S.Amdt. 4318

1. Adds Subtitle J--Data Security SEC. 1084. DEFINITIONS at the end of title X

   Adds a section

   In S. 2766 · Placed on Calendar Senate

   (5) the risk assessment prepared by the Chairman of the Joint Chiefs to accompany the Quadrennial Defense Review should be comprehensive and should include a description of the capabilities needed to address the risks identified in that assessment.

   Inserted: Subtitle J--Data Security SEC. 1084. DEFINITIONS.

   Inserted: In this title, the following definitions shall apply:

   Inserted: (1) Agency.--The term "agency" has the same meaning given such term in section 551(1) of title 5, United States Code.

   Inserted: (2) Breach of security of the system.--The term "breach of security of the system" means the compromise of the security, confidentiality, or integrity of data that results in, or there is a reasonable basis to conclude has resulted in, the unauthorized acquisition of personal information maintained by the agency, including by the agency's employees and contractors.

   Inserted: (3) Personal information.--The term "personal information" means an individual's last name in combination with any 1 or more of the following data elements of such individual:

   Inserted: (A) Social security number.

   Inserted: (B) Driver's license number or State identification number.

   Inserted: (C) Date of birth.

   Inserted: (D) Security clearance level;

   Inserted: (E) Work assignment.

   Inserted: (F) Home address.

   Inserted: (G) Health data.

   Show 75 more inserted paragraphsShow less

   Inserted: (4) Substitute notice.--The term "substitute notice" means--

   Inserted: (A) conspicuous posting of the notice on the Internet site of an agency, if the agency maintains a public Internet site; and

   Inserted: (B) notification to major print and broadcast media, including major media in metropolitan and rural areas where the individual whose personal information was, or is reasonably believed to have been, acquired resides. The notice to media shall include a toll-free phone number where an individual can learn whether or not that individual's personal data is included in the security breach.

   Inserted: SEC. 1085. DATABASE SECURITY.

   Inserted: (a) Disclosure of Security Breach.--

   Inserted: (1) In general.--Any agency that owns, licenses, or collects data, whether or not held in electronic form, containing personal information shall, following the discovery of a breach of security of the system maintained by the agency or maintained by a contractor who contracts with such agency that contains such data, or upon receipt of notice under paragraphs (2) or (3), notify any individual of the United States whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

   Inserted: (2) Notification of owner or licensee.--Any agency in possession of data, whether or not held in electronic form, containing personal information that the agency does not own or license shall notify the owner or licensee of the information if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person through a breach of security of the system containing such data.

   Inserted: (3) Notice to agency.--

   Inserted: (A) In general.--Any contractor who contracts with an agency and that maintains personal information, whether or not held in electronic form, shall notify that agency, if such contractor determines that a breach of data security has, or may have, occurred with respect to such information.

   Inserted: (B) Timing.--The notice required under subparagraph (A) shall be provided not later than 7 days after the contractor has made the determination described in subparagraph (A).

   Inserted: (4) Timeliness of notification.--

   Inserted: (A) In general.--All notifications required under paragraphs (1), (2), or (3) shall be made without unreasonable delay following--

   Inserted: (i) the discovery by the agency or contractor of a breach of security of its system;

   Inserted: (ii) any measures necessary to determine the scope of the breach, prevent further disclosures, and restore the reasonable integrity of the data system; and

   Inserted: (iii) receipt of written notice that a law enforcement agency has determined that the notification will no longer seriously impede its investigation, where notification is delayed as provided in paragraph (5).

   Inserted: (B) Burden of proof.--The agency or contractor required to provide notification under this subsection shall have the burden of demonstrating that all notifications were made as required under this subsection, including evidence demonstrating the necessity of any delay.

   Inserted: (5) Delay of notification authorized for law enforcement purposes.--If a law enforcement agency determines that the notification required under this subsection would seriously impede a criminal investigation, such notification may be delayed upon the written request of the law enforcement agency.

   Inserted: (6) Exception for national security and law enforcement.--

   Inserted: (A) In general.--This subsection shall not apply to an agency if the head of the agency certifies, in writing, that notification of the breach as required by this subsection reasonably could be expected to--

   Inserted: (i) cause damage to the national security; and

   Inserted: (ii) hinder a law enforcement investigation or the ability of the agency to conduct law enforcement investigations.

   Inserted: (B) Limits on certifications.--The head of an agency may not execute a certification under subparagraph (A) to--

   Inserted: (i) conceal violations of law, inefficiency, or administrative error;

   Inserted: (ii) prevent embarrassment to a person, organization, or agency; or

   Inserted: (iii) restrain competition.

   Inserted: (C) Notice.--In every case in which a head of an agency issues a certification under subparagraph (A), a copy of the certification, accompanied by a concise description of the factual basis for the certification, shall be immediately provided to the Congress.

