Sec. 217. Notice to law enforcement
362 words·~2 min read·
/bill/115/hr/4081/ih/section-217A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Not later than 60 days after the date of enactment of this Act, the Secretary of Homeland Security, in consultation with the Attorney General, shall designate a Federal Government entity to receive the notices required under section 211 and this section. The designated entity shall— promptly provide the information that it receives to the United States Secret Service or the Federal Bureau of Investigation for law enforcement purposes; and provide the information described in subparagraph
(A)as appropriate to other Federal agencies for law enforcement, national security, or data security purposes. A covered entity shall notify the designated entity of the fact that a security breach has occurred if— the number of individuals whose sensitive personally identifying information was, or is reasonably believed to have been, accessed or acquired by an unauthorized person exceeds 5,000; the security breach involves a database, networked or integrated databases, or other data system containing the sensitive personally identifiable information of more than 500,000 individuals nationwide; the security breach involves databases owned by the Federal Government; or the security breach involves primarily sensitive personally identifiable information of individuals known to the covered entity to be employees and contractors of the Federal Government involved in national security or law enforcement. The Attorney General, in consultation with the Secretary of Homeland Security, after notice and the opportunity for public comment, and in a manner consistent with this section, shall promulgate regulations, as necessary, under section 553 of title 5, United States Code, to adjust the thresholds for notice to law enforcement and national security authorities under subsection
(a)and to facilitate the purposes of this section. The notice required under subsection
(b)shall be provided as promptly as possible, but such notice must be provided not less than 72 hours before notice is provided to an individual pursuant to section 211, or not later than 10 days after the discovery of the events requiring notice, whichever occurs first. For each breach requiring notice under this subsection, a copy of the notice to individuals required under section 211 shall also be provided to the designated entity not later than the date on which the notice is provided to affected individuals.