1.Short title; table of
contents
(a)This Act may be cited
as the Personal Data Privacy and
Security Act of 2005
.
(b)The table of
contents for this Act is as follows:
Sec. 1. Short title;
table of contents.
Sec. 2. Findings.
Sec. 3. Definitions.
TITLE I—Enhancing punishment for identity theft and other
violations of data privacy and security
Sec. 101. Fraud and related criminal activity in connection
with unauthorized access to personally identifiable information.
Sec. 102. Organized criminal activity in connection with
unauthorized access to personally identifiable information.
Sec. 103. Concealment of security breaches involving personally
identifiable information.
Sec. 104. Aggravated fraud in connection with
computers.
Sec. 105. Review and amendment of Federal sentencing guidelines
related to fraudulent access to or misuse of digitized or electronic personally
identifiable information.
TITLE II—Assistance for state and local law enforcement combating
crimes related to fraudulent, unauthorized, or other criminal use of personally
identifiable information
Sec. 201. Grants for State and local enforcement.
Sec. 202. Authorization of appropriations.
TITLE III—Data brokers
Sec. 301. Transparency and accuracy of data
collection.
Sec. 302. Enforcement.
Sec. 303. Relation to State
laws.
Sec. 304. Effective date.
TITLE IV—Privacy and security of personally identifiable
information
Subtitle A—Data privacy and security program
Sec. 401. Purpose and applicability of data privacy and
security program.
Sec. 402. Requirements for a personal data privacy and security
program.
Sec. 403. Enforcement.
Sec. 404. Relation to State
laws.
Subtitle B—Security breach notification
Sec. 421. Right to notice of security breach.
Sec. 422. Notice procedures.
Sec. 423. Content of notice.
Sec. 424. Risk assessment and fraud prevention notice
exemptions.
Sec. 425. Victim protection assistance.
Sec. 426. Enforcement.
Sec. 427. Relation to State
laws.
Sec. 428. Study on securing personally identifiable information
in the digital era.
Sec. 429. Authorization of appropriations.
Sec. 430. Effective date.
TITLE V—Protection of Social Security numbers
Sec. 501. Social Security number protection.
Sec. 502. Limits on personal disclosure of social security
numbers for commercial transactions and accounts.
Sec. 503. Public records.
Sec. 504. Treatment of social security numbers on government
checks and prohibition of inmate access.
Sec. 505. Study and report.
Sec. 506. Enforcement.
Sec. 507. Relation to State
laws.
TITLE VI—Government access to and use of commercial
data
Sec. 601. General Services Administration review of
contracts.
Sec. 602. Requirement to audit information security practices
of contractors and third party business entities.
Sec. 603. Privacy impact assessment of government use of
commercial information services containing personally identifiable
information.
Sec. 604. Implementation of Chief Privacy Officer
requirements.
2.Congress finds that—
(1)databases of personal identifiable
information are increasingly prime targets of hackers, identity thieves, rogue
employees, and other criminals, including organized and sophisticated criminal
operations;
(2)identity theft is a serious threat to the
nation’s economic stability, homeland security, the development of e-commerce,
and the privacy rights of Americans;
(3)over 9,300,000 individuals were victims of
identity theft in America last year;
(4)security breaches are a serious threat to
consumer confidence, homeland security, e-commerce, and economic
stability;
(5)it is important for business entities that
own, use, or license personally identifiable information to adopt reasonable
procedures to ensure the security, privacy, and confidentially of that
personally identifiable information;
(6)individuals whose personal information has
been compromised or who have been victims of identity theft should receive the
necessary information and assistance to mitigate their damages and to restore
the integrity of their personal information and identities;
(7)data brokers have assumed a significant
role in providing identification, authentication, and screening services, and
related data collection and analyses for commercial, nonprofit, and government
operations;
(8)data misuse and use of inaccurate data have
the potential to cause serious or irreparable harm to an individual’s
livelihood, privacy, and liberty and undermine efficient and effective business
and government operations;
(9)there is a need to insure that data brokers
conduct their operations in a manner that prioritizes fairness, transparency,
accuracy, and respect for the privacy of consumers;
(10)government access to commercial data can
potentially improve safety, law enforcement, and national security; and
(11)because government misuse of commercial
data endangers privacy, security, and liberty, there is a need for Congress to
exercise oversight over government use of commercial data.
3.In this Act:
(1)The term agency has the same
meaning given such term in section 551 of title 5, United States Code.
(2)The term affiliate means
persons related by common ownership or affiliated by corporate control.
(3)The term
business entity means any organization, corporation, trust,
partnership, sole proprietorship, unincorporated association, venture
established to make a profit, or nonprofit, and any contractor, subcontractor,
affiliate, or licensee thereof engaged in interstate commerce.
(4)The term identity
theft means a violation of section 1028 of title 18, United States Code,
or any other similar provision of applicable State law.
(5)The term data
broker
means a business entity which for monetary fees, dues, or on a
cooperative nonprofit basis, regularly engages, in whole or in part, in the
practice of collecting, transmitting, or otherwise providing personally
identifiable information on a nationwide basis on more than 5,000 individuals
who are not the customers or employees of the business entity or
affiliate.
(6)The term
data furnisher
means any agency, governmental entity,
organization, corporation, trust, partnership, sole proprietorship,
unincorporated association, venture established to make a profit, or nonprofit,
and any contractor, subcontractor, affiliate, or licensee thereof, that serves
as a source of information for a data broker.
(7)personal
electronic recordThe term
personal electronic record
means the compilation of personally
identifiable information of an individual (including information associated
with that personally identifiable information) in a database, networked or
integrated databases, or other data system.
(8)Personally
identifiable informationThe
term personally identifiable information means any information, or
compilation of information, in electronic or digital form serving as a means of
identification, as defined by section 1028(d)(7) of title 18, United State
Code.
(9)The term public
record
means any item, collection, or grouping of information about an
individual that is maintained by an agency, including—
(A)education, financial transactions, medical
history, and criminal or employment history containing the name of an
individual; and
(B)the identifying number, symbol, or other
identifying particular assigned to an individual, such as—
(i)a fingerprint;
(ii)a voice print; or
(iii)a photograph.
(10)
(A)The term
security breach means compromise of the security, confidentiality,
or integrity of computerized data through misrepresentation or actions that
result in, or there is a reasonable basis to conclude has resulted in, the
unauthorized acquisition of and access to sensitive personally identifiable
information.
(B)The term security breach
does not include a good faith acquisition of sensitive personally identifiable
information if the sensitive personally identifiable information is not subject
to further unauthorized disclosure.
(11)Sensitive
personally identifiable informationThe term sensitive personally
identifiable information
means any name or number used in conjunction
with any other information to identify a specific individual, including
any—
(A)name, social security number, date of
birth, official State or government issued driver's license or identification
number, alien registration number, government passport number, employer or
taxpayer identification number;
(B)unique biometric data, such as—
(i)a fingerprint;
(ii)a voice print;
(iii)a retina or iris image; or
(iv)any other unique physical
representation;
(C)unique electronic identification number,
address, or routing code; or
(D)telecommunication identifying information
or access device (as defined in section 1029(e) of title 18, United States
Code).
<enum>I</enum><header>Enhancing punishment for identity theft and
other violations of data privacy and security</header>
<section commented="no" display-inline="no-display-inline" id="ID61e083d79c73471f84abe587faeefdc8" section-type="subsequent-section"><enum>101.</enum><header>Fraud and related
criminal activity in connection with unauthorized access to personally
identifiable information</header><text display-inline="no-display-inline">Section 1030(a)(2) of title 18, United
States Code, is amended—</text>
<paragraph commented="no" display-inline="no-display-inline" id="id167EF4DBD506403CB33EC942C15C857A"><enum>(1)</enum><text display-inline="yes-display-inline">in subparagraph (B), by striking
<quote>or</quote> after the semicolon;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id0B378F7E00F8435183BFDC9935046238"><enum>(2)</enum><text display-inline="yes-display-inline">in subparagraph (C), by inserting
<quote>or</quote> after the semicolon; and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id668C984F5F464EE0BF096DA0C22263C1"><enum>(3)</enum><text display-inline="yes-display-inline">by adding at the end the following:</text>
<quoted-block display-inline="no-display-inline" id="id3E71C5CA58D545CBB516BF9C700D5326" style="OLC">
<subparagraph commented="no" display-inline="no-display-inline" id="id8EFFE5D364F442A8B125D3A2837C70A6"><enum>(D)</enum><text display-inline="yes-display-inline">information contained in the databases or
systems of a data broker, or in other personal electronic records, as such
terms are defined in section 3 of the Personal Data Privacy and Security Act of
2005;</text>
</subparagraph><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></section><section commented="no" display-inline="no-display-inline" id="id63126F2035C94E829418C6E150EE08C5" section-type="subsequent-section"><enum>102.</enum><header>Organized criminal
activity in connection with unauthorized access to personally identifiable
information</header><text display-inline="no-display-inline">Section 1961(1) of
title 18, United States Code, is amended by inserting <quote>section
1030(a)(2)(D)(relating to fraud and related activity in connection with
unauthorized access to personally identifiable information,</quote> before
<quote>section 1084</quote>.</text>
</section><section commented="no" display-inline="no-display-inline" id="ID70a64b144d6247be93d4e8f09f04b114" section-type="subsequent-section"><enum>103.</enum><header>Concealment of
security breaches involving personally identifiable information</header>
<subsection commented="no" display-inline="no-display-inline" id="id25F83CAF43EC45BE8D42EE4F7CF85091"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">Chapter 47 of title
18, United States Code, is amended by adding at the end the following:</text>
<quoted-block act-name="" display-inline="no-display-inline" id="id2080910D48CA48739E1F132569D2FE09" style="USC">
<section commented="no" display-inline="no-display-inline" id="ID63bafa953e254711bc4cf1f2f3f2e802" section-type="subsequent-section"><enum>1039.</enum><header>Concealment of
security breaches involving personally identifiable information</header><text display-inline="no-display-inline">Whoever, having knowledge of a security
breach requiring notice to individuals under title IV of the Personal Data
Privacy and Security Act of 2005, intentionally and willfully conceals the fact
of, or information related to, such security breach, shall be fined under this
title or imprisoned not more than 5 years, or
both.</text>
</section><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection commented="no" display-inline="no-display-inline" id="idE93AFC9E494546AAA07F96705A26C6C2"><enum>(b)</enum><header>Conforming and
technical amendments</header><text display-inline="yes-display-inline">The
table of sections for chapter 47 of title 18, United States Code, is amended by
adding at the end the following:</text>
<toc>
<toc-entry bold="off" level="section"><quote>1039. Concealment of
security breaches involving personally identifiable information.</quote>.
</toc-entry>
</toc>
</subsection></section><section commented="no" display-inline="no-display-inline" id="ID4868ceaa18ae404f909aea47f5a379a8" section-type="subsequent-section"><enum>104.</enum><header>Aggravated fraud in
connection with computers</header>
<subsection commented="no" display-inline="no-display-inline" id="id120B2EEC0ECA4CC48C181529F621EB40"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">Chapter 47 of title
18, United States Code, is amended by adding after section 1030 the
following:</text>
<quoted-block act-name="" display-inline="no-display-inline" id="idE47332D6CD974E25B8EDD6E5102EDA6B" style="USC">
<section commented="no" display-inline="no-display-inline" id="idF92FFB5B44394885A3BB23E6469A7F8F" section-type="subsequent-section"><enum>1030A.</enum><header>Aggravated fraud
in connection with computers </header>
<subsection commented="no" display-inline="no-display-inline" id="idE1B6555CF5864447BF77B3E6BEBDE80C"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">Whoever, during and
in relation to any felony violation enumerated in subsection (c), knowingly
obtains, accesses, or transmits, without lawful authority, a means of
identification of another person may, in addition to the punishment provided
for such felony, be sentenced to a term of imprisonment of up to 2
years.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="id136452167BDC4DA8BAD0595A27A37D80"><enum>(b)</enum><header>Consecutive
sentences</header><text display-inline="yes-display-inline">Notwithstanding any
other provision of law, should a court in its discretion impose an additional
sentence under subsection (a)—</text>
<paragraph commented="no" display-inline="no-display-inline" id="IDca8209d20e9145e9976c1a8d0b83e1aa"><enum>(1)</enum><text display-inline="yes-display-inline">no term of imprisonment imposed on a person
under this section shall run concurrently, except as provided in paragraph (3),
with any other term of imprisonment imposed on such person under any other
provision of law, including any term of imprisonment imposed for the felony
during which the means of identifications was obtained, accessed, or
transmitted;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDc70ec296b91841e1b9b6fd69680eda06"><enum>(2)</enum><text display-inline="yes-display-inline">in determining any term of imprisonment to
be imposed for the felony during which the means of identification was
obtained, accessed, or transmitted, a court shall not in any way reduce the
term to be imposed for such crime so as to compensate for, or otherwise take
into account, any separate term of imprisonment imposed or to be imposed for a
violation of this section; and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDa4cd2847e6a747fb83b873aa144b7fc9"><enum>(3)</enum><text display-inline="yes-display-inline">a term of imprisonment imposed on a person
for a violation of this section may, in the discretion of the court, run
concurrently, in whole or in part, only with another term of imprisonment that
is imposed by the court at the same time on that person for an additional
violation of this section.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="id7A3695AA73DC4904B2482F7AA4560D18"><enum>(c)</enum><header>Definition</header><text display-inline="yes-display-inline">For purposes of this section, the term
<quote>felony violation enumerated in subsection (c)</quote> means any offense
that is a felony violation of paragraphs (2) through (7) of section
1030(a).</text>
</subsection></section><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection commented="no" display-inline="no-display-inline" id="id912A7E3E85FB4E3A9A3C088849CAA03E"><enum>(b)</enum><header>Conforming and
technical amendments</header><text display-inline="yes-display-inline">The
table of sections for chapter 47 of title 18, United States Code, is amended by
inserting after the item relating to section 1030 the following new
item:</text>
<toc>
<toc-entry bold="off" level="section"><quote>1030A. Aggravated fraud
in connection with computers.</quote>. </toc-entry>
</toc>
</subsection></section><section commented="no" display-inline="no-display-inline" id="idC4C20A02F98A4601AF7B6CFE40BF3C35" section-type="subsequent-section"><enum>105.</enum><header>Review and amendment
of Federal sentencing guidelines related to fraudulent access to or misuse of
digitized or electronic personally identifiable information</header>
<subsection commented="no" display-inline="no-display-inline" id="ID2bd5bb5b497a4dda94d5f1f9bdf960b0"><enum>(a)</enum><header>Review and
amendment</header><text display-inline="yes-display-inline">Not later than 180
days after the date of enactment of this Act, the United States Sentencing
Commission, pursuant to its authority under section 994 of title 28, United
States Code, and in accordance with this section, shall review and, if
appropriate, amend the Federal sentencing guidelines (including its policy
statements) applicable to persons convicted of using fraud to access, or misuse
of, digitized or electronic personally identifiable information, including
identity theft or any offense under—</text>
<paragraph commented="no" display-inline="no-display-inline" id="IDf723d8a9c5df49b78c2acee27f8c18e1"><enum>(1)</enum><text display-inline="yes-display-inline">sections 1028, 1028A, 1030, 1030A, 2511,
and 2701 of title 18, United States Code; or</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID26a03e40e13b4e5da8dfaa3a141277ec"><enum>(2)</enum><text display-inline="yes-display-inline">any other relevant provision.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="IDb9eb2288b26340b29d08a02cb933d4cd"><enum>(b)</enum><header>Requirements</header><text display-inline="yes-display-inline">In carrying out the requirements of this
section, the United States Sentencing Commission shall—</text>
<paragraph commented="no" display-inline="no-display-inline" id="ID41ee8258c25d405291ccf31ac075b733"><enum>(1)</enum><text display-inline="yes-display-inline">ensure that the Federal sentencing
guidelines (including its policy statements) reflect—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="ID32704ac0c2f54849908376111e428a51"><enum>(A)</enum><text display-inline="yes-display-inline">the serious nature of the offenses and
penalties referred to in this Act;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID81f4246e43e24dc4a6846d27df42d688"><enum>(B)</enum><text display-inline="yes-display-inline">the growing incidences of theft and misuse
of digitized or electronic personally identifiable information, including
identity theft; and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID1931699b3c59400290df3ca80fa93542"><enum>(C)</enum><text display-inline="yes-display-inline">the need to deter, prevent, and punish such
offenses;</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID380a86f2614f45a398a3fbeef4243915"><enum>(2)</enum><text display-inline="yes-display-inline">consider the extent to which the Federal
sentencing guidelines (including its policy statements) adequately address
violations of the sections amended by this Act to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="IDc01062d0e2cc4869b67211cfdef7bbe6"><enum>(A)</enum><text display-inline="yes-display-inline">sufficiently deter and punish such
offenses; and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="IDc57b3a1aecd148588803acbfa6a5e73e"><enum>(B)</enum><text display-inline="yes-display-inline">adequately reflect the enhanced penalties
established under this Act;</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID88f7c314e9ab41c8aa53038855d5f683"><enum>(3)</enum><text display-inline="yes-display-inline">maintain reasonable consistency with other
relevant directives and sentencing guidelines;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDfdfbd554a5aa48d7b893afdd7ac30b64"><enum>(4)</enum><text display-inline="yes-display-inline">account for any additional aggravating or
mitigating circumstances that might justify exceptions to the generally
applicable sentencing ranges;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id1873C82E53004B8BB61A72CA2117B5EA"><enum>(5)</enum><text display-inline="yes-display-inline">consider whether to provide a sentencing
enhancement for those convicted of the offenses described in subsection (a), if
the conduct involves—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="IDc976cfbfcbef4f55a30ed39839cca2d8"><enum>(A)</enum><text display-inline="yes-display-inline">the online sale of fraudulently obtained or
stolen personally identifiable information;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID561da5449fac4ba58ca4fb6ebc5a4011"><enum>(B)</enum><text display-inline="yes-display-inline">the sale of fraudulently obtained or stolen
personally identifiable information to an individual who is engaged in
terrorist activity or aiding other individuals engaged in terrorist activity;
or</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID1e06665b9e24443a812b804fe18fe950"><enum>(C)</enum><text display-inline="yes-display-inline">the sale of fraudulently obtained or stolen
personally identifiable information to finance terrorist activity or other
criminal activities;</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID588a4a5bbb7f4a9c93a7b4de4c34fe84"><enum>(6)</enum><text display-inline="yes-display-inline">make any necessary conforming changes to
the Federal sentencing guidelines to ensure that such guidelines (including its
policy statements) as described in subsection (a) are sufficiently stringent to
deter, and adequately reflect crimes related to fraudulent access to, or misuse
of, personally identifiable information; and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDcd872ce7a7e84ffe9cf4eb230f654565"><enum>(7)</enum><text display-inline="yes-display-inline">ensure that the Federal sentencing
guidelines adequately meet the purposes of sentencing under section 3553(a)(2)
of title 18, United States Code.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="id9EDB15E299B349FE9E5212EBC50E595D"><enum>(c)</enum><header>Emergency