   Inserted: (7) Methods of notice.--An agency shall be in compliance with this subsection if it provides the individual, with--

   Inserted: (A) written notification;

   Inserted: (B) e-mail notice; or

   Inserted: (C) substitute notice, if--

   Inserted: (i) the agency demonstrates that the cost of providing direct notice would exceed $500,000;

   Inserted: (ii) the number of individuals to be notified exceeds 500,000; or

   Inserted: (iii) the agency does not have sufficient contact information for those to be notified.

   Inserted: (8) Content of notification.--Regardless of the method by which notice is provided to individuals under paragraphs (1), (2), or (3) , such notice shall include--

   Inserted: (A) to the extent possible, a description of the categories of information that was, or is reasonably believed to have been, acquired by an unauthorized person;

   Inserted: (B) a toll-free number that the individual may use to contact the agency; and

   Inserted: (C) the toll-free contact telephone numbers and addresses for the major credit reporting agencies.

   Inserted: (9) Coordination of notification with credit reporting agencies.--If an agency is required to provide notification to more than 1,000 individuals under this subsection, the agency shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis (as defined in section 603(p) of the Fair Credit Reporting Act (15 U.S.C. 1681a(p)) of the timing and distribution of the notices.

   Inserted: (b) Civil Remedies.--

   Inserted: (1) Penalties.--Any agency or contractor, that violates subsection (a) shall be subject to a fine of--

   Inserted: (A) not more than $1,000 per individual whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person; or

   Inserted: (B) not more than $50,000 per day while the failure to give notice under subsection (a) persists.

   Inserted: (2) Equitable relief.--Any agency or contractor that violates, proposes to violate, or has violated this section may be enjoined from further violations by a court of competent jurisdiction.

   Inserted: (3) Other rights and remedies.--The rights and remedies available under this subsection are cumulative and shall not affect any other rights and remedies available under law.

   Inserted: (c) Enforcement.--The Attorney General of the United States is authorized to enforce compliance with this section, including the assessment of fines under subsection (b)(1).

   Inserted: (d) Fraud Alert.--Section 605A(b)(1) of the Fair Credit Reporting Act (15 U.S.C. 1681c-1(b)(1)) is amended by inserting ", or evidence that the consumer has received notice that the consumer's personal financial information has or may have been compromised," after "identity theft report".

   Inserted: SEC. 1086. ENFORCEMENT BY STATE ATTORNEYS GENERAL.

   Inserted: (a) In General.--

   Inserted: (1) Civil actions.--In any case in which the attorney general of a State has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by the engagement of the agency or any contractor of the agency in a practice that is prohibited under this title, the State, as parens patriae, may bring a civil action on behalf of the residents of the State in a district court of the United States of appropriate jurisdiction or any other court of competent jurisdiction, including a State court, to--

   Inserted: (A) enjoin that practice;

   Inserted: (B) enforce compliance with this title;

   Inserted: (C) obtain damages, restitution, or other compensation on behalf of residents of the State; or

   Inserted: (D) obtain such other relief as the court may consider to be appropriate.

   Inserted: (2) Notice.--

   Inserted: (A) In general.--Before filing an action under paragraph (1), the attorney general of the State involved shall provide to the Attorney General of the United States--

   Inserted: (i) written notice of the action; and

   Inserted: (ii) a copy of the complaint for the action.

   Inserted: (B) Exemption.--

   Inserted: (i) In general.--Subparagraph (A) shall not apply with respect to the filing of an action by an attorney general of a State under this subsection, if the State attorney general determines that it is not feasible to provide the notice described in such subparagraph before the filing of the action.

   Inserted: (ii) Notification.--In an action described in clause (i), the attorney general of a State shall provide notice and a copy of the complaint to the Attorney General at the time the State attorney general files the action.

   Inserted: (b) Construction.--For purposes of bringing any civil action under subsection (a), nothing in this title shall be construed to prevent an attorney general of a State from exercising the powers conferred on such attorney general by the laws of that State to--

   Inserted: (1) conduct investigations;

   Inserted: (2) administer oaths or affirmations; or

   Inserted: (3) compel the attendance of witnesses or the production of documentary and other evidence.

   Inserted: (c) Venue; Service of Process.--

   Inserted: (1) Venue.--Any action brought under subsection (a) may be brought in--

   Inserted: (A) the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code; or

   Inserted: (B) another court of competent jurisdiction.

   Inserted: (2) Service of process.--In an action brought under subsection (a), process may be served in any district in which the defendant--

   Inserted: (A) is an inhabitant; or

   Inserted: (B) may be found.

   Inserted: SEC. 1087. EFFECT ON STATE LAW.

   Inserted: The provisions of this subtitle shall supersede any inconsistent provisions of law of any State or unit of local government with respect to the conduct required by the specific provisions of this subtitle.

   Inserted: SEC. 1088. EFFECTIVE DATE.

   Inserted: This subtitle shall take effect on the expiration of the date which is 90 days after the date of enactment of this Act.

   Original wording

   At the end of title X, add the following new subtitle:

Read automatically from the Congressional Record. Check the original before relying on it.

As printed