,,ii  #aaf? ,,congress  #a/ ,session    
,s4 #accf  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,may #g1 #bjai,ms4     
,w>r5 7= h]self & ,mr4 ,w>n]7 introduc$ 
! foll[+ bill2 :i* 0 read twice & ref]r$
 to ! ,committee on ,bank+1 ,h\s+1 &    
,urban ,affairs  ,a ,,bill  ,to create  
an ,(fice ( ,cyb]security at ! ,f$]al   
,trade ,commission = sup]vision ( data  
security at consum] report+ ag5cies1 to 
require ! promulgation ( regulations    
e/abli%+ /&>ds = effective cyb]security 
at consum] report+ ag5cies1 to impose   
p5alties on cr$it report+ ag5cies =     
cyb]security brea*es t put s5sitive     
consum] data at risk1 & = o!r purposes4 
#a4 ,%ort title ,?is ,act may be cit$ z 
! ,data ,brea* ,prev5tion & ,comp5sation
 ,act ( #bjai4  #b4 ,def9itions ,9 ?is  
,act3 7#a7 ,affect$ consum] ,! t]m      
affect$ consum] means any individual to 
:om p]sonally id5tify+ in=mation p]ta9s 
t 01 or t may h be51 affect$ by a cov]$ 
brea*4  7#b7 ,ag5cy ,! t]m ag5cy has !  
mean+ giv5 ! t]m 9 section #eea ( title 

#e1 ,unit$ ,/ates ,code4  7#c7 ,c>e]    
appo9tee ,! t]m c>e] appo9tee has !     
mean+ giv5 ! t]m 9 section #cacb7;a7 (  
title #e1 ,unit$ ,/ates ,code4  7#d7    
,commission ,! t]m ,commission means !  
,f$]al ,trade ,commission4  7#e7        
,consum] report2 consum] report+ ag5cy  
,! t]ms consum] report & consum] report+
 ag5cy h ! mean+s giv5 ! t]ms 9 section 
#fjc ( ! ,fair ,cr$it ,report+ ,act 7#ae
 ,u4,s4,c4 #afha;a74  7#f7 ,cov]$ brea* 
,! t]m cov]$ brea* means any in/ance 9  
:i* n less ?an #a piece ( p]sonally     
id5tify+ in=mation held by a cov]$      
consum] report+ ag5cy is expos$1 or is  
reasonably likely to h be5 expos$1 to an
 unau?oriz$ p>ty4  7#g7 ,cov]$ consum]  
report+ ag5cy ,! t]m cov]$ consum]      
report+ ag5cy means-- 7,a7 a consum]    
report+ ag5cy describ$ 9 section #fjc7p7
 ( ! ,fair ,cr$it ,report+ ,act 7#ae    
,u4,s4,c4 #afha;a7p772 or  7,b7 a       
consum] report+ ag5cy t e>ns n less ?an 
#g1jjj1jjj 9 annual rev5ue f ! sale (   
consum] reports4  7#h7 ,detail ,! t]m   

detail means a tempor>y assignm5t ( an  
employee to a diff]5t position = a      
specifi$ p]iod1 ) ! employee return+ to 
! regul> duties ( ! employee at ! end ( 
! specifi$ p]iod4  7#i7 ,director ,! t]m
 ,director means ! ,director ( ! ,(fice4
  7#aj7 ,(fice ,! t]m ,(fice means !    
,(fice ( ,cyb]security e/abli%$ "u      
section #c7;a74  7#aa7 ,p]sonally       
id5tify+ in=mation ,! t]m p]sonally     
id5tify+ in=mation means1 ) respect to  
an individual-- 7,a7 ! social security  
numb] ( ! individual2  7,b7 a driv]'s   
lic5se numb] ( ! individual2  7,c7 a    
passport numb] ( ! individual2  7,d7 an 
ali5 regi/ration numb] or o!r           
gov]nm5t-issu$ unique id5tification     
numb] ( ! individual2  7,e7 unique      
biometric data1 su* z a facepr9t1 a     
f+]pr9t1 a voice pr9t1 an iris image1 or
 any o!r unique physical repres5tation (
 ! individual2  7,f7 ! fir/ & la/ "n ( !
 individual1 or ! fir/ initial ( ! fir/ 
"n & ! la/ "n ( ! individual1 9         
comb9ation ) any in=mation t relates    

