S.Amdt. 2578

1. Adds DIVISION __--DATA BREACHES at the end of the bill

   Adds a section

   In S. 3414 · Placed on Calendar Senate

   (21) Third party.--The term "third party" includes Federal entities and non-Federal entities.

   Inserted: DIVISION __--DATA BREACHES

   Inserted: SECTION 1. SHORT TITLE.

   Inserted: This division may be cited as the "Personal Data Privacy and Security Act of 2012".

   Inserted: SEC. 2. FINDINGS.

   Inserted: Congress finds that--

   Inserted: (1) databases of personally identifiable information are increasingly prime targets of hackers, identity thieves, rogue employees, and other criminals, including organized and sophisticated criminal operations;

   Inserted: (2) identity theft is a serious threat to the Nation's economic stability, national security, homeland security, cybersecurity, the development of e-commerce, and the privacy rights of Americans;

   Inserted: (3) security breaches are a serious threat to consumer confidence, homeland security, national security, e-commerce, and economic stability;

   Inserted: (4) it is important for business entities that own, use, or license personally identifiable information to adopt reasonable procedures to ensure the security, privacy, and confidentiality of that personally identifiable information;

   Inserted: (5) individuals whose personal information has been compromised or who have been victims of identity theft should receive the necessary information and assistance to mitigate their damages and to restore the integrity of their personal information and identities;

   Inserted: (6) data misuse and use of inaccurate data have the potential to cause serious or irreparable harm to an individual's livelihood, privacy, and liberty and undermine efficient and effective business and government operations;

   Inserted: (7) government access to commercial data can potentially improve safety, law enforcement, and national security; and

   Show 208 more inserted paragraphsShow less

   Inserted: (8) because government use of commercial data containing personal information potentially affects individual privacy, and law enforcement and national security operations, there is a need for Congress to exercise oversight over government use of commercial data.

   Inserted: SEC. 3. DEFINITIONS.

   Inserted: In this division, the following definitions shall apply:

   Inserted: (1) Affiliate.--The term "affiliate" means persons related by common ownership or by corporate control.

   Inserted: (2) Agency.--The term "agency" has the same meaning given such term in section 551 of title 5, United States Code.

   Inserted: (3) Business entity.--The term "business entity" means any organization, corporation, trust, partnership, sole proprietorship, unincorporated association, or venture established to make a profit, or nonprofit.

   Inserted: (4) Data system communication information.--The term "data system communication information" means dialing, routing, addressing, or signaling information that identifies the origin, direction, destination, processing, transmission, or termination of each communication initiated, attempted, or received.

   Inserted: (5) Designated entity.--The term "designated entity" means the Federal Government entity designated by the Secretary of Homeland Security under section 206(a).

   Inserted: (6) Encryption.--The term "encryption"--

   Inserted: (A) means the protection of data in electronic form, in storage or in transit, using an encryption technology that has been generally accepted by experts in the field of information security that renders such data indecipherable in the absence of associated cryptographic keys necessary to enable decryption of such data; and

   Inserted: (B) includes appropriate management and safeguards of such cryptographic keys so as to protect the integrity of the encryption.

   Inserted: (7) Identity theft.--The term "identity theft" means a violation of section 1028(a)(7) of title 18, United States Code.

   Inserted: (8) Personally identifiable information.--The term "personally identifiable information" means any information, or compilation of information, in electronic or digital form that is a means of identification, as defined by section 1028(d)(7) of title 18, United State Code.

   Inserted: (9) Public record source.--The term "public record source" means the Congress, any agency, any State or local government agency, the government of the District of Columbia and governments of the territories or possessions of the United States, and Federal, State or local courts, courts martial and military commissions, that maintain personally identifiable information in records available to the public.

   Inserted: (10) Security breach.--

   Inserted: (A) In general.--The term "security breach" means compromise of the security, confidentiality, or integrity of, or the loss of, computerized data that result in, or that there is a reasonable basis to conclude has resulted in--

   Inserted: (i) the unauthorized acquisition of sensitive personally identifiable information; and

   Inserted: (ii) access to sensitive personally identifiable information that is for an unauthorized purpose, or in excess of authorization.

