US Codex
Bill
Notes

Title II — Privacy and security of personally identifiable information

S. 1897 · 113th Congress · Jan 8, 2014 · Lineage

II Privacy and security of personally identifiable information

A A Data Privacy and Security Program

Sec. 201 Purpose and applicability of data privacy and security program

(a)
Purpose— The purpose of this subtitle is to ensure standards for developing and implementing administrative, technical, and physical safeguards to protect the security of sensitive personally identifiable information.
(b)
Applicability— A business entity engaging in interstate commerce that involves collecting, accessing, transmitting, using, storing, or disposing of sensitive personally identifiable information in electronic or digital form on 10,000 or more United States persons is subject to the requirements for a data privacy and security program under section 202 for protecting sensitive personally identifiable information.
(c)
Limitations— Notwithstanding any other obligation under this subtitle, this subtitle does not apply to the following:
(1)
Financial institutions— Financial institutions—
(A)
subject to the data security requirements and standards under section 501(b) of the Gramm-Leach-Bliley Act (15 U.S.C. 6801(b)); and
(B)
subject to the jurisdiction of an agency or authority described in section 505(a) of the Gramm-Leach-Bliley Act (15 U.S.C. 6805(a)).
(2)
HIPAA regulated entities—
(A)
Covered entities— Covered entities subject to the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1301 et seq.), including the data security requirements and implementing regulations of that Act.
(B)
Business entities— A business entity shall be deemed in compliance with this Act if the business entity—
(i)
is acting as a business associate, as that term is defined under the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1301 et seq.) and is in compliance with the requirements imposed under that Act and implementing regulations promulgated under that Act; and
(ii)
is subject to, and currently in compliance, with the privacy and data security requirements under sections 13401 and 13404 of division A of the American Reinvestment and Recovery Act of 2009 (42 U.S.C. 17931 and 17934) and implementing regulations promulgated under such sections.
(3)
Service providers— A service provider for any electronic communication by a third party, to the extent that the service provider is exclusively engaged in the transmission, routing, or temporary, intermediate, or transient storage of that communication.
(4)
Public records— Public records not otherwise subject to a confidentiality or nondisclosure requirement, or information obtained from a public record, including information obtained from a news report or periodical.
(d)
Safe Harbors—
(1)
In general— A business entity shall be deemed in compliance with the privacy and security program requirements under section 202 if the business entity complies with or provides protection equal to industry standards or standards widely accepted as an effective industry practice, as identified by the Federal Trade Commission, that are applicable to the type of sensitive personally identifiable information involved in the ordinary course of business of such business entity.
(2)
Limitation— Nothing in this subsection shall be construed to permit, and nothing does permit, the Federal Trade Commission to issue regulations requiring, or according greater legal status to, the implementation of or application of a specific technology or technological specifications for meeting the requirements of this title.

