Sec. 216. Notice to law enforcement
417 words·~2 min read·
/bill/113/s/1897/is/section-216·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Not later than 60 days after the date of enactment of this Act, the Secretary of Homeland Security shall designate a Federal Government entity to receive the notices required under section 212 and this section, and any other reports and information about information security incidents, threats, and vulnerabilities. The designated entity shall— be responsible for promptly providing the information that it receives to the United States Secret Service and the Federal Bureau of Investigation, and to the Federal Trade Commission for civil law enforcement purposes; and provide the information described in subparagraph
(A)as appropriate to other Federal agencies for law enforcement, national security, or data security purposes. Any business entity or agency shall notify the designated entity of the fact that a security breach has occurred if— the number of individuals whose sensitive personally identifying information was, or is reasonably believed to have been accessed or acquired by an unauthorized person exceeds 5,000; the security breach involves a database, networked or integrated databases, or other data system containing the sensitive personally identifiable information of more than 500,000 individuals nationwide; the security breach involves databases owned by the Federal Government; or the security breach involves primarily sensitive personally identifiable information of individuals known to the agency or business entity to be employees and contractors of the Federal Government involved in national security or law enforcement. Not later than 1 year after the date of the enactment of this Act, the Federal Trade Commission, in consultation with the Attorney General of the United States and the Secretary of Homeland Security, shall promulgate regulations under section 553 of title 5, United States Code, regarding the reports required under subsection (a). The Federal Trade Commission, in consultation with the Attorney General and the Secretary of Homeland Security, after notice and the opportunity for public comment, and in a manner consistent with this section, shall promulgate regulations, as necessary, under section 553 of title 5, United States Code, to adjust the thresholds for notice to law enforcement and national security authorities under subsection
(a)and to facilitate the purposes of this section. The notice required under subsection
(a)shall be provided as promptly as possible, but such notice must be provided either 72 hours before notice is provided to an individual pursuant to section 211, or not later than 10 days after the business entity or agency discovers the security breach or discovers that the nature of the security breach requires notice to law enforcement under this section, whichever occurs first.