   Inserted: (B) Exclusion.--The term "security breach" does not include--

   Inserted: (i) a good faith acquisition of sensitive personally identifiable information by a business entity or agency, or an employee or agent of a business entity or agency, if the sensitive personally identifiable information is not subject to further unauthorized disclosure;

   Inserted: (ii) the release of a public record not otherwise subject to confidentiality or nondisclosure requirements or the release of information obtained from a public record, including information obtained from a news report or periodical; or

   Inserted: (iii) any lawfully authorized investigative, protective, or intelligence activity of a law enforcement or intelligence agency of the United States, a State, or a political subdivision of a State.

   Inserted: (11) Sensitive personally identifiable information.--The term "sensitive personally identifiable information" means any information or compilation of information, in electronic or digital form that includes the following:

   Inserted: (A) An individual's first and last name or first initial and last name in combination with any two of the following data elements:

   Inserted: (i) Home address or telephone number.

   Inserted: (ii) Mother's maiden name.

   Inserted: (iii) Month, day, and year of birth.

   Inserted: (B) A non-truncated social security number, driver's license number, passport number, or alien registration number or other government-issued unique identification number.

   Inserted: (C) Unique biometric data such as a finger print, voice print, a retina or iris image, or any other unique physical representation.

   Inserted: (D) A unique account identifier, including a financial account number or credit or debit card number, electronic identification number, user name, or routing code.

   Inserted: (E) Any combination of the following data elements:

   Inserted: (i) An individual's first and last name or first initial and last name.

   Inserted: (ii) A unique account identifier, including a financial account number or credit or debit card number, electronic identification number, user name, or routing code.

   Inserted: (iii) Any security code, access code, or password, or source code that could be used to generate such codes or passwords.

   Inserted: (12) Service provider.--The term "service provider" means a business entity that provides electronic data transmission, routing, intermediate and transient storage, or connections to its system or network, where the business entity providing such services does not select or modify the content of the electronic data, is not the sender or the intended recipient of the data, and the business entity transmits, routes, stores, or provides connections for personal information in a manner that personal information is undifferentiated from other types of data that such business entity transmits, routes, stores, or provides connections. Any such business entity shall be treated as a service provider under this division only to the extent that it is engaged in the provision of such transmission, routing, intermediate and transient storage or connections.

   Inserted: TITLE I--CONCEALMENT OF SECURITY BREACHES

   Inserted: SEC. 101. CONCEALMENT OF SECURITY BREACHES INVOLVING SENSITIVE PERSONALLY IDENTIFIABLE INFORMATION.

   Inserted: (a) In General.--Chapter 47 of title 18, United States Code, is amended by adding at the end the following:

   Inserted: "Sec. 1041. Concealment of security breaches involving sensitive personally identifiable information

   Inserted: "(a) In General.--Whoever, having knowledge of a security breach and of the fact that notice of such security breach is required under title II of the Personal Data Privacy and Security Act of 2012, intentionally and willfully conceals the fact of such security breach, shall, in the event that such security breach results in economic harm to any individual in the amount of $1,000 or more, be fined under this title or imprisoned for not more than 5 years, or both.

   Inserted: "(b) Person Defined.--For purposes of subsection (a), the term 'person' has the same meaning as in section 1030(e)(12) of title 18, United States Code.

   Inserted: "(c) Notice Requirement.--Any person seeking an exemption under section 202(b) of the Personal Data Privacy and Security Act of 2012 shall be immune from prosecution under this section if the Federal Trade Commission does not indicate, in writing, that such notice be given under section 202(b)(1)(C) of such Act.".

   Inserted: (b) Conforming and Technical Amendments.--The table of sections for chapter 47 of title 18, United States Code, is amended by adding at the end the following:

   Inserted: "1041. Concealment of security breaches involving sensitive personally identifiable information.".

   Inserted: (c) Enforcement Authority.--

   Inserted: (1) In general.--The United States Secret Service and Federal Bureau of Investigation shall have the authority to investigate offenses under this section.

   Inserted: (2) Nonexclusivity.--The authority granted in paragraph (1) shall not be exclusive of any existing authority held by any other Federal agency.

   Inserted: TITLE II--SECURITY BREACH NOTIFICATION

   Inserted: SEC. 201. NOTICE TO INDIVIDUALS.

