Sec. 217. Notice to law enforcement
409 words·~2 min read·
/bill/113/s/1995/is/section-217A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Not later than 60 days after the date of enactment of this Act, the Secretary of Homeland Security, in consultation with the Attorney General, shall designate a Federal Government entity to receive the information required to be submitted under this subtitle, and any other reports and information about information security incidents, threats, and vulnerabilities. The designated entity shall— be responsible for promptly providing the information it receives to the United States Secret Service and the Federal Bureau of Investigation, and to the Federal Trade Commission for civil law enforcement purposes; and provide the information described in subparagraph
(A)as appropriate to other Federal agencies for law enforcement, national security, or data security purposes. Any business entity or agency shall notify the designated entity of the fact that a security breach has occurred if— the number of individuals whose sensitive personally identifiable information was, or is reasonably believed to have been, accessed or acquired by an unauthorized person exceeds 5,000; the security breach involves a database, networked or integrated databases, or other data system containing the sensitive personally identifiable information of more than 500,000 individuals nationwide; the security breach involves databases owned by the Federal Government; or the security breach involves primarily sensitive personally identifiable information of individuals known to the agency or business entity to be employees and contractors of the Federal Government involved in national security or law enforcement. Not later than 1 year after the date of enactment of this Act, the Federal Trade Commission, in consultation with the Attorney General and the Secretary of Homeland Security, shall promulgate regulations regarding the reports required under subsection (a). The Federal Trade Commission, in consultation with the Attorney General and the Secretary of Homeland Security, after notice and the opportunity for public comment, and in a manner consistent with this section, shall promulgate regulations, as necessary, under section 553 of title 5, United States Code, to adjust the thresholds for notice to law enforcement and national security authorities under subsection
(a)and to facilitate the purposes of this section. The notices required under this section shall be delivered as follows: Notice under subsection
(a)shall be delivered as promptly as possible, but not later than 10 days after discovery of the security breach. Notice under section 211 shall be delivered to individuals not later than 48 hours after the Federal Bureau of Investigation or the Secret Service receives notice of a security breach from an agency or business entity.