Sec. 202 Requirements for a personal data privacy and security program

(a)
Personal Data Privacy and Security Program— A business entity subject to this subtitle shall comply with the following safeguards and any other administrative, technical, or physical safeguards identified by the Federal Trade Commission in a rulemaking process pursuant to section 553 of title 5, United States Code, for the protection of sensitive personally identifiable information:
(1)
Scope— A business entity shall implement a comprehensive personal data privacy and security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity of the business entity and the nature and scope of its activities.
(2)
Design— The personal data privacy and security program shall be designed to—
(A)
ensure the privacy, security, and confidentiality of sensitive personally identifying information;
(B)
protect against any anticipated vulnerabilities to the privacy, security, or integrity of sensitive personally identifying information; and
(C)
protect against unauthorized access to use of sensitive personally identifying information that could create a significant risk of harm or fraud to any individual.
(3)
Risk assessment— A business entity shall—
(A)
identify reasonably foreseeable internal and external vulnerabilities that could result in unauthorized access, disclosure, use, or alteration of sensitive personally identifiable information or systems containing sensitive personally identifiable information;
(B)
assess the likelihood of and potential damage from unauthorized access, disclosure, use, or alteration of sensitive personally identifiable information;
(C)
assess the sufficiency of its policies, technologies, and safeguards in place to control and minimize risks from unauthorized access, disclosure, use, or alteration of sensitive personally identifiable information; and
(D)
assess the vulnerability of sensitive personally identifiable information during destruction and disposal of such information, including through the disposal or retirement of hardware.
(4)
Risk management and control— Each business entity shall—
(A)
design its personal data privacy and security program to control the risks identified under paragraph (3);
(B)
adopt measures commensurate with the sensitivity of the data as well as the size, complexity, and scope of the activities of the business entity that—
(i)
control access to systems and facilities containing sensitive personally identifiable information, including controls to authenticate and permit access only to authorized individuals;
(ii)
detect, record, and preserve information relevant to actual and attempted fraudulent, unlawful, or unauthorized access, disclosure, use, or alteration of sensitive personally identifiable information, including by employees and other individuals otherwise authorized to have access;
(iii)
protect sensitive personally identifiable information during use, transmission, storage, and disposal by encryption, redaction, or access controls that are widely accepted as an effective industry practice or industry standard, or other reasonable means (including as directed for disposal of records under section 628 of the Fair Credit Reporting Act (15 U.S.C. 1681w) and the implementing regulations of such Act as set forth in section 682 of title 16, Code of Federal Regulations);
(iv)
ensure that sensitive personally identifiable information is properly destroyed and disposed of, including during the destruction of computers, diskettes, and other electronic media that contain sensitive personally identifiable information;
(v)
trace access to records containing sensitive personally identifiable information so that the business entity can determine who accessed or acquired such sensitive personally identifiable information pertaining to specific individuals; and
(vi)
ensure that no third party or customer of the business entity is authorized to access or acquire sensitive personally identifiable information without the business entity first performing sufficient due diligence to ascertain, with reasonable certainty, that such information is being sought for a valid legal purpose; and
(C)
establish a plan and procedures for minimizing the amount of sensitive personally identifiable information maintained by such business entity, which shall provide for the retention of sensitive personally identifiable information only as reasonably needed for the business purposes of such business entity or as necessary to comply with any legal obligation.
(b)
Training— Each business entity subject to this subtitle shall take steps to ensure employee training and supervision for implementation of the data security program of the business entity.
(c)
Vulnerability testing—
(1)
In general— Each business entity subject to this subtitle shall take steps to ensure regular testing of key controls, systems, and procedures of the personal data privacy and security program to detect, prevent, and respond to attacks or intrusions, or other system failures.
(2)
Frequency— The frequency and nature of the tests required under paragraph (1) shall be determined by the risk assessment of the business entity under subsection (a)(3).
(d)
Relationship to certain providers of services— In the event a business entity subject to this subtitle engages a person or entity not subject to this subtitle (other than a service provider) to receive sensitive personally identifiable information in performing services or functions (other than the services or functions provided by a service provider) on behalf of and under the instruction of such business entity, such business entity shall—
(1)
exercise appropriate due diligence in selecting the person or entity for responsibilities related to sensitive personally identifiable information, and take reasonable steps to select and retain a person or entity that is capable of maintaining appropriate safeguards for the security, privacy, and integrity of the sensitive personally identifiable information at issue; and
(2)
require the person or entity by contract to implement and maintain appropriate measures designed to meet the objectives and requirements governing entities subject to section 201, this section, and subtitle B.
(e)
Periodic Assessment and Personal Data Privacy and Security Modernization— Each business entity subject to this subtitle shall on a regular basis monitor, evaluate, and adjust, as appropriate its data privacy and security program in light of any relevant changes in—
(1)
technology;
(2)
the sensitivity of personally identifiable information;
(3)
internal or external threats to personally identifiable information; and
(4)
the changing business arrangements of the business entity, such as—
(A)
mergers and acquisitions;
(B)
alliances and joint ventures;
(C)
outsourcing arrangements;
(D)
bankruptcy; and
(E)
changes to sensitive personally identifiable information systems.
(f)
Implementation Timeline— Not later than 1 year after the date of enactment of this Act, a business entity subject to the provisions of this subtitle shall implement a data privacy and security program pursuant to this subtitle.

