Bill > S1193

This bill, the Data Security and Breach Notification Act of 2013, requires entities that collect and maintain personal information to implement reasonable security measures to protect that data and to notify individuals if their personal information is compromised in a data breach. A "covered entity" is defined as any commercial entity that acquires, maintains, stores, or uses personal information, with exemptions for financial institutions and certain healthcare entities. "Personal information" is broadly defined to include names combined with sensitive identifiers like Social Security numbers, driver's license numbers, or financial account numbers, unless the information is publicly available or encrypted. If a breach occurs, covered entities must notify affected individuals, and if over 10,000 individuals are impacted, they must also notify the Secret Service or the FBI. The bill outlines specific notification requirements for third-party agents and service providers, and allows for delays in notification for law enforcement or national security purposes. Notifications can be made directly via mail, phone, or email, or through substitute methods like website postings or media announcements if direct notification is not feasible. The Federal Trade Commission (FTC) is tasked with enforcing the act, treating violations as unfair or deceptive practices, with a maximum civil penalty of $500,000 for violations stemming from the same act or omission or a single breach. Importantly, this bill preempts state laws on data security and breach notification and does not create a private right of action for individuals to sue for violations.