authority to sentencing commission</header><text display-inline="yes-display-inline">The United States Sentencing Commission
may, as soon as practicable, promulgate amendments under this section in
accordance with procedures established in section 21(a) of the Sentencing Act
of 1987 (28 U.S.C. 994 note) as though the authority under that Act had not
expired.</text>
</subsection></section><enum>II</enum><header>Assistance for state and local law
enforcement combating crimes related to fraudulent, unauthorized, or other
criminal use of personally identifiable information</header>
<section commented="no" display-inline="no-display-inline" id="ID658dea62203e4e48853ba6c5949f6592" section-type="subsequent-section"><enum>201.</enum><header>Grants for State and
local enforcement</header>
<subsection commented="no" display-inline="no-display-inline" id="IDe11c2f2366374d49a2e44349e98f26db"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">Subject to the
availability of amounts provided in advance in appropriations Acts, the
Assistant Attorney General for the Office of Justice Programs of the Department
of Justice may award a grant to a State to establish and develop programs to
increase and enhance enforcement against crimes related to fraudulent,
unauthorized, or other criminal use of personally identifiable
information.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="idEC522DF89D844052A7BE0ADCE4B297BE"><enum>(b)</enum><header>Application</header><text display-inline="yes-display-inline">A State seeking a grant under subsection
(a) shall submit an application to the Assistant Attorney General for the
Office of Justice Programs of the Department of Justice at such time, in such
manner, and containing such information as the Assistant Attorney General may
require.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="ID93ee6021ddc44f139fb242f63926c3ed"><enum>(c)</enum><header>Use of grant
amounts</header><text display-inline="yes-display-inline">A grant awarded to a
State under subsection (a) shall be used by a State, in conjunction with units
of local government within that State, State and local courts, other States, or
combinations thereof, to establish and develop programs to—</text>
<paragraph commented="no" display-inline="no-display-inline" id="ID123408b1c76c4c36ae4f48c57f1b0484"><enum>(1)</enum><text display-inline="yes-display-inline">assist State and local law enforcement
agencies in enforcing State and local criminal laws relating to crimes
involving the fraudulent, unauthorized, or other criminal use of personally
identifiable information;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID5f3f802e55f149e7bdbb9b5c66192f08"><enum>(2)</enum><text display-inline="yes-display-inline">assist State and local law enforcement
agencies in educating the public to prevent and identify crimes involving the
fraudulent, unauthorized, or other criminal use of personally identifiable
information;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID73a70ad30052456896694999d66d5e08"><enum>(3)</enum><text display-inline="yes-display-inline">educate and train State and local law
enforcement officers and prosecutors to conduct investigations and forensic
analyses of evidence and prosecutions of crimes involving the fraudulent,
unauthorized, or other criminal use of personally identifiable
information;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID67e0bafc7b9543f1913dd2b803c2b7bc"><enum>(4)</enum><text display-inline="yes-display-inline">assist State and local law enforcement
officers and prosecutors in acquiring computer and other equipment to conduct
investigations and forensic analysis of evidence of crimes involving the
fraudulent, unauthorized, or other criminal use of personally identifiable
information; and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID827de869205241ab9dbfc2da8da354ae"><enum>(5)</enum><text display-inline="yes-display-inline">facilitate and promote the sharing of
Federal law enforcement expertise and information about the investigation,
analysis, and prosecution of crimes involving the fraudulent, unauthorized, or
other criminal use of personally identifiable information with State and local
law enforcement officers and prosecutors, including the use of
multi-jurisdictional task forces.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="IDf14e4dec11924a30a9f658aabc81743e"><enum>(d)</enum><header>Assurances and
eligibility</header><text display-inline="yes-display-inline">To be eligible to
receive a grant under subsection (a), a State shall provide assurances to the
Attorney General that the State—</text>
<paragraph commented="no" display-inline="no-display-inline" id="ID083c31bf4e6b414ca34108fe81a0a931"><enum>(1)</enum><text display-inline="yes-display-inline">has in effect laws that penalize crimes
involving the fraudulent, unauthorized, or other criminal use of personally
identifiable information, such as penal laws prohibiting—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="ID84eacf9998454eca9a183604d98575bf"><enum>(A)</enum><text display-inline="yes-display-inline">fraudulent schemes executed to obtain
personally identifiable information;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="IDad8e3a9492244a7c82847fc181a86648"><enum>(B)</enum><text display-inline="yes-display-inline">schemes executed to sell or use
fraudulently obtained personally identifiable information; and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="IDfd97ae8f57574738a4b5bf342a6ae69b"><enum>(C)</enum><text display-inline="yes-display-inline">online sales of personally identifiable
information obtained fraudulently or by other illegal means;</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID3fff5bdf4a6644b68a93e928cf15983c"><enum>(2)</enum><text display-inline="yes-display-inline">will provide an assessment of the resource
needs of the State and units of local government within that State, including
criminal justice resources being devoted to the investigation and enforcement
of laws related to crimes involving the fraudulent, unauthorized, or other
criminal use of personally identifiable information; and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID49af589de2de47e5b530cb5f1060240b"><enum>(3)</enum><text display-inline="yes-display-inline">will develop a plan for coordinating the
programs funded under this section with other federally funded technical
assistant and training programs, including directly funded local programs such
as the Local Law Enforcement Block Grant program (described under the heading
<quote>Violent Crime Reduction Programs, State and Local Law Enforcement
Assistance</quote> of the Departments of Commerce, Justice, and State, the
Judiciary, and Related Agencies Appropriations Act, 1998 (Public Law
105–119)).</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="ID5ffc39c69366469fa60575861d50861b"><enum>(e)</enum><header>Matching
funds</header><text display-inline="yes-display-inline">The Federal share of a
grant received under this section may not exceed 90 percent of the total cost
of a program or proposal funded under this section unless the Attorney General
waives, wholly or in part, the requirements of this subsection.</text>
</subsection></section><section commented="no" display-inline="no-display-inline" id="ID57a283bdcc93459690dd9f4c0636c52e" section-type="subsequent-section"><enum>202.</enum><header>Authorization of
appropriations</header>
<subsection commented="no" display-inline="no-display-inline" id="ID25feba6d720542ab8fc08893c6f61cd4"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">There is authorized
to be appropriated to carry out this title $25,000,000 for each of fiscal years
2006 through 2009.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="IDce529b4ad8804711983c4e6a48e4f386"><enum>(b)</enum><header>Limitations</header><text display-inline="yes-display-inline">Of the amount made available to carry out
this title in any fiscal year not more than 3 percent may be used by the
Attorney General for salaries and administrative expenses.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="ID854c8539514c4047980a110d695df691"><enum>(c)</enum><header>Minimum
amount</header><text display-inline="yes-display-inline">Unless all eligible
applications submitted by a State or units of local government within a State
for a grant under this title have been funded, the State, together with
grantees within the State (other than Indian tribes), shall be allocated in
each fiscal year under this title not less than 0.75 percent of the total
amount appropriated in the fiscal year for grants pursuant to this title,
except that the United States Virgin Islands, American Samoa, Guam, and the
Northern Mariana Islands each shall be allocated 0.25 percent.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="IDfb1765d8a7dd479cafc476ebeed5bca5"><enum>(d)</enum><header>Grants to
Indian tribes</header><text display-inline="yes-display-inline">Notwithstanding
any other provision of this title, the Attorney General may use amounts made
available under this title to make grants to Indian tribes for use in
accordance with this title.</text>
</subsection></section><enum>III</enum><header>Data brokers</header>
<section commented="no" display-inline="no-display-inline" id="IDeccfb3aac4fd4b588b6e173e9e660124" section-type="subsequent-section"><enum>301.</enum><header>Transparency and
accuracy of data collection</header>
<subsection commented="no" display-inline="no-display-inline" id="IDe05080b3ea064673a744a944c6d9ee91"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">Data brokers engaging
in interstate commerce are subject to the requirements of this title for any
offered product or service offered to third parties that allows access, use,
compilation, distribution, processing, analyzing, or evaluating personally
identifiable information, unless that product or service is currently subject
to similar protections under subsections (b) and (g) of this section, the Fair
Credit Reporting Act (Public Law 91–508), or the Gramm-Leach Bliley Act (Public
Law 106–102), and implementing regulations.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="ID265dd81f54a04aaea0aa4ed6284c6192"><enum>(b)</enum><header>Disclosures to
individuals</header>
<paragraph commented="no" display-inline="no-display-inline" id="idC3AD44CCB59F46E494C7C424D220CD8B"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">A data broker shall,
upon the request of an individual, clearly and accurately disclose to such
individual for a reasonable fee all personal electronic records pertaining to
that individual maintained for disclosure to third parties in the databases or
systems of the data broker at the time of the request.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="idC177AF910684499489B81D330554E056"><enum>(2)</enum><header>Information on
how to correct inaccuracies</header><text display-inline="yes-display-inline">The disclosures required under paragraph
(1) shall also include guidance to individuals on the processes and procedures
for demonstrating and correcting any inaccuracies.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="ID19090d9d4ba04538ace70172b84f8719"><enum>(c)</enum><header>Creation of an
accuracy resolution process</header><text display-inline="yes-display-inline">A
data broker shall develop and publish on its website timely and fair processes
and procedures for responding to claims of inaccuracies, including procedures
for correcting inaccurate information in the personal electronic records it
maintains on individuals.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="ID9cf3cda91a884c49890c309a02517db4"><enum>(d)</enum><header>Accuracy
resolution process</header>
<paragraph commented="no" display-inline="no-display-inline" id="ID0d279e6308514df3ab79394ee6646dcc"><enum>(1)</enum><header>Public record
information</header>
<subparagraph commented="no" display-inline="no-display-inline" id="id625EDD6F21724D0CA79C31A941DDDBC3"><enum>(A)</enum><header>In
general</header><text display-inline="yes-display-inline">If an individual
notifies a data broker of a dispute as to the completeness or accuracy of
information, and the data broker determines that such information is derived
from a public record source, the data broker shall determine within 30 days
whether the information in its system accurately and completely records the
information offered by the public record source.</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id68128AA750884D759E1A76114A921CAE"><enum>(B)</enum><header>Data broker
actions</header><text display-inline="yes-display-inline">If a data broker
determines under subparagraph (A) that the information in its systems—</text>
<clause commented="no" display-inline="no-display-inline" id="id06D910AB0D164D68903845967D458CA7"><enum>(i)</enum><text display-inline="yes-display-inline">does not accurately and completely record
the information offered by a public record source, the data broker shall
correct any inaccuracies or incompleteness, and provide to such individual
written notice of such changes; and</text>
</clause><clause commented="no" display-inline="no-display-inline" id="idF6D3927975F4497497A0087AE585D2E2"><enum>(ii)</enum><text display-inline="yes-display-inline">does accurately and completely record the
information offered by a public record source, the data broker shall—</text>
<subclause commented="no" display-inline="no-display-inline" id="idEAD81956F4CD4A4698AF09C888F43EF5"><enum>(I)</enum><text display-inline="yes-display-inline">provide such individual with the name,
address, and telephone contact information of the public record source;
and</text>
</subclause><subclause commented="no" display-inline="no-display-inline" id="idFC484EF5DC7C450BA2C4C5FA054D86A4"><enum>(II)</enum><text display-inline="yes-display-inline">notify such individual of the right to add
to the personal electronic record of the individual maintained by the data
broker a statement disputing the accuracy or completeness of the information
for a period of 90 days under subsection (e).</text>
</subclause></clause></subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="idBBB3C147F9C644E28150237951B0A7BD"><enum>(2)</enum><header>Investigation
of disputed non-public record information</header><text display-inline="yes-display-inline">If the completeness or accuracy of any
non-public record information disclosed to an individual under subsection (b)
is disputed by the individual and such individual notifies the data broker
directly of such dispute, the data broker shall, before the end of the 30-day
period beginning on the date on which the data broker receives the notice of
the dispute—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="id1A11BB9608B545A785FFBC340677010A"><enum>(A)</enum><text display-inline="yes-display-inline">investigate free of charge and record the
current status of the disputed information; or</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id5ABEA019A030401A98C571ABE0FD3064"><enum>(B)</enum><text display-inline="yes-display-inline">delete the item from the individuals data
file in accordance with paragraph (8).</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDdd5de9a2f73a478198f5a22b3ae522cd"><enum>(3)</enum><header>Extension of
period to investigate</header><text display-inline="yes-display-inline">Except
as provided in paragraph (4), the 30-day period described in paragraph (1) may
be extended for not more than 15 additional days if a data broker receives
information from the individual during that 30-day period that is relevant to
the investigation.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDc8892c1b14b543fab9ebfaf86e24c51b"><enum>(4)</enum><header>Limitations on
extension of period to investigate</header><text display-inline="yes-display-inline">Paragraph (3) shall not apply to any
investigation in which, during the 30-day period described in paragraph (1),
the information that is the subject of the investigation is found to be
inaccurate or incomplete or a data broker determines that the information
cannot be verified.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDa67ebe256597468fa70bd315c052c526"><enum>(5)</enum><header>Notice
identifying the data furnisher</header><text display-inline="yes-display-inline">If the completeness or accuracy of any
information disclosed to an individual under subsection (b) is disputed by the
individual, a data broker shall provide upon the request of the individual, the
name, business address, and telephone contact information of any data furnisher
who provided an item of information in dispute.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDcff82324443a48cea2bb8cfab80523fb"><enum>(6)</enum><header>Determination
that dispute is frivolous or irrelevant</header>
<subparagraph commented="no" display-inline="no-display-inline" id="ID908d18c64c6a4174b5798d667ad22403"><enum>(A)</enum><header>In
general</header><text display-inline="yes-display-inline">Notwithstanding
paragraphs (1) through (4), a data broker may decline to investigate or
terminate an investigation of information disputed by an individual under those
paragraphs if the data broker reasonably determines that the dispute by the
individual is frivolous or irrelevant, including by reason of a failure by the
individual to provide sufficient information to investigate the disputed
information.</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="IDf0c71360aad74dda9050677e887608ec"><enum>(B)</enum><header>Notice</header><text display-inline="yes-display-inline">Not later than 5 business days after making
any determination in accordance with subparagraph (A) that a dispute is
frivolous or irrelevant, a data broker shall notify the individual of such
determination by mail, or if authorized by the individual, by any other means
available to the data broker.</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID4924f256e2084311b1868c35553d8627"><enum>(C)</enum><header>Contents of
notice</header><text display-inline="yes-display-inline">A notice under
subparagraph (B) shall include—</text>
<clause commented="no" display-inline="no-display-inline" id="idB4F2F21A4C7D46A6868CCE72BCADB669"><enum>(i)</enum><text display-inline="yes-display-inline">the reasons for the determination under
subparagraph (A); and</text>
</clause><clause commented="no" display-inline="no-display-inline" id="id5BD0DA3E5F264419A309E704BA2EA2E3"><enum>(ii)</enum><text display-inline="yes-display-inline">identification of any information required
to investigate the disputed information, which may consist of a standardized
form describing the general nature of such information.</text>
</clause></subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID9552efa6377d4516bf58487c36c5e443"><enum>(7)</enum><header>Consideration
of individual information</header><text display-inline="yes-display-inline">In
conducting any investigation with respect to disputed information in the
personal electronic record of any individual, a data broker shall review and
consider all relevant information submitted by the individual in the period
described in paragraph (2) with respect to such disputed information.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID5125d224bfbd47459cb872f122565628"><enum>(8)</enum><header>Treatment of
inaccurate or unverifiable information</header>
<subparagraph commented="no" display-inline="no-display-inline" id="ID8e1d3ee81ab9433c9a2c15707066bab2"><enum>(A)</enum><header>In
general</header><text display-inline="yes-display-inline">If, after any review
of public record information under paragraph (1) or any investigation of any
information disputed by an individual under paragraphs (2) through (4), an item
of information is found to be inaccurate or incomplete or cannot be verified, a
data broker shall promptly delete that item of information from the
individual’s personal electronic record or modify that item of information, as
appropriate, based on the results of the investigation.</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="IDb77965b5351646b7af944dc9bda1c3ab"><enum>(B)</enum><header>Notice to
individuals of reinsertion of previously deleted information</header><text display-inline="yes-display-inline">If any information that has been deleted
from an individual’s personal electronic record pursuant to subparagraph (A) is
reinserted in the personal electronic record of the individual, a data broker
shall, not later than 5 days after reinsertion, notify the individual of the
reinsertion and identify any data furnisher not previously disclosed in
writing, or if authorized by the individual for that purpose, by any other
means available to the data broker, unless such notification has been
previously given under this subsection.</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="IDfaec19d5917e4604b546a9fb456f556e"><enum>(C)</enum><header>Notice of
results of investigation of disputed non-public record</header>
<clause commented="no" display-inline="no-display-inline" id="id71D2113B11C747D09B723AE8185474AB"><enum>(i)</enum><header>In
general</header><text display-inline="yes-display-inline">Not later than 5
business days after the completion of an investigation under paragraph (2), a
data broker shall provide written notice to an individual of the results of the
investigation, by mail or, if authorized by the individual for that purpose, by
other means available to the data broker.</text>
</clause><clause commented="no" display-inline="no-display-inline" id="id631CD67E09FE469B89E04D08BEE6F9ED"><enum>(ii)</enum><header>Additional
requirement</header><text display-inline="yes-display-inline">Before the
expiration of the 5-day period, as part of, or in addition to such notice, a
data broker shall, in writing, provide to an individual—</text>
<subclause commented="no" display-inline="no-display-inline" id="IDb8fef9a422e849f192a9a66d9600e9ae"><enum>(I)</enum><text display-inline="yes-display-inline">a statement that the investigation is
completed;</text>
</subclause><subclause commented="no" display-inline="no-display-inline" id="ID432490b49750452c9be6e34173651d3f"><enum>(II)</enum><text display-inline="yes-display-inline">a report that is based upon the personal
electronic record of such individual as that personal electronic record is
revised as a result of the investigation;</text>
</subclause><subclause commented="no" display-inline="no-display-inline" id="ID30df3893746848a89af13631f4ad799b"><enum>(III)</enum><text display-inline="yes-display-inline">a notice that, if requested by the
individual, a description of the procedures used to determine the accuracy and
completeness of the information shall be provided to the individual by the data
broker, including the business name, address, and telephone number of any data
