7#b7 shall provide that notice on an expeditious and practical timeline1 as determined appropriate by the ,commission1 after the date on which the law enforcement or national security delay under subparagraph 7,a7 of this paragraph ends1 unless a ,federal law enforcement or intelligence agency to which the ,commission has provided notice under paragraph 7#a77;,b77i7 provides written notification to the ,commission and the covered consumer reporting agency that states-- 7i7 that further delay is necessary2 and 7ii7 the date on which the further delay shall end4 7,c7 ,law enforcement immunity ,no nonconstitutional cause of action shall lie in any court against any agency for acts relating to the delay of notification under subparagraph 7,a71 or the extended delay of notification under subparagraph 7,b71 for law enforcement or national security purposes4 7b7 ,penalty 7#a7 ,in general ,in the event of a covered breach1 the ,commission shall1 not later than #cj days after the date on which the ,commission receives notification of the covered breach under subsection 7a77#a77;,a71 commence a civil action to recover a civil penalty in an appropriate district court of the ,united ,states against the covered consumer reporting agency that was subject to the covered breach4 7#b7 ,determining penalty amount 7,a7 ,in general ,except as provided in subparagraph 7,b71 in determining the amount of a civil penalty under paragraph 7#a71 the court shall impose a civil penalty on a covered consumer reporting agency of-- 7i7 #ajj for each consumer for whom the first and last name1 or the first initial of the first name and last name1 and #a other item of personally identifying information were exposed to an unauthorized party2 and 7ii7 in addition to the penalty imposed under clause 7i71 an additional #ej for each item of personally identifying information of the consumer1 other than an item described in that clause1 that was exposed to an unauthorized party4 7,b7 ,exception 7i7 ,in general ,except as provided in clause 7ii71 in an action commenced under this subsection1 a court may not impose a civil penalty in an amount that is more than #ej percent of the gross revenue of the covered consumer reporting agency against which the action is brought for the fiscal year before the fiscal year in which the covered consumer reporting agency became aware of the covered breach that is the subject of the action4 7ii7 ,penalty doubled ,in an action commenced under this subsection1 the court shall impose a civil penalty on a covered consumer reporting agency in an amount that is #b times the amount of the penalty described in subparagraph 7,a71 but not greater than #ge percent of the gross revenue of the covered consumer reporting agency for the fiscal year before the fiscal year in which the covered consumer reporting agency became aware of the covered breach that is subject to the action1 if-- 7,i7 the covered consumer reporting agency fails to notify the ,commission of the covered breach before the deadline established under subsection 7a77#a77;,a72 or 7,,ii7 the covered consumer reporting agency violates any requirement described in clause 7ii7 or 7iii7 of section #c7;b77#a77;,b74 7#c7 ,proceeds of the penalties ,of the penalties imposed under this subsection-- 7,a7 #ej percent shall be used for cybersecurity research and inspections by the ,office2 and 7,b7 #ej percent shall be used by the ,office to be divided fairly among consumers affected by the covered breach4 7#d7 ,no preemption ,nothing in this subsection shall preclude an action by a consumer under ,state or other ,federal law4 7c7 ,injunctive relief ,the ,commission1 acting through the ,office1 may bring suit in an appropriate district court of the ,united ,states or in the ,united ,states court of any territory to require a covered consumer reporting agency to implement or correct a particular security measure in order to promote effective security in accordance with the requirements described in clauses 7ii7 and 7iii7 of section #c7;b77#a77;,b74 #e4 ,amendments to the ,gramm-,leach-,bliley ,act 7a7 ,enforcement relating to disclosure of nonpublic personal information ,section #eje7;a77#g7 of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhje7;a77#g77 is amended by inserting 1 including any consumer reporting agency that compiles and maintains files on consumers on a nationwide basis 7as defined in section #fjc7p7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a7p777 before the period at the end4 7b7 ,definitions relating to disclosure of nonpublic personal information ,section #eji7c7 of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhji7c77 is amended by adding at the end the following3 7,e7 ,consumer reporting agencies specifically included ,the term financial institution includes any consumer reporting agency that compiles and maintains files on consumers on a nationwide basis 7as defined in section #fjc7p7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a7p7774 4 #f4 ,authorization of appropriations ,there are authorized to be appropriated #ajj1jjj1jjj to carry out this ,act1 to remain available until expended4