Sec. 4. Notice to law enforcement

401 words·~2 min read·/bill/113/s/1976/is/section-4

A research copy — for the controlling text, always check the official state or federal source. Not legal advice.

Not later than 60 days after the date of enactment of this Act, the Secretary of the Department of Homeland Security shall designate a Federal Government entity to receive notice under this section. A covered entity shall notify the designated entity of a breach of security if— the number of individuals whose personal information was, or is reasonably believed to have been, acquired or assessed as a result of the breach of security exceeds 10,000; the breach of security involves a database, networked or integrated databases, or other data system containing the personal information of more than 1,000,000 individuals; the breach of security involves databases owned by the Federal Government; or the breach of security involves primarily personal information of individuals known to the covered entity to be employees or contractors of the Federal Government involved in national security or law enforcement.

Each notice under subsection

(b)shall contain— the date, estimated date, or estimated date range of the breach of security; a description of the nature of the breach of security; a description of each type of personal information that was or is reasonably believed to have been acquired or accessed as a result of the breach of security; and a statement of each paragraph under subsection

(b)that applies to the breach of security. Nothing in this section shall be construed to require a covered entity to reveal specific or identifying information about an individual as part of the notice under paragraph (1). The designated entity shall promptly provide each notice it receives under subsection

(b)to— the United States Secret Service; the Federal Bureau of Investigation; the Federal Trade Commission; the United States Postal Inspection Service, if the breach of security involves mail fraud; the attorney general of each State affected by the breach of security; and as appropriate, other Federal agencies for law enforcement, national security, or data security purposes. Notice under this section shall be delivered as follows: Notice under subsection

(b)shall be delivered as promptly as possible, but— not less than 3 business days before notification to an individual under section 3; and not later than 10 days after the date of discovery of the events requiring notice. Notice under subsection

(d)shall be delivered as promptly as possible, but not later than 1 business day after the date that the designated entity receives notice of a breach of security from a covered entity.