furnisher of information contacted in connection with such information;
and</text>
</subclause><subclause commented="no" display-inline="no-display-inline" id="ID7c0efaa99736407296d401cb01f3cf4a"><enum>(IV)</enum><text display-inline="yes-display-inline">a notice that the individual has the right
to request notifications under subsection (g).</text>
</subclause></clause></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID830226c3fc6443ba9860567d4af28d7d"><enum>(D)</enum><header>Description of
investigation procedures</header><text display-inline="yes-display-inline">Not
later than 15 days after receiving a request from an individual for a
description referred to in subparagraph (C)(ii)(III), a data broker shall
provide to the individual such a description.</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID8eb1dc504b7a4688b59ef787a9e74450"><enum>(E)</enum><header>Expedited
dispute resolution</header><text display-inline="yes-display-inline">If by no
later than 3 business days after the date on which a data broker receives
notice of a dispute from an individual of information in the personal
electronic record of such individual in accordance with paragraph (2), a data
broker resolves such dispute in accordance with subparagraph (A) by the
deletion of the disputed information, then the data broker shall not be
required to comply with subsections (e) and (f) with respect to that dispute if
the data broker provides—</text>
<clause commented="no" display-inline="no-display-inline" id="ID9de5f20aa722486291de1b4542cb2f16"><enum>(i)</enum><text display-inline="yes-display-inline">to the individual, by telephone, prompt
notice of the deletion; and</text>
</clause><clause commented="no" display-inline="no-display-inline" id="IDca5ecc9d03c242c98322d2fb6d785d51"><enum>(ii)</enum><text display-inline="yes-display-inline">to the individual a right to request that
the data broker furnish notifications under subsection (g).</text>
</clause></subparagraph></paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="ID60e9584212db4d36935375077c457601"><enum>(e)</enum><header>Statement of
dispute</header>
<paragraph commented="no" display-inline="no-display-inline" id="id6008CC273B0A4A16BA8DE7DE3BCB8549"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">If the completeness
or accuracy of any information disclosed to an individual under subsection (b)
is disputed, an individual may file a brief statement setting forth the nature
of the dispute.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id0AEDEAB28984415F9EB86C1D0734462D"><enum>(2)</enum><header>Contents of
statement</header><text display-inline="yes-display-inline">A data broker may
limit the statements made pursuant to paragraph (1) to not more than 100 words
if it provides an individual with assistance in writing a clear summary of the
dispute or until the dispute is resolved, whichever is earlier.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="ID4c3b8cfeb6684fc8881aeb6c6863e80f"><enum>(f)</enum><header>Notification of
dispute in subsequent reports</header><text display-inline="yes-display-inline">Whenever a statement of a dispute is filed
under subsection (e), unless there is a reasonable grounds to believe that it
is frivolous or irrelevant, a data broker shall, in any subsequent report,
product, or service containing the information in question, clearly note that
it is disputed by an individual and provide either the statement of such
individual or a clear and accurate codification or summary thereof for a period
of 90 days after the data broker first posts the statement of dispute.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="ID75dd702753e340ac937be7da8fddcd46"><enum>(g)</enum><header>Notification of
deletion of disputed information</header><text display-inline="yes-display-inline">Following any deletion of information which
is found to be inaccurate or whose accuracy can no longer be verified, a data
broker shall, at the request of an individual, furnish notification that the
item has been deleted or the statement, codification, or summary pursuant to
subsection (e) or (f) to any user or customer of the products or services of
the data broker who has within 90 days received a report with the deleted or
disputed information or has electronically accessed the deleted or disputed
information.</text>
</subsection></section><section commented="no" display-inline="no-display-inline" id="ID1c8011428bc24b24891956b4f7e6262d" section-type="subsequent-section"><enum>302.</enum><header>Enforcement</header>
<subsection commented="no" display-inline="no-display-inline" id="IDfdf7ea47510b46018984fae9f35fe4a9"><enum>(a)</enum><header>Civil
penalties</header>
<paragraph commented="no" display-inline="no-display-inline" id="ID77b7e92dbb9045eeaa92a2a504783729"><enum>(1)</enum><header>Penalties</header><text display-inline="yes-display-inline">Any data broker that violates the
provisions of section 301 shall be subject to civil penalties of not more than
$1,000 per violation per day, with a maximum of $15,000 per day, while such
violations persist.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDc04de66b19024774b5f98345e40a93ac"><enum>(2)</enum><header>Intentional or
willful violation</header><text display-inline="yes-display-inline">A data
broker that intentionally or willfully violates the provisions of section 301
shall be subject to additional penalties in the amount of $1,000 per violation
per day, with a maximum of an additional $15,000 per day, while such violations
persist.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID950b5eb68a9f4e0bbb5750a95e12d446"><enum>(3)</enum><header>Equitable
relief</header><text display-inline="yes-display-inline">A data broker engaged
in interstate commerce that violates this section may be enjoined from further
violations by a court of competent jurisdiction.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID0413ef81c1e94b5383fb876cf3774edc"><enum>(4)</enum><header>Other rights
and remedies</header><text display-inline="yes-display-inline">The rights and
remedies available under this subsection are cumulative and shall not affect
any other rights and remedies available under law.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="id9DD6A175887344D386D9F94E7409DCED"><enum>(b)</enum><header>Injunctive
actions by the Attorney General</header>
<paragraph commented="no" display-inline="no-display-inline" id="idF953EBE8802F449B8F64F73E3C5652F3"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">Whenever it appears
that a data broker to which this title applies has engaged, is engaged, or is
about to engage, in any act or practice constituting a violation of this title,
the Attorney General may bring a civil action in an appropriate district court
of the United States to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="id83C1E1EE65A44F05871FBDA523D18F1D"><enum>(A)</enum><text display-inline="yes-display-inline">enjoin such act or practice;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idF6A3DFF2FFAA4892820D61CF07117E0B"><enum>(B)</enum><text display-inline="yes-display-inline">enforce compliance with this title;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id756BB37D9D584D8DBFB5C43F1B36F48A"><enum>(C)</enum><text display-inline="yes-display-inline">obtain damages—</text>
<clause commented="no" display-inline="no-display-inline" id="id338BB1FA40E8435FA4C8285BAA93B113"><enum>(i)</enum><text display-inline="yes-display-inline">in the sum of actual damages, restitution,
and other compensation on behalf of the affected residents of a State;
and</text>
</clause><clause commented="no" display-inline="no-display-inline" id="id744251AD0A68486289BD569879719943"><enum>(ii)</enum><text display-inline="yes-display-inline">punitive damages, if the violation is
willful or intentional; and</text>
</clause></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id3F4C5A746A3548D28B475F92FF9D4B3F"><enum>(D)</enum><text display-inline="yes-display-inline">obtain such other relief as the court
determines to be appropriate.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="id7FAAA5C70BFA47F9865C53BC092F0CB6"><enum>(2)</enum><header>Other
injunctive relief</header><text display-inline="yes-display-inline">Upon a
proper showing in the action under paragraph (1), the court shall grant a
permanent injunction or a temporary restraining order without bond.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="ID0cc935df13884fafa539854a43455951"><enum>(c)</enum><header>State
enforcement</header>
<paragraph commented="no" display-inline="no-display-inline" id="IDd887f71cae944e0d908a31989dc6df22"><enum>(1)</enum><header>Civil
actions</header><text display-inline="yes-display-inline">In any case in which
the attorney general of a State has reason to believe that an interest of the
residents of that State has been or is threatened or adversely affected by an
act or practice that violates this title, the State may bring a civil action on
behalf of the residents of that State in a district court of the United States
of appropriate jurisdiction, or any other court of competent jurisdiction,
to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="ID5568efe9f4f44f6da842c1b6a63161dd"><enum>(A)</enum><text display-inline="yes-display-inline">enjoin that act or practice;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID61815e49cd0b4e50b5237515619ba2bc"><enum>(B)</enum><text display-inline="yes-display-inline">enforce compliance with this title;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID17e4c47f47ae4260ba9409c1d883d47c"><enum>(C)</enum><text display-inline="yes-display-inline">obtain—</text>
<clause commented="no" display-inline="no-display-inline" id="id64FCAF5AA50D4CAEBB220A5731545058"><enum>(i)</enum><text display-inline="yes-display-inline">damages in the sum of actual damages,
restitution, or other compensation on behalf of affected residents of the
State; and</text>
</clause><clause commented="no" display-inline="no-display-inline" id="id809BEC60E1C64DEA944ABC7EFA07397D"><enum>(ii)</enum><text display-inline="yes-display-inline">punitive damages, if the violation is
willful or intentional; or</text>
</clause></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID6b238dbe64564aba8111ee5d46ded61e"><enum>(D)</enum><text display-inline="yes-display-inline">obtain such other legal and equitable
relief as the court may consider to be appropriate.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID7290fbddbcf344bda6a114cdc8239dc2"><enum>(2)</enum><header>Notice</header>
<subparagraph commented="no" display-inline="no-display-inline" id="id9B4507B13316426DAA04E68070BD039C"><enum>(A)</enum><header>In
general</header><text display-inline="yes-display-inline">Before filing an
action under this subsection, the attorney general of the State involved shall
provide to the Attorney General—</text>
<clause commented="no" display-inline="no-display-inline" id="id809CB295C03C4B0BADF0B8478E558DA3"><enum>(i)</enum><text display-inline="yes-display-inline">a written notice of that action; and</text>
</clause><clause commented="no" display-inline="no-display-inline" id="idAF8CE86D861E4A4EB22F7D68D3D3B1AF"><enum>(ii)</enum><text display-inline="yes-display-inline">a copy of the complaint for that
action.</text>
</clause></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idEE00A3DFCF7B4A498D4AFA93833FADD1"><enum>(B)</enum><header>Exception</header><text display-inline="yes-display-inline">Subparagraph (A) shall not apply with
respect to the filing of an action by an attorney general of a State under this
subsection, if the attorney general of a State determines that it is not
feasible to provide the notice described in this subparagraph before the filing
of the action.</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id46E8DD94C42E46D9A59A98F32A7BE9F1"><enum>(C)</enum><header>Notification
when practicable</header><text display-inline="yes-display-inline">In an action
described under subparagraph (B), the attorney general of a State shall provide
the written notice and the copy of the complaint to the Attorney General as
soon after the filing of the complaint as practicable.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="id2B2DD5B8C1754633AF3BAE51CCA60A68"><enum>(3)</enum><header>Attorney
General authority</header><text display-inline="yes-display-inline">Upon
receiving notice under paragraph (2), the Attorney General shall have the right
to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="idFDCC43E9F5EE4A2C9C8C1549350EE924"><enum>(A)</enum><text display-inline="yes-display-inline">move to stay the action, pending the final
disposition of a pending Federal proceeding or action as described in paragraph
(4);</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idEC965CB28F3D4AC68ABD21A48C74F25F"><enum>(B)</enum><text display-inline="yes-display-inline">intervene in an action brought under
paragraph (1); and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id35C714E3352C4A3784936FE4161BCEE5"><enum>(C)</enum><text display-inline="yes-display-inline">file petitions for appeal.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="id8D0AB2F639FE4AD897224B165CC96698"><enum>(4)</enum><header>Pending
proceedings</header><text display-inline="yes-display-inline">If the Attorney
General has instituted a proceeding or action for a violation of this Act or
any regulations thereunder, no attorney general of a State may, during the
pendency of such proceeding or action, bring an action under this subsection
against any defendant named in such criminal proceeding or civil action for any
violation that is alleged in that proceeding or action.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDcdc5b6a41278463baadf9d054f9765b1"><enum>(5)</enum><header>Rule of
construction</header><text display-inline="yes-display-inline">For purposes of
bringing any civil action under paragraph (1), nothing in this Act shall be
construed to prevent an attorney general of a State from exercising the powers
conferred on the attorney general by the laws of that State to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="id73F3BD1F4CFA45619316D4B5F0F3FE9E"><enum>(A)</enum><text display-inline="yes-display-inline">conduct investigations;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id8197748E226A420ABEF52A07D20E8496"><enum>(B)</enum><text display-inline="yes-display-inline">administer oaths and affirmations;
or</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idB5EB6260CF4345B89FA57E2FB6D01DF0"><enum>(C)</enum><text display-inline="yes-display-inline">compel the attendance of witnesses or the
production of documentary and other evidence.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="id787BB8B04B0D4CEDAA88932E19597466"><enum>(6)</enum><header>Venue; service
of process</header>
<subparagraph commented="no" display-inline="no-display-inline" id="id07B4836BF02549CD8BDA9501354E2C38"><enum>(A)</enum><header>Venue</header><text display-inline="yes-display-inline">Any action brought under this subsection
may be brought in the district court of the United States that meets applicable
requirements relating to venue under section 1931 of title 28, United States
Code.</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id17155495E48541E2B3EAFD9114D67039"><enum>(B)</enum><header>Service of
process</header><text display-inline="yes-display-inline">In an action brought
under this subsection process may be served in any district in which the
defendant—</text>
<clause commented="no" display-inline="no-display-inline" id="idA2A6BB0B43B24BAD8392506F4A3D8303"><enum>(i)</enum><text display-inline="yes-display-inline">is an inhabitant; or</text>
</clause><clause commented="no" display-inline="no-display-inline" id="id3EFCC1069BCB4A328EE03FD3B09D34AC"><enum>(ii)</enum><text display-inline="yes-display-inline">may be found.</text>
</clause></subparagraph></paragraph></subsection></section><section commented="no" display-inline="no-display-inline" id="idBB183622651046E4AF84B055157BC19A" section-type="subsequent-section"><enum>303.</enum><header>Relation to State
laws</header>
<subsection commented="no" display-inline="no-display-inline" id="idE750C81457E04A17ACF7B38927D1978D"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">Except as provided in
subsection (b), this title does not annul, alter, affect, or exempt any person
subject to the provisions of this title from complying with the laws of any
State with respect to the access, use, compilation, distribution, processing,
analysis, and evaluation of any personally identifiable information by data
brokers, except to the extent that those laws are inconsistent with any
provisions of this title, and then only to the extent of such
inconsistency.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="id017D9834C1BE41F29897EB95B0870FA1"><enum>(b)</enum><header>Exceptions</header><text display-inline="yes-display-inline">No requirement or prohibition may be
imposed under the laws of any State with respect to any subject matter
regulated under section 301, relating to individual access to, and correction
of, personal electronic records.</text>
</subsection></section><section commented="no" display-inline="no-display-inline" id="ID14ba6a6695f94105b011a272fdfadde0" section-type="subsequent-section"><enum>304.</enum><header>Effective
date</header><text display-inline="no-display-inline">This title shall take
effect 180 days after the date of enactment of this Act.</text>
</section><enum>IV</enum><header>Privacy and security of personally
identifiable information</header>
<subtitle commented="no" id="idB969701409E841279B2194E39DA6954F" style="OLC"><enum>A</enum><header>Data privacy and security program</header>
<section commented="no" display-inline="no-display-inline" id="id9AB3EE7075E9442AAC7653256781195F" section-type="subsequent-section"><enum>401.</enum><header>Purpose and
applicability of data privacy and security program</header>
<subsection commented="no" display-inline="no-display-inline" id="ID5421e92137ff47019751add36a2838f2"><enum>(a)</enum><header>Purpose</header><text display-inline="yes-display-inline">The purpose of this subtitle is to ensure
standards for developing and implementing administrative, technical, and
physical safeguards to protect the privacy, security, confidentiality,
integrity, storage, and disposal of personally identifiable information.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="IDb7719eac3a244f9cb4dd8cb90890f655"><enum>(b)</enum><header>In
general</header><text display-inline="yes-display-inline">A business entity
engaging in interstate commerce that involves collecting, accessing,
transmitting, using, storing, or disposing of personally identifiable
information in electronic or digital form on 10,000 or more United States
persons is subject to the requirements for a data privacy and security program
under section 402 for protecting personally identifiable information.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="IDaf912e9ec5e04f21b758000178d60783"><enum>(c)</enum><header>Limitations</header><text display-inline="yes-display-inline">Notwithstanding any other obligation under
this subtitle, this subtitle does not apply to—</text>
<paragraph commented="no" display-inline="no-display-inline" id="idB6CE38DA1914481C815D0D2B16B2C3AE"><enum>(1)</enum><text display-inline="yes-display-inline">financial institutions subject to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="id2F01E638FD314AFFBE058E2E9DAE6D86"><enum>(A)</enum><text display-inline="yes-display-inline">the data security requirements and
implementing regulations under the Gramm-Leach-Bliley Act (15 U.S.C. 6801 et
seq.); and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id973B1599A2B34E48A3FB231FFD1648F0"><enum>(B)</enum><text display-inline="yes-display-inline">examinations for compliance with the
requirements of this Act by 1 or more Federal functional regulators (as defined
in section 509 of the Gramm-Leach-Bliley Act (15 U.S.C. 6809)); or</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="id21F025CC9E404A878CB8E071668097EE"><enum>(2)</enum><text display-inline="yes-display-inline"><quote>covered entities</quote> subject to
the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1301
et seq.), including the data security requirements and implementing regulations
of that Act.</text>
</paragraph></subsection></section><section commented="no" display-inline="no-display-inline" id="ID5693f6a32a6442db906fdeee52d8b875" section-type="subsequent-section"><enum>402.</enum><header>Requirements for a
personal data privacy and security program</header>
<subsection commented="no" display-inline="no-display-inline" id="IDe44596fc79db4092b316001803881eb7"><enum>(a)</enum><header>Personal data
privacy and security program</header><text display-inline="yes-display-inline">Unless otherwise limited under section
401(c), a business entity subject to this subtitle shall comply with the
following safeguards to protect the privacy and security of personally
identifiable information:</text>
<paragraph commented="no" display-inline="no-display-inline" id="ID1700e1d016f6495b952aa37376545319"><enum>(1)</enum><header>Scope</header><text display-inline="yes-display-inline">A business entity shall implement a
comprehensive personal data privacy and security program, written in 1 or more
readily accessible parts, that includes administrative, technical, and physical
safeguards appropriate to the size and complexity of the business entity and
the nature and scope of its activities.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDbf3e846409134d2280181f860f2603e3"><enum>(2)</enum><header>Design</header><text display-inline="yes-display-inline">The personal data privacy and security
program shall be designed to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="ID99c9a6f0bd0d4a04addd24fecd737ee0"><enum>(A)</enum><text display-inline="yes-display-inline">ensure the privacy, security, and
confidentiality of personal electronic records;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="IDb017ea66a4a3454da23426a7817c10bd"><enum>(B)</enum><text display-inline="yes-display-inline">protect against any anticipated
vulnerabilities to the privacy, security, or integrity of personal electronic
records; and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID9f26c5947df8427e9789f1e930f3bafb"><enum>(C)</enum><text display-inline="yes-display-inline">protect against unauthorized access to use
of personal electronic records that could result in substantial harm or
inconvenience to any individual.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID956e1d56ea3446e180ba3b42d7e2ec67"><enum>(3)</enum><header>Risk
assessment</header><text display-inline="yes-display-inline">A business entity
