S. 115Senate109th Congress (2005-2007)In Committee

Notification of Risk to Personal Data Act

Introduced January 24, 2005

Legislative Activity

Stay on top of the latest movement without scrolling through every action

2 earlier actions
SenateIntro Referral Latest Action

Read twice and referred to the Committee on the Judiciary. (text of measure as introduced: CR S288-289)

January 24, 2005

View full timeline
SenateIntro Referral

Introduced in Senate

January 24, 2005

SenateIntro Referral

Sponsor introductory remarks on measure. (CR S287-288)

January 24, 2005

SenateIntro Referral

Read twice and referred to the Committee on the Judiciary. (text of measure as introduced: CR S288-289)

January 24, 2005

Floor Debate

24 members

What members said about S. 115 on the floor

11 Republicans13 Democrats
Dianne Feinstein
Sen. Dianne FeinsteinD-CA · Jan 24, 2005

Mr. President, on behalf of Senator Hutchison and myself, I rise today to introduce legislation to reauthorize the tremendously successful Breast Cancer Research Stamp for 2 additional years. Without…

Daniel K. Inouye
Sen. Daniel K. InouyeD-HI · Jan 24, 2005

Mr. President, today I introduce the United States Military Cancer Institute Research Collaborative Act. This legislation would formally establish the United States Military Cancer Institute (USMCI),…

Edward M. Kennedy
Sen. Edward M. KennedyD-MA · Jan 24, 2005

Mr. President, it's an honor to join our Democratic Leader and so many of our colleagues in introducing the Affordable Health Care Act. This legislation states our strong commitment as Democrats to…

Maria Cantwell
Sen. Maria CantwellD-WA · Jan 24, 2005

Mr. President, today I am joining my good friend the Senator from Texas, (Mrs. Hutchison), and the Senator from Tennessee, the Majority Leader, Mr. Frist, in legislation to permanently extend the…

Carl Levin
Sen. Carl LevinD-MI · Jan 24, 2005

Mr. President, I am honored to introduce the Standing with Our Troops Act of 2005. This bill addresses the needs of the Soldiers, Sailors, Airmen, and Marines who have responded so bravely to the…

Show 8 more
Russell D. Feingold
Sen. Russell D. FeingoldD-WI · Jan 24, 2005

Mr. President, I am pleased to reintroduce legislation that would put an end to automatic cost-of-living adjustments for congressional pay. As I have noted when I raised this issue in past years, it…

John F. Kerry
Sen. John F. KerryD-MA · Jan 24, 2005

Mr. President, as Ranking Member of the Small Business and Entrepreneurship Committee, today I am introducing a package of bills that will help small business owners with access to loans, business…

Paul S. Sarbanes
Sen. Paul S. SarbanesD-MD · Jan 24, 2005

Mr. President, today I am introducing the International Remittance Consumer Protection Act of 2005. This legislation extends basic consumer protection rights to those who send remittances, and it…

James M. Inhofe
Sen. James M. InhofeR-OK · Jan 24, 2005

Mr. President, I rise today, as an experienced pilot over age 60, along with my colleagues, Senator Stevens and Senator Burns, to introduce a bill that will help end age discrimination among airline…

Michael B. Enzi
Sen. Michael B. EnziR-WY · Jan 24, 2005

Mr. President, as reports continue to appear in the media, there can be little doubt that a critical area of homeland security, and one on which I will be focusing as Chairman of the Health,…

Kay Bailey Hutchison
Sen. Kay Bailey HutchisonR-TX · Jan 24, 2005

Mr. President, over the past decade, Congress has approved over $46 billion in disaster relief and emergency spending. This is an average of $4.6 billion a year. The majority of this funding--$34…

Larry E. Craig
Sen. Larry E. CraigR-ID · Jan 24, 2005

Mr. President, I rise to address an issue that has begun to emerge and gain our attention in rural America. This issue is an important one because it has the potential to devastate, economically,…

George Allen
Sen. George AllenR-VA · Jan 24, 2005

Mr. President, I rise to bring to my colleagues' attention a bill I introduced today called the Honoring the Fallen Soldiers and Families Act of 2005, sharing the same views of Senator Sessions of…

Show 11 more
Richard G. Lugar
Sen. Richard G. LugarR-IN · Jan 24, 2005

Mr. President, I rise today in support of a bill that I have introduced with Senator Carl Levin authorizing the extension of permanent normal trade relations treatment. Ukraine is still subject to…

Daniel K. Akaka
Sen. Daniel K. AkakaD-HI · Jan 24, 2005

Mr. President, I rise today to introduce a bill that would make sweeping changes to the way the Department of Veterans Affairs (VA) delivers health care and benefits to our nation's veterans. S. 13…

