PlainBillCongress, translated.Legislation. Context. Public interest.Read twice and referred to the Committee on Commerce, Science, and Transportation.
Congressional Research Service
Version 00 · Introduced in Senate · Apr 15, 2015
Data Security Act of 2015
Requires individuals, corporations, or other non-government entities that access, maintain, communicate, or handle sensitive account information or nonpublic personal information to implement an information security program and to notify consumers, federal law enforcement, appropriate administrative agencies, payment card networks, and consumer reporting agencies of certain data breaches of unencrypted sensitive information likely to cause identity theft or fraudulent transactions on consumer financial accounts.
Directs entities to require their service providers by contract to implement appropriate safeguards for sensitive information.
Showing the opening paragraphs of the official summary.
Provides special notification procedures for: (1) third-party service providers that maintain data in electronic form on behalf of another entity, and (2) certain electronic data carriers.
Allows financial institutions to communicate with account holders regarding breaches at third-party entities with access to their account information.
Sets forth alternative compliance procedures for: (1) financial institutions and affiliates under the Gramm-Leach-Bliley Act, and (2) entities complying with certain health record privacy laws.
Requires this Act to be enforced by the Federal Trade Commission, the Comptroller of the Currency, the Federal Reserve System, the Federal Deposit Insurance Corporation, the National Credit Union Administration Board, the Securities and Exchange Commission, the Commodity Futures Trading Commission, the Office of Federal Housing Enterprise Oversight, or a state insurance authority depending on the type of entity handling the sensitive information.
Allows a consumer or entity that suffers financial harm from an entity's violation of this Act to bring an action in federal court to recover damages for negligent or knowing violations.
Prohibits certain state laws from being imposed for information security and breach notification purposes. Provides for the requirements of this Act to apply to certain entities in place of existing security practices and notifications standards currently enforced by the Federal Communications Commission.
People & committees
Sen. Carper, Thomas R. [D-DE] · D–DE
Legislative record
A procedural vote is different from passage. Passage in one chamber does not establish enactment. Explore the glossary.
Read twice and referred to the Committee on Commerce, Science, and Transportation.
Introduced in Senate
Primary sources
Text links open the official source. We currently store references to these documents.
Source last updated: Sep 8, 2026. Consult Congress.gov for the current record.
AI Conversation Starters
Choose a perspective, copy a prompt, and paste it into your preferred AI. Each prompt includes the bill version and available official source links, and asks for counterarguments as well as supporting evidence.
Analyze S.961 as objectively as possible. Explain its main provisions, who would be affected, possible benefits and harms, implementation, exceptions, and uncertainties. Present the strongest arguments for and against it, and identify evidence needed to assess its public impact.
Examine S.961 through a progressive lens, focusing on fairness, access, economic inequality, and effects on vulnerable communities. Explain potential benefits, costs, and unintended consequences. Consider the strongest counterarguments and distinguish stated goals from demonstrated outcomes.
Examine S.961 through a conservative lens, focusing on fiscal responsibility, institutional stability, federalism, and the scope of government. Explain potential benefits, costs, and unintended consequences. Consider the strongest counterarguments and any provisions that challenge this perspective.
Examine S.961 through a civil-liberties and limited-government lens. Consider individual rights, privacy, voluntary choice, accountability, and government power. Explain tradeoffs, possible safeguards, and the strongest counterarguments without assuming the proposal is beneficial or harmful.