shall—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="ID3cc8d7810e8f4714a705351002fb4783"><enum>(A)</enum><text display-inline="yes-display-inline">identify reasonably foreseeable internal
and external vulnerabilities that could result in unauthorized access,
disclosure, use, or alteration of personally identifiable information or
systems containing personally identifiable information;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID353b206af29a4c84a8380cf8c2283fac"><enum>(B)</enum><text display-inline="yes-display-inline">assess the likelihood of and potential
damage from unauthorized access, disclosure, use, or alteration of personally
identifiable information; and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID33549e9e9e5046499a3f7c0b2ae63b4e"><enum>(C)</enum><text display-inline="yes-display-inline">assess the sufficiency of its policies,
technologies, and safeguards in place to control and minimize risks from
unauthorized access, disclosure, use, or alteration of personally identifiable
information.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID705f43bfa8694f82bfcd99cf3c87bed3"><enum>(4)</enum><header>Risk management
and control</header><text display-inline="yes-display-inline">Each business
entity shall—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="idB3D1A10E41E74035B5948664A64EB652"><enum>(A)</enum><text display-inline="yes-display-inline">design its personal data privacy and
security program to control the risks identified under paragraph (3);
and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id42D1A39F755E443E935EA4B2C4FF113A"><enum>(B)</enum><text display-inline="yes-display-inline">adopt measures commensurate with the
sensitivity of the data as well as the size, complexity, and scope of the
activities of the business entity that—</text>
<clause commented="no" display-inline="no-display-inline" id="IDef48e3ace0b74ee984c751493bffdfb1"><enum>(i)</enum><text display-inline="yes-display-inline">control access to systems and facilities
containing personally identifiable information, including controls to
authenticate and permit access only to authorized individuals;</text>
</clause><clause commented="no" display-inline="no-display-inline" id="ID439b19bdfbf74c679ac3221bba9057c5"><enum>(ii)</enum><text display-inline="yes-display-inline">detect actual and attempted fraudulent,
unlawful, or unauthorized access, disclosure, use, or alteration of personally
identifiable information, including by employees and other individuals
otherwise authorized to have access; and</text>
</clause><clause commented="no" display-inline="no-display-inline" id="ID9c3d8b25a17541c98f533375f8dc303c"><enum>(iii)</enum><text display-inline="yes-display-inline">protect personally identifiable information
during use, transmission, storage, and disposal by encryption or other
reasonable means (including as directed for disposal of records under section
628 of the Fair Credit Reporting Act (15 U.S.C. 1681w) and the implementing
regulations of such Act as set forth in section 682 of title 16, Code of
Federal Regulations).</text>
</clause></subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="id71B5E18A20EA4CAFBD67965A402359AA"><enum>(5)</enum><header>Accountability</header><text display-inline="yes-display-inline">Each business entity required to establish
a data security program under section 401 shall publish on its website or make
otherwise available the terms of such program to the extent that such terms do
not reveal information that compromise data security or privacy.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="ID6580e32338ff46138d992c0609ac947c"><enum>(b)</enum><header>Training</header><text display-inline="yes-display-inline">Each business entity subject to this
subtitle shall take steps to ensure employee training and supervision for
implementation of the data security program of the business entity.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="IDadc6f7197b1a4160b7f492bb85bd1ea5"><enum>(c)</enum><header>Vulnerability
testing</header>
<paragraph commented="no" display-inline="no-display-inline" id="id7B41208F6D5F43C39DD8232F641DC697"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">Each business entity
subject to this subtitle shall take steps to ensure regular testing of key
controls, systems, and procedures of the personal data privacy and security
program to detect, prevent, and respond to attacks or intrusions, or other
system failures.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="idC119407B572447C98484012EE3F09E3E"><enum>(2)</enum><header>Frequency</header><text display-inline="yes-display-inline">The frequency and nature of the tests
required under paragraph (1) shall be determined by the risk assessment of the
business entity under subsection (a)(3).</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="ID8b3ac9c4d91d47aa8c52cd174729f673"><enum>(d)</enum><header>Relationship to
service providers</header><text display-inline="yes-display-inline">In the
event a business entity subject to this subtitle engages service providers not
subject to this subtitle, such business entity shall—</text>
<paragraph commented="no" display-inline="no-display-inline" id="IDcc97c88c09824d1cb88aef26aec04111"><enum>(1)</enum><text display-inline="yes-display-inline">exercise appropriate due diligence in
selecting those service providers for responsibilities related to personally
identifiable information, and take reasonable steps to select and retain
service providers that are capable of maintaining appropriate safeguards for
the security, privacy, and integrity of the personally identifiable information
at issue; and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDac5ccd8449764e59b1660bdff2c177f1"><enum>(2)</enum><text display-inline="yes-display-inline">require those service providers by contract
to implement and maintain appropriate measures designed to meet the objectives
and requirements governing entities subject to this section, section 401, and
subtitle B.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="IDc023fa1ae63e49eca60328f46c15c6eb"><enum>(e)</enum><header>Periodic
assessment and personal data privacy and security modernization</header><text display-inline="yes-display-inline">Each business entity subject to this
subtitle shall on a regular basis monitor, evaluate, and adjust, as appropriate
its data privacy and security program in light of any relevant changes
in—</text>
<paragraph commented="no" display-inline="no-display-inline" id="id7B8EF50E08E14F65A4DF4C887614FD71"><enum>(1)</enum><text display-inline="yes-display-inline">technology;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id04C25DB2254A46899A66FFE98EE17FA4"><enum>(2)</enum><text display-inline="yes-display-inline">the sensitivity of personally identifiable
information;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id50F8A1324042443C99E76F2A541A3A84"><enum>(3)</enum><text display-inline="yes-display-inline">internal or external threats to personally
identifiable information; and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id0BA5E3DD25DB4462894A0CEDF6515FB6"><enum>(4)</enum><text display-inline="yes-display-inline">the changing business arrangements of the
business entity, such as—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="id311F2BBA795449E086D5006CEC3C2913"><enum>(A)</enum><text display-inline="yes-display-inline">mergers and acquisitions;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id14936CFBAEFE42F4AB900DCB43F034D0"><enum>(B)</enum><text display-inline="yes-display-inline">alliances and joint ventures;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idE07238FE05364DF2894983D4AA5E9520"><enum>(C)</enum><text display-inline="yes-display-inline">outsourcing arrangements;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id990765DA7EAE484CBFAB8331FCCF9D0A"><enum>(D)</enum><text display-inline="yes-display-inline">bankruptcy; and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id2D81463C59CF45BE94967C312105F1A1"><enum>(E)</enum><text display-inline="yes-display-inline">changes to personally identifiable
information systems.</text>
</subparagraph></paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="ID3b3aa52ec1be4719954a93ab713ff73b"><enum>(f)</enum><header>Implementation
time line</header><text display-inline="yes-display-inline">Not later than 1
year after the date of enactment of this Act, a business entity subject to the
provisions of this subtitle shall implement a data privacy and security program
pursuant to this subtitle.</text>
</subsection></section><section commented="no" display-inline="no-display-inline" id="ID5f321c3d88964c2fbff395285c6073fa" section-type="subsequent-section"><enum>403.</enum><header>Enforcement</header>
<subsection commented="no" display-inline="no-display-inline" id="ID4a1203708e004384a481a1c7a4566b78"><enum>(a)</enum><header>Civil
penalties</header>
<paragraph commented="no" display-inline="no-display-inline" id="idCBB68F386B0F4D95AC4989E9C51B0C12"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">Any business entity
that violates the provisions of sections 401 or 402 shall be subject to civil
penalties of not more than $5,000 per violation per day, with a maximum of
$35,000 per day, while such violations persist.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID6c9e3029206840478e35e8a71a69054c"><enum>(2)</enum><header>Intentional or
willful violation</header><text display-inline="yes-display-inline">A business
entity that intentionally or willfully violates the provisions of sections 401
or 402 shall be subject to additional penalties in the amount of $5,000 per
violation per day, with a maximum of an additional $35,000 per day, while such
violations persist.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID62dc1e10374a494f94d854be306e9af7"><enum>(3)</enum><header>Equitable
relief</header><text display-inline="yes-display-inline">A business entity
engaged in interstate commerce that violates this section may be enjoined from
further violations by a court of competent jurisdiction.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID47d7f48ff89147bd9e684361f2e0c77f"><enum>(4)</enum><header>Other rights
and remedies</header><text display-inline="yes-display-inline">The rights and
remedies available under this section are cumulative and shall not affect any
other rights and remedies available under law</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="id09D96FAB648E422CB7BC384F4E203DF9"><enum>(b)</enum><header>Injunctive
actions by the Attorney General</header>
<paragraph commented="no" display-inline="no-display-inline" id="id952E8F0426B748E185AEBC6BC5E36574"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">Whenever it appears
that a business entity or agency to which this subtitle applies has engaged, is
engaged, or is about to engage, in any act or practice constituting a violation
of this subtitle, the Attorney General may bring a civil action in an
appropriate district court of the United States to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="id1FF4591F220F450C8F29FF7703BAE6D0"><enum>(A)</enum><text display-inline="yes-display-inline">enjoin such act or practice;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id52FF5E73741A489DBC2C21E7408DA4BA"><enum>(B)</enum><text display-inline="yes-display-inline">enforce compliance with this subtitle;
and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id1587C48F4BA94DF7861F3373DCD95DD5"><enum>(C)</enum><text display-inline="yes-display-inline">obtain damages—</text>
<clause commented="no" display-inline="no-display-inline" id="id253613DA247249889432B79E474C9A1D"><enum>(i)</enum><text display-inline="yes-display-inline">in the sum of actual damages, restitution,
and other compensation on behalf of the affected residents of a State;
and</text>
</clause><clause commented="no" display-inline="no-display-inline" id="id13B11E0C2AD64531A2689C73A0217FEA"><enum>(ii)</enum><text display-inline="yes-display-inline">punitive damages, if the violation is
willful or intentional; and</text>
</clause></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idC32FE5FDB69E4281B1742B43B3AB4240"><enum>(D)</enum><text display-inline="yes-display-inline">obtain such other relief as the court
determines to be appropriate.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="id9E188A106BB1457ABCAD1623E374A5EE"><enum>(2)</enum><header>Other
injunctive relief</header><text display-inline="yes-display-inline">Upon a
proper showing in the action under paragraph (1), the court shall grant a
permanent injunction or a temporary restraining order without bond.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="ID02ae805648c1498aa9217e9c46961734"><enum>(c)</enum><header>State
enforcement</header>
<paragraph commented="no" display-inline="no-display-inline" id="IDcf8362cefa0749f092bfca6cd2cac173"><enum>(1)</enum><header>Civil
actions</header><text display-inline="yes-display-inline">In any case in which
the attorney general of a State has reason to believe that an interest of the
residents of that State has been or is threatened or adversely affected by an
act or practice that violates this subtitle, the State may bring a civil action
on behalf of the residents of that State in a district court of the United
States of appropriate jurisdiction, or any other court of competent
jurisdiction, to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="ID4d964a8ec1454cdf955afa68ee93fe07"><enum>(A)</enum><text display-inline="yes-display-inline">enjoin that act or practice;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID902912db88b141b89b1a1bb628b47f4f"><enum>(B)</enum><text display-inline="yes-display-inline">enforce compliance with this
subtitle;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idECE71A3FEF1149FA94203C71C4BA4CC8"><enum>(C)</enum><text display-inline="yes-display-inline">obtain—</text>
<clause commented="no" display-inline="no-display-inline" id="idC7DDE671A91A4F08B9F372DFEAEBFA91"><enum>(i)</enum><text display-inline="yes-display-inline">damages in the sum of actual damages,
restitution, or other compensation on behalf of affected residents of the
State; and</text>
</clause><clause commented="no" display-inline="no-display-inline" id="idAD988127897E44E798DCAAE4E6518683"><enum>(ii)</enum><text display-inline="yes-display-inline">punitive damages, if the violation is
willful or intentional; or</text>
</clause></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID01102203db0243c380b92d246b38e184"><enum>(D)</enum><text display-inline="yes-display-inline">obtain such other legal and equitable
relief as the court may consider to be appropriate.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="id29B0311AB47C4376B82A3C836644EB1F"><enum>(2)</enum><header>Notice</header>
<subparagraph commented="no" display-inline="no-display-inline" id="id48D1A18D322546F2B726468DC24666C4"><enum>(A)</enum><header>In
general</header><text display-inline="yes-display-inline">Before filing an
action under this subsection, the attorney general of the State involved shall
provide to the Attorney General—</text>
<clause commented="no" display-inline="no-display-inline" id="id4C2709A4996041DD83EF31944B2810B0"><enum>(i)</enum><text display-inline="yes-display-inline">a written notice of that action; and</text>
</clause><clause commented="no" display-inline="no-display-inline" id="id19B08F4BE71048E0962A3C91CB418632"><enum>(ii)</enum><text display-inline="yes-display-inline">a copy of the complaint for that
action.</text>
</clause></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idDE1817B880884A7E99989EC835121847"><enum>(B)</enum><header>Exception</header><text display-inline="yes-display-inline">Subparagraph (A) shall not apply with
respect to the filing of an action by an attorney general of a State under this
subsection, if the attorney general of a State determines that it is not
feasible to provide the notice described in this subparagraph before the filing
of the action.</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idF7D51ADFC8B1449CB90A506DA78B7242"><enum>(C)</enum><header>Notification
when practicable</header><text display-inline="yes-display-inline">In an action
described under subparagraph (B), the attorney general of a State shall provide
the written notice and the copy of the complaint to the Attorney General as
soon after the filing of the complaint as practicable.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="idAF8580F1441E4E1ABA6C7AE3D21FBD8A"><enum>(3)</enum><header>Attorney
General authority</header><text display-inline="yes-display-inline">Upon
receiving notice under paragraph (2), the Attorney General shall have the right
to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="idAD9B19B4C54247F8A80BB470F81C0644"><enum>(A)</enum><text display-inline="yes-display-inline">move to stay the action, pending the final
disposition of a pending Federal proceeding or action as described in paragraph
(4);</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idE3BCB8F9FDB24A6688DA592526102BE2"><enum>(B)</enum><text display-inline="yes-display-inline">intervene in an action brought under
paragraph (1); and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idD675AD00EB0F4687B3FD6C4FF4E073A7"><enum>(C)</enum><text display-inline="yes-display-inline">file petitions for appeal.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="idEF955D595846479196A8C8D5D13CF829"><enum>(4)</enum><header>Pending
proceedings</header><text display-inline="yes-display-inline">If the Attorney
General has instituted a proceeding or action for a violation of this Act or
any regulations thereunder, no attorney general of a State may, during the
pendency of such proceeding or action, bring an action under this subsection
against any defendant named in such criminal proceeding or civil action for any
violation that is alleged in that proceeding or action.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDca36c4de516f4ef183e4087cd213d56f"><enum>(5)</enum><header>Rule of
construction</header><text display-inline="yes-display-inline">For purposes of
bringing any civil action under paragraph (1) nothing in this Act shall be
construed to prevent an attorney general of a State from exercising the powers
conferred on the attorney general by the laws of that State to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="idE6EB0346347B42FAA53C4F9E512D7F3B"><enum>(A)</enum><text display-inline="yes-display-inline">conduct investigations;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idDCF233C5DA1C4F9B91E07073922AC6A9"><enum>(B)</enum><text display-inline="yes-display-inline">administer oaths and affirmations;
or</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idF2314C1DD1354FF5A76704299B66EB51"><enum>(C)</enum><text display-inline="yes-display-inline">compel the attendance of witnesses or the
production of documentary and other evidence.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="idD69D960D6D304009962C6D0179D26383"><enum>(6)</enum><header>Venue; service
of process</header>
<subparagraph commented="no" display-inline="no-display-inline" id="idFED206234C5C4FF8BD84F81608B7C4C1"><enum>(A)</enum><header>Venue</header><text display-inline="yes-display-inline">Any action brought under this subsection
may be brought in the district court of the United States that meets applicable
requirements relating to venue under section 1931 of title 28, United States
Code.</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idE29174FEEA054F8C822CF1137E752FAC"><enum>(B)</enum><header>Service of
process</header><text display-inline="yes-display-inline">In an action brought
under this subsection process may be served in any district in which the
defendant—</text>
<clause commented="no" display-inline="no-display-inline" id="id5F4847EADB1E4A30A59F6A66A91D8F0D"><enum>(i)</enum><text display-inline="yes-display-inline">is an inhabitant; or</text>
</clause><clause commented="no" display-inline="no-display-inline" id="id2917C7D674944A908C1D92A458E4A44B"><enum>(ii)</enum><text display-inline="yes-display-inline">may be found.</text>
</clause></subparagraph></paragraph></subsection></section><section commented="no" display-inline="no-display-inline" id="idF8813A768CEC49BE96DBFF58E67BCD25" section-type="subsequent-section"><enum>404.</enum><header>Relation to State
laws</header>
<subsection commented="no" display-inline="no-display-inline" id="idCAF5576AAAF942B59807FA98559E7D01"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">Except as provided in
subsection (b), this title does not annul, alter, affect, or exempt any person
subject to the provisions of this title from complying with the laws of any
State with respect to security programs for personally identifiable
information, except to the extent that those laws are inconsistent with any
provisions of this title, and then only to the extent of such
inconsistency.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="id604A4A699BD941F7A1F5E6A0CCCF9F89"><enum>(b)</enum><header>Exceptions</header><text display-inline="yes-display-inline">No requirement or prohibition may be
imposed under the laws of any State with respect to any subject matter
regulated under section 401(c), relating to entities exempted from compliance
with subtitle A.</text>
</subsection></section></subtitle><subtitle commented="no" id="id297E7488A241413A9052B7A86EF17F4A" style="OLC"><enum>B</enum><header>Security breach notification</header>
<section commented="no" display-inline="no-display-inline" id="ID881d7c39760845feb410427d37e47437" section-type="subsequent-section"><enum>421.</enum><header>Right to notice of
security breach</header>
<subsection commented="no" display-inline="no-display-inline" id="ID1824000472f6444596615e6a01d13edf"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">Unless delayed under
section 422(d) or exempted under section 424, any business entity or agency
engaged in interstate commerce that involves collecting, accessing, using,
transmitting, storing, or disposing of personally identifiable information
shall notify, following the discovery of a security breach of its systems or
databases in its possession or direct control when such security breach impacts
sensitive personally identifiable information—</text>
<paragraph commented="no" display-inline="no-display-inline" id="ID1b81a57be30a4eeca626e1fcba98ca2f"><enum>(1)</enum><text display-inline="yes-display-inline">if the security breach impacts more than
10,000 individuals nationwide, impacts a database, networked or integrated
databases, or other data system associated with more than 1,000,000 individuals
nationwide, impacts databases owned or used by the Federal Government, or
involves sensitive personally identifiable information of employees and