to-- 7i7 ! pa/1 pres5t1 or future       
physical or m5tal heal? or condition ( !
 individual2 or  7ii7 ! provision (     
heal? c>e to1 or a diagnosis (1 !       
individual2  7,g7 7i7 a f9ancial acc\nt 
numb]1 debit c>d numb]1 or cr$it c>d    
numb] ( ! individual2 or  7ii7 any      
passcode requir$ to access an acc\nt    
describ$ 9 clause 7i72 &  7,h7 su*      
additional in=mation1 z det]m9$ by !    
,director4  #c4 ,cyb]security /&>ds &   
,,ftc au?ority  7a7 ,e/abli%m5t ,!re is 
e/abli%$ 9 ! ,commission an ,(fice (    
,cyb]security1 :i* %all be head$ by a   
,director1 :o %all be a c>e] appo9tee4  
7b7 ,duties ,! ,(fice-- 7#a7 %all-- 7,a7
 sup]vise cov]$ consum] report+ ag5cies 
) respect to data security2  7,b7       
promulgate regulations1 ?r\gh notice &  
comm5t rulemak+ t complies ) section    
#eec ( title #e1 ,unit$ ,/ates ,code1 = 
effective data security = cov]$ consum] 
report+ ag5cies1 includ+ requirem5ts = a
 cov]$ consum] report+ ag5cy to-- 7i7   
provide ! ,commission ) descriptions (  

te*nical & organizational security      
measures ( ! consum] report+ ag5cy1     
includ+-- 7,i7 sy/em & network security 
measures1 includ+-- 7aa7 asset          
managem5t1 includ+-- 7,,aa7 an inv5tory 
( devices ( ! cov]$ consum] report+     
ag5cy t are au?oriz$ to access data     
ma9ta9$ by ! cov]$ consum] report+      
ag5cy2 7,,bb7 an inv5tory ( s(tw>e t is 
au?oriz$ by ! cov]$ consum] report+     
ag5cy to access data ma9ta9$ by ! cov]$ 
consum] report+ ag5cy1 includ+          
application :iteli/+2 & 7,,cc7 secure   
configurations = h>dw>e & s(tw>e ( !    
cov]$ consum] report+ ag5cy2  7bb7      
network managem5t & monitor+1 includ+-- 
7,,aa7 mapp$ data fl[s1 includ+         
functional mission mapp+2 7,,bb7        
ma9t5ance1 monitor+1 & analysis ( audit 
logs2 7,,cc7 network segm5tation2 &     
7,,dd7 local & remote access privileges1
 def9$ & manag$2 &  7cc7 application    
managem5t1 includ+-- 7,,aa7 cont9u\s    
vuln]ability assessm5t & rem$iation2    
7,,bb7 s]v] application h>d5+2 7,,cc7   

vuln]ability h&l+1 su* z coord9at$      
vuln]ability disclosure policy2 & 7,,dd7
 pat* managem5t1 includ+ at1 or ne>1    
real-"t da%bo>ds ( pat* implem5tation   
across network ho/s2 &  7,,ii7 data     
security measures1 includ+-- 7aa7       
data-c5tric security me*anisms su* z    
=mat-pres]v+ encryption1 cryptographic  
data-splitt+1 & data-tagg+ & l9eage2    
7bb7 encryption = data at re/2  7cc7    
encryption = data 9 transit2  7dd7      
sy/emwide data m9imization evaluations &
 policies2 &  7ee7 data recov]y         
capability2  7ii7 employ reasonable     
te*nical measures & corporate gov]nance 
processes = cont9u\s monitor+ ( data1   
intrusion detection1 & cont9u\s         
evaluation & timely pat*+ (             
vuln]abilities2  7iii7 employ reasonable
 te*nical measures & corporate gov]nance
 processes t satisfy & exce$ all        
relevant data security policy           
recomm5dations conta9$ 9 ! framework ( !
 ,national ,in/itute ( ,/&>ds &         
,te*nology entitl$ ,framework = ,improv+

