[Congressional Bills 109th Congress]
[From the U.S. Government Publishing Office]
[S. 1789 Reported in Senate (RS)]
Calendar No. 297
109th CONGRESS
1st Session
S. 1789
To prevent and mitigate identity theft, to ensure privacy, to provide
notice of security breaches, and to enhance criminal penalties, law
enforcement assistance, and other protections against security
breaches, fraudulent access, and misuse of personally identifiable
information.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
September 29, 2005
Mr. Specter (for himself, Mr. Leahy, Mrs. Feinstein, and Mr. Feingold)
introduced the following bill; which was read twice and referred to the
Committee on the Judiciary
November 17, 2005
Reported by Mr. Specter, with an amendment
[Strike out all after the enacting clause and insert the part printed
in italic]
_______________________________________________________________________
A BILL
To prevent and mitigate identity theft, to ensure privacy, to provide
notice of security breaches, and to enhance criminal penalties, law
enforcement assistance, and other protections against security
breaches, fraudulent access, and misuse of personally identifiable
information.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
<DELETED>SECTION 1. SHORT TITLE; TABLE OF CONTENTS.</DELETED>
<DELETED> (a) Short Title.--This Act may be cited as the ``Personal
Data Privacy and Security Act of 2005''.</DELETED>
<DELETED> (b) Table of Contents.--The table of contents for this Act
is as follows:</DELETED>
<DELETED>Sec. 1. Short title; table of contents.
<DELETED>Sec. 2. Findings.
<DELETED>Sec. 3. Definitions.
<DELETED>TITLE I--ENHANCING PUNISHMENT FOR IDENTITY THEFT AND OTHER
VIOLATIONS OF DATA PRIVACY AND SECURITY
<DELETED>Sec. 101. Fraud and related criminal activity in connection
with unauthorized access to personally
identifiable information.
<DELETED>Sec. 102. Organized criminal activity in connection with
unauthorized access to personally
identifiable information.
<DELETED>Sec. 103. Concealment of security breaches involving sensitive
personally identifiable information.
<DELETED>Sec. 104. Aggravated fraud in connection with computers.
<DELETED>Sec. 105. Review and amendment of Federal sentencing
guidelines related to fraudulent access to
or misuse of digitized or electronic
personally identifiable information.
<DELETED>TITLE II--ASSISTANCE FOR STATE AND LOCAL LAW ENFORCEMENT
COMBATING CRIMES RELATED TO FRAUDULENT, UNAUTHORIZED, OR OTHER CRIMINAL
USE OF PERSONALLY IDENTIFIABLE INFORMATION
<DELETED>Sec. 201. Grants for State and local enforcement.
<DELETED>Sec. 202. Authorization of appropriations.
<DELETED>TITLE III--DATA BROKERS
<DELETED>Sec. 301. Transparency and accuracy of data collection.
<DELETED>Sec. 302. Enforcement.
<DELETED>Sec. 303. Relation to State laws.
<DELETED>Sec. 304. Effective date.
<DELETED>TITLE IV--PRIVACY AND SECURITY OF PERSONALLY IDENTIFIABLE
INFORMATION
<DELETED>Subtitle A--Data Privacy and Security Program
<DELETED>Sec. 401. Purpose and applicability of data privacy and
security program.
<DELETED>Sec. 402. Requirements for a personal data privacy and
security program.
<DELETED>Sec. 403. Enforcement.
<DELETED>Sec. 404. Relation to State laws.
<DELETED>Subtitle B--Security Breach Notification
<DELETED>Sec. 421. Right to notice of security breach.
<DELETED>Sec. 422. Notice procedures.
<DELETED>Sec. 423. Content of notice.
<DELETED>Sec. 424. Risk assessment and fraud prevention notice
exemptions.
<DELETED>Sec. 425. Victim protection assistance.
<DELETED>Sec. 426. Enforcement.
<DELETED>Sec. 427. Relation to State laws.
<DELETED>Sec. 428. Study on securing personally identifiable
information in the digital era.
<DELETED>Sec. 429. Reporting on risk assessment exemption.
<DELETED>Sec. 430. Authorization of appropriations.
<DELETED>Sec. 431. Reporting on risk assessment exemption.
<DELETED>Sec. 432. Effective date.
<DELETED>TITLE V--GOVERNMENT ACCESS TO AND USE OF COMMERCIAL DATA
<DELETED>Sec. 501. General Services Administration review of contracts.
<DELETED>Sec. 502. Requirement to audit information security practices
of contractors and third party business
entities.
<DELETED>Sec. 503. Privacy impact assessment of government use of
commercial information services containing
personally identifiable information.
<DELETED>Sec. 504. Implementation of Chief Privacy Officer
requirements.
<DELETED>SEC. 2. FINDINGS.</DELETED>
<DELETED> Congress finds that--</DELETED>
<DELETED> (1) databases of personally identifiable
information are increasingly prime targets of hackers, identity
thieves, rogue employees, and other criminals, including
organized and sophisticated criminal operations;</DELETED>
<DELETED> (2) identity theft is a serious threat to the
nation's economic stability, homeland security, the development
of e-commerce, and the privacy rights of Americans;</DELETED>
<DELETED> (3) over 9,300,000 individuals were victims of
identity theft in America last year;</DELETED>
<DELETED> (4) security breaches are a serious threat to
consumer confidence, homeland security, e-commerce, and
economic stability;</DELETED>
<DELETED> (5) it is important for business entities that
own, use, or license personally identifiable information to
adopt reasonable procedures to ensure the security, privacy,
and confidentially of that personally identifiable
information;</DELETED>
<DELETED> (6) individuals whose personal information has
been compromised or who have been victims of identity theft
should receive the necessary information and assistance to
mitigate their damages and to restore the integrity of their
personal information and identities;</DELETED>
<DELETED> (7) data brokers have assumed a significant role
in providing identification, authentication, and screening
services, and related data collection and analyses for
commercial, nonprofit, and government operations;</DELETED>
<DELETED> (8) data misuse and use of inaccurate data have
the potential to cause serious or irreparable harm to an
individual's livelihood, privacy, and liberty and undermine
efficient and effective business and government
operations;</DELETED>
<DELETED> (9) there is a need to insure that data brokers
conduct their operations in a manner that prioritizes fairness,
transparency, accuracy, and respect for the privacy of
consumers;</DELETED>
<DELETED> (10) government access to commercial data can
potentially improve safety, law enforcement, and national
security; and</DELETED>
<DELETED> (11) because government use of commercial data
containing personal information potentially affects individual
privacy, and law enforcement and national security operations,
there is a need for Congress to exercise oversight over
government use of commercial data.</DELETED>
<DELETED>SEC. 3. DEFINITIONS.</DELETED>
<DELETED> In this Act:</DELETED>
<DELETED> (1) Agency.--The term ``agency'' has the same
meaning given such term in section 551 of title 5, United
States Code.</DELETED>
<DELETED> (2) Affiliate.--The term ``affiliate'' means
persons related by common ownership or by corporate
control.</DELETED>
<DELETED> (3) Business entity.--The term ``business entity''
means any organization, corporation, trust, partnership, sole
proprietorship, unincorporated association, venture established
to make a profit, or nonprofit, and any contractor,
subcontractor, affiliate, or licensee thereof engaged in
interstate commerce.</DELETED>
<DELETED> (4) Identity theft.--The term ``identity theft''
means a violation of section 1028 of title 18, United States
Code, or any other similar provision of applicable State
law.</DELETED>
<DELETED> (5) Data broker.--The term ``data broker'' means a
business entity which for monetary fees, dues, or on a
cooperative nonprofit basis, currently or regularly engages, in
whole or in part, in the practice of collecting, transmitting,
or providing access to sensitive personally identifiable
information primarily for the purposes of providing such
information to nonaffiliated third parties on a nationwide
basis on more than 5,000 individuals who are not the customers
or employees of the business entity or affiliate.</DELETED>
<DELETED> (6) Data furnisher.--The term ``data furnisher''
means any agency, governmental entity, organization,
corporation, trust, partnership, sole proprietorship,
unincorporated association, venture established to make a
profit, or nonprofit, and any contractor, subcontractor,
affiliate, or licensee thereof, that serves as a source of
information for a data broker.</DELETED>
<DELETED> (7) Personal electronic record.--The term
``personal electronic record'' means data associated with an
individual contained in a database, networked or integrated
databases, or other data system that holds sensitive personally
identifiable information of that individual and is provided to
non-affiliated third parties.</DELETED>
<DELETED> (8) Personally identifiable information.--The term
``personally identifiable information'' means any information,
or compilation of information, in electronic or digital form
serving as a means of identification, as defined by section
1028(d)(7) of title 18, United State Code.</DELETED>
<DELETED> (9) Public record source.--The term ``public
record source'' means any agency, Federal court, or State court
that maintains personally identifiable information in records
available to the public.</DELETED>
<DELETED> (10) Security breach.--</DELETED>
<DELETED> (A) In general.--The term ``security
breach'' means compromise of the security,
confidentiality, or integrity of computerized data
through misrepresentation or actions that result in, or
there is a reasonable basis to conclude has resulted
in, the unauthorized acquisition of and access to
sensitive personally identifiable
information.</DELETED>
<DELETED> (B) Exclusion.--The term ``security
breach'' does not include--</DELETED>
<DELETED> (i) a good faith acquisition of
sensitive personally identifiable information
by a business entity or agency, or an employee
or agent of a business entity or agency, if the
sensitive personally identifiable information
is not subject to further unauthorized
disclosure; or</DELETED>
<DELETED> (ii) the release of a public
record not otherwise subject to confidentiality
or nondisclosure requirements.</DELETED>
<DELETED> (11) Sensitive personally identifiable
information.--The term ``sensitive personally identifiable
information'' means any information or compilation of
information, in electronic or digital form that
includes:</DELETED>
<DELETED> (A) An individual's name in combination
with any 1 of the following data elements:</DELETED>
<DELETED> (i) A non-truncated social
security number, driver's license number,
passport number, or alien registration
number.</DELETED>
<DELETED> (ii) Any 2 of the
following:</DELETED>
<DELETED> (I) Information that
relates to--</DELETED>
<DELETED> (aa) the past,
present, or future physical or
mental health or condition of
an individual;</DELETED>
<DELETED> (bb) the provision
of health care to an
individual; or</DELETED>
<DELETED> (cc) the past,
present, or future payment for
the provision of health care to
an individual.</DELETED>
<DELETED> (II) Home address or
telephone number.</DELETED>
<DELETED> (III) Mother's maiden
name, if identified as such.</DELETED>
<DELETED> (IV) Month, day, and year
of birth.</DELETED>
<DELETED> (iii) Unique biometric data such
as a finger print, voice print, a retina or
iris image, or any other unique physical
representation.</DELETED>
<DELETED> (iv) A unique electronic
identification number, user name, or routing
code in combination with the associated
security code, access code, or
password.</DELETED>
<DELETED> (v) Any other information
regarding an individual determined appropriate
by the Federal Trade Commission.</DELETED>
<DELETED> (B) A financial account number or credit
or debit card number in combination with the required
security code, access code, or password.</DELETED>
<DELETED>TITLE I--ENHANCING PUNISHMENT FOR IDENTITY THEFT AND OTHER
VIOLATIONS OF DATA PRIVACY AND SECURITY</DELETED>
<DELETED>SEC. 101. FRAUD AND RELATED CRIMINAL ACTIVITY IN CONNECTION
WITH UNAUTHORIZED ACCESS TO PERSONALLY IDENTIFIABLE
INFORMATION.</DELETED>
<DELETED> Section 1030(a)(2) of title 18, United States Code, is
amended--</DELETED>
<DELETED> (1) in subparagraph (B), by striking ``or'' after
the semicolon;</DELETED>
<DELETED> (2) in subparagraph (C), by inserting ``or'' after
the semicolon; and</DELETED>
<DELETED> (3) by adding at the end the following:</DELETED>
<DELETED> ``(D) information contained in the
databases or systems of a data broker, or in other
personal electronic records, as such terms are defined
in section 3 of the Personal Data Privacy and Security
Act of 2005;''.</DELETED>
<DELETED>SEC. 102. ORGANIZED CRIMINAL ACTIVITY IN CONNECTION WITH
UNAUTHORIZED ACCESS TO PERSONALLY IDENTIFIABLE
INFORMATION.</DELETED>
<DELETED> Section 1961(1) of title 18, United States Code, is
amended by inserting ``section 1030(a)(2)(D)(relating to fraud and
related activity in connection with unauthorized access to personally
identifiable information,'' before ``section 1084''.</DELETED>
<DELETED>SEC. 103. CONCEALMENT OF SECURITY BREACHES INVOLVING SENSITIVE
PERSONALLY IDENTIFIABLE INFORMATION.</DELETED>
<DELETED> (a) In General.--Chapter 47 of title 18, United States
Code, is amended by adding at the end the following:</DELETED>
<DELETED>``Sec. 1039. Concealment of security breaches involving
sensitive personally identifiable information</DELETED>
<DELETED> ``(a) Whoever, having knowledge of a security breach and
the obligation to provide notice of such breach to individuals under
title IV of the Personal Data Privacy and Security Act of 2005, and
having not otherwise qualified for an exemption from providing notice
under section 422 of such Act, intentionally and willfully conceals the
fact of such security breach which causes economic damages to 1 or more
persons, shall be fined under this title or imprisoned not more than 5
years, or both.</DELETED>
<DELETED> ``(b) For purposes of subsection (a), the term `person'
means any individual, corporation, company, association, firm,
partnership, society, or joint stock company.''.</DELETED>
<DELETED> (b) Conforming and Technical Amendments.--The table of
sections for chapter 47 of title 18, United States Code, is amended by
adding at the end the following:</DELETED>
<DELETED>``1039. Concealment of security breaches involving personally
identifiable information.''.
<DELETED> (c) Enforcement Authority.--The United States Secret
Service shall have the authority to investigate offenses under this
section.</DELETED>
<DELETED>SEC. 104. AGGRAVATED FRAUD IN CONNECTION WITH
COMPUTERS.</DELETED>
<DELETED> (a) In General.--Chapter 47 of title 18, United States
Code, is amended by adding after section 1030 the following:</DELETED>
<DELETED>``Sec. 1030A. Aggravated fraud in connection with
computers</DELETED>
<DELETED> ``(a) In General.--Whoever, during and in relation to any
felony violation enumerated in subsection (c), knowingly obtains,
accesses, or transmits, without lawful authority, a means of
identification of another person may, in addition to the punishment
provided for such felony, be sentenced to a term of imprisonment of up
to 2 years.</DELETED>
<DELETED> ``(b) Consecutive Sentences.--Notwithstanding any other
provision of law, should a court in its discretion impose an additional
sentence under subsection (a)--</DELETED>
<DELETED> ``(1) no term of imprisonment imposed on a person
under this section shall run concurrently, except as provided
in paragraph (3), with any other term of imprisonment imposed
on such person under any other provision of law, including any
term of imprisonment imposed for the felony during which the
means of identifications was obtained, accessed, or
transmitted;</DELETED>
<DELETED> ``(2) in determining any term of imprisonment to
be imposed for the felony during which the means of
identification was obtained, accessed, or transmitted, a court
shall not in any way reduce the term to be imposed for such
crime so as to compensate for, or otherwise take into account,
any separate term of imprisonment imposed or to be imposed for
a violation of this section; and</DELETED>
<DELETED> ``(3) a term of imprisonment imposed on a person
for a violation of this section may, in the discretion of the
court, run concurrently, in whole or in part, only with another
term of imprisonment that is imposed by the court at the same
time on that person for an additional violation of this
section.</DELETED>
<DELETED> ``(c) Definition.--For purposes of this section, the term
`felony violation enumerated in subsection (c)' means any offense that
is a felony violation of paragraphs (2) through (7) of section
1030(a).''.</DELETED>
<DELETED> (b) Conforming and Technical Amendments.--The table of
sections for chapter 47 of title 18, United States Code, is amended by
inserting after the item relating to section 1030 the following new
item:</DELETED>
<DELETED>``1030A. Aggravated fraud in connection with computers.''.
