PlainBillCongress, translated.Legislation. Context. Public interest.Referred to the Subcommittee on the Constitution and Civil Justice.
Congressional Research Service
Version 00 · Introduced in House · Mar 26, 2015
Personal Data Notification and Protection Act of 2015
Requires certain businesses that use, access, transmit, store, dispose of, or collect sensitive personally identifiable information about more than 10,000 individuals during any 12-month period to notify individuals whose information is believed to have been accessed or acquired through a discovered security breach.
Directs businesses, within 30 days after discovery of a breach, to notify: (1) affected individuals by mail, telephone, or email; and (2) major media outlets if the number of affected residents of a state exceeds 5,000. Allows the Federal Trade Commission (FTC) to extend the notification period if a business seeks additional time.
Showing the opening paragraphs of the official summary.
Requires the Department of Homeland Security (DHS) to designate a federal government entity to receive notices about security incidents, threats, and vulnerabilities. Directs businesses to notify the DHS-designated entity, and requires the DHS-designated entity to then notify the U.S. Secret Service, the Federal Bureau of Investigation (FBI), and the FTC, if a security breach affects: (1) more than 5,000 individuals, (2) a database that contains the sensitive information of more than 500,000 individuals, (3) federal government databases, or (4) federal employees or contractors involved in national security or law enforcement. Requires the DHS-designated entity to also make the information available to other appropriate federal agencies for law enforcement, national security, or computer security purposes.
Authorizes the Secret Service or the FBI to require businesses to delay or exempt individuals from notifications for national security or law enforcement purposes.
Requires businesses to notify consumer reporting agencies if more than 5,000 individuals must be notified of a breach.
Exempts a business from individual notification requirements if the business: (1) conducts and notifies the FTC of a risk assessment finding no reasonable risk that a breach resulted in, or will result in, harm to the affected individuals, provided that the FTC is given 10 days to determine whether individual notification should be provided before the exemption automatically becomes effective; or (2) uses or participates in a security program that blocks the use of certain sensitive personal information to initiate financial transactions if the program also notifies affected individuals after a breach that results in fraud or unauthorized transactions.
Sets forth authority for the FTC and states to enforce against violations of this Act.
Amends the federal criminal code to extend extraterritorially the application of penalties for fraud offenses involving an access device issued, owned, managed, or controlled by a financial institution, credit card system member, or other entity organized under the laws of the United States or any U.S. state or territory. (An access device is any card, code, electronic serial number, telecommunications service, or other means of account access that can be used to initiate a transfer of funds or to obtain money, goods, or services.) Removes a condition under current law that subjects a person to such penalties only if the underlying articles, property, or proceeds are held within or have transferred through U.S. jurisdiction.
People & committees
Rep. Langevin, James R. [D-RI-2] · D–RI
Legislative record
A procedural vote is different from passage. Passage in one chamber does not establish enactment. Explore the glossary.
Referred to the Subcommittee on the Constitution and Civil Justice.
Referred to the Subcommittee on Crime, Terrorism, Homeland Security, and Investigations.
Referred to the Subcommittee on Commerce, Manufacturing, and Trade.
Referred to the Committee on Energy and Commerce, and in addition to the Committee on the Judiciary, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
Referred to the Committee on Energy and Commerce, and in addition to the Committee on the Judiciary, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
Referred to the Committee on Energy and Commerce, and in addition to the Committee on the Judiciary, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
Introduced in House
Introduced in House
Primary sources
Text links open the official source. We currently store references to these documents.
Source last updated: Aug 12, 2025. Consult Congress.gov for the current record.
AI Conversation Starters
Choose a perspective, copy a prompt, and paste it into your preferred AI. Each prompt includes the bill version and available official source links, and asks for counterarguments as well as supporting evidence.
Analyze H.R.1704 as objectively as possible. Explain its main provisions, who would be affected, possible benefits and harms, implementation, exceptions, and uncertainties. Present the strongest arguments for and against it, and identify evidence needed to assess its public impact.
Examine H.R.1704 through a progressive lens, focusing on fairness, access, economic inequality, and effects on vulnerable communities. Explain potential benefits, costs, and unintended consequences. Consider the strongest counterarguments and distinguish stated goals from demonstrated outcomes.
Examine H.R.1704 through a conservative lens, focusing on fiscal responsibility, institutional stability, federalism, and the scope of government. Explain potential benefits, costs, and unintended consequences. Consider the strongest counterarguments and any provisions that challenge this perspective.
Examine H.R.1704 through a civil-liberties and limited-government lens. Consider individual rights, privacy, voluntary choice, accountability, and government power. Explain tradeoffs, possible safeguards, and the strongest counterarguments without assuming the proposal is beneficial or harmful.