Summary: Personal Data Privacy and Security Act of 2011 - (Sec. 3) Defines "sensitive personally identifiable information" for purposes of this Act to include: (1) specified combinations of data elements in electronic or digital form, such as an individual's first and last name or first initial and last name in combination with home address or telephone number, mother's maiden name, and date of birth; (2) a non-truncated social security number, driver's license number, passport number, or government-issued unique identification number; (3) unique biometric data, such as a fingerprint, voice print, retina or iris image, or other unique physical representation; (4) a unique account identifier; and (5) any security code, access code, password, or secure code that could be used to generate such codes or passwords. Title I: Enhancing Punishment for Identity Theft and Other Violations of Data Privacy and Security - (Sec. 101) Amends the federal criminal code to make fraud in connection with the unauthorized access of personally identifiable information (in electronic or digital form) a predicate for instituting a prosecution for racketeering. (Sec. 102) Imposes a prison term of up to five years and/or a fine on any individual who has knowledge of and intentionally and willfully conceals a security breach and such breach results in economic harm  of $1,000 or more to any individual. Grants the U.S. Secret Service and the Federal Bureau of Investigation (FBI) authority to investigate criminal concealments of security breaches. (Sec. 103) Increases penalties for fraud and related activity in connection with computers. (Sec. 104) Expands the prohibition against trafficking in passwords to include trafficking through any means by which a protected computer may be accessed without authorization. (Sec. 105) Imposes criminal penalties for attempts and conspiracies to commit fraud and related activity in connection with computers. (Sec. 106) Modifies criminal and civil forfeiture provisions, including requiring certain civil forfeiture seizures and forfeitures to be performed by persons designated for that purpose by the Secretary of Homeland Security (DHS) or the Attorney General (DOJ). (Sec. 107) Prohibits civil actions involving unauthorized use of a protected computer if a violation of a contractual obligation or agreement, such as an acceptable use policy or terms of service agreement, constitutes the sole basis for determining that access to the computer is unauthorized or in excess of authorization. (Sec. 108) Directs the Attorney General to report the number of criminal cases that involve conduct in which: (1) the defendant exceeded authorized access to a nongovernmental computer or accessed a nongovernmental computer without authorization; and (2) the sole basis for such a determination was that the defendant violated a contractual obligation or agreement with a service provider or employer, such as an acceptable use policy or terms of service agreement. (Sec. 109) Prohibits, during and in relation to a felony violation of provisions regarding fraud and related activity in connection with computers, intentionally causing or attempting to cause damage to a critical infrastructure computer if such damage results in (or, in the case of an attempt, would, if completed have resulted in) the substantial impairment of the operation of that computer or of the critical infrastructure associated with the computer. Imposes a prison term of between 3 and 20 years, a fine, or both. Prohibits probation for any person convicted of such a violation. Provides for concurrent sentences under specified circumstances. (Sec. 110) Excludes from the definition of "exceeds authorized access" for purposes of the prohibition against fraudulent use of computers, access in violation of a contractual obligation or agreement, such as an acceptable use policy or terms of service agreement, with an Internet service provider, Internet website, or nongovernment employer, if such violation constitutes the sole basis for determining that access to a protected computer is unauthorized. Title II: Privacy and Security of Personally Identifiable Information - Subtitle A: A Data Privacy and Security Program - (Sec. 201) States that the purpose of this subtitle is to ensure the establishment of standards for developing and implementing safeguards to protect the security of sensitive personally identifiable information. Subjects a business entity engaging in interstate commerce that involves collecting, accessing, transmitting, using, storing, or disposing of sensitive information in electronic or digital form on 10,000 or more U.S. persons to the requirements for the data privacy and security program established by this subtitle. Makes this subtitle inapplicable to: (1) financial institutions subject to the data security requirements and standards under the Gramm-Leach-Bliley Act; (2) specified entities subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA); (3) service providers for any electronic communication by a third-party to the extent that such provider is exclusively engaged in the transmission, routing, or temporary, intermediate, or transient storage of that communication; and (4) public records not otherwise subject to a confidentiality or nondisclosure requirement. Deems a business entity to be in compliance with the privacy and security program requirements of this subtitle if the entity complies with or provides protection equal to industry standards or standards widely accepted as an effective industry practice, as identified by the Federal Trade Commission (FTC), that are applicable to the type of sensitive information involved in the ordinary course of business of such entity. (Sec. 202) Requires a business entity subject to this subtitle to comply with specified safeguards identified by the FTC in a rulemaking process for the protection of sensitive personally identifiable information. Requires such entity to implement a comprehensive personal data privacy and security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity of the entity and the nature and scope of its activities. Requires the program to be designed to: (1) ensure the privacy, security, and confidentiality of sensitive information; (2) protect against any anticipated vulnerabilities to the privacy, security, or integrity of such information; and (3) protect against unauthorized access to use of such information that could create a significant risk of harm or fraud to any individual. Requires a business entity subject to the requirements of this subtitle to: (1) identify reasonably foreseeable internal and external vulnerabilities that could result in unauthorized access, disclosure, use, or alteration of sensitive information or systems containing such information; (2) assess the likelihood of and potential damage from unauthorized access to, or disclosure, use, or alteration of, sensitive information; (3) assess the sufficiency of its policies, technologies, and safeguards in place to control and minimize risks from unauthorized access, disclosure, use, or alteration of sensitive information; (4) assess the vulnerability of sensitive information during destruction and disposal of such information, including through the disposal or retirement of hardware; (5) design its personal data privacy and security program to control risks; (6) adopt measures commensurate with the sensitivity of the data as well as the size, complexity, and scope of activities of the business entity that control access to systems and facilities containing sensitive information; (7) establish a plan and procedures for minimizing the amount of sensitive information maintained by a business entity; and (8) take steps to ensure appropriate employee training and regular testing of key controls, systems, and procedures of the entity's personal data privacy and security program. (Sec. 203) Imposes civil penalties upon business entities for violations of the requirements of this subtitle, up to $5,000 per violation per day, with a maximum of $500,000 per violation. Provides additional penalties for intentional or willful violations. Allows an injunction against a business entity to stop continuing violations of the requirements of this subtitle. Grants authority to the FTC to enforce the requirements of this subtitle. Authorizes state attorneys general and law enforcement agencies to bring civil actions to protect state residents against business entities that are violating the requirements of this subtitle.  Requires states to give advance notice to the FTC of the filing of any civil action. (Sec. 204) Preempts state laws relating to administrative, technical, and physical safeguards for the protection of personal information. Subtitle B: Security Breach Notification - (Sec. 211) Requires any agency or business entity engaged in interstate commerce that uses, accesses, transmits, stores, disposes of, or collects sensitive personally identifiable information to notify without unreasonable delay, after the discovery of a security breach, any U.S. resident whose information has been, or is reasonably believed to have been, accessed or acquired. Allows the Secret Service or the FBI to delay notification of a security breach if such notification would impede a criminal investigation or harm national security. Makes this subtitle inapplicable to: (1) financial institutions subject to the data security requirements and standards under the Gramm-Leach-Bliley Act, and (2) specified entities subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA). (Sec. 212) Allows exemptions from security breach notification requirements if: (1) the Secret Service or the FBI determines that notification of the security breach could be expected to reveal sensitive sources and methods or similarly impede the government's ability to conduct law enforcement investigations, or (2) the FBI determines that notification of the breach could be expected to damage national security. States that no non-constitutional cause of action shall lie in any court against a federal agency for acts relating to the exemption from notification for law enforcement or national security purposes under this title. Provides that an agency or business entity shall be exempt from notice requirements if: (1) a risk assessment concludes that there is no significant risk that a security breach has resulted in, or will result in, identity theft, economic loss or harm, or physical harm to the individuals whose sensitive information was subject to the security breach; (2) without unreasonable delay, but not later than 45 days after the discovery of the breach (unless extended by the FTC), the agency or entity notifies the FTC in writing of the results of the risk assessment and its decision to invoke the risk assessment exemption; and (3) the FTC does not indicate, within 10 business days from receipt of the decision, that notice should be given. Provides that a business entity will be exempt from notice requirements if it utilizes or participates in a security program that: (1) effectively blocks the use of the sensitive information to initiate unauthorized financial transactions before they are charged to the individual's account, and (2) provides for notice to affected individuals after a security breach that has resulted in fraud or unauthorized transactions. (Sec. 213) Provides for individual notice by mail, telephone, and e-mail of a security breach and for notice to major media outlets serving a state or jurisdiction if a security breach involves more than 5,000 individuals. (Sec. 214) Specifies the required content of a notification of a security breach under this subtitle, including the toll-free telephone numbers of the agencies or business entities involved, addresses for the major credit reporting agencies, and information about availability of victim protection assistance. (Sec. 215) Requires an agency or business entity that is required to provide notification of a data security breach involving more than 5,000 individuals to also provide notification to credit reporting agencies. (Sec. 216) Directs the DHS Secretary to designate a federal entity to receive the notices required under this subtitle. Requires business entities and federal agencies to report data security breaches to the designated entity if the breach involves: (1) more than 5,000 individuals, (2) a database that contains information about more than 500,000 individuals, (3) a federal government database, or (4) individuals known to be federal employees or contractors involved in national security or law enforcement. Requires the designated agency to report information it receives about security breaches to the Secret Service, FBI, and FTC for civil law enforcement purposes as promptly as possible, but either 72 hours before notice of a breach is required to be provided to an individual or not later than 10 days after the breach is discovered, whichever occurs first. (Sec. 217) Authorizes the Attorney General and the FTC to bring civil and administrative actions against business entities for violations of this subtitle and to seek injunctive relief or civil penalties, including increased penalties for willful or intentional violations. Imposes limitations on such penalties. (Sec. 218) Authorizes state attorneys general or state or local law enforcement agencies to bring a civil action on behalf of state residents who have been threatened or adversely affected by a business entity violating provisions of this subtitle and obtain injunctive relief or civil penalties. Requires a state attorney general bringing a civil action to provide written notice to the Attorney General who may then move to stay the action, move to consolidate all pending actions, intervene, and file petitions for appeal. (Sec. 219) Provides that the security breach notification provisions of this subtitle supersede other provisions of federal law, with specified exceptions, and state laws relating to notification of a security breach. (Sec. 220) Directs the FTC, not later than 18 months after the enactment of this Act, to report on the number and nature of the security breaches described in notices filed by business entities invoking the risk assessment exemption under this subtitle and their response to such notices. Directs the Secret Service and FBI, not later than 18 months after the enactment of this Act, to report on the number and nature of security breaches subject to the national security and law enforcement exemptions under this subtitle. Excludes from such report the contents of any risk assessment provided to the Secret Service and the FBI under this subtitle. Title III: Compliance with Statutory Pay-As-You-Go Act - Provides that the budgetary effects of this Act, for the purpose of complying with the Statutory Pay-As-You-Go Act of 2010, shall be determined by reference to the latest statement titled "Budgetary Effects of PAYGO Legislation" for this Act, provided that such statement has been submitted prior to the vote on passage.