<DELETED>SEC. 105. REVIEW AND AMENDMENT OF FEDERAL SENTENCING
GUIDELINES RELATED TO FRAUDULENT ACCESS TO OR MISUSE OF
DIGITIZED OR ELECTRONIC PERSONALLY IDENTIFIABLE
INFORMATION.</DELETED>
<DELETED> (a) Review and Amendment.--Not later than 180 days after
the date of enactment of this Act, the United States Sentencing
Commission, pursuant to its authority under section 994 of title 28,
United States Code, and in accordance with this section, shall review
and, if appropriate, amend the Federal sentencing guidelines (including
its policy statements) applicable to persons convicted of using fraud
to access, or misuse of, digitized or electronic personally
identifiable information, including identity theft or any offense
under--</DELETED>
<DELETED> (1) sections 1028, 1028A, 1030, 1030A, 2511, and
2701 of title 18, United States Code; or</DELETED>
<DELETED> (2) any other relevant provision.</DELETED>
<DELETED> (b) Requirements.--In carrying out the requirements of
this section, the United States Sentencing Commission shall--</DELETED>
<DELETED> (1) ensure that the Federal sentencing guidelines
(including its policy statements) reflect--</DELETED>
<DELETED> (A) the serious nature of the offenses and
penalties referred to in this Act;</DELETED>
<DELETED> (B) the growing incidences of theft and
misuse of digitized or electronic personally
identifiable information, including identity theft;
and</DELETED>
<DELETED> (C) the need to deter, prevent, and punish
such offenses;</DELETED>
<DELETED> (2) consider the extent to which the Federal
sentencing guidelines (including its policy statements)
adequately address violations of the sections amended by this
Act to--</DELETED>
<DELETED> (A) sufficiently deter and punish such
offenses; and</DELETED>
<DELETED> (B) adequately reflect the enhanced
penalties established under this Act;</DELETED>
<DELETED> (3) maintain reasonable consistency with other
relevant directives and sentencing guidelines;</DELETED>
<DELETED> (4) account for any additional aggravating or
mitigating circumstances that might justify exceptions to the
generally applicable sentencing ranges;</DELETED>
<DELETED> (5) consider whether to provide a sentencing
enhancement for those convicted of the offenses described in
subsection (a), if the conduct involves--</DELETED>
<DELETED> (A) the online sale of fraudulently
obtained or stolen personally identifiable
information;</DELETED>
<DELETED> (B) the sale of fraudulently obtained or
stolen personally identifiable information to an
individual who is engaged in terrorist activity or
aiding other individuals engaged in terrorist activity;
or</DELETED>
<DELETED> (C) the sale of fraudulently obtained or
stolen personally identifiable information to finance
terrorist activity or other criminal
activities;</DELETED>
<DELETED> (6) make any necessary conforming changes to the
Federal sentencing guidelines to ensure that such guidelines
(including its policy statements) as described in subsection
(a) are sufficiently stringent to deter, and adequately reflect
crimes related to fraudulent access to, or misuse of,
personally identifiable information; and</DELETED>
<DELETED> (7) ensure that the Federal sentencing guidelines
adequately meet the purposes of sentencing under section
3553(a)(2) of title 18, United States Code.</DELETED>
<DELETED> (c) Emergency Authority to Sentencing Commission.--The
United States Sentencing Commission may, as soon as practicable,
promulgate amendments under this section in accordance with procedures
established in section 21(a) of the Sentencing Act of 1987 (28 U.S.C.
994 note) as though the authority under that Act had not
expired.</DELETED>
<DELETED>TITLE II--ASSISTANCE FOR STATE AND LOCAL LAW ENFORCEMENT
COMBATING CRIMES RELATED TO FRAUDULENT, UNAUTHORIZED, OR OTHER CRIMINAL
USE OF PERSONALLY IDENTIFIABLE INFORMATION</DELETED>
<DELETED>SEC. 201. GRANTS FOR STATE AND LOCAL ENFORCEMENT.</DELETED>
<DELETED> (a) In General.--Subject to the availability of amounts
provided in advance in appropriations Acts, the Assistant Attorney
General for the Office of Justice Programs of the Department of Justice
may award a grant to a State to establish and develop programs to
increase and enhance enforcement against crimes related to fraudulent,
unauthorized, or other criminal use of personally identifiable
information.</DELETED>
<DELETED> (b) Application.--A State seeking a grant under subsection
(a) shall submit an application to the Assistant Attorney General for
the Office of Justice Programs of the Department of Justice at such
time, in such manner, and containing such information as the Assistant
Attorney General may require.</DELETED>
<DELETED> (c) Use of Grant Amounts.--A grant awarded to a State
under subsection (a) shall be used by a State, in conjunction with
units of local government within that State, State and local courts,
other States, or combinations thereof, to establish and develop
programs to--</DELETED>
<DELETED> (1) assist State and local law enforcement
agencies in enforcing State and local criminal laws relating to
crimes involving the fraudulent, unauthorized, or other
criminal use of personally identifiable information;</DELETED>
<DELETED> (2) assist State and local law enforcement
agencies in educating the public to prevent and identify crimes
involving the fraudulent, unauthorized, or other criminal use
of personally identifiable information;</DELETED>
<DELETED> (3) educate and train State and local law
enforcement officers and prosecutors to conduct investigations
and forensic analyses of evidence and prosecutions of crimes
involving the fraudulent, unauthorized, or other criminal use
of personally identifiable information;</DELETED>
<DELETED> (4) assist State and local law enforcement
officers and prosecutors in acquiring computer and other
equipment to conduct investigations and forensic analysis of
evidence of crimes involving the fraudulent, unauthorized, or
other criminal use of personally identifiable information;
and</DELETED>
<DELETED> (5) facilitate and promote the sharing of Federal
law enforcement expertise and information about the
investigation, analysis, and prosecution of crimes involving
the fraudulent, unauthorized, or other criminal use of
personally identifiable information with State and local law
enforcement officers and prosecutors, including the use of
multi-jurisdictional task forces.</DELETED>
<DELETED> (d) Assurances and Eligibility.--To be eligible to receive
a grant under subsection (a), a State shall provide assurances to the
Attorney General that the State--</DELETED>
<DELETED> (1) has in effect laws that penalize crimes
involving the fraudulent, unauthorized, or other criminal use
of personally identifiable information, such as penal laws
prohibiting--</DELETED>
<DELETED> (A) fraudulent schemes executed to obtain
personally identifiable information;</DELETED>
<DELETED> (B) schemes executed to sell or use
fraudulently obtained personally identifiable
information; and</DELETED>
<DELETED> (C) online sales of personally
identifiable information obtained fraudulently or by
other illegal means;</DELETED>
<DELETED> (2) will provide an assessment of the resource
needs of the State and units of local government within that
State, including criminal justice resources being devoted to
the investigation and enforcement of laws related to crimes
involving the fraudulent, unauthorized, or other criminal use
of personally identifiable information; and</DELETED>
<DELETED> (3) will develop a plan for coordinating the
programs funded under this section with other federally funded
technical assistant and training programs, including directly
funded local programs such as the Local Law Enforcement Block
Grant program (described under the heading ``Violent Crime
Reduction Programs, State and Local Law Enforcement
Assistance'' of the Departments of Commerce, Justice, and
State, the Judiciary, and Related Agencies Appropriations Act,
1998 (Public Law 105-119)).</DELETED>
<DELETED> (e) Matching Funds.--The Federal share of a grant received
under this section may not exceed 90 percent of the total cost of a
program or proposal funded under this section unless the Attorney
General waives, wholly or in part, the requirements of this
subsection.</DELETED>
<DELETED>SEC. 202. AUTHORIZATION OF APPROPRIATIONS.</DELETED>
<DELETED> (a) In General.--There is authorized to be appropriated to
carry out this title $25,000,000 for each of fiscal years 2006 through
2009.</DELETED>
<DELETED> (b) Limitations.--Of the amount made available to carry
out this title in any fiscal year not more than 3 percent may be used
by the Attorney General for salaries and administrative
expenses.</DELETED>
<DELETED> (c) Minimum Amount.--Unless all eligible applications
submitted by a State or units of local government within a State for a
grant under this title have been funded, the State, together with
grantees within the State (other than Indian tribes), shall be
allocated in each fiscal year under this title not less than 0.75
percent of the total amount appropriated in the fiscal year for grants
pursuant to this title, except that the United States Virgin Islands,
American Samoa, Guam, and the Northern Mariana Islands each shall be
allocated 0.25 percent.</DELETED>
<DELETED> (d) Grants to Indian Tribes.--Notwithstanding any other
provision of this title, the Attorney General may use amounts made
available under this title to make grants to Indian tribes for use in
accordance with this title.</DELETED>
<DELETED>TITLE III--DATA BROKERS</DELETED>
<DELETED>SEC. 301. TRANSPARENCY AND ACCURACY OF DATA
COLLECTION.</DELETED>
<DELETED> (a) In General.--Data brokers engaging in interstate
commerce are subject to the requirements of this title for any product
or service offered to third parties that allows access, use,
compilation, distribution, processing, analyzing, or evaluation of
sensitive personally identifiable information.</DELETED>
<DELETED> (b) Limitation.--Notwithstanding any other paragraph of
this title, this section shall not apply to--</DELETED>
<DELETED> (1) data brokers engaging in interstate commerce
for any offered product or service currently subject to, and in
compliance with, access and accuracy protections similar to
those under subsections (c) through (f) of this section under
the Fair Credit Reporting Act (Public Law 91-508), or the
Gramm-Leach Bliley Act (Public Law 106-102);</DELETED>
<DELETED> (2) data brokers engaging in interstate commerce
for any offered product or service currently in compliance with
the requirements for such entities under the Health Insurance
Portability and Accountability Act (Public Law 104-191), and
implementing regulations;</DELETED>
<DELETED> (3) information in a personal electronic record
held by a data broker if--</DELETED>
<DELETED> (A) the data broker maintains such
information solely pursuant to a license agreement with
another business entity; and</DELETED>
<DELETED> (B) the business entity providing such
information to the data broker pursuant to a license
agreement either complies with the provisions of this
section or qualifies for this exemption; and</DELETED>
<DELETED> (4) information in a personal record that--
</DELETED>
<DELETED> (A) the data broker has identified as
inaccurate, but maintains for the purpose of aiding the
data broker in preventing inaccurate information from
entering an individual's personal electronic record;
and</DELETED>
<DELETED> (B) is not maintained primarily for the
purpose of transmitting or otherwise providing that
information, or assessments based on that information,
to non-affiliated third parties.</DELETED>
<DELETED> (c) Disclosures to Individuals.--</DELETED>
<DELETED> (1) In general.--A data broker shall, upon the
request of an individual, clearly and accurately disclose to
such individual for a reasonable fee all personal electronic
records pertaining to that individual maintained for disclosure
to third parties in the ordinary course of business in the
databases or systems of the data broker at the time of the
request.</DELETED>
<DELETED> (2) Information on how to correct inaccuracies.--
The disclosures required under paragraph (1) shall also include
guidance to individuals on the processes and procedures for
demonstrating and correcting any inaccuracies.</DELETED>
<DELETED> (d) Creation of an Accuracy Resolution Process.--A data
broker shall develop and publish on its website timely and fair
processes and procedures for responding to claims of inaccuracies,
including procedures for correcting inaccurate information in the
personal electronic records it maintains on individuals.</DELETED>
<DELETED> (e) Accuracy Resolution Process.--</DELETED>
<DELETED> (1) Information from a public record source.--
</DELETED>
<DELETED> (A) In general.--If an individual notifies
a data broker of a dispute as to the completeness or
accuracy of information, and the data broker determines
that such information is derived from a public record
source, the data broker shall determine within 30 days
whether the information in its system accurately and
completely records the information offered by the
public record source.</DELETED>
<DELETED> (B) Data broker actions.--If a data broker
determines under subparagraph (A) that the information
in its systems--</DELETED>
<DELETED> (i) does not accurately and
completely record the information offered by a
public record source, the data broker shall
correct any inaccuracies or incompleteness, and
provide to such individual written notice of
such changes; and</DELETED>
<DELETED> (ii) does accurately and
completely record the information offered by a
public record source, the data broker shall--
</DELETED>
<DELETED> (I) provide such
individual with the name, address, and
telephone contact information of the
public record source; and</DELETED>
<DELETED> (II) notify such
individual of the right to add for a
period of 90 days to the personal
electronic record of the individual
maintained by the data broker notice of
the dispute under subsection
(f).</DELETED>
<DELETED> (2) Investigation of disputed information not from
a public record source.--If the completeness or accuracy of any
nonpublic record source disclosed to an individual under
subsection (c) is disputed by the individual and such
individual notifies the data broker directly of such dispute,
the data broker shall, before the end of the 30-day period
beginning on the date on which the data broker receives the
notice of the dispute--</DELETED>
<DELETED> (A) investigate free of charge and record
the current status of the disputed information;
or</DELETED>
<DELETED> (B) delete the item from the individuals
data file in accordance with paragraph (8).</DELETED>
<DELETED> (3) Extension of period to investigate.--Except as
provided in paragraph (4), the 30-day period described in
paragraph (1) may be extended for not more than 15 additional
days if a data broker receives information from the individual
during that 30-day period that is relevant to the
investigation.</DELETED>
<DELETED> (4) Limitations on extension of period to
investigate.--Paragraph (3) shall not apply to any
investigation in which, during the 30-day period described in
paragraph (1), the information that is the subject of the
investigation is found to be inaccurate or incomplete or a data
broker determines that the information cannot be
verified.</DELETED>
<DELETED> (5) Notice identifying the data furnisher.--If the
completeness or accuracy of any information disclosed to an
individual under subsection (c) is disputed by the individual,
a data broker shall provide upon the request of the individual,
the name, business address, and telephone contact information
of any data furnisher who provided an item of information in
dispute.</DELETED>
<DELETED> (6) Determination that dispute is frivolous or
irrelevant.--</DELETED>
<DELETED> (A) In general.--Notwithstanding
paragraphs (1) through (4), a data broker may decline
to investigate or terminate an investigation of
information disputed by an individual under those
paragraphs if the data broker reasonably determines
that the dispute by the individual is frivolous or
irrelevant, including by reason of a failure by the
individual to provide sufficient information to
investigate the disputed information.</DELETED>
<DELETED> (B) Notice.--Not later than 5 business
days after making any determination in accordance with
subparagraph (A) that a dispute is frivolous or
irrelevant, a data broker shall notify the individual
of such determination by mail, or if authorized by the
individual, by any other means available to the data
broker.</DELETED>
<DELETED> (C) Contents of notice.--A notice under
subparagraph (B) shall include--</DELETED>
<DELETED> (i) the reasons for the
determination under subparagraph (A);
and</DELETED>
<DELETED> (ii) identification of any
information required to investigate the
disputed information, which may consist of a
standardized form describing the general nature
of such information.</DELETED>
<DELETED> (7) Consideration of individual information.--In
conducting any investigation with respect to disputed
information in the personal electronic record of any
individual, a data broker shall review and consider all
relevant information submitted by the individual in the period
described in paragraph (2) with respect to such disputed
information.</DELETED>
<DELETED> (8) Treatment of inaccurate or unverifiable
information.--</DELETED>
<DELETED> (A) In general.--If, after any review of
public record information under paragraph (1) or any
investigation of any information disputed by an
individual under paragraphs (2) through (4), an item of
information is found to be inaccurate or incomplete or
cannot be verified, a data broker shall promptly delete
that item of information from the individual's personal
electronic record or modify that item of information,
as appropriate, based on the results of the
investigation.</DELETED>
<DELETED> (B) Notice to individuals of reinsertion
of previously deleted information.--If any information
that has been deleted from an individual's personal
electronic record pursuant to subparagraph (A) is
reinserted in the personal electronic record of the
individual, a data broker shall, not later than 5 days
after reinsertion, notify the individual of the
