Data Security and Breach Notification Act of 2014
Latest action. Read twice and referred to the Committee on Commerce, Science, and Transportation.
Data Security and Breach Notification Act of 2014 - Requires the Federal Trade Commission (FTC) to promulgate regulations requiring each covered entity (proprietorships, partnerships, estates, trusts, cooperatives, and nonprofit and for-profit corporations) that owns or possesses data containing personal information to implement policies and procedures regarding information security practices for the treatment and protection of such information.
Establishes procedures to be followed in the event of an information security breach. Requires a covered entity that discovers a breach to notify the FTC (unless the covered entity has already notified a federal entity designated by the Department of Homeland Security [DHS] to receive such information) and affected individuals. Sets forth requirements concerning such notification, including methods of notification and timeliness requirements. Allows an exemption from notification requirements if such entity reasonably concludes that there is no reasonable risk of identity theft, fraud, or other unlawful conduct. Establishes a presumption that there is no such risk for encrypted data.
Directs DHS to designate a federal entity that covered entities would be required to notify if a security breach involves: (1) the personal information of more than 10,000 individuals, (2) a database containing the personal information of more than 1 million individuals, (3) federal government databases, or (4) the personal information of federal employees or contractors known to be involved in national security or law enforcement.
Requires the designated entity to provide each notice it receives to:
the U.S. Secret Service;
the Federal Bureau of Investigation (FBI);
the FTC;
the U.S. Postal Inspection Service, if mail fraud is involved;
attorneys general of affected states; and
appropriate federal agencies for law enforcement, national security, or data security purposes. Sets forth enforcement provisions for the FTC, state attorneys general, and the Attorney General (DOJ).
Establishes criminal penalties of a fine, imprisonment for up to five years, or both, for concealment of a security breach that results in economic harm of at least $1,000 to an individual.
Written by analysts at the Congressional Research Service and published on Congress.gov, not by Civibrief. Summarized at the "Introduced in Senate" stage on January 30, 2014. It describes the bill, it is not the legal text.
Where is it in the process, and what happens next?
4 steps remain before this bill could become law.
The record's latest action, on January 30, 2014: Read twice and referred to the Committee on Commerce, Science, and Transportation.
- Clearing the committees it was referred to, and being scheduled for a floor vote
- Passage by the Senate
- Passage by the House
- The President's signature. If the President vetoes it, two-thirds of both chambers must vote to override.
How likely is it to become law?
Civibrief does not forecast outcomes and this page has no opinion about this one. What the record supports is a base rate, which is a fact about the whole pile, not a prediction about this measure.
In the 113th Congress (2013-14), 296 of the 9,091 bills and joint resolutions introduced became law, about 3.3 percent. That count covers every measure at every stage, including the many that never left committee.
This one is not there yet: 4 steps are still outstanding, listed above.
Has anyone actually voted on it?
No. No roll call in this Congress cites this measure. That is the ordinary outcome: most measures never reach a recorded floor vote, and a committee ends most of them simply by not acting.
A vote is not the only thing that happens to a measure. Hearings, markups, and referrals are all recorded actions, and none of them is a vote of the full chamber.
Who is behind it?
JAY ROCKEFELLER (D-WV) introduced it on January 30, 2014, and 3 members have since signed on as cosponsors.
They are 3 Democrats.
Cosponsoring is a formal signature on the text. It is not a commitment to vote for the measure, it does not bind anyone's party, and a long list of cosponsors is a measure of attention rather than of prospects.
How long has it been in play?
It was introduced on January 30, 2014, 4606 days ago. The most recent recorded action was 4606 days ago, on January 30, 2014.
Measures do not carry over. Anything the 113th Congress has not finished by January 3, 2015 dies when the term ends, and has to be introduced again from the start in the next Congress.
Every answer above is assembled from this measure's own record on Congress.gov and from published counts of what Congress has passed before. Civibrief does not predict outcomes and takes no position on any measure.
Vote history
- SenateIn committee, no floor vote yet
- HouseAwaits Senate passage
- PresidentAwaits both chambers