sec defines sensitive personally identifiable information purposes act include specified combinations data elements electronic digital form individual initial combination home address telephone number mother maiden date birth non truncated social security number driver license number passport number government issued unique identification number unique biometric data fingerprint voice print image unique physical representation unique account identifier security code access code password secure code generate codes passwords title enhancing punishment identity theft violations data privacy security sec amends federal criminal code fraud connection unauthorized access personally identifiable information electronic digital form predicate instituting prosecution racketeering sec imposes prison term years fine individual knowledge intentionally willfully conceals security breach breach results economic harm individual grants federal_bureau_of_investigation fbi authority investigate criminal security breaches sec increases penalties fraud related activity connection computers sec expands prohibition trafficking passwords include trafficking means protected computer accessed authorization sec imposes criminal penalties attempts conspiracies commit fraud related activity connection computers sec modifies criminal civil forfeiture provisions including requiring certain civil forfeiture seizures forfeitures performed persons designated purpose secretary homeland_security dhs attorney general doj sec prohibits civil actions involving unauthorized use protected computer violation contractual obligation agreement acceptable use policy terms service agreement constitutes sole basis determining access computer unauthorized excess authorization sec directs attorney general report number criminal cases involve conduct defendant exceeded authorized access nongovernmental computer accessed nongovernmental computer authorization sole basis determination defendant violated contractual obligation agreement service provider employer acceptable use policy terms service agreement sec prohibits relation felony violation provisions fraud related activity connection computers intentionally causing attempting cause damage critical infrastructure computer damage results case attempt completed resulted substantial impairment operation computer critical infrastructure associated computer imposes prison term years fine prohibits probation person convicted violation provides concurrent sentences specified circumstances sec excludes definition exceeds authorized access purposes prohibition fraudulent use computers access violation contractual obligation agreement acceptable use policy terms service agreement internet service provider internet website nongovernment employer violation constitutes sole basis determining access protected computer unauthorized title privacy security personally identifiable information subtitle sec states purpose subtitle ensure establishment standards developing implementing safeguards protect security sensitive personally identifiable information subjects business entity engaging interstate commerce involves collecting accessing transmitting storing disposing sensitive information electronic digital form persons requirements data privacy security program established subtitle makes subtitle inapplicable financial institutions subject data security requirements standards gramm leach bliley act specified entities subject health_insurance_portability_and_accountability_act hipaa service providers electronic communication party extent provider exclusively engaged transmission routing temporary intermediate transient storage communication public records subject confidentiality nondisclosure requirement deems business entity compliance privacy security program requirements subtitle entity complies provides protection equal industry standards standards widely accepted effective industry practice identified federal_trade_commission ftc applicable type sensitive information involved ordinary course business entity sec requires business entity subject subtitle comply specified safeguards identified ftc rulemaking process protection sensitive personally identifiable information requires entity implement comprehensive personal data privacy security program includes administrative technical physical safeguards appropriate size complexity entity nature scope activities requires program designed ensure privacy security confidentiality sensitive information protect anticipated vulnerabilities privacy security integrity information protect unauthorized access use information create significant risk harm fraud individual requires business entity subject requirements subtitle identify reasonably foreseeable internal external vulnerabilities result unauthorized access disclosure use alteration sensitive information systems containing information assess likelihood potential damage unauthorized access disclosure use alteration sensitive information assess sufficiency policies technologies safeguards place control minimize risks unauthorized access disclosure use alteration sensitive information assess vulnerability sensitive information destruction disposal information including disposal retirement hardware design personal data privacy security program control risks adopt measures commensurate sensitivity data size complexity scope activities business entity control access systems facilities containing sensitive information establish plan procedures minimizing sensitive information maintained business entity steps ensure appropriate employee training regular testing key controls systems procedures entity personal data privacy security program sec imposes civil penalties business entities violations requirements subtitle violation day maximum violation provides additional penalties intentional willful violations allows injunction business entity stop continuing violations requirements subtitle grants authority ftc enforce requirements subtitle authorizes state attorneys general law enforcement agencies bring civil actions protect state residents business entities violating requirements subtitle requires states advance notice ftc filing civil action sec preempts state laws relating administrative technical physical safeguards protection personal information subtitle security breach notification sec requires agency business entity engaged interstate commerce uses accesses transmits stores disposes collects sensitive personally identifiable information notify unreasonable delay discovery security breach resident information reasonably believed accessed acquired allows secret_service fbi delay notification security breach notification impede criminal investigation harm national security makes subtitle inapplicable financial institutions subject data security requirements standards gramm leach bliley act specified entities subject health_insurance_portability_and_accountability_act hipaa sec allows exemptions security breach notification requirements secret_service fbi determines notification security breach expected reveal sensitive sources methods similarly impede government ability conduct law enforcement investigations fbi determines notification breach expected damage national security states non constitutional cause action shall lie court federal agency acts relating exemption notification law enforcement national security purposes title provides agency business entity shall exempt notice requirements risk assessment concludes significant risk security breach resulted result identity theft economic loss harm physical harm individuals sensitive information subject security breach unreasonable delay later days discovery breach extended ftc agency entity notifies ftc writing results risk assessment decision risk assessment exemption ftc indicate business days receipt decision notice given provides business entity exempt notice requirements utilizes participates security program effectively blocks use sensitive information initiate unauthorized financial transactions charged individual account provides notice affected individuals security breach resulted fraud unauthorized transactions sec provides individual notice mail telephone mail security breach notice major media outlets serving state jurisdiction security breach involves individuals sec specifies required content notification security breach subtitle including toll free telephone numbers agencies business entities involved addresses major credit reporting agencies information availability victim protection assistance sec requires agency business entity required provide notification data security breach involving individuals provide notification credit reporting agencies sec directs dhs secretary designate federal entity receive notices required subtitle requires business entities federal agencies report data security breaches designated entity breach involves individuals database contains information individuals federal government database individuals known federal employees contractors involved national security law enforcement requires designated agency report information receives security breaches secret_service fbi ftc civil law enforcement purposes promptly possible hours notice breach required provided individual later days breach discovered whichever occurs sec authorizes attorney general ftc bring civil administrative actions business entities violations subtitle seek injunctive relief civil penalties including increased penalties willful intentional violations imposes limitations penalties sec authorizes state attorneys general state local law enforcement agencies bring civil action behalf state residents threatened adversely affected business entity violating provisions subtitle obtain injunctive relief civil penalties requires state attorney general bringing civil action provide written notice attorney general stay action consolidate pending actions intervene file petitions appeal sec provides security breach notification provisions subtitle supersede provisions federal law specified exceptions state laws relating notification security breach sec directs ftc later months enactment act report number nature security breaches described notices filed business entities invoking risk assessment exemption subtitle response notices directs secret_service fbi later months enactment act report number nature security breaches subject national security law enforcement exemptions subtitle excludes report contents risk assessment provided secret_service fbi subtitle title iii compliance statutory pay act provides budgetary effects act purpose complying statutory pay act shall determined reference latest statement titled budgetary effects paygo legislation act provided statement submitted prior vote passage