   Inserted: (a) In General.--Any agency, or business entity engaged in interstate commerce, other than a service provider, that uses, accesses, transmits, stores, disposes of or collects sensitive personally identifiable information shall, following the discovery of a security breach of such information, notify any resident of the United States whose sensitive personally identifiable information has been, or is reasonably believed to have been, accessed, or acquired.

   Inserted: (b) Obligation of Owner or Licensee.--

   Inserted: (1) Notice to owner or licensee.--Any agency, or business entity engaged in interstate commerce, that uses, accesses, transmits, stores, disposes of, or collects sensitive personally identifiable information that the agency or business entity does not own or license shall notify the owner or licensee of the information following the discovery of a security breach involving such information.

   Inserted: (2) Notice by owner, licensee, or other designated third party.--Nothing in this title shall prevent or abrogate an agreement between an agency or business entity required to give notice under this section and a designated third party, including an owner or licensee of the sensitive personally identifiable information subject to the security breach, to provide the notifications required under subsection (a).

   Inserted: (3) Business entity relieved from giving notice.--A business entity obligated to give notice under subsection (a) shall be relieved of such obligation if an owner or licensee of the sensitive personally identifiable information subject to the security breach, or other designated third party, provides such notification.

   Inserted: (4) Service providers.--If a service provider becomes aware of a security breach of data in electronic form containing sensitive personal information that is owned or possessed by another business entity that connects to or uses a system or network provided by the service provider for the purpose of transmitting, routing, or providing intermediate or transient storage of such data, the service provider shall be required to notify the business entity who initiated such connection, transmission, routing, or storage of the security breach if the business entity can be reasonably identified. Upon receiving such notification from a service provider, the business entity shall be required to provide the notification required under subsection (a).

   Inserted: (c) Timeliness of Notification.--

   Inserted: (1) In general.--All notifications required under this section shall be made without unreasonable delay following the discovery by the agency or business entity of a security breach.

   Inserted: (2) Reasonable delay.--

   Inserted: (A) In general.--Reasonable delay under this subsection may include any time necessary to determine the scope of the security breach, prevent further disclosures, conduct the risk assessment described in section 202(b)(1)(A), and restore the reasonable integrity of the data system and provide notice to law enforcement when required.

   Inserted: (B) Extension.--

   Inserted: (i) In general.--Except as provided in section 202, delay of notification shall not exceed 60 days following the discovery of the security breach, unless the business entity or agency request an extension of time and the Federal Trade Commission determines in writing that additional time is reasonably necessary to determine the scope of the security breach, prevent further disclosures, conduct the risk assessment, restore the reasonable integrity of the data system, or to provide notice to the entity designated by the Secretary of Homeland Security pursuant to section 206.

   Inserted: (ii) Approval of request.--If the Federal Trade Commission approves the request for delay, the agency or business entity may delay the time period for notification for additional periods of up to 30 days.

   Inserted: (3) Burden of production.--The agency, business entity, owner, or licensee required to provide notice under this title shall, upon the request of the Attorney General or the Federal Trade Commission provide records or other evidence of the notifications required under this title, including to the extent applicable, the reasons for any delay of notification.

   Inserted: (d) Delay of Notification Authorized for Law Enforcement or National Security Purposes.--

   Inserted: (1) In general.--If the United States Secret Service or the Federal Bureau of Investigation determines that the notification required under this section would impede a criminal investigation, or national security activity, such notification shall be delayed upon written notice from the United States Secret Service or the Federal Bureau of Investigation to the agency or business entity that experienced the breach. The notification from the United States Secret Service or the Federal Bureau of Investigation shall specify in writing the period of delay requested for law enforcement or national security purposes.

   Inserted: (2) Extended delay of notification.--If the notification required under subsection (a) is delayed pursuant to paragraph (1), an agency or business entity shall give notice 30 days after the day such law enforcement or national security delay was invoked unless a Federal law enforcement or intelligence agency provides written notification that further delay is necessary.

   Inserted: (3) Law enforcement immunity.--No nonconstitutional cause of action shall lie in any court against any agency for acts relating to the delay of notification for law enforcement or national security purposes under this title.

   Inserted: (e) Limitations.--Notwithstanding any other obligation under this title, this title does not apply to the following:

   Inserted: (1) Financial institutions.--Financial institutions--

   Inserted: (A) subject to the data security requirements and standards under section 501(b) of the Gramm-Leach-Bliley Act (15 U.S.C. 6801(b)); and

   Inserted: (B) subject to the jurisdiction of an agency or authority described in section 505(a) of the Gramm-Leach-Bliley Act (15 U.S.C. 6805(a)).