 ,critical ,infra/ructure ,cyb]security1
 dat$ ,febru>y #ab1 #bjad1 or any       
successor !reto1 z det]m9$ appropriate  
by ! ,(fice2 &  7iv7 create & ma9ta9    
docum5tation demon/rat+ t ! cov]$       
consum] report+ ag5cy is employ+ !      
te*nical measures & corporate gov]nance 
processes describ$ 9 clauses 7ii7 &     
7iii72  7,c7 annually exam9e ! data     
security measures ( cov]$ consum]       
report+ ag5cies = compliance ) !        
requirem5ts describ$ 9 clauses 7ii7 &   
7iii7 ( subp>agraph 7,b72  7,d7         
inve/igate any cov]$ consum] report+    
ag5cy if ! ,(fice has reason to         
suspect-- 7i7 a cov]$ brea* has occurr$ 
& ! cov]$ consum] report+ ag5cy 0       
subject to ! cov]$ brea*2 or  7ii7 !    
cov]$ consum] report+ ag5cy is n 9      
compliance ) ! requirem5ts describ$ 9   
clauses 7ii7 & 7iii7 ( subp>agraph 7,b72
  7,e7 aft] consultation ) memb]s ( !   
te*nical & academic communities1 develop
 a rigor\s1 repeatable me?odology-- 7i7 
= evaluat+1 te/+1 & measur+ effective   

data security practices ( cov]$ consum] 
report+ ag5cies2 &  7ii7 t employs =ms (
 /atic & dynamic s(tw>e analysis &      
p5etration te/+2  7,f7 submit to        
,congress an annual report on ! f9d+s ( 
ea* inve/igation c>ri$ out "u           
subp>agraph 7,d7 dur+ ! ye> cov]$ by !  
report t includes a /atem5t ( h[        
,congress c\ld enhance ! au?orities ( ! 
,(fice 9 ord] to assi/ ! ,(fice 9 c>ry+ 
out ! duties ( ! ,(fice "u ?is ,act2    
7,g7 det]m9e :e!r cov]$ consum] report+ 
ag5cies are comply+ ) ! requirem5ts     
describ$ 9 clauses 7ii7 & 7iii7 (       
subp>agraph 7,b72 &  7,h7 coord9ate ) ! 
,national ,in/itute ( ,/&>ds &          
,te*nology & ! ,national ,cyb]security &
 ,communications ,integration ,c5t] ( ! 
,dep>tm5t ( ,homel& ,security2 &  7#b7  
may-- 7,a7 inve/igate any cov]$ brea* to
 det]m9e if ! cov]$ consum] report+     
ag5cy t 0 subject to ! cov]$ brea* 0 9  
compliance ) ! requirem5ts describ$ 9   
clauses 7ii7 & 7iii7 ( p>agraph         
7#a77;,b7 z ( ! date on :i* ! cov]$     

brea* occurr$2 &  7,b7 if ! ,director   
has reason to believe t any cov]$       
consum] report+ ag5cy is violat+1 or 9 !
 imm$iate future w violate1 a requirem5t
 describ$ 9 clause 7ii7 or 7iii7 (      
p>agraph 7#a71 br+ a suit 9 an          
appropriate di/rict c\rt ( ! ,unit$     
,/ates to enjo9 any su* act or practice4
  7c7 ,/aff  7#a7 ,9 g5]al ,! ,director 
%all1 )\t reg>d to ! civil s]vice laws &
 regulations1 appo9t su* p]sonnel1      
includ+ comput] security rese>*]s &     
practition]s ) te*nical exp]tise 9      
comput] sci5ce1 eng9e]+1 & cyb]security1
 z ! ,director det]m9es are necess>y to 
c>ry out ! duties ( ! ,(fice4  7#b7     
,details  7,a7 ,9 g5]al ,an employee ( !
 ,national ,in/itute ( ,/&>ds &         
,te*nology1 ! ,bureau ( ,consum]        
,f9ancial ,protection1 or ! ,national   
,cyb]security & ,communications         
,integration ,c5t] ( ! ,dep>tm5t (      
,homel& ,security may be detail$ to !   
,(fice1 )\t reimbursem5t4  7,b7 ,civil  
s]vice /atus & privilege ,detail "u     