contractors of the Federal Government—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="id1D4BD05800384259ABFEB398D8DA291A"><enum>(A)</enum><text display-inline="yes-display-inline">the United States Secret Service, which
shall be responsible for notifying——</text>
<clause commented="no" display-inline="no-display-inline" id="id881FE155E4C245EAA2B9EF1AFDE19909"><enum>(i)</enum><text display-inline="yes-display-inline">the Federal Bureau of Investigation, if the
security breach involves espionage, foreign counterintelligence, information
protected against unauthorized disclosure for reasons of national defense or
foreign relations, or Restricted Data (as that term is defined in section 11y
of the Atomic Energy Act of 1954 (42 U.S.C. 2014(y)), except for offenses
affecting the duties of the United States Secret Service under section 3056(a)
of title 18, United States Code; and</text>
</clause><clause commented="no" display-inline="no-display-inline" id="idBA5A6F06AB0E445596A6A8FD53A834CE"><enum>(ii)</enum><text display-inline="yes-display-inline">the United States Postal Inspection
Service, if the security breach involves mail fraud; and</text>
</clause></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idE954AFDF71FD4DD391CD5F0925B6ACCA"><enum>(B)</enum><text display-inline="yes-display-inline">the attorney general of each State affected
by the security breach;</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID32455824e99444a68a6f2c10102cba24"><enum>(2)</enum><text display-inline="yes-display-inline">each consumer reporting agency described in
section 603(p) of the Fair Credit Reporting Act (15 U.S.C. 1681a), pursuant to
subsection (b); and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID6578367a17ea4b26a5da2d39a3922457"><enum>(3)</enum><text display-inline="yes-display-inline">any resident of the United States whose
sensitive personally identifiable information was subject to the security
breach, pursuant to sections 422 and 423, but in the event a business entity or
agency is unable to identify the specific residents of the United States whose
sensitive personally identifiable information was impacted by a security
breach, the business entity or agency shall consult with the United States
Secret Service to determine the scope of individuals who there is a reasonable
basis to conclude have been impacted by such breach and should receive
notice.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="ID353c8091eac84c05b3abdb21b515376f"><enum>(b)</enum><header>Consumer
reporting agencies</header><text display-inline="yes-display-inline">Any
business entity or agency obligated to provide notice of a security breach to
more than 1,000 residents of the United States under subsection (a)(3) shall
inform consumer reporting agencies of the fact and scope of such notices for
the purpose of facilitating and managing potential increases in consumer
inquiries and mitigating identity theft or other negative consequences of the
breach.</text>
</subsection></section><section commented="no" display-inline="no-display-inline" id="ID1f8b88d6d7d5422c9d80f517c537b6c2" section-type="subsequent-section"><enum>422.</enum><header>Notice
procedures</header>
<subsection commented="no" display-inline="no-display-inline" id="ID6c695a27def54f8ea3dff75880d3411c"><enum>(a)</enum><header>Timeliness of
notice</header>
<paragraph commented="no" display-inline="no-display-inline" id="idDB20BC058CAD45388BEF9B1538D9D67A"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">Except as provided in
subsection (c), all notices required under section 421 shall be issued
expeditiously and without unreasonable delay after discovery of the events
requiring notice.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="idD71FD854793242A4A71A477F4EB878B8"><enum>(2)</enum><header>14-day
rule</header><text display-inline="yes-display-inline">The notices to Federal
law enforcement and the attorney general of each State affected by a security
breach required under section 421(a) shall be delivered not later than 14 days
after discovery of the events requiring notice.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id2948A5524CD94730A820C88BC35C2920"><enum>(3)</enum><header>Required
disclosure</header><text display-inline="yes-display-inline">In complying with
the notices required under section 421, a business entity or agency shall
expeditiously and without unreasonable delay take reasonable measures which are
necessary to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="idF1F85CA6032A4979BD1A3FC547899B91"><enum>(A)</enum><text display-inline="yes-display-inline">determine the scope and assess the impact
of a breach under section 421; and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id1048477AC03345A38C54E3A86148F3C1"><enum>(B)</enum><text display-inline="yes-display-inline">restore the reasonable integrity of the
data system.</text>
</subparagraph></paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="IDdd9921b9cf614e4c98e11bc4d8de57a3"><enum>(b)</enum><header>Method</header><text display-inline="yes-display-inline">Any business entity or agency obligated to
provide notice under section 421 shall be in compliance with that section if
they provide notice as follows:</text>
<paragraph commented="no" display-inline="no-display-inline" id="ID31c408d2a32142db8ed3d67e1e1803ed"><enum>(1)</enum><header>written
notification</header><text display-inline="yes-display-inline">By written
notification to the last known home address of the individual whose sensitive
personally identifiable information was breached, or if unknown, notification
via telephone call to the last known home telephone number.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID25b3fd2e772e43ae8f3749140ad5d66f"><enum>(2)</enum><header>internet
posting</header><text display-inline="yes-display-inline">If more than 1,000
residents of the United States require notice under section 421 and if the
business entity or agency maintains an Internet site, conspicuous posting of
the notice on the Internet site of the business entity or agency.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID0b8bd341f653493990fbe6d9898ebd0f"><enum>(3)</enum><header>media
notice</header><text display-inline="yes-display-inline">If more than 5,000
residents of a State or jurisdiction are impacted, notice to major media
outlets serving that State or jurisdiction.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="ID2125c0e742bf489f8a66865cb9ad16f5"><enum>(c)</enum><header>Delay of
notification for law enforcement purposes</header>
<paragraph commented="no" display-inline="no-display-inline" id="ID3d0cf47f6d4a43e093a3f5854d8e1694"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">If Federal law
enforcement or the attorney general of a State determines that the notices
required under section 421(a) would impede a criminal investigation, such
notices may be delayed until such law enforcement agency determines that the
notices will no longer compromise such investigation.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id42E15E0984E8470DB0823E344C2CA653"><enum>(2)</enum><header>Extended delay
of notification for law enforcement purposes</header><text display-inline="yes-display-inline">If a business entity or agency has delayed
the notices required under paragraphs (2) and (3) of section 421(a) as
described in paragraph (1), the business entity or agency shall give notice 30
days after the day such law enforcement delay was invoked unless Federal law
enforcement provides written notification that further delay is
necessary.</text>
</paragraph></subsection></section><section commented="no" display-inline="no-display-inline" id="ID8bb093e0c48e439299159f2b8130ded1" section-type="subsequent-section"><enum>423.</enum><header>Content of
notice</header>
<subsection commented="no" display-inline="no-display-inline" id="IDc70593a702484076ac395c010b86d9e0"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">A business entity or
agency obligated to provide notice to residents of the United States under
section 421(a)(3) shall clearly and concisely detail the nature of the
sensitive personally identifiable information impacted by the security
breach.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="ID00dc7439494f4f7da1426f35440af060"><enum>(b)</enum><header>Content of
notice</header><text display-inline="yes-display-inline">A notice under
subsection (a) shall include—</text>
<paragraph commented="no" display-inline="no-display-inline" id="ID8a07f5568dc94258859cb544a141d892"><enum>(1)</enum><text display-inline="yes-display-inline">the availability of victim protection
assistance pursuant to section 425;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDf0591ccb8f2f46b9a97edbd6301c6b9c"><enum>(2)</enum><text display-inline="yes-display-inline">guidance on how to request that a fraud
alert be placed in the file of the individual maintained by consumer reporting
agencies, pursuant to section 605A of the Fair Credit Reporting Act (15 U.S.C.
1681c–1) and the implications of such actions;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDb65adef8d1c64388ab3342b986bac5ef"><enum>(3)</enum><text display-inline="yes-display-inline">the availability of a summary of rights for
identity theft victims from consumer reporting agencies, pursuant to section
609 of the Fair Credit Reporting Act (15 U.S.C. 1681g);</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="idDF5D417861B248F3AC22CABD84236D7E"><enum>(4)</enum><text display-inline="yes-display-inline">if applicable, notice that the State where
an individual resides has a statute that provides the individual the right to
place a security freeze on their credit report; and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDeca08c6df7ff4e179dee06eeb4c2dc24"><enum>(5)</enum><text display-inline="yes-display-inline">if applicable, notice that consumer
reporting agencies have been notified of the security breach.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="idEBCE71F0B8CF4AC7AD66BB69C5486DFA"><enum>(c)</enum><header>Marketing not
allowed in notice</header><text display-inline="yes-display-inline">A notice
under subsection (a) may not include—</text>
<paragraph commented="no" display-inline="no-display-inline" id="idB87B6D5D1E7E4FBD98ADED5397ECC460"><enum>(1)</enum><text display-inline="yes-display-inline">marketing information;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id8EE2C9167E284788A123EF46223C1BDF"><enum>(2)</enum><text display-inline="yes-display-inline">sales offers; or</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id803DC4388098482BA780C6BD204CF7D3"><enum>(3)</enum><text display-inline="yes-display-inline">any solicitation regarding the collection
of additional personally identifiable information from an individual.</text>
</paragraph></subsection></section><section commented="no" display-inline="no-display-inline" id="ID21f0f97210d54a64aa30e340cc2683a1" section-type="subsequent-section"><enum>424.</enum><header>Risk assessment and
fraud prevention notice exemptions</header>
<subsection commented="no" display-inline="no-display-inline" id="IDf97ab0947f1c4db486e5f8e0d877508d"><enum>(a)</enum><header>Risk assessment
exemption</header><text display-inline="yes-display-inline">A business entity
will be exempt from the notice requirements under paragraphs (2) and (3) of
section 421(a), if a risk assessment conducted in consultation with Federal law
enforcement and the attorney general of each State affected by a security
breach concludes that there is a de minimis risk of harm to the individuals
whose sensitive personally identifiable information was at issue in the
security breach.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="ID6a5f039b165d4caca9288ce88abc1790"><enum>(b)</enum><header>Fraud
prevention exemption</header><text display-inline="yes-display-inline">A
business entity will be exempt from the notice requirement under section 421(a)
if—</text>
<paragraph commented="no" display-inline="no-display-inline" id="ID44354f1b5325419d8095c6635b60245a"><enum>(1)</enum><text display-inline="yes-display-inline">the nature of the sensitive personally
identifiable information subject to the security breach cannot be used to
facilitate transactions or facilitate identity theft to further transactions
with another business entity that is not the business entity subject to the
security breach notification requirements of section 421;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id0E2D0DB5860044638CD592B48BAD2DF5"><enum>(2)</enum><text display-inline="yes-display-inline">the business entity utilizes a security
program reasonably designed to block the use of the sensitive personally
identifiable information to initiate unauthorized transactions before they are
charged to the account of the individual; and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDedf6fb4e0a2a459096cd63bd3b1f3822"><enum>(3)</enum><text display-inline="yes-display-inline">the business entity has a policy in place
to provide notice and provides such notice after a breach of the security of
the system has resulted in fraud or unauthorized transactions, but does not
necessarily require notice in other circumstances.</text>
</paragraph></subsection></section><section commented="no" display-inline="no-display-inline" id="ID5e84cff2cb524b8096106533476327b6" section-type="subsequent-section"><enum>425.</enum><header>Victim protection
assistance</header>
<subsection commented="no" display-inline="no-display-inline" id="ID675a97deb3994e75a89bbccea111fdc0"><enum></enum><text display-inline="yes-display-inline">Any business entity or agency obligated to
provide notice to residents of the United States under section 421(a)(3) shall
offer to those same residents to cover the cost of—</text>
<paragraph commented="no" display-inline="no-display-inline" id="ID6514f1c72199465494d6895e5312b196"><enum>(1)</enum><text display-inline="yes-display-inline">monthly access to a credit report for a
period of 1 year from the date of notice provided under section 421(a)(3);
and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID0c81814435b84534b6bc7198240d303e"><enum>(2)</enum><text display-inline="yes-display-inline">credit-monitoring services for up to 1 year
from the date of notice provided under section 421(a)(3).</text>
</paragraph></subsection></section><section commented="no" display-inline="no-display-inline" id="IDfa073e895b624d1c845687d16b987e34" section-type="subsequent-section"><enum>426.</enum><header>Enforcement</header>
<subsection commented="no" display-inline="no-display-inline" id="IDcd402a4374d34d14b3194812dd6248b5"><enum>(a)</enum><header>Civil
penalties</header>
<paragraph commented="no" display-inline="no-display-inline" id="idE0BCABFBEE814C56B0302860C0208992"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">Any business entity
that violates the provisions of sections 421 through 425 shall be subject to
civil penalties of not more than $5,000 per violation per day, with a maximum
of $55,000 per day, while such violations persist.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDdb1b872af303459bbb5f6dcfa9464316"><enum>(2)</enum><header>Intentional or
willful violation</header><text display-inline="yes-display-inline">A business
entity that intentionally or willfully violates the provisions of sections 421
through 425 shall be subject to additional penalties in the amount of $5,000
per violation per day, with a maximum of an additional $55,000 per day, while
such violations persist.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id0D05C049CECD49598AC15B93DAB9DCDD"><enum>(3)</enum><header>Equitable
relief</header><text display-inline="yes-display-inline">A business entity
engaged in interstate commerce that violates this section may be enjoined from
further violations by a court of competent jurisdiction.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID9ba5597d8fa447beb9e41261ebb665a9"><enum>(4)</enum><header>Other rights
and remedies</header><text display-inline="yes-display-inline">The rights and
remedies available under this section are cumulative and shall not affect any
other rights and remedies available under law.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="ID9d78515cc1524dfa99044e7e4eb5758c"><enum>(b)</enum><header>Injunctive
actions by the attorney general</header>
<paragraph commented="no" display-inline="no-display-inline" id="id9EFC6224B5724ED381CB356533EC3122"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">Whenever it appears
that a business entity or agency to which this subtitle applies has engaged, is
engaged, or is about to engage, in any act or practice constituting a violation
of this subtitle, the Attorney General may bring a civil action in an
appropriate district court of the United States to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="ID4e7bebb28e134bd085a0b3ef637d4e95"><enum>(A)</enum><text display-inline="yes-display-inline">enjoin such act or practice;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="IDec87efdfc5ea4110ab8918712a7187c7"><enum>(B)</enum><text display-inline="yes-display-inline">enforce compliance with this subtitle;
and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID7a0f0d4a15054535ba872358655fd3c5"><enum>(C)</enum><text display-inline="yes-display-inline">obtain damages—</text>
<clause commented="no" display-inline="no-display-inline" id="ID29b4c01c4e8042a78c6b846f5db38e84"><enum>(i)</enum><text display-inline="yes-display-inline">in the sum of actual damages, restitution,
and other compensation on behalf of the affected residents of a State;
and</text>
</clause><clause commented="no" display-inline="no-display-inline" id="ID7d3fa14c9b6949d2b7fd5de416f2f38f"><enum>(ii)</enum><text display-inline="yes-display-inline">punitive damages, if the violation is
willful or intentional; and</text>
</clause></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID8709b760732f4012898197f427378910"><enum>(D)</enum><text display-inline="yes-display-inline">obtain such other relief as the court
determines to be appropriate.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID89db09fefeea420fbb9aefd1e55e5422"><enum>(2)</enum><header>Other
injunctive relief</header><text display-inline="yes-display-inline">Upon a
proper showing in the action under paragraph (1), the court shall grant a
permanent injunction or a temporary restraining order without bond.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="IDbf5514d44c524f8688f9c49cc1629e37"><enum>(c)</enum><header>State
enforcement</header>
<paragraph commented="no" display-inline="no-display-inline" id="ID4120971861f740cc80b11a5f114c304d"><enum>(1)</enum><header>Civil
actions</header><text display-inline="yes-display-inline">In any case in which
the attorney general of a State has reason to believe that an interest of the
residents of that State has been, or is threatened to be, adversely affected by
a violation of this subtitle, the State, as parens patriae, may bring a civil
action on behalf of the residents of that State in a district court of the
United States of appropriate jurisdiction, or any other court of competent
jurisdiction, to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="IDa3ec9182d1854c4483d8665b9f305016"><enum>(A)</enum><text display-inline="yes-display-inline">enjoin that practice;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID90af7fdc81d74c4fa998651e1d4531d1"><enum>(B)</enum><text display-inline="yes-display-inline">enforce compliance with this
subtitle;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="IDe65a149f2f284439afd4660b32e4fb7a"><enum>(C)</enum><text display-inline="yes-display-inline">obtain damages—</text>
<clause commented="no" display-inline="no-display-inline" id="ID406d6e2df74142db9ad9436c0d47f716"><enum>(i)</enum><text display-inline="yes-display-inline">in the sum of actual damages, restitution,
and other compensation on behalf of the affected residents of that State;
and</text>
</clause><clause commented="no" display-inline="no-display-inline" id="ID8858153cc39148f5bea2ce71a0d99023"><enum>(ii)</enum><text display-inline="yes-display-inline">punitive damages, if the violation is
willful or intentional; and</text>
</clause></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID0d7e8c6a58f64be0a17ac57f4dc069ed"><enum>(D)</enum><text display-inline="yes-display-inline">obtain such other equitable relief as the
court may consider to be appropriate.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID27e6fba3c13841db929fcfbd89b19d9a"><enum>(2)</enum><header>Notice</header>
<subparagraph commented="no" display-inline="no-display-inline" id="ID0aff04d8c79a4fcb992163b47f438cd0"><enum>(A)</enum><header>In
general</header><text display-inline="yes-display-inline">Before filing an
action under paragraph (1), the attorney general of the State involved shall
provide to the Attorney General—</text>
<clause commented="no" display-inline="no-display-inline" id="IDe61f14dc1b6845c595b1fad4500edc4d"><enum>(i)</enum><text display-inline="yes-display-inline">written notice of the action; and</text>
</clause><clause commented="no" display-inline="no-display-inline" id="IDbee1bb6229194bbe84fc605004951791"><enum>(ii)</enum><text display-inline="yes-display-inline">a copy of the complaint for the
action.</text>
</clause></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID35a8d5943e97455baad86d626cab47fd"><enum>(B)</enum><header>Exception</header>
<clause commented="no" display-inline="no-display-inline" id="IDaaf8b070785b4105b3d456a115683792"><enum>(i)</enum><header>In
general</header><text display-inline="yes-display-inline">Subparagraph (A)
shall not apply with respect to the filing of an action by an attorney general
of a State under this subsection, if the attorney general of a State determines
that it is not feasible to provide the notice described in such subparagraph
before the filing of the action.</text>
</clause><clause commented="no" display-inline="no-display-inline" id="ID44a4c80fe8184bbab12bdea1c666f008"><enum>(ii)</enum><header>Notification
when practicable</header><text display-inline="yes-display-inline">In an action
described in clause (i), the attorney general of a State shall provide notice
and a copy of the complaint to the Attorney General at the time the attorney
general of a State files the action.</text>
</clause></subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="id57FAA0D7B5314234A6DFBD4E6DA9B2F2"><enum>(3)</enum><header>Attorney
General authority</header><text display-inline="yes-display-inline">Upon
receiving notice under paragraph (2), the Attorney General shall have the right
to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="id6DAEDE1FA45A4ECDABCFCB730FC275FF"><enum>(A)</enum><text display-inline="yes-display-inline">move to stay the action, pending the final
