S.Amdt. 2577

1. Adds TITLE VIII--DATA SECURITY at the end of the bill

   Adds a title

   In S. 3414 · Placed on Calendar Senate

   (21) Third party.--The term "third party" includes Federal entities and non-Federal entities.

   Inserted: TITLE VIII--DATA SECURITY

   Inserted: SEC. 801. DEFINITIONS.

   Inserted: In this title, the following definitions shall apply:

   Inserted: (1) Business entity.--The term "business entity" means any organization, corporation, trust, partnership, sole proprietorship, unincorporated association, or venture established to make a profit, or nonprofit.

   Inserted: (2) Personally identifiable information.--The term "personally identifiable information" means any information, or compilation of information, in electronic or digital form that is a means of identification, as defined by section 1028(d)(7) of title 18, United State Code.

   Inserted: (3) Sensitive personally identifiable information.--The term "sensitive personally identifiable information" means any information or compilation of information, in electronic or digital form that includes the following:

   Inserted: (A) An individual's first and last name or first initial and last name in combination with any 2 of the following data elements:

   Inserted: (i) Home address or telephone number.

   Inserted: (ii) Mother's maiden name.

   Inserted: (iii) Month, day, and year of birth.

   Inserted: (B) A non-truncated social security number, driver's license number, passport number, or alien registration number or other government-issued unique identification number.

   Inserted: (C) Unique biometric data such as a finger print, voice print, a retina or iris image, or any other unique physical representation.

   Show 107 more inserted paragraphsShow less

   Inserted: (D) A unique account identifier, including a financial account number or credit or debit card number, electronic identification number, user name, or routing code.

   Inserted: (E) Any combination of the following data elements:

   Inserted: (i) An individual's first and last name or first initial and last name.

   Inserted: (ii) A unique account identifier, including a financial account number or credit or debit card number, electronic identification number, user name, or routing code.

   Inserted: (iii) Any security code, access code, or password, or source code that could be used to generate such codes or passwords.

   Inserted: (4) Service provider.--The term "service provider" means a business entity that provides electronic data transmission, routing, intermediate and transient storage, or connections to its system or network, where the business entity providing such services does not select or modify the content of the electronic data, is not the sender or the intended recipient of the data, and the business entity transmits, routes, stores, or provides connections for personal information in a manner that personal information is undifferentiated from other types of data that such business entity transmits, routes, stores, or provides connections. Any such business entity shall be treated as a service provider under this title only to the extent that it is engaged in the provision of such transmission, routing, intermediate and transient storage or connections.

   Inserted: SEC. 802. PURPOSE AND APPLICABILITY OF DATA PRIVACY AND SECURITY PROGRAM.

   Inserted: (a) Purpose.--The purpose of this title is to ensure standards for developing and implementing administrative, technical, and physical safeguards to protect the security of sensitive personally identifiable information.

   Inserted: (b) Applicability.--A business entity engaging in interstate commerce that involves collecting, accessing, transmitting, using, storing, or disposing of sensitive personally identifiable information in electronic or digital form on 10,000 or more United States persons is subject to the requirements for a data privacy and security program under section 803 for protecting sensitive personally identifiable information.

   Inserted: (c) Limitations.--Notwithstanding any other obligation under this title, this title does not apply to the following:

   Inserted: (1) Financial institutions.--Financial institutions--

   Inserted: (A) subject to the data security requirements and standards under section 501(b) of the Gramm-Leach-Bliley Act (15 U.S.C. 6801(b)); and

   Inserted: (B) subject to the jurisdiction of an agency or authority described in section 505(a) of the Gramm-Leach-Bliley Act (15 U.S.C. 6805(a)).

   Inserted: (2) HIPAA regulated entities.--

   Inserted: (A) Covered entities.--Covered entities subject to the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1301 et seq.), including the data security requirements and implementing regulations of that Act.

   Inserted: (B) Business entities.--A Business entity shall be deemed in compliance with this title if the business entity--

   Inserted: (i) is acting as a business associate, as that term is defined under the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1301 et seq.) and is in compliance with the requirements imposed under that Act and implementing regulations promulgated under that Act; and

   Inserted: (ii) is subject to, and currently in compliance, with the privacy and data security requirements under sections 13401 and 13404 of division A of the American Reinvestment and Recovery Act of 2009 (42 U.S.C. 17931 and 17934) and implementing regulations promulgated under such sections.

