Sec. 3. Notification of breach of security
3,004 words·~14 min read·
/bill/113/s/1976/is/section-3A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
A covered entity that owns or possesses data in electronic form containing personal information, following the discovery of a breach of security of the system maintained by the covered entity that contains such data, shall notify— each individual who is a citizen or resident of the United States and whose personal information was or is reasonably believed to have been acquired or accessed from the covered entity as a result of the breach of security; and the Commission, unless the covered entity has notified the designated entity under section 4.
In the event of a breach of security of a system maintained by a third-party entity that has been contracted to maintain or process data in electronic form containing personal information on behalf of any other covered entity who owns or possesses such data, the third-party entity shall notify the covered entity of the breach of security. Upon receiving notification from the third party entity, such covered entity shall provide the notification required under subsection (a). If a service provider becomes aware of a breach of security of data in electronic form containing personal information that is owned or possessed by another covered entity that connects to or uses a system or network provided by the service provider for the purpose of transmitting, routing, or providing intermediate or transient storage of such data, the service provider shall notify of the breach of security only the covered entity who initiated such connection, transmission, routing, or storage if such covered entity can be reasonably identified.
Upon receiving the notification from the service provider, the covered entity shall provide the notification required under subsection (a). If a covered entity is required to provide notification to more than 5,000 individuals under subsection (a)(1), the covered entity also shall notify each major credit reporting agency of the timing and distribution of the notices, except when the only personal information that is the subject of the breach of security is the individual’s first name or initial and last name, or address, or phone number, in combination with a credit or debit card number, and any required security code.
Such notice shall be given to each credit reporting agency without unreasonable delay and, if it will not delay notice to the affected individuals, prior to the distribution of notices to the affected individuals. Notification under subsection
(a)shall be made— not later than 30 days after the date of discovery of a breach of security; or as promptly as possible if the covered entity providing notice can show that providing notice within the timeframe under paragraph
(1)is not feasible due to circumstances necessary— to accurately identify affected consumers; to prevent further breach or unauthorized disclosures; or to reasonably restore the integrity of the data system. A covered entity shall be in compliance with the notification requirement under subsection (a)(1) if— the covered entity provides conspicuous and clearly identified notification— in writing; or by e-mail or other electronic means if— the covered entity's primary method of communication with the individual is by e-mail or such other electronic means; or the individual has consented to receive notification by e-mail or such other electronic means and such notification is provided in a manner that is consistent with the provisions permitting electronic transmission of notices under section 101 of the Electronic Signatures in Global and National Commerce Act ( 15 U.S.C. 7001 ); and the method of notification selected under clause
(i)can reasonably be expected to reach the intended individual. Each method of direct notification under subparagraph
(A)shall include— the date, estimated date, or estimated date range of the breach of security; a description of the personal information that was or is reasonably believed to have been acquired or accessed as a result of the breach of security; a telephone number that an individual can use at no cost to the individual to contact the covered entity to inquire about the breach of security or the information the covered entity maintained about that individual; notice that the individual may be entitled to consumer credit reports under subsection (e)(1); instructions how an individual can request consumer credit reports under subsection (e)(1); a telephone number, that an individual can use at no cost to the individual, and an address to contact each major credit reporting agency; and a telephone number, that an individual can use at no cost to the individual, and an Internet Web site address to obtain information regarding identity theft from the Commission. A covered entity required to provide notification to individuals under subsection (a)(1) may provide substitute notification instead of direct notification under paragraph (1)— if direct notification is not feasible due to lack of sufficient contact information for the individual required to be notified; or if the covered entity owns or possesses data in electronic form containing personal information of fewer than 10,000 individuals and direct notification is not feasible due to excessive cost to the covered entity required to provide such notification relative to the resources of such covered entity, as determined in accordance with the regulations issued by the Commission under paragraph (3)(A). Substitute notification under this paragraph shall include— conspicuous and clearly identified notification by e-mail to the extent the covered entity has an e-mail address for an individual who is entitled to notification under subsection (a)(1); conspicuous and clearly identified notification on the Internet Web site of the covered entity if the covered entity maintains an Internet Web site; and notification to print and to broadcast media, including major media in metropolitan and rural areas where the individuals whose personal information was acquired reside. Each method of substitute notification under this paragraph shall include— the date, estimated date, or estimated date range of the breach of security; a description of the types of personal information that were or are reasonably believed to have been acquired or accessed as a result of the breach of security; notice that an individual may be entitled to consumer credit reports under subsection (e)(1); instructions