disposition of a pending Federal proceeding or action as described in paragraph
(4);</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idE59F6F37433D41C7AFC68F356D824925"><enum>(B)</enum><text display-inline="yes-display-inline">intervene in an action brought under
paragraph (1); and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idDA564DD8BAE44820904DC0C63C286061"><enum>(C)</enum><text display-inline="yes-display-inline">file petitions for appeal.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="idA23B2FEA0E084B6093CA8B1C2E553449"><enum>(4)</enum><header>Pending
proceedings</header><text display-inline="yes-display-inline">If the Attorney
General has instituted a proceeding or action for a violation of this Act or
any regulations thereunder, no attorney general of a State may, during the
pendency of such proceeding or action, bring an action under this subsection
against any defendant named in such criminal proceeding or civil action for any
violation that is alleged in that proceeding or action.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDa96a5948776f4632b405acca192f5aeb"><enum>(5)</enum><header>Rule of
construction</header><text display-inline="yes-display-inline">For purposes of
bringing any civil action under paragraph (1), nothing in this subsection shall
be construed to prevent an attorney general of a State from exercising the
powers conferred on such attorney general by the laws of that State to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="IDf4775dbbd2f24b0e80c6fff155730944"><enum>(A)</enum><text display-inline="yes-display-inline">conduct investigations;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="IDff5eda5f98324d7cba1236e26cb68648"><enum>(B)</enum><text display-inline="yes-display-inline">administer oaths or affirmations; or</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID49ea68d6f4f2471891cb9e2641decf73"><enum>(C)</enum><text display-inline="yes-display-inline">compel the attendance of witnesses or the
production of documentary and other evidence.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID2126a541b51d427886472825e8af60ad"><enum>(6)</enum><header>Venue; service
of process</header>
<subparagraph commented="no" display-inline="no-display-inline" id="ID4e39acbf395a4a4abb715a657f6236dc"><enum>(A)</enum><header>Venue</header><text display-inline="yes-display-inline">Any action brought under this subsection
may be brought in the district court of the United States that meets applicable
requirements relating to venue under section 1391 of title 28, United States
Code.</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID3d97df0d3d1c4b33adde739ad9b9a55e"><enum>(B)</enum><header>Service of
process</header><text display-inline="yes-display-inline">In an action brought
under this subsection process may be served in any district in which the
defendant—</text>
<clause commented="no" display-inline="no-display-inline" id="ID0f5c4bc16a944c1c907f84a0501ffa99"><enum>(i)</enum><text display-inline="yes-display-inline">is an inhabitant; or</text>
</clause><clause commented="no" display-inline="no-display-inline" id="ID99806f83b6764c68881dda9834703697"><enum>(ii)</enum><text display-inline="yes-display-inline">may be found.</text>
</clause></subparagraph></paragraph></subsection></section><section commented="no" display-inline="no-display-inline" id="idF7552D432E724836A338BE914198F9A1" section-type="subsequent-section"><enum>427.</enum><header>Relation to State
laws</header>
<subsection commented="no" display-inline="no-display-inline" id="id57149451E75C45F8908ACBE4097EE2ED"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">Except as provided in
subsection (b), this title does not annul, alter, affect, or exempt any person
subject to the provisions of this title from complying with the laws of any
State with respect to protecting consumers from the risk of theft or misuse of
personally identifiable information, except to the extent that those laws are
inconsistent with any provisions of this title, and then only to the extent of
such inconsistency.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="id53DBFB20F460480F894A598051F69957"><enum>(b)</enum><header>Exceptions</header><text display-inline="yes-display-inline">No requirement or prohibition may be
imposed under the laws of any State with respect to any subject matter
regulated under—</text>
<paragraph commented="no" display-inline="no-display-inline" id="id58370888144C4A32A3D05D8E24708321"><enum>(1)</enum><text display-inline="yes-display-inline">section 3(9), relating to the definition of
<quote>security breach</quote>;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="idFCB64C2434E4465094E0AD2DEB5FD239"><enum>(2)</enum><text display-inline="yes-display-inline">paragraphs (1)(A), (2), and (3) of
subsection (a), and subsection (b) of section 421, relating to the right to
notice of security breach;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="idFA7870F1386E4A3B87FD27FFFBECC85A"><enum>(3)</enum><text display-inline="yes-display-inline">section 422, relating to notice
procedures;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id966AA22041054989A6B574352B7EE005"><enum>(4)</enum><text display-inline="yes-display-inline">section 423, relating to notice content,
except that nothing in this section shall prevent a State from requiring notice
of additional victim protection assistance by that State; and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id6D24C2AEDF9240AAAA2B92FF91D5B81E"><enum>(5)</enum><text display-inline="yes-display-inline">section 424, relating to risk assessment
and fraud prevention notice exemptions.</text>
</paragraph></subsection></section><section commented="no" display-inline="no-display-inline" id="ID79f8d201021e47d7ab34968591c22936" section-type="subsequent-section"><enum>428.</enum><header>Study on securing
personally identifiable information in the digital era</header>
<subsection commented="no" display-inline="no-display-inline" id="ID3467a0e67a5a4263b90082e5fe939dc9"><enum>(a)</enum><header>Requirement for
study</header><text display-inline="yes-display-inline">Not later than 120 days
after the date of enactment of this Act, the Department of Justice shall enter
into a contract with the National Research Council of the National Academies to
conduct a study on securing personally identifiable information in the digital
era.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="ID560ef4ee1f2d452c904d1af5763bd2e1"><enum>(b)</enum><header>Matters to be
assessed in review</header><text display-inline="yes-display-inline">The study
required under subsection (a) shall include—</text>
<paragraph commented="no" display-inline="no-display-inline" id="id35D2CBE04531414A9506515CD43E9372"><enum>(1)</enum><text display-inline="yes-display-inline">threats to the public posed by the
unauthorized or improper disclosure of personally identifiable information,
including threats to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="id548DD555836D4ED8A3FDCCCFECC09B2D"><enum>(A)</enum><text display-inline="yes-display-inline">law enforcement;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id123631E1681248A5BF0FA9117676D1DD"><enum>(B)</enum><text display-inline="yes-display-inline">homeland security;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id7D80027DD88440F2935EF9E45678E87B"><enum>(C)</enum><text display-inline="yes-display-inline">individual citizens; and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id1AB0521E1A2A4E5EA3E8EDB77F4AEA21"><enum>(D)</enum><text display-inline="yes-display-inline">commerce;</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="id14E23DBD891D4D9DB9D39705F990C9FB"><enum>(2)</enum><text display-inline="yes-display-inline">an assessment of the benefits and costs of
currently available strategies for securing personally identifiable information
based on—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="id379CB31C25894AFE9EFFB1E6E98B5A9C"><enum>(A)</enum><text display-inline="yes-display-inline">technology;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idE5C7317E04C8432F824AB3D31A749624"><enum>(B)</enum><text display-inline="yes-display-inline">legislation;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idEA3904B907C34D0B8445F40980A85EBF"><enum>(C)</enum><text display-inline="yes-display-inline">regulation; or</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id88CF3F163E5344B681CC0872B6A5185B"><enum>(D)</enum><text display-inline="yes-display-inline">public education;</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="idFFD64A5ACBBC4D6A8F7F11E87AD58A18"><enum>(3)</enum><text display-inline="yes-display-inline">research needed to develop additional
strategies;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id598710584A7842D0B2E76DF8FA86DDFC"><enum>(4)</enum><text display-inline="yes-display-inline">recommendations for congressional or other
policy actions to further minimize vulnerabilities to the threats described in
paragraph (1); and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="idCCD3F49218A04BF98864F2A2AE3D61B4"><enum>(5)</enum><text display-inline="yes-display-inline">other relevant issues that in the
discretion of the National Research Council warrant examination.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="id8C26B4F45EAD4878BE46B6797FC44149"><enum>(c)</enum><header>Time line for
study and requirement for report</header><text display-inline="yes-display-inline">Not later than 18-month period beginning
upon completion of the performance of the contract described in subsection (a),
the National Research Council shall conduct the study and report its findings,
conclusions, and recommendations to Congress.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="ID4b8c352309d349bbae41e3a11f3011b4"><enum>(d)</enum><header>Federal
department and agency compliance</header><text display-inline="yes-display-inline">Federal departments and agencies shall
comply with requests made by the National Science Foundation, National Research
Council, and National Academies for information that is necessary to assist in
preparing the report required by subsection (c).</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="ID6cb178b49aaf43e89143f35c505c3deb"><enum>(e)</enum><header>Authorization
of appropriations</header><text display-inline="yes-display-inline">Of the
amounts authorized to be appropriated to the Department of Justice for
Department-wide activities, $850,000 shall be made available to carry out the
provisions of this section for fiscal year 2006.</text>
</subsection></section><section commented="no" display-inline="no-display-inline" id="id730468FE5A494F288D068BED2F217BB0" section-type="subsequent-section"><enum>429.</enum><header>Authorization of
appropriations</header><text display-inline="no-display-inline">There is
authorized to be appropriated such sums as may be necessary to cover the costs
incurred by the United States Secret Service to carry out investigations and
risk assessments of security breaches as required under this subtitle.</text>
</section><section commented="no" display-inline="no-display-inline" id="IDf0cdf31330284ff0950a385b84be4de8" section-type="subsequent-section"><enum>430.</enum><header>Effective
date</header><text display-inline="no-display-inline">This subtitle shall take
effect 90 days after the date of enactment of this Act.</text>
</section></subtitle><enum>V</enum><header>Protection of Social Security
numbers</header>
<section commented="no" display-inline="no-display-inline" id="id2376031B6E614EFCAD819D1E3CA81E7E" section-type="subsequent-section"><enum>501.</enum><header>Social Security
number protection</header>
<subsection commented="no" display-inline="no-display-inline" id="ID438bef9362b24a41ba67d5b674164d3a"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">No person may—</text>
<paragraph commented="no" display-inline="no-display-inline" id="ID9cddad2602684e909e4ace257c105eff"><enum>(1)</enum><text display-inline="yes-display-inline">display any individual’s social security
number to a third party without the voluntary and affirmatively expressed
consent of such individual; or</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID49c88e421b4f48d8aac1c7cf43073838"><enum>(2)</enum><text display-inline="yes-display-inline">sell or purchase any social security number
of an individual without the voluntary and affirmatively expressed consent of
such individual.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="ID66cef57c83144af0aaf60ea76da23000"><enum>(b)</enum><header>Prerequisites
for consent</header><text display-inline="yes-display-inline">To obtain the
consent of an individual under paragraphs (1) or (2) of subsection (a), the
person displaying, selling, or attempting to sell, purchasing, or attempting to
purchase the social security number of such individual shall—</text>
<paragraph commented="no" display-inline="no-display-inline" id="ID477d55f86d934a1385a96ab32ca88eb2"><enum>(1)</enum><text display-inline="yes-display-inline">inform such individual of the general
purpose for which the social security number will be used, the types of persons
to whom the social security number may be available, and the scope of
transactions permitted by the consent; and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDd0af465d561942bbb8f56feedb53c491"><enum>(2)</enum><text display-inline="yes-display-inline">obtain the affirmatively expressed consent
(electronically or in writing) of such individual.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="idD841D529723646FAA46AE4A999FA133E"><enum>(c)</enum><header>Harvested
social security numbers</header><text display-inline="yes-display-inline">Subsection (a) shall apply to any public
record of a Federal agency that contains social security numbers extracted from
other public records for the purpose of displaying or selling such numbers to
the general public.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="ID076ba642cb344ed190666bf4a766a1ff"><enum>(d)</enum><header>Exceptions</header><text display-inline="yes-display-inline">Nothing in this section shall be construed
to prohibit or limit the display, sale, or purchase of a social security
number—</text>
<paragraph commented="no" display-inline="no-display-inline" id="ID65e6305b16a5405cba5c1b9577144e97"><enum>(1)</enum><text display-inline="yes-display-inline">as required, authorized, or excepted under
Federal law;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID11d4badbf4fd41e3979067e2dd5ec753"><enum>(2)</enum><text display-inline="yes-display-inline">to the extent necessary for a public health
purpose, including the protection of the health or safety of an individual in
an emergency situation;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDb1b0b7cd65544a358d995055e88eea66"><enum>(3)</enum><text display-inline="yes-display-inline">to the extent necessary for a national
security purpose;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID9e0238e656a849899b997dcb3ef75749"><enum>(4)</enum><text display-inline="yes-display-inline">to the extent necessary for a law
enforcement purpose, including the investigation of fraud and the enforcement
of a child support obligation;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID1f649952bd43455d93534fcd47d69ae2"><enum>(5)</enum><text display-inline="yes-display-inline">to the extent necessary for research
conducted for the purpose of advancing public knowledge, on the condition that
the researcher provides adequate assurances that—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="IDc9c19f70bf1143e38c31d5214ecb5783"><enum>(A)</enum><text display-inline="yes-display-inline">the social security numbers will not be
used to harass, target, or publicly reveal information concerning any
individual;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="IDeba29f6f2d4b4f1daf4e27dce1bad27c"><enum>(B)</enum><text display-inline="yes-display-inline">information about individuals obtained from
the research will not be used to make decisions that directly affect the
rights, benefits, or privileges of specific individuals; and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID66267769a8524fee947170d4da2e301e"><enum>(C)</enum><text display-inline="yes-display-inline">the researcher has in place appropriate
safeguards to protect the privacy and confidentiality of any information about
individuals;</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID3ea0c146ac5744e980c6a5691acb8575"><enum>(6)</enum><text display-inline="yes-display-inline">if such a number is required to be
submitted as part of the process for applying for any type of Federal, State,
or local government benefit or program;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID253b4f6f03b04ab5a804e4ec2b4d33ed"><enum>(7)</enum><text display-inline="yes-display-inline">when the transmission of the number is
incidental to, and in the course of, the sale, lease, franchising, or merger of
all or a portion of a business; or</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id7ACBCCE12DB14811A26835FE2D1575B7"><enum>(8)</enum><text display-inline="yes-display-inline">to the extent only the last 4 digits of a
social security number are displayed.</text>
</paragraph></subsection></section><section commented="no" display-inline="no-display-inline" id="id7FD7F07997F44A349C9D52B7303375FF" section-type="subsequent-section"><enum>502.</enum><header>Limits on personal
disclosure of social security numbers for commercial transactions and
accounts</header>
<subsection commented="no" display-inline="no-display-inline" id="idAAB4931496B34408883CA4120CCE4A1C"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">Part A of title XI of
the Social Security Act (42 U.S.C. 1301 et seq.) is amended by adding the
following:</text>
<quoted-block display-inline="no-display-inline" id="idF23D455ED3BF4DB8BF4B845E381B62B9" style="OLC">
<section commented="no" display-inline="no-display-inline" id="idEECB4051B0064BDFAA149BDD427BC7F3" section-type="subsequent-section"><enum>1150A.</enum><header>Limits on personal
disclosure of social security numbers for commercial transactions and
accounts</header>
<subsection commented="no" display-inline="no-display-inline" id="idD6E1D48E034146E18DDFF9F098906940"><enum>(a)</enum><header>Account
numbers</header>
<paragraph commented="no" display-inline="no-display-inline" id="id2E409EA089C1483D8981C559E4F9165C"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">A business entity may
not—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="idE5130AED3BE64476B760ECB881585956"><enum>(A)</enum><text display-inline="yes-display-inline">require an individual to use the social
security number of such individual as an account number or account identifier
when purchasing a commercial good or service; or</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idA07782E1A8CC4C2DA12F46A08A1AADB4"><enum>(B)</enum><text display-inline="yes-display-inline">deny an individual goods or services for
refusing to accept the use of the social security number of such individual as
an account number or account identifier.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="idBD490FF833E04A5B8972659828F05065"><enum>(2)</enum><header>Existing
account exception</header><text display-inline="yes-display-inline">Paragraph
(1) shall not apply to any account number or account identifier established
prior to the date of enactment of this Act.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="idCC7B54B0739A4F4882452C66A25A460E"><enum>(b)</enum><header>Social security
number prerequisites for goods and services</header><text display-inline="yes-display-inline">A business entity may not require an
individual to provide the social security number of such individual when
purchasing a commercial good or service or deny an individual goods or services
for refusing to provide that number except for any purpose relating to—</text>
<paragraph commented="no" display-inline="no-display-inline" id="id5DC3860D0BD745CCBC4185FC1FC58A70"><enum>(1)</enum><text display-inline="yes-display-inline">obtaining a consumer report for any purpose
permitted under the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.);</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="idC08549D62204467F83CB614E1FC81B1B"><enum>(2)</enum><text display-inline="yes-display-inline">a background check of the individual
conducted by a landlord, lessor, employer, or voluntary service agency;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id167B6E97A67C44228A5CA0E8862F6B9E"><enum>(3)</enum><text display-inline="yes-display-inline">law enforcement; or</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id00F6370E39204D8E991FE9ABBC7A30E5"><enum>(4)</enum><text display-inline="yes-display-inline">a Federal, State, or local law
requirement.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="id10EABFD81651429BAB39A144107CF740"><enum>(c)</enum><header>Application of
civil money penalties</header><text display-inline="yes-display-inline">A
violation of this section shall be deemed to be a violation of section
1129(a).</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="id5B26880616E34350A171588243D0ABA7"><enum>(d)</enum><header>Application of
criminal penalties</header><text display-inline="yes-display-inline">A
violation of this section shall be deemed to be a violation of section
208(a)(8).</text>
</subsection></section><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection></section><section commented="no" display-inline="no-display-inline" id="id3820820B21274BF1BD1C0E395EFDB0EB" section-type="subsequent-section"><enum>503.</enum><header>Public
records</header>
<subsection commented="no" display-inline="no-display-inline" id="id4CDF5B3DCA804C6DB04AD45B5373B00C"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">Except as provided in
paragraph (2), paragraphs (a) and (b) of section 501 shall apply to all public
records posted on the Internet or provided in an electronic medium by, or on
behalf of, a Federal agency.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="ID901f3b0b4cf4479dacda5fec4a842588"><enum>(b)</enum><header>Exceptions</header>
<paragraph commented="no" display-inline="no-display-inline" id="idB3CA6D4F31134144B5016697C9FB4B06"><enum>(1)</enum><header>Truncation and
prior displays</header><text display-inline="yes-display-inline">Section 501(a)
shall not apply to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="id23D5B18CA4434199B61431BA8068D884"><enum>(A)</enum><text display-inline="yes-display-inline">a public record which displays only the