reinsertion and identify any data furnisher not
previously disclosed in writing, or if authorized by
the individual for that purpose, by any other means
available to the data broker, unless such notification
has been previously given under this
subsection.</DELETED>
<DELETED> (C) Notice of results of investigation of
disputed information from a nonpublic record source.--
</DELETED>
<DELETED> (i) In general.--Not later than 5
business days after the completion of an
investigation under paragraph (2), a data
broker shall provide written notice to an
individual of the results of the investigation,
by mail or, if authorized by the individual for
that purpose, by other means available to the
data broker.</DELETED>
<DELETED> (ii) Additional requirement.--
Before the expiration of the 5-day period, as
part of, or in addition to such notice, a data
broker shall, in writing, provide to an
individual--</DELETED>
<DELETED> (I) a statement that the
investigation is completed;</DELETED>
<DELETED> (II) a report that is
based upon the personal electronic
record of such individual as that
personal electronic record is revised
as a result of the
investigation;</DELETED>
<DELETED> (III) a notice that, if
requested by the individual, a
description of the procedures used to
determine the accuracy and completeness
of the information shall be provided to
the individual by the data broker,
including the business name, address,
and telephone number of any data
furnisher of information contacted in
connection with such information;
and</DELETED>
<DELETED> (IV) a notice that the
individual has the right to request
notifications under subsection
(f).</DELETED>
<DELETED> (D) Description of investigation
procedures.--Not later than 15 days after receiving a
request from an individual for a description referred
to in subparagraph (C)(ii)(III), a data broker shall
provide to the individual such a description.</DELETED>
<DELETED> (E) Expedited dispute resolution.--If by
no later than 3 business days after the date on which a
data broker receives notice of a dispute from an
individual of information in the personal electronic
record of such individual in accordance with paragraph
(2), a data broker resolves such dispute in accordance
with subparagraph (A) by the deletion of the disputed
information, then the data broker shall not be required
to comply with subsections (e) and (f) with respect to
that dispute if the data broker provides to the
individual, by telephone or other means authorized by
the individual, prompt notice of the
deletion.</DELETED>
<DELETED> (f) Notice of Dispute.--</DELETED>
<DELETED> (1) In general.--If the completeness or accuracy
of any information disclosed to an individual under subsection
(c) is disputed and unless there is a reasonable ground to
believe that such dispute is frivolous or irrelevant, an
individual may request that the data broker indicate notice of
the dispute for a period of--</DELETED>
<DELETED> (A) 30 days for information from a
nonpublic record source; and</DELETED>
<DELETED> (B) 90 days for information from a public
record source.</DELETED>
<DELETED> (2) Compliance.--A data broker shall be deemed in
compliance with the requirements under paragraph (1) by
either--</DELETED>
<DELETED> (A) allowing the individual to file a
brief statement setting forth the nature of the dispute
under paragraph (3); or</DELETED>
<DELETED> (B) using an alternative notice method
that--</DELETED>
<DELETED> (i) clearly flags the disputed
information for third parties accessing the
information; and</DELETED>
<DELETED> (ii) provides a means for third
parties to obtain further information regarding
the nature of the dispute.</DELETED>
<DELETED> (3) Contents of statement.--A data broker may
limit statements made under paragraph (2)(A) to not more than
100 words if it provides an individual with assistance in
writing a clear summary of the dispute or until the dispute is
resolved.</DELETED>
<DELETED> (g) Additional Requirements.--The Federal Trade Commission
may exempt certain classes of data brokers from this title in a
rulemaking process pursuant to section 553 of title 5, United States
Code.</DELETED>
<DELETED>SEC. 302. ENFORCEMENT.</DELETED>
<DELETED> (a) Civil Penalties.--</DELETED>
<DELETED> (1) Penalties.--Any data broker that violates the
provisions of section 301 shall be subject to civil penalties
of not more than $1,000 per violation per day, with a maximum
of $15,000 per day, while such violations persist.</DELETED>
<DELETED> (2) Intentional or willful violation.--A data
broker that intentionally or willfully violates the provisions
of section 301 shall be subject to additional penalties in the
amount of $1,000 per violation per day, with a maximum of an
additional $15,000 per day, while such violations
persist.</DELETED>
<DELETED> (3) Equitable relief.--A data broker engaged in
interstate commerce that violates this section may be enjoined
from further violations by a court of competent
jurisdiction.</DELETED>
<DELETED> (4) Other rights and remedies.--The rights and
remedies available under this subsection are cumulative and
shall not affect any other rights and remedies available under
law.</DELETED>
<DELETED> (b) Injunctive Actions by the Attorney General.--
</DELETED>
<DELETED> (1) In general.--Whenever it appears that a data
broker to which this title applies has engaged, is engaged, or
is about to engage, in any act or practice constituting a
violation of this title, the Attorney General may bring a civil
action in an appropriate district court of the United States
to--</DELETED>
<DELETED> (A) enjoin such act or practice;</DELETED>
<DELETED> (B) enforce compliance with this
title;</DELETED>
<DELETED> (C) obtain damages--</DELETED>
<DELETED> (i) in the sum of actual damages,
restitution, and other compensation on behalf
of the affected residents of a State;
and</DELETED>
<DELETED> (ii) punitive damages, if the
violation is willful or intentional;
and</DELETED>
<DELETED> (D) obtain such other relief as the court
determines to be appropriate.</DELETED>
<DELETED> (2) Other injunctive relief.--Upon a proper
showing in the action under paragraph (1), the court shall
grant a permanent injunction or a temporary restraining order
without bond.</DELETED>
<DELETED> (c) State Enforcement.--</DELETED>
<DELETED> (1) Civil actions.--In any case in which the
attorney general of a State has reason to believe that an
interest of the residents of that State has been or is
threatened or adversely affected by an act or practice that
violates this title, the State may bring a civil action on
behalf of the residents of that State in a district court of
the United States of appropriate jurisdiction, or any other
court of competent jurisdiction, to--</DELETED>
<DELETED> (A) enjoin that act or practice;</DELETED>
<DELETED> (B) enforce compliance with this
title;</DELETED>
<DELETED> (C) obtain--</DELETED>
<DELETED> (i) damages in the sum of actual
damages, restitution, or other compensation on
behalf of affected residents of the State;
and</DELETED>
<DELETED> (ii) punitive damages, if the
violation is willful or intentional;
or</DELETED>
<DELETED> (D) obtain such other legal and equitable
relief as the court may consider to be
appropriate.</DELETED>
<DELETED> (2) Notice.--</DELETED>
<DELETED> (A) In general.--Before filing an action
under this subsection, the attorney general of the
State involved shall provide to the Attorney General--
</DELETED>
<DELETED> (i) a written notice of that
action; and</DELETED>
<DELETED> (ii) a copy of the complaint for
that action.</DELETED>
<DELETED> (B) Exception.--Subparagraph (A) shall not
apply with respect to the filing of an action by an
attorney general of a State under this subsection, if
the attorney general of a State determines that it is
not feasible to provide the notice described in this
subparagraph before the filing of the action.</DELETED>
<DELETED> (C) Notification when practicable.--In an
action described under subparagraph (B), the attorney
general of a State shall provide the written notice and
the copy of the complaint to the Attorney General as
soon after the filing of the complaint as
practicable.</DELETED>
<DELETED> (3) Attorney general authority.--Upon receiving
notice under paragraph (2), the Attorney General shall have the
right to--</DELETED>
<DELETED> (A) move to stay the action, pending the
final disposition of a pending Federal proceeding or
action as described in paragraph (4);</DELETED>
<DELETED> (B) intervene in an action brought under
paragraph (1); and</DELETED>
<DELETED> (C) file petitions for appeal.</DELETED>
<DELETED> (4) Pending proceedings.--If the Attorney General
has instituted a proceeding or action for a violation of this
title or any regulations thereunder, no attorney general of a
State may, during the pendency of such proceeding or action,
bring an action under this subsection against any defendant
named in such criminal proceeding or civil action for any
violation that is alleged in that proceeding or
action.</DELETED>
<DELETED> (5) Rule of construction.--For purposes of
bringing any civil action under paragraph (1), nothing in this
title shall be construed to prevent an attorney general of a
State from exercising the powers conferred on the attorney
general by the laws of that State to--</DELETED>
<DELETED> (A) conduct investigations;</DELETED>
<DELETED> (B) administer oaths and affirmations;
or</DELETED>
<DELETED> (C) compel the attendance of witnesses or
the production of documentary and other
evidence.</DELETED>
<DELETED> (6) Venue; service of process.--</DELETED>
<DELETED> (A) Venue.--Any action brought under this
subsection may be brought in the district court of the
United States that meets applicable requirements
relating to venue under section 1931 of title 28,
United States Code.</DELETED>
<DELETED> (B) Service of process.--In an action
brought under this subsection process may be served in
any district in which the defendant--</DELETED>
<DELETED> (i) is an inhabitant; or</DELETED>
<DELETED> (ii) may be found.</DELETED>
<DELETED> (d) No Private Cause of Action.--Nothing in this title
establishes a private cause of action against a data broker for
violation of any provision of this title.</DELETED>
<DELETED>SEC. 303. RELATION TO STATE LAWS.</DELETED>
<DELETED> No requirement or prohibition may be imposed under the
laws of any State with respect to any subject matter regulated under
section 301, relating to individual access to, and correction of,
personal electronic records held by databrokers.</DELETED>
<DELETED>SEC. 304. EFFECTIVE DATE.</DELETED>
<DELETED> This title shall take effect 180 days after the date of
enactment of this Act and shall be implemented pursuant to a State by
State rollout schedule set by the Federal Trade Commission, but in no
case shall full implementation and effect of this title occur later
than 1 year and 180 days after the date of enactment of this
Act.</DELETED>
<DELETED>TITLE IV--PRIVACY AND SECURITY OF PERSONALLY IDENTIFIABLE
INFORMATION</DELETED>
<DELETED>Subtitle A--Data Privacy and Security Program</DELETED>
<DELETED>SEC. 401. PURPOSE AND APPLICABILITY OF DATA PRIVACY AND
SECURITY PROGRAM.</DELETED>
<DELETED> (a) Purpose.--The purpose of this subtitle is to ensure
standards for developing and implementing administrative, technical,
and physical safeguards to protect the privacy, security,
confidentiality, integrity, storage, and disposal of sensitive
personally identifiable information.</DELETED>
<DELETED> (b) In General.--A business entity engaging in interstate
commerce that involves collecting, accessing, transmitting, using,
storing, or disposing of sensitive personally identifiable information
in electronic or digital form on 10,000 or more United States persons
is subject to the requirements for a data privacy and security program
under section 402 for protecting sensitive personally identifiable
information.</DELETED>
<DELETED> (c) Limitations.--Notwithstanding any other obligation
under this subtitle, this subtitle does not apply to--</DELETED>
<DELETED> (1) financial institutions--</DELETED>
<DELETED> (A) subject to the data security
requirements and implementing regulations under the
Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.);
and</DELETED>
<DELETED> (B) subject to--</DELETED>
<DELETED> (i) examinations for compliance
with the requirements of this Act by 1 or more
Federal or State functional regulators (as
defined in section 509 of the Gramm-Leach-
Bliley Act (15 U.S.C. 6809)); or</DELETED>
<DELETED> (ii) compliance with part 314 of
title 16, Code of Federal Regulations;
or</DELETED>
<DELETED> (2) ``covered entities'' subject to the Health
Insurance Portability and Accountability Act of 1996 (42 U.S.C.
1301 et seq.), including the data security requirements and
implementing regulations of that Act.</DELETED>
<DELETED> (d) Safe Harbor.--A business entity shall be deemed in
compliance with the privacy and security program requirements under
section 402 if the business entity complies with or provides protection
equal to industry standards, as identified by the Federal Trade
Commission, that are applicable to the type of sensitive personally
identifiable information involved in the ordinary course of business of
such business entity.</DELETED>
<DELETED>SEC. 402. REQUIREMENTS FOR A PERSONAL DATA PRIVACY AND
SECURITY PROGRAM.</DELETED>
<DELETED> (a) Personal Data Privacy and Security Program.--Unless
otherwise limited under section 401(c), a business entity subject to
this subtitle shall comply with the following safeguards and any others
identified by the Federal Trade Commission in a rulemaking process
pursuant to section 553 of title 5, United States Code, to protect the
privacy and security of sensitive personally identifiable
information:</DELETED>
<DELETED> (1) Scope.--A business entity shall implement a
comprehensive personal data privacy and security program that
includes administrative, technical, and physical safeguards
appropriate to the size and complexity of the business entity
and the nature and scope of its activities.</DELETED>
<DELETED> (2) Design.--The personal data privacy and
security program shall be designed to--</DELETED>
<DELETED> (A) ensure the privacy, security, and
confidentiality of personal electronic
records;</DELETED>
<DELETED> (B) protect against any anticipated
vulnerabilities to the privacy, security, or integrity
of personal electronic records; and</DELETED>
<DELETED> (C) protect against unauthorized access to
use of personal electronic records that could result in
substantial harm or inconvenience to any
individual.</DELETED>
<DELETED> (3) Risk assessment.--A business entity shall--
</DELETED>
<DELETED> (A) identify reasonably foreseeable
internal and external vulnerabilities that could result
in unauthorized access, disclosure, use, or alteration
of sensitive personally identifiable information or
systems containing sensitive personally identifiable
information;</DELETED>
<DELETED> (B) assess the likelihood of and potential
damage from unauthorized access, disclosure, use, or
alteration of sensitive personally identifiable
information; and</DELETED>
<DELETED> (C) assess the sufficiency of its
policies, technologies, and safeguards in place to
control and minimize risks from unauthorized access,
disclosure, use, or alteration of sensitive personally
identifiable information.</DELETED>
<DELETED> (4) Risk management and control.--Each business
entity shall--</DELETED>
<DELETED> (A) design its personal data privacy and
security program to control the risks identified under
paragraph (3); and</DELETED>
<DELETED> (B) adopt measures commensurate with the
sensitivity of the data as well as the size,
complexity, and scope of the activities of the business
entity that--</DELETED>
<DELETED> (i) control access to systems and
facilities containing sensitive personally
identifiable information, including controls to
authenticate and permit access only to
authorized individuals;</DELETED>
<DELETED> (ii) detect actual and attempted
fraudulent, unlawful, or unauthorized access,
disclosure, use, or alteration of sensitive
personally identifiable information, including
by employees and other individuals otherwise
authorized to have access; and</DELETED>
<DELETED> (iii) protect sensitive personally
identifiable information during use,
transmission, storage, and disposal by
encryption or other reasonable means (including
as directed for disposal of records under
section 628 of the Fair Credit Reporting Act
(15 U.S.C. 1681w) and the implementing
regulations of such Act as set forth in section
682 of title 16, Code of Federal
Regulations).</DELETED>
<DELETED> (b) Training.--Each business entity subject to this
subtitle shall take steps to ensure employee training and supervision
for implementation of the data security program of the business
entity.</DELETED>
<DELETED> (c) Vulnerability Testing.--</DELETED>
<DELETED> (1) In general.--Each business entity subject to
this subtitle shall take steps to ensure regular testing of key
controls, systems, and procedures of the personal data privacy
and security program to detect, prevent, and respond to attacks
or intrusions, or other system failures.</DELETED>
<DELETED> (2) Frequency.--The frequency and nature of the
tests required under paragraph (1) shall be determined by the
risk assessment of the business entity under subsection
(a)(3).</DELETED>
<DELETED> (d) Relationship to Service Providers.--In the event a
business entity subject to this subtitle engages service providers not
subject to this subtitle, such business entity shall--</DELETED>
<DELETED> (1) exercise appropriate due diligence in
selecting those service providers for responsibilities related
to sensitive personally identifiable information, and take
reasonable steps to select and retain service providers that
are capable of maintaining appropriate safeguards for the
security, privacy, and integrity of the sensitive personally
identifiable information at issue; and</DELETED>
<DELETED> (2) require those service providers by contract to
implement and maintain appropriate measures designed to meet
the objectives and requirements governing entities subject to
this section, section 401, and subtitle B.</DELETED>
<DELETED> (e) Periodic Assessment and Personal Data Privacy and
