1. Short title This Act may be cited as the Cyber Privacy Fortification Act of 2017 . I Data Breach Notification 101. Failure to provide notice of security breaches involving sensitive personally identifiable information (a) In general Chapter 47 of title 18, United States Code, is amended by adding at the end the following: 1041. Failure to provide notice of security breaches involving sensitive personally identifiable information (a) Whoever, having a covered obligation to provide notice of a security breach involving sensitive personally identifiable information, knowingly fails to do so, shall be fined under this title or imprisoned not more than 5 years, or both. (b) As used in this section— (1) the term covered obligation , with respect to providing notice of a security breach, means an obligation under Federal law or, if the breach is in or affects interstate or foreign commerce, under State law; (2) the term sensitive personally identifiable information means any electronic or digital information that includes— (A) an individual’s first and last name, or first initial and last name, or address or phone number in combination with any one of the following data elements where the data elements are not protected by a technology protection measure that renders the data element indecipherable— (i) a nontruncated social security number, driver’s license number, state resident identification number, passport number, or alien registration number; (ii) both— (I) mother’s maiden name, if identified as such; and (II) month, day, and year of birth; and (iii) unique biometric data such as a fingerprint, voice print, a retina or iris image; or (B) a financial account number or credit or debit card number in combination with any security code, access code or password that is required for an individual to obtain credit, withdraw funds, or engage in a financial transaction by means of such number