Personal Data Protection and Breach Accountability Act of 2014
The source supplies the latest action, but no lifecycle stage.
Latest action (4 Feb 2014): Read twice and referred to the Committee on the Judiciary.
What this bill does
Senate bill S. 1995, the Personal Data Protection and Breach Accountability Act of 2014, would establish new federal requirements for companies that collect, store, or handle sensitive personal information, aiming to reduce data breaches and improve accountability when they occur. The bill would create a mandatory "data privacy and security program" for business entities handling data on 10,000 or more U.S. persons, requiring administrative, technical, and physical safeguards, with enforcement by the Federal Trade Commission, state attorneys general, and, in some cases, individuals. It would also set nationwide standards for notifying consumers, credit reporting agencies, and law enforcement after a security breach, establish a clearinghouse for sharing post-breach technical information among companies, and create new criminal penalties—including fines and up to five years in prison—for knowingly concealing a breach or for secretly redirecting or monitoring a user's internet searches for profit.
The bill would primarily affect businesses that collect large amounts of personal data (with some exemptions, such as certain financial institutions already regulated under the Gramm-Leach-Bliley Act), as well as consumers whose personal information could be exposed in a breach. It also directs federal agencies, including the General Services Administration, FBI, and Department of Justice, to review government contracts, audit contractors' security practices, and report on breach notifications and enforcement.
The bill was introduced by Senator Richard Blumenthal (D-CT), with Senator Edward Markey as a cosponsor, on February 4, 2014, and referred to the Senate Judiciary Committee. It did not receive a vote and did not advance further in the 113th Congress.
Plain-English summary generated by Bill100 AI from the official record. Always verify against the source below.
Official summary
Personal Data Protection and Breach Accountability Act of 2014 - Title I: Enhancing Punishment for Identity Theft and Other Violations of Data Privacy and Security - Amends the federal criminal code to impose a fine and/or prison term of up to five years for intentionally or willfully concealing a security breach involving sensitive personally identifiable information when such breach results in economic harm or substantial emotional distress to one or more persons.
Makes it unlawful for a service provider to knowingly or intentionally redirect web searches or otherwise monitor, manipulate, aggregate, and market data from websites without the consent of the Internet user. Imposes a civil fine of up to $500,000 for a violation of this provision and an increased fine of up to $1 million for engaging in a pattern or practice of activity that violates this provision.
Title II: Privacy and Security of Sensitive Personally Identifiable Information - Makes any interstate business entity that collects, accesses, transmits, uses, stores, or disposes of sensitive personally identifiable information on 10,000 or more U.S. persons subject to the requirements for a data privacy and security program under this Act. Exempts public records not otherwise subject to a confidentiality or nondisclosure requirement, certain financial institutions subject to the Gramm-Leach-Bliley Act, business entities subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and service providers exclusively engaged in the transmission, routing, or storage of data.
Requires business entities that are subject to personal data privacy and security requirements of this Act to implement a comprehensive program that: (1) ensures the privacy, security, and confidentiality of sensitive personally identifiable information; (2) protects against any anticipated vulnerabilities to the privacy, security, or integrity of such information; and (3) protects against unauthorized access to such information that could create a significant risk of harm.
Requires such entities to: (1) assess risks of future security breaches and design a personal data privacy and security program to control such risks; (2) ensure employee training for implementing a security program; (3) ensure regular testing of key controls, systems, and procedures of such program; and (4) monitor, evaluate, and adjust the security program to reflect relevant changes in technology and other considerations.
Authorizes the Attorney General to bring a civil action or request injunctive relief against any business entity that violates the requirements of this title and obtain fines against such entity for violations, including enhanced penalties for intentional or willful violations.
Authorizes a state attorney general to bring a civil action or request injunctive relief against a business entity that adversely threatens or affects the residents of the state by violating the requirements of this title.
Allows individuals aggrieved by a violation of the data privacy and security requirements of this title to bring a civil action to recover for personal injuries sustained as a result of such violation. Allows punitive damages against a business entity that intentionally or willfully violates the provisions of this title.
Timeline
4 Feb 2014
Read twice and referred to the Committee on the Judiciary.
Common questions
- What does S. 1995 do?
- Senate bill S. 1995, the Personal Data Protection and Breach Accountability Act of 2014, would establish new federal requirements for companies that collect, store, or handle sensitive personal information, aiming to reduce data breaches and improve accountability when they occur. The bill would create a mandatory "data privacy and security program" for business entities handling data on 10,000 or more U.S. persons, requiring administrative, technical, and physical safeguards, with enforcement by the Federal Trade Commission, state attorneys general, and, in some cases, individuals. It would also set nationwide standards for notifying consumers, credit reporting agencies, and law enforcement after a security breach, establish a clearinghouse for sharing post-breach technical information among companies, and create new criminal penalties—including fines and up to five years in prison—for knowingly concealing a breach or for secretly redirecting or monitoring a user's internet searches for profit. The bill would primarily affect businesses that collect large amounts of personal data (with some exemptions, such as certain financial institutions already regulated under the Gramm-Leach-Bliley Act), as well as consumers whose personal information could be exposed in a breach. It also directs federal agencies, including the General Services Administration, FBI, and Department of Justice, to review government contracts, audit contractors' security practices, and report on breach notifications and enforcement. The bill was introduced by Senator Richard Blumenthal (D-CT), with Senator Edward Markey as a cosponsor, on February 4, 2014, and referred to the Senate Judiciary Committee. It did not receive a vote and did not advance further in the 113th Congress.
- Has S. 1995 become law?
- The source does not supply a confirmed lifecycle stage for S. 1995. Check the latest action and official source below.
- Who sponsored S. 1995?
- S. 1995 was sponsored by Sen. Blumenthal, Richard [D-CT] (D-CT), with 1 cosponsor.
- What's the latest action on S. 1995?
- Read twice and referred to the Committee on the Judiciary. (4 Feb 2014).
Related bills in Commerce
Critical Infrastructure Manufacturing Feasibility Act
Cybersecurity for Small Businesses Act of 2026
Small Business Payment for Performance Act of 2026
Combating Foreign Threats to Main Street Act of 2026
More bills from Sen. Blumenthal, Richard [D-CT]
Judicial Ethics Enforcement Act of 2026
Veterans Crisis Line Support and Safety Act of 2026
Military Officer Promotion Integrity Act of 2026
A bill to designate Ukraine under section 244 of the Immigration and Nationality Act to provide certain nationals of Ukraine with continued eligibility for temporary protected status, and for other purposes.
Bill100 mirrors the public U.S. legislative record from Congress.gov and GovTrack and adds plain-English AI summaries. It is an information tool, not legal, compliance or lobbying advice, and it is not affiliated with the U.S. Congress or any government agency. AI summaries can simplify or omit detail — every bill links to the official source; verify there before you rely on it.