(This measure has not been amended since it was introduced. The summary has been expanded because action occurred on the measure.)
Notification of Risk to Personal Data Act - Requires any agency or person (agency) that owns or licenses computerized data containing sensitive personal information to: (1) implement and maintain reasonable security and notification procedures and practices to protect sensitive personal information from unauthorized access, destruction, use, modification, or disclosure; and (2) notify any U.S. resident whose sensitive personal information was compromised. Permits a federal law enforcement agency to delay notification if notification would impede an investigation.
Requires any agency in possession of computerized data containing sensitive personal information that it does not own or license to notify the entity from whom it received the information if the security of that information was compromised, resulting in a significant risk of identity theft.
Sets forth provisions regarding: (1) the timeliness of notification; (2) the methods and contents of notice; and (3) the duty to coordinate with consumer reporting agencies.
Declares that an agency that maintains notification procedures as part of an information security policy for the treatment of sensitive personal information and otherwise meets this Act's requirements shall be in compliance with this Act if the agency notifies subject persons in accordance with its policies in the event of a security breach.
Establishes civil remedies for failure to provide notice of a security breach.
Authorizes enforcement by state attorneys general on behalf of residents of the state.
[Congressional Bills 109th Congress]
[From the U.S. Government Publishing Office]
[S. 1326 Introduced in Senate (IS)]
109th CONGRESS
1st Session
S. 1326
To require agencies and persons in possession of computerized data
containing sensitive personal information, to disclose security
breaches where such breach poses a significant risk of identity theft.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
June 28, 2005
Mr. Sessions introduced the following bill; which was read twice and
referred to the Committee on the Judiciary
_______________________________________________________________________
A BILL
To require agencies and persons in possession of computerized data
containing sensitive personal information, to disclose security
breaches where such breach poses a significant risk of identity theft.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Notification of Risk to Personal
Data Act''.
SEC. 2. DEFINITIONS.
In this Act, the following definitions shall apply:
(1) Agency.--The term ``agency''--
(A) has the meaning given such term in section
551(1) of title 5, United States Code; and
(B) includes any authority of a State or political
subdivision.
(2) Breach of security of the system.--The term ``breach of
security of the system''--
(A) means the compromise of the security of
computerized data containing sensitive personal
information that establishes a reasonable basis to
conclude that a significant risk of identity theft to
an individual exists; and
(B) does not include the compromise of the security
of computerized data, if the agency or person
concludes, after conducting a reasonable investigation,
that there is not a significant risk of identity theft
to an individual, including a situation in which--
(i) sensitive personal information is
acquired in good faith by an employee or agent
of the agency or person and the information is
not subject to further unauthorized disclosure;
(ii) an investigation by an appropriate law
enforcement agency, government agency, or
official determines that there is not a
significant risk of identity theft; or
(iii) the agency or person maintains or
participates in a security program reasonably
designed to block unauthorized transactions
before they are charged to an individual's
account and the security program does not
indicate that the compromise of sensitive
personal information has resulted in fraud or
unauthorized transactions.
(3) Person.--The term ``person'' has the meaning given such
term in section 551(2) of title 5, United States Code.
(4) Sensitive personal information.--The term ``sensitive
personal information''--
(A) means--
(i) an individual's first and last name;
(ii) the individual's address or telephone
number; and
(iii) the individual's social security
number, the individual's driver's license
number or equivalent State identification
number, or the individual's financial account
number, credit or debit card number, in
combination with any required security code,
access code, or password that would permit
access to an individual's financial account, if
the data element under this clause is not
encrypted or redacted and is linked to the
information described in clauses (i) and (ii);
and
(B) does not include--
(i) any list, description, or other
grouping of individuals (and publicly available
information pertaining to them) that is derived
without using any sensitive personal
information; or
(ii) publicly available information that is
lawfully made available to the general public
from Federal, State or local government
records.
(5) Redacted.--The term ``redacted'' means truncated so
that not more than the last 4 digits of the social security
number, driver's license number, State identification card
number, or account number are accessible as part of the data.
(6) Identity theft.--The term ``identity theft'' means a
fraud committed using the identification of another person with
the intent to commit, or to aid or abet any unlawful activity
that constitutes a violation of Federal law, or that
constitutes a felony under any applicable State or local law
and that results in economic loss to the individual.