subp>agraph 7,a7 %all be )\t int]ruption
 or loss ( ! civil s]vice /atus or      
privilege ( ! employee :o is detail$ to 
! ,(fice4  #d4 ,notification & en=cem5t 
7a7 ,notification  7#a7 ,notification to
 ! ,commission & relevant f$]al law     
en=cem5t & intellig5ce ag5cies  7,a7    
,notification to ! ,commission ,except z
 provid$ 9 p>agraph 7#c71 n lat] ?an #aj
 days aft] ! date on :i* a cov]$ brea*  
occurs1 any cov]$ consum] report+ ag5cy 
t 0 subject to ! cov]$ brea* %all notify
 ! ,commission ( ! cov]$ brea*4  7,b7   
,notification to relevant f$]al law     
en=cem5t & intellig5ce ag5cies ,n lat]  
?an #aj days aft] ! date on :i* !       
,commission receives a notification "u  
subp>agraph 7,a7 t a cov]$ brea* has    
occurr$1 ! ,commission %all-- 7i7 notify
 ! relevant ,f$]al law en=cem5t ag5cies 
& intellig5ce ag5cies t ! cov]$ brea*   
has occurr$2 &  7ii7 ) respect to !     
cov]$ brea*1 consult ) ! relevant ,f$]al
 law en=cem5t ag5cies & intellig5ce     
ag5cies1 z appropriate4  7#b7           

,notification to affect$ consum]s & !   
public  7,a7 ,9 g5]al ,except z provid$ 
9 p>agraph 7#c71 on an exp$iti\s &      
practical timel9e1 z det]m9$ appropriate
 by ! ,commission1 a cov]$ consum]      
report+ ag5cy t is subject to a cov]$   
brea* %all-- 7i7 submit to ea* affect$  
consum] ) respect to :om ! cov]$ consum]
 report+ ag5cy holds a piece ( p]sonally
 id5tify+ in=mation a notification      
reg>d+ ! cov]$ brea* t complies )       
subp>agraph 7,b72 &  7ii7 publi% on !   
int]net website ( ! cov]$ consum]       
report+ ag5cy a notice t conta9s a      
/atem5t (-- 7,i7 ! in=mation describ$ 9 
clauses 7i7 & 7ii7 ( subp>agraph 7,b7 & 
subclauses 7,i7 & 7,,ii7 ( clause 7iii7 
( t subp>agraph2 &  7,,ii7 ! /eps t !   
cov]$ consum] report+ ag5cy is tak+ to  
notify ! affect$ consum]s describ$ 9    
clause 7i7 reg>d+ ! cov]$ brea*4  7,b7  
,notification to affect$ consum]s ,9 a  
notification to affect$ consum]s "u     
subp>agraph 7,a77i71 ! cov]$ consum]    
report+ ag5cy submitt+ ! notification   

%all include a /atem5t (-- 7i7 ! fact t 
! cov]$ brea* occurr$2  7ii7 !          
approximate date on :i* ! cov]$ brea*   
occurr$2 &  7iii7 ) respect to ! cov]$  
brea*-- 7,i7 ! numb] ( affect$ consum]s2
  7,,ii7 ! measures t ! cov]$ consum]   
report+ ag5cy is tak+ to rem$y ! cov]$  
brea*2 &  7,,iii7 ! pot5tial risks      
creat$ by ! cov]$ brea*1 a li/ ( :i* !  
cov]$ consum] report+ ag5cy %all develop
 9 consultation ) ! ,(fice4  7#c7 ,delay
 ( notification au?oriz$ = law en=cem5t 
or national security purposes  7,a7     
,notification by law en=cem5t ag5cy or  
intellig5ce ag5cy ,if a ,f$]al law      
en=cem5t ag5cy or intellig5ce ag5cy to  
:i* ! ,commission has provid$ notice "u 
p>agraph 7#a77;,b77i7 det]m9es t !      
notification requir$ "u p>agraph 7#b7   
may imp$e a crim9al inve/igation or     
national security activity-- 7i7 !      
,f$]al law en=cem5t ag5cy or intellig5ce
 ag5cy %all provide writt5 notice to !  
,commission & ! cov]$ consum] report+   
ag5cy t 0 subject to ! cov]$ brea* t is 

