S. 1350Senate108th Congress (2003-2005)In Committee

Notification of Risk to Personal Data Act

Introduced June 26, 2003

Legislative Activity

Stay on top of the latest movement without scrolling through every action

3 earlier actions
SenateCommittee Latest Action

Committee on the Judiciary Subcommittee on Terrorism, Technology and Homeland Security. Hearings held. With printed Hearing: S.Hrg. 108-520.

November 4, 2003

View full timeline
SenateIntro Referral

Introduced in Senate

June 26, 2003

SenateIntro Referral

Sponsor introductory remarks on measure. (CR S8738-8739)

June 26, 2003

SenateIntro Referral

Read twice and referred to the Committee on the Judiciary. (text of measure as introduced: CR S8739-8740)

June 26, 2003

SenateCommittee

Committee on the Judiciary Subcommittee on Terrorism, Technology and Homeland Security. Hearings held. With printed Hearing: S.Hrg. 108-520.

November 4, 2003

Floor Debate

17 members

What members said about S. 1350 on the floor

6 Republicans11 Democrats
Dianne Feinstein
Sen. Dianne FeinsteinD-CA · Jun 26, 2003

Mr. President, I rise today to introduce legislation to amend the Graton Rancheria Restoration Act to give the State of California and the local communities of Sonoma, Napa, and Marin counties the…

Carl Levin
Sen. Carl LevinD-MI · Jun 26, 2003

Mr. President, I ask unanimous consent that the text of the Keweenaw National Historical Park bill be printed in the Record. Mr. President, I am pleased to join Senators Akaka, Grassley, Leahy, and…

Mitch McConnell
Sen. Mitch McConnellR-KY · Jun 26, 2003

Mr. President, today, along with my colleagues Senators Kyl and Leahy, I offer the ``Cambodia Democracy and Accountability Act of 2003''. This Act is particularly timely, given that national…

Maria Cantwell
Sen. Maria CantwellD-WA · Jun 26, 2003

Mr. President, I come to the floor today to discuss a topic that I believe is critical to our Nation's economic growth and future competitiveness--the training of our workforce. We are living in…

Lisa Murkowski
Sen. Lisa MurkowskiR-AK · Jun 26, 2003

Mr. President, I rise today to reintroduce a bill that passed the Senate with bipartisan support in the 107th Congress. This legislation addresses an equity issue for one of Alaska's rural village…

Show 8 more
Dianne Feinstein
Sen. Dianne FeinsteinD-CA · Jun 26, 2003

Mr. President, I rise to introduce the Notification of Risk to Personal Data Act of 2003. This legislation will require that individuals are notified when their most sensitive personal information is…

Bob Graham
Sen. Bob GrahamD-FL · Jun 26, 2003

Mr. President, I rise today to introduce legislation that will authorize additional judgeships in the Middle and Southern Federal Judicial Districts of Florida. Additional judgeships are needed in…

Jon S. Corzine
Sen. Jon S. CorzineD-NJ · Jun 26, 2003

Mr. President, today, along with my distinguished colleagues Senators Schumer, Akaka, and Boxer, I am introducing ``The Money Wire Improvement and Remittance Enhancement Act'' (The ``Money WIRE…

Barbara Boxer
Sen. Barbara BoxerD-CA · Jun 26, 2003

Mr. President, today, I am introducing the International Remittances Services Enhancement and Protection Act of 2003. Remittances are the funds that immigrants send to their families abroad to help…

Daniel K. Akaka
Sen. Daniel K. AkakaD-HI · Jun 26, 2003

Mr. President, I rise as a cosponsor of the Money Wire Improvement and Remittance Enhancement Act introduced by my colleague, Senator Corzine. I thank Senator Corzine for his leadership on this…

Patty Murray
Sen. Patty MurrayD-WA · Jun 26, 2003

Mr. President, I rise today to introduce legislation that will greatly enhance Federal participation in financing and improving our Nation's ferry transportation system. Today I am introducing the…

Gordon H. Smith
Sen. Gordon H. SmithR-OR · Jun 26, 2003

Mr. President, on behalf of myself and my colleagues, Mr. Kohl of Wisconsin, Mrs. Boxer of California, Mr. Cornyn of Texas, Mr. Feingold of Wisconsin, Mrs. Hutchison of Texas, Ms. Murkowski of…

Russell D. Feingold
Sen. Russell D. FeingoldD-WI · Jun 26, 2003

Mr. President, I am pleased to join with my colleague from Colorado, Mr. Allard, as a cosponsor of the Chronic Wasting Disease Financial Assistance Act of 2003. This legislation is similar to…

Show 5 more
Harry Reid
Sen. Harry ReidD-NV · Jun 26, 2003

Mr. President, as thousands of families look forward to summer vacations at our beautiful national parks, we must address an issue that could one day ruin their experience: privatization of the…

Ron Wyden
Sen. Ron WydenD-OR · Jun 26, 2003

Mr. President: Today, I introduce, for myself and Mrs. Feinstein, the Community and Forest Protection Act. I ask unanimous consent that the text of the bill to be printed in the Record.

