Consumer Privacy Protection Act of 2017
The source supplies the latest action, but no lifecycle stage.
Latest action (14 Nov 2017): Read twice and referred to the Committee on the Judiciary. (Sponsor introductory remarks on measure: CR S7215-7216)
What this bill does
This bill, the Consumer Privacy Protection Act of 2017, would establish new federal regulations concerning consumer privacy and data security. It would make it a crime to intentionally hide knowledge of a security breach that leads to at least $1,000 in economic harm to an individual, with penalties including fines and imprisonment. The bill also requires certain businesses to create comprehensive programs to protect sensitive personal information and to notify affected individuals in the event of a security breach, offering identity theft prevention services.
The bill affects commercial entities that handle sensitive personally identifiable information for 10,000 or more U.S. residents annually. These entities would need to implement specific safeguards, conduct risk assessments, and provide notifications after breaches. Law enforcement agencies like the Secret Service and FBI would be authorized to investigate violations, and the Department of Justice, the Federal Trade Commission, and state attorneys general could bring civil actions. Financial institutions and entities regulated by HIPAA would be exempt if they meet certain existing data security requirements.
As of its introduction in November 2017, the bill had been referred to the Senate Committee on the Judiciary. From this point, it would need to be considered and potentially amended by the committee. If passed by the committee, it would then proceed to the full Senate for a vote. Should it pass the Senate, it would then move to the House of Representatives for a similar process.
Plain-English summary generated by Bill100 AI from the official record. Always verify against the source below.
Official summary
Consumer Privacy Protection Act of 2017
This bill amends the federal criminal code to make it a crime to intentionally and willfully conceal knowledge of a security breach that results in economic harm of at least $1,000 to any individual.
It imposes criminal penalties on a violator and authorizes the U.S. Secret Service and the Federal Bureau of Investigation to investigate offenses.
The bill authorizes the Department of Justice (DOJ) to file a civil action: (1) to prevent ongoing conduct that damages 100 or more protected computers (e.g., government computers); and (2) to prevent the disposition of unlawfully obtained property.
The bill also adds to the list of money laundering predicate offenses financial transactions that involve proceeds of unlawful manufacturing, distribution, possession, and advertising of wire, oral, or electronic communication intercepting devices.
Finally, the bill requires certain commercial entities to implement a comprehensive consumer privacy and data security program.
Following the discovery of a security breach of sensitive personally identifiable information (PII), a commercial entity must notify an affected U.S. resident and provide identify theft prevention and mitigation services. Sensitive PII is information that identifies a particular person, including electronic or digital forms of personal, financial, health, and biometric data, geographic location, and password-protected photographs and videos.
It establishes civil penalties for violations and authorizes DOJ, the Federal Trade Commission, and states to enforce compliance.
Timeline
14 Nov 2017
Read twice and referred to the Committee on the Judiciary. (Sponsor introductory remarks on measure: CR S7215-7216)
Common questions
- What does S. 2124 do?
- This bill, the Consumer Privacy Protection Act of 2017, would establish new federal regulations concerning consumer privacy and data security. It would make it a crime to intentionally hide knowledge of a security breach that leads to at least $1,000 in economic harm to an individual, with penalties including fines and imprisonment. The bill also requires certain businesses to create comprehensive programs to protect sensitive personal information and to notify affected individuals in the event of a security breach, offering identity theft prevention services. The bill affects commercial entities that handle sensitive personally identifiable information for 10,000 or more U.S. residents annually. These entities would need to implement specific safeguards, conduct risk assessments, and provide notifications after breaches. Law enforcement agencies like the Secret Service and FBI would be authorized to investigate violations, and the Department of Justice, the Federal Trade Commission, and state attorneys general could bring civil actions. Financial institutions and entities regulated by HIPAA would be exempt if they meet certain existing data security requirements. As of its introduction in November 2017, the bill had been referred to the Senate Committee on the Judiciary. From this point, it would need to be considered and potentially amended by the committee. If passed by the committee, it would then proceed to the full Senate for a vote. Should it pass the Senate, it would then move to the House of Representatives for a similar process.
- Has S. 2124 become law?
- The source does not supply a confirmed lifecycle stage for S. 2124. Check the latest action and official source below.
- Who sponsored S. 2124?
- S. 2124 was sponsored by Sen. Leahy, Patrick J. [D-VT] (D-VT), with 7 cosponsors.
- What's the latest action on S. 2124?
- Read twice and referred to the Committee on the Judiciary. (Sponsor introductory remarks on measure: CR S7215-7216) (14 Nov 2017).
Related bills in Crime and Law Enforcement
Enhancing Detection of Human Trafficking Act
National Coordination Center and Commercial Cyber Capabilities Codification Act
Anthony Amoros Law Right to Know Act
Supporting the goals and ideals of "National Nonviolence Week" to raise awareness of youth violence in the United States.
More bills from Sen. Leahy, Patrick J. [D-VT]
A bill to place restrictions on searches and seizures of electronic devices at the border.
A bill to place restrictions on searches and seizures of electronic devices at the border.
Consumer Privacy Protection Act of 2015
Personal Data Privacy and Security Act of 2014
Bill100 mirrors the public U.S. legislative record from Congress.gov and GovTrack and adds plain-English AI summaries. It is an information tool, not legal, compliance or lobbying advice, and it is not affiliated with the U.S. Congress or any government agency. AI summaries can simplify or omit detail — every bill links to the official source; verify there before you rely on it.