Sec. 203 Enforcement

(a)
Civil Penalties—
(1)
In general— Any business entity that violates the provisions of section 201 or 202 shall be subject to civil penalties of not more than $5,000 per violation per day while such a violation exists, with a maximum of $500,000 per violation.
(2)
Intentional or willful violation— A business entity that intentionally or willfully violates the provisions of section 201 or 202 shall be subject to additional penalties in the amount of $5,000 per violation per day while such a violation exists, with a maximum of an additional $500,000 per violation.
(3)
Penalty limits—
(A)
In general— Notwithstanding any other provision of law, the total sum of civil penalties assessed against a business entity for all violations of the provisions of this subtitle resulting from the same or related acts or omissions shall not exceed $500,000, unless such conduct is found to be willful or intentional.
(B)
Determinations— The determination of whether a violation of a provision of this subtitle has occurred, and if so, the amount of the penalty to be imposed, if any, shall be made by the court sitting as the finder of fact. The determination of whether a violation of a provision of this subtitle was willful or intentional, and if so, the amount of the additional penalty to be imposed, if any, shall be made by the court sitting as the finder of fact.
(C)
Additional penalty limit— If a court determines under subparagraph (B) that a violation of a provision of this subtitle was willful or intentional and imposes an additional penalty, the court may not impose an additional penalty in an amount that exceeds $500,000.
(4)
Equitable relief— A business entity engaged in interstate commerce that violates this section may be enjoined from further violations by a United States district court.
(5)
Other rights and remedies— The rights and remedies available under this section are cumulative and shall not affect any other rights and remedies available under law.
(b)
Federal Trade Commission Authority— Any business entity shall have the provisions of this subtitle enforced against it by the Federal Trade Commission.
(c)
State Enforcement—
(1)
Civil actions— In any case in which the attorney general of a State or any State or local law enforcement agency authorized by the State attorney general or by State statute to prosecute violations of consumer protection law, has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by the acts or practices of a business entity that violate this subtitle, the State may bring a civil action on behalf of the residents of that State in a district court of the United States of appropriate jurisdiction to—
(A)
enjoin that act or practice;
(B)
enforce compliance with this subtitle; or
(C)
obtain civil penalties of not more than $5,000 per violation per day while such violations persist, up to a maximum of $500,000 per violation.
(2)
Penalty limits—
(A)
In general— Notwithstanding any other provision of law, the total sum of civil penalties assessed against a business entity for all violations of the provisions of this subtitle resulting from the same or related acts or omissions shall not exceed $500,000, unless such conduct is found to be willful or intentional.
(B)
Determinations— The determination of whether a violation of a provision of this subtitle has occurred, and if so, the amount of the penalty to be imposed, if any, shall be made by the court sitting as the finder of fact. The determination of whether a violation of a provision of this subtitle was willful or intentional, and if so, the amount of the additional penalty to be imposed, if any, shall be made by the court sitting as the finder of fact.
(C)
Additional penalty limit— If a court determines under subparagraph (B) that a violation of a provision of this subtitle was willful or intentional and imposes an additional penalty, the court may not impose an additional penalty in an amount that exceeds $500,000.
(3)
Notice—
(A)
In general— Before filing an action under this subsection, the attorney general of the State involved shall provide to the Federal Trade Commission—
(i)
a written notice of that action; and
(ii)
a copy of the complaint for that action.
(B)
Exception— Subparagraph (A) shall not apply with respect to the filing of an action by an attorney general of a State under this subsection, if the attorney general of a State determines that it is not feasible to provide the notice described in this subparagraph before the filing of the action.
(C)
Notification when practicable— In an action described under subparagraph (B), the attorney general of a State shall provide the written notice and the copy of the complaint to the Federal Trade Commission as soon after the filing of the complaint as practicable.
(4)
Federal trade commission authority— Upon receiving notice under paragraph (2), the Federal Trade Commission shall have the right to—
(A)
move to stay the action, pending the final disposition of a pending Federal proceeding or action as described in paragraph (4);
(B)
intervene in an action brought under paragraph (1); and
(C)
file petitions for appeal.
(5)
Pending proceedings— If the Federal Trade Commission initiates a Federal civil action for a violation of this subtitle, or any regulations thereunder, no attorney general of a State may bring an action for a violation of this subtitle that resulted from the same or related acts or omissions against a defendant named in the Federal civil action initiated by the Federal Trade Commission.
(6)
Rule of construction— For purposes of bringing any civil action under paragraph (1) nothing in this subtitle shall be construed to prevent an attorney general of a State from exercising the powers conferred on the attorney general by the laws of that State to—
(A)
conduct investigations;
(B)
administer oaths and affirmations; or
(C)
compel the attendance of witnesses or the production of documentary and other evidence.
(7)
Venue; service of process—
(A)
Venue— Any action brought under this subsection may be brought in the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code.
(B)
Service of process— In an action brought under this subsection, process may be served in any district in which the defendant—
(i)
is an inhabitant; or
(ii)
may be found.
(d)
No Private Cause of Action— Nothing in this subtitle establishes a private cause of action against a business entity for violation of any provision of this subtitle.

Sec. 204 Relation to other laws

(a)
In General— No State may require any business entity subject to this subtitle to comply with any requirements with respect to administrative, technical, and physical safeguards for the protection of personal information.
(b)
Limitations— Nothing in this subtitle shall be construed to modify, limit, or supersede the operation of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.) or its implementing regulations, including those adopted or enforced by States.