   Inserted: (2) HIPAA regulated entities.--

   Inserted: (A) Covered entities.--Covered entities subject to the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1301 et seq.), including the data security requirements and implementing regulations of that Act.

   Inserted: (B) Business entities.--A business entity shall be deemed in compliance with this division if the business entity--

   Inserted: (i)(I) is acting as a covered entity and as a business associate, as those terms are defined under the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1301 et seq.) and is in compliance with the requirements imposed under that Act and implementing regulations promulgated under that Act; and

   Inserted: (II) is subject to, and currently in compliance, with the data breach notification, privacy and data security requirements under the Health Information Technology for Economic and Clinical Health (HITECH) Act, (42 U.S.C. 17932) and implementing regulations promulgated thereunder; or

   Inserted: (ii) is acting as a vendor of personal health records and third party service provider, subject to the Health Information Technology for Economic and Clinical Health (HITECH) Act (42 U.S.C. 17937), including the data breach notification requirements and implementing regulations of that Act.

   Inserted: SEC. 202. EXEMPTIONS.

   Inserted: (a) Exemption for National Security and Law Enforcement.--

   Inserted: (1) In general.--Section 201 shall not apply to an agency or business entity if--

   Inserted: (A) the United States Secret Service or the Federal Bureau of Investigation determines that notification of the security breach could be expected to reveal sensitive sources and methods or similarly impede the ability of the Government to conduct law enforcement investigations; or

   Inserted: (B) the Federal Bureau of Investigation determines that notification of the security breach could be expected to cause damage to the national security.

   Inserted: (2) Immunity.--No nonconstitutional cause of action shall lie in any court against any Federal agency for acts relating to the exemption from notification for law enforcement or national security purposes under this title.

   Inserted: (b) Safe Harbor.--

   Inserted: (1) In general.--An agency or business entity shall be exempt from the notice requirements under section 201, if--

   Inserted: (A) a risk assessment conducted by the agency or business entity concludes that, based upon the information available, there is no significant risk that a security breach has resulted in, or will result in, identity theft, economic loss or harm, or physical harm to the individuals whose sensitive personally identifiable information was subject to the security breach;

   Inserted: (B) without unreasonable delay, but not later than 45 days after the discovery of a security breach, unless extended by the Federal Trade Commission, the agency or business entity notifies the Federal Trade Commission, in writing, of--

   Inserted: (i) the results of the risk assessment; and

   Inserted: (ii) its decision to invoke the risk assessment exemption; and

   Inserted: (C) the Federal Trade Commission does not indicate, in writing, within 10 business days from receipt of the decision, that notice should be given.

   Inserted: (2) Rebuttable presumptions.--For purposes of paragraph (1)--

   Inserted: (A) the encryption of sensitive personally identifiable information described in paragraph (1)(A) shall establish a rebuttable presumption that no significant risk exists; and

   Inserted: (B) the rendering of sensitive personally identifiable information described in paragraph (1)(A) unusable, unreadable, or indecipherable through data security technology or methodology that is generally accepted by experts in the field of information security, such as redaction or access controls shall establish a rebuttable presumption that no significant risk exists.

   Inserted: (3) Violation.--It shall be a violation of this section to--

   Inserted: (A) fail to conduct the risk assessment in a reasonable manner, or according to standards generally accepted by experts in the field of information security; or

   Inserted: (B) submit the results of a risk assessment that contains fraudulent or deliberately misleading information.

   Inserted: (c) Financial Fraud Prevention Exemption.--

   Inserted: (1) In general.--A business entity will be exempt from the notice requirement under section 201 if the business entity utilizes or participates in a security program that--

   Inserted: (A) effectively blocks the use of the sensitive personally identifiable information to initiate unauthorized financial transactions before they are charged to the account of the individual; and

   Inserted: (B) provides for notice to affected individuals after a security breach that has resulted in fraud or unauthorized transactions.

   Inserted: (2) Limitation.--The exemption in paragraph (1) does not apply if the information subject to the security breach includes an individual's first and last name, or any other type of sensitive personally identifiable information as defined in section 3, unless that information is only a credit card number or credit card security code.