(7) Personal information.--The term ``personal
information'' means personally identifiable information about a
specific individual.
(8) Functional regulator.--The term ``functional
regulator'' means--
(A) the Office of the Comptroller of the Currency
with respect to national banks, and Federal branches,
Federal agencies of foreign banks, and any subsidiaries
of such entities (except brokers, dealers, persons
providing insurance, investment companies, and
investment advisers);
(B) the Board of Governors of the Federal Reserve
System with respect to member banks of the Federal
Reserve System (other than national banks), branches
and agencies of foreign banks (other than Federal
branches, Federal agencies, and insured State branches
of foreign banks), commercial lending companies owned
or controlled by foreign banks, organizations operating
under section 25 or 25A of the Federal Reserve Act (12
U.S.C. 601 and 611), bank and financial holding
companies, and any nonbank subsidiaries or affiliates
of such entities (except brokers, dealers, persons
providing insurance, investment companies, and
investment advisers);
(C) the Board of Directors of the Federal Deposit
Insurance Corporation with respect to banks insured by
the Federal Deposit Insurance Corporation (other than
members of the Federal Reserve System), insured State
branches of foreign banks, and any subsidiaries of such
entities (except brokers, dealers, persons providing
insurance, investment companies, and investment
advisers);
(D) the Director of the Office of Thrift
Supervision with respect to savings association the
deposits of which are insured by the Federal Deposit
Insurance Corporation, savings and loan holding
companies, and any subsidiaries of such entities
(except brokers, dealers, persons providing insurance,
investment companies, and investment advisers);
(E) the National Credit Union Administration Board
with respect to any Federal credit union and any
subsidiaries of such an entity;
(F) the Secretary of Transportation with respect to
any air carrier or foreign air carrier subject to part
A of subtitle VII of title 49, United States Code;
(G) the Secretary of Agriculture with respect to
any activities subject to the Packers and Stockyards
Act, 1921 (7 U.S.C. 181 et seq.) (except as provided in
section 406 of that Act (7 U.S.C. 226 and 227));
(H) the Farm Credit Administration with respect to
any Federal land bank, Federal land bank association,
Federal intermediate credit bank, or production credit
association;
(I) the Securities and Exchange Commission with
respect to any broker or dealer, investment company or
investment adviser;
(J) the applicable State insurance authority of the
State in which the person is domiciled with respect to
any person engaged in providing insurance;
(K) the Federal Communications Commission with
respect to any entity subject to the jurisdiction of
the Commission; and
(L) the Federal Trade Commission with respect to
any other financial institution or other person that is
not subject to the jurisdiction of any agency or
authority under subparagraphs (A) through (K).
SEC. 3. DATABASE SECURITY.
(a) In General.--Any agency or person that owns or licenses
computerized data containing sensitive personal information shall
implement and maintain reasonable security and notification procedures
and practices appropriate to the size and nature of the agency or
person and the nature of the information to protect the sensitive
personal information from unauthorized access, destruction, use,
modification or disclosure.
(b) Disclosure of Security Breach.--
(1) Notification of individual.--
(A) In general.--If an agency or person that owns
or licenses computerized data containing sensitive
personal information, determines, after discovery and a
reasonable investigation, or notification under
paragraph (2), that a significant risk of identity
theft exists as a result of a breach of security of the
system of such agency or person containing such data,
the agency or person shall notify any individual whose
sensitive personal information was compromised if such
individual is known to be a resident of the United
States.
(B) Delay of notification.--If a Federal law
enforcement agency of either appropriate domestic or
foreign jurisdiction determines that the notification
required under this subsection would impede a criminal
or civil investigation, such notification may be
delayed until such Federal law enforcement agency
determines that the notification will no longer
compromise such investigation.
(2) Notification of owner or licensor.--Any agency or
person in possession of computerized data containing sensitive
personal information that the agency or person does not own or
license shall notify the entity from whom it received the
information if the security of the sensitive personal
information was compromised and such compromise has resulted in
a significant risk of identity theft to an individual.
(3) Timeliness of notification.--All notifications required
under paragraph (1) or (2) shall be made as expediently as
possible and without unreasonable delay following--
(A) the discovery and reasonable investigation by
the agency or person of a breach of security of the
system; and
(B) any measures the agency or person takes that
are necessary to determine the scope of the breach,
prevent further breaches, determine whether there is a
reasonable basis to conclude that a significant risk of
identity theft to an individual exists, restore the
reasonable integrity of the data system, and comply
with applicable requirements of securities laws and
regulations.
