S.Amdt. 2584

SA 2584. Mr. BLUMENTHAL submitted an amendment intended to be proposed by him to the bill S. 754, to improve cybersecurity in the United States through enhanced sharing of information about cybersecurity threats, and for other purposes; which was ordered to lie on the table; as follows:

On page 44, between lines 5 and 6, insert the following:

(c) Private Right of Action for Violations by Federal Entities of Restrictions on Disclosure, Use, and Protection of Voluntarily Shared Cyber Threat Indicators.--

(1) In general.--If a department or agency of the Federal Government knowingly or recklessly violates the requirements of this Act with respect to the disclosure, use, or protection of voluntarily shared cyber threat indicators, the United States shall be liable to a person adversely affected by such violation in an amount equal to the sum of--

(A) the actual damages sustained by the person as a result of the violation or $50,000, whichever is greater; and

(B) the costs of the action together with reasonable attorney fees as determined by the court.

(2) Venue.--An action to enforce liability created under this subsection may be brought in the district court of the United States in--

(A) the district in which the complainant resides;

(B) the district in which the principal place of business of the complainant is located;

(C) the district in which the department or agency of the Federal Government that disclosed the information is located; or

(D) the District of Columbia.

(3) Statute of limitations.--No action shall lie under this subsection unless such action is commenced not later than two years after the person adversely affected by a violation described in paragraph (1) first learns, or by which such person reasonably should have learned, of the facts and circumstances giving rise to the action.