Section 1 Short title
This Act may be cited as the “Data Breach Prevention and Compensation Act of 2019”.
Data Breach Prevention and Compensation Act of 2019
A BILL
To create an Office of Cybersecurity at the Federal Trade Commission for supervision of data security at consumer reporting agencies, to require the promulgation of regulations establishing standards for effective cybersecurity at consumer reporting agencies, to impose penalties on credit reporting agencies for cybersecurity breaches that put sensitive consumer data at risk, and for other purposes.
Sec. 2 Definitions
In this Act:
Affected consumer— The term “affected consumer” means any individual to whom personally identifying information pertains that was, or that may have been, affected by a covered breach.
Agency— The term agency has the meaning given the term in section 551 of title 5, United States Code.
Career appointee— The term career appointee has the meaning given the term in section 3132(a) of title 5, United States Code.
Commission— The term Commission means the Federal Trade Commission.
Consumer report; consumer reporting agency— The terms “consumer report” and “consumer reporting agency” have the meanings given the terms in section 603 of the Fair Credit Reporting Act (15 U.S.C. 1681a).
Covered breach— The term covered breach means any instance in which not less than 1 piece of personally identifying information held by a covered consumer reporting agency is exposed, or is reasonably likely to have been exposed, to an unauthorized party.
Covered consumer reporting agency— The term covered consumer reporting agency means—
a consumer reporting agency described in section 603(p) of the Fair Credit Reporting Act (15 U.S.C. 1681a(p)); or
a consumer reporting agency that earns not less than $7,000,000 in annual revenue from the sale of consumer reports.
Detail— The term detail means a temporary assignment of an employee to a different position for a specified period, with the employee returning to the regular duties of the employee at the end of the specified period.
Director— The term Director means the Director of the Office.
Office— The term “Office” means the Office of Cybersecurity established under section 3(a).
Personally identifying information— The term personally identifying information means, with respect to an individual—
the social security number of the individual;
a driver’s license number of the individual;
a passport number of the individual;
an alien registration number or other government-issued unique identification number of the individual;
unique biometric data, such as a faceprint, a fingerprint, a voice print, an iris image, or any other unique physical representation of the individual;
the first and last name of the individual, or the first initial of the first name and the last name of the individual, in combination with any information that relates to—
the past, present, or future physical or mental health or condition of the individual; or
the provision of health care to, or a diagnosis of, the individual;
a financial account number, debit card number, or credit card number of the individual; or
any passcode required to access an account described in clause (i); and
such additional information, as determined by the Director.
Sec. 3 Cybersecurity standards and FTC authority
Establishment— There is established in the Commission an Office of Cybersecurity, which shall be headed by a Director, who shall be a career appointee.
Duties— The Office—
shall—
supervise covered consumer reporting agencies with respect to data security;
promulgate regulations, through notice and comment rulemaking that complies with section 553 of title 5, United States Code, for effective data security for covered consumer reporting agencies, including requirements for a covered consumer reporting agency to—
provide the Commission with descriptions of technical and organizational security measures of the consumer reporting agency, including—
system and network security measures, including—
asset management, including—
an inventory of devices of the covered consumer reporting agency that are authorized to access data maintained by the covered consumer reporting agency;
an inventory of software that is authorized by the covered consumer reporting agency to access data maintained by the covered consumer reporting agency, including application whitelisting; and
secure configurations for hardware and software of the covered consumer reporting agency;
network management and monitoring, including—
mapped data flows, including functional mission mapping;
maintenance, monitoring, and analysis of audit logs;
network segmentation; and
local and remote access privileges, defined and managed; and
application management, including—
continuous vulnerability assessment and remediation;
server application hardening;
vulnerability handling, such as coordinated vulnerability disclosure policy; and
patch management, including at, or near, real-time dashboards of patch implementation across network hosts; and
data security measures, including—
data-centric security mechanisms such as format-preserving encryption, cryptographic data-splitting, and data-tagging and lineage;
encryption for data at rest;
encryption for data in transit;
systemwide data minimization evaluations and policies; and
data recovery capability;
employ reasonable technical measures and corporate governance processes for continuous monitoring of data, intrusion detection, and continuous evaluation and timely patching of vulnerabilities;
employ reasonable technical measures and corporate governance processes that satisfy and exceed all relevant data security policy recommendations contained in the framework of the National Institute of Standards and Technology entitled “Framework for Improving Critical Infrastructure Cybersecurity”, dated February 12, 2014, or any successor thereto, as determined appropriate by the Office; and
create and maintain documentation demonstrating that the covered consumer reporting agency is employing the technical measures and corporate governance processes described in clauses (ii) and (iii);
annually examine the data security measures of covered consumer reporting agencies for compliance with the requirements described in clauses (ii) and (iii) of subparagraph (B);
