; or (II) an organization which is not organized to carry on business for its own profit or that of its members. (3) Regulations (A) In general The Federal Trade Commission shall promulgate, in accordance with section 553 of title 5, United States Code, such regulations as may be necessary to carry out this section. (B) Minimum standards In promulgating any standards for cybersecurity protections and practices to carry out this section, the Commission shall ensure that any such standards that would safeguard customer information do so as well as or better than the standards set forth under part 314 of title 16, Code of Federal Regulations, as in effect on the day before the date of the enactment of this Act. (4) Civil penalties Notwithstanding section 5(m) of the Federal Trade Commission Act ( 15 U.S.C. 45(m) ), a civil penalty recovered under such section may be in excess of amounts provided for in such section as the court finds appropriate to deter violations of subsection (a) of this section. (c) Definitions In this section: (1) Breach of security (A) In general The term breach of security means compromise of the security, confidentiality, or integrity of, or loss of, data in electronic form that results in, or there is a reasonable basis to conclude has resulted in, unauthorized access to or acquisition of personal information from a covered entity. (B) Exclusions The term breach of security does not include— (i) a good faith acquisition of personal information by a covered entity, or an employee or agent of a covered entity, if the personal information is not subject to further use or unauthorized disclosure; (ii) any lawfully authorized investigative, protective, or intelligence activity of a law enforcement or an intelligence agency of the United States, a State, or a political subdivision of a State