S.Amdt. 2733

SA 2733. Mr. BLUMENTHAL submitted an amendment intended to be
proposed to amendment SA 2716 proposed by Mr. Burr (for himself and
Mrs. Feinstein) to the bill S. 754, to improve cybersecurity in the
United States through enhanced sharing of information about
cybersecurity threats, and for other purposes; which was ordered to lie
on the table; as follows:

On page 48, between lines 6 and 7, insert the following:
(c) Private Right of Action for Violations by Federal
Entities of Restrictions on Disclosure, Use, and Protection
of Voluntarily Shared Cyber Threat Indicators.--
(1) In general.--If a department or agency of the Federal
Government knowingly or recklessly violates the requirements
of this Act with respect to the disclosure, use, or
protection of voluntarily shared cyber threat indicators, the
United States shall be liable to a person adversely affected
by such violation in an amount equal to the sum of--
(A) the actual damages sustained by the person as a result
of the violation or $50,000, whichever is greater; and
(B) the costs of the action together with reasonable
attorney fees as determined by the court.
(2) Venue.--An action to enforce liability created under
this subsection may be brought in the district court of the
United States in--
(A) the district in which the complainant resides;
(B) the district in which the principal place of business
of the complainant is located;
(C) the district in which the department or agency of the
Federal Government that disclosed the information is located;
or
(D) the District of Columbia.
(3) Statute of limitations.--No action shall lie under this
subsection unless such

[[Page S7418]]

action is commenced not later than two years after the person
adversely affected by a violation described in paragraph (1)
first learns, or by which such person reasonably should have
learned, of the facts and circumstances giving rise to the
action.
______