Personal Data Protection and Breach Accountability Act of 2011

Personal Data Protection and Breach Accountability Act of 2011 - Title I: Enhancing Punishment for Identity Theft and Other Violations of Data Privacy and Security - (Sec. 101) Amends the federal criminal code to impose a fine and/or prison term of up to five years for intentionally or willfully concealing a security breach involving sensitive personally identifiable information when such breach results in economic harm or substantial emotional distress to one or more persons.

(Sec. 102) Makes it unlawful for a service provider, as defined by this Act, to knowingly or intentionally redirect web searches or otherwise monitor, manipulate, aggregate, and market data from websites without the consent of the Internet user. Imposes a civil fine of up to $500,000 for a violation of this provision and an increased fine of up to $1 million for engaging in a pattern or practice of activity that violates this provision.

Title II: Privacy and Security of Sensitive Personally Identifiable Information - Subtitle A: Data Privacy and Security Program - (Sec. 201) Makes any interstate business entity that collects, accesses, transmits, uses, stores, or disposes of sensitive personally identifiable information on 10,000 or more U.S. persons subject to the requirements for a data privacy and security program under this Act. Exempts public records not otherwise subject to a confidentiality or nondisclosure requirement, certain financial institutions subject to the Gramm-Leach-Bliley Act, business entities subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and service providers exclusively engaged in the transmission, routing, or storage of data.

(Sec. 202) Requires business entities that are subject to personal data privacy and security requirements of this Act to implement a comprehensive program that: (1) ensures the privacy, security, and confidentiality of sensitive personally identifiable information; (2) protects against any anticipated vulnerabilities to the privacy, security, or integrity of such information; and (3) protects against unauthorized access to such information that could create a significant risk of harm.

Requires such entities to: (1) assess risks of future security breaches and design a personal data privacy and security program to control such risks; (2) ensure employee training for implementing a security program; (3) ensure regular testing of key controls, systems, and procedures of such program; and (4) monitor, evaluate, and adjust the security program to reflect relevant changes in technology and other considerations.

(Sec. 203) Authorizes the Attorney General to bring a civil action or request injunctive relief against any business entity that violates the requirements of this subtitle and obtain fines against such entity for violations, including enhanced penalties for intentional or willful violations.

(Sec. 204) Authorizes a state attorney general to bring a civil action or request injunctive relief against a business entity that adversely threatens or affects the residents of the state by violating the requirements of this subtitle.

(Sec. 205) Allows individuals aggrieved by a violation of the data privacy and security requirements of this subtitle to bring a civil action to recover for personal injuries sustained as a result of such violation. Allows punitive damages against a business entity that intentionally or willfully violates the provisions of this subtitle.