B Security Breach Notification

Sec. 211 Notice to individuals

(a)
In General— Except as provided in section 212, any agency, or business entity engaged in interstate commerce, other than a service provider, that uses, accesses, transmits, stores, disposes of or collects sensitive personally identifiable information shall, following the discovery of a security breach of such information, notify any resident of the United States whose sensitive personally identifiable information has been, or is reasonably believed to have been, accessed, or acquired.
(b)
Obligation of Owner or Licensee—
(1)
Notice to owner or licensee— Any agency, or business entity engaged in interstate commerce, that uses, accesses, transmits, stores, disposes of, or collects sensitive personally identifiable information that the agency or business entity does not own or license shall notify the owner or licensee of the information following the discovery of a security breach involving such information.
(2)
Notice by owner, licensee, or other designated third party— Nothing in this subtitle shall prevent or abrogate an agreement between an agency or business entity required to give notice under this section and a designated third party, including an owner or licensee of the sensitive personally identifiable information subject to the security breach, to provide the notifications required under subsection (a).
(3)
Business entity relieved from giving notice— A business entity obligated to give notice under subsection (a) shall be relieved of such obligation if an owner or licensee of the sensitive personally identifiable information subject to the security breach, or other designated third party, provides such notification.
(4)
Service providers— If a service provider becomes aware of a security breach of data in electronic form containing sensitive personal information that is owned or possessed by another business entity that connects to or uses a system or network provided by the service provider for the purpose of transmitting, routing, or providing intermediate or transient storage of such data, the service provider shall be required to notify the business entity who initiated such connection, transmission, routing, or storage of the security breach if the business entity can be reasonably identified. Upon receiving such notification from a service provider, the business entity shall be required to provide the notification required under subsection (a).
(c)
Timeliness of Notification—
(1)
In general— All notifications required under this section shall be made without unreasonable delay following the discovery by the agency or business entity of a security breach.
(2)
Reasonable delay—
(A)
In general— Reasonable delay under this subsection may include any time necessary to determine the scope of the security breach, prevent further disclosures, conduct the risk assessment described in section 202(a)(3), and restore the reasonable integrity of the data system and provide notice to law enforcement when required.
(B)
Extension—
(i)
In general— Except as provided in subsection (d), delay of notification shall not exceed 60 days following the discovery of the security breach, unless the business entity or agency requests an extension of time and the Federal Trade Commission determines in writing that additional time is reasonably necessary to determine the scope of the security breach, prevent further disclosures, conduct the risk assessment, restore the reasonable integrity of the data system, or to provide notice to the designated entity.
(ii)
Approval of request— If the Federal Trade Commission approves the request for delay, the agency or business entity may delay the time period for notification for additional periods of up to 30 days.
(3)
Burden of production— The agency, business entity, owner, or licensee required to provide notice under this subtitle shall, upon the request of the Attorney General or the Federal Trade Commission provide records or other evidence of the notifications required under this subtitle, including to the extent applicable, the reasons for any delay of notification.
(d)
Delay of notification authorized for law enforcement or national security purposes—
(1)
In general— If the United States Secret Service or the Federal Bureau of Investigation determines that the notification required under this section would impede a criminal investigation, or national security activity, such notification shall be delayed upon written notice from the United States Secret Service or the Federal Bureau of Investigation to the agency or business entity that experienced the breach. The notification from the United States Secret Service or the Federal Bureau of Investigation shall specify in writing the period of delay requested for law enforcement or national security purposes.
(2)
Extended delay of notification— If the notification required under subsection (a) is delayed pursuant to paragraph (1), an agency or business entity shall give notice 30 days after the day such law enforcement or national security delay was invoked unless a Federal law enforcement or intelligence agency provides written notification that further delay is necessary.
(3)
Law enforcement immunity— No non-constitutional cause of action shall lie in any court against any agency for acts relating to the delay of notification for law enforcement or national security purposes under this subtitle.
(e)
Limitations— Notwithstanding any other obligation under this subtitle, this subtitle does not apply to the following:
(1)
Financial institutions— Financial institutions—
(A)
subject to the data security requirements and standards under section 501(b) of the Gramm-Leach-Bliley Act (15 U.S.C. 6801(b)); and
(B)
subject to the jurisdiction of an agency or authority described in section 505(a) of the Gramm-Leach-Bliley Act (15 U.S.C. 6805(a)).
(2)
HIPAA regulated entities—
(A)
Covered entities— Covered entities subject to the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1301 et seq.), including the data security requirements and implementing regulations of that Act.
(B)
Business entities— A business entity shall be deemed in compliance with this Act if the business entity—
(i)
(I)
is acting as a covered entity and as a business associate, as those terms are defined under the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1301 et seq.) and is in compliance with the requirements imposed under that Act and implementing regulations promulgated under that Act; and
(II)
is subject to, and currently in compliance, with the data breach notification, privacy and data security requirements under the Health Information Technology for Economic and Clinical Health (HITECH) Act, (42 U.S.C. 17932) and implementing regulations promulgated thereunder; or
(ii)
is acting as a vendor of personal health records and third party service provider, subject to the Health Information Technology for Economic and Clinical Health (HITECH) Act (42 U.S.C. 17937), including the data breach notification requirements and implementing regulations of that Act.