   Inserted: SEC. 203. METHODS OF NOTICE.

   Inserted: An agency or business entity shall be in compliance with section 201 if it provides the following:

   Inserted: (1) Individual notice.--Notice to individuals by 1 of the following means:

   Inserted: (A) Written notification to the last known home mailing address of the individual in the records of the agency or business entity.

   Inserted: (B) Telephone notice to the individual personally.

   Inserted: (C) E-mail notice, if the individual has consented to receive such notice and the notice is consistent with the provisions permitting electronic transmission of notices under section 101 of the Electronic Signatures in Global and National Commerce Act (15 U.S.C. 7001).

   Inserted: (2) Media notice.--Notice to major media outlets serving a State or jurisdiction, if the number of residents of such State whose sensitive personally identifiable information was, or is reasonably believed to have been, accessed or acquired by an unauthorized person exceeds 5,000.

   Inserted: SEC. 204. CONTENT OF NOTIFICATION.

   Inserted: (a) In General.--Regardless of the method by which notice is provided to individuals under section 203, such notice shall include, to the extent possible--

   Inserted: (1) a description of the categories of sensitive personally identifiable information that was, or is reasonably believed to have been, accessed or acquired by an unauthorized person;

   Inserted: (2) a toll-free number--

   Inserted: (A) that the individual may use to contact the agency or business entity, or the agent of the agency or business entity; and

   Inserted: (B) from which the individual may learn what types of sensitive personally identifiable information the agency or business entity maintained about that individual; and

   Inserted: (3) the toll-free contact telephone numbers and addresses for the major credit reporting agencies.

   Inserted: (b) Additional Content.--Notwithstanding section 209, a State may require that a notice under subsection (a) shall also include information regarding victim protection assistance provided for by that State.

   Inserted: (c) Direct Business Relationship.--Regardless of whether a business entity, agency, or a designated third party provides the notice required pursuant to section 201(b), such notice shall include the name of the business entity or agency that has a direct relationship with the individual being notified.

   Inserted: SEC. 205. COORDINATION OF NOTIFICATION WITH CREDIT REPORTING AGENCIES.

   Inserted: If an agency or business entity is required to provide notification to more than 5,000 individuals under section 201(a), the agency or business entity shall also notify all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis (as defined in section 603(p) of the Fair Credit Reporting Act (15 U.S.C. 1681a(p)) of the timing and distribution of the notices. Such notice shall be given to the consumer credit reporting agencies without unreasonable delay and, if it will not delay notice to the affected individuals, prior to the distribution of notices to the affected individuals.

   Inserted: SEC. 206. NOTICE TO LAW ENFORCEMENT.

   Inserted: (a) Designation of Government Entity to Receive Notice.--

   Inserted: (1) In general.--Not later than 60 days after the date of enactment of this Act, the Secretary of Homeland Security shall designate a Federal Government entity to receive the notices required under section 201 and this section, and any other reports and information about information security incidents, threats, and vulnerabilities.

   Inserted: (2) Responsibilities of the designated entity.--The designated entity shall--

   Inserted: (A) be responsible for promptly providing the information that it receives to the United States Secret Service and the Federal Bureau of Investigation, and to the Federal Trade Commission for civil law enforcement purposes; and

   Inserted: (B) provide the information described in subparagraph (A) as appropriate to other Federal agencies for law enforcement, national security, or data security purposes.

   Inserted: (b) Notice.--Any business entity or agency shall notify the designated entity of the fact that a security breach has occurred if--

   Inserted: (1) the number of individuals whose sensitive personally identifying information was, or is reasonably believed to have been accessed or acquired by an unauthorized person exceeds 5,000;

   Inserted: (2) the security breach involves a database, networked or integrated databases, or other data system containing the sensitive personally identifiable information of more than 500,000 individuals nationwide;

   Inserted: (3) the security breach involves databases owned by the Federal Government; or

   Inserted: (4) the security breach involves primarily sensitive personally identifiable information of individuals known to the agency or business entity to be employees and contractors of the Federal Government involved in national security or law enforcement.

