Data Breach Insurance Act

Data Breach Insurance Act

This bill amends the Internal Revenue Code to allow a business tax credit for the purchase of qualified data breach insurance. The credit applies for five years and is equal to 15% of the annual premiums paid or incurred for the insurance in the ordinary course of the taxpayer's trade or business.

Qualified data breach insurance is coverage provided by an insurance company for expenses or losses in connection with the theft, loss, disclosure, inaccessibility, or manipulation of data.

Insurance does not qualify for the credit unless the taxpayer has adopted and is in compliance with: (1) the Framework for Improving Critical Infrastructure Cybersecurity published by the National Institute of Standards and Technology, or (2) any similar standard specified by the Internal Revenue Service.

[Congressional Bills 114th Congress]
[From the U.S. Government Publishing Office]
[H.R. 6032 Introduced in House (IH)]

<DOC>






114th CONGRESS
  2d Session
                                H. R. 6032

To amend the Internal Revenue Code of 1986 to provide a tax credit for 
                   purchase of data breach insurance.


_______________________________________________________________________


                    IN THE HOUSE OF REPRESENTATIVES

                           September 14, 2016

Mr. Perlmutter introduced the following bill; which was referred to the 
                      Committee on Ways and Means

_______________________________________________________________________

                                 A BILL


 
To amend the Internal Revenue Code of 1986 to provide a tax credit for 
                   purchase of data breach insurance.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Data Breach Insurance Act''.

SEC. 2. CREDITS FOR PURCHASE OF DATA BREACH INSURANCE.

    (a) In General.--Subpart D of part IV of subchapter A of chapter 1 
of the Internal Revenue Code of 1986 (relating to business related 
credits) is amended by adding at the end the following new section:

``SEC. 45S. DATA BREACH INSURANCE.

    ``(a) In General.--For purposes of section 38, the data breach 
insurance credit determined under this section for the taxable year is 
an amount equal to 15 percent of the aggregate premiums paid or 
incurred by the taxpayer during such taxable year for qualified data 
breach insurance.
    ``(b) Qualified Data Breach Insurance.--
            ``(1) In general.--For purposes of this section, the term 
        `qualified data breach insurance' means coverage provided by an 
        insurance company for expenses or losses in connection with the 
        theft, loss, disclosure, inaccessibility, or manipulation, of 
        data.
            ``(2) Cybersecurity framework requirement.--Such term shall 
        not include coverage for any period unless the taxpayer has 
        adopted, and is in compliance with, one of the following with 
        respect to such period:
                    ``(A) Version 1.0 of the Framework for Improving 
                Critical Infrastructure Cybersecurity published by the 
                National Institute of Standards and Technology as in 
                effect on February 12, 2014, or subsequent versions or 
                iterations.
                    ``(B) Any similar standard specified by the 
                Secretary (after consultation with the Secretary of 
                Homeland Security and the Secretary of Commerce) for 
                purposes of this paragraph.
            ``(3) Insurance company.--The term `insurance company' 
        means any corporation subject to tax under subchapter L (or 
        which would be so subject if such corporation were a domestic 
        corporation).
            ``(4) Treatment of insurance covering more than data.--In 
        the case of coverage under which amounts are payable for other 
        than expenses or losses described in paragraph (1)--
                    ``(A) no amount shall be treated as premiums for 
                qualified data breach insurance unless the charge for 
                such insurance is either separately stated in the 
                contract, or furnished to the policyholder by the 
                insurance company in a separate statement,
                    ``(B) the amount taken into account as the premium 
                paid or incurred for such insurance shall not exceed 
                such charge, and
                    ``(C) no amount shall be treated as paid or 
                incurred for such insurance if the amount specified in 
                the contract (or furnished to the policyholder by the 
                insurance company in a separate statement) as the 
                charge for such insurance is unreasonably large in 
                relation to the total charges under the contract.
    ``(c) Premiums Must Be Trade or Business Expense.--Premiums shall 
be taken into account under subsection (a) only if such premiums are 
paid or incurred in the ordinary course of the taxpayer's trade or 
business.
    ``(d) Termination.--No credit shall be determined under this 
section for any taxable year beginning after the date which is 5 years 
after the date of the enactment of this section.''.
    (b) Conforming Amendments.--
            (1) Section 38(b) of such Code is amended by striking 
        ``plus'' at the end of paragraph (35), by striking the period 
        at the end of paragraph (36), and inserting ``, plus'', and by 
        adding at the end the following new paragraph:
            ``(37) the data breach insurance credit determined under 
        section 45S.''.
            (2) The table of sections for subpart D of part IV of 
        subchapter A of chapter 1 of such Code is amended by adding at 
        the end the following new item:

``Sec. 45S. Data breach insurance.''.
    (c) Effective Date.--The amendments made by this section shall 
apply to taxable years beginning after the date of the enactment of 
this Act.
                                 <all>