! subject ( ! notification t /ates--    
7,i7 t ! notification requir$ "u        
p>agraph 7#b7 %all be delay$ = law      
en=cem5t or national security purposes2 
&  7,,ii7 ! date on :i* ! delay impos$  
"u subclause 7,i7 %all end2 &  7ii7     
subject to subp>agraph 7,b71 ! cov]$    
consum] report+ ag5cy t 0 subject to !  
cov]$ brea* %all delay notification "u  
p>agraph 7#b7 until ! date describ$ 9   
clause 7i77,,ii7 ( ?is subp>agraph4     
7,b7 ,ext5d$ delay ( notification ,if ! 
notification requir$ "u p>agraph 7#b7 is
 delay$ "u subp>agraph 7,a7 ( ?is       
p>agraph1 a cov]$ consum] report+ ag5cy 
t is requir$ to provide notice "u       
p>agraph 7#b7 %all provide t notice on  
an exp$iti\s & practical timel9e1 z     
det]m9$ appropriate by ! ,commission1   
aft] ! date on :i* ! law en=cem5t or    
national security delay "u subp>agraph  
7,a7 ( ?is p>agraph ends1 unless a      
,f$]al law en=cem5t or intellig5ce ag5cy
 to :i* ! ,commission has provid$ notice
 "u p>agraph 7#a77;,b77i7 provides      

writt5 notification to ! ,commission & !
 cov]$ consum] report+ ag5cy t /ates--  
7i7 t fur!r delay is necess>y2 &  7ii7 !
 date on :i* ! fur!r delay %all end4    
7,c7 ,law en=cem5t immunity ,no         
noncon/itutional cause ( action %all lie
 9 any c\rt aga9/ any ag5cy = acts      
relat+ to ! delay ( notification "u     
subp>agraph 7,a71 or ! ext5d$ delay (   
notification "u subp>agraph 7,b71 = law 
en=cem5t or national security purposes4 
7b7 ,p5alty  7#a7 ,9 g5]al ,9 ! ev5t ( a
 cov]$ brea*1 ! ,commission %all1 n lat]
 ?an #cj days aft] ! date on :i* !      
,commission receives notification ( !   
cov]$ brea* "u subsection 7a77#a77;,a71 
comm5ce a civil action to recov] a civil
 p5alty 9 an appropriate di/rict c\rt ( 
! ,unit$ ,/ates aga9/ ! cov]$ consum]   
report+ ag5cy t 0 subject to ! cov]$    
brea*4  7#b7 ,det]m9+ p5alty am\nt  7,a7
 ,9 g5]al ,except z provid$ 9           
subp>agraph 7,b71 9 det]m9+ ! am\nt ( a 
civil p5alty "u p>agraph 7#a71 ! c\rt   
%all impose a civil p5alty on a cov]$   

consum] report+ ag5cy (-- 7i7 #ajj = ea*
 consum] = :om ! fir/ & la/ "n1 or !    
fir/ initial ( ! fir/ "n & la/ "n1 & #a 
o!r item ( p]sonally id5tify+ in=mation 
7 expos$ to an unau?oriz$ p>ty2 &  7ii7 
9 addition to ! p5alty impos$ "u clause 
7i71 an additional #ej = ea* item (     
p]sonally id5tify+ in=mation ( !        
consum]1 o!r ?an an item describ$ 9 t   
clause1 t 0 expos$ to an unau?oriz$     
p>ty4  7,b7 ,exception  7i7 ,9 g5]al    
,except z provid$ 9 clause 7ii71 9 an   
action comm5c$ "u ?is subsection1 a c\rt
 may n impose a civil p5alty 9 an am\nt 
t is m ?an #ej p]c5t ( ! gross rev5ue ( 
! cov]$ consum] report+ ag5cy aga9/ :i* 
! action is br\ght = ! fiscal ye> be=e !
 fiscal ye> 9 :i* ! cov]$ consum]       
report+ ag5cy became aw>e ( ! cov]$     
brea* t is ! subject ( ! action4  7ii7  
,p5alty d\bl$ ,9 an action comm5c$ "u   
?is subsection1 ! c\rt %all impose a    
civil p5alty on a cov]$ consum] report+ 
ag5cy 9 an am\nt t is #b times ! am\nt (
 ! p5alty describ$ 9 subp>agraph 7,a71 b