   Inserted: (3) Service providers.--A service provider for any electronic communication by a third-party, to the extent that the service provider is exclusively engaged in the transmission, routing, or temporary, intermediate, or transient storage of that communication.

   Inserted: (4) Public records.--Public records not otherwise subject to a confidentiality or nondisclosure requirement, or information obtained from a public record, including information obtained from a news report or periodical.

   Inserted: (d) Safe Harbors.--

   Inserted: (1) In general.--A business entity shall be deemed in compliance with the privacy and security program requirements under section 803 if the business entity complies with or provides protection equal to industry standards or standards widely accepted as an effective industry practice, as identified by the Federal Trade Commission, that are applicable to the type of sensitive personally identifiable information involved in the ordinary course of business of such business entity.

   Inserted: (2) Limitation.--Nothing in this subsection shall be construed to permit, and nothing does permit, the Federal Trade Commission to issue regulations requiring, or according greater legal status to, the implementation of or application of a specific technology or technological specifications for meeting the requirements of this title.

   Inserted: SEC. 803. REQUIREMENTS FOR A PERSONAL DATA PRIVACY AND SECURITY PROGRAM.

   Inserted: (a) Personal Data Privacy and Security Program.--A business entity subject to this title shall comply with the following safeguards and any other administrative, technical, or physical safeguards identified by the Federal Trade Commission in a rulemaking process pursuant to section 553 of title 5, United States Code, for the protection of sensitive personally identifiable information:

   Inserted: (1) Scope.--A business entity shall implement a comprehensive personal data privacy and security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity of the business entity and the nature and scope of its activities.

   Inserted: (2) Design.--The personal data privacy and security program shall be designed to--

   Inserted: (A) ensure the privacy, security, and confidentiality of sensitive personally identifying information;

   Inserted: (B) protect against any anticipated vulnerabilities to the privacy, security, or integrity of sensitive personally identifying information; and

   Inserted: (C) protect against unauthorized access to use of sensitive personally identifying information that could create a significant risk of harm or fraud to any individual.

   Inserted: (3) Risk assessment.--A business entity shall--

   Inserted: (A) identify reasonably foreseeable internal and external vulnerabilities that could result in unauthorized access, disclosure, use, or alteration of sensitive personally identifiable information or systems containing sensitive personally identifiable information;

   Inserted: (B) assess the likelihood of and potential damage from unauthorized access, disclosure, use, or alteration of sensitive personally identifiable information;

   Inserted: (C) assess the sufficiency of its policies, technologies, and safeguards in place to control and minimize risks from unauthorized access, disclosure, use, or alteration of sensitive personally identifiable information; and

   Inserted: (D) assess the vulnerability of sensitive personally identifiable information during destruction and disposal of such information, including through the disposal or retirement of hardware.

   Inserted: (4) Risk management and control.--Each business entity shall--

   Inserted: (A) design its personal data privacy and security program to control the risks identified under paragraph (3);

   Inserted: (B) adopt measures commensurate with the sensitivity of the data as well as the size, complexity, and scope of the activities of the business entity that--

   Inserted: (i) control access to systems and facilities containing sensitive personally identifiable information, including controls to authenticate and permit access only to authorized individuals;

   Inserted: (ii) detect, record, and preserve information relevant to actual and attempted fraudulent, unlawful, or unauthorized access, disclosure, use, or alteration of sensitive personally identifiable information, including by employees and other individuals otherwise authorized to have access;

   Inserted: (iii) protect sensitive personally identifiable information during use, transmission, storage, and disposal by encryption, redaction, or access controls that are widely accepted as an effective industry practice or industry standard, or other reasonable means (including as directed for disposal of records under section 628 of the Fair Credit Reporting Act (15 U.S.C. 1681w) and the implementing regulations of such Act as set forth in section 682 of title 16, Code of Federal Regulations);

   Inserted: (iv) ensure that sensitive personally identifiable information is properly destroyed and disposed of, including during the destruction of computers, diskettes, and other electronic media that contain sensitive personally identifiable information;

   Inserted: (v) trace access to records containing sensitive personally identifiable information so that the business entity can determine who accessed or acquired such sensitive personally identifiable information pertaining to specific individuals; and

   Inserted: (vi) ensure that no third party or customer of the business entity is authorized to access or acquire sensitive personally identifiable information without the business entity first performing sufficient due diligence to ascertain, with reasonable certainty, that such information is being sought for a valid legal purpose; and

   Inserted: (C) establish a plan and procedures for minimizing the amount of sensitive personally identifiable information maintained by such business entity, which shall provide for the retention of sensitive personally identifiable information only as reasonably needed for the business purposes of such business entity or as necessary to comply with any legal obligation.

