,i #aafth ,,congress #ast ,session ,h4 ,r4 #cbg ,,in ,,the ,,house ,,of ,,representatives ,january #h1 #bjai,mr4 ,ted ,lieu of ,california introduced the following bill2 which was referred to the ,committee on ,energy and ,commerce ,a ,,bill ,to prohibit entities from requiring individuals to submit to arbitration for disputes arising from a security breach1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,ending ,forced ,arbitration for ,victims of ,data ,breaches ,act of #bjai4 #b4 ,protection of data security breach victims ,an entity may not require1 as part of a customer or other similar agreement1 an individual to agree to submit any dispute related to a security breach1 including any dispute related to identity theft1 to arbitration4 #c4 ,applicability ,a provision of an agreement entered into prior to the date of the enactment of this ,act1 that violates section #b1 is void4 #d4 ,enforcement by the ,federal ,trade ,commission 7a7 ,unfair or deceptive acts or practices ,a violation of section #b shall be treated as an unfair and deceptive act or practice in violation of a regulation under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 regarding unfair or deceptive acts or practices4 7b7 ,powers of commission ,the ,commission shall enforce this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 ,any person who violates section #b shall be subject to the penalties and entitled to the privileges and immunities provided in that ,act4 7c7 ,rules ,the ,commission shall promulgate1 under section #eec of title #e1 ,united ,states ,code1 such rules as may be necessary to carry out the provisions of this ,act4 #e4 ,enforcement by ,states 7a7 ,in general ,if the attorney general of a ,state has reason to believe that an interest of the residents of the ,state has been or is being threatened or adversely affected by a practice that violates section #b1 the attorney general of the ,state may1 as parens patriae1 bring a civil action on behalf of the residents of the ,state in an appropriate district court of the ,united ,states to obtain appropriate relief4 7b7 ,rights of ,federal ,trade ,commission 7#a7 ,notice to ,federal ,trade ,commission 7,a7 ,in general ,except as provided in clause 7iii71 the attorney general of a ,state1 before initiating a civil action under paragraph 7#a71 shall provide written notification to the ,federal ,trade ,commission that the attorney general intends to bring such civil action4 7,b7 ,contents ,the notification required under clause 7i7 shall include a copy of the complaint to be filed to initiate the civil action4 7,c7 ,exception ,if it is not feasible for the attorney general of a ,state to provide the notification required under clause 7i7 before initiating a civil action under paragraph 7#a71 the attorney general shall notify the ,commission immediately upon instituting the civil action4 7#b7 ,intervention by ,federal ,trade ,commission ,the ,commission may-- 7,a7 intervene in any civil action brought by the attorney general of a ,state under paragraph 7#a72 and 7,b7 upon intervening-- 7i7 be heard on all matters arising in the civil action2 and 7ii7 file petitions for appeal of a decision in the civil action4 7c7 ,investigatory powers ,nothing in this subsection may be construed to prevent the attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of the ,state to conduct investigations1 to administer oaths or affirmations1 or to compel the attendance of witnesses or the production of documentary or other evidence4 7d7 ,preemptive action by ,federal ,trade ,commission ,if the ,federal ,trade ,commission institutes a civil action or an administrative action with respect to a violation of section #b1 the attorney general of a ,state may not1 during the pendency of such action1 bring a civil action under paragraph 7#a7 against any defendant named in the complaint of the ,commission for the violation with respect to which the ,commission instituted such action4 7e7 ,venue2 service of process 7#a7 ,venue ,any action brought under paragraph 7#a7 may be brought in-- 7,a7 the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code2 or 7,b7 another court of competent jurisdiction4 7#b7 ,service of process ,in an action brought under paragraph 7#a71 process may be served in any district in which-- 7,a7 the defendant is an inhabitant1 may be found1 or transacts business2 or 7,b7 venue is proper under section #acia of title #bh1 ,united ,states ,code4 #f4 ,private right of action 7a7 ,in general ,an individual who is injured by a violation of section #b may bring a private right of action in any court of appropriate jurisdiction for rescission and restitution1 as well as for all damages and may be awarded injunctive relief against a violation of such section4 ,the individual shall also be entitled to recover its costs of litigation and reasonable attorney's fees and expert witness fees1 against any entity or person found to be liable for such violation4 7b7 ,liability ,every person who directly or indirectly controls a person liable under subsection 7a71 every partner in a firm so liable1 every principal executive officer or director of a corporation so liable1 every person occupying a similar status or performing similar functions and every employee of a person so liable who materially aids in the act or transaction constituting the violation is also liable jointly and severally with and to the same extent as such person1 unless the person who would otherwise be liable hereunder had no knowledge of or reasonable grounds to know of the existence of the facts by reason of which the liability is alleged to exist4 7c7 ,statute of limitations ,no action may be commenced pursuant to this section more than the later of-- 7#a7 #b years after the date on which the violation occurs2 or 7#b7 #b years after the date on which the violation is discovered or should have been discovered through exercise of reasonable diligence4 7d7 ,venue ,an action under this section may be brought in-- 7#a7 the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code2 or 7#b7 another court of competent jurisdiction4 7e7 ,cumulative right ,the private rights provided for in this section are in addition to and not in lieu of other rights or remedies created by ,federal or ,state law4 #g4 ,definitions ,in this ,act-- 7#a7 the term security breach-- 7,a7 means a compromise of the security1 confidentiality1 or integrity of1 or the loss of1 computerized data that results in1 or there is a reasonable basis to conclude has resulted in-- 7i7 the unauthorized acquisition of sensitive personally identifiable information2 or 7ii7 access to sensitive personally identifiable information that is for an unauthorized purpose1 or in excess of authorization2 7,b7 does not include any lawfully authorized investigative1 protective1 or intelligence activity of a law enforcement agency of the ,united ,states1 a ,state1 or a political subdivision of a ,state1 or of an element of the intelligence community2 and 7#b7 the term sensitive personally identifiable information means any information or compilation of information1 in electronic or digital form that includes one or more of the following3 7,a7 ,an individual's first and last name or first initial and last name in combination with any two of the following data elements3 7i7 ,home address or telephone number4 7ii7 ,mother's maiden name4 7iii7 ,month1 day1 and year of birth4 7,b7 ,a ,social ,security number 7but not including only the last four digits of a ,social ,security number71 driver's license number1 passport number1 or alien registration number or other ,government-issued unique identification number4 7,c7 ,unique biometric data such as a finger print1 voice print1 a retina or iris image1 or any other unique physical representation4 7,d7 ,a unique account identifier1 including a financial account number or credit or debit card number1 electronic identification number1 user name1 or routing code4 7,e7 ,a user name or electronic mail address1 in combination with a password or security question and answer that would permit access to an online account4 7,f7 ,any combination of the following data elements3 7i7 ,an individual's first and last name or first initial and last name4 7ii7 ,a unique account identifier1 including a financial account number or credit or debit card number1 electronic identification number1 user name1 or routing code4 7iii7 ,any security code1 access code1 or password1 or source code that could be used to generate such codes or passwords4