PlainBillCongress, translated.Legislation. Context. Public interest.Read twice and referred to the Committee on Commerce, Science, and Transportation.
Congressional Research Service
Version 00 · Introduced in Senate · Jan 13, 2015
Data Security and Breach Notification Act of 2015
Requires the Federal Trade Commission (FTC) to promulgate regulations requiring commercial entities, nonprofit and for-profit corporations, estates, trusts, cooperatives, and other specified entities that own or possess data containing personal information (covered entities), or that contract to have a third-party maintain or process such data for the entity, to implement information security policies and procedures for the treatment and protection of personal information.
Establishes procedures to be followed in the event of an information security breach. Requires a covered entity that discovers a breach to notify the FTC (unless the covered entity has already notified a federal entity designated by the Department of Homeland Security [DHS] to receive such information) and affected individuals. Sets forth requirements concerning such notification, including methods of notification and timeliness requirements. Allows an exemption from notification requirements if such entity reasonably concludes that there is no reasonable risk of identity theft, fraud, or other unlawful conduct. Establishes a presumption that there is no such risk for encrypted data.
Showing the opening paragraphs of the official summary.
Directs DHS to designate a federal entity that covered entities would be required to notify if a security breach involves: (1) the personal information of more than 10,000 individuals, (2) a database containing the personal information of more than 1 million individuals, (3) federal government databases, or (4) the personal information of federal employees or contractors known to be involved in national security or law enforcement.
Requires the designated entity to provide each notice it receives to:
the U.S. Secret Service;
the Federal Bureau of Investigation;
the FTC;
the U.S. Postal Inspection Service, if mail fraud is involved;
attorneys general of affected states; and
appropriate federal agencies for law enforcement, national security, or data security purposes.
Sets forth enforcement provisions for the FTC, state attorneys general, and the Attorney General.
Establishes criminal penalties of a fine, imprisonment for up to five years, or both, for concealment of a security breach that results in economic harm of at least $1,000 to an individual.
People & committees
Sen. Nelson, Bill [D-FL] · D–FL
Legislative record
A procedural vote is different from passage. Passage in one chamber does not establish enactment. Explore the glossary.
Read twice and referred to the Committee on Commerce, Science, and Transportation.
Introduced in Senate
Primary sources
Text links open the official source. We currently store references to these documents.
Source last updated: Sep 8, 2026. Consult Congress.gov for the current record.
AI Conversation Starters
Choose a perspective, copy a prompt, and paste it into your preferred AI. Each prompt includes the bill version and available official source links, and asks for counterarguments as well as supporting evidence.
Analyze S.177 as objectively as possible. Explain its main provisions, who would be affected, possible benefits and harms, implementation, exceptions, and uncertainties. Present the strongest arguments for and against it, and identify evidence needed to assess its public impact.
Examine S.177 through a progressive lens, focusing on fairness, access, economic inequality, and effects on vulnerable communities. Explain potential benefits, costs, and unintended consequences. Consider the strongest counterarguments and distinguish stated goals from demonstrated outcomes.
Examine S.177 through a conservative lens, focusing on fiscal responsibility, institutional stability, federalism, and the scope of government. Explain potential benefits, costs, and unintended consequences. Consider the strongest counterarguments and any provisions that challenge this perspective.
Examine S.177 through a civil-liberties and limited-government lens. Consider individual rights, privacy, voluntary choice, accountability, and government power. Explain tradeoffs, possible safeguards, and the strongest counterarguments without assuming the proposal is beneficial or harmful.