Summary: Data Security and Breach Notification Act of 2011 - Requires the Federal Trade Commission (FTC) to promulgate regulations requiring each covered entity (proprietorships, partnerships, estates, trusts, cooperatives, and nonprofit and for-profit corporations) that owns or possesses data containing personal information to implement policies and procedures regarding information security practices for the treatment and protection of such information. Sets forth additional requirements for information brokers, including requiring brokers to: (1) submit their security policies to the FTC with a notification of a security breach or upon FTC request; (2) establish procedures to assure the accuracy of the information they collect, assemble, or maintain that is personal information or that identifies an individual; (3) provide individuals access to their personal information for review; and (4) correct inaccurate information. Authorizes the FTC to conduct information security practices audits of brokers who have had a security breach or require such brokers to conduct independent audits. Directs the FTC to require information brokers to establish measures that facilitate the auditing or retracing of access to, or transmissions of, any data containing personal information. Makes it unlawful for information brokers to obtain or disclose personal information by false pretenses (pretexting). Establishes procedures in the event of an information security breach. Requires a covered entity that discovers a breach to notify the FTC and affected individuals. Sets forth requirements concerning such notification, including the method of notification requirements and timeliness requirements. Allows an exemption from notification requirements if such entity determines that there is no reasonable risk of identity theft, fraud, or other unlawful conduct. Establishes a presumption that there is no such risk for encrypted data. Applies this Act to nonprofit organizations. Sets forth enforcement provisions.

data_security breach notification act requires federal_trade_commission ftc promulgate regulations requiring covered entity partnerships estates trusts cooperatives nonprofit profit corporations owns possesses data containing personal information implement policies procedures information security practices treatment protection information sets forth additional requirements information brokers including requiring brokers submit security policies ftc notification security breach ftc request establish procedures assure accuracy information collect assemble maintain personal information identifies individual provide individuals access personal information review correct inaccurate information authorizes ftc conduct information security practices audits brokers security breach require brokers conduct independent audits directs ftc require information brokers establish measures facilitate auditing retracing access transmissions data containing personal information makes unlawful information brokers obtain disclose personal information false pretenses pretexting establishes procedures event information security breach requires covered entity discovers breach notify ftc affected individuals sets forth requirements concerning notification including method notification requirements timeliness requirements allows exemption notification requirements entity determines reasonable risk identity theft fraud unlawful conduct establishes presumption risk encrypted data applies act nonprofit organizations sets forth enforcement provisions


Summary: Military Access to Reproductive Care and Health for Military Women Act or the MARCH for Military Women Act - Amends the prohibition on using funds available to the Department of Defense (DOD) to perform abortions by adding an exception for cases where the pregnancy is the result of rape or incest. (Current law provides an exception only where the life of the mother would be endangered if the fetus were carried to term.) Repeals a statutory restriction on using a medical treatment facility or other DOD facility to perform an abortion.

military access reproductive care health military women act march military women act amends prohibition funds available department_of_defense dod perform abortions adding exception cases pregnancy result rape incest current law provides exception life mother endangered fetus carried term repeals statutory restriction medical treatment facility dod facility perform abortion


Summary: Stop Deceptive Advertising for Women's Services Act - Requires the Federal Trade Commission (FTC) to promulgate rules to prohibit, as an unfair and deceptive act or practice, a person from advertising with the intent to deceptively create the impression that: (1) such person is a provider of abortion services if such person does not provide such services, or (2) such person is not a provider of abortion services if such person does provide such services.

stop deceptive advertising women services act requires federal_trade_commission ftc promulgate rules prohibit unfair deceptive act practice person advertising intent deceptively create impression person provider abortion services person provide services person provider abortion services person provide services


Summary: Data Breach Notification Act of 2011 - (Sec. 2) Requires any federal agency or business entity engaged in interstate commerce that uses, accesses, transmits, stores, disposes of, or collects sensitive personally identifiable information, following the discovery of a security breach, to notify: (1) any U.S. resident whose information has been, or is reasonably believed to have been, accessed or acquired; and (2) any owner or licensee of such information. Requires notifications to be made without unreasonable delay following the discovery of a security breach. Allows a delay of notification for law enforcement and national security purposes if written justification for such delay is provided to the Secretary of Homeland Security (DHS) by the U.S. Secret Service and to the Attorney General by the Federal Bureau of Investigation (FBI). (Sec. 3) Exempts agencies or business entities from notification requirements if: (1) the Secret Service or the FBI determines that notification of a security breach could reveal sensitive sources and methods or impede law enforcement or intelligence investigations, or the FBI determines that such notification may damage national security; (2) a risk assessment concludes that there is no significant risk that a security breach has resulted in, or will result in, identity theft, economic loss or harm, or physical harm to individuals whose sensitive personally identifiable information was subject to the security breach; (3) an agency or business entity notifies the Federal Trade Commission (FTC) of intent to invoke a risk assessment exemption; or (4) a business entity participates in a security program that effectively blocks the use of sensitive personally identifiable information and provides for notice to affected individuals of a security breach. (Sec. 4) Requires: (1) written notice of a security breach to individuals by mail, telephone, and e-mail; and (2) notice to major media outlets if a security breach involves more than 5,000 individuals. (Sec. 5) Requires a notification of a security breach to include: (1) a description of the categories of sensitive personally identifiable information acquired by an unauthorized person, (2) a toll-free telephone number for contacting an agency or business entity to ascertain the types of personal information maintained by such agency or entity, and (3) the toll-free telephone numbers and addresses for the major credit reporting agencies. Authorizes a state to require that a notification also include information about victim protection assistance provided by that state. (Sec. 6) Directs an agency or business entity that is required to provide notification to more than 5,000 individuals to also notify all nationwide consumer reporting agencies of the timing and distribution of the notices. (Sec. 7) Requires the DHS Secretary to designate a federal government entity to receive notices of security breaches (designated entity). Requires such designated entity to provide the notices and other information it receives to the Secret Service, the FBI, the FTC, the U.S. Postal Inspection Service (if fraud is involved), state attorneys general, and other federal law enforcement agencies. Requires any business entity or agency to notify the designated entity of a security breach if: (1) the number of individuals whose sensitive personally identifying information was acquired by an unauthorized person exceeds 10,000, (2) the breach involves a data system containing information on more than 1 million individuals nationwide, (3) the breach involves databases owned by the federal government, or (4) the breach involves primarily sensitive personally identifiable information of individuals known to be employees and contractors of the federal government involved in national security or law enforcement. (Sec. 8) Authorizes the Attorney General to bring civil and administrative actions against business entities for violations of this Act and to seek injunctive relief or civil penalties, including increased penalties for willful or intentional violations. (Sec. 9) Authorizes state attorneys general or state or local law enforcement agencies to bring a civil action on behalf of state residents who have been threatened or adversely affected by a business entity violating provisions of this Act and to obtain injunctive relief or civil penalties. Requires a state attorney general bringing a civil action to provide written notice to the Attorney General who may then move to stay the action, move to consolidate all pending actions, intervene, and file petitions for appeal. (Sec. 10) Amends the federal criminal code to impose a prison term of up to five years and/or a fine on any individual who has knowledge of a security breach and intentionally and willfully conceals such breach, resulting in economic harm of $1,000 or more to any individual. Grants the Secret Service and the FBI authority to investigate criminal concealments of security breaches. (Sec. 11) Provides that this Act shall supersede any other provision of federal law (except the data security requirements of the Gramm-Leach-Bliley Act and certain health privacy provisions) or state law relating to notification by an interstate business entity or agency of a security breach. (Sec. 12) Authorizes appropriations for the cost of investigations, risk assessments, and civil actions relating to security breaches under this Act. (Sec. 13) Directs the FTC, not later than 18 months after the enactment of this Act, to report on: (1) the number and nature of the security breaches described in notices filed by business entities invoking the risk assessment exemption under this Act, and (2) the response of the FTC to such notices. Excludes from such report the contents of any risk assessment provided to the FTC. Directs the Secret Service and FBI, not later than 18 months after the enactment of this Act, to report on the number and nature of security breaches subject to the national security and law enforcement exemptions under this Act. (Sec. 14) Sets forth definitions for purposes of this Act, including a definition of "sensitive personally identifiable information."