   Inserted: (b) Training.--Each business entity subject to this title shall take steps to ensure employee training and supervision for implementation of the data security program of the business entity.

   Inserted: (c) Vulnerability Testing.--

   Inserted: (1) In general.--Each business entity subject to this title shall take steps to ensure regular testing of key controls, systems, and procedures of the personal data privacy and security program to detect, prevent, and respond to attacks or intrusions, or other system failures.

   Inserted: (2) Frequency.--The frequency and nature of the tests required under paragraph (1) shall be determined by the risk assessment of the business entity under subsection (a)(3).

   Inserted: (d) Relationship to Certain Providers of Services.--In the event a business entity subject to this title engages a person or entity not subject to this title (other than a service provider) to receive sensitive personally identifiable information in performing services or functions (other than the services or functions provided by a service provider) on behalf of and under the instruction of such business entity, such business entity shall--

   Inserted: (1) exercise appropriate due diligence in selecting the person or entity for responsibilities related to sensitive personally identifiable information, and take reasonable steps to select and retain a person or entity that is capable of maintaining appropriate safeguards for the security, privacy, and integrity of the sensitive personally identifiable information at issue; and

   Inserted: (2) require the person or entity by contract to implement and maintain appropriate measures designed to meet the objectives and requirements governing entities subject to this section.

   Inserted: (e) Periodic Assessment and Personal Data Privacy and Security Modernization.--Each business entity subject to this title shall on a regular basis monitor, evaluate, and adjust, as appropriate its data privacy and security program in light of any relevant changes in--

   Inserted: (1) technology;

   Inserted: (2) the sensitivity of personally identifiable information;

   Inserted: (3) internal or external threats to personally identifiable information; and

   Inserted: (4) the changing business arrangements of the business entity, such as--

   Inserted: (A) mergers and acquisitions;

   Inserted: (B) alliances and joint ventures;

   Inserted: (C) outsourcing arrangements;

   Inserted: (D) bankruptcy; and

   Inserted: (E) changes to sensitive personally identifiable information systems.

   Inserted: (f) Implementation Timeline.--Not later than 1 year after the date of enactment of this title, a business entity subject to the provisions of this title shall implement a data privacy and security program pursuant to this title.

   Inserted: SEC. 804. ENFORCEMENT.

   Inserted: (a) Civil Penalties.--

   Inserted: (1) In general.--Any business entity that violates the provisions of section 803 shall be subject to civil penalties of not more than $5,000 per violation per day while such a violation exists, with a maximum of $500,000 per violation.

   Inserted: (2) Intentional or willful violation.--A business entity that intentionally or willfully violates the provisions of section 803 shall be subject to additional penalties in the amount of $5,000 per violation per day while such a violation exists, with a maximum of an additional $500,000 per violation.

   Inserted: (3) Penalty limits.--

   Inserted: (A) In general.--Notwithstanding any other provision of law, the total sum of civil penalties assessed against a business entity for all violations of the provisions of this title resulting from the same or related acts or omissions shall not exceed $500,000, unless such conduct is found to be willful or intentional.

   Inserted: (B) Determinations.--The determination of whether a violation of a provision of this title has occurred, and if so, the amount of the penalty to be imposed, if any, shall be made by the court sitting as the finder of fact. The determination of whether a violation of a provision of this title was willful or intentional, and if so, the amount of the additional penalty to be imposed, if any, shall be made by the court sitting as the finder of fact.

   Inserted: (C) Additional penalty limit.--If a court determines under subparagraph (B) that a violation of a provision of this title was willful or intentional and imposes an additional penalty, the court may not impose an additional penalty in an amount that exceeds $500,000.

   Inserted: (4) Equitable relief.--A business entity engaged in interstate commerce that violates a provision of this title may be enjoined from further violations by a United States district court.

   Inserted: (5) Other rights and remedies.--The rights and remedies available under this section are cumulative and shall not affect any other rights and remedies available under law.

   Inserted: (b) Federal Trade Commission Authority.--Any business entity shall have the provisions of this title enforced against it by the Federal Trade Commission.

