Data Accountability and Trust Act

This bill requires the Federal Trade Commission (FTC) to require certain businesses and other organizations to (1) establish specified information-security practices for the treatment and protection of personal information; and (2) in the event of a security breach involving such information, provide specified notice and offer credit-monitoring services.

The FTC must also establish information-security rules specific to information brokers, including (1) requirements regarding post-breach audits and consumer access to information, and (2) prohibitions on obtaining personal information by false pretenses.

The bill establishes civil penalties and provides for enforcement by the FTC and by states.