Frank R. Lautenberg
Sen. Frank R. LautenbergD-NJ · Jan 24, 2005

Mr. President, I rise today to speak about a bill that Senator Corzine and I are introducing, the New Jersey Coastal Heritage Trail Route bill. Our bill would reauthorize a law based on a bill that…

Herb Kohl
Sen. Herb KohlD-WI · Jan 24, 2005

Mr. President, today I am introducing the Weekend Voting Act. This legislation will change the day for Congressional and Presidential elections from the first Tuesday in November to the first weekend…

Mike DeWine
Sen. Mike DeWineR-OH · Jan 24, 2005

Mr. President, I rise today to honor the many families of our Nation's servicemen and women. We owe them a tremendous debt of gratitude for the services they have performed in supporting their family…

Wayne Allard
Sen. Wayne AllardR-CO · Jan 24, 2005

Mr. President, I would like to first express my gratitude to the leadership for making the Marriage Protection Amendment a priority in this Congress. The Marriage Protection Amendment is a…

Barbara Boxer
Sen. Barbara BoxerD-CA · Jan 24, 2005

Mr. President, I am introducing legislation today to name the courthouse in Sacramento, California, as the ``Robert T. Matsui United States Courthouse.'' I am pleased to be joined in this effort by…

George V. Voinovich
Sen. George V. VoinovichR-OH · Jan 24, 2005

Mr. President, I am pleased to join my friend and colleague from California, Senator Dianne Feinstein, in introducing very important legislation that I believe will encourage young teachers to go…

Olympia J. Snowe
Sen. Olympia J. SnoweR-ME · Jan 24, 2005

Mr. President, America's finest citizens and the world's greatest military men and women continue to put themselves in harm's way in support of the establishment of freedom and democracy in Iraq and…

Jeff Bingaman
Sen. Jeff BingamanD-NM · Jan 24, 2005

Mr. President, I ask unanimous consent that the text of the bill be printed in the Record. Mr. President, today, I am introducing along with Mr. Domenici the ``Pecos National Historical Park Land…

Jim Talent
Sen. Jim TalentR-MO · Jan 24, 2005

Mr. President, I ask unanimous consent that the text of the bill be printed in the Record. Mr. President, I am pleased to be introducing this bill, which will allow more owners of hybrid electric…

Bill Text

Latest available legislative text

Reading Mode
Latest
Introduced in SenateIssued January 24, 2005

II

109th CONGRESS

1st Session

S. 115

IN THE SENATE OF THE UNITED STATES

January 24, 2005

Mrs. Feinstein introduced the following bill; which was read twice and referred to the Committee on the Judiciary

A BILL

To require Federal agencies, and persons engaged in interstate commerce, in possession of electronic data containing personal information, to disclose any unauthorized acquisition of such information.

1.

Short title

This Act may be cited as the Notification of Risk to Personal Data Act.

2.

Definitions

In this Act, the following definitions shall apply:

(1)

Agency

The term agency has the same meaning given such term in section 551(1) of title 5, United States Code.

(2)

Breach of security of the system

The term breach of security of the system—

(A)

means the compromise of the security, confidentiality, or integrity of computerized data that results in, or there is a reasonable basis to conclude has resulted in, the unauthorized acquisition of and access to personal information maintained by the person or business; and

(B)

does not include good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business, if the personal information is not used or subject to further unauthorized disclosure.

(3)

Person

The term person has the same meaning given such term in section 551(2) of title 5, United States Code.

(4)

Personal information

The term personal information means an individual’s last name in combination with any 1 or more of the following data elements, when either the name or the data elements are not encrypted:

(A)

Social security number.

(B)

Driver’s license number or State identification number.

(C)

Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account.

(5)

Substitute notice

The term substitute notice means—

(A)

e-mail notice, if the agency or person has an e-mail address for the subject persons;

(B)

conspicuous posting of the notice on the Internet site of the agency or person, if the agency or person maintains an Internet site; or

(C)

notification to major media.

3.

Database security

(a)

Disclosure of security breach

(1)

In general

Any agency, or person engaged in interstate commerce, that owns or licenses electronic data containing personal information shall, following the discovery of a breach of security of the system containing such data, notify any resident of the United States whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

(2)

Notification of owner or licensee

Any agency, or person engaged in interstate commerce, in possession of electronic data containing personal information that the agency does not own or license shall notify the owner or licensee of the information if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person through a breach of security of the system containing such data.

(3)

Timeliness of notification

Except as provided in paragraph (4), all notifications required under paragraph (1) or (2) shall be made as expediently as possible and without unreasonable delay following—

(A)

the discovery by the agency or person of a breach of security of the system; and

(B)

any measures necessary to determine the scope of the breach, prevent further disclosures, and restore the reasonable integrity of the data system.

