United States 114th Congress Status: Died 1 D cosponsors

HR 1704 — Personal Data Notification and Protection Act of 2015

Last action — Referred to the Subcommittee on the Constitution and Civil Justice.

Track this bill free

No card. One bill, free forever — alerts when it moves.

  1. ✓
    Introduced
  2. ✓
    In Committee
  3. Died in session

This bill died with 114th Congress. It reached “In Committee” and never advanced before the session ended, so it can no longer move — a new version would have to be reintroduced in the current session.

This bill is no longer active — its legislative session has ended, so there is no live prognosis. It would have to be reintroduced in the current session to move again.

Summary

Personal Data Notification and Protection Act of 2015 Requires certain businesses that use, access, transmit, store, dispose of, or collect sensitive personally identifiable information about more than 10,000 individuals during any 12-month period to notify individuals whose information is believed to have been accessed or acquired through a discovered security breach. Directs businesses, within 30 days after discovery of a breach, to notify: (1) affected individuals by mail, telephone, or email; and (2) major media outlets if the number of affected residents of a state exceeds 5,000. Allows the Federal Trade Commission (FTC) to extend the notification period if a business seeks additional time. Requires the Department of Homeland Security (DHS) to designate a federal government entity to receive notices about security incidents, threats, and vulnerabilities. Directs businesses to notify the DHS-designated entity, and requires the DHS-designated entity to then notify the U.S. Secret Service, the Federal Bureau of Investigation (FBI), and the FTC, if a security breach affects: (1) more than 5,000 individuals, (2) a database that contains the sensitive information of more than 500,000 individuals, (3) federal government databases, or (4) federal employees or contractors involved in national security or law enforcement. Requires the DHS-designated entity to also make the information available to other appropriate federal agencies for law enforcement, national security, or computer security purposes. Authorizes the Secret Service or the FBI to require businesses to delay or exempt individuals from notifications for national security or law enforcement purposes. Requires businesses to notify consumer reporting agencies if more than 5,000 individuals must be notified of a breach. Exempts a business from individual notification requirements if the business: (1) conducts and notifies the FTC of a risk assessment finding no reasonable risk that a breach resulted in, or will result in, harm to the affected individuals, provided that the FTC is given 10 days to determine whether individual notification should be provided before the exemption automatically becomes effective; or (2) uses or participates in a security program that blocks the use of certain sensitive personal information to initiate financial transactions if the program also notifies affected individuals after a breach that results in fraud or unauthorized transactions. Sets forth authority for the FTC and states to enforce against violations of this Act. Amends the federal criminal code to extend extraterritorially the application of penalties for fraud offenses involving an access device issued, owned, managed, or controlled by a financial institution, credit card system member, or other entity organized under the laws of the United States or any U.S. state or territory. (An access device is any card, code, electronic serial number, telecommunications service, or other means of account access that can be used to initiate a transfer of funds or to obtain money, goods, or services.) Removes a condition under current law that subjects a person to such penalties only if the underlying articles, property, or proceeds are held within or have transferred through U.S. jurisdiction.

Bill Text

We don't have the full text on file for this bill yet.

Read HR 1704 on the official United States source →

Action History

  1. Referred to the Subcommittee on the Constitution and Civil Justice.

  2. Referred to the Subcommittee on Crime, Terrorism, Homeland Security, and Investigations.

  3. Referred to the Subcommittee on Commerce, Manufacturing, and Trade.

  4. Referred to House Judiciary

  5. Referred to House Energy and Commerce

  6. Referred to the Committee on Energy and Commerce, and in addition to the Committee on the Judiciary, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.

  7. Introduced in House

Sponsors

Sponsorship breakdown

Export CSV (upgrade) →

1 sponsors · 0 co-sponsors · 546 not signed on

Sponsors (1)

Co-sponsors (0)

None.

Not signed on (546)

546 members have not signed on to this bill.

Show all 546 →

"Not signed on" means a member has not sponsored or co-sponsored this bill — it does not imply opposition. Members flagged Voted No have a recorded No vote on this bill.

Whip count is in markup. Polling the chamber and every recorded vote this session. Only the first open is slow. It’s instant for you after this. Calling the roll · Tallying · Engrossing

Subjects

public-safety civil-rights technology
Cross-referencing the record. Reading this bill against every other bill in the corpus by meaning, not keywords. Only the first open is slow. It’s instant for you after this. Matching · Ranking · Engrossing

Frequently asked questions

What does HR 1704 do?
Personal Data Notification and Protection Act of 2015 Requires certain businesses that use, access, transmit, store, dispose of, or collect sensitive personally identifiable information about more than 10,000 individuals during any 12-month period to notify individuals whose information is believed to have been accessed or acquired through a discovered security breach. Directs businesses, within 30 days after discovery of a breach, to notify: (1) affected individuals by mail, telephone, or email; and (2) major media outlets if the number of affected residents of a state exceeds 5,000. Allows the Federal Trade Commission (FTC) to extend the notification period if a business seeks additional time. Requires the Department of Homeland Security (DHS) to designate a federal government entity to receive notices about security incidents, threats, and vulnerabilities. Directs businesses to notify the DHS-designated entity, and requires the DHS-designated entity to then notify the U.S. Secret Service, the Federal Bureau of Investigation (FBI), and the FTC, if a security breach affects: (1) more than 5,000 individuals, (2) a database that contains the sensitive information of more than 500,000 individuals, (3) federal government databases, or (4) federal employees or contractors involved in national security or law enforcement. Requires the DHS-designated entity to also make the information available to other appropriate federal agencies for law enforcement, national security, or computer security purposes. Authorizes the Secret Service or the FBI to require businesses to delay or exempt individuals from notifications for national security or law enforcement purposes. Requires businesses to notify consumer reporting agencies if more than 5,000 individuals must be notified of a breach. Exempts a business from individual notification requirements if the business: (1) conducts and notifies the FTC of a risk assessment finding no reasonable risk that a breach resulted in, or will result in, harm to the affected individuals, provided that the FTC is given 10 days to determine whether individual notification should be provided before the exemption automatically becomes effective; or (2) uses or participates in a security program that blocks the use of certain sensitive personal information to initiate financial transactions if the program also notifies affected individuals after a breach that results in fraud or unauthorized transactions. Sets forth authority for the FTC and states to enforce against violations of this Act. Amends the federal criminal code to extend extraterritorially the application of penalties for fraud offenses involving an access device issued, owned, managed, or controlled by a financial institution, credit card system member, or other entity organized under the laws of the United States or any U.S. state or territory. (An access device is any card, code, electronic serial number, telecommunications service, or other means of account access that can be used to initiate a transfer of funds or to obtain money, goods, or services.) Removes a condition under current law that subjects a person to such penalties only if the underlying articles, property, or proceeds are held within or have transferred through U.S. jurisdiction.
Who sponsors HR 1704?
HR 1704 is sponsored by James Langevin (D).
What is the current status of HR 1704?
This bill died with 114th Congress. It reached “In Committee” and never advanced before the session ended, so it can no longer move — a new version would have to be reintroduced in the current session.
Where can I track HR 1704?
Track HR 1704 free on One Click Politics — get push/email alerts when it moves.

Make your voice heard on HR 1704

Find the representatives who decide this bill and tell them where you stand — for yourself, or mobilize your whole list in one click with One Click Politics advocacy software.

Find my representatives → Run a campaign

Stay ahead of HR 1704

Last checked for changes about 16 hours ago · updated continuously

One Click Politics tracks every bill in Congress and all 50 states.

Track this bill →