Data Breach Prevention and Compensation Act of 2024

S 5449 establishes new cybersecurity standards for consumer reporting agencies (like credit bureaus) that handle personal data, requiring them to implement specific security measures and report breaches to the Federal Trade Commission (FTC) within 10 days. Covered agencies must notify affected consumers about breaches, including the risks involved, and face penalties of $100 per consumer for basic data exposure plus $50 per additional data type exposed, capped at 50% of their prior year's revenue. The FTC’s new Office of Cybersecurity will enforce these rules, investigate violations, and use penalty funds - split equally between cybersecurity research and direct compensation to affected consumers. The law applies to agencies meeting revenue thresholds or listed in the Fair Credit Reporting Act, directly impacting millions of consumers whose data is stored by these entities.