   Inserted: (c) State Enforcement.--

   Inserted: (1) Civil actions.--In any case in which the attorney general of a State or any State or local law enforcement agency authorized by the State attorney general or by State statute to prosecute violations of consumer protection law, has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by the acts or practices of a business entity that violate this title, the State may bring a civil action on behalf of the residents of that State in a district court of the United States of appropriate jurisdiction to--

   Inserted: (A) enjoin that act or practice;

   Inserted: (B) enforce compliance with this title; or

   Inserted: (C) obtain civil penalties of not more than $5,000 per violation per day while such violations persist, up to a maximum of $500,000 per violation.

   Inserted: (2) Penalty limits.--

   Inserted: (A) In general.--Notwithstanding any other provision of law, the total sum of civil penalties assessed against a business entity for all violations of the provisions of this title resulting from the same or related acts or omissions shall not exceed $500,000, unless such conduct is found to be willful or intentional.

   Inserted: (B) Determinations.--The determination of whether a violation of a provision of this title has occurred, and if so, the amount of the penalty to be imposed, if any, shall be made by the court sitting as the finder of fact. The determination of whether a violation of a provision of this title was willful or intentional, and if so, the amount of the additional penalty to be imposed, if any, shall be made by the court sitting as the finder of fact.

   Inserted: (C) Additional penalty limit.--If a court determines under subparagraph (B) that a violation of a provision of this title was willful or intentional and imposes an additional penalty, the court may not impose an additional penalty in an amount that exceeds $500,000.

   Inserted: (3) Notice.--

   Inserted: (A) In general.--Before filing an action under this subsection, the attorney general of the State involved shall provide to the Federal Trade Commission--

   Inserted: (i) a written notice of that action; and

   Inserted: (ii) a copy of the complaint for that action.

   Inserted: (B) Exception.--Subparagraph (A) shall not apply with respect to the filing of an action by an attorney general of a State under this subsection, if the attorney general of a State determines that it is not feasible to provide the notice described in this subparagraph before the filing of the action.

   Inserted: (C) Notification when practicable.--In an action described under subparagraph (B), the attorney general of a State shall provide the written notice and the copy of the complaint to the Federal Trade Commission as soon after the filing of the complaint as practicable.

   Inserted: (4) Federal trade commission authority.--Upon receiving notice under paragraph (3), the Federal Trade Commission shall have the right to--

   Inserted: (A) move to stay the action, pending the final disposition of a pending Federal proceeding or action as described in paragraph (5);

   Inserted: (B) intervene in an action brought under paragraph (1); and

   Inserted: (C) file petitions for appeal.

   Inserted: (5) Pending proceedings.--If the Federal Trade Commission initiates a Federal civil action for a violation of this title, or any regulations thereunder, no attorney general of a State may bring an action for a violation of this title that resulted from the same or related acts or omissions against a defendant named in the Federal civil action initiated by the Federal Trade Commission.

   Inserted: (6) Rule of construction.--For purposes of bringing any civil action under paragraph (1) nothing in this title shall be construed to prevent an attorney general of a State from exercising the powers conferred on the attorney general by the laws of that State to--

   Inserted: (A) conduct investigations;

   Inserted: (B) administer oaths and affirmations; or

   Inserted: (C) compel the attendance of witnesses or the production of documentary and other evidence.

   Inserted: (7) Venue; service of process.--

   Inserted: (A) Venue.--Any action brought under this subsection may be brought in the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code.

   Inserted: (B) Service of process.--In an action brought under this subsection, process may be served in any district in which the defendant--

   Inserted: (i) is an inhabitant; or

   Inserted: (ii) may be found.

   Inserted: (d) No Private Cause of Action.--Nothing in this title establishes a private cause of action against a business entity for violation of any provision of this title.

   Inserted: SEC. 805. RELATION TO OTHER LAWS.

   Inserted: (a) In General.--No State may require any business entity subject to this title to comply with any requirements with respect to administrative, technical, and physical safeguards for the protection of personal information.

   Inserted: (b) Limitations.--Nothing in this title shall be construed to modify, limit, or supersede the operation of the Gramm-Leach-Bliley Act or its implementing regulations, including those adopted or enforced by States.

   Original wording

   At the end, add the following:

Read automatically from the Congressional Record. Check the original before relying on it.

As printed