Personal Data Notification and Protection Act of 2017
This bill requires certain businesses that use, access, transmit, store, dispose of, or collect sensitive personally identifiable information to notify individuals whose information is believed to have been accessed or acquired through a discovered security breach. In addition, the businesses must meet specified requirements for notifying certain federal agencies, credit reporting agencies, and the media regarding a security breach. The bill also sets forth requirements for the notification process, exemptions from the requirements, and enforcement authorities for the Federal Trade Commission and the states.