3.0.0 1408 2023-01-11T13:22:36Z 2023-01-11T13:22:36Z Senate S S 2011-07-22 112 ssju00 Judiciary Committee Senate Standing Reported by 2012-02-06T20:46:23Z Markup by 2011-09-22T13:46:15Z Referred to 2011-07-22T16:42:12Z Personal Data Privacy and Security Act of 2011 112 1151 S 2011-11-07 By Senator Leahy from Committee on the Judiciary filed written report. Report No. 112-91. Additional and Minority views filed. Related bill CRS Personal Data Protection and Breach Accountability Act of 2011 112 1535 S 2011-09-22 Placed on Senate Legislative Calendar under General Orders. Calendar No. 182. Related bill CRS 2012-02-06 Senate Placed on Senate Legislative Calendar under General Orders. Calendar No. 310. Calendars 2012-02-06 ssju00 Judiciary Committee Senate Committee on the Judiciary. Reported by Senator Leahy with an amendment in the nature of a substitute. Without written report. Committee 2012-02-06 Committee on the Judiciary. Reported by Senator Leahy with an amendment in the nature of a substitute. Without written report. Committee 14000 9 Library of Congress ssju00 Judiciary Committee 2011-09-22 ssju00 Judiciary Committee Senate Committee on the Judiciary. Ordered to be reported with an amendment in the nature of a substitute favorably. Committee 2011-07-22 ssju00 Judiciary Committee Senate Read twice and referred to the Committee on the Judiciary. (text of measure as introduced: CR S4847-4849) IntroReferral 2011-07-22 Sponsor introductory remarks on measure. (CR S4846-4847) IntroReferral B00100 9 Library of Congress 2011-07-22 Introduced in Senate IntroReferral 10000 9 Library of Congress F000062 Sen. Feinstein, Dianne [D-CA] Dianne Feinstein D CA N Crime and Law Enforcement Bank accounts, deposits, capital Business records Civil actions and liability Computer security and identity theft Consumer affairs Consumer credit Fraud offenses and financial crimes Government information and archives Intelligence activities, surveillance, classified information Right of privacy Social security and elderly assistance Visas and passports Crime and Law Enforcement 00 2011-07-22 Introduced in Senate 2011-08-29T15:44:38Z Data Breach Notification Act of 2011 - Requires any federal agency or business entity engaged in interstate commerce that uses, accesses, or collects sensitive personally identifiable information, following the discovery of a security breach, to notify: (1) any U.S. resident whose information may have been accessed or acquired, and (2) the owner or licensee of any such information that the agency or business does not own or license.

Exempts: (1) agencies and business entities from notification requirements for national security and law enforcement purposes and for security breaches that a risk assessment concludes do not have a significant risk of resulting in harm if specified certification or notice is provided, subject to review by the Secret Service; and (2) business entities which utilize a security program that blocks the use of sensitive personally identifiable information and provide notice of a breach to affected individuals.

Requires notifications regarding security breaches under specified circumstances to the Secret Service, the Federal Bureau of Investigation (FBI), the Postal Inspection Service, and state attorneys general.

Authorizes the Attorney General to bring a civil action in U.S. district court against any business entity that violates this Act. Sets civil penalties for violations.

Amends the Fair Credit Reporting Act to require agencies to include a fraud alert in the file of a consumer that submits evidence of compromised financial information to a consumer reporting agency.

Authorizes: (1) civil actions by state attorneys general to enforce this Act, and (2) appropriations for costs incurred by the Secret Service to investigate and conduct risk assessments of security breaches.

]]> 01 2012-02-06 Reported to Senate with amendment(s) 2012-03-03T17:38:37Z Data Breach Notification Act of 2011 - (Sec. 2) Requires any federal agency or business entity engaged in interstate commerce that uses, accesses, transmits, stores, disposes of, or collects sensitive personally identifiable information, following the discovery of a security breach, to notify: (1) any U.S. resident whose information has been, or is reasonably believed to have been, accessed or acquired; and (2) any owner or licensee of such information. Requires notifications to be made without unreasonable delay following the discovery of a security breach. Allows a delay of notification for law enforcement and national security purposes if written justification for such delay is provided to the Secretary of Homeland Security (DHS) by the U.S. Secret Service and to the Attorney General by the Federal Bureau of Investigation (FBI).

(Sec. 3) Exempts agencies or business entities from notification requirements if: (1) the Secret Service or the FBI determines that notification of a security breach could reveal sensitive sources and methods or impede law enforcement or intelligence investigations, or the FBI determines that such notification may damage national security; (2) a risk assessment concludes that there is no significant risk that a security breach has resulted in, or will result in, identity theft, economic loss or harm, or physical harm to individuals whose sensitive personally identifiable information was subject to the security breach; (3) an agency or business entity notifies the Federal Trade Commission (FTC) of intent to invoke a risk assessment exemption; or (4) a business entity participates in a security program that effectively blocks the use of sensitive personally identifiable information and provides for notice to affected individuals of a security breach.