Security Modernization.--Each business entity subject to this subtitle
shall on a regular basis monitor, evaluate, and adjust, as appropriate
its data privacy and security program in light of any relevant changes
in--</DELETED>
<DELETED> (1) technology;</DELETED>
<DELETED> (2) the sensitivity of personally identifiable
information;</DELETED>
<DELETED> (3) internal or external threats to personally
identifiable information; and</DELETED>
<DELETED> (4) the changing business arrangements of the
business entity, such as--</DELETED>
<DELETED> (A) mergers and acquisitions;</DELETED>
<DELETED> (B) alliances and joint
ventures;</DELETED>
<DELETED> (C) outsourcing arrangements;</DELETED>
<DELETED> (D) bankruptcy; and</DELETED>
<DELETED> (E) changes to sensitive personally
identifiable information systems.</DELETED>
<DELETED> (f) Implementation Time Line.--Not later than 1 year after
the date of enactment of this Act, a business entity subject to the
provisions of this subtitle shall implement a data privacy and security
program pursuant to this subtitle.</DELETED>
<DELETED>SEC. 403. ENFORCEMENT.</DELETED>
<DELETED> (a) Civil Penalties.--</DELETED>
<DELETED> (1) In general.--Any business entity that violates
the provisions of sections 401 or 402 shall be subject to civil
penalties of not more than $5,000 per violation per day, with a
maximum of $35,000 per day, while such violations
persist.</DELETED>
<DELETED> (2) Intentional or willful violation.--A business
entity that intentionally or willfully violates the provisions
of sections 401 or 402 shall be subject to additional penalties
in the amount of $5,000 per violation per day, with a maximum
of an additional $35,000 per day, while such violations
persist.</DELETED>
<DELETED> (3) Equitable relief.--A business entity engaged
in interstate commerce that violates this section may be
enjoined from further violations by a court of competent
jurisdiction.</DELETED>
<DELETED> (4) Other rights and remedies.--The rights and
remedies available under this section are cumulative and shall
not affect any other rights and remedies available under
law</DELETED>
<DELETED> (b) Injunctive Actions by the Attorney General.--
</DELETED>
<DELETED> (1) In general.--Whenever it appears that a
business entity or agency to which this subtitle applies has
engaged, is engaged, or is about to engage, in any act or
practice constituting a violation of this subtitle, the
Attorney General may bring a civil action in an appropriate
district court of the United States to--</DELETED>
<DELETED> (A) enjoin such act or practice;</DELETED>
<DELETED> (B) enforce compliance with this subtitle;
and</DELETED>
<DELETED> (C) obtain damages--</DELETED>
<DELETED> (i) in the sum of actual damages,
restitution, and other compensation on behalf
of the affected residents of a State;
and</DELETED>
<DELETED> (ii) punitive damages, if the
violation is willful or intentional;
and</DELETED>
<DELETED> (D) obtain such other relief as the court
determines to be appropriate.</DELETED>
<DELETED> (2) Other injunctive relief.--Upon a proper
showing in the action under paragraph (1), the court shall
grant a permanent injunction or a temporary restraining order
without bond.</DELETED>
<DELETED> (c) State Enforcement.--</DELETED>
<DELETED> (1) Civil actions.--In any case in which the
attorney general of a State has reason to believe that an
interest of the residents of that State has been or is
threatened or adversely affected by an act or practice that
violates this subtitle, the State may bring a civil action on
behalf of the residents of that State in a district court of
the United States of appropriate jurisdiction, or any other
court of competent jurisdiction, to--</DELETED>
<DELETED> (A) enjoin that act or practice;</DELETED>
<DELETED> (B) enforce compliance with this
subtitle;</DELETED>
<DELETED> (C) obtain--</DELETED>
<DELETED> (i) damages in the sum of actual
damages, restitution, or other compensation on
behalf of affected residents of the State;
and</DELETED>
<DELETED> (ii) punitive damages, if the
violation is willful or intentional;
or</DELETED>
<DELETED> (D) obtain such other legal and equitable
relief as the court may consider to be
appropriate.</DELETED>
<DELETED> (2) Notice.--</DELETED>
<DELETED> (A) In general.--Before filing an action
under this subsection, the attorney general of the
State involved shall provide to the Attorney General--
</DELETED>
<DELETED> (i) a written notice of that
action; and</DELETED>
<DELETED> (ii) a copy of the complaint for
that action.</DELETED>
<DELETED> (B) Exception.--Subparagraph (A) shall not
apply with respect to the filing of an action by an
attorney general of a State under this subsection, if
the attorney general of a State determines that it is
not feasible to provide the notice described in this
subparagraph before the filing of the action.</DELETED>
<DELETED> (C) Notification when practicable.--In an
action described under subparagraph (B), the attorney
general of a State shall provide the written notice and
the copy of the complaint to the Attorney General as
soon after the filing of the complaint as
practicable.</DELETED>
<DELETED> (3) Attorney general authority.--Upon receiving
notice under paragraph (2), the Attorney General shall have the
right to--</DELETED>
<DELETED> (A) move to stay the action, pending the
final disposition of a pending Federal proceeding or
action as described in paragraph (4);</DELETED>
<DELETED> (B) intervene in an action brought under
paragraph (1); and</DELETED>
<DELETED> (C) file petitions for appeal.</DELETED>
<DELETED> (4) Pending proceedings.--If the Attorney General
has instituted a proceeding or action for a violation of this
title or any regulations thereunder, no attorney general of a
State may, during the pendency of such proceeding or action,
bring an action under this subsection against any defendant
named in such criminal proceeding or civil action for any
violation that is alleged in that proceeding or
action.</DELETED>
<DELETED> (5) Rule of construction.--For purposes of
bringing any civil action under paragraph (1) nothing in this
title shall be construed to prevent an attorney general of a
State from exercising the powers conferred on the attorney
general by the laws of that State to--</DELETED>
<DELETED> (A) conduct investigations;</DELETED>
<DELETED> (B) administer oaths and affirmations;
or</DELETED>
<DELETED> (C) compel the attendance of witnesses or
the production of documentary and other
evidence.</DELETED>
<DELETED> (6) Venue; service of process.--</DELETED>
<DELETED> (A) Venue.--Any action brought under this
subsection may be brought in the district court of the
United States that meets applicable requirements
relating to venue under section 1931 of title 28,
United States Code.</DELETED>
<DELETED> (B) Service of process.--In an action
brought under this subsection process may be served in
any district in which the defendant--</DELETED>
<DELETED> (i) is an inhabitant; or</DELETED>
<DELETED> (ii) may be found.</DELETED>
<DELETED> (d) No Private Cause of Action.--Nothing in this title
establishes a private cause of action against a business entity for
violation of any provision of this subtitle.</DELETED>
<DELETED>SEC. 404. RELATION TO STATE LAWS.</DELETED>
<DELETED> (a) In General.--No State may--</DELETED>
<DELETED> (1) require an entity described in section 401(c)
to comply with this subtitle or any regulation promulgated
thereunder; and</DELETED>
<DELETED> (2) require an entity in compliance with the safe
harbor established under section 401(d), to comply with any
other provision of this subtitle.</DELETED>
<DELETED> (b) Effect of Subtitle A.--Except as provided in
subsection (a), this subtitle does not annul, alter, affect, or exempt
any person subject to the provisions of this subtitle from complying
with the laws of any State with respect to security programs for
sensitive personally identifiable information, except to the extent
that those laws are inconsistent with any provisions of this subtitle,
and then only to the extent of such inconsistency.</DELETED>
<DELETED>Subtitle B--Security Breach Notification</DELETED>
<DELETED>SEC. 421. NOTICE TO INDIVIDUALS.</DELETED>
<DELETED> (a) In General.--Any agency, or business entity engaged in
interstate commerce, that uses, accesses, transmits, stores, disposes
of or collects sensitive personally identifiable information shall,
following the discovery of a security breach maintained by the agency
or business entity that contains such information, notify any resident
of the United States whose sensitive personally identifiable
information was subject to the security breach.</DELETED>
<DELETED> (b) Obligation of Owner or Licensee.--</DELETED>
<DELETED> (1) Notice to owner or licensee.--Any agency, or
business entity engaged in interstate commerce, that uses,
accesses, transmits, stores, disposes of, or collects sensitive
personally identifiable information that the agency or business
entity does not own or license shall notify the owner or
licensee of the information following the discovery of a
security breach containing such information.</DELETED>
<DELETED> (2) Notice by owner, licensee or other designated
third party.--Noting in this subtitle shall prevent or abrogate
an agreement between an agency or business entity required to
give notice under this section and a designated third party,
including an owner or licensee of the sensitive personally
identifiable information subject to the security breach, to
provide the notifications required under subsection
(a).</DELETED>
<DELETED> (3) Business entity relieved from giving notice.--
A business entity obligated to give notice under subsection (a)
shall be relieved of such obligation if an owner or licensee of
the sensitive personally identifiable information subject to
the security breach, or other designated third party, provides
such notification.</DELETED>
<DELETED> (c) Timeliness of Notification.--</DELETED>
<DELETED> (1) In general.--All notifications required under
this section shall be made without unreasonable delay
following--</DELETED>
<DELETED> (A) the discovery by the agency or
business entity of a security breach; and</DELETED>
<DELETED> (B) any measures necessary to determine
the scope of the breach, prevent further disclosures,
and restore the reasonable integrity of the data
system.</DELETED>
<DELETED> (2) Burden of proof.--The agency, business entity,
owner, or licensee required to provide notification under this
section shall have the burden of demonstrating that all
notifications were made as required under this subtitle,
including evidence demonstrating the necessity of any
delay.</DELETED>
<DELETED> (d) Delay of Notification Authorized for Law Enforcement
Purposes.--</DELETED>
<DELETED> (1) In general.--If a law enforcement agency
determines that the notification required under this section
would impede a criminal investigation, such notification may be
delayed upon the written request of the law enforcement
agency.</DELETED>
<DELETED> (2) Extended delay of notification.--If the
notification required under subsection (a) is delayed pursuant
to paragraph (1), an agency or business entity shall give
notice 30 days after the day such law enforcement delay was
invoked unless a law enforcement agency provides written
notification that further delay is necessary.</DELETED>
<DELETED>SEC. 422. EXEMPTIONS.</DELETED>
<DELETED> (a) Exemption for National Security and Law Enforcement.--
</DELETED>
<DELETED> (1) In general.--Section 421 shall not apply to an
agency if the head of the agency certifies, in writing, that
notification of the security breach as required by section 421
reasonably could be expected to--</DELETED>
<DELETED> (A) cause damage to the national security;
or</DELETED>
<DELETED> (B) hinder a law enforcement investigation
or the ability of the agency to conduct law enforcement
investigations.</DELETED>
<DELETED> (2) Limits on certifications.--The head of an
agency may not execute a certification under paragraph (1) to--
</DELETED>
<DELETED> (A) conceal violations of law,
inefficiency, or administrative error;</DELETED>
<DELETED> (B) prevent embarrassment to a business
entity, organization, or agency; or</DELETED>
<DELETED> (C) restrain competition.</DELETED>
<DELETED> (3) Notice.--In every case in which a head of an
agency issues a certification under paragraph (1), the
certification, accompanied by a concise description of the
factual basis for the certification, shall be immediately
provided to the Congress.</DELETED>
<DELETED> (b) Risk Assessment Exemption.--An agency or business
entity will be exempt from the notice requirements under section 421,
if--</DELETED>
<DELETED> (1) a risk assessment concludes that there is no
significant risk that the security breach has resulted in, or
will result in, harm to the individuals whose sensitive
personally identifiable information was subject to the security
breach;</DELETED>
<DELETED> (2) without unreasonable delay, but not later than
45 days after the discovery of a security breach, unless
extended by the United States Secret Service, the business
entity notifies the United States Secret Service, in writing,
of--</DELETED>
<DELETED> (A) the results of the risk
assessment;</DELETED>
<DELETED> (B) its decision to invoke the risk
assessment exemption; and</DELETED>
<DELETED> (3) the United States Secret Service does not
indicate, in writing, within 10 days from receipt of the
decision, that notice should be given.</DELETED>
<DELETED> (c) Financial Fraud Prevention Exemption.--</DELETED>
<DELETED> (1) In general.--A business entity will be exempt
from the notice requirement under section 421 if the business
entity utilizes or participates in a security program that--
</DELETED>
<DELETED> (A) is designed to block the use of the
sensitive personally identifiable information to
initiate unauthorized financial transactions before
they are charged to the account of the individual;
and</DELETED>
<DELETED> (B) provides for notice after a security
breach that has resulted in fraud or unauthorized
transactions.</DELETED>
<DELETED> (2) Limitation.--The exemption by this subsection
does not apply if the information subject to the security
breach includes, in addition to an account number, sensitive
personally identifiable information.</DELETED>
<DELETED>SEC. 423. METHODS OF NOTICE.</DELETED>
<DELETED> An agency, or business entity shall be in compliance with
section 421 if it provides:</DELETED>
<DELETED> (1) Individual notice.--</DELETED>
<DELETED> (A) Written notification to the last known
home mailing address of the individual in the records
of the agency or business entity; or</DELETED>
<DELETED> (B) E-mail notice, if the individual has
consented to receive such notice and the notice is
consistent with the provisions permitting electronic
transmission of notices under section 101 of the
Electronic Signatures in Global and National Commerce
Act (15 U.S.C. 7001).</DELETED>
<DELETED> (2) Media notice.--If more than 5,000 residents of
a State or jurisdiction are impacted, notice to major media
outlets serving that State or jurisdiction.</DELETED>
<DELETED>SEC. 424. CONTENT OF NOTIFICATION.</DELETED>
<DELETED> (a) In General.--Regardless of the method by which notice
is provided to individuals under section 423, such notice shall
include, to the extent possible--</DELETED>
<DELETED> (1) a description of the categories of sensitive
personally identifiable information that was, or is reasonably
believed to have been, acquired by an unauthorized
person;</DELETED>
<DELETED> (2) a toll-free number--</DELETED>
<DELETED> (A) that the individual may use to contact
the agency or business entity, or the agent of the
agency or business entity; and</DELETED>
<DELETED> (B) from which the individual may learn--
</DELETED>
<DELETED> (i) what types of sensitive
personally identifiable information the agency
or business entity maintained about that
individual or about individuals in general;
and</DELETED>
<DELETED> (ii) whether or not the agency or
business entity maintained sensitive personally
identifiable information about that individual;
and</DELETED>
<DELETED> (3) the toll-free contact telephone numbers and
addresses for the major credit reporting agencies.</DELETED>
<DELETED> (b) Additional Content.--Notwithstanding section 429, a
State may require that a notice under subsection (a) shall also include
information regarding victim protection assistance provided for by that
State.</DELETED>
<DELETED>SEC. 425. COORDINATION OF NOTIFICATION WITH CREDIT REPORTING
AGENCIES.</DELETED>
<DELETED> If an agency or business entity is required to provide
notification to more than 1,000 individuals under section 421(a), the
agency or business entity shall also notify, without unreasonable
delay, all consumer reporting agencies that compile and maintain files
on consumers on a nationwide basis (as defined in section 603(p) of the
Fair Credit Reporting Act (15 U.S.C. 1681a(p)) of the timing and
distribution of the notices.</DELETED>
<DELETED>SEC. 426. NOTICE TO LAW ENFORCEMENT.</DELETED>
<DELETED> (a) Secret Service.--Any business entity or agency
required to give notice under section 421 shall also give notice to the
United States Secret Service if the security breach impacts--</DELETED>
<DELETED> (1) more than 10,000 individuals
nationwide;</DELETED>
<DELETED> (2) a database, networked or integrated databases,
or other data system associated with the sensitive personally
identifiable information on more than 1,000,000 individuals
nationwide;</DELETED>
<DELETED> (3) databases owned by the Federal Government;
or</DELETED>
<DELETED> (4) primarily sensitive personally identifiable
information of employees and contractors of the Federal
Government involved in national security or law
enforcement.</DELETED>
<DELETED> (b) Notice to Other Law Enforcement Agencies.--The United
States Secret Service shall be responsible for notifying--</DELETED>
<DELETED> (1)(A) the Federal Bureau of Investigation, if the
security breach involves espionage, foreign
counterintelligence, information protected against unauthorized
disclosure for reasons of national defense or foreign
relations, or Restricted Data (as that term is defined in
section 11y of the Atomic Energy Act of 1954 (42 U.S.C.