(4)

Delay of notification authorized for law enforcement purposes

If a law enforcement agency determines that the notification required under this subsection would impede a criminal investigation, such notification may be delayed until such law enforcement agency determines that the notification will no longer compromise such investigation.

(5)

Methods of notice

An agency, or person engaged in interstate commerce, shall be in compliance with this subsection if it provides the resident, owner, or licensee, as appropriate, with—

(A)

written notification;

(B)

e-mail notice, if the person or business has an e-mail address for the subject person; or

(C)

substitute notice, if—

(i)

the agency or person demonstrates that the cost of providing direct notice would exceed $250,000;

(ii)

the affected class of subject persons to be notified exceeds 500,000; or

(iii)

the agency or person does not have sufficient contact information for those to be notified.

(6)

Alternative notification procedures

Notwithstanding any other obligation under this subsection, an agency, or person engaged in interstate commerce, shall be deemed to be in compliance with this subsection if the agency or person—

(A)

maintains its own reasonable notification procedures as part of an information security policy for the treatment of personal information; and

(B)

notifies subject persons in accordance with its information security policy in the event of a breach of security of the system.

(7)

Reasonable notification procedures

As used in paragraph (6), with respect to a breach of security of the system involving personal information described in section 2(4)(C), the term reasonable notification procedures means procedures that—

(A)

use a security program reasonably designed to block unauthorized transactions before they are charged to the customer’s account;

(B)

provide for notice to be given by the owner or licensee of the database, or another party acting on behalf of such owner or licensee, after the security program indicates that the breach of security of the system has resulted in fraud or unauthorized transactions, but does not necessarily require notice in other circumstances; and

(C)

are subject to examination for compliance with the requirements of this Act by 1 or more Federal functional regulators (as defined in section 509 of the Gramm-Leach Bliley Act (15 U.S.C. 6809)), with respect to the operation of the security program and the notification procedures.

(b)

Civil remedies

(1)

Penalties

Any agency, or person engaged in interstate commerce, that violates this section shall be subject to a fine of not more than $5,000 per violation, to a maximum of $25,000 per day while such violations persist.

(2)

Equitable relief

Any person engaged in interstate commerce that violates, proposes to violate, or has violated this section may be enjoined from further violations by a court of competent jurisdiction.

(3)

Other rights and remedies

The rights and remedies available under this subsection are cumulative and shall not affect any other rights and remedies available under law.

(c)

Enforcement

The Federal Trade Commission is authorized to enforce compliance with this section, including the assessment of fines under subsection (b)(1).

4.

Enforcement by State attorneys general

(a)

In general

(1)

Civil actions

In any case in which the attorney general of a State has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by the engagement of any person in a practice that is prohibited under this Act, the State, as parens patriae, may bring a civil action on behalf of the residents of the State in a district court of the United States of appropriate jurisdiction to—

(A)

enjoin that practice;

(B)

enforce compliance with this Act;

(C)

obtain damage, restitution, or other compensation on behalf of residents of the State; or

(D)

obtain such other relief as the court may consider to be appropriate.

(2)

Notice

(A)

In general

Before filing an action under paragraph (1), the attorney general of the State involved shall provide to the Attorney General—

(i)

written notice of the action; and

(ii)

a copy of the complaint for the action.

(B)

Exemption

(i)

In general

Subparagraph (A) shall not apply with respect to the filing of an action by an attorney general of a State under this subsection, if the State attorney general determines that it is not feasible to provide the notice described in such subparagraph before the filing of the action.

(ii)

Notification

In an action described in clause (i), the attorney general of a State shall provide notice and a copy of the complaint to the Attorney General at the time the State attorney general files the action.

(b)

Construction

For purposes of bringing any civil action under subsection (a), nothing in this Act shall be construed to prevent an attorney general of a State from exercising the powers conferred on such attorney general by the laws of that State to—

(1)

conduct investigations;

(2)

administer oaths or affirmations; or

(3)

compel the attendance of witnesses or the production of documentary and other evidence.

(c)

Venue; service of process

(1)

Venue

Any action brought under subsection (a) may be brought in the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code.

(2)

Service of process

In an action brought under subsection (a), process may be served in any district in which the defendant—

(A)

is an inhabitant; or

(B)

may be found.

5.

Effect on State law

The provisions of this Act shall supersede any inconsistent provisions of law of any State or unit of local government relating to the notification of any resident of the United States of any breach of security of an electronic database containing such resident’s personal information (as defined in this Act), except as provided under sections 1798.82 and 1798.29 of the California Civil Code.

6.

Effective date

This Act shall take effect on the expiration of the date which is 6 months after the date of enactment of this Act.