(4) Methods of notice.--An agency or person shall be in
compliance with this subsection if it provides the resident,
owner, or licensee, as appropriate, with--
(A) written notification to a mailing address for
the subject individual;
(B) telephonic notification to a telephone number
for the subject individual;
(C) e-mail notice to an e-mail address for the
subject individual; or
(D) conspicuous posting of the notice on the
Internet site of the agency or person, if the agency or
person maintains an Internet site, or notification to
major media, if--
(i) the agency or person demonstrates that
the cost of providing direct notice under
paragraphs (A) through (C) of this subsection
would exceed $250,000;
(ii) the affected class of subject
individuals to be notified exceeds 500,000; or
(iii) the agency or person does not have
sufficient contact information for those to be
notified.
(5) Contents of notice.--Notice under this subsection
shall--
(A) be given in a clear and conspicuous manner;
(B) describe the breach of security of the system
in general terms and the type of sensitive personal
information involved; and
(C) include a toll-free telephone number or website
that individuals can utilize for further information
and assistance.
(6) Duty to coordinate with consumer reporting agencies.--
Before any agency or person provides notice to more than 1,000
individuals at any time, or provides notice pursuant to
paragraph (4)(D), that sensitive personal information on the
individuals was, or may reasonably be expected to have been,
the subject of a breach of security of the system, the agency
or person shall, without unreasonable delay--
(A) notify all nationwide consumer reporting
agencies (as defined in section 603(p) of the Fair
Credit Reporting Act (15 U.S.C. 1681a(p))) of the
timing, content, and distribution of the notice,
including--
(i) the number of individuals to whom the
notice will be given; or
(ii) the type of notice provided under
paragraph (4)(D); and
(B) conform the notice to individuals to be
delivered by such agency or person to accurately
reflect, to the extent given in such notice--
(i) the method of contact reasonably
specified by each nationwide consumer reporting
agency that such individuals are to use with
respect to the particular notice; and
(ii) the responsibilities of a nationwide
consumer reporting agency under the Fair Credit
Reporting Act (15 U.S.C. 1681 et seq.) and any
other applicable law.
(7) Safe harbor.--Notwithstanding any other obligation
under this subsection, an agency or person that maintains
notification procedures as part of an information security
policy for the treatment of sensitive personal information and
is otherwise consistent with the requirements of paragraphs (3)
and (6) shall be in compliance with this subsection if the
agency or person notifies subject persons in accordance with
its policies in the event of a breach of security of the
system.
(8) Relation to other provisions.--Nothing in this Act
shall be construed to modify, limit or supersede the operation
of either the Fair Credit Reporting Act, the Gramm-Leach-Bliley
Act, or any other applicable provision of Federal law.
(c) Civil Remedies.--
(1) Penalties.--
(A) In general.--Except as provided under
subparagraph (B), any agency or person that fails to
give notice in accordance with paragraph (1) through
(4) of subsection (b) shall be subject to--
(i) a fine in an amount not to exceed
$250,000 per breach of security of the system;
or
(ii) in the case of a violation of
subsection (a), such actual damages as may be
proven.
(B) Exemption.--An agency or person shall not be
subject to a fine under this paragraph if the breach of
security of the system--
(i) was not a result of the negligence of
such agency or person; and
(ii) was the result of fraud committed by a
third party.
(2) Equitable relief.--Any person that violates, proposes
to violate, or has violated this section may be enjoined from
further violations by a court of competent jurisdiction.
(3) Other rights and remedies.--The rights and remedies
available under this subsection are cumulative and shall not
affect any other rights and remedies available under law.
(d) Enforcement.--
(1) In general.--The functional regulator is authorized to
enforce compliance with this section, including the assessment
of fines under subsection (c)(1).
(2) Civil actions.--No private right of action or class
action shall be brought under this Act. No person other than
the attorney general of a State may bring a civil action under
the law of any State if such action is premised in whole or in
part upon the defendant violating any provision of this Act.
SEC. 4. ENFORCEMENT BY STATE ATTORNEYS GENERAL.