2014(y)), except for offenses affecting the duties of the
United States Secret Service under section 3056(a) of title 18,
United States Code; and</DELETED>
<DELETED> (B) the United States Postal Inspection Service,
if the security breach involves mail fraud; and</DELETED>
<DELETED> (2) the attorney general of each State affected by
the security breach.</DELETED>
<DELETED> (c) 30-Day Rule.--The notices to Federal law enforcement
and the attorney general of each State affected by a security breach
required under this section shall be delivered without unreasonable
delay, but not later than 30 days after discovery of the events
requiring notice.</DELETED>
<DELETED>SEC. 427. CIVIL REMEDIES.</DELETED>
<DELETED> (a) Penalties.--Any agency, or business entity engaged in
interstate commerce, that violates this subtitle shall be subject to a
fine of--</DELETED>
<DELETED> (1) not more than $1,000 per individual per day
whose sensitive personally identity information was, or is
reasonably believed to have been, acquired by an unauthorized
person; or</DELETED>
<DELETED> (2) not more than $50,000 per day while the
failure to give notice under this subtitle persists.</DELETED>
<DELETED> (b) Equitable Relief.--Any agency or business entity that
violates, proposes to violate, or has violated this subtitle may be
enjoined from further violations by a court of competent
jurisdiction.</DELETED>
<DELETED> (c) Other Rights and Remedies.--The rights and remedies
available under this subtitle are cumulative and shall not affect any
other rights and remedies available under law.</DELETED>
<DELETED> (d) Fraud Alert.--Section 605A(b)(1) of the Fair Credit
Reporting Act (15 U.S.C. 1681c-1(b)(1)) is amended by inserting ``, or
evidence that the consumer has received notice that the consumer's
financial information has or may have been compromised,'' after
``identity theft report''.</DELETED>
<DELETED> (e) Injunctive Actions by the Attorney General.--Whenever
it appears that a business entity or agency to which this subtitle
applies has engaged, is engaged, or is about to engage, in any act or
practice constituting a violation of this subtitle, the Attorney
General may bring a civil action in an appropriate district court of
the United States to--</DELETED>
<DELETED> (1) enjoin such act or practice;</DELETED>
<DELETED> (2) enforce compliance with this
subtitle;</DELETED>
<DELETED> (3) obtain damages--</DELETED>
<DELETED> (A) in the sum of actual damages,
restitution, and other compensation on behalf of the
affected residents of a State; and</DELETED>
<DELETED> (B) punitive damages, if the violation is
willful or intentional; and</DELETED>
<DELETED> (4) obtain such other relief as the court
determines to be appropriate.</DELETED>
<DELETED>SEC. 428. ENFORCEMENT BY STATE ATTORNEYS GENERAL.</DELETED>
<DELETED> (a) In General.--</DELETED>
<DELETED> (1) Civil actions.--In any case in which the
attorney general of a State, or any State or local law
enforcement agency authorized by the State attorney general or
by State statute to prosecute violations of consumer protection
law, has reason to believe that an interest of the residents of
that State has been or is threatened or adversely affected by
the engagement of any agency or business entity in a practice
that is prohibited under this subtitle, the State, as parens
patriae on behalf of the residents of the State, or the State
or local law enforcement agency on behalf of the residents of
the agency's jurisdiction, may bring a civil action on behalf
of the residents of the State or jurisdiction in a district
court of the United States of appropriate jurisdiction or any
other court of competent jurisdiction, including a State court,
to--</DELETED>
<DELETED> (A) enjoin that practice;</DELETED>
<DELETED> (B) enforce compliance with this
subtitle;</DELETED>
<DELETED> (C) obtain damages, restitution, or other
compensation on behalf of residents of the State;
or</DELETED>
<DELETED> (D) obtain such other relief as the court
may consider to be appropriate.</DELETED>
<DELETED> (2) Notice.--</DELETED>
<DELETED> (A) In general.--Before filing an action
under paragraph (1), the attorney general of the State
involved shall provide to the Attorney General of the
United States--</DELETED>
<DELETED> (i) written notice of the action;
and</DELETED>
<DELETED> (ii) a copy of the complaint for
the action.</DELETED>
<DELETED> (B) Exemption.--</DELETED>
<DELETED> (i) In general.--Subparagraph (A)
shall not apply with respect to the filing of
an action by an attorney general of a State
under this subtitle, if the State attorney
general determines that it is not feasible to
provide the notice described in such
subparagraph before the filing of the
action.</DELETED>
<DELETED> (ii) Notification.--In an action
described in clause (i), the attorney general
of a State shall provide notice and a copy of
the complaint to the Attorney General at the
time the State attorney general files the
action.</DELETED>
<DELETED> (b) Federal Proceedings.--Upon receiving notice under
subsection (a)(2), the Attorney General shall have the right to--
</DELETED>
<DELETED> (1) move to stay the action, pending the final
disposition of a pending Federal proceeding or
action;</DELETED>
<DELETED> (2) intervene in an action brought under
subsection (a)(2); and</DELETED>
<DELETED> (3) file petitions for appeal.</DELETED>
<DELETED> (c) Pending Proceedings.--If the Attorney General has
instituted a proceeding or action for a violation of this subtitle or
any regulations thereunder, no attorney general of a State may, during
the pendency of such proceeding or action, bring an action under this
subtitle against any defendant named in such criminal proceeding or
civil action for any violation that is alleged in that proceeding or
action.</DELETED>
<DELETED> (d) Construction.--For purposes of bringing any civil
action under subsection (a), nothing in this subtitle regarding
notification shall be construed to prevent an attorney general of a
State from exercising the powers conferred on such attorney general by
the laws of that State to--</DELETED>
<DELETED> (1) conduct investigations;</DELETED>
<DELETED> (2) administer oaths or affirmations; or</DELETED>
<DELETED> (3) compel the attendance of witnesses or the
production of documentary and other evidence.</DELETED>
<DELETED> (e) Venue; Service of Process.--</DELETED>
<DELETED> (1) Venue.--Any action brought under subsection
(a) may be brought in--</DELETED>
<DELETED> (A) the district court of the United
States that meets applicable requirements relating to
venue under section 1391 of title 28, United States
Code; or</DELETED>
<DELETED> (B) another court of competent
jurisdiction.</DELETED>
<DELETED> (2) Service of process.--In an action brought
under subsection (a), process may be served in any district in
which the defendant--</DELETED>
<DELETED> (A) is an inhabitant; or</DELETED>
<DELETED> (B) may be found.</DELETED>
<DELETED> (f) No Private Cause of Action.--Nothing in this subtitle
establishes a private cause of action against a data broker for
violation of any provision of this subtitle.</DELETED>
<DELETED>SEC. 429. EFFECT ON FEDERAL AND STATE LAW.</DELETED>
<DELETED> The provisions of this subtitle shall supersede any other
provision of Federal law or any provision of law of any State relating
to notification of a security breach, except as provided in section
424(b).</DELETED>
<DELETED>SEC. 430. AUTHORIZATION OF APPROPRIATIONS.</DELETED>
<DELETED> There are authorized to be appropriated such sums as may
be necessary to cover the costs incurred by the United States Secret
Service to carry out investigations and risk assessments of security
breaches as required under this subtitle.</DELETED>
<DELETED>SEC. 431. REPORTING ON RISK ASSESSMENT EXEMPTION.</DELETED>
<DELETED> The United States Secret Service shall report to Congress
not later than 18 months after the date of enactment of this Act, and
upon the request by Congress thereafter, on the number and nature of
the security breaches described in the notices filed by those business
entities invoking the risk assessment exemption under section 422(b)
and the response of the United States Secret Service to those
notices.</DELETED>
<DELETED>SEC. 432. EFFECTIVE DATE.</DELETED>
<DELETED> This subtitle shall take effect on the expiration of the
date which is 90 days after the date of enactment of this
Act.</DELETED>
<DELETED>TITLE V--GOVERNMENT ACCESS TO AND USE OF COMMERCIAL
DATA</DELETED>
<DELETED>SEC. 501. GENERAL SERVICES ADMINISTRATION REVIEW OF
CONTRACTS.</DELETED>
<DELETED> (a) In General.--In considering contract awards totaling
more than $500,000 and entered into after the date of enactment of this
Act with data brokers, the Administrator of the General Services
Administration shall evaluate--</DELETED>
<DELETED> (1) the data privacy and security program of a
data broker to ensure the privacy and security of data
containing personally identifiable information, including
whether such program adequately addresses privacy and security
threats created by malicious software or code, or the use of
peer-to-peer file sharing software;</DELETED>
<DELETED> (2) the compliance of a data broker with such
program;</DELETED>
<DELETED> (3) the extent to which the databases and systems
containing personally identifiable information of a data broker
have been compromised by security breaches; and</DELETED>
<DELETED> (4) the response by a data broker to such
breaches, including the efforts by such data broker to mitigate
the impact of such breaches.</DELETED>
<DELETED> (b) Compliance Safe Harbor.--The data privacy and security
program of a data broker shall be deemed sufficient for the purposes of
subsection (a), if the data broker complies with or provides protection
equal to industry standards, as identified by the Federal Trade
Commission, that are applicable to the type of personally identifiable
information involved in the ordinary course of business of such data
broker.</DELETED>
<DELETED> (c) Penalties.--In awarding contracts with data brokers
for products or services related to access, use, compilation,
distribution, processing, analyzing, or evaluating personally
identifiable information, the Administrator of the General Services
Administration shall--</DELETED>
<DELETED> (1) include monetary or other penalties--
</DELETED>
<DELETED> (A) for failure to comply with subtitles A
and B of title IV of this Act; or</DELETED>
<DELETED> (B) if a contractor knows or has reason to
know that the personally identifiable information being
provided is inaccurate, and provides such inaccurate
information; and</DELETED>
<DELETED> (2) require a data broker that engages service
providers not subject to subtitle A of title IV for
responsibilities related to sensitive personally identifiable
information to--</DELETED>
<DELETED> (A) exercise appropriate due diligence in
selecting those service providers for responsibilities
related to personally identifiable
information;</DELETED>
<DELETED> (B) take reasonable steps to select and
retain service providers that are capable of
maintaining appropriate safeguards for the security,
privacy, and integrity of the personally identifiable
information at issue; and</DELETED>
<DELETED> (C) require such service providers, by
contract, to implement ad maintain appropriate measures
designed to meet the objectives and requirements in
title IV.</DELETED>
<DELETED> (d) Limitation.--The penalties under subsection (c) shall
not apply to a data broker providing information that is accurately and
completely recorded from a public record source.</DELETED>
<DELETED>SEC. 502. REQUIREMENT TO AUDIT INFORMATION SECURITY PRACTICES
OF CONTRACTORS AND THIRD PARTY BUSINESS
ENTITIES.</DELETED>
<DELETED> Section 3544(b) of title 44, United States Code, is
amended--</DELETED>
<DELETED> (1) in paragraph (7)(C)(iii), by striking ``and''
after the semicolon;</DELETED>
<DELETED> (2) in paragraph (8), by striking the period and
inserting ``; and''; and</DELETED>
<DELETED> (3) by adding at the end the following:</DELETED>
<DELETED> ``(9) procedures for evaluating and auditing the
information security practices of contractors or third party
business entities supporting the information systems or
operations of the agency involving personally identifiable
information (as that term is defined in section 3 of the
Personal Data Privacy and Security Act of 2005) and ensuring
remedial action to address any significant
deficiencies.''.</DELETED>
<DELETED>SEC. 503. PRIVACY IMPACT ASSESSMENT OF GOVERNMENT USE OF
COMMERCIAL INFORMATION SERVICES CONTAINING PERSONALLY
IDENTIFIABLE INFORMATION.</DELETED>
<DELETED> (a) In General.--Section 208(b)(1) of the E-Government Act
of 2002 (44 U.S.C. 3501 note) is amended--</DELETED>
<DELETED> (1) in subparagraph (A)(i), by striking ``or'';
and</DELETED>
<DELETED> (2) in subparagraph (A)(ii), by striking the
period and inserting ``; or''; and</DELETED>
<DELETED> (3) by inserting after clause (ii) the
following:</DELETED>
<DELETED> ``(iii) purchasing or subscribing
for a fee to personally identifiable
information from a data broker (as such terms
are defined in section 3 of the Personal Data
Privacy and Security Act of 2005).''.</DELETED>
<DELETED> (b) Limitation.--Notwithstanding any other provision of
law, commencing 1 year after the date of enactment of this Act, no
Federal department or agency may enter into a contract with a data
broker to access for a fee any database consisting primarily of
personally identifiable information concerning United States persons
(other than news reporting or telephone directories) unless the head of
such department or agency--</DELETED>
<DELETED> (1) completes a privacy impact assessment under
section 208 of the E-Government Act of 2002 (44 U.S.C. 3501
note), which shall subject to the provision in that Act
pertaining to sensitive information, include a description of--
</DELETED>
<DELETED> (A) such database;</DELETED>
<DELETED> (B) the name of the data broker from whom
it is obtained; and</DELETED>
<DELETED> (C) the amount of the contract for
use;</DELETED>
<DELETED> (2) adopts regulations that specify--</DELETED>
<DELETED> (A) the personnel permitted to access,
analyze, or otherwise use such databases;</DELETED>
<DELETED> (B) standards governing the access,
analysis, or use of such databases;</DELETED>
<DELETED> (C) any standards used to ensure that the
personally identifiable information accessed, analyzed,
or used is the minimum necessary to accomplish the
intended legitimate purpose of the Federal department
or agency;</DELETED>
<DELETED> (D) standards limiting the retention and
redisclosure of personally identifiable information
obtained from such databases;</DELETED>
<DELETED> (E) procedures ensuring that such data
meet standards of accuracy, relevance, completeness,
and timeliness;</DELETED>
<DELETED> (F) the auditing and security measures to
protect against unauthorized access, analysis, use, or
modification of data in such databases;</DELETED>
<DELETED> (G) applicable mechanisms by which
individuals may secure timely redress for any adverse
consequences wrongly incurred due to the access,
analysis, or use of such databases;</DELETED>
<DELETED> (H) mechanisms, if any, for the
enforcement and independent oversight of existing or
planned procedures, policies, or guidelines;
and</DELETED>
<DELETED> (I) an outline of enforcement mechanisms
for accountability to protect individuals and the
public against unlawful or illegitimate access or use
of databases; and</DELETED>
<DELETED> (3) incorporates into the contract or other
agreement totaling more than $500,000, provisions--</DELETED>
<DELETED> (A) providing for penalties--</DELETED>
<DELETED> (i) for failure to comply with
title IV of this Act; or</DELETED>
<DELETED> (ii) if the entity knows or has
reason to know that the personally identifiable
information being provided to the Federal
department or agency is inaccurate, and
provides such inaccurate information.</DELETED>
<DELETED> (B) requiring a data broker that engages
service providers not subject to subtitle A of title IV
for responsibilities related to sensitive personally
identifiable information to--</DELETED>
<DELETED> (i) exercise appropriate due
diligence in selecting those service providers
for responsibilities related to personally
identifiable information;</DELETED>
<DELETED> (ii) take reasonable steps to
select and retain service providers that are
capable of maintaining appropriate safeguards
for the security, privacy, and integrity of the
personally identifiable information at issue;
and</DELETED>
<DELETED> (iii) require such service
providers, by contract, to implement ad
maintain appropriate measures designed to meet
the objectives and requirements in title
IV.</DELETED>
<DELETED> (c) Limitation on Penalties.--The penalties under
paragraph (3)(A) shall not apply to a data broker providing information
that is accurately and completely recorded from a public record
source.</DELETED>
<DELETED> (d) Individual Screening Programs.--</DELETED>
<DELETED> (1) In general.--Notwithstanding any other
provision of law, commencing one year after the date of
enactment of this Act, no Federal department or agency may use
commercial databases or contract with a data broker to
implement an individual screening program unless such program
is--</DELETED>
<DELETED> (A) congressionally authorized;
and</DELETED>
<DELETED> (B) subject to regulations developed by
notice and comment that--</DELETED>
<DELETED> (i) establish a procedure to
enable individuals, who suffer an adverse
consequence because the screening system
determined that they might pose a security
threat, to appeal such determination and
correct information contained in the
system;</DELETED>
<DELETED> (ii) ensure that Federal and
commercial databases that will be used to
establish the identity of individuals or
otherwise make assessments of individuals under
the system will not produce a large number of
false positives or unjustified adverse
consequences;</DELETED>
<DELETED> (iii) ensure the efficacy and
accuracy of all of the search tools that will
be used and ensure that the department or
agency can make an accurate predictive
assessment of those who may constitute a
threat;</DELETED>
<DELETED> (iv) establish an internal
oversight board to oversee and monitor the
manner in which the system is being
implemented;</DELETED>
<DELETED> (v) establish sufficient
operational safeguards to reduce the
opportunities for abuse;</DELETED>
<DELETED> (vi) implement substantial
security measures to protect the system from
unauthorized access;</DELETED>
<DELETED> (vii) adopt policies establishing
the effective oversight of the use and
operation of the system; and</DELETED>
<DELETED> (viii) ensure that there are no
specific privacy concerns with the
technological architecture of the system;
and</DELETED>
<DELETED> (C) coordinated with the Terrorist
Screening Center or any such successor
organization.</DELETED>
<DELETED> (2) Definition.--As used in this subsection, the
term ``individual screening program''--</DELETED>
<DELETED> (A) means a system that relies on
personally identifiable information from commercial
databases to--</DELETED>
<DELETED> (i) evaluate all or most
individuals seeking to exercise a particular
right or privilege under Federal law;
and</DELETED>
<DELETED> (ii) determine whether such
individuals are on a terrorist watch list or
otherwise pose a security threat; and</DELETED>
<DELETED> (B) does not include any program or system
to grant security clearances.</DELETED>
<DELETED> (e) Study of Government Use.--</DELETED>
<DELETED> (1) Scope of study.--Not later than 180 days after
the date of enactment of this Act, the Comptroller General of
the United States shall conduct a study and audit and prepare a
report on Federal agency use of data brokers or commercial
databases containing personally identifiable information,
including the impact on privacy and security, and the extent to
which Federal contracts include sufficient provisions to ensure
privacy and security protections, and penalties for failures in
privacy and security practices.</DELETED>
<DELETED> (2) Report.--A copy of the report required under
paragraph (1) shall be submitted to Congress.</DELETED>
<DELETED>SEC. 504. IMPLEMENTATION OF CHIEF PRIVACY OFFICER
REQUIREMENTS.</DELETED>
<DELETED> (a) Designation of the Chief Privacy Officer.--Pursuant to
the requirements under section 522 of the Transportation, Treasury,
Independent Agencies, and General Government Appropriations Act, 2005
(division H of Public Law 108-447; 118 Stat. 3199) that each agency
designate a Chief Privacy Officer, the Department of Justice shall
implement such requirements by designating a department-wide Chief
Privacy Officer, whose primary role shall be to fulfill the duties and
responsibilities of Chief Privacy Officer and who shall report directly
to the Deputy Attorney General.</DELETED>
<DELETED> (b) Duties and Responsibilities of Chief Privacy
Officer.--In addition to the duties and responsibilities outlined under
section 522 of the Transportation, Treasury, Independent Agencies, and
General Government Appropriations Act, 2005 (division H of Public Law
108-447; 118 Stat. 3199), the Department of Justice Chief Privacy
Officer shall--</DELETED>
<DELETED> (1) oversee the Department of Justice's
implementation of the requirements under section 603 to conduct
privacy impact assessments of the use of commercial data
containing personally identifiable information by the
Department;</DELETED>
<DELETED> (2) promote the use of law enforcement
technologies that sustain privacy protections, and assure that
the implementation of such technologies relating to the use,
collection, and disclosure of personally identifiable
information preserve the privacy and security of such
information; and</DELETED>
<DELETED> (3) coordinate with the Privacy and Civil
Liberties Oversight Board, established in the Intelligence
Reform and Terrorism Prevention Act of 2004 (Public Law 108-
458), in implementing paragraphs (1) and (2) of this
subsection.</DELETED>
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) Short Title.--This Act may be cited as the ``Personal Data
Privacy and Security Act of 2005''.
(b) Table of Contents.--The table of contents for this Act is as
follows:
Sec. 1. Short title; table of contents.
Sec. 2. Findings.
Sec. 3. Definitions.
TITLE I--ENHANCING PUNISHMENT FOR IDENTITY THEFT AND OTHER VIOLATIONS
OF DATA PRIVACY AND SECURITY
Sec. 101. Organized criminal activity in connection with unauthorized
access to personally identifiable
information.
Sec. 102. Concealment of security breaches involving sensitive
personally identifiable information.
Sec. 103. Review and amendment of Federal sentencing guidelines related
to fraudulent access to or misuse of
digitized or electronic personally
identifiable information.
TITLE II--DATA BROKERS
Sec. 201. Transparency and accuracy of data collection.
Sec. 202. Enforcement.
Sec. 203. Relation to state laws.
Sec. 204. Effective date.
TITLE III--PRIVACY AND SECURITY OF PERSONALLY IDENTIFIABLE INFORMATION
Subtitle A--A Data Privacy and Security Program
Sec. 301. Purpose and applicability of data privacy and security
program.
Sec. 302. Requirements for a personal data privacy and security
program.
Sec. 303. Enforcement.
Sec. 304. Relation to other laws.
Subtitle B--Security Breach Notification
Sec. 321. Notice to individuals.
Sec. 322. Exemptions.
Sec. 323. Methods of notice.
Sec. 324. Content of notification.
Sec. 325. Coordination of notification with credit reporting agencies.
Sec. 326. Notice to law enforcement.
Sec. 327. Enforcement.
Sec. 328. Enforcement by State attorneys general.
Sec. 329. Effect on Federal and State law.
Sec. 330. Authorization of appropriations.
Sec. 331. Reporting on risk assessment exemptions.
Sec. 332. Effective date.