data breach notification act sec requires federal agency business entity engaged interstate commerce uses accesses transmits stores disposes collects sensitive personally identifiable information following discovery security breach notify resident information reasonably believed accessed acquired owner licensee information requires notifications unreasonable delay following discovery security breach allows delay notification law enforcement national security purposes written justification delay provided secretary homeland_security dhs attorney general federal_bureau_of_investigation fbi sec exempts agencies business entities notification requirements secret_service fbi determines notification security breach reveal sensitive sources methods impede law enforcement intelligence investigations fbi determines notification damage national security risk assessment concludes significant risk security breach resulted result identity theft economic loss harm physical harm individuals sensitive personally identifiable information subject security breach agency business entity notifies federal_trade_commission ftc intent risk assessment exemption business entity participates security program effectively blocks use sensitive personally identifiable information provides notice affected individuals security breach sec requires written notice security breach individuals mail telephone mail notice major media outlets security breach involves individuals sec requires notification security breach include description categories sensitive personally identifiable information acquired unauthorized person toll free telephone number contacting agency business entity ascertain types personal information maintained agency entity toll free telephone numbers addresses major credit reporting agencies authorizes state require notification include information victim protection assistance provided state sec directs agency business entity required provide notification individuals notify nationwide consumer reporting agencies timing distribution notices sec requires dhs secretary designate federal government entity receive notices security breaches designated entity requires designated entity provide notices information receives secret_service fbi ftc fraud involved state attorneys general federal law enforcement agencies requires business entity agency notify designated entity security breach number individuals sensitive personally identifying information acquired unauthorized person exceeds breach involves data system containing information million individuals nationwide breach involves databases owned federal government breach involves primarily sensitive personally identifiable information individuals known employees contractors federal government involved national security law enforcement sec authorizes attorney general bring civil administrative actions business entities violations act seek injunctive relief civil penalties including increased penalties willful intentional violations sec authorizes state attorneys general state local law enforcement agencies bring civil action behalf state residents threatened adversely affected business entity violating provisions act obtain injunctive relief civil penalties requires state attorney general bringing civil action provide written notice attorney general stay action consolidate pending actions intervene file petitions appeal sec amends federal criminal code impose prison term years fine individual knowledge security breach intentionally willfully conceals breach resulting economic harm individual fbi authority investigate criminal security breaches sec provides act shall supersede provision federal law data security requirements gramm leach bliley act certain health privacy provisions state law relating notification interstate business entity agency security breach sec authorizes appropriations cost investigations risk assessments civil actions relating security breaches act sec directs ftc later months enactment act report number nature security breaches described notices filed business entities invoking risk assessment exemption act response ftc notices excludes report contents risk assessment provided ftc directs secret_service fbi later months enactment act report number nature security breaches subject national security law enforcement exemptions act sec sets forth definitions purposes act including definition sensitive personally identifiable information


Summary: Hyde and Related Amendments Codification Act- Prohibits the expenditure of funds authorized or appropriated by federal law or funds in any trust fund to which funds are authorized or appropriated by federal law (federal funds) for any abortion.Prohibits federal funds from being used for any health benefits coverage that includes coverage of abortion. (Currently, federal funds cannot be used for abortion services and plans receiving federal funds must keep federal funds segregated from any funds for abortion services.) Prohibits the inclusion of abortion in any health care service furnished by a federal or District of Columbia health care facility or by any physician or other individual employed by the federal government or the District. Excludes from such prohibitions an abortion if: (1) the pregnancy is the result of rape or incest; or (2) the woman suffers from a physical disorder, injury, or illness, including a life-endangering physical condition caused by or arising from the pregnancy itself, that would place her in danger of death unless an abortion is performed, as certified by a physician. Makes such prohibitions applicable to District of Columbia funds. Codifies the prohibition against a federal agency or program or any state or local government that receives federal financial assistance from subjecting any individual or health care entity to discrimination on the basis that the health care entity does not provide, pay for, provide coverage of, or refer for abortions. Creates a cause of action for any violations of such provisions. Gives federal courts jurisdiction to prevent and redress actual or threatened violations of such provisions by issuing any form of legal or equitable relief, including an injunction or order preventing the disbursement of all or a portion of federal financial assistance until the prohibited conduct has ceased. Gives standing to institute an action to affected health care entities and the Attorney General. Requires the Secretary of Health and Human Services to designate the Director of the Office for Civil Rights of the Department of Health and Human Services (HHS) to receive, investigate, and refer to the appropriate federal agency complaints alleging a violation of such provisions.

hyde related amendments codification act- prohibits expenditure funds authorized appropriated federal law funds trust fund funds authorized appropriated federal law federal funds abortion prohibits federal funds health benefits coverage includes coverage abortion currently federal funds abortion services plans receiving federal funds federal funds segregated funds abortion services prohibits inclusion abortion health care service furnished federal district_of_columbia health care facility physician individual employed federal government district excludes prohibitions abortion pregnancy result rape incest woman suffers physical disorder injury illness including life endangering physical condition caused arising pregnancy place danger death abortion performed certified physician makes prohibitions applicable district_of_columbia funds codifies prohibition federal agency program state local government receives federal financial assistance subjecting individual health care entity discrimination basis health care entity provide pay provide coverage refer abortions creates cause action violations provisions gives federal courts jurisdiction prevent redress actual threatened violations provisions issuing form legal equitable relief including injunction order preventing disbursement portion federal financial assistance prohibited conduct ceased gives standing institute action affected health care entities attorney general requires secretary health_and_human_services designate director office_for_civil_rights_of_the_department_of_health_and_human_services hhs receive investigate refer appropriate federal agency complaints alleging violation provisions


Summary: Hyde Amendment Codification Act - Prohibits the expenditure of funds authorized or appropriated by federal law or funds in any trust fund to which funds are authorized or appropriated by federal law (federal funds) for any abortion.Prohibits federal funds from being used for any health benefits coverage that includes coverage of abortion. (Currently, federal funds cannot be used for abortion services and plans receiving federal funds must keep federal funds segregated from any funds for abortion services.) Excludes from such prohibitions an abortion if: (1) the pregnancy is the result of rape or incest; or (2) the woman suffers from a physical disorder, injury, or illness, including a life-endangering physical condition caused by or arising from the pregnancy itself, that would place her in danger of death unless an abortion is performed, as certified by a physician.

hyde amendment codification act prohibits expenditure funds authorized appropriated federal law funds trust fund funds authorized appropriated federal law federal funds abortion prohibits federal funds health benefits coverage includes coverage abortion currently federal funds abortion services plans receiving federal funds federal funds segregated funds abortion services excludes prohibitions abortion pregnancy result rape incest woman suffers physical disorder injury illness including life endangering physical condition caused arising pregnancy place danger death abortion performed certified physician


Summary: Health Care Provider and Hospital Conscience Protection Act - Prohibits the federal government and any state or local government that receives federal financial assistance from discriminating or retaliating against any individual or health care entity because of the refusal by the individual or entity to recommend, refer for, provide coverage for, pay for, provide, perform, assist, or participate in any abortion. Includes within such prohibited discrimination: (1) denial, deprivation, or disqualification in licensing; (2) withholding accreditations, authorizations, loans, grants, aids, assistance, benefits, or privileges; and (3) withholding authorization to expand, improve, finance, or create facilities or programs. Creates a cause of action for any violation of this Act. Gives federal courts jurisdiction to order any form of legal or equitable relief, including injunctive relief or an order preventing the disbursement of all or a portion of federal financial assistance to a state government until the prohibited conduct has ceased. Authorizes the Attorney General to file a civil action seeking injunctive or declaratory relief to enforce compliance with this Act. Requires the Secretary of Health and Human Services to designate the Director of the Office for Civil Rights of the Department of Health and Human Services (HHS) to receive and investigate complaints alleging a violation of this Act. Requires this Act to be construed in favor of broad conscience protection for individuals and health care entities to the maximum extent permitted by the terms of this Act and the Constitution.

