1. Short title This Act may be cited as the Ending Forced Arbitration for Victims of Data Breaches Act of 2018 . 2. Protection of data security breach victims An entity may not require, as part of a customer or other similar agreement, an individual to agree to submit any dispute related to a security breach, including any dispute related to identity theft, to arbitration. 3. Applicability A provision of an agreement entered into prior to the date of the enactment of this Act, that violates section 2, is void. 4. Enforcement by the Federal Trade Commission (a) Unfair or deceptive acts or practices A violation of section 2 shall be treated as an unfair and deceptive act or practice in violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act ( 15 U.S.C. 57a(a)(1)(B) ) regarding unfair or deceptive acts or practices. (b) Powers of commission The Commission shall enforce this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act ( 15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act. Any person who violates section 2 shall be subject to the penalties and entitled to the privileges and immunities provided in that Act. (c) Rules The Commission shall promulgate, under section 553 of title 5, United States Code, such rules as may be necessary to carry out the provisions of this Act. 5. Enforcement by States (a) In general If the attorney general of a State has reason to believe that an interest of the residents of the State has been or is being threatened or adversely affected by a practice that violates section 2, the attorney general of the State may, as parens patriae, bring a civil action on behalf of the residents of the State in an appropriate district court of the United States to obtain appropriate relief. (b) Rights of Federal Trade Commission (1) Notice to Federal Trade Commission (A) In general Except as provided in clause (iii), the