[Congressional Record Volume 161, Number 154 (Wednesday, October 21, 2015)]
[Senate]
[Pages S7417-S7418]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

  SA 2733. Mr. BLUMENTHAL submitted an amendment intended to be 
proposed to amendment SA 2716 proposed by Mr. Burr (for himself and 
Mrs. Feinstein) to the bill S. 754, to improve cybersecurity in the 
United States through enhanced sharing of information about 
cybersecurity threats, and for other purposes; which was ordered to lie 
on the table; as follows:

       On page 48, between lines 6 and 7, insert the following:
       (c) Private Right of Action for Violations by Federal 
     Entities of Restrictions on Disclosure, Use, and Protection 
     of Voluntarily Shared Cyber Threat Indicators.--
       (1) In general.--If a department or agency of the Federal 
     Government knowingly or recklessly violates the requirements 
     of this Act with respect to the disclosure, use, or 
     protection of voluntarily shared cyber threat indicators, the 
     United States shall be liable to a person adversely affected 
     by such violation in an amount equal to the sum of--
       (A) the actual damages sustained by the person as a result 
     of the violation or $50,000, whichever is greater; and
       (B) the costs of the action together with reasonable 
     attorney fees as determined by the court.
       (2) Venue.--An action to enforce liability created under 
     this subsection may be brought in the district court of the 
     United States in--
       (A) the district in which the complainant resides;
       (B) the district in which the principal place of business 
     of the complainant is located;
       (C) the district in which the department or agency of the 
     Federal Government that disclosed the information is located; 
     or
       (D) the District of Columbia.
       (3) Statute of limitations.--No action shall lie under this 
     subsection unless such

[[Page S7418]]

     action is commenced not later than two years after the person 
     adversely affected by a violation described in paragraph (1) 
     first learns, or by which such person reasonably should have 
     learned, of the facts and circumstances giving rise to the 
     action.
                                 ______