health care provider hospital conscience protection act prohibits federal government state local government receives federal financial assistance discriminating retaliating individual health care entity refusal individual entity recommend refer provide coverage pay provide perform assist participate abortion includes prohibited discrimination denial deprivation disqualification licensing withholding authorizations loans grants aids assistance benefits privileges withholding authorization expand improve finance create facilities programs creates cause action violation act gives federal courts jurisdiction order form legal equitable relief including injunctive relief order preventing disbursement portion federal financial assistance state government prohibited conduct ceased authorizes attorney general file civil action seeking injunctive declaratory relief enforce compliance act requires secretary health_and_human_services designate director office_for_civil_rights_of_the_department_of_health_and_human_services hhs receive investigate complaints alleging violation act requires act construed favor broad conscience protection individuals health care entities maximum extent permitted terms act constitution


Summary: Privacy Act Modernization for the Information Age Act of 2011 - Amends provisions of federal law relating to privacy protections, including the Privacy Act of 1974 and the E-Government Act of 2002, to revise and expand such protections, including by: (1) redefining "system of records" to include any records maintained by, or otherwise under the control of, any federal agency and "routine use," with respect to the disclosure of a record, as the use of such record for a purpose that is compatible with the purpose for which it was collected and that is appropriate and reasonably necessary for the efficient and effective conduct of goverment; (2) expanding agency requirements for collecting, maintaining, and disclosing information on individuals to require the creation of a centralized website maintained by the Office of Management and Budget (OMB) containing system of records notices and related privacy information; and (3) revising and increasing civil and criminal penalties for violations of privacy requirements. Sets forth a new Federal Information Privacy Policy defining the authority and functions of the OMB Director and agency responsibilities with respect to privacy protections.  Establishes: (1) the position of Federal Chief Privacy Officer in OMB, and (2) a Chief Privacy Officers Council to develop best practices for agency privacy policies. Amends the National Intelligence Reform Act of 2004 to expand the authority of agency privacy or civil liberties officers to investigate violations of privacy law.

privacy act modernization information age act amends provisions federal law relating privacy protections including privacy act government act revise expand protections including redefining system records include records maintained control federal agency routine use respect disclosure record use record purpose compatible purpose collected appropriate reasonably necessary efficient effective conduct expanding agency requirements collecting maintaining disclosing information individuals require creation centralized website maintained office_of_management_and_budget omb containing system records notices related privacy information revising increasing civil criminal penalties violations privacy requirements sets forth new defining authority functions omb director agency responsibilities respect privacy protections establishes position omb chief privacy officers council develop best practices agency privacy policies amends expand authority agency privacy civil liberties officers investigate violations privacy law


Summary: Cybersecurity Information Sharing Act of 2012 - Authorizes private entities to monitor information systems for cybersecurity threats and operate countermeasures for protection, including the information systems of third parties authorizing such measures. Allows private entities to disclose lawfully obtained cybersecurity threat indicators to any other private entity, provided that the entities: (1) make efforts to safeguard information that can be used to identify specific persons, (2) comply with lawful use or disclosure restrictions, (3) not use the indicators to gain an unfair competitive advantage, and (4) use the indicators only for the purpose of protecting against or mitigating cybersecurity threats. Directs the Secretary of Homeland Security (DHS) to establish processes and procedures for: (1) designating appropriate federal and non-federal entities as cybersecurity exchanges, (2) sharing classified and unclassified cybersecurity threat information with designated cybersecurity exchanges and other appropriate entities, and (3) identifying certified entities to receive such classified information. Directs the Secretary to designate a federal entity as the lead cybersecurity exchange for cybersecurity information sharing among federal entities and with non-federal entities. Allows a non-federal entity to disclose lawfully obtained cybersecurity threat information to an exchange. Requires the Secretary to develop policies and procedures that govern a federal entity's receipt, retention, use, and disclosure of cybersecurity threat information in a manner that minimizes the impact on privacy and civil liberties. Directs: (1) the Secretary and the Attorney General (DOJ) to establish a mandatory program to oversee compliance with such policies and procedures, and (2) the heads of federal entities to develop and enforce appropriate sanctions for officers, employees, or agents of the federal entities who conduct prohibited activities. Provides legal protections for entities engaged in cybersecurity monitoring activities, including a good faith defense.

cybersecurity information sharing act authorizes private entities monitor information systems cybersecurity threats operate countermeasures protection including information systems parties authorizing measures allows private entities disclose lawfully obtained cybersecurity threat indicators private entity provided entities efforts safeguard information identify specific persons comply lawful use disclosure restrictions use indicators gain unfair competitive advantage use indicators purpose protecting mitigating cybersecurity threats directs secretary homeland_security dhs establish processes procedures designating appropriate federal non federal entities cybersecurity exchanges sharing classified unclassified cybersecurity threat information designated cybersecurity exchanges appropriate entities identifying certified entities receive classified information directs secretary designate federal entity lead cybersecurity exchange cybersecurity information sharing federal entities non federal entities allows non federal entity disclose lawfully obtained cybersecurity threat information exchange requires secretary develop policies procedures govern federal entity receipt retention use disclosure cybersecurity threat information manner minimizes impact privacy civil liberties directs secretary attorney general doj establish mandatory program oversee compliance policies procedures heads federal entities develop enforce appropriate sanctions officers employees agents federal entities conduct prohibited activities provides legal protections entities engaged cybersecurity monitoring activities including good faith defense


Summary: Cyber Crime Protection Security Act - Amends the federal criminal code to make fraud in connection with the unauthorized access of personally identifiable information (in electronic or digital form) a predicate for instituting a prosecution for racketeering. Increases penalties for fraud and related activity in connection with computers. Expands the prohibition against trafficking in passwords to include trafficking through any means by which a protected computer may be accessed without authorization. Imposes criminal penalties for attempts and conspiracies to commit fraud and related activity in connection with computers. Modifies criminal and civil forfeiture provisions, including requiring certain civil forfeiture seizures and forfeitures to be performed by persons designated for that purpose by the Secretary of Homeland Security (DHS) or the Attorney General (DOJ). Prohibits, during and in relation to a felony violation of provisions regarding fraud and related activity in connection with computers, intentionally causing or attempting to cause damage to a critical infrastructure computer if such damage results in (or, in the case of an attempt, would, if completed have resulted in) the substantial impairment of the operation of that computer or of the critical infrastructure associated with the computer. Imposes a prison term of between 3 and 20 years, a fine, or both. Prohibits probation for any person convicted of such a violation. Provides for concurrent sentences under specified circumstances. Excludes from the definition of "exceeds authorized access" for purposes of the prohibition against fraudulent use of computers, access in violation of a contractual obligation or agreement, such as an acceptable use policy or terms of service agreement, with an Internet service provider, Internet website, or nongovernment employer, if such violation constitutes the sole basis for determining that access to a protected computer is unauthorized.

federal criminal code fraud connection unauthorized access personally identifiable information electronic digital form predicate instituting prosecution racketeering increases penalties fraud related activity connection computers expands prohibition trafficking passwords include trafficking means protected computer accessed authorization imposes criminal penalties attempts conspiracies commit fraud related activity connection computers modifies criminal civil forfeiture provisions including requiring certain civil forfeiture seizures forfeitures performed persons designated purpose secretary homeland_security dhs attorney general doj prohibits relation felony violation provisions fraud related activity connection computers intentionally causing attempting cause damage critical infrastructure computer damage results case attempt completed resulted substantial impairment operation computer critical infrastructure associated computer imposes prison term years fine prohibits probation person convicted violation provides concurrent sentences specified circumstances excludes definition exceeds authorized access purposes prohibition fraudulent use computers access violation contractual obligation agreement acceptable use policy terms service agreement internet service provider internet website nongovernment employer violation constitutes sole basis determining access protected computer unauthorized


