S 1207 · 112th Congress 2011–2013, ended

Data Security and Breach Notification Act of 2011

Introduced Jun 15, 2011 Originated Senate Sponsor Mark L. Pryor D-AR

Latest action · Jun 15, 2011 Read twice and referred to the Committee on Commerce, Science, and Transportation.

Progress

Where this bill reached, and when. A stage with no date was not reached; one that failed a vote and later carried shows the date it carried.

IntroducedJun 15, 2011
Passed SenateNot reached
Passed HouseNot reached
To the PresidentNot reached
Became lawNot reached

Summary

Data Security and Breach Notification Act of 2011 - Requires the Federal Trade Commission (FTC) to promulgate regulations requiring each covered entity (proprietorships, partnerships, estates, trusts, cooperatives, and nonprofit and for-profit corporations) that owns or possesses data containing personal information to implement policies and procedures regarding information security practices for the treatment and protection of such information.

Sets forth additional requirements for information brokers, including requiring brokers to: (1) submit their security policies to the FTC with a notification of a security breach or upon FTC request; (2) establish procedures to assure the accuracy of the information they collect, assemble, or maintain that is personal information or that identifies an individual; (3) provide individuals access to their personal information for review; and (4) correct inaccurate information. Authorizes the FTC to conduct information security practices audits of brokers who have had a security breach or require such brokers to conduct independent audits.

Directs the FTC to require information brokers to establish measures that facilitate the auditing or retracing of access to, or transmissions of, any data containing personal information.

Makes it unlawful for information brokers to obtain or disclose personal information by false pretenses (pretexting).

Establishes procedures in the event of an information security breach. Requires a covered entity that discovers a breach to notify the FTC and affected individuals. Sets forth requirements concerning such notification, including the method of notification requirements and timeliness requirements. Allows an exemption from notification requirements if such entity determines that there is no reasonable risk of identity theft, fraud, or other unlawful conduct. Establishes a presumption that there is no such risk for encrypted data.

Applies this Act to nonprofit organizations.

Sets forth enforcement provisions.

Cosponsors 1

Members who signed on, in the order they did. All signed on Jun 15, 2011.

Seat	Cosponsor		Signed on
D-WV	John D. Rockefeller IV	Original	Jun 15, 2011

Committees 1

Where it was sent and what each committee and subcommittee did with it, in order.

Chamber	Committee	What it did
Senate	Commerce, Science, and Transportation Committee	Referred Jun 15, 2011

Actions 2

Everything that happened, newest first.

Jun 15, 2011Introduced in Senate
Jun 15, 2011Read twice and referred to the Committee on Commerce, Science, and Transportation.

In the Congressional Record 1

Days the Record’s own index lists this bill, newest first, with the pages and the members it names. Pages starting H are the House, S the Senate, E Extensions of Remarks.

Where	In the Record	Members	Date
Senate	Debate and remarks S3836	John D. Rockefeller IV D-WV	Jun 15, 2011

Research

What has been written about this bill: committee reports, cost estimates, the sponsor’s authority statement, printed hearings and the Congressional Research Service’s work.

Printed hearings 2

Hearings whose printed record names this bill, newest first: hearings on it, and wider hearings where it came up.

Number	Hearing	Committee	Held
S. Hrg. 112-791	THE NEED FOR PRIVACY PROTECTIONS: PERSPECTIVES FROM THE ADMINISTRATION AND THE FEDERAL TRADE COMMISSION66 pages	Commerce, Science, and Transportation Committee	May 9, 2012
S. Hrg. 112-152	PRIVACY AND DATA SECURITY: PROTECTING CONSUMERS IN THE MODERN WORLD95 pages	Commerce, Science, and Transportation Committee	Jun 29, 2011

CRS reports 1

Congressional Research Service work that CRS links to this bill or the law it became, newest first.

Cite it 1

Products on other subjects that cite it, usually among other measures.

Product	Title	Kind	Published
R42114	Federal Laws Relating to Cybersecurity: Overview of Major Issues, Current Laws, and Proposed Legislation Archived	Report	Dec 12, 2014

Related bills 2

Companion bills and other measures the record links to this one.

Bill	Title	Relationship	Latest action
HR 1707	Data Accountability and Trust Act	Related bill	May 6, 2011
HR 2577	SAFE Data Act	Related bill	Jul 29, 2011

Titles 2

Every title it has carried, official and short, at each stage.

Official Title as Introduced: A bill to protect consumers by requiring reasonable security policies and procedures to protect data containing personal information, and to provide for nationwide notice in the event of a security breach.
Short Titles as Introduced: Data Security and Breach Notification Act of 2011

Subjects

Assigned by the Library of Congress. Policy area: Commerce.

Text 1

Each version as it was printed, newest first.

Jun 15, 2011Introduced in Senate

Support LegiList

This page is free, carries no paywall, and is built and maintained by one person. If the record here is useful to you, a few dollars keeps it going.

$1 $5 $10

Processed by Stripe in a separate window. LegiList never sees card details.

Everything here is as published by Congress: the summary is the Congressional Research Service's, the action wording is the clerks', and the subjects are the Library of Congress's. How far it got is read from the actions themselves, taking the most recent one of each kind, so a bill that failed a vote and later passed is shown as having passed. Records come from this bill on Congress.gov and govinfo.gov; cost estimates are the Congressional Budget Office's, and the hearings are the printed hearings GovInfo publishes, which can appear months after the hearing.