Sec. 230. Clearinghouse information collection, maintenance, and access
355 words·~2 min read·
/bill/113/s/1995/is/section-230A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
The designated entity shall maintain a clearinghouse of technical information concerning system vulnerabilities identified in the wake of security breaches, which shall— contain information disclosed by agencies or business entities under subsection (b); and be accessible to certified entities under subsection (c). In any instance in which an agency or business entity is required to notify the designated entity under section 217, the agency or business entity shall also provide the designated entity with technical information concerning the nature of the security breach, including— technical information regarding any system vulnerabilities of the agency or business entity revealed by or identified as a consequence of the security breach; technical information regarding any system vulnerabilities of the agency or business entity actually exploited during the security breach; and any other technical information concerning the nature of the security breach deemed appropriate for collection by the designated entity in furtherance of this subtitle.
Any entity certified under subsection
(d)may review information maintained by the technical information clearinghouse for the purpose of preventing security breaches that threaten the security of sensitive personally identifiable information. The designated entity shall issue and revoke certifications to agencies and business entities wishing to review information maintained by the technical information clearinghouse and shall establish conditions for obtaining and maintaining such certifications, including agreement that any information obtained directly or derived indirectly from the review of information maintained by the technical information clearinghouse— shall only be used to improve the security and reduce the vulnerability of networks that collect, access, transmit, use, store, or dispose of sensitive personally identifiable information; may not be used for any competitive commercial purpose; and may not be shared with any third party, including other parties certified for access to the information clearinghouse, without the express written consent of the designated entity. In consultation with the private sector, appropriate representatives of State and local governments, and other appropriate Federal agencies, the designated entity may issue such regulations as it determines to be necessary to carry out this subtitle. All regulations promulgated under this Act shall be issued in accordance with section 553 of title 5, United States Code.