	Introduction

Recent data breaches at major U.S. retailers have placed a spotlight on concerns about the security of personal information stored in electronic form by corporations and other private entities. A data breach occurs when data containing sensitive personal information is lost, stolen, or accessed in an unauthorized manner, thereby causing a potential compromise of the confidentiality of the data. Existing federal law imposes security and breach notification requirements on specific industries or types of data. For example, certain health information is subject to requirements under the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH Act), while certain financial institutions are subject to requirements under the Gramm-Leach-Bliley Act (GLB). Additionally, 47 states, the District of Columbia (D.C.), and three territories have enacted laws requiring breach notification, while at least 12 states have enacted data security laws. Several data security and breach notification bills have been introduced in the 114 th Congress, which broadly would impose security and notification requirements on businesses regardless of industry sector, with limited exceptions. Second, what effect would such legislation have on the existing authority of the Federal Trade Commission (FTC) and the Federal Communications Commission (FCC) to bring enforcement actions related to data security and breach notification? It will then analyze how these preemption principles might be applied by a reviewing court seeking to determine the preemptive effect of different federal proposals. Next, it will examine the existing jurisdiction and enforcement authority of the FTC and the FCC with regard to data security and breach notification as applied to telecommunications providers and how these agencies' responsibilities might be altered by proposed legislation. There are two kinds of federal preemption: express preemption and implied preemption. All of the current federal legislative proposals in the area include express preemption clauses. For more information on the FTC's use of this authority in the data security and breach context, see CRS Report R43723, The Federal Trade Commission's Regulation of Data Security Under Its Unfair or Deceptive Acts or Practices (UDAP) Authority , by [author name scrubbed]. Other bills only eliminate the FCC's ability to enforce some of the relevant Communications Act provisions regarding data security and breach notification, but not all.
Recent data breaches at major U.S. retailers have placed a spotlight on concerns about the security of personal information stored in electronic form by corporations and other private entities. A data breach occurs when data containing sensitive personal information is lost, stolen, or accessed in an unauthorized manner, thereby causing a potential compromise of the confidentiality of the data. Existing federal laws, such as the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH Act), and the Gramm-Leach-Bliley Act, impose security and breach notification requirements on specific industries or types of data. Additionally, 47 states, the District of Columbia (D.C.), and three territories have enacted laws requiring breach notification, while at least 12 states have enacted data security laws, designed to reduce the likelihood of a data breach. Alabama, New Mexico, and South Dakota have not enacted breach notification laws.
Several data security and breach notification bills have been introduced in the 114th Congress, which broadly would impose security and notification requirements on businesses regardless of industry sector, with limited exceptions. This report begins by describing the common elements of these federal proposals and then discusses state laws that may apply in the event of a data breach.
The report then addresses two legal issues that may arise in consideration of new legislation about data security and breach notification. First, how would new federal legislation alter the application of existing state law or the availability of state law remedies for victims of data breaches? The report will discuss various forms of federal preemption (including express preemption, implied impossibility preemption, and implied obstacle preemption) and evaluate how a reviewing court might apply these preemption principles to federal proposals to determine which state laws would be superseded.
Second, the report examines the existing jurisdiction and enforcement authority of the Federal Trade Commission (FTC) and the Federal Communications Commission (FCC) with regard to data security and breach notification requirements. This section analyzes the FTC's unfair or deceptive acts and practices authority under the Federal Trade Commission Act and the FCC's authority to regulate data security and breach notification for common carriers and cable and satellite providers under the Communications Act. Finally, it evaluates how the current federal proposals would change the enforcement responsibilities of each agency, potentially increasing the jurisdiction of the FTC and limiting the FCC's ability to enforce its existing data security rules.