Data Security and Breach Notification Act of 2014
Latest action · Jan 30, 2014 Read twice and referred to the Committee on Commerce, Science, and Transportation.
Progress
Where this bill reached, and when. A stage with no date was not reached; one that failed a vote and later carried shows the date it carried.
- IntroducedJan 30, 2014
- Passed SenateNot reached
- Passed HouseNot reached
- To the PresidentNot reached
- Became lawNot reached
Summary
Data Security and Breach Notification Act of 2014 - Requires the Federal Trade Commission (FTC) to promulgate regulations requiring each covered entity (proprietorships, partnerships, estates, trusts, cooperatives, and nonprofit and for-profit corporations) that owns or possesses data containing personal information to implement policies and procedures regarding information security practices for the treatment and protection of such information.
Establishes procedures to be followed in the event of an information security breach. Requires a covered entity that discovers a breach to notify the FTC (unless the covered entity has already notified a federal entity designated by the Department of Homeland Security [DHS] to receive such information) and affected individuals. Sets forth requirements concerning such notification, including methods of notification and timeliness requirements. Allows an exemption from notification requirements if such entity reasonably concludes that there is no reasonable risk of identity theft, fraud, or other unlawful conduct. Establishes a presumption that there is no such risk for encrypted data.
Directs DHS to designate a federal entity that covered entities would be required to notify if a security breach involves: (1) the personal information of more than 10,000 individuals, (2) a database containing the personal information of more than 1 million individuals, (3) federal government databases, or (4) the personal information of federal employees or contractors known to be involved in national security or law enforcement.
Requires the designated entity to provide each notice it receives to:
- the U.S. Secret Service;
- the Federal Bureau of Investigation (FBI);
- the FTC;
- the U.S. Postal Inspection Service, if mail fraud is involved;
- attorneys general of affected states; and
- appropriate federal agencies for law enforcement, national security, or data security purposes.
Sets forth enforcement provisions for the FTC, state attorneys general, and the Attorney General (DOJ).
Establishes criminal penalties of a fine, imprisonment for up to five years, or both, for concealment of a security breach that results in economic harm of at least $1,000 to an individual.
Cosponsors 3
Members who signed on, in the order they did. All signed on Jan 30, 2014.
| Seat | Cosponsor | Signed on | |
|---|---|---|---|
| D-FL | Bill Nelson | Original | Jan 30, 2014 |
| D-CA | Dianne Feinstein | Original | Jan 30, 2014 |
| D-AR | Mark L. Pryor | Original | Jan 30, 2014 |
Actions 3
Everything that happened, newest first.
- Jan 30, 2014Introduced in Senate
- Jan 30, 2014Read twice and referred to the Committee on Commerce, Science, and Transportation.
- Jan 30, 2014Sponsor introductory remarks on measure. (CR S656-657)
Related bills 3
Companion bills and other measures the record links to this one.
| Bill | Title | Relationship | Latest action |
|---|---|---|---|
| S 2378 | Commercial Privacy Bill of Rights Act of 2014 | Related bill | May 21, 2014 |
| HR 4400 | Data Accountability and Trust Act | Related bill | Apr 11, 2014 |
| HR 4711 | To establish a regulatory framework for the comprehensive protection of personal data for individuals under the aegis of the Federal Trade Commission, to amend the Children's Online Privacy Protection Act of 1998 to improve provisions relating to collecti | Related bill | May 23, 2014 |
Subjects
Assigned by the Library of Congress. Policy area: Commerce.
- Administrative law and regulatory procedures
- Bank accounts, deposits, capital
- Banking and financial institutions regulation
- Business records
- Civil actions and liability
- Commerce
- Computer security and identity theft
- Computers and information technology
- Congressional oversight
- Consumer affairs
- Consumer credit
- Criminal investigation, prosecution, interrogation
- Federal Trade Commission (FTC)
- Fraud offenses and financial crimes
- Intelligence activities, surveillance, classified information
- Internet and video services
- Internet, web applications, social media
- Right of privacy
- Small business
- Social work, volunteer service, charitable organizations
Text 1
Each version as it was printed, newest first.
- Jan 30, 2014Introduced in Senate
Everything here is as published by Congress: the summary is the Congressional Research Service's, the action wording is the clerks', and the subjects are the Library of Congress's. How far it got is read from the actions themselves, taking the most recent one of each kind, so a bill that failed a vote and later passed is shown as having passed. Records come from this bill on Congress.gov and govinfo.gov.