TITLE IV--GOVERNMENT ACCESS TO AND USE OF COMMERCIAL DATA
Sec. 401. General services administration review of contracts.
Sec. 402. Requirement to audit information security practices of
contractors and third party business
entities.
Sec. 403. Privacy impact assessment of government use of commercial
information services containing personally
identifiable information.
Sec. 404. Implementation of chief privacy officer requirements.
SEC. 2. FINDINGS.
Congress finds that--
(1) databases of personally identifiable information are
increasingly prime targets of hackers, identity thieves, rogue
employees, and other criminals, including organized and
sophisticated criminal operations;
(2) identity theft is a serious threat to the nation's
economic stability, homeland security, the development of e-
commerce, and the privacy rights of Americans;
(3) over 9,300,000 individuals were victims of identity
theft in America last year;
(4) security breaches are a serious threat to consumer
confidence, homeland security, e-commerce, and economic
stability;
(5) it is important for business entities that own, use, or
license personally identifiable information to adopt reasonable
procedures to ensure the security, privacy, and confidentiality
of that personally identifiable information;
(6) individuals whose personal information has been
compromised or who have been victims of identity theft should
receive the necessary information and assistance to mitigate
their damages and to restore the integrity of their personal
information and identities;
(7) data brokers have assumed a significant role in
providing identification, authentication, and screening
services, and related data collection and analyses for
commercial, nonprofit, and government operations;
(8) data misuse and use of inaccurate data have the
potential to cause serious or irreparable harm to an
individual's livelihood, privacy, and liberty and undermine
efficient and effective business and government operations;
(9) there is a need to insure that data brokers conduct
their operations in a manner that prioritizes fairness,
transparency, accuracy, and respect for the privacy of
consumers;
(10) government access to commercial data can potentially
improve safety, law enforcement, and national security; and
(11) because government use of commercial data containing
personal information potentially affects individual privacy,
and law enforcement and national security operations, there is
a need for Congress to exercise oversight over government use
of commercial data.
SEC. 3. DEFINITIONS.
In this Act:
(1) Agency.--The term ``agency'' has the same meaning given
such term in section 551 of title 5, United States Code.
(2) Affiliate.--The term ``affiliate'' means persons
related by common ownership or by corporate control.
(3) Business entity.--The term ``business entity'' means
any organization, corporation, trust, partnership, sole
proprietorship, unincorporated association, venture established
to make a profit, or nonprofit, and any contractor,
subcontractor, affiliate, or licensee thereof engaged in
interstate commerce.
(4) Identity theft.--The term ``identity theft'' means a
violation of section 1028 of title 18, United States Code.
(5) Data broker.--The term ``data broker'' means a business
entity which for monetary fees or dues regularly engages in the
practice of collecting, transmitting, or providing access to
sensitive personally identifiable information on more than
5,000 individuals who are not the customers or employees of
that business entity or affiliate primarily for the purposes of
providing such information to nonaffiliated third parties on an
interstate basis.
(6) Data furnisher.--The term ``data furnisher'' means any
agency, organization, corporation, trust, partnership, sole
proprietorship, unincorporated association, or nonprofit that
serves as a source of information for a data broker.
(7) Personal electronic record.--
(A) In general.--The term ``personal electronic
record'' means data associated with an individual
contained in a database, networked or integrated
databases, or other data system that holds sensitive
personally identifiable information of that individual
and is provided to nonaffiliated third parties.
(B) Exclusions.--The term ``personal electronic
record'' does not include--
(i) any data related to an individual's
past purchases of consumer goods; or
(ii) any proprietary assessment or
evaluation of an individual or any proprietary
assessment or evaluation of information about
an individual.
(8) Personally identifiable information.--The term
``personally identifiable information'' means any information,
or compilation of information, in electronic or digital form
serving as a means of identification, as defined by section
1028(d)(7) of title 18, United State Code.
(9) Public record source.--The term ``public record
source'' means the Congress, any agency, any State or local
government agency, the government of the District of Columbia
and governments of the territories or possessions of the United
States, and Federal, State or local courts, courts martial and
military commissions, that maintain personally identifiable
information in records available to the public.
(10) Security breach.--
(A) In general.--The term ``security breach'' means
compromise of the security, confidentiality, or
integrity of computerized data through
misrepresentation or actions that result in, or there
is a reasonable basis to conclude has resulted in,
acquisition of or access to sensitive personally
identifiable information that is unauthorized or in
excess of authorization.
(B) Exclusion.--The term ``security breach'' does
not include--
(i) a good faith acquisition of sensitive
personally identifiable information by a
business entity or agency, or an employee or
agent of a business entity or agency, if the
sensitive personally identifiable information
is not subject to further unauthorized
disclosure; or
(ii) the release of a public record not
otherwise subject to confidentiality or
nondisclosure requirements.
(11) Sensitive personally identifiable information.--The
term ``sensitive personally identifiable information'' means
any information or compilation of information, in electronic or
digital form that includes--
(A) an individual's first and last name or first
initial and last name in combination with any 1 of the
following data elements:
(i) A non-truncated social security number,
driver's license number, passport number, or
alien registration number.
(ii) Any 2 of the following:
(I) Home address or telephone
number.
(II) Mother's maiden name, if
identified as such.
(III) Month, day, and year of
birth.
(iii) Unique biometric data such as a
finger print, voice print, a retina or iris
image, or any other unique physical
representation.
(iv) A unique account identifier,
electronic identification number, user name, or
routing code in combination with any associated
security code, access code, or password that is
required for an individual to obtain money,
goods, services or any other thing of value; or
(B) a financial account number or credit or debit
card number in combination with any security code,
access code or password that is required for an
individual to obtain money, goods, services or any
other thing of value.
TITLE I--ENHANCING PUNISHMENT FOR IDENTITY THEFT AND OTHER VIOLATIONS
OF DATA PRIVACY AND SECURITY
SEC. 101. ORGANIZED CRIMINAL ACTIVITY IN CONNECTION WITH UNAUTHORIZED
ACCESS TO PERSONALLY IDENTIFIABLE INFORMATION.
Section 1961(1) of title 18, United States Code, is amended by
inserting ``section 1030(a)(2)(D) (relating to fraud and related
activity in connection with unauthorized access to sensitive personally
identifiable information as defined in the Data Privacy and Security
Act of 2005,'' before ``section 1084'' .
SEC. 102. CONCEALMENT OF SECURITY BREACHES INVOLVING SENSITIVE
PERSONALLY IDENTIFIABLE INFORMATION.
(a) In General.--Chapter 47 of title 18, United States Code, is
amended by adding at the end the following:
``SEC. 1039. CONCEALMENT OF SECURITY BREACHES INVOLVING SENSITIVE
PERSONALLY IDENTIFIABLE INFORMATION.
``(a) Whoever, having knowledge of a security breach and of the
obligation either individually or collectively to provide notice of
such breach to individuals under title IV of the Personal Data Privacy
and Security Act of 2005, and having not otherwise qualified for an
exemption from providing notice under section 422 of such Act,
intentionally and willfully conceals the fact of such security breach
and which breach causes economic damage to 1 or more persons, shall be
fined under this title or imprisoned not more than 5 years, or both.
``(b) For purposes of subsection (a), the term `person' has the
same meaning as in section 1030(e)(12) of title 18, United States
Code.''.
(b) Conforming and Technical Amendments.--The table of sections for
chapter 47 of title 18, United States Code, is amended by adding at the
end the following:
``1039. Concealment of security breaches involving personally
identifiable information.''.
(c) Enforcement Authority.--
(1) In general.--The United States Secret Service shall
have the authority to investigate offenses under this section.
(2) Non-exclusivity.--The authority granted in paragraph
(1) shall not be exclusive of any existing authority held by
any other Federal agency.
SEC. 103. REVIEW AND AMENDMENT OF FEDERAL SENTENCING GUIDELINES RELATED
TO FRAUDULENT ACCESS TO OR MISUSE OF DIGITIZED OR
ELECTRONIC PERSONALLY IDENTIFIABLE INFORMATION.
(a) Review and Amendment.--The United States Sentencing Commission,
pursuant to its authority under section 994 of title 28, United States
Code, and in accordance with this section, shall review and, if
appropriate, amend the Federal sentencing guidelines (including its
policy statements) applicable to persons convicted of using fraud to
access, or misuse of, digitized or electronic personally identifiable
information, including identity theft or any offense under--
(1) sections 1028, 1028A, 1030, 1030A, 2511, and 2701 of
title 18, United States Code; and
(2) any other relevant provision.
(b) Requirements.--In carrying out the requirements of this
section, the United States Sentencing Commission shall--
(1) ensure that the Federal sentencing guidelines
(including its policy statements) reflect--
(A) the serious nature of the offenses and
penalties referred to in this Act;
(B) the growing incidences of theft and misuse of
digitized or electronic personally identifiable
information, including identity theft; and
(C) the need to deter, prevent, and punish such
offenses;
(2) consider the extent to which the Federal sentencing
guidelines (including its policy statements) adequately address
violations of the sections amended by this Act to--
(A) sufficiently deter and punish such offenses;
and
(B) adequately reflect the enhanced penalties
established under this Act;
(3) maintain reasonable consistency with other relevant
directives and sentencing guidelines;
(4) account for any additional aggravating or mitigating
circumstances that might justify exceptions to the generally
applicable sentencing ranges;
(5) consider whether to provide a sentencing enhancement
for those convicted of the offenses described in subsection
(a), if the conduct involves--
(A) the online sale of fraudulently obtained or
stolen personally identifiable information;
(B) the sale of fraudulently obtained or stolen
personally identifiable information to an individual
who is engaged in terrorist activity or aiding other
individuals engaged in terrorist activity; or
(C) the sale of fraudulently obtained or stolen
personally identifiable information to finance
terrorist activity or other criminal activities;
(6) make any necessary conforming changes to the Federal
sentencing guidelines to ensure that such guidelines (including
its policy statements) as described in subsection (a) are
sufficiently stringent to deter, and adequately reflect crimes
related to fraudulent access to, or misuse of, personally
identifiable information; and
(7) ensure that the Federal sentencing guidelines
adequately meet the purposes of sentencing under section
3553(a)(2) of title 18, United States Code.
(c) Emergency Authority to Sentencing Commission.--The United
States Sentencing Commission may, as soon as practicable, promulgate
amendments under this section in accordance with procedures established
in section 21(a) of the Sentencing Act of 1987 (28 U.S.C. 994 note) as
though the authority under that Act had not expired.
TITLE II--DATA BROKERS
SEC. 201. TRANSPARENCY AND ACCURACY OF DATA COLLECTION.
(a) In General.--Data brokers engaging in interstate commerce are
subject to the requirements of this title for any product or service
offered to third parties that allows access or use of sensitive
personally identifiable information.
(b) Limitation.--Notwithstanding any other provision of this title,
this section shall not apply to--
(1) any product or service offered by a data broker
engaging in interstate commerce where such product or service
is currently subject to, and in compliance with, access and
accuracy protections similar to those under subsections (c)
through (f) of this section under the Fair Credit Reporting Act
(Public Law 91-508);
(2) any data broker that is subject to regulation under the
Gramm-Leach-Bliley Act (Public Law 106-102);
(3) any data broker currently subject to and in compliance
with the data security requirements for such entities under the
Health Insurance Portability and Accountability Act (Public Law
104-191), and its implementing regulations;
(4) information in a personal electronic record that--
(A) the data broker has identified as inaccurate,
but maintains for the purpose of aiding the data broker
in preventing inaccurate information from entering an
individual's personal electronic record; and
(B) is not maintained primarily for the purpose of
transmitting or otherwise providing that information,
or assessments based on that information, to non-
affiliated third parties; and
(5) information concerning proprietary methodologies,
techniques, scores, or algorithms relating to fraud prevention
not normally provided to third parties in the ordinary course
of business.
(c) Disclosures to Individuals.--
(1) In general.--A data broker shall, upon the request of
an individual, disclose to such individual for a reasonable fee
all personal electronic records pertaining to that individual
maintained specifically for disclosure to third parties that
request information on that individual in the ordinary course
of business in the databases or systems of the data broker at
the time of such request.
(2) Information on how to correct inaccuracies.--The
disclosures required under paragraph (1) shall also include
guidance to individuals on procedures for correcting
inaccuracies.
(d) Accuracy Resolution Process.--
(1) Information from a public record or licensor.--
(A) In general.--If an individual notifies a data
broker of a dispute as to the completeness or accuracy
of information disclosed to such individual under
subsection (c) that is derived from a public record
source or pursuant to a license agreement, such data
broker shall determine within 30 days whether the
information in its system accurately and completely
records the information available from the public
record source or licensor.
(B) Data broker actions.--If a data broker
determines under subparagraph (A) that the information
in its systems does not accurately and completely
record the information available from a public record
source or licensor, the data broker shall --
(i) correct any inaccuracies or
incompleteness, and provide to such individual
written notice of such changes; or
(ii) provide such individual with the
contact information of the public record or
licensor.
(2) Information not from a public record source or
licensor.--If an individual notifies a data broker of a dispute
as to the completeness or accuracy of information not from a
public record or licensor that was disclosed to the individual
under subsection (c), the data broker shall, within 30 days of
receiving notice of such dispute--
(A) review and consider free of charge any
information submitted by such individual that is
relevant to the completeness or accuracy of the
disputed information; and
(B) correct any information found to be incomplete
or inaccurate and provide notice to such individual of
whether and what information was corrected, if any.
(3) Extension of review period.--The 30-day period
described in paragraph (1) may be extended for not more than 30
additional days if a data broker receives information from the
individual during the initial 30-day period that is relevant to
the completeness or accuracy of any disputed information.
(4) Notice identifying the data furnisher.--If the
completeness or accuracy of any information not from a public
record source or licensor that was disclosed to an individual
under subsection (c) is disputed by such individual, the data
broker shall provide, upon the request of such individual, the
contact information of any data furnisher that provided the
disputed information.
(5) Determination that dispute is frivolous or
irrelevant.--
(A) In general.--Notwithstanding paragraphs (1)
through (3), a data broker may decline to investigate
or terminate a review of information disputed by an
individual under those paragraphs if the data broker
reasonably determines that the dispute by the
individual is frivolous or intended to perpetrate
fraud.
(B) Notice.--A data broker shall notify an
individual of a determination under subparagraph (A)
within a reasonable time by any means available to such
data broker.
SEC. 202. ENFORCEMENT.
(a) Civil Penalties.--
(1) Penalties.--Any data broker that violates the
provisions of section 201 shall be subject to civil penalties
of not more than $1,000 per violation per day while such
violations persist, up to a maximum of $250,000 per violation.
(2) Intentional or willful violation.--A data broker that
intentionally or willfully violates the provisions of section
201 shall be subject to additional penalties in the amount of
$1,000 per violation per day, to a maximum of an additional
$250,000 per violation, while such violations persist.
(3) Equitable relief.--A data broker engaged in interstate
commerce that violates this section may be enjoined from
further violations by a court of competent jurisdiction.
(4) Other rights and remedies.--The rights and remedies
available under this subsection are cumulative and shall not
affect any other rights and remedies available under law.
(b) Federal Trade Commission Authority.--Any data broker shall have
the provisions of this title enforced against it by the Federal Trade
Commission.
(c) State Enforcement.--
(1) Civil actions.--In any case in which the attorney
general of a State or any State or local law enforcement agency
authorized by the State attorney general or by State statute to
prosecute violations of consumer protection law, has reason to
believe that an interest of the residents of that State has
been or is threatened or adversely affected by the acts or
practices of a data broker that violate this subtitle, the
State may bring a civil action on behalf of the residents of
that State in a district court of the United States of
appropriate jurisdiction, or any other court of competent
jurisdiction, to--
(A) enjoin that act or practice;
(B) enforce compliance with this title; or
(C) obtain civil penalties of not more than $1,000
per violation per day while such violations persist, up
to a maximum of $250,000 per violation.
(2) Notice.--
(A) In general.--Before filing an action under this
subsection, the attorney general of the State involved
shall provide to the Federal Trade Commission--
(i) a written notice of that action; and
(ii) a copy of the complaint for that
action.
(B) Exception.--Subparagraph (A) shall not apply
with respect to the filing of an action by an attorney
general of a State under this subsection, if the
attorney general of a State determines that it is not
feasible to provide the notice described in
subparagraph (A) before the filing of the action.
(C) Notification when practicable.--In an action
described under subparagraph (B), the attorney general
of a State shall provide the written notice and the
copy of the complaint to the Federal Trade Commission
as soon after the filing of the complaint as
practicable.
(3) Federal trade commission authority.--Upon receiving
notice under paragraph (2), the Federal Trade Commission shall
have the right to--
(A) move to stay the action, pending the final
disposition of a pending Federal proceeding or action
as described in paragraph (4);
(B) intervene in an action brought under paragraph
(1); and
(C) file petitions for appeal.
(4) Pending proceedings.--If the Federal Trade Commission
has instituted a proceeding or civil action for a violation of
this title, no attorney general of a State may, during the
pendency of such proceeding or civil action, bring an action
under this subsection against any defendant named in such civil
action for any violation that is alleged in that civil action.
(5) Rule of construction.--For purposes of bringing any
civil action under paragraph (1), nothing in this title shall
be construed to prevent an attorney general of a State from
exercising the powers conferred on the attorney general by the
laws of that State to--
(A) conduct investigations;
(B) administer oaths and affirmations; or
(C) compel the attendance of witnesses or the
production of documentary and other evidence.