William H. Frist
Sen. William H. FristR-TN · Jun 26, 2003

Mr. President, I ask unanimous consent that the text of the bill be printed in the Record.

Sam Brownback
Sen. Sam BrownbackR-KS · Jun 26, 2003

Mr. President, I ask unanimous consent that the text of the bill be printed in the Record.

Wayne Allard
Sen. Wayne AllardR-CO · Jun 26, 2003

Mr. President, I ask unanimous consent that the text of the bill be printed in the Record.

Bill Text

Latest available legislative text

Reading Mode
Latest
Introduced in SenateIssued June 26, 2003
        [Congressional Bills 108th Congress]
[From the U.S. Government Publishing Office]
[S. 1350 Introduced in Senate (IS)]

108th CONGRESS
1st Session
S. 1350

To require Federal agencies, and persons engaged in interstate
commerce, in possession of electronic data containing personal
information, to disclose any unauthorized acquisition of such
information.

_______________________________________________________________________

IN THE SENATE OF THE UNITED STATES

June 26, 2003

Mrs. Feinstein introduced the following bill; which was read twice and
referred to the Committee on the Judiciary

_______________________________________________________________________

A BILL

To require Federal agencies, and persons engaged in interstate
commerce, in possession of electronic data containing personal
information, to disclose any unauthorized acquisition of such
information.

Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

This Act may be cited as the ``Notification of Risk to Personal
Data Act''.

SEC. 2. DEFINITIONS.

In this Act, the following definitions shall apply:
(1) Agency.--The term ``agency'' has the same meaning given
such term in section 551(1) of title 5, United States Code.
(2) Breach of security of the system.--The term ``breach of
security of the system''--
(A) means the compromise of the security,
confidentiality, or integrity of computerized data that
results in, or there is a reasonable basis to conclude
has resulted in, the unauthorized acquisition of and
access to personal information maintained by the person
or business; and
(B) does not include good faith acquisition of
personal information by an employee or agent of the
person or business for the purposes of the person or
business, if the personal information is not used or
subject to further unauthorized disclosure.
(3) Person.--The term ``person'' has the same meaning given
such term in section 551(2) of title 5, United States Code.
(4) Personal information.--The term ``personal
information'' means an individual's last name in combination
with any 1 or more of the following data elements, when either
the name or the data elements are not encrypted:
(A) Social security number.
(B) Driver's license number or State identification
number.
(C) Account number, credit or debit card number, in
combination with any required security code, access
code, or password that would permit access to an
individual's financial account.
(5) Substitute notice.--The term ``substitute notice''
means--
(A) e-mail notice, if the agency or person has an
e-mail address for the subject persons;
(B) conspicuous posting of the notice on the
Internet site of the agency or person, if the agency or
person maintains an Internet site; or
(C) notification to major media.

SEC. 3. DATABASE SECURITY.