   Inserted: (c) FTC Rulemaking and Review of Thresholds.--Not later 1 year after the date of the enactment of this Act, the Federal Trade Commission, in consultation with the Attorney General of the United States and the Secretary of Homeland Security, shall promulgate regulations regarding the reports required under subsection (a). The Federal Trade Commission, in consultation with the Attorney General and the Secretary of Homeland Security, after notice and the opportunity for public comment, and in a manner consistent with this section, shall promulgate regulations, as necessary, under section 553 of title 5, United States Code, to adjust the thresholds for notice to law enforcement and national security authorities under subsection (a) and to facilitate the purposes of this section.

   Inserted: (d) Timing.--The notice required under subsection (a) shall be provided as promptly as possible, but such notice must be provided either 72 hours before notice is provided to an individual pursuant to section 201, or not later than 10 days after the business entity or agency discovers the security breach or discovers that the nature of the security breach requires notice to law enforcement under this section, whichever occurs first.

   Inserted: SEC. 207. ENFORCEMENT.

   Inserted: (a) In General.--The Attorney General of the United States and the Federal Trade Commission may enforce civil violations of section 201.

   Inserted: (b) Civil Actions by the Attorney General of the United States.--

   Inserted: (1) In general.--The Attorney General may bring a civil action in the appropriate United States district court against any business entity that engages in conduct constituting a violation of this title and, upon proof of such conduct by a preponderance of the evidence, such business entity shall be subject to a civil penalty of not more than $11,000 per day per security breach.

   Inserted: (2) Penalty limitation.--Notwithstanding any other provision of law, the total amount of the civil penalty assessed against a business entity for conduct involving the same or related acts or omissions that results in a violation of this title may not exceed $1,000,000.

   Inserted: (3) Determinations.--The determination of whether a violation of a provision of this title has occurred, and if so, the amount of the penalty to be imposed, if any, shall be made by the court sitting as the finder of fact. The determination of whether a violation of a provision of this title was willful or intentional, and if so, the amount of the additional penalty to be imposed, if any, shall be made by the court sitting as the finder of fact.

   Inserted: (4) Additional penalty limit.--If a court determines under paragraph (3) that a violation of a provision of this title was willful or intentional and imposes an additional penalty, the court may not impose an additional penalty in an amount that exceeds $1,000,000.

   Inserted: (c) Injunctive Actions by the Attorney General.--

   Inserted: (1) In general.--If it appears that a business entity has engaged, or is engaged, in any act or practice constituting a violation of this title, the Attorney General may petition an appropriate district court of the United States for an order--

   Inserted: (A) enjoining such act or practice; or

   Inserted: (B) enforcing compliance with this title.

   Inserted: (2) Issuance of order.--A court may issue an order under paragraph (1), if the court finds that the conduct in question constitutes a violation of this title.

   Inserted: (d) Civil Actions by the Federal Trade Commission.--

   Inserted: (1) In general.--Compliance with the requirements imposed under this title may be enforced under the Federal Trade Commission Act (15 U.S.C. 41 et seq.) by the Federal Trade Commission with respect to business entities subject to this division. All of the functions and powers of the Federal Trade Commission under the Federal Trade Commission Act are available to the Federal Trade Commission to enforce compliance by any person with the requirements imposed under this title.

   Inserted: (2) Penalty limitation.--

   Inserted: (A) In general.--Notwithstanding any other provision of law, the total sum of civil penalties assessed against a business entity for all violations of the provisions of this title resulting from the same or related acts or omissions may not exceed $1,000,000, unless such conduct is found to be willful or intentional.

   Inserted: (B) Determinations.--The determination of whether a violation of a provision of this title has occurred, and if so, the amount of the penalty to be imposed, if any, shall be made by the court sitting as the finder of fact. The determination of whether a violation of a provision of this title was willful or intentional, and if so, the amount of the additional penalty to be imposed, if any, shall be made by the court sitting as the finder of fact.

   Inserted: (C) Additional penalty limit.--If a court determines under subparagraph (B) that a violation of a provision of this title was willful or intentional and imposes an additional penalty, the court may not impose an additional penalty in an amount that exceeds $1,000,000.

   Inserted: (3) Unfair or deceptive acts or practices.--For the purpose of the exercise by the Federal Trade Commission of its functions and powers under the Federal Trade Commission Act, a violation of any requirement or prohibition imposed under this title shall constitute an unfair or deceptive act or practice in commerce in violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(I)(B)) regarding unfair or deceptive acts or practices and shall be subject to enforcement by the Federal Trade Commission under that Act with respect to any business entity, irrespective of whether that business entity is engaged in commerce or meets any other jurisdictional tests in the Federal Trade Commission Act.