(Sec. 4) Requires: (1) written notice of a security breach to individuals by mail, telephone, and e-mail; and (2) notice to major media outlets if a security breach involves more than 5,000 individuals.

(Sec. 5) Requires a notification of a security breach to include: (1) a description of the categories of sensitive personally identifiable information acquired by an unauthorized person, (2) a toll-free telephone number for contacting an agency or business entity to ascertain the types of personal information maintained by such agency or entity, and (3) the toll-free telephone numbers and addresses for the major credit reporting agencies. Authorizes a state to require that a notification also include information about victim protection assistance provided by that state.

(Sec. 6) Directs an agency or business entity that is required to provide notification to more than 5,000 individuals to also notify all nationwide consumer reporting agencies of the timing and distribution of the notices.

(Sec. 7) Requires the DHS Secretary to designate a federal government entity to receive notices of security breaches (designated entity). Requires such designated entity to provide the notices and other information it receives to the Secret Service, the FBI, the FTC, the U.S. Postal Inspection Service (if fraud is involved), state attorneys general, and other federal law enforcement agencies.

Requires any business entity or agency to notify the designated entity of a security breach if: (1) the number of individuals whose sensitive personally identifying information was acquired by an unauthorized person exceeds 10,000, (2) the breach involves a data system containing information on more than 1 million individuals nationwide, (3) the breach involves databases owned by the federal government, or (4) the breach involves primarily sensitive personally identifiable information of individuals known to be employees and contractors of the federal government involved in national security or law enforcement.

(Sec. 8) Authorizes the Attorney General to bring civil and administrative actions against business entities for violations of this Act and to seek injunctive relief or civil penalties, including increased penalties for willful or intentional violations.

(Sec. 9) Authorizes state attorneys general or state or local law enforcement agencies to bring a civil action on behalf of state residents who have been threatened or adversely affected by a business entity violating provisions of this Act and to obtain injunctive relief or civil penalties. Requires a state attorney general bringing a civil action to provide written notice to the Attorney General who may then move to stay the action, move to consolidate all pending actions, intervene, and file petitions for appeal.

(Sec. 10) Amends the federal criminal code to impose a prison term of up to five years and/or a fine on any individual who has knowledge of a security breach and intentionally and willfully conceals such breach, resulting in economic harm of $1,000 or more to any individual. Grants the Secret Service and the FBI authority to investigate criminal concealments of security breaches.

(Sec. 11) Provides that this Act shall supersede any other provision of federal law (except the data security requirements of the Gramm-Leach-Bliley Act and certain health privacy provisions) or state law relating to notification by an interstate business entity or agency of a security breach.

(Sec. 12) Authorizes appropriations for the cost of investigations, risk assessments, and civil actions relating to security breaches under this Act.

(Sec. 13) Directs the FTC, not later than 18 months after the enactment of this Act, to report on: (1) the number and nature of the security breaches described in notices filed by business entities invoking the risk assessment exemption under this Act, and (2) the response of the FTC to such notices. Excludes from such report the contents of any risk assessment provided to the FTC.

Directs the Secret Service and FBI, not later than 18 months after the enactment of this Act, to report on the number and nature of security breaches subject to the national security and law enforcement exemptions under this Act.

(Sec. 14) Sets forth definitions for purposes of this Act, including a definition of "sensitive personally identifiable information."

]]>

Data Breach Notification Act of 2011 Display Title Data Breach Notification Act of 2011 Official Title as Introduced A bill to require Federal agencies, and persons engaged in interstate commerce, in possession of data containing sensitive personally identifiable information, to disclose any breach of such information. Introduced in Senate IS Short Titles as Introduced Data Breach Notification Act of 2011 Short Titles as Reported to Senate Data Breach Notification Act of 2011 S Senate Reported to Senate 2012-02-06T05:00:00Z https://www.govinfo.gov/content/pkg/BILLS-112s1408rs/xml/BILLS-112s1408rs.xml Introduced in Senate 2011-07-22T04:00:00Z https://www.govinfo.gov/content/pkg/BILLS-112s1408is/xml/BILLS-112s1408is.xml 2012-02-06 Placed on Senate Legislative Calendar under General Orders. Calendar No. 310. text/xml EN Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain. Congressional Research Service, Library of Congress This file contains bill summaries and statuses for federal legislation. A bill summary describes the most significant provisions of a piece of legislation and details the effects the legislative text may have on current law and federal programs. Bill summaries are authored by the Congressional Research Service (CRS) of the Library of Congress. As stated in Public Law 91-510 (2 USC 166 (d)(6)), one of the duties of CRS is "to prepare summaries and digests of bills and resolutions of a public general nature introduced in the Senate or House of Representatives". For more information, refer to the User Guide that accompanies this file.