1. Short title This Act may be cited as the Data Breach Accountability and Enforcement Act of 2017 . 2. Requirement to implement reasonable cybersecurity protections and practices (a) Requirement No covered entity may acquire, maintain, or use personal information in commerce without having in effect reasonable cybersecurity protections and practices. (b) Enforcement by Federal Trade Commission (1) Unfair or deceptive acts or practices A violation of subsection (a) by a covered entity shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act ( 15 U.S.C. 57a(a)(1)(B) ). (2) Powers of Commission (A) In general Except as provided in subparagraph (C), the Federal Trade Commission shall enforce this section in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act ( 15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act. (B) Privileges and immunities Except as provided in subparagraph (C), any person who violates this section shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act ( 15 U.S.C. 41 et seq.). (C) Applicability to all covered entities (i) In general The Federal Trade Commission shall enforce this section with respect to a person described in clause (ii) as if such person were a person over which the Commission has authority pursuant to section 5(a)(2) of the Federal Trade Commission Act ( 15 U.S.C. 45(a)(2) ) and, notwithstanding sections 4, 5(a)(2), and 6 of such Act ( 15 U.S.C. 44 , 45(a)(2), and 46), not jurisdictional limitation of the Commission with respect to a person described in clause (ii) shall apply for purposes of this section. (ii) Persons described A person described in this clause is— (I) a bank, a savings and loan institution, a Federal credit union, a common carrier, an air carrier or