Sec. 212 Exemptions

(a)
Exemption for National Security and Law Enforcement—
(1)
In general— Section 211 shall not apply to an agency or business entity if—
(A)
the United States Secret Service or the Federal Bureau of Investigation determines that notification of the security breach could be expected to reveal sensitive sources and methods or similarly impede the ability of the Government to conduct law enforcement investigations; or
(B)
the Federal Bureau of Investigation determines that notification of the security breach could be expected to cause damage to the national security.
(2)
Immunity— No non-constitutional cause of action shall lie in any court against any Federal agency for acts relating to the exemption from notification for law enforcement or national security purposes under this title.
(b)
Safe Harbor—
(1)
In general— An agency or business entity shall be exempt from the notice requirements under section 211, if—
(A)
a risk assessment conducted by the agency or business entity concludes that, based upon the information available, there is no significant risk that a security breach has resulted in, or will result in, identity theft, economic loss or harm, or physical harm to the individuals whose sensitive personally identifiable information was subject to the security breach;
(B)
without unreasonable delay, but not later than 45 days after the discovery of a security breach, unless extended by the Federal Trade Commission, the agency or business entity notifies the Federal Trade Commission, in writing, of—
(i)
the results of the risk assessment; and
(ii)
its decision to invoke the risk assessment exemption; and
(C)
the Federal Trade Commission does not indicate, in writing, within 10 business days from receipt of the decision, that notice should be given.
(2)
Rebuttable presumptions— For purposes of paragraph (1)—
(A)
the encryption of sensitive personally identifiable information described in paragraph (1)(A)(i) shall establish a rebuttable presumption that no significant risk exists; and
(B)
the rendering of sensitive personally identifiable information described in paragraph (1)(A)(ii) unusable, unreadable, or indecipherable through data security technology or methodology that is generally accepted by experts in the field of information security, such as redaction or access controls shall establish a rebuttable presumption that no significant risk exists.
(3)
Violation— It shall be a violation of this section to—
(A)
fail to conduct the risk assessment in a reasonable manner, or according to standards generally accepted by experts in the field of information security; or
(B)
submit the results of a risk assessment that contains fraudulent or deliberately misleading information.
(c)
Financial fraud prevention exemption—
(1)
In general— A business entity will be exempt from the notice requirement under section 211 if the business entity utilizes or participates in a security program that—
(A)
effectively blocks the use of the sensitive personally identifiable information to initiate unauthorized financial transactions before they are charged to the account of the individual; and
(B)
provides for notice to affected individuals after a security breach that has resulted in fraud or unauthorized transactions.
(2)
Limitation— The exemption in paragraph (1) does not apply if the information subject to the security breach includes an individual's first and last name, or any other type of sensitive personally identifiable information as defined in section 3, unless that information is only a credit card number or credit card security code.

Sec. 213 Methods of notice

An agency or business entity shall be in compliance with section 211 if it provides the following:
(1)
Individual notice— Notice to individuals by one of the following means:
(A)
Written notification to the last known home mailing address of the individual in the records of the agency or business entity.
(B)
Telephone notice to the individual personally.
(C)
E-mail notice, if the individual has consented to receive such notice and the notice is consistent with the provisions permitting electronic transmission of notices under section 101 of the Electronic Signatures in Global and National Commerce Act (15 U.S.C. 7001).
(2)
Media notice— Notice to major media outlets serving a State or jurisdiction, if the number of residents of such State whose sensitive personally identifiable information was, or is reasonably believed to have been, accessed or acquired by an unauthorized person exceeds 5,000.

Sec. 214 Content of notification

(a)
In General— Regardless of the method by which notice is provided to individuals under section 213, such notice shall include, to the extent possible—
(1)
a description of the categories of sensitive personally identifiable information that was, or is reasonably believed to have been, accessed or acquired by an unauthorized person;
(2)
a toll-free number—
(A)
that the individual may use to contact the agency or business entity, or the agent of the agency or business entity; and
(B)
from which the individual may learn what types of sensitive personally identifiable information the agency or business entity maintained about that individual; and
(3)
the toll-free contact telephone numbers and addresses for the major credit reporting agencies.
(b)
Additional content— Notwithstanding section 219, a State may require that a notice under subsection (a) shall also include information regarding victim protection assistance provided for by that State.
(c)
Direct Business Relationship— Regardless of whether a business entity, agency, or a designated third party provides the notice required pursuant to section 211(b), such notice shall include the name of the business entity or agency that has a direct relationship with the individual being notified.