last 4 digits of the social security number of an individual; and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id6D87C75C9DA2448E95C9F7F9D0A2BEAE"><enum>(B)</enum><text display-inline="yes-display-inline">any record or a category of public records
first posted on the Internet or provided in an electronic medium by, or on
behalf of, a Federal agency prior to the date of enactment of this Act.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="id1C6AF1C88C3D4B1EAF0862F7A9B44321"><enum>(2)</enum><header>Law
enforcement</header><text display-inline="yes-display-inline">Nothing in this
subsection shall be construed to prevent an entity acting pursuant to a police
investigation or regulatory power of a domestic governmental unit from
accessing the full social security number of an individual.</text>
</paragraph></subsection></section><section commented="no" display-inline="no-display-inline" id="id71B42D9E73BD437BA83CE602103A16D7" section-type="subsequent-section"><enum>504.</enum><header>Treatment of social
security numbers on government checks and prohibition of inmate access</header>
<subsection commented="no" display-inline="no-display-inline" id="IDdee9afcc6a2749bf8abe3d4011e9ee79"><enum>(a)</enum><header>Prohibition of
use of social security numbers on checks issued for payment by governmental
entities</header>
<paragraph commented="no" display-inline="no-display-inline" id="IDec65660cae194233b70f911194cb5187"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">Section 205(c)(2)(C)
of the Social Security Act (42 U.S.C. 405(c)(2)(C)) is amended by adding at the
end the following:</text>
<quoted-block display-inline="no-display-inline" id="idF81F00FFA9B24EEBA6E33EB29EF5DA88" style="OLC">
<clause commented="no" display-inline="no-display-inline" id="IDb9f84963fb9148fca9b8e38f7a83405a" indent="up2"><enum>(x)</enum><text display-inline="yes-display-inline">No
Federal, State, or local agency may display the social security account number
of any individual, or any derivative of such number, on any check issued for
any payment by the Federal, State, or local
agency.</text>
</clause><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID12d386e0bfad4672a391baaf138c87d7"><enum>(2)</enum><header>Effective
date</header><text display-inline="yes-display-inline">The amendment made under
paragraph (1) shall apply with respect to checks issued after the date that is
3 years after the date of enactment of this Act.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="ID7d4312d285b44937a70aca2c44c5f4c5"><enum>(b)</enum><header>Prohibition on
inmate access to social security numbers</header>
<paragraph commented="no" display-inline="no-display-inline" id="ID689dc8c0697040e6a2a34396f81df0ed"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">Section 205(c)(2)(C)
of the Social Security Act (42 U.S.C. 405(c)(2)(C)), as amended by subsection
(b), is further amended by adding at the end the following:</text>
<quoted-block display-inline="no-display-inline" id="id000A5469CF3B4F2B9B6396B1D7EA6985" style="OLC">
<clause commented="no" display-inline="no-display-inline" id="ID9eb5d3d1fc18492c936666312bcb6e38" indent="up2"><enum>(xi)</enum><subclause commented="no" display-inline="yes-display-inline" id="id1FD0C2F718CB4072B5D5A2EDFF98BA03"><enum>(I)</enum><text display-inline="yes-display-inline">No Federal, State, or local agency may
employ, or enter into a contract for the use or employment of, prisoners in any
capacity that would allow such prisoners access to the social security account
numbers of other individuals.</text>
</subclause><subclause commented="no" display-inline="no-display-inline" id="id61AAB2F7552945389007E7B7A1BB84A8" indent="up1"><enum>(II)</enum><text display-inline="yes-display-inline">For purposes of this clause, the term
<term>prisoner</term> means an individual confined in a jail, prison, or other
penal institution or correctional facility pursuant to conviction of such
individual of a criminal
offense.</text>
</subclause></clause><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="idA7094D5D1D04479C9512559542F9BA38"><enum>(2)</enum><header>Effective
date</header><text display-inline="yes-display-inline">The amendment made under
paragraph (1) shall apply with respect to employment of prisoners, or entry
into contract with prisoners, after the date that is 1 year after the date of
enactment of this Act.</text>
</paragraph></subsection></section><section commented="no" display-inline="no-display-inline" id="IDaaaeccb3738f47529f8b7ff9bf93df4a" section-type="subsequent-section"><enum>505.</enum><header>Study and
report</header>
<subsection commented="no" display-inline="no-display-inline" id="ID9e5a4c36c9f849e195801f2bd0b5d3cd"><enum>(a)</enum><header>By the
Comptroller General</header><text display-inline="yes-display-inline">The
Comptroller General of the United States (in this section referred to as the
<quote>Comptroller General</quote>) shall conduct a study and prepare a report
on—</text>
<paragraph commented="no" display-inline="no-display-inline" id="idB8235D6478314AB7955BF8BA38AB9585"><enum>(1)</enum><text display-inline="yes-display-inline">all of the uses of social security numbers
permitted, required, authorized, or excepted under any Federal law; and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="idC6234704F8DB449BBD7006478D9924B1"><enum>(2)</enum><text display-inline="yes-display-inline">the uses of social security numbers in
Federal, State, and local public records.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="id608BB69BCAB945A7B349A1AD89C88CF4"><enum>(b)</enum><header>Content of
report</header><text display-inline="yes-display-inline">The report required
under subsection (a) shall—</text>
<paragraph commented="no" display-inline="no-display-inline" id="id834CFB95DDC1468EA53CF4E3C8009E27"><enum>(1)</enum><text display-inline="yes-display-inline">identify users of social security numbers
under Federal law;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id03C8FD6F23E04242AFF622FF6A97DD96"><enum>(2)</enum><text display-inline="yes-display-inline">include a detailed description of the uses
allowed as of the date of enactment of this Act;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id48673CC36267482C8E517FB474B88612"><enum>(3)</enum><text display-inline="yes-display-inline">describe the impact of such uses on privacy
and data security;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id20E753A413864EB3A282A7E933E97A1C"><enum>(4)</enum><text display-inline="yes-display-inline">evaluate whether such uses should be
continued or discontinued by appropriate legislative action;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id22AA4DF9500943A6BD46BFDAB98AFDC2"><enum>(5)</enum><text display-inline="yes-display-inline">examine whether States are complying with
prohibitions on the display and use of social security numbers—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="id52C8C26595A94DB9BB64B6581B6AE0B5"><enum>(A)</enum><text display-inline="yes-display-inline">under the Privacy Act of 1974 (5 U.S.C.
552a et seq.); and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idBEB104618B034D0FB4380B8C292B673B"><enum>(B)</enum><text display-inline="yes-display-inline">the Driver's Privacy Protection Act of 1994
(18 U.S.C. 2721 et seq.);</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="idB09820E0BEB84225918EFE86605481A1"><enum>(6)</enum><text display-inline="yes-display-inline">include a review of the uses of social
security numbers in Federal, State, or local public records;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="idF8A7BB241E844D24A2A199A7B16F9276"><enum>(7)</enum><text display-inline="yes-display-inline">include a review of the manner in which
public records are stored (with separate reviews for both paper records and
electronic records);</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id663EBC54FEBD468DAD66EF95A9190131"><enum>(8)</enum><text display-inline="yes-display-inline">include a review of the advantages,
utility, and disadvantages of public records that contain social security
numbers, including—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="idBF02840CDC674D40A2931C10E75307A9"><enum>(A)</enum><text display-inline="yes-display-inline">impact on law enforcement;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id919780DAFD754EEB89112DCD2EF9B1B4"><enum>(B)</enum><text display-inline="yes-display-inline">threats to homeland security; and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id5BDB7B94E0684B1F90B9031AA2AD7FBD"><enum>(C)</enum><text display-inline="yes-display-inline">impact on personal privacy and
security;</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="idB7C73291F4844904864BF35A30CEFE18"><enum>(9)</enum><text display-inline="yes-display-inline">include an assessment of the costs and
benefits to State and local governments of truncating, redacting, or removing
social security numbers from public records, including a review of current
technologies and procedures for truncating, redacting, or removing social
security numbers from public records (with separate assessments for both paper
and electronic records);</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="idDF9B059A6A484DAF8E83E673F6BD94AA"><enum>(10)</enum><text display-inline="yes-display-inline">include an assessment of the benefits and
costs to businesses, non-profit organizations, and the general public of
requiring truncation, redaction, or removal of social security numbers on
public records (with separate assessments for both paper and electronic
records);</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id973D5AD7D63E43F29C876AD002F3A1D0"><enum>(11)</enum><text display-inline="yes-display-inline">include an assessment of Federal and State
requirements to truncate social security numbers, and issue recommendations
on—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="idEDF87E490E93430E96272D2B198A5484"><enum>(A)</enum><text display-inline="yes-display-inline">how to harmonize those requirements;
and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id51574501BDEC4A7D8EC32E304C028F3C"><enum>(B)</enum><text display-inline="yes-display-inline">whether to further extend truncation
requirements, taking into consideration the impact on accuracy and use;</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="idDB92372028C74F01A726E68CD4632800"><enum>(12)</enum><text display-inline="yes-display-inline">include recommendations regarding whether
subsection (a) should apply to any record or category of public records first
posted on the Internet or provided in an electronic medium by, or on behalf of,
a Federal agency prior to the date of enactment of this Act; and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id4DC12DF52EC0461BAA0883878FB6080E"><enum>(13)</enum><text display-inline="yes-display-inline">include such recommendations for
legislation based on criteria the Comptroller General determines to be
appropriate.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="idA5E4B6CF9C364C8EA17C3FB5CCD94A55"><enum>(c)</enum><header>Required
consultation</header><text display-inline="yes-display-inline">In developing
the report required under this subsection, the Comptroller General shall
consult with—</text>
<paragraph commented="no" display-inline="no-display-inline" id="id7A723C9994A14EA2817BE78788A69E32"><enum>(1)</enum><text display-inline="yes-display-inline">the Administrative Office of the United
States Courts;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="idDBA6BD16717E4B038F270361497B20DE"><enum>(2)</enum><text display-inline="yes-display-inline">the Conference of State Court
Administrators;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id5D8AB5CB56C9485E9ADD9938DBC5CF37"><enum>(3)</enum><text display-inline="yes-display-inline">the Department of Justice;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id9841B73A9395403BB62A4E5E00CA3083"><enum>(4)</enum><text display-inline="yes-display-inline">the Department of Homeland Security;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id4D25660FFD5D48CFABDF12622E4DDB4D"><enum>(5)</enum><text display-inline="yes-display-inline">the Social Security Administration;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="idF32E8D38E6D64CF6A0238BB73F8B1CA8"><enum>(6)</enum><text display-inline="yes-display-inline">Sate and local governments that store,
maintain, or disseminate public records; and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="idC42FF8EFF7DE450CBF25F5C0943C0752"><enum>(7)</enum><text display-inline="yes-display-inline">other stakeholders, including members of
the private sector who routinely use public records that contain social
security numbers.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="ID1ac9269e216c42c8bdf4ff8e9324f4d1"><enum>(d)</enum><header>Timing of
report</header><text display-inline="yes-display-inline">Not later than 1 year
after the date of enactment of this Act, the Comptroller General shall report
to Congress its findings under this section.</text>
</subsection></section><section commented="no" display-inline="no-display-inline" id="ID46fb30269c4541a690c3aca4321259a1" section-type="subsequent-section"><enum>506.</enum><header>Enforcement</header>
<subsection commented="no" display-inline="no-display-inline" id="id147C2389E37942128DE0E1D13030D5BB"><enum>(a)</enum><header>Civil
penalties</header>
<paragraph commented="no" display-inline="no-display-inline" id="idA2BCBA53ED9948B9933CBC6FC17667FE"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">Any person that
violates the provisions of sections 501 or 502 shall be subject to civil
penalties of not more than $5,000 per violation per day, with a maximum of
$35,000 per day, while such violations persist.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id0841DA2F4EFB411CA4519C096265F6AA"><enum>(2)</enum><header>Intentional or
willful violation</header><text display-inline="yes-display-inline">Any person
who intentionally or willfully violates the provisions of sections 501 or 502
shall be subject to additional penalties in the amount of $5,000 per violation
per day, with a maximum of an additional $35,000 per day, while such violations
persist.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id77EA8C473E52429186B9D4F5493EC967"><enum>(3)</enum><header>Equitable
relief</header><text display-inline="yes-display-inline">Any person who engages
in interstate commerce that violates this section may be enjoined from further
violations by a court of competent jurisdiction.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="idFA6FB81386F247F8976D27D50FA0F6A3"><enum>(4)</enum><header>Other rights
and remedies</header><text display-inline="yes-display-inline">The rights and
remedies available under this section are cumulative and shall not affect any
other rights and remedies available under law</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="id3A4980AC6CD04794A0EEBD99A34A8E85"><enum>(b)</enum><header>Injunctive
actions by the Attorney General</header>
<paragraph commented="no" display-inline="no-display-inline" id="id2BB2C852FCEB4C90B692512731FA46B7"><enum>(1)</enum><header>In
general</header><text display-inline="yes-display-inline">Whenever it appears
that a person to which this title applies has engaged, is engaged, or is about
to engage, in any act or practice constituting a violation of this title, the
Attorney General may bring a civil action in an appropriate district court of
the United States to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="id72A6754AEF2448DBBE7DDFB989F9CF67"><enum>(A)</enum><text display-inline="yes-display-inline">enjoin such act or practice;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id94668D5B7CE74EEA8D93B7AC0CCB6CEF"><enum>(B)</enum><text display-inline="yes-display-inline">enforce compliance with this title;
and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idD26F6D3436284FD5844B72EF650C720B"><enum>(C)</enum><text display-inline="yes-display-inline">obtain damages—</text>
<clause commented="no" display-inline="no-display-inline" id="id78466AE0831E42E987B75A04F994522F"><enum>(i)</enum><text display-inline="yes-display-inline">in the sum of actual damages, restitution,
and other compensation on behalf of the affected residents of a State;
and</text>
</clause><clause commented="no" display-inline="no-display-inline" id="id62BAEC834E434A019907B6349C2176F2"><enum>(ii)</enum><text display-inline="yes-display-inline">punitive damages, if the violation is
willful or intentional; and</text>
</clause></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id6411056D0E4943889537383B0B0DA85E"><enum>(D)</enum><text display-inline="yes-display-inline">obtain such other relief as the court
determines to be appropriate.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="id476E7499A45A4399B8BB3F95468A505A"><enum>(2)</enum><header>Other
injunctive relief</header><text display-inline="yes-display-inline">Upon a
proper showing in the action under paragraph (1), the court shall grant a
permanent injunction or a temporary restraining order without bond.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="ID82e53eb2422a4b699e2d3c616d279245"><enum>(c)</enum><header>State
enforcement</header>
<paragraph commented="no" display-inline="no-display-inline" id="ID89c2615c57654d839cc58f4687b43966"><enum>(1)</enum><header>Civil
actions</header><text display-inline="yes-display-inline">In any case in which
the attorney general of a State has reason to believe that an interest of the
residents of that State has been or is threatened or adversely affected by an
act or practice that violates this section, the State may bring a civil action
on behalf of the residents of that State in a district court of the United
States of appropriate jurisdiction, or any other court of competent
jurisdiction, to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="IDff77c57ccaec468290284862ce63b59f"><enum>(A)</enum><text display-inline="yes-display-inline">enjoin that act or practice;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="IDedac41f14af946d0b0d82136c3ccbc0a"><enum>(B)</enum><text display-inline="yes-display-inline">enforce compliance with this Act;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="IDb7569bb42e924a8c875a4c612ac66e65"><enum>(C)</enum><text display-inline="yes-display-inline">obtain damages, restitution, or other
compensation on behalf of residents of that State; or</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID74e51bdbe17b46eb82d5bcfacce77eab"><enum>(D)</enum><text display-inline="yes-display-inline">obtain such other legal and equitable
relief as the court may consider to be appropriate.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="idCCBAC5227E33420F868D5537E3D1DBDF"><enum>(2)</enum><header>Notice</header>
<subparagraph commented="no" display-inline="no-display-inline" id="id0B56A87F9A9F4C2D96B08F19231A012D"><enum>(A)</enum><header>In
general</header><text display-inline="yes-display-inline">Before filing an
action under this subsection, the attorney general of the State involved shall
provide to the Attorney General—</text>
<clause commented="no" display-inline="no-display-inline" id="idABFCEB8541B447AD8710C59F29BB4251"><enum>(i)</enum><text display-inline="yes-display-inline">a written notice of that action; and</text>
</clause><clause commented="no" display-inline="no-display-inline" id="id48247385DE044E1A848B86FFACFCCAAD"><enum>(ii)</enum><text display-inline="yes-display-inline">a copy of the complaint for that
action.</text>
</clause></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id2A84444DEAD5481F872E4A887540FE34"><enum>(B)</enum><header>Exception</header><text display-inline="yes-display-inline">Subparagraph (A) shall not apply with
respect to the filing of an action by an attorney general of a State under this
subsection, if the attorney general of a State determines that it is not
feasible to provide the notice described in this subparagraph before the filing
of the action.</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id29BD41C363E6473FABA8E8A9961E302B"><enum>(C)</enum><header>Notification
when practicable</header><text display-inline="yes-display-inline">In an action
described under subparagraph (B), the attorney general of a State shall provide
the written notice and the copy of the complaint to the Attorney General as
soon after the filing of the complaint as practicable.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="id1E74109CA61C4EBBB067A37FC03883F8"><enum>(3)</enum><header>Attorney
General authority</header><text display-inline="yes-display-inline">Upon
receiving notice under paragraph (2), the Attorney General shall have the right
to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="idB6BD650999B847CC953B4B8D3214B1B2"><enum>(A)</enum><text display-inline="yes-display-inline">move to stay the action, pending the final
disposition of a pending Federal proceeding or action as described in paragraph
(4);</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id78982FD2471141F19515AA215C95F3E3"><enum>(B)</enum><text display-inline="yes-display-inline">intervene in an action brought under
paragraph (1); and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="idFEB9241CCB3E41E786624EAE9B97B564"><enum>(C)</enum><text display-inline="yes-display-inline">file petitions for appeal.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="idA5ECF9DCA79841EA9095C35E4F5B9212"><enum>(4)</enum><header>Pending
proceedings</header><text display-inline="yes-display-inline">If the Attorney
General has instituted a proceeding or action for a violation of this Act or
any regulations thereunder, no attorney general of a State may, during the
pendency of such proceeding or action, bring an action under this subsection
against any defendant named in such criminal proceeding or civil action for any
violation that is alleged in that proceeding or action.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID288616d8643c493fa2738176719d4e4b"><enum>(5)</enum><header>Rule of
construction</header><text display-inline="yes-display-inline">For purposes of
bringing any civil action under paragraph (1), nothing in this Act shall be
construed to prevent an attorney general of a State from exercising the powers
conferred on the attorney general by the laws of that State to—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="idFBC040AE524E4650A7FC75A5FF30C8CB"><enum>(A)</enum><text display-inline="yes-display-inline">conduct investigations;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id6D33D7E04D8A42F987DA78CB5271E07D"><enum>(B)</enum><text display-inline="yes-display-inline">administer oaths and affirmations;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id392FC37D0D18444B8B8B8774F638980D"><enum>(C)</enum><text display-inline="yes-display-inline">or compel the attendance of witnesses or
