HR 4187 — Secure and Protect Americans' Data Act

1 sponsors · 0 co-sponsors · 546 not signed on

"Not signed on" means a member has not sponsored or co-sponsored this bill — it does not imply opposition. Members flagged Voted No have a recorded No vote on this bill.

Frequently asked questions

What does HR 4187 do?

Secure and Protect Americans' Data Act This bill requires the Federal Trade Commission (FTC) to promulgate regulations requiring entities regulated by the FTC, common carriers, and nonprofit organizations to establish information security practices for the treatment and protection of personal information. At least annually, such entities must evaluate their consumer privacy programs to make any appropriate adjustments for changing technologies, threats or vulnerabilities, or business arrangements. The bill sets forth special procedures for information brokers to: (1) submit security policies to the FTC, (2) provide for post-breach audits, and (3) establish procedures for individuals to review and correct inaccuracies in their personal information. In lieu of procedures that allow individuals to dispute information, an information broker may provide individuals a means of expressing a preference not to have their information used for marketing purposes. The bill prohibits information brokers from obtaining or disclosing personal information by false pretenses. Within 10 days following discovery of a security breach, entities must notify: the FTC; the Federal Bureau of Investigation; the U.S. Secret Service; for common carriers, the Federal Communications Commission (FCC); and attorneys general of affected states. Within 30 days following a breach, entities must notify individuals who are U.S. citizens or residents whose personal information was, or is reasonably believed to have been, acquired or accessed by an unauthorized person, or used for an unauthorized purpose. If an entity is required to notify more than 5,000 individuals, the entity must also notify major consumer reporting agencies. An entity must provide notices in print and broadcast media if the affected residents of a state exceed 5,000. Notices must include information on affected individuals' entitlement to consumer credit reports or credit monitoring services. The bill exempts entities from notification requirements if the data is unusable, unreadable, or indecipherable. Entities complying with other federal laws that require substantially similar information security procedures or breach notifications are deemed to be in compliance with the FTC's procedures or the notification requirements of this Act. Enforcement authority is provided to the FTC and states. States may obtain civil penalties for certain violations.

Who sponsors HR 4187?

HR 4187 is sponsored by Janice Schakowsky (D).

What is the current status of HR 4187?

This bill died with 114th Congress. It reached “In Committee” and never advanced before the session ended, so it can no longer move — a new version would have to be reintroduced in the current session.

Where can I track HR 4187?

Track HR 4187 free on One Click Politics — get push/email alerts when it moves.