 n great] ?an #ge p]c5t ( ! gross rev5ue
 ( ! cov]$ consum] report+ ag5cy = !    
fiscal ye> be=e ! fiscal ye> 9 :i* !    
cov]$ consum] report+ ag5cy became aw>e 
( ! cov]$ brea* t is subject to !       
action1 if-- 7,i7 ! cov]$ consum]       
report+ ag5cy fails to notify !         
,commission ( ! cov]$ brea* be=e !      
deadl9e e/abli%$ "u subsection          
7a77#a77;,a72 or  7,,ii7 ! cov]$ consum]
 report+ ag5cy violates any requirem5t  
describ$ 9 clause 7ii7 or 7iii7 (       
section #c7;b77#a77;,b74  7#c7 ,proce$s 
( ! p5alties ,( ! p5alties impos$ "u ?is
 subsection-- 7,a7 #ej p]c5t %all be us$
 = cyb]security rese>* & inspections by 
! ,(fice2 &  7,b7 #ej p]c5t %all be us$ 
by ! ,(fice to be divid$ fairly among   
consum]s affect$ by ! cov]$ brea*4  7#d7
 ,no preemption ,no?+ 9 ?is subsection  
%all preclude an action by a consum] "u 
,/ate or o!r ,f$]al law4  7c7           
,injunctive relief ,! ,commission1 act+ 
?r\gh ! ,(fice1 may br+ suit 9 an       
appropriate di/rict c\rt ( ! ,unit$     

,/ates or 9 ! ,unit$ ,/ates c\rt ( any  
t]ritory to require a cov]$ consum]     
report+ ag5cy to implem5t or correct a  
p>ticul> security measure 9 ord] to     
promote effective security 9 accordance 
) ! requirem5ts describ$ 9 clauses 7ii7 
& 7iii7 ( section #c7;b77#a77;,b74  #e4 
,am5dm5ts to ! ,gramm-,lea*-,bliley ,act
  7a7 ,en=cem5t relat+ to disclosure (  
nonpublic p]sonal in=mation ,section    
#eje7;a77#g7 ( ! ,gramm-,lea*-,bliley   
,act 7#ae ,u4,s4,c4 #fhje7;a77#g77 is   
am5d$ by ins]t+ 1 includ+ any consum]   
report+ ag5cy t compiles & ma9ta9s files
 on consum]s on a nationwide basis 7z   
def9$ 9 section #fjc7p7 ( ! ,fair ,cr$it
 ,report+ ,act 7#ae ,u4,s4,c4           
#afha;a7p777 be=e ! p]iod at ! end4  7b7
 ,def9itions relat+ to disclosure (     
nonpublic p]sonal in=mation ,section    
#eji7c7 ( ! ,gramm-,lea*-,bliley ,act   
7#ae ,u4,s4,c4 #fhji7c77 is am5d$ by    
add+ at ! end ! foll[+3  7,e7 ,consum]  
report+ ag5cies specifically includ$ ,! 
t]m f9ancial in/itution includes any    

consum] report+ ag5cy t compiles &      
ma9ta9s files on consum]s on a          
nationwide basis 7z def9$ 9 section     
#fjc7p7 ( ! ,fair ,cr$it ,report+ ,act  
7#ae ,u4,s4,c4 #afha;a7p7774  4  #f4    
,au?orization ( appropriations ,!re are 
au?oriz$ to be appropriat$ #ajj1jjj1jjj 
to c>ry out ?is ,act1 to rema9 available
 until exp5d$4