Summary: Strengthening and Enhancing Cybersecurity by Using Research, Education, Information, and Technology Act of 2012 or SECURE IT - Authorizes private entities to employ countermeasures and use cybersecurity systems to obtain, identify, or possess cyber threat information on its own networks or the networks of another entity with such entity's authorization. Allows private entities, nonfederal government agencies, or state, tribal, or local governments to voluntarily disclose cyber threat information to designated cybersecurity centers or to each other to assist with preventing, investigating, or mitigating threats to information security. Requires federal contractors of electronic communication, remote computing, or cybersecurity services to immediately provide the contracting agency with any cyber threat information directly related to the contract. Permits contractors to also provide such information to a cybersecurity center. Directs federal agencies receiving such contractor-provided information to disclose it immediately to a cybersecurity center. Permits cyber threat information provided to a cybersecurity center to be disclosed to, or used by, the federal government for a cybersecurity or national security purpose or to prevent, investigate, or prosecute various criminal offenses for which law enforcement officials are authorized, under existing law, to seek a court order authorizing an interception of wire, oral, or electronic communications. Prohibits federal, state, tribal, or local agencies from directly using such information to regulate an entity's lawful activities. Sets forth conditions with regard to information provided to a cybersecurity center including: (1) the disclosure of such information to state, tribal, or local governments; (2) the use, distribution, and any prerequisite consent necessary for sharing such information; and (3) the legal treatment of such information under specified privileges, exemptions, ex parte communications rules, and requirements for disclosing public information and records. Provides legal protections to entities engaged in authorized cybersecurity activities. Directs the Director of National Intelligence (DNI) and Secretary of Defense (DOD) to develop procedures for sharing classified and unclassified information. Amends the Federal Information Security Management Act of 2002 to replace existing information security procedures for federal agencies with a new framework for coordinating and securing federal information. Directs the Secretary of Commerce to issue compulsory and binding policies and directives governing agency information security operations. Requires that national security systems be overseen as directed by the President. Requires each agency to comply with such policies and provide risk-commensurate information security protections for information systems used or operated by the agency or a contractor or other organization on an agency's behalf. Requires each agency's Chief Information Officer to develop an agencywide information security program. Directs the Secretary of Homeland Security (DHS) to: (1) designate a DHS entity to conduct an ongoing security analysis of agency information systems using automated processes, and (2) develop a timeline for each agency to adopt continuous monitoring systems. Sets forth separate requirements for national security systems. Requires that federal information systems be based on National Institute of Standards and Technology (NIST) standards. Amends the Computer Fraud and Abuse Act to increase and further delineate the criminal penalties for computer fraud and related activities. Establishes an offense for aggravated damage to a public or private critical infrastructure computer that manages or controls systems or assets vital to national defense, national security, national economic security, or public health or safety. Amends the High-Performance Computing Act of 1991 to re-designate the National High-Performance Computing Program as the Networking and Information Technology Research and Development Program. Requires the Director of the Office of Science and Technology Policy (STP) to establish goals for inter-agency collaborative research and development with Program Component Areas, industry, institutions of higher education, federal laboratories, and international organizations. Directs agencies to develop a five-year strategic plan. Requires that agencies be encouraged under the Program to address application areas with potential for contributions to national economic competitiveness and other societal benefits including technical solutions to cybersecurity, health care, energy management, transportation, cyber-physical systems, physical and behavioral phenomena, and privacy protection. Defines "cyber-physical systems" as physical or engineered systems whose networking and information technology functions and physical elements are integrated and actively connected to the physical world through sensors, actuators, or other means to perform monitoring and control functions. Requires the STP Director to convene a task force to report to Congress on options for the research, development, and organizational structure of cyber-physical systems. Requires the National Science Foundation (NSF) to continue a Federal Cyber Scholarship-for-Service program. Requires the NIST to coordinate federal agencies engaged in the development of international technical standards. Amends the Cyber Security Research and Development Act to add research areas eligible for NSF computer and network security research grants. Authorizes: (1) various grant programs through FY2013, and (2) the cybersecurity faculty development traineeship program through FY2014.

strengthening research education information technology act secure authorizes private entities employ countermeasures use cybersecurity systems obtain identify possess cyber threat information networks networks entity entity authorization allows private entities nonfederal government agencies state tribal local governments voluntarily disclose cyber threat information designated cybersecurity centers assist preventing investigating mitigating threats information security requires federal contractors electronic communication remote computing cybersecurity services immediately provide contracting agency cyber threat information directly related contract permits contractors provide information cybersecurity center directs federal agencies receiving contractor provided information disclose immediately cybersecurity center permits cyber threat information provided cybersecurity center disclosed federal government cybersecurity national security purpose prevent investigate prosecute criminal offenses law enforcement officials authorized existing law seek court order authorizing interception wire oral electronic communications prohibits federal state tribal local agencies directly information regulate entity lawful activities sets forth conditions regard information provided cybersecurity center including disclosure information state tribal local governments use distribution prerequisite consent necessary sharing information legal treatment information specified privileges exemptions parte communications rules requirements disclosing public information records provides legal protections entities engaged authorized cybersecurity activities directs director national_intelligence dni secretary defense dod develop procedures sharing classified unclassified information amends federal_information_security_management_act replace existing information security procedures federal agencies new framework coordinating securing federal information directs secretary commerce issue compulsory binding policies directives governing agency information security operations requires national security systems overseen directed president requires agency comply policies provide risk commensurate information security protections information systems operated agency contractor organization agency behalf requires agency chief information officer develop agencywide information security program directs secretary homeland_security dhs designate dhs entity conduct ongoing security analysis agency information systems automated processes develop timeline agency adopt continuous monitoring systems sets forth separate requirements national security systems requires federal information systems based national_institute_of_standards_and_technology nist standards amends increase delineate criminal penalties computer fraud related activities establishes offense aggravated damage public private critical infrastructure computer manages controls systems assets vital national defense national security national economic security public health safety amends high performance computing act designate national high performance computing program networking_and_information_technology_research_and_development_program requires director office_of_science_and_technology_policy establish goals inter agency collaborative research development program component areas industry institutions higher education federal laboratories international organizations directs agencies develop year strategic plan requires agencies encouraged program address application areas potential contributions national economic competitiveness societal benefits including technical solutions cybersecurity health care energy management transportation cyber physical systems physical behavioral phenomena privacy protection defines cyber physical systems physical engineered systems networking information technology functions physical elements integrated actively connected physical world sensors means perform monitoring control functions requires director convene task force report congress options research development organizational structure cyber physical systems requires national_science_foundation nsf continue federal cyber scholarship service program requires nist coordinate federal agencies engaged development international technical standards amends add research areas eligible nsf computer network security research grants authorizes grant programs fy2013 cybersecurity faculty development traineeship program fy2014


Summary: Password Protection Act of 2012 - Amends the federal criminal code to subject to a fine any employer who knowingly and intentionally: (1) compels or coerces any person to provide the employer with a password or similar information to access a protected computer not owned by such employer; or (2) discharges, disciplines, discriminates, or threatens to take such actions, against any person who fails to authorize access to such computer, has filed a complaint or instituted a proceeding regarding such action, or testified or is about to testify in any such proceeding. Declares that nothing in this Act shall be construed to limit the authority of a court of competent jurisdiction to grant equitable relief in a civil action, if the court believes that the information sought to be obtained is relevant to protecting the intellectual property, a trade secret, or confidential business information of the party seeking relief. Exempts an employer's actions from such prohibition if: (1) the employer discharges or disciplines an individual for good cause; (2) a state enacts a law that specifically waives such prohibition with respect to a particular class of state or agency employees and the employer's action relates to an employee in such class; or (3) an executive agency, military department, or other executive branch entity specifically waives the prohibition with respect to a particular class of employees who may have access to classified information.

password protection act amends federal criminal code subject fine employer knowingly intentionally coerces person provide employer password similar information access protected computer owned employer discharges disciplines discriminates threatens actions person fails authorize access computer filed complaint instituted proceeding action testified testify proceeding declares act shall construed limit authority court competent jurisdiction grant equitable relief civil action court believes information sought obtained relevant protecting intellectual property trade secret confidential business information party seeking relief exempts employer actions prohibition employer discharges disciplines individual good cause state enacts law specifically waives prohibition respect particular class state agency employees employer action relates employee class executive agency military department executive branch entity specifically waives prohibition respect particular class employees access classified information


Summary: Prohibits applying any criminal penalty for refusing or willfully neglecting to answer questions (except with respect to the respondent's name and contact information, the date of the response, and the number of people living or staying at the address) in connection with the American Community Survey conducted by the Secretary of Commerce.

prohibits applying criminal penalty refusing willfully neglecting answer questions respect respondent contact information date response number people living staying address connection american_community_survey conducted secretary commerce


