Personal Data Privacy and Security Act of 2009
The source supplies the latest action, but no lifecycle stage.
Latest action (17 Dec 2009): An errata sheet on written report No. 111-110 was printed.
What this bill does
This bill, S. 1490, the Personal Data Privacy and Security Act of 2009, aims to enhance protections against identity theft and the misuse of personal information. It would establish new criminal penalties for intentionally concealing security breaches involving sensitive personally identifiable information. The bill also imposes requirements on "data brokers" – companies that collect and sell personal information – requiring them to disclose data to individuals, help correct inaccuracies, and notify individuals of adverse actions taken by third parties based on their data. Additionally, it mandates that businesses handling large amounts of sensitive personal data implement a privacy and security program and notify individuals of security breaches.
The legislation affects individuals by providing them with more control over their personal data and greater transparency from data brokers, as well as mandating notification in case of data breaches. Businesses that handle sensitive personal information, particularly "data brokers," are directly impacted by new disclosure, correction, and notification requirements. Certain financial institutions and healthcare providers are exempt from some data security program requirements.
S. 1490 was introduced in the Senate in July 2009 and has been "Ordered Reported" by the Committee on the Judiciary with an amendment. This means the bill has passed committee review and is now ready to be considered by the full Senate. If passed by the Senate, it would then proceed to the House of Representatives for consideration.
Plain-English summary generated by Bill100 AI from the official record. Always verify against the source below.
Official summary
Personal Data Privacy and Security Act of 2009 - Title I: Enhancing Punishment for Identity Theft and Other Violations of Data Privacy and Security - (Sec. 101) Amends the federal criminal code to add intentionally accessing a computer without authorization to the definition of racketeering activity.
(Sec. 102) Imposes a fine and/or prison term of up to five years for intentionally and willfully concealing a security breach involving sensitive personally identifiable information that causes economic damage to one or more persons. Defines "sensitive personally identifiable information" to include an individual's name in combination with other personal information, such as a social security number, home address, date of birth, biometrics data, or financial account information.
(Sec. 103) Directs the U.S. Sentencing Commission to review and amend, if appropriate, federal sentencing guidelines for persons convicted of using fraud to access, or to misuse, digitized or electronic personally identifiable information, including sentencing guidelines for identity theft.
(Sec. 104) Amends the federal bankruptcy code to prohibit the dismissal or conversion of a bankruptcy case based upon a debtor's failure to meet means testing eligibility requirements if such debtor is a victim of identity theft.
Title II: Data Brokers - (Sec. 201) Requires interstate data brokers (defined as business entities which, for monetary fees or dues, regularly engage in the practice of collecting, transmitting, or providing access to sensitive personally identifiable information on more than 5,000 individuals to nonaffiliated third parties on an interstate basis) to: (1) disclose to a requesting individual all personal electronic records pertaining to such individual in their databases or systems at the time of such request; (2) provide guidance to such individuals for correcting inaccuracies in their records; (3) provide written or electronic notice of any adverse action taken against an individual by a third party based upon information in their databases; and (4) correct any inaccurate information in their databases. Sets forth procedures for disputing the completeness or accuracy of information in a data broker's database. Permits a data broker to decline to investigate or terminate a review of information disputed by an individual if the data broker reasonably determines that the dispute is frivolous and intended to perpetrate fraud.
(Sec. 202) Imposes civil penalties on data brokers who violate the requirements of this title. Grants the Federal Trade Commission (FTC) enforcement authority over data brokers. Allows state attorneys general to pursue civil remedies against data brokers who are deemed to pose a threat to state residents.
(Sec. 203) Preempts state regulation of data brokers.
(Sec. 204) Makes the provisions of this title effective 180 days after enactment of this Act.
Timeline
17 Dec 2009
An errata sheet on written report No. 111-110 was printed.
Common questions
- What does S. 1490 do?
- This bill, S. 1490, the Personal Data Privacy and Security Act of 2009, aims to enhance protections against identity theft and the misuse of personal information. It would establish new criminal penalties for intentionally concealing security breaches involving sensitive personally identifiable information. The bill also imposes requirements on "data brokers" – companies that collect and sell personal information – requiring them to disclose data to individuals, help correct inaccuracies, and notify individuals of adverse actions taken by third parties based on their data. Additionally, it mandates that businesses handling large amounts of sensitive personal data implement a privacy and security program and notify individuals of security breaches. The legislation affects individuals by providing them with more control over their personal data and greater transparency from data brokers, as well as mandating notification in case of data breaches. Businesses that handle sensitive personal information, particularly "data brokers," are directly impacted by new disclosure, correction, and notification requirements. Certain financial institutions and healthcare providers are exempt from some data security program requirements. S. 1490 was introduced in the Senate in July 2009 and has been "Ordered Reported" by the Committee on the Judiciary with an amendment. This means the bill has passed committee review and is now ready to be considered by the full Senate. If passed by the Senate, it would then proceed to the House of Representatives for consideration.
- Has S. 1490 become law?
- The source does not supply a confirmed lifecycle stage for S. 1490. Check the latest action and official source below.
- Who sponsored S. 1490?
- S. 1490 was sponsored by Sen. Leahy, Patrick J. [D-VT] (D-VT), with 7 cosponsors.
- What's the latest action on S. 1490?
- An errata sheet on written report No. 111-110 was printed. (17 Dec 2009).
Related bills in Crime and Law Enforcement
Enhancing Detection of Human Trafficking Act
National Coordination Center and Commercial Cyber Capabilities Codification Act
Supporting the goals and ideals of "National Nonviolence Week" to raise awareness of youth violence in the United States.
Anthony Amoros Law Right to Know Act
More bills from Sen. Leahy, Patrick J. [D-VT]
A bill to place restrictions on searches and seizures of electronic devices at the border.
A bill to place restrictions on searches and seizures of electronic devices at the border.
Consumer Privacy Protection Act of 2017
Consumer Privacy Protection Act of 2015
Bill100 mirrors the public U.S. legislative record from Congress.gov and GovTrack and adds plain-English AI summaries. It is an information tool, not legal, compliance or lobbying advice, and it is not affiliated with the U.S. Congress or any government agency. AI summaries can simplify or omit detail — every bill links to the official source; verify there before you rely on it.