(a) In General.--
(1) Civil actions.--In any case in which the attorney
general of a State has reason to believe that an interest of
the residents of that State has been or is threatened or
adversely affected by the engagement of any person in a
practice that is prohibited under this Act, the State, as
parens patriae, may bring a civil action on behalf of the
residents of the State in a United States district court of
appropriate jurisdiction to--
(A) enjoin that practice;
(B) enforce compliance with this Act; or
(C) obtain damage, restitution, or other
compensation on behalf of residents of the State under
the conditions and up to the monetary limits set forth
in section 3(c)(1).
(2) Notice.--
(A) In general.--Before filing an action under
paragraph (1), the attorney general of the State shall
provide the Attorney General of the United States and
the functional regulator--
(i) written notice of the action; and
(ii) a copy of the complaint for the
action.
(B) Exemption.--
(i) In general.--Subparagraph (A) shall not
apply with respect to the filing of an action
by an attorney general of a State under this
subsection, if the State attorney general
determines that it is not feasible to provide
the notice described in such subparagraph
before the filing of the action.
(ii) Notification.--In an action described
in clause (i), the attorney general of a State
shall provide notice and a copy of the
complaint to the functional regulator and the
Attorney General at the time the State attorney
general files the action.
(C) United states attorney general priority.--After
having been notified, as provided in subparagraph (A),
the Attorney General shall have the right--
(i) to file a civil action, subject to
monetary limits equal to those set forth in
section 3(c)(1);
(ii) to intervene in the action;
(iii) upon so intervening, to be heard on
all matters arising therein;
(iv) to remove the action to the
appropriate United States district court; and
(v) to file petitions for appeal.
(D) Preemption.--
(i) Action by department of justice.--If
the Attorney General institutes a civil action
or intervenes in an action under this
subsection, the functional regulator, a State
attorney general, or an official or agency of a
State may not bring an action under this
section for any violation of this Act alleged
in the complaint.
(ii) Action by functional regulator.--If
the functional regulator institutes a civil
action or intervenes under section 3(d)(1) to
enforce compliance with section 3, a State
attorney general or official or agency of a
State, may not bring an action under this
section for any violation of this Act alleged
in the complaint.
(b) Limitations on State Actions.--
(1) Violation of injunction required.--A State may not
bring an action against a person under subsection (a)(1)(C)
unless--
(A) the person has been enjoined from committing
the violation, in an action brought by the State under
subsection (a)(1)(A); and
(B) the person has violated the injunction.
(2) Limitation on damages recoverable.--In an action under
subsection (a)(1)(C), a State may not recover any damages
incurred before the date of the violation of an injunction on
which the action is based.
(c) Construction.--For purposes of a civil action under subsection
(a), nothing in this Act shall be construed to prevent the attorney
general of a State from exercising the powers conferred on such
attorney general by the laws of that State to--
(1) conduct investigations;
(2) administer oaths or affirmations; or
(3) compel the attendance of witnesses or the production of
documentary and other evidence.
(d) Venue; Service of Process.--
(1) Venue.--Any action brought under subsection (a) may be
brought in the district court of the United States that meets
applicable requirements relating to venue under section 1391 of
title 28, United States Code.
(2) Service of process.--In an action brought under
subsection (a), process may be served in any district in which
the defendant--
(A) is an inhabitant; or
(B) may be found.
SEC. 5. EFFECT ON STATE LAW.
The provisions of this Act shall supersede any law, rule, or
regulation of any State or unit of local government that relates in any
way to electronic information security standards or the notification of
any resident of the United States of any breach of security pertaining
to any collection of personal information about such resident.
SEC. 6. EFFECTIVE DATE.
This Act shall take effect on the expiration of the date which is
180 days after the date of enactment of this Act.
<all>
Introduced in Senate
Read twice and referred to the Committee on the Judiciary.
Committee on the Judiciary. Ordered to be reported without amendment favorably.
Committee on the Judiciary. Reported by Senator Specter without amendment. Without written report.
Committee on the Judiciary. Reported by Senator Specter without amendment. Without written report.
Placed on Senate Legislative Calendar under General Orders. Calendar No. 252.
Llama 3.2 · runs locally in your browser
Ask anything about this bill. The AI reads the full text to answer.
Enter to send · Shift+Enter for new line