Summary: Preserving Freedom from Unwarranted Surveillance Act of 2012 - Prohibits a person or entity acting under the authority of (or funded in whole or in part by) the federal government from using a drone to gather evidence or other information pertaining to criminal conduct or conduct in violation of a statute or regulation except to the extent authorized in a warrant satisfying the requirements of the Fourth Amendment to the Constitution. Defines a "drone" as any powered, aerial vehicle that: (1) does not carry a human operator; (2) uses aerodynamic forces to provide vehicle lift; and (3) can fly autonomously or be piloted remotely, be expendable or recoverable, and carry a lethal or nonlethal payload. Exempts from such prohibition the use of drones to: (1) patrol national borders to prevent or deter illegal entry of any persons or illegal substances, (2) prevent imminent danger to life when drones are used by law enforcement under exigent circumstances, or (3) counter a high risk of a terrorist attack by a specific individual or organization based on credible intelligence determined by the Secretary of Homeland Security (DHS). Authorizes civil actions by aggrieved parties. Prohibits evidence obtained or collected in violation of this Act from being admissible in a criminal prosecution in any court in the United States.

preserving freedom unwarranted surveillance act prohibits person entity acting authority funded federal government drone gather evidence information pertaining criminal conduct conduct violation statute regulation extent authorized warrant satisfying requirements fourth amendment constitution defines drone powered aerial vehicle carry human operator uses aerodynamic forces provide vehicle lift fly piloted remotely recoverable carry lethal nonlethal exempts prohibition use drones patrol national borders prevent deter illegal entry persons illegal substances prevent imminent danger life drones law enforcement exigent circumstances counter high risk terrorist attack specific individual organization based credible intelligence determined secretary homeland_security dhs authorizes civil actions aggrieved parties prohibits evidence obtained collected violation act admissible criminal prosecution court united_states


Summary: Data Security and Breach Notification Act of 2012 - Requires commercial entities that acquire, maintain, store, or utilize personal information (covered entities) to take reasonable measures to protect and secure data in electronic form containing personal information. Directs a covered entity that owns or licenses such data to give notice of any breach of the security of the system that the entity reasonably believes has caused or will cause identity theft or other financial harm to each individual: (1) who is a U.S. citizen or resident; and (2) whose personal information was, or that the covered entity reasonably believes has been, accessed and acquired by an unauthorized person. Requires a covered entity to notify the Secret Service or the Federal Bureau of Investigation (FBI) of a security breach of personal information involving more than 10,000 individuals. Requires a third-party entity contracted to maintain, store, or process data containing personal information to notify the covered entity of a breach of security of a system. Requires a service provider to notify the covered entity if it becomes aware of a breach of security involving personal information owned or possessed by a covered entity and if such covered entity can be reasonably identified. Allows delays of notifications to avoid impeding a civil or criminal investigation or threatening national or homeland security. Sets forth the methods for notification under this Act. Preempts information security practices of the Communications Act applicable to telecommunication carriers, satellite operators, and cable operators. Sets forth civil monetary penalties for violations of this Act. Exempts financial institutions and entities subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

data_security breach notification act requires commercial entities acquire maintain store utilize personal information covered entities reasonable measures protect secure data electronic form containing personal information directs covered entity owns licenses data notice breach security system entity reasonably believes caused cause identity theft financial harm individual citizen resident personal information covered entity reasonably believes accessed acquired unauthorized person requires covered entity notify secret_service federal_bureau_of_investigation fbi security breach personal information involving individuals requires party entity contracted maintain store process data containing personal information notify covered entity breach security system requires service provider notify covered entity aware breach security involving personal information owned possessed covered entity covered entity reasonably identified allows delays notifications avoid impeding civil criminal investigation threatening national homeland security sets forth methods notification act preempts information security practices communications act applicable telecommunication carriers satellite operators cable operators sets forth civil monetary penalties violations act exempts financial institutions entities subject health_insurance_portability_and_accountability_act hipaa


Summary: Strengthening and Enhancing Cybersecurity by Using Research, Education, Information, and Technology Act of 2012 or SECURE IT - Authorizes private entities to employ countermeasures and use cybersecurity systems to obtain, identify, or possess cyber threat information on its own networks or the networks of another entity with such entity's authorization. Allows private entities, nonfederal government agencies, or state, tribal, or local governments to voluntarily disclose cyber threat information to designated cybersecurity centers or to each other to assist with preventing, investigating, or mitigating threats to information security. Requires such entities and governments providing electronic communication, remote computing, or information security services to a federal agency to inform the agency of a significant cyber incident involving the federal information system of that agency that: (1) is directly known as a result of providing such services and directly related to the provision of such services, and (2) has impeded or will impede the performance of a critical mission of the federal agency. Defines "significant cyber incident" as a cyber incident resulting in, or an attempted cyber incident that, if successful, would have resulted in: (1) the exfiltration from a federal information system (an information system used or operated by an executive agency, contractor, or another organization on behalf of an executive agency) of data essential to the operation of the such a system, or (2) an incident in which an operational or technical control essential to the security or operation of a such a system was defeated. Directs federal agencies receiving such significant cyber incident information to report the information to a cybersecurity center. Permits cyber threat information provided to a cybersecurity center to be disclosed to, retained by, or used by, consistent with otherwise applicable federal law, the federal government for a cybersecurity or national security purpose or to prevent, investigate, or prosecute various criminal offenses for which law enforcement officials are authorized, under existing law, to seek a court order authorizing an interception of wire, oral, or electronic communications. Prohibits the disclosure, retention, or use of such information for any use not expressly permitted. Prohibits federal, state, tribal, or local agencies from directly using such information to regulate an entity's lawful activities. Sets forth conditions with regard to information provided to a cybersecurity center including: (1) the disclosure of such information to state, tribal, or local governments; (2) the use, distribution, and any prerequisite consent necessary for sharing such information; and (3) the legal treatment of such information under specified privileges, exemptions, ex parte communications rules, and requirements for disclosing public information and records. Provides legal protections to entities engaged in authorized cybersecurity activities. Directs the Director of National Intelligence (DNI) and Secretary of Defense (DOD) to develop procedures for sharing, through cybersecurity centers, classified and unclassified information. Authorizes the Council of the Inspectors General on Integrity and Efficiency to review compliance by the cybersecurity centers and federal agencies with required procedures, including privacy and civil liberty protections through anonymization or other methods. Amends the Federal Information Security Management Act of 2002 to replace existing information security procedures for federal agencies with a new framework for coordinating and securing federal information. Directs the Secretary of Commerce to issue compulsory and binding policies and directives governing agency information security operations. Requires that national security systems be overseen as directed by the President. Requires each agency to comply with such policies and provide risk-commensurate information security protections for information systems used or operated by the agency or a contractor or other organization on an agency's behalf. Requires each agency's Chief Information Officer to develop an agencywide information security program. Directs the Office of Management and Budget (OMB), in coordination with the Department of Homeland Security (DHS), to designate an entity to conduct an ongoing security analysis of agency information systems using automated processes. Requires each agency to develop a timeline for the implementation of technology facilitating continuous monitoring and threat assessments. Sets forth separate requirements for national security systems. Requires that federal information systems be based on National Institute of Standards and Technology (NIST) standards. Amends the Computer Fraud and Abuse Act to increase and further delineate the criminal penalties for computer fraud and related activities. Establishes an offense for aggravated damage to a public or private critical infrastructure computer that manages or controls systems or assets vital to national defense, national security, national economic security, or public health or safety. Amends the High-Performance Computing Act of 1991 to re-designate the National High-Performance Computing Program as the Networking and Information Technology Research and Development Program. Requires the Director of the Office of Science and Technology Policy (STP) to establish goals for inter-agency collaborative research and development with Program Component Areas, industry, institutions of higher education, federal laboratories, and international organizations. Directs agencies to develop a five-year strategic plan. Requires that agencies be encouraged under the Program to address application areas with potential for contributions to national economic competitiveness and other societal benefits including technical solutions to cybersecurity, health care, energy management, transportation, cyber-physical systems, physical and behavioral phenomena, and privacy protection. Defines "cyber-physical systems" as physical or engineered systems whose networking and information technology functions and physical elements are integrated and actively connected to the physical world through sensors, actuators, or other means to perform monitoring and control functions. Requires the STP Director to convene a task force to report to Congress on options for the research, development, and organizational structure of cyber-physical systems. Requires the National Science Foundation (NSF) to carry out a Federal Cyber Scholarship-for-Service program. Requires the NIST to coordinate federal agencies engaged in the development of international technical standards. Amends the Cyber Security Research and Development Act to add research areas eligible for NSF computer and network security research grants. Authorizes various grant programs through FY2013.

