; table of contents. Sec. 2. Notification to individuals. Sec. 3. Exemptions from notification to individuals. Sec. 4. Methods of notification. Sec. 5. Content of notification. Sec. 6. Coordination of notification with credit reporting agencies. Sec. 7. Notification for law enforcement and other purposes. Sec. 8. Enforcement by the Federal Trade Commission. Sec. 9. Enforcement by State attorneys general. Sec. 10. Effect on State law. Sec. 11. Reporting on security breaches. Sec. 12. Excluded business entities. Sec. 13. Definitions. Sec. 14. Effective date. 2. Notification to individuals (a) In general Except as provided for in section 3, any business entity engaged in or affecting interstate commerce, that uses, accesses, transmits, stores, disposes of, or collects sensitive personally identifiable information about more than 10,000 individuals during any 12-month period shall, following the discovery of a security breach of such information, notify, in accordance with sections 4 and 5, any individual whose sensitive personally identifiable information has been, or is reasonably believed to have been, accessed or acquired. (b) Obligations of and to owner or licensee (1) Notification to owner or licensee Any business entity engaged in or affecting interstate commerce, that uses, accesses, transmits, stores, disposes of, or collects sensitive personally identifiable information that the business entity does not own or license shall notify the owner or licensee of the information following the discovery of a security breach involving such information, unless there is no reasonable risk of harm or fraud to such owner or licensee. (2) Notification by owner, licensee, or other designated third party Nothing in this Act shall prevent or abrogate an agreement between a business entity required to provide notification under this section and a designated third party, including an owner or licensee of the sensitive personally identifiable information subject to the security breach, to provide the notifications required