how an individual can request consumer credit reports under subsection (e)(1); a telephone number that an individual can use at no cost to the individual to learn whether the individual's personal information is included in the breach of security; a telephone number, that an individual can use at no cost to the individual, and an address to contact each major credit reporting agency; and a telephone number, that an individual can use at no cost to the individual, and an Internet Web site address to obtain information regarding identity theft from the Commission. Not later than 1 year after the date of enactment of this Act, the Commission, by regulation under section 553 of title 5, United States Code, shall establish criteria for determining circumstances under which substitute notification may be provided under section 3(d)(2) of this Act, including criteria for determining if direct notification under section 3(d)(1) of this Act is not feasible due to excessive costs to the covered entity required to provide such notification relative to the resources of such covered entity. The regulations may also identify other circumstances where substitute notification would be appropriate, including circumstances under which the cost of providing direct notification exceeds the benefits to consumers. In addition, the Commission, in consultation with the Small Business Administration, shall provide and publish general guidance with respect to compliance with this subsection. The guidance shall include— a description of written or e-mail notification that complies with paragraph (1); and guidance on the content of substitute notification under paragraph (2), including the extent of notification to print and broadcast media that complies with paragraph (2)(B)(iii). Not later than 60 days after the date of request by an individual who received notification under subsection (a)(1) and quarterly thereafter for 2 years, a covered entity required to provide notification under subsection (a)(1) shall provide, or arrange for the provision of, to the individual at no cost, consumer credit reports from at least 1 major credit reporting agency. This subsection shall not apply if the only personal information that is the subject of the breach of security is the individual's first name or initial and last name, or address, or phone number, in combination with a credit or debit card number, and any required security code. The Commission's rulemaking under subsection (d)(3) shall include— determination of the circumstances under which a covered entity required to provide notification under subsection (a)(1) must provide or arrange for the provision of free consumer credit reports; and establishment of a simple process under which a covered entity that is a small business or small non-profit organization may request a full or a partial waiver or a modified or an alternative means of complying with this subsection if providing free consumer credit reports is not feasible due to excessive costs relative to the resources of such covered entity and relative to the level of harm, to affected individuals, caused by the breach of security. If the United States Secret Service or the Federal Bureau of Investigation determines that notification under this section would impede a criminal investigation or a national security activity, notification shall be delayed upon written notice from the United States Secret Service or the Federal Bureau of Investigation to the covered entity that experienced the breach of security. Written notice from the United States Secret Service or the Federal Bureau of Investigation shall specify the period of delay requested for national security or law enforcement purposes. A covered entity shall provide notification under this section not later than 30 days after the day that the delay was invoked unless a Federal law enforcement or intelligence agency provides subsequent written notice to the covered entity that further delay is necessary. If the United States Secret Service instructs a covered entity to delay notification under this section beyond the 30-day period under subparagraph
(A)(referred to in this clause as subsequent delay ), the United States Secret Service shall submit written justification for the subsequent delay to the Secretary of Homeland Security before the subsequent delay begins. If the Federal Bureau of Investigation instructs a covered entity to delay notification under this section beyond the 30-day period under subparagraph
(A)(referred to in this clause as subsequent delay ), the Federal Bureau of Investigation shall submit written justification for the subsequent delay to the Attorney General before the subsequent delay begins. No cause of action shall lie in any court against any Federal agency for acts relating to the delay of notification for national security or law enforcement purposes under this Act. A covered entity shall be exempt from the requirements under this section if, following a breach of security, the covered entity reasonably concludes that there is no reasonable risk of identity theft, fraud, or other unlawful conduct. There shall be a presumption that no reasonable risk of identity theft, fraud, or other unlawful conduct exists following a breach of security if— the data is rendered unusable, unreadable, or indecipherable through a security technology or methodology; and the security technology or methodology under clause
(i)is generally accepted by experts in the information security field. The presumption under subparagraph
(A)may be rebutted by facts demonstrating that the security technology or methodology in a specific case has been or is reasonably likely to be compromised. Not later than 1 year after the date of enactment of this Act, and biennially thereafter, the Commission, after consultation with the National Institute of Standards and Technology, shall issue rules (pursuant to section 553 of title 5, United States Code) or guidance to identify each security technology and methodology under paragraph (2). In identifying each such security technology and methodology, the Commission and the National Institute of Standards and Technology shall— consult with relevant industries, consumer organizations, data security and identity theft prevention experts, and established standards setting bodies; and consider whether and in what circumstances a security technology or methodology currently in use, such as encryption, complies with the standards under paragraph (2). Not later than 1 year after the date of enactment of this Act, the Commission, after consultation with the National Institute of Standards and Technology, shall issue guidance regarding the application of the exemption under paragraph (1). A covered entity shall be exempt from the requirements under this section if— a determination is made— by the United States Secret Service or the Federal Bureau of Investigation that notification of the breach of security could be reasonably expected to reveal sensitive sources and methods or similarly impede the ability of the Government to conduct law enforcement or intelligence investigations; or by the Federal Bureau of Investigation that notification of the breach of security could be reasonably expected to cause damage to the national security; and the United States Secret Service or the Federal Bureau of Investigation, as the case may be, provides written notice of its determination under subparagraph