(a) Disclosure of Security Breach.--
(1) In general.--Any agency, or person engaged in
interstate commerce, that owns or licenses electronic data
containing personal information shall, following the discovery
of a breach of security of the system containing such data,
notify any resident of the United States whose unencrypted
personal information was, or is reasonably believed to have
been, acquired by an unauthorized person.
(2) Notification of owner or licensee.--Any agency, or
person engaged in interstate commerce, in possession of
electronic data containing personal information that the agency
does not own or license shall notify the owner or licensee of
the information if the personal information was, or is
reasonably believed to have been, acquired by an unauthorized
person through a breach of security of the system containing
such data.
(3) Timeliness of notification.--Except as provided in
paragraph (4), all notifications required under paragraph (1)
or (2) shall be made as expediently as possible and without
unreasonable delay following--
(A) the discovery by the agency or person of a
breach of security of the system; and
(B) any measures necessary to determine the scope
of the breach, prevent further disclosures, and restore
the reasonable integrity of the data system.
(4) Delay of notification authorized for law enforcement
purposes.--If a law enforcement agency determines that the
notification required under this subsection would impede a
criminal investigation, such notification may be delayed until
such law enforcement agency determines that the notification
will no longer compromise such investigation.
(5) Methods of notice.--An agency, or person engaged in
interstate commerce, shall be in compliance with this
subsection if it provides the resident, owner, or licensee, as
appropriate, with--
(A) written notification;
(B) e-mail notice, if the person or business has an
e-mail address for the subject person; or
(C) substitute notice, if--
(i) the agency or person demonstrates that
the cost of providing direct notice would
exceed $250,000;
(ii) the affected class of subject persons
to be notified exceeds 500,000; or
(iii) the agency or person does not have
sufficient contact information for those to be
notified.
(6) Alternative notification procedures.--Notwithstanding
any other obligation under this subsection, an agency, or
person engaged in interstate commerce, shall be deemed to be in
compliance with this subsection if the agency or person--
(A) maintains its own reasonable notification
procedures as part of an information security policy
for the treatment of personal information; and
(B) notifies subject persons in accordance with its
information security policy in the event of a breach of
security of the system.
(7) Reasonable notification procedures.--As used in
paragraph (6), with respect to a breach of security of the
system involving personal information described in section
2(4)(C), the term ``reasonable notification procedures'' means
procedures that--
(A) use a security program reasonably designed to
block unauthorized transactions before they are charged
to the customer's account;
(B) provide for notice to be given by the owner or
licensee of the database, or another party acting on
behalf of such owner or licensee, after the security
program indicates that the breach of security of the
system has resulted in fraud or unauthorized
transactions, but does not necessarily require notice
in other circumstances; and
(C) are subject to examination for compliance with
the requirements of this Act by 1 or more Federal
functional regulators (as defined in section 509 of the
Gramm-Leach Bliley Act (15 U.S.C. 6809)), with respect
to the operation of the security program and the
notification procedures.
(b) Civil Remedies.--
(1) Penalties.--Any agency, or person engaged in interstate
commerce, that violates this section shall be subject to a fine
of not more than $5,000 per violation, to a maximum of $25,000
per day while such violations persist.
(2) Equitable relief.--Any person engaged in interstate
commerce that violates, proposes to violate, or has violated
this section may be enjoined from further violations by a court
of competent jurisdiction.
(3) Other rights and remedies.--The rights and remedies
available under this subsection are cumulative and shall not
affect any other rights and remedies available under law.
(c) Enforcement.--The Federal Trade Commission is authorized to
enforce compliance with this section, including the assessment of fines
under subsection (b)(1).

SEC. 4. ENFORCEMENT BY STATE ATTORNEYS GENERAL.

(a) In General.--
(1) Civil actions.--In any case in which the attorney
general of a State has reason to believe that an interest of
the residents of that State has been or is threatened or
adversely affected by the engagement of any person in a
practice that is prohibited under this Act, the State, as
parens patriae, may bring a civil action on behalf of the
residents of the State in a district court of the United States
of appropriate jurisdiction to--
(A) enjoin that practice;
(B) enforce compliance with this Act;
(C) obtain damage, restitution, or other
compensation on behalf of residents of the State; or
(D) obtain such other relief as the court may
consider to be appropriate.
(2) Notice.--
(A) In general.--Before filing an action under
paragraph (1), the attorney general of the State
involved shall provide to the Attorney General--
(i) written notice of the action; and
(ii) a copy of the complaint for the
action.
(B) Exemption.--
(i) In general.--Subparagraph (A) shall not
apply with respect to the filing of an action
by an attorney general of a State under this
subsection, if the State attorney general
determines that it is not feasible to provide
the notice described in such subparagraph
before the filing of the action.
(ii) Notification.--In an action described
in clause (i), the attorney general of a State
shall provide notice and a copy of the
complaint to the Attorney General at the time
the State attorney general files the action.
(b) Construction.--For purposes of bringing any civil action under
subsection (a), nothing in this Act shall be construed to prevent an
attorney general of a State from exercising the powers conferred on
such attorney general by the laws of that State to--
(1) conduct investigations;
(2) administer oaths or affirmations; or
(3) compel the attendance of witnesses or the production of
documentary and other evidence.
(c) Venue; Service of Process.--
(1) Venue.--Any action brought under subsection (a) may be
brought in the district court of the United States that meets
applicable requirements relating to venue under section 1391 of
title 28, United States Code.
(2) Service of process.--In an action brought under
subsection (a), process may be served in any district in which
the defendant--
(A) is an inhabitant; or
(B) may be found.

SEC. 5. EFFECT ON STATE LAW.

The provisions of this Act shall supersede any inconsistent
provisions of law of any State or unit of local government relating to
the notification of any resident of the United States of any breach of
security of an electronic database containing such resident's personal
information (as defined in this Act), except as provided under sections
1798.82 and 1798.29 of the California Civil Code.

SEC. 6. EFFECTIVE DATE.

This Act shall take effect on the expiration of the date which is 6
months after the date of enactment of this Act.
<all>