kgrant on DSKB33CYQ1 with PUBLAW PUBLIC LAW 113–282—DEC. 18, 2014 128 STAT. 3071 of sector coordinating councils, sector information sharing and analysis organizations (as defined in section 212(5)), owners and operators of critical infrastructure, and any other person that the Secretary determines appropriate.’’. (b) BREACHES.— (1) REQUIREMENTS.—The Director of the Office of Management and Budget shall ensure that data breach notification policies and guidelines are updated periodically and require— (A) except as provided in paragraph (4), notice by the affected agency to each committee of Congress described in section 3544(c)(1) of title 44, United States Code, the Committee on the Judiciary of the Senate, and the Committee on Homeland Security and the Committee on the Judiciary of the House of Representatives, which shall— (i) be provided expeditiously and not later than 30 days after the date on which the agency discovered the unauthorized acquisition or access; and (ii) include— (I) information about the breach, including a summary of any information that the agency knows on the date on which notification is provided about how the breach occurred; (II) an estimate of the number of individuals affected by the breach, based on information that the agency knows on the date on which notification is provided, including an assessment of the risk of harm to affected individuals; (III) a description of any circumstances necessitating a delay in providing notice to affected individuals; and (IV) an estimate of whether and when the agency will provide notice to affected individuals; and (B) notice by the affected agency to affected individuals, pursuant to data breach notification policies and guidelines, which shall be provided as expeditiously as practicable and without unreasonable delay after the agency discovers the unauthorized acquisition or access. (2) NATIONAL SECURITY; LAW ENFORCEMENT; REMEDIATION.—The Attorney General, the head of an element of the intelligence community (as such term is defined under section 3(4) of the National Security Act of 1947 (50 U.S.C. 3003(4)), or the Secretary may delay the notice to affected individuals under paragraph (1)(B) if the notice would disrupt a law enforcement investigation, endanger national security, or hamper security remediation actions. (3) OMB REPORT.—During the first 2 years beginning after the date of enactment of this Act, the Director of the Office of Management and Budget shall, on an annual basis— (A) assess agency implementation of data breach notification policies and guidelines in aggregate; and (B) include the assessment described in clause (i) in the report required under section 3543(a)(8) of title 44, United States Code. (4) EXCEPTION.—Any element of the intelligence community (as such term is defined under section 3(4) of the National Security Act of 1947 (50 U.S.C. 3003(4)) that is required to VerDate Mar 15 2010 05:38 Feb 13, 2015 Jkt 049139 PO 00282 Frm 00007 Fmt 6580 Sfmt 6581 E:\PUBLAW\PUBL282.113 44 USC 3543 note. Notifications. Deadline. Time period. Effective date. PUBL282