Sec. 215 Coordination of notification with credit reporting agencies

If an agency or business entity is required to provide notification to more than 5,000 individuals under section 211(a), the agency or business entity shall also notify all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis (as defined in section 603(p) of the Fair Credit Reporting Act (15 U.S.C. 1681a(p))) of the timing and distribution of the notices. Such notice shall be given to the consumer credit reporting agencies without unreasonable delay and, if it will not delay notice to the affected individuals, prior to the distribution of notices to the affected individuals.

Sec. 216 Notice to law enforcement

(a)
Designation of government entity To receive notice—
(1)
In general— Not later than 60 days after the date of enactment of this Act, the Secretary of Homeland Security shall designate a Federal Government entity to receive the notices required under section 212 and this section, and any other reports and information about information security incidents, threats, and vulnerabilities.
(2)
Responsibilities of the designated entity— The designated entity shall—
(A)
be responsible for promptly providing the information that it receives to the United States Secret Service and the Federal Bureau of Investigation, and to the Federal Trade Commission for civil law enforcement purposes; and
(B)
provide the information described in subparagraph (A) as appropriate to other Federal agencies for law enforcement, national security, or data security purposes.
(b)
Notice— Any business entity or agency shall notify the designated entity of the fact that a security breach has occurred if—
(1)
the number of individuals whose sensitive personally identifying information was, or is reasonably believed to have been accessed or acquired by an unauthorized person exceeds 5,000;
(2)
the security breach involves a database, networked or integrated databases, or other data system containing the sensitive personally identifiable information of more than 500,000 individuals nationwide;
(3)
the security breach involves databases owned by the Federal Government; or
(4)
the security breach involves primarily sensitive personally identifiable information of individuals known to the agency or business entity to be employees and contractors of the Federal Government involved in national security or law enforcement.
(c)
FTC rulemaking and review of thresholds—
(1)
Reports— Not later than 1 year after the date of the enactment of this Act, the Federal Trade Commission, in consultation with the Attorney General of the United States and the Secretary of Homeland Security, shall promulgate regulations under section 553 of title 5, United States Code, regarding the reports required under subsection (a).
(2)
Thresholds for notice— The Federal Trade Commission, in consultation with the Attorney General and the Secretary of Homeland Security, after notice and the opportunity for public comment, and in a manner consistent with this section, shall promulgate regulations, as necessary, under section 553 of title 5, United States Code, to adjust the thresholds for notice to law enforcement and national security authorities under subsection (a) and to facilitate the purposes of this section.
(d)
Timing— The notice required under subsection (a) shall be provided as promptly as possible, but such notice must be provided either 72 hours before notice is provided to an individual pursuant to section 211, or not later than 10 days after the business entity or agency discovers the security breach or discovers that the nature of the security breach requires notice to law enforcement under this section, whichever occurs first.

