To protect and enhance consumer privacy, and for other purposes.

Summary: Consumer Privacy Protection Act of 2003 - Requires data collection organizations, under specified conditions, to notify consumers: (1) at the time of collection that their personally identifiable information may be used for an unrelated transaction purpose; and (2) of any material change in the organization's privacy policy statement immediately after each change.

Requires such organizations to establish a privacy policy with respect to the collection, sale, disclosure for consideration, or use of the consumer's information.

Requires an organization to provide consumers, without charge, the opportunity to preclude the sale or disclosure of their information to any organization that is not an information-sharing partner. Prescribes requirements for opportunities an organization may give consumers to limit other information practices of the organization.

Directs an organization to prepare and implement an information security policy that prevents the unauthorized disclosure or release of a consumer's information.

Requires the Federal Trade Commission (FTC) to presume that an organization is in compliance with this Act if it participates in an approved five-year self-regulatory program. Prescribes requirements for a self-regulatory consumer dispute resolution process.

Directs the FTC to: (1) facilitate electronic and promote the use of common identity theft affidavits; (2) require the timely resolution of identity theft disputes; (3) utilize the Identity Theft Clearinghouse to transmit information to appropriate entities for protective action and to mitigate losses; and (4) provide change of address protection for consumers.

Requires: (1) the Comptroller General to analyze the impact on U.S. interstate and foreign commerce of information privacy laws, regulations, or agreements enacted, promulgated, or adopted by other nations, and whether the enforcement mechanisms or procedures of them result in discriminatory treatment of U.S. entities; and (2) the Secretary of Commerce, based on such results, to take steps to mitigate against such discriminatory impact.

Directs the Secretary to seek harmonization of this Act with other international privacy laws, regulations, and agreements for the advancement of transnational and electronic commerce.

OF IDENTITY THEFT DISPUTES.

    The Commission shall require entities that receive disputes 
regarding the unauthorized use of accounts of such entities from 
consumers that have reason to believe that they are victims of identity 
theft to conduct any necessary investigation and decide an outcome of a 
claim within 90 days from the date on which all necessary information 
to investigate the claim has been submitted to the entity.

SEC. 204. IMPROVEMENTS TO CONSUMER CLEARINGHOUSE.

    The Commission shall utilize the Identity Theft Clearinghouse to 
permit consumers that have a reasonable belief that they are victims of 
identity theft to submit any information relevant to such identity 
theft to the Clearinghouse (including by means of an Identity Theft 
Affidavit), so that such information may be transmitted by the 
Clearinghouse to appropriate entities for necessary protective action 
and to mitigate losses resulting from such identity theft.

SEC. 205. IMPROVED IDENTITY THEFT DATA.

    (a) In General.--The Commission shall--
            (1) establish a process to contact, not less than annually, 
        public and private entities that receive and process complaints 
        from consumers that have a reasonable belief that they are 
        victims of identity theft; and
            (2) obtain accurate data on the incidences and nature of 
        complaints from such entities.
    (b) Inclusion in Database.--Such information shall be made part of 
the Commission's Identity Theft Clearinghouse database.

SEC. 206. CHANGE OF ADDRESS PROTECTIONS.

    The Commission shall require appropriate entities to take 
reasonable steps to verify the accuracy of a consumer's address, 
including by confirming a consumer's change of address by sending a 
confirmation of such change to the old and the new address of the 
consumer.

SEC. 207. EFFECTIVE DATE.

    This title shall take effect 180 days after the date of enactment 
of this Act.

                  TITLE III--INTERNATIONAL PROVISIONS

SEC. 301. STUDY BY COMPTROLLER GENERAL.

    The Comptroller General of the United States shall conduct a study 
and issue a report analyzing the impact on the interstate and foreign 
commerce of the United States of information privacy laws, regulations, 
or agreements enacted, promulgated, or adopted by other nations, 
including regional or international agreements between nations, and 
whether the enforcement mechanisms or procedures of those laws, 
regulations, or agreements result in discriminatory treatment of United 
States entities. The first report under this section shall be issued 
not later than 120 days after the date of enactment of this Act and 
subsequent reports shall be issued every 3 years thereafter.

SEC. 302. REMEDIATION OF DISCRIMINATORY IMPACT BY SECRETARY OF 
              COMMERCE.

    If the Comptroller General of the United States finds, in the study 
and report under section 301, that such information privacy laws, 
regulations, or agreements substantially impede interstate and foreign 
commerce of the United States and that the enforcement mechanisms or 
procedures of the information privacy laws, regulations, or agreements 
described in such subsection result in discriminatory treatment of 
United States entities, the Secretary of Commerce shall, to the extent 
permitted by law take all steps necessary to mitigate against such 
discriminatory impact within 180 days after the report making such 
findings is issued.

SEC. 303. EFFECT OF NONREMEDIATION.

    (a) Recommendations.--If by the end of the 180-day period described 
in section 302, the Secretary of Commerce has not attained complete 
relief from the discriminatory impact described in such subsection, the 
Secretary shall report to the Congress and the President 
recommendations on action to relieve any such remaining discriminatory 
impact.
    (b) Federal Agency Action After Consideration by Congress.--During 
the period after the Secretary reports recommendations under subsection 
(a) for mitigation of discriminatory impact and before the Congress 
acts with respect to such recommendations, no officer or employee of 
any Federal agency may take or continue any action to enjoin, or impose 
any penalty on, a United States entity, or a citizen or legal resident 
of the United States, for the purpose of fulfilling an international 
obligation of the United States under an international privacy 
agreement (other than such an obligation under a ratified treaty) that 
resulted in such discriminatory impact.

SEC. 304. HARMONIZATION OF INTERNATIONAL PRIVACY LAWS, REGULATIONS, AND 
              AGREEMENTS.

    Beginning on the date of enactment of this Act, the Secretary of 
Commerce shall provide notice of the provisions of this Act to other 
nations, individually, or as members of international organizations or 
unions that have enacted, promulgated, or adopted information privacy 
laws, regulations, or agreements, and shall seek recognition of this 
Act by such nations, organizations, or unions. The Secretary shall seek 
the harmonization of this Act with such information privacy laws, 
regulations, or agreements, to the extent such harmonization is 
necessary for the advancement of transnational commerce, including 
electronic commerce.