the production of documentary and other evidence.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="id00DC7632868241EBB39963B0F156F4D9"><enum>(6)</enum><header>Venue; service
of process</header>
<subparagraph commented="no" display-inline="no-display-inline" id="id95C5131A40B0401BBB039D7E62FB56BB"><enum>(A)</enum><header>Venue</header><text display-inline="yes-display-inline">Any action brought under this subsection
may be brought in the district court of the United States that meets applicable
requirements relating to venue under section 1391 of title 28, United States
Code.</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id66CA704A38854EEF97F76257E94FBD70"><enum>(B)</enum><header>Service of
process</header><text display-inline="yes-display-inline">In an action brought
under this subsection process may be served in any district in which the
defendant—</text>
<clause commented="no" display-inline="no-display-inline" id="idA30A732232FC4936A33FF28F0AE15F92"><enum>(i)</enum><text display-inline="yes-display-inline">is an inhabitant; or</text>
</clause><clause commented="no" display-inline="no-display-inline" id="id3161C7E6B69240E48E0555F62444934E"><enum>(ii)</enum><text display-inline="yes-display-inline">may be found.</text>
</clause></subparagraph></paragraph></subsection></section><section commented="no" display-inline="no-display-inline" id="idA1229850A6B9455EABB2A16EEFBA4E88" section-type="subsequent-section"><enum>507.</enum><header>Relation to State
laws</header>
<subsection commented="no" display-inline="no-display-inline" id="id695E9581289943F9BFE66AA061EB03FD"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">Except as provided in
subsection (b), this title does not annul, alter, affect, or exempt any person
subject to the provisions of this title from complying with the laws of any
State with respect to protecting and securing social security numbers, except
to the extent that those laws are inconsistent with any provisions of this
title, and then only to the extent of such inconsistency.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="id028608275DF64C6B87B28658F525660E"><enum>(b)</enum><header>Exceptions</header><text display-inline="yes-display-inline">No requirement or prohibition may be
imposed under the laws of any State with respect to any subject matter
regulated under—</text>
<paragraph commented="no" display-inline="no-display-inline" id="idB885B25D9869447EB193A1362E77EE31"><enum>(1)</enum><text display-inline="yes-display-inline">section 501(b), relating to prerequisites
for consent for the display, sale, or purchase of social security
numbers;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="idCA48CACC78B04FC2BCCD0705A178511B"><enum>(2)</enum><text display-inline="yes-display-inline">section 501(c), relating to harvesting of
social security numbers; and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="idCF8CEB095EA14E8E98DA904A829B3757"><enum>(3)</enum><text display-inline="yes-display-inline">section 504, relating to treatment of
social security numbers on government checks and prohibition of inmate
access.</text>
</paragraph></subsection></section><enum>VI</enum><header>Government access to and use of commercial
data</header>
<section commented="no" display-inline="no-display-inline" id="IDe80a8e1d714e420fa5bfe423fac8281f" section-type="subsequent-section"><enum>601.</enum><header>General Services
Administration review of contracts</header>
<subsection commented="no" display-inline="no-display-inline" id="id31E355AB3C8A4C5590951E8D83E46006"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">In considering
contract awards entered into after the date of enactment of this Act, the
Administrator of the General Services Administration shall evaluate—</text>
<paragraph commented="no" display-inline="no-display-inline" id="id5526F8A36E624BFC831393AB7DA51A49"><enum>(1)</enum><text display-inline="yes-display-inline">the program of a contractor to ensure the
privacy and security of data containing personally identifiable
information;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id75D17AC6F2FE43BC8BF9EA2A3B575CA7"><enum>(2)</enum><text display-inline="yes-display-inline">the compliance of a contractor with such
program;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id7ED942D2EF9048CE823A77B8CE0A1ED6"><enum>(3)</enum><text display-inline="yes-display-inline">the extent to which the databases and
systems containing personally identifiable information of a contractor have
been compromised by security breaches; and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="idD2FFC837446B4DC5B272880846E3B1B1"><enum>(4)</enum><text display-inline="yes-display-inline">the response by a contractor to such
breaches, including the efforts of a contractor to mitigate the impact of such
breaches.</text>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="id716228CED1E1428D8D45D7A77CD30C66"><enum>(b)</enum><header>Penalties</header><text display-inline="yes-display-inline">In awarding contracts for products or
services related to access, use, compilation, distribution, processing,
analyzing, or evaluating personally identifiable information, the Administrator
of the General Services Administration shall include the following:</text>
<paragraph commented="no" display-inline="no-display-inline" id="id4B6832D7FB4843E68198A9A706CDE409"><enum>(1)</enum><text display-inline="yes-display-inline">Monetary or other penalties—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="idD4A75D9460C1410588429BED0344DC89"><enum>(A)</enum><text display-inline="yes-display-inline">for failure to comply with subtitles A and
B of title IV of this Act;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id78EE99CC02B047C9B569309845324310"><enum>(B)</enum><text display-inline="yes-display-inline">if a contractor knows or has reason to know
that the personally identifiable information being provided is inaccurate, and
provides such inaccurate information; or</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id5C375AF0759545C2B9FD1240A01C2123"><enum>(C)</enum><text display-inline="yes-display-inline">if a contractor is notified by an
individual that the personally identifiable information being provided is
inaccurate and it is in fact inaccurate.</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="id68F49E72A7D84B6A840C9058AE80B627"><enum>(2)</enum><text display-inline="yes-display-inline">Accuracy update requirements that obligate
a contractor to provide notice to the Federal department or agency of any
changes or corrections to the personally identifiable information provided
under the contract.</text>
</paragraph></subsection></section><section commented="no" display-inline="no-display-inline" id="idCAE548F38BD64ECD90834972854E1CA7" section-type="subsequent-section"><enum>602.</enum><header>Requirement to audit
information security practices of contractors and third party business
entities</header><text display-inline="no-display-inline">Section 3544(b) of
title 44, United States Code, is amended—</text>
<paragraph commented="no" display-inline="no-display-inline" id="id047AD61C39814E87B85F9839DD319714"><enum>(1)</enum><text display-inline="yes-display-inline">in paragraph (7)(C)(iii), by striking
<quote>and</quote> after the semicolon;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id248F978EAA0F4799932E36AED53E3344"><enum>(2)</enum><text display-inline="yes-display-inline">in paragraph (8), by striking the period
and inserting <quote>; and</quote>; and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id73B06CE9592B4E5EB4DB00F63BEBEDA8"><enum>(3)</enum><text display-inline="yes-display-inline">by adding at the end the following:</text>
<quoted-block display-inline="no-display-inline" id="id25CA42715B7849D380103B47B8B85826" style="OLC">
<paragraph commented="no" display-inline="no-display-inline" id="id6C3EFD46AF144E249D8F30895F903D60"><enum>(9)</enum><text display-inline="yes-display-inline">procedures for evaluating and auditing the
information security practices of contractors or third party business entities
supporting the information systems or operations of the agency involving
personally identifiable information, and ensuring remedial action to address
any significant
deficiencies.</text>
</paragraph><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></section><section commented="no" display-inline="no-display-inline" id="idB8E458C334C14BAD80F90A39D0FCEDB0" section-type="subsequent-section"><enum>603.</enum><header>Privacy impact
assessment of government use of commercial information services containing
personally identifiable information</header>
<subsection commented="no" display-inline="no-display-inline" id="IDdd15a5bae993472488774147fe03b5af"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">Section 208(b)(1) of
the E-Government Act of 2002 (44 U.S.C. 3501 note) is amended—</text>
<paragraph commented="no" display-inline="no-display-inline" id="IDe08c5f85fc2448588ae55b8bb6b4ca47"><enum>(1)</enum><text display-inline="yes-display-inline">in subparagraph (A)(i), by striking
<quote>or</quote>; and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID52f5cb13d156463d9c7d5b1acd315f28"><enum>(2)</enum><text display-inline="yes-display-inline">in subparagraph (A)(ii), by striking the
period and inserting <quote>; or</quote>; and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="id34BA8988A9B44728872380BFB8E0DF66"><enum>(3)</enum><text display-inline="yes-display-inline">by inserting after clause (ii) the
following:</text>
<quoted-block display-inline="no-display-inline" id="idBFA518D784BD4645A1E1566B2823AFE2" style="OLC">
<clause commented="no" display-inline="no-display-inline" id="IDf1b36c5794af4ea3817657ffcf9d8fae"><enum>(iii)</enum><text display-inline="yes-display-inline">purchasing or subscribing for a fee to
personally identifiable information from a commercial entity (other than news
reporting or telephone
directories).</text>
</clause><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="ID87fa6d627664464db2dfe94405565b22"><enum>(b)</enum><header>Limitation</header><text display-inline="yes-display-inline">Notwithstanding any other provision of law,
commencing 60 days after the date of enactment of this Act, no Federal
department or agency may procure or access any commercially available database
consisting primarily of personally identifiable information concerning United
States persons (other than news reporting or telephone directories) unless the
head of such department or agency—</text>
<paragraph commented="no" display-inline="no-display-inline" id="IDcc11f04a4d544ac793bb6df8c65b15c2"><enum>(1)</enum><text display-inline="yes-display-inline">completes a privacy impact assessment under
section 208 of the E-Government Act of 2002 (44 U.S.C. 3501 note), which shall
include a description of—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="id7524FA8407684D61A29A82F009FAD24E"><enum>(A)</enum><text display-inline="yes-display-inline">such database;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id33E9B1B4DEC44916ABA9D6A8B08031EA"><enum>(B)</enum><text display-inline="yes-display-inline">the name of the commercial entity from whom
it is obtained; and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="id2459A77DF0694FCF8A93FB0ACB42E06D"><enum>(C)</enum><text display-inline="yes-display-inline">the amount of the contract for use;</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID2ce2424ed9144696b37b8fe1e83d4e0a"><enum>(2)</enum><text display-inline="yes-display-inline">adopts regulations that specify—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="IDfc56d79a542e47b3b38c993a9af70e0a"><enum>(A)</enum><text display-inline="yes-display-inline">the personnel permitted to access, analyze,
or otherwise use such databases;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="IDc4fd6f41f10a417681070223398dc79e"><enum>(B)</enum><text display-inline="yes-display-inline">standards governing the access analysis, or
use of such databases;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID1053bd46791e44c3b68d57d3f5f7b1d4"><enum>(C)</enum><text display-inline="yes-display-inline">any standards used to ensure that the
personally identifiable information accessed, analyzed, or used is the minimum
necessary to accomplish the intended legitimate purpose of the Federal
department or agency;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID7035425ef4714021972c2c269edd01dd"><enum>(D)</enum><text display-inline="yes-display-inline">standards limiting the retention and
redisclosure of personally identifiable information obtained from such
databases;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="IDb11b7b39a29d4a7c9d1a881bb1813db4"><enum>(E)</enum><text display-inline="yes-display-inline">procedures ensuring that such data meet
standards of accuracy, relevance, completeness, and timeliness;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="IDa2b7ad5e56f5428d8432d53c7b6f7df4"><enum>(F)</enum><text display-inline="yes-display-inline">the auditing and security measures to
protect against unauthorized access, analysis, use, or modification of data in
such databases;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID30ea156f3b5746c0b18347a284324ce7"><enum>(G)</enum><text display-inline="yes-display-inline">applicable mechanisms by which individuals
may secure timely redress for any adverse consequences wrongly incurred due to
the access, analysis, or use of such databases;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID0b3e488ad4454a4abd6b7e044f1a256d"><enum>(H)</enum><text display-inline="yes-display-inline">mechanisms, if any, for the enforcement and
independent oversight of existing or planned procedures, policies, or
guidelines; and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="IDf2a558a5f86945c9a399c70d5e14a0f9"><enum>(I)</enum><text display-inline="yes-display-inline">an outline of enforcement mechanisms for
accountability to protect individuals and the public against unlawful or
illegitimate access or use of databases; and</text>
</subparagraph></paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID4255f43d3e2842a988861bcc1a0d34f1"><enum>(3)</enum><text display-inline="yes-display-inline">incorporates into the contract or other
agreement with the commercial entity, provisions—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="ID44bcc37cc6fa4938b911bb5cf01d2237"><enum>(A)</enum><text display-inline="yes-display-inline">providing for penalties—</text>
<clause commented="no" display-inline="no-display-inline" id="IDcd07dec58cce44a8bda13a24aaf2c2a7"><enum>(i)</enum><text display-inline="yes-display-inline">if the entity knows or has reason to know
that the personally identifiable information being provided to the Federal
department or agency is inaccurate, and provides such inaccurate information;
or</text>
</clause><clause commented="no" display-inline="no-display-inline" id="IDaa00d924735449f48e000826f5511434"><enum>(ii)</enum><text display-inline="yes-display-inline">if the entity is notified by an individual
that the personally identifiable information being provided to the Federal
department or agency is inaccurate and it is in fact inaccurate; and</text>
</clause></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID536de15313dc44c8963428701fad6f7d"><enum>(B)</enum><text display-inline="yes-display-inline">requiring commercial entities to inform
Federal departments or agencies to which they sell, disclose, or provide access
to personally identifiable information of any changes or corrections to the
personally identifiable information.</text>
</subparagraph></paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="ID04a7ec6b958d43a0bc922ef1d6dc9f02"><enum>(c)</enum><header>Individual
screening programs</header><text display-inline="yes-display-inline">Notwithstanding any other provision of law,
commencing 60 days after the date of enactment of this Act, no Federal
department or agency may use commercial databases to implement an individual
screening program unless such program is—</text>
<paragraph commented="no" display-inline="no-display-inline" id="ID7b02ef246bf7466a80f09d6821d4518a"><enum>(1)</enum><text display-inline="yes-display-inline">congressionally authorized; and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDc3334f25e8554912b5a1966ad268ba95"><enum>(2)</enum><text display-inline="yes-display-inline">subject to regulations developed by notice
and comment that—</text>
<subparagraph commented="no" display-inline="no-display-inline" id="ID67290e377d73422cafbf3bae5d90d600"><enum>(A)</enum><text display-inline="yes-display-inline">establish a procedure to enable
individuals, who suffer an adverse consequence because the screening system
determined that they might pose a security threat, to appeal such determination
and correct information contained in the system;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID95b4e0af9da844f395e8f198f1f3afca"><enum>(B)</enum><text display-inline="yes-display-inline">ensure that Federal and commercial
databases that will be used to establish the identity of individuals or
otherwise make assessments of individuals under the system will not produce a
large number of false positives or unjustified adverse consequences;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="IDc4a4599409ae43da9e6e802f006e156c"><enum>(C)</enum><text display-inline="yes-display-inline">ensure the efficacy and accuracy of all of
the search tools that will be used and ensure that the department or agency can
make an accurate predictive assessment of those who may constitute a
threat;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID903fa7a4285546c184006f9d960cd215"><enum>(D)</enum><text display-inline="yes-display-inline">establish an internal oversight board to
oversee and monitor the manner in which the system is being implemented;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="IDbfcaacbe5e9e4347ac829301c6cd29cc"><enum>(E)</enum><text display-inline="yes-display-inline">establish sufficient operational safeguards
to reduce the opportunities for abuse;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID865c2af269a34783a0a16838456652e5"><enum>(F)</enum><text display-inline="yes-display-inline">implement substantial security measures to
protect the system from unauthorized access;</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID631d401e20724426b82200bb5c71b654"><enum>(G)</enum><text display-inline="yes-display-inline">adopt policies establishing the effective
oversight of the use and operation of the system; and</text>
</subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="ID982808f5f6e24affbefbc82e4c98f835"><enum>(H)</enum><text display-inline="yes-display-inline">ensure that there are no specific privacy
concerns with the technological architecture of the system.</text>
</subparagraph></paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="ID37a0a0125a3043cf82028bea0f86738c"><enum>(d)</enum><header>Study of
government use</header>
<paragraph commented="no" display-inline="no-display-inline" id="ID7f2dcf7bc65a45b6858a1b5eadeb451f"><enum>(1)</enum><header>Scope of
study</header><text display-inline="yes-display-inline">Not later than 180 days
after the date of enactment of this Act, the Comptroller General of the United
States shall conduct a study and audit and prepare a report on Federal agency
use of commercial databases, including the impact on privacy and security, and
the extent to which Federal contracts include sufficient provisions to ensure
privacy and security protections, and penalties for failures in privacy and
security practices.</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID95d5160629794417b05367480fc44571"><enum>(2)</enum><header>Report</header><text display-inline="yes-display-inline">A copy of the report required under
paragraph (1) shall be submitted to Congress.</text>
</paragraph></subsection></section><section commented="no" display-inline="no-display-inline" id="id1055A56CF08341A09FA12FC834F96E1F" section-type="subsequent-section"><enum>604.</enum><header>Implementation of
Chief Privacy Officer requirements</header>
<subsection commented="no" display-inline="no-display-inline" id="ID25d0e324e1cb4b128ea190112d4f8e37"><enum>(a)</enum><header>Designation of
the Chief Privacy Officer</header><text display-inline="yes-display-inline">Pursuant to the requirements under section
522 of the Transportation, Treasury, Independent Agencies, and General
Government Appropriations Act, 2005 (division H of Public Law 108–447; 118
Stat. 3199) that each agency designate a Chief Privacy Officer, the Department
of Justice shall implement such requirements by designating a department-wide
Chief Privacy Officer, whose primary role shall be to fulfill the duties and
responsibilities of Chief Privacy Officer and who shall report directly to the
Deputy Attorney General.</text>
</subsection><subsection commented="no" display-inline="no-display-inline" id="ID54cd683ee5f34dbc8db0aec728976302"><enum>(b)</enum><header>Duties and
responsibilities of Chief Privacy Officer</header><text display-inline="yes-display-inline">In addition to the duties and
responsibilities outlined under section 522 of the Transportation, Treasury,
Independent Agencies, and General Government Appropriations Act, 2005 (division
H of Public Law 108–447; 118 Stat. 3199), the Department of Justice Chief
Privacy Officer shall—</text>
<paragraph commented="no" display-inline="no-display-inline" id="ID895ef86d2ced48fab86dee6cbbf5a279"><enum>(1)</enum><text display-inline="yes-display-inline">oversee the Department of Justice’s
implementation of the requirements under section 603 to conduct privacy impact
assessments of the use of commercial data containing personally identifiable
information by the Department;</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="IDe3fe72c238144c03a12e73c352d4bfd3"><enum>(2)</enum><text display-inline="yes-display-inline">promote the use of law enforcement
technologies that sustain, rather than erode, privacy protections, and assure
that the implementation of such technologies relating to the use, collection,
and disclosure of personally identifiable information preserve the privacy and
security of such information; and</text>
</paragraph><paragraph commented="no" display-inline="no-display-inline" id="ID687c8749cffb40bbb96b92b562511dd1"><enum>(3)</enum><text display-inline="yes-display-inline">coordinate with the Privacy and Civil
Liberties Oversight Board, established in the Intelligence Reform and Terrorism
Prevention Act of 2004 (Public Law 108–458), in implementing paragraphs (1) and
(2) of this subsection.</text>
</paragraph></subsection></section>
July 1 (legislative
day, June 30), 2005
Read the second time and placed on the
calendar