(6) Venue; service of process.--
(A) Venue.--Any action brought under this
subsection may be brought in the district court of the
United States that meets applicable requirements
relating to venue under section 1931 of title 28,
United States Code.
(B) Service of process.--In an action brought under
this subsection process may be served in any district
in which the defendant--
(i) is an inhabitant; or
(ii) may be found.
(d) No Private Cause of Action.--Nothing in this title establishes
a private cause of action against a data broker for violation of any
provision of this title.
(e) Implementation Time Line.--Not later than 1 year after the date
of enactment of this Act, a business entity subject to the provisions
of this title shall implement a data privacy and security program
pursuant to this title.
SEC. 203. RELATION TO STATE LAWS.
No requirement or prohibition may be imposed under the laws of any
State with respect to any subject matter regulated under section 201,
relating to individual access to, and correction of, personal
electronic records held by data brokers.
SEC. 204. EFFECTIVE DATE.
This title shall take effect 180 days after the date of enactment
of this Act.
TITLE III--PRIVACY AND SECURITY OF PERSONALLY IDENTIFIABLE INFORMATION
Subtitle A--A Data Privacy and Security Program
SEC. 301. PURPOSE AND APPLICABILITY OF DATA PRIVACY AND SECURITY
PROGRAM.
(a) Purpose.--The purpose of this subtitle is to ensure standards
for developing and implementing administrative, technical, and physical
safeguards to protect the security of sensitive personally identifiable
information.
(b) In General.--A business entity engaging in interstate commerce
that involves collecting, accessing, transmitting, using, storing, or
disposing of sensitive personally identifiable information in
electronic or digital form on 10,000 or more United States persons is
subject to the requirements for a data privacy and security program
under section 302 for protecting sensitive personally identifiable
information.
(c) Limitations.--Notwithstanding any other obligation under this
subtitle, this subtitle does not apply to:
(1) Financial institutions.--Financial institutions--
(A) subject to the data security requirements and
implementing regulations under the Gramm-Leach-Bliley
Act (15 U.S.C. 6801 et seq.); and
(B) subject to--
(i) examinations for compliance with the
requirements of this Act by a Federal
Functional Regulator or State Insurance
Authority (as those terms are defined in
section 509 of the Gramm-Leach-Bliley Act (15
U.S.C. 6809)); or
(ii) compliance with part 314 of title 16,
Code of Federal Regulations.
(2) HIPPA regulated entities.--
(A) Covered entities.--Covered entities subject to
the Health Insurance Portability and Accountability Act
of 1996 (42 U.S.C. 1301 et seq.), including the data
security requirements and implementing regulations of
that Act.
(B) Business entities.--A business entity shall be
deemed in compliance with the privacy and security
program requirements under section 302 if the business
entity is acting as a ``business associate'' as that
term is defined in the Health Insurance Portability and
Accountability Act of 1996 (42 U.S.C. 1301 et. seq.)
and is in compliance with requirements imposed under
that Act and its implementing regulations
(d) Safe Harbors.--
(1) In general.--A business entity shall be deemed in
compliance with the privacy and security program requirements
under section 302 if the business entity complies with or
provides protection equal to industry standards, as identified
by the Federal Trade Commission, that are applicable to the
type of sensitive personally identifiable information involved
in the ordinary course of business of such business entity.
(2) Limitation.--Nothing in this subsection shall be
construed to permit, and nothing does permit, the Federal Trade
Commission to issue regulations requiring, or according greater
legal status to, the implementation of or application of a
specific technology or technological specifications for meeting
the requirements of this title.
SEC. 302. REQUIREMENTS FOR A PERSONAL DATA PRIVACY AND SECURITY
PROGRAM.
(a) Personal Data Privacy and Security Program.--A business entity
subject to this subtitle shall comply with the following safeguards and
any other administrative, technical, or physical safeguards identified
by the Federal Trade Commission in a rulemaking process pursuant to
section 553 of title 5, United States Code, for the protection of
sensitive personally identifiable information:
(1) Scope.--A business entity shall implement a
comprehensive personal data privacy and security program that
includes administrative, technical, and physical safeguards
appropriate to the size and complexity of the business entity
and the nature and scope of its activities.
(2) Design.--The personal data privacy and security program
shall be designed to--
(A) ensure the privacy, security, and
confidentiality of personal electronic records;
(B) protect against any anticipated vulnerabilities
to the privacy, security, or integrity of sensitive
personally identifying information; and
(C) protect against unauthorized access to use of
sensitive personally identifying information that could
result in substantial harm or inconvenience to any
individual.
(3) Risk assessment.--A business entity shall--
(A) identify reasonably foreseeable internal and
external vulnerabilities that could result in
unauthorized access, disclosure, use, or alteration of
sensitive personally identifiable information or
systems containing sensitive personally identifiable
information;
(B) assess the likelihood of and potential damage
from unauthorized access, disclosure, use, or
alteration of sensitive personally identifiable
information;
(C) assess the sufficiency of its policies,
technologies, and safeguards in place to control and
minimize risks from unauthorized access, disclosure,
use, or alteration of sensitive personally identifiable
information; and
(D) assess the vulnerability of sensitive
personally identifiable information during destruction
and disposal of such information, including through the
disposal or retirement of hardware.
(4) Risk management and control.--Each business entity
shall--
(A) design its personal data privacy and security
program to control the risks identified under paragraph
(3); and
(B) adopt measures commensurate with the
sensitivity of the data as well as the size,
complexity, and scope of the activities of the business
entity that--
(i) control access to systems and
facilities containing sensitive personally
identifiable information, including controls to
authenticate and permit access only to
authorized individuals;
(ii) detect actual and attempted
fraudulent, unlawful, or unauthorized access,
disclosure, use, or alteration of sensitive
personally identifiable information, including
by employees and other individuals otherwise
authorized to have access;
(iii) protect sensitive personally
identifiable information during use,
transmission, storage, and disposal by
encryption or other reasonable means (including
as directed for disposal of records under
section 628 of the Fair Credit Reporting Act
(15 U.S.C. 1681w) and the implementing
regulations of such Act as set forth in section
682 of title 16, Code of Federal Regulations);
and
(iv) ensure that sensitive personally
identifiable information is properly destroyed
and disposed of, including during the
destruction of computers, diskettes, and other
electronic media that contain sensitive
personally identifiable information.
(b) Training.--Each business entity subject to this subtitle shall
take steps to ensure employee training and supervision for
implementation of the data security program of the business entity.
(c) Vulnerability Testing.--
(1) In general.--Each business entity subject to this
subtitle shall take steps to ensure regular testing of key
controls, systems, and procedures of the personal data privacy
and security program to detect, prevent, and respond to attacks
or intrusions, or other system failures.
(2) Frequency.--The frequency and nature of the tests
required under paragraph (1) shall be determined by the risk
assessment of the business entity under subsection (a)(3).
(d) Relationship to Service Providers.--In the event a business
entity subject to this subtitle engages service providers not subject
to this subtitle, such business entity shall--
(1) exercise appropriate due diligence in selecting those
service providers for responsibilities related to sensitive
personally identifiable information, and take reasonable steps
to select and retain service providers that are capable of
maintaining appropriate safeguards for the security, privacy,
and integrity of the sensitive personally identifiable
information at issue; and
(2) require those service providers by contract to
implement and maintain appropriate measures designed to meet
the objectives and requirements governing entities subject to
section 301, this section, and subtitle B.
(e) Periodic Assessment and Personal Data Privacy and Security
Modernization.--Each business entity subject to this subtitle shall on
a regular basis monitor, evaluate, and adjust, as appropriate its data
privacy and security program in light of any relevant changes in--
(1) technology;
(2) the sensitivity of personally identifiable information;
(3) internal or external threats to personally identifiable
information; and
(4) the changing business arrangements of the business
entity, such as--
(A) mergers and acquisitions;
(B) alliances and joint ventures;
(C) outsourcing arrangements;
(D) bankruptcy; and
(E) changes to sensitive personally identifiable
information systems.
(f) Implementation Time Line.--Not later than 1 year after the date
of enactment of this Act, a business entity subject to the provisions
of this subtitle shall implement a data privacy and security program
pursuant to this subtitle.
SEC. 303. ENFORCEMENT.
(a) Civil Penalties.--
(1) In general.--Any business entity that violates the
provisions of sections 301 or 302 shall be subject to civil
penalties of not more than $5,000 per violation per day while
such a violation exists, with a maximum of $500,000 per
violation.
(2) Intentional or willful violation.--A business entity
that intentionally or willfully violates the provisions of
sections 301 or 302 shall be subject to additional penalties in
the amount of $5,000 per violation per day while such a
violation exists, with a maximum of an additional $500,000 per
violation.
(3) Equitable relief.--A business entity engaged in
interstate commerce that violates this section may be enjoined
from further violations by a court of competent jurisdiction.
(4) Other rights and remedies.--The rights and remedies
available under this section are cumulative and shall not
affect any other rights and remedies available under law.
(b) Federal Trade Commission Authority.--Any data broker shall have
the provisions of this title enforced against it by the Federal Trade
Commission.
(c) State Enforcement.--
(1) Civil actions.--In any case in which the attorney
general of a State or any State or local law enforcement agency
authorized by the State attorney general or by State statute to
prosecute violations of consumer protection law, has reason to
believe that an interest of the residents of that State has
been or is threatened or adversely affected by the acts or
practices of a data broker that violate this subtitle, the
State may bring a civil action on behalf of the residents of
that State in a district court of the United States of
appropriate jurisdiction, or any other court of competent
jurisdiction, to--
(A) enjoin that act or practice;
(B) enforce compliance with this title; or
(C) obtain civil penalties of not more than $5,000
per violation per day while such violations persist, up
to a maximum of $500,000 per violation.
(2) Notice.--
(A) In general.--Before filing an action under this
subsection, the Attorney General of the State involved
shall provide to the Federal Trade Commission--
(i) a written notice of that action; and
(ii) a copy of the complaint for that
action.
(B) Exception.--Subparagraph (A) shall not apply
with respect to the filing of an action by an Attorney
General of a State under this subsection, if the
attorney general of a State determines that it is not
feasible to provide the notice described in this
subparagraph before the filing of the action.
(C) Notification when practicable.--In an action
described under subparagraph (B), the Attorney General
of a State shall provide the written notice and the
copy of the complaint to the Federal Trade Commission
as soon after the filing of the complaint as
practicable.
(3) Federal trade commission authority.--Upon receiving
notice under paragraph (2), the Federal Trade Commission shall
have the right to--
(A) move to stay the action, pending the final
disposition of a pending Federal proceeding or action
as described in paragraph (4);
(B) intervene in an action brought under paragraph
(1); and
(C) file petitions for appeal.
(4) Pending proceedings.--If the Federal Trade Commission
has instituted a proceeding or action for a violation of this
title or any regulations thereunder, no attorney general of a
State may, during the pendency of such proceeding or action,
bring an action under this subsection against any defendant
named in such criminal proceeding or civil action for any
violation that is alleged in that proceeding or action.
(5) Rule of construction.--For purposes of bringing any
civil action under paragraph (1) nothing in this title shall be
construed to prevent an attorney general of a State from
exercising the powers conferred on the attorney general by the
laws of that State to--
(A) conduct investigations;
(B) administer oaths and affirmations; or
(C) compel the attendance of witnesses or the
production of documentary and other evidence.
(6) Venue; service of process.--
(A) Venue.--Any action brought under this
subsection may be brought in the district court of the
United States that meets applicable requirements
relating to venue under section 1391 of title 28,
United States Code.
(B) Service of process.--In an action brought under
this subsection process may be served in any district
in which the defendant--
(i) is an inhabitant; or
(ii) may be found.
(d) No Private Cause of Action.--Nothing in this subtitle
establishes a private cause of action against a business entity for
violation of any provision of this subtitle.
SEC. 304. RELATION TO OTHER LAWS.
(a) In General.--No State may require any business entity subject
to this subtitle to comply with any requirements with respect to
administrative, technical, and physical safeguards for the protection
of sensitive personally identifying information.
(b) Limitations.--Nothing in this subtitle shall be construed to
modify, limit, or supersede the operation of the Gramm-Leach-Bliley Act
or its implementing regulations, including those adopted or enforced by
States.
Subtitle B--Security Breach Notification
SEC. 321. NOTICE TO INDIVIDUALS.
(a) In General.--Any agency, or business entity engaged in
interstate commerce, that uses, accesses, transmits, stores, disposes
of or collects sensitive personally identifiable information shall,
following the discovery of a security breach of such information notify
any resident of the United States whose sensitive personally
identifiable information has been, or is reasonably believed to have
been, accessed, or acquired.
(b) Obligation of Owner or Licensee.--
(1) Notice to owner or licensee.--Any agency, or business
entity engaged in interstate commerce, that uses, accesses,
transmits, stores, disposes of, or collects sensitive
personally identifiable information that the agency or business
entity does not own or license shall notify the owner or
licensee of the information following the discovery of a
security breach involving such information.
(2) Notice by owner, licensee or other designated third
party.--Nothing in this subtitle shall prevent or abrogate an
agreement between an agency or business entity required to give
notice under this section and a designated third party,
including an owner or licensee of the sensitive personally
identifiable information subject to the security breach, to
provide the notifications required under subsection (a).
(3) Business entity relieved from giving notice.--A
business entity obligated to give notice under subsection (a)
shall be relieved of such obligation if an owner or licensee of
the sensitive personally identifiable information subject to
the security breach, or other designated third party, provides
such notification.
(c) Timeliness of Notification.--
(1) In general.--All notifications required under this
section shall be made without unreasonable delay following the
discovery by the agency or business entity of a security
breach.
(2) Reasonable delay.--Reasonable delay under this
subsection may include any time necessary to determine the
scope of the security breach, prevent further disclosures, and
restore the reasonable integrity of the data system and provide
notice to law enforcement when required.
(3) Burden of proof.--The agency, business entity, owner,
or licensee required to provide notification under this section
shall have the burden of demonstrating that all notifications
were made as required under this subtitle, including evidence
demonstrating the necessity of any delay.
(d) Delay of Notification Authorized for Law Enforcement
Purposes.--
(1) In general.--If a Federal law enforcement agency
determines that the notification required under this section
would impede a criminal investigation, such notification shall
be delayed upon written notice from such Federal law
enforcement agency to the agency or business entity that
experienced the breach.
(2) Extended delay of notification.--If the notification
required under subsection (a) is delayed pursuant to paragraph
(1), an agency or business entity shall give notice 30 days
after the day such law enforcement delay was invoked unless a
Federal law enforcement agency provides written notification
that further delay is necessary.
(3) Law enforcement immunity.--No cause of action shall lie
in any court against any law enforcement agency for acts
relating to the delay of notification for law enforcement
purposes under this Act.
SEC. 322. EXEMPTIONS.
(a) Exemption for National Security and Law Enforcement.--
(1) In general.--Section 321 shall not apply to an agency
if the agency certifies, in writing, that notification of the
security breach as required by section 321 reasonably could be
expected to--
(A) cause damage to the national security; or
(B) hinder a law enforcement investigation or the
ability of the agency to conduct law enforcement
investigations.
(2) Limits on certifications.--An agency may not execute a
certification under paragraph (1) to--
(A) conceal violations of law, inefficiency, or
administrative error;
(B) prevent embarrassment to a business entity,
organization, or agency; or
(C) restrain competition.
(3) Notice.--In every case in which an agency issues a
certification under paragraph (1), the certification,
accompanied by a description of the factual basis for the
certification, shall be immediately provided to the United
States Secret Service.
(b) Safe Harbor.--An agency or business entity will be exempt from
the notice requirements under section 321, if--
(1) a risk assessment concludes that there is no
significant risk that the security breach has resulted in, or
will result in, harm to the individuals whose sensitive
personally identifiable information was subject to the security
breach;
(2) without unreasonable delay, but not later than 45 days
after the discovery of a security breach, unless extended by
the United States Secret Service, the agency or business entity
notifies the United States Secret Service, in writing, of--
(A) the results of the risk assessment; and
(B) its decision to invoke the risk assessment
exemption; and
(3) the United States Secret Service does not indicate, in
writing, within 10 days from receipt of the decision, that
notice should be given.
(c) Financial Fraud Prevention Exemption.--
(1) In general.--A business entity will be exempt from the
notice requirement under section 321 if the business entity
utilizes or participates in a security program that--
(A) is designed to block the use of the sensitive
personally identifiable information to initiate
unauthorized financial transactions before they are
charged to the account of the individual; and
(B) provides for notice to affected individuals
after a security breach that has resulted in fraud or
unauthorized transactions.
(2) Limitation.--The exemption by this subsection does not
apply if the information subject to the security breach
includes sensitive personally identifiable information in
addition to the sensitive personally identifiable information
identified in section 3.
SEC. 323. METHODS OF NOTICE.
An agency, or business entity shall be in compliance with section
321 if it provides both:
(1) Individual notice.--
(A) Written notification to the last known home
mailing address of the individual in the records of the
agency or business entity;
(B) Telephone notice to the individual personally;
or
(C) E-mail notice, if the individual has consented
to receive such notice and the notice is consistent
with the provisions permitting electronic transmission
of notices under section 101 of the Electronic
Signatures in Global and National Commerce Act (15
U.S.C. 7001).
