Ask AI
Bill109th CongressFiled Jun 28, 2005Science, Technology, Communications
S. 1326

Notification of Risk to Personal Data Act

Bill journey · stage 2 of 5

Under committee review

Filed
Comm.
Floor
Both
Law

What it doesSummary reported to senate without amendment (Oct 20, 2005)

(This measure has not been amended since it was introduced. The summary has been expanded because action occurred on the measure.)

Notification of Risk to Personal Data Act - Requires any agency or person (agency) that owns or licenses computerized data containing sensitive personal information to: (1) implement and maintain reasonable security and notification procedures and practices to protect sensitive personal information from unauthorized access, destruction, use, modification, or disclosure; and (2) notify any U.S. resident whose sensitive personal information was compromised. Permits a federal law enforcement agency to delay notification if notification would impede an investigation.

Requires any agency in possession of computerized data containing sensitive personal information that it does not own or license to notify the entity from whom it received the information if the security of that information was compromised, resulting in a significant risk of identity theft.

Sets forth provisions regarding: (1) the timeliness of notification; (2) the methods and contents of notice; and (3) the duty to coordinate with consumer reporting agencies.

Declares that an agency that maintains notification procedures as part of an information security policy for the treatment of sensitive personal information and otherwise meets this Act's requirements shall be in compliance with this Act if the agency notifies subject persons in accordance with its policies in the event of a security breach.

Establishes civil remedies for failure to provide notice of a security breach.

Authorizes enforcement by state attorneys general on behalf of residents of the state.

What just happenedOct 20, 2005

Placed on Senate Legislative Calendar under General Orders. Calendar No. 252.

Who’s behind it

Sen. Sessions, Jeff [R-AL](R-AL)Sponsor
1 cosponsor1 R
Read on Congress.gov
1cosponsors1committees6actions25subjects
  1. Oct 20, 2005Calendars

    Placed on Senate Legislative Calendar under General Orders. Calendar No. 252.

  2. Oct 20, 2005Committee

    Committee on the Judiciary. Reported by Senator Specter without amendment. Without written report.

    Judiciary Committee
  3. Oct 20, 2005Committee14000

    Committee on the Judiciary. Reported by Senator Specter without amendment. Without written report.

    Judiciary Committee
  4. Oct 20, 2005Committee

    Committee on the Judiciary. Ordered to be reported without amendment favorably.

    Judiciary Committee
  5. Jun 28, 2005IntroReferral

    Read twice and referred to the Committee on the Judiciary.

    Judiciary Committee
  6. Jun 28, 2005IntroReferral10000

    Introduced in Senate

Reported to Senate without amendmentOct 20, 200580

(This measure has not been amended since it was introduced. The summary has been expanded because action occurred on the measure.)

Notification of Risk to Personal Data Act - Requires any agency or person (agency) that owns or licenses computerized data containing sensitive personal information to: (1) implement and maintain reasonable security and notification procedures and practices to protect sensitive personal information from unauthorized access, destruction, use, modification, or disclosure; and (2) notify any U.S. resident whose sensitive personal information was compromised. Permits a federal law enforcement agency to delay notification if notification would impede an investigation.

Requires any agency in possession of computerized data containing sensitive personal information that it does not own or license to notify the entity from whom it received the information if the security of that information was compromised, resulting in a significant risk of identity theft.

Sets forth provisions regarding: (1) the timeliness of notification; (2) the methods and contents of notice; and (3) the duty to coordinate with consumer reporting agencies.

Declares that an agency that maintains notification procedures as part of an information security policy for the treatment of sensitive personal information and otherwise meets this Act's requirements shall be in compliance with this Act if the agency notifies subject persons in accordance with its policies in the event of a security breach.

Establishes civil remedies for failure to provide notice of a security breach.

Authorizes enforcement by state attorneys general on behalf of residents of the state.

Introduced in SenateJun 28, 200500

Notification of Risk to Personal Data Act - Requires any agency or person that owns or licenses computerized data containing sensitive personal information to: (1) implement and maintain reasonable security and notification procedures and practices (appropriate to the size and nature of the agency or person and the nature of the information) to protect sensitive personal information from unauthorized access, destruction, use, modification, or disclosure; and (2) notify any individual whose sensitive personal information was compromised if such individual is known to be a U.S. resident (permits a federal law enforcement agency of domestic or foreign jurisdiction to delay notification if notification would impede a criminal or civil investigation).

Requires any agency or person in possession of computerized data containing sensitive personal information that it does not own or license to notify the entity from whom it received the information if the security of that information was compromised, resulting in a significant risk of identity theft. Sets forth provisions regarding the timeliness of notification, the methods and contents of notice, and the duty to coordinate with consumer reporting agencies.

Establishes civil remedies for failure to provide notice of a security breach. Authorizes enforcement by state Attorneys General on behalf of residents of the state.