investigate any covered consumer reporting agency if the Office has reason to suspect—
a covered breach has occurred and the covered consumer reporting agency was subject to the covered breach; or
the covered consumer reporting agency is not in compliance with the requirements described in clauses (ii) and (iii) of subparagraph (B);
after consultation with members of the technical and academic communities, develop a rigorous, repeatable methodology—
for evaluating, testing, and measuring effective data security practices of covered consumer reporting agencies; and
that employs forms of static and dynamic software analysis and penetration testing;
submit to Congress an annual report on the findings of each investigation carried out under subparagraph (D) during the year covered by the report that includes a statement of how Congress could enhance the authorities of the Office in order to assist the Office in carrying out the duties of the Office under this Act;
determine whether covered consumer reporting agencies are complying with the requirements described in clauses (ii) and (iii) of subparagraph (B); and
coordinate with the National Institute of Standards and Technology and the National Cybersecurity and Communications Integration Center of the Department of Homeland Security; and
may—
investigate any covered breach to determine if the covered consumer reporting agency that was subject to the covered breach was in compliance with the requirements described in clauses (ii) and (iii) of paragraph (1)(B) as of the date on which the covered breach occurred; and
if the Director has reason to believe that any covered consumer reporting agency is violating, or in the immediate future will violate, a requirement described in clause (ii) or (iii) of paragraph (1), bring a suit in an appropriate district court of the United States to enjoin any such act or practice.
Staff—
In general— The Director shall, without regard to the civil service laws and regulations, appoint such personnel, including computer security researchers and practitioners with technical expertise in computer science, engineering, and cybersecurity, as the Director determines are necessary to carry out the duties of the Office.
Details—
In general— An employee of the National Institute of Standards and Technology, the Bureau of Consumer Financial Protection, or the National Cybersecurity and Communications Integration Center of the Department of Homeland Security may be detailed to the Office, without reimbursement.
Civil service status and privilege— Detail under subparagraph (A) shall be without interruption or loss of the civil service status or privilege of the employee who is detailed to the Office.
Sec. 4 Notification and enforcement
Notification—
Notification to the Commission and relevant federal law enforcement and intelligence agencies—
Notification to the Commission— Except as provided in paragraph (3), not later than 10 days after the date on which a covered breach occurs, any covered consumer reporting agency that was subject to the covered breach shall notify the Commission of the covered breach.
Notification to relevant federal law enforcement and intelligence agencies— Not later than 10 days after the date on which the Commission receives a notification under subparagraph (A) that a covered breach has occurred, the Commission shall—
notify the relevant Federal law enforcement agencies and intelligence agencies that the covered breach has occurred; and
with respect to the covered breach, consult with the relevant Federal law enforcement agencies and intelligence agencies, as appropriate.
Notification to affected consumers and the public—
In general— Except as provided in paragraph (3), on an expeditious and practical timeline, as determined appropriate by the Commission, a covered consumer reporting agency that is subject to a covered breach shall—
submit to each affected consumer with respect to whom the covered consumer reporting agency holds a piece of personally identifying information a notification regarding the covered breach that complies with subparagraph (B); and
publish on the internet website of the covered consumer reporting agency a notice that contains a statement of—
the information described in clauses (i) and (ii) of subparagraph (B) and subclauses (I) and (II) of clause (iii) of that subparagraph; and
the steps that the covered consumer reporting agency is taking to notify the affected consumers described in clause (i) regarding the covered breach.
Notification to affected consumers— In a notification to affected consumers under subparagraph (A)(i), the covered consumer reporting agency submitting the notification shall include a statement of—
the fact that the covered breach occurred;
the approximate date on which the covered breach occurred; and
with respect to the covered breach—
the number of affected consumers;
the measures that the covered consumer reporting agency is taking to remedy the covered breach; and
the potential risks created by the covered breach, a list of which the covered consumer reporting agency shall develop in consultation with the Office.
Delay of notification authorized for law enforcement or national security purposes—
Notification by law enforcement agency or intelligence agency— If a Federal law enforcement agency or intelligence agency to which the Commission has provided notice under paragraph (1)(B)(i) determines that the notification required under paragraph (2) may impede a criminal investigation or national security activity—
the Federal law enforcement agency or intelligence agency shall provide written notice to the Commission and the covered consumer reporting agency that was subject to the covered breach that is the subject of the notification that states—
that the notification required under paragraph (2) shall be delayed for law enforcement or national security purposes; and
the date on which the delay imposed under subclause (I) shall end; and
subject to subparagraph (B), the covered consumer reporting agency that was subject to the covered breach shall delay notification under paragraph (2) until the date described in clause (i)(II) of this subparagraph.