Sec. 217 Enforcement

(a)
In general— The Attorney General and the Federal Trade Commission may enforce civil violations of section 211.
(b)
Civil actions by the Attorney General of the United States—
(1)
In general— The Attorney General may bring a civil action in the appropriate United States district court against any business entity that engages in conduct constituting a violation of this subtitle and, upon proof of such conduct by a preponderance of the evidence, such business entity shall be subject to a civil penalty of not more than $11,000 per day per security breach.
(2)
Penalty limitation— Notwithstanding any other provision of law, the total amount of the civil penalty assessed against a business entity for conduct involving the same or related acts or omissions that results in a violation of this subtitle may not exceed $1,000,000.
(3)
Determinations— The determination of whether a violation of a provision of this subtitle has occurred, and if so, the amount of the penalty to be imposed, if any, shall be made by the court sitting as the finder of fact. The determination of whether a violation of a provision of this subtitle was willful or intentional, and if so, the amount of the additional penalty to be imposed, if any, shall be made by the court sitting as the finder of fact.
(4)
Additional penalty limit— If a court determines under paragraph (3) that a violation of a provision of this subtitle was willful or intentional and imposes an additional penalty, the court may not impose an additional penalty in an amount that exceeds $1,000,000.
(c)
Injunctive actions by the Attorney General—
(1)
In general— If it appears that a business entity has engaged, or is engaged, in any act or practice constituting a violation of this subtitle, the Attorney General may petition an appropriate district court of the United States for an order—
(A)
enjoining such act or practice; or
(B)
enforcing compliance with this subtitle.
(2)
Issuance of order— A court may issue an order under paragraph (1), if the court finds that the conduct in question constitutes a violation of this subtitle.
(d)
Civil actions by the Federal Trade Commission—
(1)
In general— Compliance with the requirements imposed under this subtitle may be enforced under the Federal Trade Commission Act (15 U.S.C. 41 et seq.) by the Federal Trade Commission with respect to business entities subject to this Act. All of the functions and powers of the Federal Trade Commission under the Federal Trade Commission Act are available to the Commission to enforce compliance by any person with the requirements imposed under this title.
(2)
Penalty limitation—
(A)
In general— Notwithstanding any other provision of law, the total sum of civil penalties assessed against a business entity for all violations of the provisions of this subtitle resulting from the same or related acts or omissions may not exceed $1,000,000, unless such conduct is found to be willful or intentional.
(B)
Determinations— The determination of whether a violation of a provision of this subtitle has occurred, and if so, the amount of the penalty to be imposed, if any, shall be made by the court sitting as the finder of fact. The determination of whether a violation of a provision of this subtitle was willful or intentional, and if so, the amount of the additional penalty to be imposed, if any, shall be made by the court sitting as the finder of fact.
(C)
Additional penalty limit— If a court determines under subparagraph (B) that a violation of a provision of this subtitle was willful or intentional and imposes an additional penalty, the court may not impose an additional penalty in an amount that exceeds $1,000,000.
(3)
Unfair or deceptive acts or practices— For the purpose of the exercise by the Federal Trade Commission of its functions and powers under the Federal Trade Commission Act, a violation of any requirement or prohibition imposed under this title shall constitute an unfair or deceptive act or practice in commerce in violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(I)(B)) regarding unfair or deceptive acts or practices and shall be subject to enforcement by the Federal Trade Commission under that Act with respect to any business entity, irrespective of whether that business entity is engaged in commerce or meets any other jurisdictional tests in the Federal Trade Commission Act.
(e)
Coordination of enforcement—
(1)
In general— Before opening an investigation, the Federal Trade Commission shall consult with the Attorney General.
(2)
Limitation— The Federal Trade Commission may initiate investigations under this subsection unless the Attorney General determines that such an investigation would impede an ongoing criminal investigation or national security activity.
(3)
Coordination agreement—
(A)
In general— In order to avoid conflicts and promote consistency regarding the enforcement and litigation of matters under this Act, not later than 180 days after the enactment of this Act, the Attorney General and the Federal Trade Commission shall enter into an agreement for coordination regarding the enforcement of this Act.
(B)
Requirement— The coordination agreement entered into under subparagraph (A) shall include provisions to ensure that parallel investigations and proceedings under this section are conducted in a matter that avoids conflicts and does not impede the ability of the Attorney General to prosecute violations of Federal criminal laws.
(4)
Coordination with the FCC— If an enforcement action under this Act relates to customer proprietary network information, the Federal Trade Commission shall coordinate the enforcement action with the Federal Communications Commission.
(f)
Rulemaking— The Federal Trade Commission may, in consultation with the Attorney General, issue such other regulations as it determines to be necessary to carry out this subtitle. All regulations promulgated under this Act shall be issued in accordance with section 553 of title 5, United States Code. Where regulations relate to customer proprietary network information, the promulgation of such regulations will be coordinated with the Federal Communications Commission.
(g)
Other rights and remedies— The rights and remedies available under this subtitle are cumulative and shall not affect any other rights and remedies available under law.
(h)
Fraud alert— Section 605A(b)(1) of the Fair Credit Reporting Act (15 U.S.C. 1681c–1(b)(1)) is amended by inserting “, or evidence that the consumer has received notice that the consumer's financial information has or may have been compromised,” after “identity theft report”.