   Inserted: (e) Coordination of Enforcement.--

   Inserted: (1) In general.--Before opening an investigation, the Federal Trade Commission shall consult with the Attorney General.

   Inserted: (2) Limitation.--The Federal Trade Commission may initiate investigations under this subsection unless the Attorney General determines that such an investigation would impede an ongoing criminal investigation or national security activity.

   Inserted: (3) Coordination agreement.--

   Inserted: (A) In general.--In order to avoid conflicts and promote consistency regarding the enforcement and litigation of matters under this division, not later than 180 days after the enactment of this Act, the Attorney General and the Commission shall enter into an agreement for coordination regarding the enforcement of this division

   Inserted: (B) Requirement.--The coordination agreement entered into under subparagraph (A) shall include provisions to ensure that parallel investigations and proceedings under this section are conducted in a matter that avoids conflicts and does not impede the ability of the Attorney General to prosecute violations of Federal criminal laws.

   Inserted: (4) Coordination with the fcc.--If an enforcement action under this division relates to customer proprietary network information, the Federal Trade Commission shall coordinate the enforcement action with the Federal Communications Commission.

   Inserted: (f) Rulemaking.--The Federal Trade Commission may, in consultation with the Attorney General, issue such other regulations as it determines to be necessary to carry out this title. All regulations promulgated under this division shall be issued in accordance with section 553 of title 5, United States Code. Where regulations relate to customer proprietary network information, the promulgation of such regulations will be coordinated with the Federal Communications Commission.

   Inserted: (g) Other Rights and Remedies.--The rights and remedies available under this title are cumulative and shall not affect any other rights and remedies available under law.

   Inserted: (h) Fraud Alert.--Section 605A(b)(1) of the Fair Credit Reporting Act (15 U.S.C. 1681c-1(b)(1)) is amended by inserting ", or evidence that the consumer has received notice that the consumer's financial information has or may have been compromised," after "identity theft report".

   Inserted: SEC. 208. ENFORCEMENT BY STATE ATTORNEYS GENERAL.

   Inserted: (a) In General.--

   Inserted: (1) Civil actions.--In any case in which the attorney general of a State or any State or local law enforcement agency authorized by the State attorney general or by State statute to prosecute violations of consumer protection law, has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by the engagement of a business entity in a practice that is prohibited under this title, the State or the State or local law enforcement agency on behalf of the residents of the agency's jurisdiction, may bring a civil action on behalf of the residents of the State or jurisdiction in a district court of the United States of appropriate jurisdiction to--

   Inserted: (A) enjoin that practice;

   Inserted: (B) enforce compliance with this title; or

   Inserted: (C) civil penalties of not more than $11,000 per day per security breach up to a maximum of $1,000,000 per violation, unless such conduct is found to be willful or intentional.

   Inserted: (2) Penalty limitation.--

   Inserted: (A) In general.--Notwithstanding any other provision of law, the total sum of civil penalties assessed against a business entity for all violations of the provisions of this title resulting from the same or related acts or omissions may not exceed $1,000,000, unless such conduct is found to be willful or intentional.

   Inserted: (B) Determinations.--The determination of whether a violation of a provision of this title has occurred, and if so, the amount of the penalty to be imposed, if any, shall be made by the court sitting as the finder of fact. The determination of whether a violation of a provision of this title was willful or intentional, and if so, the amount of the additional penalty to be imposed, if any, shall be made by the court sitting as the finder of fact.

   Inserted: (C) Additional penalty limit.--If a court determines under subparagraph (B) that a violation of a provision of this title was willful or intentional and imposes an additional penalty, the court may not impose an additional penalty in an amount that exceeds $1,000,000.

   Inserted: (3) Notice.--

   Inserted: (A) In general.--Before filing an action under paragraph (1), the attorney general of the State involved shall provide to the Attorney General of the United States--

   Inserted: (i) written notice of the action; and

   Inserted: (ii) a copy of the complaint for the action.

   Inserted: (B) Exemption.--

   Inserted: (i) In general.--Subparagraph (A) shall not apply with respect to the filing of an action by an attorney general of a State under this title, if the State attorney general determines that it is not feasible to provide the notice described in such subparagraph before the filing of the action.

