PlainBillCongress, translated.Legislation. Context. Public interest.Placed on Senate Legislative Calendar under General Orders. Calendar No. 563.
Congressional Research Service
Version 80 · Reported to Senate without amendment · Sep 15, 2010
(This measure has not been amended since it was introduced. The summary has been expanded because action occurred on the measure.)
Data Breach Notification Act - (Sec. 2) Requires any agency or business entity with sensitive personally identifiable information to notify without unreasonable delay any U.S. resident of a security breach in which such resident's information has been, or is reasonably believed to have been, accessed or acquired.
(Sec. 3) Exempts agencies or business entities from security breach notification requirements if they provide written certification to the Secret Service that providing such notification would impede a criminal investigation or damage national security. Requires the Secret Service to evaluate the merits of such certifications.
Showing the opening paragraphs of the official summary.
(Sec. 4) Requires an agency or business entity to give notice of a security breach to any affected individuals: (1) by written notice to their last known home mailing address, by telephone, or by email (if email notification was consented to); and (2) to major media outlets if the number of residents in a state affected by a security breach exceeds 5,000.
(Sec. 5) Requires the notification to individuals whose sensitive personally identifiable information has been acquired to include: (1) a description of the categories of information an unauthorized individual has acquired; and (2) toll-free numbers for contacting the agency or business entity whose databases have been breached and major credit reporting agencies.
(Sec. 6) Requires any business entity or agency that is required to provide notification to more than 5,000 individuals of a security breach to notify all consumer reporting agencies.
(Sec. 7) Requires any business entity or agency to notify the Secret Service of security breaches of sensitive personally identifying information within 14 days of any data security breach that involves: (1) more than 10,000 individuals; (2) a database that contains information about more than one million individuals nationwide; (3) a federal government database; or (4) individuals known to be government employees or contractors involved in national security or law enforcement. Requires the Secret Service to notify the Federal Bureau of Investigation (FBI), the U.S. Postal Service, and the attorney general of each affected state of a security breach within 14 days of receiving notice of any breach.
(Sec. 8) Authorizes the Attorney General to bring a civil action, including an injunction, in a U.S. district court for violations of security breach notification requirements.
(Sec. 9) Allows state attorneys general to bring a civil action in a U.S. district court to enforce security breach notification requirements. Authorizes the Attorney General to stay, or intervene in, any state action.
(Sec. 10) Declares that the provisions of this subtitle shall supersede any other provision of federal or state law relating to notification by an interstate business entity or agency of a security breach.
(Sec. 11) Authorizes appropriations to the Secret Service to carry out investigations and risk assessments of security breaches.
(Sec. 12) Requires the Secret Service to report to Congress on security breaches resulting from risk assessment exemptions.
People & committees
Sen. Feinstein, Dianne [D-CA] · D–CA
Legislative record
A procedural vote is different from passage. Passage in one chamber does not establish enactment. Explore the glossary.
Placed on Senate Legislative Calendar under General Orders. Calendar No. 563.
Committee on the Judiciary. Reported by Senator Leahy without amendment. With written report No. 111-290. Additional views filed.
Committee on the Judiciary. Reported by Senator Leahy without amendment. With written report No. 111-290. Additional views filed.
Committee on the Judiciary. Ordered to be reported without amendment favorably.
Read twice and referred to the Committee on the Judiciary. (text of measure as introduced: CR S117-119)
Sponsor introductory remarks on measure. (CR S116-117)
Introduced in Senate
Primary sources
Text links open the official source. We currently store references to these documents.
Source last updated: Aug 10, 2026. Consult Congress.gov for the current record.
AI Conversation Starters
Choose a perspective, copy a prompt, and paste it into your preferred AI. Each prompt includes the bill version and available official source links, and asks for counterarguments as well as supporting evidence.
Analyze S.139 as objectively as possible. Explain its main provisions, who would be affected, possible benefits and harms, implementation, exceptions, and uncertainties. Present the strongest arguments for and against it, and identify evidence needed to assess its public impact.
Examine S.139 through a progressive lens, focusing on fairness, access, economic inequality, and effects on vulnerable communities. Explain potential benefits, costs, and unintended consequences. Consider the strongest counterarguments and distinguish stated goals from demonstrated outcomes.
Examine S.139 through a conservative lens, focusing on fiscal responsibility, institutional stability, federalism, and the scope of government. Explain potential benefits, costs, and unintended consequences. Consider the strongest counterarguments and any provisions that challenge this perspective.
Examine S.139 through a civil-liberties and limited-government lens. Consider individual rights, privacy, voluntary choice, accountability, and government power. Explain tradeoffs, possible safeguards, and the strongest counterarguments without assuming the proposal is beneficial or harmful.