Sec. 218 Enforcement by State attorneys general

(a)
In general—
(1)
Civil actions— In any case in which the attorney general of a State or any State or local law enforcement agency authorized by the State attorney general or by State statute to prosecute violations of consumer protection law, has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by the engagement of a business entity in a practice that is prohibited under this subtitle, the State or the State or local law enforcement agency on behalf of the residents of the agency's jurisdiction, may bring a civil action on behalf of the residents of the State or jurisdiction in a district court of the United States of appropriate jurisdiction to—
(A)
enjoin that practice;
(B)
enforce compliance with this subtitle; or
(C)
civil penalties of not more than $11,000 per day per security breach up to a maximum of $1,000,000 per violation, unless such conduct is found to be willful or intentional.
(2)
Penalty limitation—
(A)
In general— Notwithstanding any other provision of law, the total sum of civil penalties assessed against a business entity for all violations of the provisions of this subtitle resulting from the same or related acts or omissions may not exceed $1,000,000, unless such conduct is found to be willful or intentional.
(B)
Determinations— The determination of whether a violation of a provision of this subtitle has occurred, and if so, the amount of the penalty to be imposed, if any, shall be made by the court sitting as the finder of fact. The determination of whether a violation of a provision of this subtitle was willful or intentional, and if so, the amount of the additional penalty to be imposed, if any, shall be made by the court sitting as the finder of fact.
(C)
Additional penalty limit— If a court determines under subparagraph (B) that a violation of a provision of this subtitle was willful or intentional and imposes an additional penalty, the court may not impose an additional penalty in an amount that exceeds $1,000,000.
(3)
Notice—
(A)
In general— Before filing an action under paragraph (1), the attorney general of the State involved shall provide to the Attorney General of the United States—
(i)
written notice of the action; and
(ii)
a copy of the complaint for the action.
(B)
Exemption—
(i)
In general— Subparagraph (A) shall not apply with respect to the filing of an action by an attorney general of a State under this subtitle, if the State attorney general determines that it is not feasible to provide the notice described in such subparagraph before the filing of the action.
(ii)
Notification— In an action described in clause (i), the attorney general of a State shall provide notice and a copy of the complaint to the Attorney General at the time the State attorney general files the action.
(b)
Federal proceedings— Upon receiving notice under subsection (a)(2), the Attorney General shall have the right to—
(1)
move to stay the action, pending the final disposition of a pending Federal proceeding or action;
(2)
initiate an action in the appropriate United States district court under section 217 and move to consolidate all pending actions, including State actions, in such court;
(3)
intervene in an action brought under subsection (a)(2); and
(4)
file petitions for appeal.
(c)
Pending proceedings— If the Attorney General or the Federal Trade Commission initiate a criminal proceeding or civil action for a violation of a provision of this subtitle, or any regulations thereunder, no attorney general of a State may bring an action for a violation of a provision of this subtitle against a defendant named in the Federal criminal proceeding or civil action.
(d)
Construction— For purposes of bringing any civil action under subsection (a), nothing in this subtitle regarding notification shall be construed to prevent an attorney general of a State from exercising the powers conferred on such attorney general by the laws of that State to—
(1)
conduct investigations;
(2)
administer oaths or affirmations; or
(3)
compel the attendance of witnesses or the production of documentary and other evidence.
(e)
Venue; service of process—
(1)
Venue— Any action brought under subsection (a) may be brought in—
(A)
the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code; or
(B)
another court of competent jurisdiction.
(2)
Service of process— In an action brought under subsection (a), process may be served in any district in which the defendant—
(A)
is an inhabitant; or
(B)
may be found.
(f)
No private cause of action— Nothing in this subtitle establishes a private cause of action against a business entity for violation of any provision of this subtitle.

Sec. 219 Effect on Federal and State law

For any entity, or agency that is subject to this subtitle, the provisions of this subtitle shall supersede any other provision of Federal law, or any provisions of the law of any State, relating to notification of a security breach, except as provided in section 214(b). Nothing in this subtitle shall be construed to modify, limit, or supersede the operation of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.) or its implementing regulations, including those regulations adopted or enforced by States, the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1301 et seq.) or its implementing regulations, or the Health Information Technology for Economic and Clinical Health Act (42 U.S.C. 17937) or its implementing regulations.

Sec. 220 Reporting on exemptions

(a)
FTC report— Not later than 18 months after the date of enactment of this Act, and upon request by Congress thereafter, the Federal Trade Commission shall submit a report to Congress on the number and nature of the security breaches described in the notices filed by those business entities invoking the risk assessment exemption under section 212(b) and their response to such notices.
(b)
Law enforcement report—
(1)
In general— Not later than 18 months after the date of enactment of this Act, and upon the request by Congress thereafter, the United States Secret Service and Federal Bureau of Investigation shall submit a report to Congress on the number and nature of security breaches subject to the national security and law enforcement exemptions under section 212(a).
(2)
Requirement— The report required under paragraph (1) shall not include the contents of any risk assessment provided to the United States Secret Service and the Federal Bureau of Investigation under this subtitle.

Sec. 221 Effective date

This subtitle shall take effect on the expiration of the date which is 90 days after the date of enactment of this Act.