1. Short title This Act may be cited as the Data Protection Act of 2017 . 2. Reasonable measures to secure sensitive personally identifiable information (a) Rules required Not later than 1 year after the date of the enactment of this Act, the Commission shall prescribe rules in accordance with section 553 of title 5, United States Code, that require a covered entity to employ reasonable measures to secure sensitive personally identifiable information maintained by such entity against a security breach. (b) Factors for consideration in determining reasonableness The rules prescribed under subsection (a) shall provide for the consideration, in determining whether measures employed by a covered entity are reasonable, of factors that include the following: (1) Whether the covered entity follows any applicable best practices issued by the National Institute of Standards and Technology. (2) Whether the covered entity takes reasonable steps to keep software up-to-date in order to mitigate security vulnerabilities, especially critical security vulnerabilities, in any database or other computer system in which sensitive personally identifiable information is maintained by such entity. (c) Consideration of binding arbitration clauses in determining civil penalty amount If a violation of the rules prescribed under subsection (a) results in a security breach and the covered entity experiencing such breach offers any credit, identity theft, fraud, or similar monitoring or protection service to consumers as a result of such breach, in determining the amount of a civil penalty under section 5(m) of the Federal Trade Commission Act ( 15 U.S.C. 45(m) ) for such violation, the court shall consider, in addition to the factors required to be considered under such section, imposing a higher penalty if the terms and conditions applicable to such service include a requirement that any disputes be resolved by binding arbitration (or a requirement that consumers take action to opt out of binding arbitration) than if such terms and