Commercial Privacy Bill of Rights Act of 2014

Title I: Commercial Privacy - Commercial Privacy Bill of Rights Act of 2014 - Directs the Federal Trade Commission (FTC) to initiate a rulemaking to require covered entities to carry out security measures to protect personally identifiable information, unique identifier information, and other information that may be used to identify a specific individual.

Defines "covered entity" as a person (a person, partnership, or corporation over which the FTC has authority under the Federal Trade Commission Act, a common carrier subject to the Communications Act of 1934, or a nonprofit organization) who collects, uses, transfers, or stores such information concerning more than 5,000 individuals during any consecutive 12-month period. Directs the FTC to require covered entities to: (1) notify individuals of their practices regarding the collection, use, transfer, and storage of such information; (2) provide timely notice before implementing a material change in such practices; (3) offer individuals a mechanism to provide opt-in consent for any unauthorized use of such information or a third party's use for behavioral advertising or marketing; and (4) provide access to, and methods to correct, stored information.

Permits covered entities to execute contracts with service providers to collect, use, and store information on behalf of the covered entity.

Restricts covered entities to the collection of only as much information relating to an individual as reasonably necessary to: (1) process or enforce a transaction or deliver a requested service, including inventory management, financial reporting and accounting, planning, product or service improvement, forecasting, and customer support; (2) prevent or detect fraud or provide for a secure environment; (3) investigate a possible crime or comply with a law; (4) market or advertise to such individual if the information used for such marketing or advertising was collected directly by the covered entity; and (5) conduct internal operations and customer research, including the collection of information about Internet website visits and click-through rates to improve website navigation and the customer's experience.

Limits the duration of time that a covered entity is authorized to retain such information to only the period necessary to provide the transaction, deliver the service, or comply with a law. Restricts the use of retained information to the purpose for which it was collected or a reasonably related purpose.

Directs covered entities that contract to transfer information to third parties to prohibit such third parties from combining transferred information that is not personally identifiable with other information in order to identify the individual without the individual's opt-in consent.

Requires covered entities to attempt to establish procedures to ensure the accuracy of personally identifiable information that could be used to deny consumers benefits or cause significant harm.

Sets forth the circumstances under which a covered entity may be required to provide notice of a breach of security to: (1) U.S. citizens or residents whose personally identifiable information is reasonably believed to have been acquired or accessed, (2) the FTC, (3) third parties, (4) service providers, and (5) credit reporting agencies.