   Inserted: (ii) Notification.--In an action described in clause (i), the attorney general of a State shall provide notice and a copy of the complaint to the Attorney General at the time the State attorney general files the action.

   Inserted: (b) Federal Proceedings.--Upon receiving notice under subsection (a)(3), the Attorney General shall have the right to--

   Inserted: (1) move to stay the action, pending the final disposition of a pending Federal proceeding or action;

   Inserted: (2) initiate an action in the appropriate United States district court under section 207 and move to consolidate all pending actions, including State actions, in such court;

   Inserted: (3) intervene in an action brought under subsection (a)(1); and

   Inserted: (4) file petitions for appeal.

   Inserted: (c) Pending Proceedings.--If the Attorney General or the Federal Trade Commission initiate a criminal proceeding or civil action for a violation of a provision of this title, or any regulations thereunder, no attorney general of a State may bring an action for a violation of a provision of this title against a defendant named in the Federal criminal proceeding or civil action.

   Inserted: (d) Construction.--For purposes of bringing any civil action under subsection (a), nothing in this title regarding notification shall be construed to prevent an attorney general of a State from exercising the powers conferred on such attorney general by the laws of that State to--

   Inserted: (1) conduct investigations;

   Inserted: (2) administer oaths or affirmations; or

   Inserted: (3) compel the attendance of witnesses or the production of documentary and other evidence.

   Inserted: (e) Venue; Service of Process.--

   Inserted: (1) Venue.--Any action brought under subsection (a) may be brought in--

   Inserted: (A) the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code; or

   Inserted: (B) another court of competent jurisdiction.

   Inserted: (2) Service of process.--In an action brought under subsection (a), process may be served in any district in which the defendant--

   Inserted: (A) is an inhabitant; or

   Inserted: (B) may be found.

   Inserted: (f) No Private Cause of Action.--Nothing in this title establishes a private cause of action against a business entity for violation of any provision of this title.

   Inserted: SEC. 209. EFFECT ON FEDERAL AND STATE LAW.

   Inserted: For any entity, or agency that is subject to this title, the provisions of this title shall supersede any other provision of Federal law, or any provisions of the law of any State, relating to notification of a security breach, except as provided in section 204(b). Nothing in this title shall be construed to modify, limit, or supersede the operation of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.) or its implementing regulations, including those regulations adopted or enforced by States, the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1301 et seq.) or its implementing regulations, or the Health Information Technology for Economic and Clinical Health Act (42 U.S.C. 17937) or its implementing regulations.

   Inserted: SEC. 210. REPORTING ON EXEMPTIONS.

   Inserted: (a) FTC Report.--Not later than 18 months after the date of enactment of this Act, and upon request by Congress thereafter, the Federal Trade Commission shall submit a report to Congress on the number and nature of the security breaches described in the notices filed by those business entities invoking the risk assessment exemption under section 202(b) and their response to such notices.

   Inserted: (b) Law Enforcement Report.--

   Inserted: (1) In general.--Not later than 18 months after the date of enactment of this Act, and upon the request by Congress thereafter, the United States Secret Service and Federal Bureau of Investigation shall submit a report to Congress on the number and nature of security breaches subject to the national security and law enforcement exemptions under section 202(a).

   Inserted: (2) Requirement.--The report required under paragraph (1) shall not include the contents of any risk assessment provided to the United States Secret Service and the Federal Bureau of Investigation under this title.

   Inserted: SEC. 211. EFFECTIVE DATE.

   Inserted: This title shall take effect 90 days after the date of enactment of this Act.

   Inserted: TITLE III--COMPLIANCE WITH STATUTORY PAY-AS-YOU-GO ACT

   Inserted: SEC. 301. BUDGET COMPLIANCE.

   Inserted: The budgetary effects of this division, for the purpose of complying with the Statutory Pay-As-You-Go Act of 2010, shall be determined by reference to the latest statement titled "Budgetary Effects of PAYGO Legislation" for this division, submitted for printing in the Congressional Record by the Chairman of the Senate Budget Committee, provided that such statement has been submitted prior to the vote on passage.

   Original wording

   At the end, add the following:

Read automatically from the Congressional Record. Check the original before relying on it.

As printed