Online transaction security

Section 7(h) of the Food and Nutrition Act of 2008 (7 U.S.C. 2016(h)) (as amended by section 2) is amended by adding at the end the following: (16) Online transaction security (A) In general In promulgating and updating, as necessary, the regulations under paragraph (15)(B)(i), the Secretary shall, with respect to online transactions using EBT cards (or any successor financial product used for a substantially similar purpose)— (i) require security measures that— (I) are effective in detecting and preventing theft of benefits through online transactions, including the theft of data from online merchants that may compromise the ability of a household to use benefits in transactions with other merchants, either online or in-person; and (II) prevent sensitive data from being stolen during online transactions and securely manage sensitive data generated by online transactions, including through cybersecurity enhancements for online retailers; (ii) establish standard reporting methods for States to collect and share data with the Secretary on the scope of benefits and data being stolen through online transactions; and (iii) in carrying out clauses (i) and (ii), take into consideration the feasibility of cost, availability, and implementation for States. (B) Consultation In carrying out subparagraph (A), the Secretary shall consult with the Director of the Administration for Children and Families, the Attorney General of the United States, State agencies, retail food stores, and EBT contractors— (i) on the measures, methods, and considerations under that subparagraph; and (ii) to determine— (I) how benefits are being stolen and sensitive data is being compromised through online transactions; and (II) how those stolen benefits and data are being used. (C) Report (i) In general Not later than 3 years after the date of enactment of this paragraph, and every 2 years thereafter, the Secretary shall submit to the Committee on Agriculture, Nutrition, and Forestry of the Senate and the Committee on Agriculture of the House of Representatives a report that includes— (I) to the maximum extent practicable, information on the frequency of theft of benefits, the number of reported thefts from online transactions, the amount of benefits stolen through online transactions, and the online retailers most commonly compromised; (II) a description of the measures and methods developed, and considerations taken, under subparagraph (A); (III) the determinations made under subparagraph (B)(ii); and (IV) recommendations on how to consistently detect, track, report, and prevent theft of benefits, including the theft of data described in subparagraph (A)(i)(I). (ii) Confidential annex The report under clause (i) may include a nonpublicly available confidential annex containing any identifying merchant information..