strengthening research education information technology act secure authorizes private entities employ countermeasures use cybersecurity systems obtain identify possess cyber threat information networks networks entity entity authorization allows private entities nonfederal government agencies state tribal local governments voluntarily disclose cyber threat information designated cybersecurity centers assist preventing investigating mitigating threats information security requires entities governments providing electronic communication remote computing information security services federal agency inform agency significant cyber incident involving federal information system agency directly known result providing services directly related provision services impeded impede performance critical mission federal agency defines significant cyber incident cyber incident resulting attempted cyber incident successful resulted federal information system information system operated executive agency contractor organization behalf executive agency data essential operation system incident operational technical control essential security operation system directs federal agencies receiving significant cyber incident information report information cybersecurity center permits cyber threat information provided cybersecurity center disclosed retained consistent applicable federal law federal government cybersecurity national security purpose prevent investigate prosecute criminal offenses law enforcement officials authorized existing law seek court order authorizing interception wire oral electronic communications prohibits disclosure retention use information use expressly permitted prohibits federal state tribal local agencies directly information regulate entity lawful activities sets forth conditions regard information provided cybersecurity center including disclosure information state tribal local governments use distribution prerequisite consent necessary sharing information legal treatment information specified privileges exemptions parte communications rules requirements disclosing public information records provides legal protections entities engaged authorized cybersecurity activities directs director national_intelligence dni secretary defense dod develop procedures sharing cybersecurity centers classified unclassified information authorizes council_of_the_inspectors_general_on_integrity_and_efficiency review compliance cybersecurity centers federal agencies required procedures including privacy civil liberty protections methods amends federal_information_security_management_act replace existing information security procedures federal agencies new framework coordinating securing federal information directs secretary commerce issue compulsory binding policies directives governing agency information security operations requires national security systems overseen directed president requires agency comply policies provide risk commensurate information security protections information systems operated agency contractor organization agency behalf requires agency chief information officer develop agencywide information security program directs office_of_management_and_budget omb coordination department_of_homeland_security dhs designate entity conduct ongoing security analysis agency information systems automated processes requires agency develop timeline implementation technology facilitating continuous monitoring threat assessments sets forth separate requirements national security systems requires federal information systems based national_institute_of_standards_and_technology nist standards amends increase delineate criminal penalties computer fraud related activities establishes offense aggravated damage public private critical infrastructure computer manages controls systems assets vital national defense national security national economic security public health safety amends high performance computing act designate national high performance computing program networking_and_information_technology_research_and_development_program requires director office_of_science_and_technology_policy establish goals inter agency collaborative research development program component areas industry institutions higher education federal laboratories international organizations directs agencies develop year strategic plan requires agencies encouraged program address application areas potential contributions national economic competitiveness societal benefits including technical solutions cybersecurity health care energy management transportation cyber physical systems physical behavioral phenomena privacy protection defines cyber physical systems physical engineered systems networking information technology functions physical elements integrated actively connected physical world sensors means perform monitoring control functions requires director convene task force report congress options research development organizational structure cyber physical systems requires national_science_foundation nsf carry federal cyber scholarship service program requires nist coordinate federal agencies engaged development international technical standards amends add research areas eligible nsf computer network security research grants authorizes grant programs fy2013


Summary: Protect Our Health Privacy Act - Amends the American Recovery and Reinvestment Act of 2009 (ARRA) to expand requirements for reports to Congress on acquisition or disclosure of unsecured protected health information in a breach to include: (1) descriptions of types of such information involved in each breach; and (2) the identity of the covered entity involved in each breach or, if the breach affected fewer than 500 individuals, the kind of covered entity involved. Revises requirements for the annual compliance report concerning informally resolved complaints of violations relating to privacy and security of health information to require: (1) a summary of the most common types of complaints resolved, (2) statements of the average amount of time between receipt of a complaint to its resolution by category and examples, (3) additional reporting of federal and state enforcement actions and priorities. Requires the Attorney General to report annually to Congress, and to publish, a study of complaints of alleged violations concerning wrongful disclosure of individually identifiable health information referred to the Department of Justice (DOJ) by the Department of Health and Human Services (HHS), the Federal Bureau of Investigation (FBI), or another state or federal agency. Includes portable media devices in guidance issued by the Secretary concerning technologies and methodologies rendering protected health information unusable by unauthorized individuals. Directs the Secretary to issue regulations requiring covered entities and their business associates to render protected health information stored on such media unusable by unauthorized individuals. Provides rules for application of regulations concerning health information privacy to use by business associates of covered entities. Amends the Public Health Service Act to require the Secretary to issue regulations to improve the safety, interoperability, and utility of health information technology systems, including: (1) a system to track the effect of health information technology on patients' health, and (2) minimum quality and risk management requirements for technology vendors. Requires promulgation of regulations by an HHS-designated agency concerning a health information technology adverse health event reporting program and database and reports by such agency on its findings to industry and policymakers.

arra expand requirements reports congress acquisition disclosure unsecured protected health information breach include descriptions types information involved breach identity covered entity involved breach breach affected fewer individuals kind covered entity involved revises requirements annual compliance report concerning resolved complaints violations relating privacy security health information require summary common types complaints resolved statements average time receipt complaint resolution category examples additional reporting federal state enforcement actions priorities requires attorney general report annually congress publish study complaints alleged violations concerning wrongful disclosure individually identifiable health information referred department_of_justice doj department_of_health_and_human_services hhs federal_bureau_of_investigation fbi state federal agency includes portable media devices guidance issued secretary concerning technologies methodologies rendering protected health information unusable unauthorized individuals directs secretary issue regulations requiring covered entities business associates render protected health information stored media unusable unauthorized individuals provides rules application regulations concerning health information privacy use business associates covered entities amends public_health_service_act require secretary issue regulations improve safety interoperability utility health information technology systems including system track effect health information technology patients health minimum quality risk management requirements technology vendors requires promulgation regulations hhs designated agency concerning health information technology adverse health event reporting program database reports agency findings industry policymakers


Summary: Deterring Public Disclosure of Covert Actions Act of 2012 - Prohibits the receipt, retention, or other possession of a security clearance for access to classified information by any individual who: (1) serves as an officer, employee, contractor, or member of a federal advisory board, or otherwise possesses an active security clearance; (2) is known or determined to have publicly disclosed classified details relating to a covert action; and (3) makes such disclosure or discusses such details without prior authorization from an original classification authority.

deterring public disclosure covert actions act prohibits receipt retention possession security clearance access classified information individual serves officer employee contractor member federal advisory board possesses active security clearance known determined publicly disclosed classified details relating covert action makes disclosure discusses details prior authorization original classification authority


Summary: (This measure has not been amended since it was passed by the Senate on December 17, 2012. The summary of that version is repeated here.) Uninterrupted Scholars Act (USA) - Amends provisions of the Family Educational Rights and Privacy Act of 1974 that prohibit the Department of Education from funding educational agencies or institutions that release student educational records (or personally identifiable information other than certain directory information) to any individual, agency, or organization without written parental consent. Expands the list of organizations exempt from such prohibitions (thereby permitting the educational agencies or institutions participating in a Department of Education program to release records or identifiable information to such organizations without parental consent) to include an agency caseworker or other representative of a state or local child welfare agency or tribal organization authorized to access a student's case plan when such agencies or organizations are legally responsible for the care and protection of the student. Sets forth conditions including that: (1) the education records, or the personally identifiable information contained in such records, will not be disclosed by such agency or organization, except to an individual or entity engaged in addressing the student's education needs and authorized by such agency or organization to receive such disclosure; and (2) such disclosures be consistent with applicable student record confidentiality laws of states and tribes. Permits the release of such records and information without additional notice to parents and students when a parent is a party to a court proceeding involving child abuse and neglect or dependency matters and a court order has already been issued in the context of that proceeding.

measure amended passed senate december summary version repeated uninterrupted scholars act usa amends provisions family_educational_rights_and_privacy_act prohibit department_of_education funding educational agencies institutions release student educational records personally identifiable information certain directory information individual agency organization written parental consent expands list organizations exempt prohibitions permitting educational agencies institutions participating department_of_education program release records identifiable information organizations parental consent include agency caseworker representative state local child welfare agency tribal organization authorized access student case plan agencies organizations legally responsible care protection student sets forth conditions including education records personally identifiable information contained records disclosed agency organization individual entity engaged addressing student education needs authorized agency organization receive disclosure disclosures consistent applicable student record confidentiality laws states tribes permits release records information additional notice parents students parent party court proceeding involving child abuse neglect dependency matters court order issued context proceeding