Extended delay of notification— If the notification required under paragraph (2) is delayed under subparagraph (A) of this paragraph, a covered consumer reporting agency that is required to provide notice under paragraph (2) shall provide that notice on an expeditious and practical timeline, as determined appropriate by the Commission, after the date on which the law enforcement or national security delay under subparagraph (A) of this paragraph ends, unless a Federal law enforcement or intelligence agency to which the Commission has provided notice under paragraph (1)(B)(i) provides written notification to the Commission and the covered consumer reporting agency that states—
that further delay is necessary; and
the date on which the further delay shall end.
Law enforcement immunity— No nonconstitutional cause of action shall lie in any court against any agency for acts relating to the delay of notification under subparagraph (A), or the extended delay of notification under subparagraph (B), for law enforcement or national security purposes.
Penalty—
In general— In the event of a covered breach, the Commission shall, not later than 30 days after the date on which the Commission receives notification of the covered breach under subsection (a)(1)(A), commence a civil action to recover a civil penalty in an appropriate district court of the United States against the covered consumer reporting agency that was subject to the covered breach.
Determining penalty amount—
In general— Except as provided in subparagraph (B), in determining the amount of a civil penalty under paragraph (1), the court shall impose a civil penalty on a covered consumer reporting agency of—
$100 for each consumer for whom the first and last name, or the first initial of the first name and last name, and 1 other item of personally identifying information were exposed to an unauthorized party; and
in addition to the penalty imposed under clause (i), an additional $50 for each item of personally identifying information of the consumer, other than an item described in that clause, that was exposed to an unauthorized party.
Exception—
In general— Except as provided in clause (ii), in an action commenced under this subsection, a court may not impose a civil penalty in an amount that is more than 50 percent of the gross revenue of the covered consumer reporting agency against which the action is brought for the fiscal year before the fiscal year in which the covered consumer reporting agency became aware of the covered breach that is the subject of the action.
Penalty doubled— In an action commenced under this subsection, the court shall impose a civil penalty on a covered consumer reporting agency in an amount that is 2 times the amount of the penalty described in subparagraph (A), but not greater than 75 percent of the gross revenue of the covered consumer reporting agency for the fiscal year before the fiscal year in which the covered consumer reporting agency became aware of the covered breach that is subject to the action, if—
the covered consumer reporting agency fails to notify the Commission of the covered breach before the deadline established under subsection (a)(1)(A); or
the covered consumer reporting agency violates any requirement described in clause (ii) or (iii) of section 3(b)(1)(B).
Proceeds of the penalties— Of the penalties imposed under this subsection—
50 percent shall be used for cybersecurity research and inspections by the Office; and
50 percent shall be used by the Office to be divided fairly among consumers affected by the covered breach.
No preemption— Nothing in this subsection shall preclude an action by a consumer under State or other Federal law.
Injunctive relief— The Commission, acting through the Office, may bring suit in an appropriate district court of the United States or in the United States court of any territory to require a covered consumer reporting agency to implement or correct a particular security measure in order to promote effective security in accordance with the requirements described in clauses (ii) and (iii) of section 3(b)(1)(B).
Sec. 5 Amendments to the Gramm-Leach-Bliley Act
Enforcement relating to disclosure of nonpublic personal information— Section 505(a)(7) of the Gramm-Leach-Bliley Act (15 U.S.C. 6805(a)(7)) is amended by inserting “, including any consumer reporting agency that compiles and maintains files on consumers on a nationwide basis (as defined in section 603(p) of the Fair Credit Reporting Act (15 U.S.C. 1681a(p)))” before the period at the end.
Definitions relating to disclosure of nonpublic personal information— Section 509(3) of the Gramm-Leach-Bliley Act (15 U.S.C. 6809(3)) is amended by adding at the end the following:
“(E) Consumer reporting agencies specifically included—The term financial institution includes any consumer reporting agency that compiles and maintains files on consumers on a nationwide basis (as defined in section 603(p) of the Fair Credit Reporting Act (15 U.S.C. 1681a(p))).”
Sec. 6 Authorization of appropriations
There are authorized to be appropriated $100,000,000 to carry out this Act, to remain available until expended.