3.0.0 139 2023-01-11T13:21:25Z 2023-01-11T13:21:25Z Senate S S 2009-01-06 111 ssju00 Judiciary Committee Senate Standing Reported by 2010-09-15T21:58:21Z Markup by 2009-11-05T17:42:02Z Referred to 2009-01-06T21:41:38Z S. Rept. 111-290 Data Breach Notification Act 111 6236 HR 2010-12-20 Referred to the Subcommittee on Commercial and Administrative Law. Identical bill CRS 2010-09-15 Senate Placed on Senate Legislative Calendar under General Orders. Calendar No. 563. Calendars 2010-09-15 ssju00 Judiciary Committee Senate Committee on the Judiciary. Reported by Senator Leahy without amendment. With written report No. 111-290. Additional views filed. Committee 2010-09-15 Committee on the Judiciary. Reported by Senator Leahy without amendment. With written report No. 111-290. Additional views filed. Committee 14000 9 Library of Congress ssju00 Judiciary Committee 2009-11-05 ssju00 Judiciary Committee Senate Committee on the Judiciary. Ordered to be reported without amendment favorably. Committee 2009-01-06 ssju00 Judiciary Committee Senate Read twice and referred to the Committee on the Judiciary. (text of measure as introduced: CR S117-119) IntroReferral 2009-01-06 Sponsor introductory remarks on measure. (CR S116-117) IntroReferral B00100 9 Library of Congress 2009-01-06 Introduced in Senate IntroReferral 10000 9 Library of Congress F000062 Sen. Feinstein, Dianne [D-CA] Dianne Feinstein D CA N 2009-12-11T17:00:00Z S. 139, Data Breach Notification Act http://www.cbo.gov/publication/41869 <p>Cost estimate for the bill as ordered reported by the Senate Committee on the Judiciary on November 5, 2009</p> 2009-12-11T17:00:00Z S. 139, Data Breach Notification Act https://www.cbo.gov/publication/41869 Cost estimate for the bill as ordered reported by the Senate Committee on the Judiciary on November 5, 2009 Crime and Law Enforcement Bank accounts, deposits, capital Business records Civil actions and liability Computer security and identity theft Consumer affairs Consumer credit Fraud offenses and financial crimes Government information and archives Intelligence activities, surveillance, classified information Right of privacy Social security and elderly assistance Visas and passports Crime and Law Enforcement 00 2009-01-06 Introduced in Senate 2009-01-16T15:09:44Z Data Breach Notification Act - Requires any federal agency or business entity engaged in interstate commerce that uses, accesses, or collects sensitive personally identifiable information, following the discovery of a security breach, to notify: (1) any U.S. resident whose information may have been accessed or acquired; and (2) the owner or licensee of any such information that the agency or business does not own or license.

Exempts: (1) agencies and business entities from notification requirements for national security and law enforcement purposes and for security breaches that a risk assessment concludes do not have a significant risk of resulting in harm if specified certification or notice is provided, subject to review by the Secret Service; and (2) business entities which utilize a security program that blocks the use of sensitive personally identifiable information and provide notice of a breach to affected individuals.

Requires notifications regarding security breaches under specified circumstances to the Secret Service, the Federal Bureau of Investigation (FBI), the Postal Inspection Service, and state attorneys general.

Authorizes the Attorney General to bring a civil action in U.S. district court against any business entity that violates this Act. Sets civil penalties for violations.

Amends the Fair Credit Reporting Act to require agencies to include a fraud alert in the file of a consumer that submits evidence of compromised financial information to a consumer reporting agency.

Authorizes: (1) civil actions by state attorneys general to enforce this Act; and (2) appropriations for costs incurred by the Secret Service to investigate and conduct risk assessments of security breaches.

]]> 80 2010-09-15 Reported to Senate without amendment 2011-02-01T20:15:37Z (This measure has not been amended since it was introduced. The summary has been expanded because action occurred on the measure.)

Data Breach Notification Act - (Sec. 2) Requires any agency or business entity with sensitive personally identifiable information to notify without unreasonable delay any U.S. resident of a security breach in which such resident's information has been, or is reasonably believed to have been, accessed or acquired.

(Sec. 3) Exempts agencies or business entities from security breach notification requirements if they provide written certification to the Secret Service that providing such notification would impede a criminal investigation or damage national security. Requires the Secret Service to evaluate the merits of such certifications.

(Sec. 4) Requires an agency or business entity to give notice of a security breach to any affected individuals: (1) by written notice to their last known home mailing address, by telephone, or by email (if email notification was consented to); and (2) to major media outlets if the number of residents in a state affected by a security breach exceeds 5,000.

(Sec. 5) Requires the notification to individuals whose sensitive personally identifiable information has been acquired to include: (1) a description of the categories of information an unauthorized individual has acquired; and (2) toll-free numbers for contacting the agency or business entity whose databases have been breached and major credit reporting agencies.

(Sec. 6) Requires any business entity or agency that is required to provide notification to more than 5,000 individuals of a security breach to notify all consumer reporting agencies.

(Sec. 7) Requires any business entity or agency to notify the Secret Service of security breaches of sensitive personally identifying information within 14 days of any data security breach that involves: (1) more than 10,000 individuals; (2) a database that contains information about more than one million individuals nationwide; (3) a federal government database; or (4) individuals known to be government employees or contractors involved in national security or law enforcement. Requires the Secret Service to notify the Federal Bureau of Investigation (FBI), the U.S. Postal Service, and the attorney general of each affected state of a security breach within 14 days of receiving notice of any breach.

(Sec. 8) Authorizes the Attorney General to bring a civil action, including an injunction, in a U.S. district court for violations of security breach notification requirements.

(Sec. 9) Allows state attorneys general to bring a civil action in a U.S. district court to enforce security breach notification requirements. Authorizes the Attorney General to stay, or intervene in, any state action.

(Sec. 10) Declares that the provisions of this subtitle shall supersede any other provision of federal or state law relating to notification by an interstate business entity or agency of a security breach.

(Sec. 11) Authorizes appropriations to the Secret Service to carry out investigations and risk assessments of security breaches.

(Sec. 12) Requires the Secret Service to report to Congress on security breaches resulting from risk assessment exemptions.

]]> Data Breach Notification Act Display Title Data Breach Notification Act Short Titles as Introduced Data Breach Notification Act Short Titles as Reported to Senate Data Breach Notification Act S Senate Official Title as Introduced A bill to require Federal agencies, and persons engaged in interstate commerce, in possession of data containing sensitive personally identifiable information, to disclose any breach of such information. Reported to Senate 2010-09-15T04:00:00Z https://www.govinfo.gov/content/pkg/BILLS-111s139rs/xml/BILLS-111s139rs.xml Introduced in Senate 2009-01-06T05:00:00Z https://www.govinfo.gov/content/pkg/BILLS-111s139is/xml/BILLS-111s139is.xml 2010-09-15 Placed on Senate Legislative Calendar under General Orders. Calendar No. 563. text/xml EN Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain. Congressional Research Service, Library of Congress This file contains bill summaries and statuses for federal legislation. A bill summary describes the most significant provisions of a piece of legislation and details the effects the legislative text may have on current law and federal programs. Bill summaries are authored by the Congressional Research Service (CRS) of the Library of Congress. As stated in Public Law 91-510 (2 USC 166 (d)(6)), one of the duties of CRS is "to prepare summaries and digests of bills and resolutions of a public general nature introduced in the Senate or House of Representatives". For more information, refer to the User Guide that accompanies this file.