(A)to the covered entity. If the United States Secret Service invokes an exemption under paragraph (1), the United States Secret Service shall submit written justification for invoking the exemption to the Secretary of Homeland Security before the exemption is invoked. If the Federal Bureau of Investigation invokes an exemption under paragraph (1), the Federal Bureau of Investigation shall submit written justification for invoking the exemption to the Attorney General before the exemption is invoked. No cause of action shall lie in any court against any Federal agency for acts relating to the exemption from notification for national security or law enforcement purposes under this Act. Not later than 18 months after the date of enactment of this Act, and upon request by Congress thereafter, the United States Secret Service and Federal Bureau of Investigation shall submit to Congress a report on the number and nature of breaches of security subject to the exemptions for national security and law enforcement purposes under this subsection. A covered entity shall be exempt from the requirements under this section if the covered entity utilizes or participates in a security program that— effectively blocks the use of the personal information to initiate an unauthorized financial transaction before it is charged to the account of the individual; and provides notice to each affected individual after a breach of security that resulted in attempted fraud or an attempted unauthorized transaction. An exemption under paragraph
(1)shall not apply if— the breach of security includes personal information, other than a credit card number or credit card security code, of any type; or the breach of security includes both the individual’s credit card number and the individual’s first and last name. A covered financial institution shall be deemed in compliance with this section if— the Federal functional regulator with jurisdiction over the covered financial institution has issued a standard by regulation or guideline under title V of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6801 et seq. ) that— requires financial institutions within its jurisdiction to provide notification to individuals following a breach of security; and provides protections substantially similar to, or greater than, those required under this Act; and the covered financial institution is in compliance with the standard under subparagraph (A). In this subsection— the term covered financial institution means a financial institution that is subject to— the data security requirements of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6801 et seq. ); any implementing standard issued by regulation or guideline issued under that Act; and the jurisdiction of a Federal functional regulator under that Act; the term Federal functional regulator has the meaning given the term in section 509 of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6809 ); and the term financial institution has the meaning given the term in section 509 of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6809 ). To the extent that a covered entity under this Act acts as a covered entity or a business associate under section 13402 of the Health Information Technology for Economic and Clinical Health Act ( 42 U.S.C. 17932 ), has the obligation to provide notification to individuals following a breach of security under that Act or its implementing regulations, and is in compliance with that obligation, the covered entity shall be deemed in compliance with this section. To the extent that a covered entity under this Act acts as a vendor of personal health records, a third party service provider, or other entity subject to section 13407 of the Health Information Technology for Economical and Clinical Health Act ( 42 U.S.C. 17937 ), has the obligation to provide notification to individuals following a breach of security under that Act or its implementing regulations, and is in compliance with that obligation, the covered entity shall be deemed in compliance with this section. Nothing in this Act may be construed in any way to give effect to the sunset provision under section 13407(g)(2) of the Health Information Technology for Economic and Clinical Health Act (42 U.S.C. 17937(g)(2)) or to otherwise limit or affect the applicability, under section 13407 of that Act, of the requirement to provide notification to individuals following a breach of security for vendors of personal health records and each entity described in clause (ii), (iii), or
(iv)of section 13424(b)(1)(A) of that Act ( 42 U.S.C. 17953(b)(1)(A) ). If the Commission, upon receiving notification of any breach of security that is reported to the Commission, finds that notification of the breach of security via the Commission's Internet Web site would be in the public interest or for the protection of consumers, the Commission shall place such a notice in a clear and conspicuous location on its Internet Web site. Not later than 1 year after the date of enactment of this Act, the Commission shall conduct a study on the practicality and cost effectiveness of requiring the direct notification required by subsection (d)(1) to be provided in a language in addition to English to individuals known to speak only such other language. The Commission may promulgate regulations necessary under section 553 of title 5, United States Code, to effectively enforce the requirements of this section.
Connectionstraces to 6
Traces to 6 documents
U.S. Code
Citation graph
cites case law
Sec. 3
Notification of breach of security
Cites 6Cited by 0 across 0 sources