(2) Media notice.--Notice to major media outlets serving a
State or jurisdiction, if the number of residents of such State
whose sensitive personally identifiable information was, or is
reasonably believed to have been, acquired by an unauthorized
person exceeds 5,000.
SEC. 324. CONTENT OF NOTIFICATION.
(a) In General.--Regardless of the method by which notice is
provided to individuals under section 323, such notice shall include,
to the extent possible--
(1) a description of the categories of sensitive personally
identifiable information that was, or is reasonably believed to
have been, acquired by an unauthorized person;
(2) a toll-free number--
(A) that the individual may use to contact the
agency or business entity, or the agent of the agency
or business entity; and
(B) from which the individual may learn what types
of sensitive personally identifiable information the
agency or business entity maintained about that
individual; and
(3) the toll-free contact telephone numbers and addresses
for the major credit reporting agencies.
(b) Additional Content.--Notwithstanding section 329, a State may
require that a notice under subsection (a) shall also include
information regarding victim protection assistance provided for by that
State.
SEC. 325. COORDINATION OF NOTIFICATION WITH CREDIT REPORTING AGENCIES.
If an agency or business entity is required to provide notification
to more than 1,000 individuals under section 321(a), the agency or
business entity shall also notify, without unreasonable delay, all
consumer reporting agencies that compile and maintain files on
consumers on a nationwide basis (as defined in section 603(p) of the
Fair Credit Reporting Act (15 U.S.C. 1681a(p)) of the timing and
distribution of the notices.
SEC. 326. NOTICE TO LAW ENFORCEMENT.
(a) Secret Service.--Any business entity or agency shall give
notice of a security breach to the United States Secret Service if--
(1) the number of individuals whose sensitive personally
identifying information was, or is reasonably believed to have
been acquired by an unauthorized person exceeds 10,000;
(2) the security breach involves a database, networked or
integrated databases, or other data system containing the
sensitive personally identifiable information of more than
1,000,000 individuals nationwide;
(3) the security breach involves databases owned by the
Federal Government; or
(4) the security breach involves primarily sensitive
personally identifiable information of employees and
contractors of the Federal Government involved in national
security or law enforcement.
(b) Notice to Other Law Enforcement Agencies.--The United States
Secret Service shall be responsible for notifying--
(1) the Federal Bureau of Investigation, if the security
breach involves espionage, foreign counterintelligence,
information protected against unauthorized disclosure for
reasons of national defense or foreign relations, or Restricted
Data (as that term is defined in section 11y of the Atomic
Energy Act of 1954 (42 U.S.C. 2014(y)), except for offenses
affecting the duties of the United States Secret Service under
section 3056(a) of title 18, United States Code;
(2) the United States Postal Inspection Service, if the
security breach involves mail fraud; and
(3) the attorney general of each State affected by the
security breach.
(c) 14-Day Rule.--The notices to Federal law enforcement and the
attorney general of each State affected by a security breach required
under this section shall be delivered as promptly as possible, but not
later than 14 days after discovery of the events requiring notice.
SEC. 327. ENFORCEMENT.
(a) Civil Actions by the Attorney General.--The Attorney General
may bring a civil action in the appropriate United States district
court against any business entity that engages in conduct constituting
a violation of this subtitle and, upon proof of such conduct by a
preponderance of the evidence, such business entity shall be subject to
a civil penalty of not more than $1,000 per day per individual whose
sensitive personally identifiable information was, or is reasonably
believed to have been, accessed or acquired by an unauthorized person,
up to a maximum of $50,000 per person.
(b) Injunctive Actions by the Attorney General.--
(1) In general.--If it appears that a business entity has
engaged, or is engaged, in any act or practice constituting a
violation of this subtitle, the Attorney General may petition
an appropriate district court of the United States for an
order--
(A) enjoining such act or practice; or
(B) enforcing compliance with this subtitle.
(2) Issuance of order.--A court may issue an order under
paragraph (1), if the court finds that the conduct in question
constitutes a violation of this subtitle.
(c) Other Rights and Remedies.--The rights and remedies available
under this subtitle are cumulative and shall not affect any other
rights and remedies available under law.
(d) Fraud Alert.--Section 605A(b)(1) of the Fair Credit Reporting
Act (15 U.S.C. 1681c-1(b)(1)) is amended by inserting ``, or evidence
that the consumer has received notice that the consumer's financial
information has or may have been compromised,'' after ``identity theft
report''.
SEC. 328. ENFORCEMENT BY STATE ATTORNEYS GENERAL.
(a) In General.--
(1) Civil actions.--In any case in which the attorney
general of a State or any State or local law enforcement agency
authorized by the State attorney general or by State statute to
prosecute violations of consumer protection law, has reason to
believe that an interest of the residents of that State has
been or is threatened or adversely affected by the engagement
of a business entity in a practice that is prohibited under
this subtitle, the State or the State or local law enforcement
agency on behalf of the residents of the agency's jurisdiction,
may bring a civil action on behalf of the residents of the
State or jurisdiction in a district court of the United States
of appropriate jurisdiction or any other court of competent
jurisdiction, including a State court, to--
(A) enjoin that practice;
(B) enforce compliance with this subtitle; or
(C) civil penalties of not more than $1,000 per day
per individual whose sensitive personally identifiable
information was, or is reasonably believed to have
been, accessed or acquired by an unauthorized person,
up to a maximum of $50,000 per day.
(2) Notice.--
(A) In general.--Before filing an action under
paragraph (1), the attorney general of the State
involved shall provide to the Attorney General of the
United States--
(i) written notice of the action; and
(ii) a copy of the complaint for the
action.
(B) Exemption.--
(i) In general.--Subparagraph (A) shall not
apply with respect to the filing of an action
by an attorney general of a State under this
subtitle, if the State attorney general
determines that it is not feasible to provide
the notice described in such subparagraph
before the filing of the action.
(ii) Notification.--In an action described
in clause (i), the attorney general of a State
shall provide notice and a copy of the
complaint to the Attorney General at the time
the State attorney general files the action.
(b) Federal Proceedings.--Upon receiving notice under subsection
(a)(2), the Attorney General shall have the right to--
(1) move to stay the action, pending the final disposition
of a pending Federal proceeding or action;
(2) initiate an action in the appropriate United States
district court under section 327 and move to consolidate all
pending actions, including State actions, in such court;
(3) intervene in an action brought under subsection (a)(2);
and
(4) file petitions for appeal.
(c) Pending Proceedings.--If the Attorney General has instituted a
proceeding or action for a violation of this subtitle or any
regulations thereunder, no attorney general of a State may, during the
pendency of such proceeding or action, bring an action under this
subtitle against any defendant named in such criminal proceeding or
civil action for any violation that is alleged in that proceeding or
action.
(d) Construction.--For purposes of bringing any civil action under
subsection (a), nothing in this subtitle regarding notification shall
be construed to prevent an attorney general of a State from exercising
the powers conferred on such attorney general by the laws of that State
to--
(1) conduct investigations;
(2) administer oaths or affirmations; or
(3) compel the attendance of witnesses or the production of
documentary and other evidence.
(e) Venue; Service of Process.--
(1) Venue.--Any action brought under subsection (a) may be
brought in--
(A) the district court of the United States that
meets applicable requirements relating to venue under
section 1391 of title 28, United States Code; or
(B) another court of competent jurisdiction.
(2) Service of process.--In an action brought under
subsection (a), process may be served in any district in which
the defendant--
(A) is an inhabitant; or
(B) may be found.
(f) No Private Cause of Action.--Nothing in this subtitle
establishes a private cause of action against a business entity for
violation of any provision of this subtitle.
SEC. 329. EFFECT ON FEDERAL AND STATE LAW.
(a) In General.--The provisions of this subtitle shall supersede
any other provision of Federal law or any provision of law of any State
relating to notification of a security breach, except as provided in
section 324(b).
(b) Gramm-Leach-Bliley.--This subtitle shall not preclude any
operation permitted under section 507 of the Gramm-Leach-Bliley Act (15
U.S.C. 6807).
SEC. 330. AUTHORIZATION OF APPROPRIATIONS.
There are authorized to be appropriated such sums as may be
necessary to cover the costs incurred by the United States Secret
Service to carry out investigations and risk assessments of security
breaches as required under this subtitle.
SEC. 331. REPORTING ON RISK ASSESSMENT EXEMPTIONS.
The United States Secret Service shall report to Congress not later
than 18 months after the date of enactment of this Act, and upon the
request by Congress thereafter, on--
(1) the number and nature of the security breaches
described in the notices filed by those business entities
invoking the risk assessment exemption under section 322(b) of
this Act and the response of the United States Secret Service
to such notices; and
(2) the number and nature of security breaches subject to
the national security and law enforcement exemptions under
section 322(a) of this Act.
SEC. 332. EFFECTIVE DATE.
This subtitle shall take effect on the expiration of the date which
is 90 days after the date of enactment of this Act.
TITLE IV--GOVERNMENT ACCESS TO AND USE OF COMMERCIAL DATA
SEC. 401. GENERAL SERVICES ADMINISTRATION REVIEW OF CONTRACTS.
(a) In General.--In considering contract awards totaling more than
$500,000 and entered into after the date of enactment of this Act with
data brokers, the Administrator of the General Services Administration
shall evaluate--
(1) the data privacy and security program of a data broker
to ensure the privacy and security of data containing
personally identifiable information, including whether such
program adequately addresses privacy and security threats
created by malicious software or code, or the use of peer-to-
peer file sharing software;
(2) the compliance of a data broker with such program;
(3) the extent to which the databases and systems
containing personally identifiable information of a data broker
have been compromised by security breaches; and
(4) the response by a data broker to such breaches,
including the efforts by such data broker to mitigate the
impact of such security breaches.
(b) Compliance Safe Harbor.--The data privacy and security program
of a data broker shall be deemed sufficient for the purposes of
subsection (a), if the data broker complies with or provides protection
equal to industry standards, as identified by the Federal Trade
Commission, that are applicable to the type of personally identifiable
information involved in the ordinary course of business of such data
broker.
(c) Penalties.--In awarding contracts with data brokers for
products or services related to access, use, compilation, distribution,
processing, analyzing, or evaluating personally identifiable
information, the Administrator of the General Services Administration
shall--
(1) include monetary or other penalties--
(A) for failure to comply with subtitles A and B of
title IV of this Act; or
(B) if a contractor knows or has reason to know
that the personally identifiable information being
provided is inaccurate, and provides such inaccurate
information; and
(2) require a data broker that engages service providers
not subject to subtitle A of title IV for responsibilities
related to sensitive personally identifiable information to--
(A) exercise appropriate due diligence in selecting
those service providers for responsibilities related to
personally identifiable information;
(B) take reasonable steps to select and retain
service providers that are capable of maintaining
appropriate safeguards for the security, privacy, and
integrity of the personally identifiable information at
issue; and
(C) require such service providers, by contract, to
implement and maintain appropriate measures designed to
meet the objectives and requirements in title IV.
(d) Limitation.--The penalties under subsection (c) shall not apply
to a data broker providing information that is accurately and
completely recorded from a public record source or licensor.
SEC. 402. REQUIREMENT TO AUDIT INFORMATION SECURITY PRACTICES OF
CONTRACTORS AND THIRD PARTY BUSINESS ENTITIES.
Section 3544(b) of title 44, United States Code, is amended--
(1) in paragraph (7)(C)(iii), by striking ``and'' after the
semicolon;
(2) in paragraph (8), by striking the period and inserting
``; and''; and
(3) by adding at the end the following:
``(9) procedures for evaluating and auditing the
information security practices of contractors or third party
business entities supporting the information systems or
operations of the agency involving personally identifiable
information (as that term is defined in section 3 of the
Personal Data Privacy and Security Act of 2005) and ensuring
remedial action to address any significant deficiencies.''.
SEC. 403. PRIVACY IMPACT ASSESSMENT OF GOVERNMENT USE OF COMMERCIAL
INFORMATION SERVICES CONTAINING PERSONALLY IDENTIFIABLE
INFORMATION.
(a) In General.--Section 208(b)(1) of the E-Government Act of 2002
(44 U.S.C. 3501 note) is amended--
(1) in subparagraph (A)(i), by striking ``or''; and
(2) in subparagraph (A)(ii), by striking the period and
inserting ``; or''; and
(3) by inserting after clause (ii) the following:
``(iii) purchasing or subscribing for a fee
to personally identifiable information from a
data broker (as such terms are defined in
section 3 of the Personal Data Privacy and
Security Act of 2005).''.
(b) Limitation.--Notwithstanding any other provision of law,
commencing 1 year after the date of enactment of this Act, no Federal
agency may enter into a contract with a data broker to access for a fee
any database consisting primarily of personally identifiable
information concerning United States persons (other than news reporting
or telephone directories) unless the head of such department or
agency--
(1) completes a privacy impact assessment under section 208
of the E-Government Act of 2002 (44 U.S.C. 3501 note), which
shall subject to the provision in that Act pertaining to
sensitive information, include a description of--
(A) such database;
(B) the name of the data broker from whom it is
obtained; and
(C) the amount of the contract for use;
(2) adopts regulations that specify--
(A) the personnel permitted to access, analyze, or
otherwise use such databases;
(B) standards governing the access, analysis, or
use of such databases;
(C) any standards used to ensure that the
personally identifiable information accessed, analyzed,
or used is the minimum necessary to accomplish the
intended legitimate purpose of the Federal agency;
(D) standards limiting the retention and
redisclosure of personally identifiable information
obtained from such databases;
(E) procedures ensuring that such data meet
standards of accuracy, relevance, completeness, and
timeliness;
(F) the auditing and security measures to protect
against unauthorized access, analysis, use, or
modification of data in such databases;
(G) applicable mechanisms by which individuals may
secure timely redress for any adverse consequences
wrongly incurred due to the access, analysis, or use of
such databases;
(H) mechanisms, if any, for the enforcement and
independent oversight of existing or planned
procedures, policies, or guidelines; and
(I) an outline of enforcement mechanisms for
accountability to protect individuals and the public
against unlawful or illegitimate access or use of
databases; and
(3) incorporates into the contract or other agreement
totaling more than $500,000, provisions--
(A) providing for penalties--
(i) for failure to comply with title IV of
this Act; or
(ii) if the entity knows or has reason to
know that the personally identifiable
information being provided to the Federal
department or agency is inaccurate, and
provides such inaccurate information; and
(B) requiring a data broker that engages service
providers not subject to subtitle A of title IV for
responsibilities related to sensitive personally
identifiable information to--
(i) exercise appropriate due diligence in
selecting those service providers for
responsibilities related to personally
identifiable information;
(ii) take reasonable steps to select and
retain service providers that are capable of
maintaining appropriate safeguards for the
security, privacy, and integrity of the
personally identifiable information at issue;
and
(iii) require such service providers, by
contract, to implement ad maintain appropriate
measures designed to meet the objectives and
requirements in title IV.
(c) Limitation on Penalties.--The penalties under subsection
(b)(3)(A) shall not apply to a data broker providing information that
is accurately and completely recorded from a public record source.
(d) Study of Government Use.--
(1) Scope of study.--Not later than 180 days after the date
of enactment of this Act, the Comptroller General of the United
States shall conduct a study and audit and prepare a report on
Federal agency use of data brokers or commercial databases
containing personally identifiable information, including the
impact on privacy and security, and the extent to which Federal
contracts include sufficient provisions to ensure privacy and
security protections, and penalties for failures in privacy and
security practices.
(2) Report.--A copy of the report required under paragraph
(1) shall be submitted to Congress.
SEC. 404. IMPLEMENTATION OF CHIEF PRIVACY OFFICER REQUIREMENTS.
(a) Designation of the Chief Privacy Officer.--Pursuant to the
requirements under section 522 of the Transportation, Treasury,
Independent Agencies, and General Government Appropriations Act, 2005
(division H of Public Law 108-447; 118 Stat. 3199) that each agency
designate a Chief Privacy Officer, the Department of Justice shall
implement such requirements by designating a department-wide Chief
Privacy Officer, whose primary role shall be to fulfill the duties and
responsibilities of Chief Privacy Officer and who shall report directly
to the Deputy Attorney General.
(b) Duties and Responsibilities of Chief Privacy Officer.--In
addition to the duties and responsibilities outlined under section 522
of the Transportation, Treasury, Independent Agencies, and General
Government Appropriations Act, 2005 (division H of Public Law 108-447;
118 Stat. 3199), the Department of Justice Chief Privacy Officer
shall--
(1) oversee the Department of Justice's implementation of
the requirements under section 603 to conduct privacy impact
assessments of the use of commercial data containing personally
identifiable information by the Department; and
(2) coordinate with the Privacy and Civil Liberties
Oversight Board, established in the Intelligence Reform and
Terrorism Prevention Act of 2004 (Public Law 108-458), in
implementing this section.
Calendar No. 297
109th CONGRESS
1st Session
S. 1789
_______________________________________________________________________
A BILL
To prevent and mitigate identity theft, to ensure privacy, to provide
notice of security breaches, and to enhance criminal penalties, law
enforcement assistance, and other protections against security
breaches, fraudulent access, and misuse of personally identifiable
information.
_______________________________________________________________________
November 17, 2005
Reported with an amendment