Alexis Agin Identity Theft Protection Act of 2013

Summary: Alexis Agin Identity Theft Protection Act of 2013 - Amends title II (Old Age, Survivors and Disability Insurance) (OASDI) of the Social Security Act to revise the treatment of death information furnished to or maintained by the Social Security Administration (SSA). Authorizes the Commissioner of Social Security to use or provide such information to federal and state agencies for statistical and research activities or to any federal agency for law enforcement or tax administration purposes. Authorizes disclosure of such information by: (1) federal and state agencies to contractors to assist with similar activities, (2) the Commissioner to entities concerning certain individuals who died more than three years earlier as well as to entities certified by the Commissioner, and (3) the Commissioner to the Secretary of Defense (DOD) to assist in the identification of remains. 

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Alexis Agin Identity Theft 
Protection Act of 2013''.

SEC. 2. LIMITATION ON DISTRIBUTION OF DEATH INFORMATION FURNISHED TO OR 
              MAINTAINED BY THE SOCIAL SECURITY ADMINISTRATION.

    (a) In General.--Section 205(r) of the Social Security Act (42 
U.S.C. 405(r)) is amended--
            (1) in paragraph (2), by inserting ``, and to ensure 
        completeness, timeliness, and accuracy of,'' after 
        ``transmitting'';
            (2) by striking paragraph (3) and inserting the following:
    ``(3) The Commissioner of Social Security shall, to the extent 
feasible, provide for the use of information regarding deceased 
individuals furnished to or maintained by the Commissioner, subject to 
such safeguards as the Commissioner of Social Security determines are 
necessary or appropriate to protect the information from unauthorized 
use or disclosure, to any Federal or State agency providing or 
administering Federally funded benefits to individuals, other than 
benefits under this Act, through a cooperative arrangement with such 
agency designed to ensure proper payment of those benefits with respect 
to such individuals if--
            ``(A) under such arrangement the agency provides 
        reimbursement to the Commissioner of Social Security for the 
        reasonable costs of carrying out such arrangement, including 
        the reasonable costs associated with the collection and 
        maintenance of information regarding deceased individuals 
        furnished to the Commissioner pursuant to paragraph (1); and
            ``(B) such arrangement does not conflict with the duties of 
        the Commissioner of Social Security under paragraph (1).'';
            (3) in paragraph (4), by inserting ``or in benefit and 
        pension plans for employees of the States or local 
        governments'' after ``by the States'';
            (4) by striking paragraph (5) and inserting the following:
    ``(5)(A) The Commissioner of Social Security may use or provide for 
the use of information regarding deceased individuals furnished to or 
maintained by the Commissioner, subject to such safeguards as the 
Commissioner of Social Security determines are necessary or appropriate 
to protect the information from unauthorized use or disclosure, 
provided the requirements of subparagraphs (A) and (B) of paragraph (3) 
are met and such information is provided--
            ``(i) to any Federal agency through a cooperative agreement 
        with such agency for the purpose of law enforcement or tax 
        administration; or
            ``(ii) for statistical and research activities conducted by 
        Federal and State agencies.
    ``(B) A Federal or State agency may disclose death information 
obtained from the Commissioner to a contractor for the purposes of 
assisting with such law enforcement, tax administration, or statistical 
and research activities, provided that the agency ensures, at a 
minimum, that the contractor fulfills the requirements of clauses (ii) 
and (iv) of paragraph (7)(E).'';
            (5) by striking paragraph (7) and inserting the following:
    ``(7)(A) For purposes of this paragraph, death information shall 
consist of information regarding deceased individuals maintained by the 
Commissioner of Social Security, except for information furnished to or 
maintained by the Commissioner pursuant to paragraphs (1) or (2), and 
the death information to be provided shall consist only of the name, 
social security number, date of birth, and date of death of a deceased 
individual.''
    ``(B) The Commissioner may disclose death information under this 
paragraph to the Secretary of Defense provided that--
            ``(i) the Secretary uses the information provided solely 
        for the purpose of assisting in the identification of 
        unidentified remains, and
            ``(ii) the Secretary enforces requirements similar to those 
        in clauses (i), (ii), (iv), (v), (vi), and (vii) with respect 
        to any contractor the Secretary hires to assist in such 
        identifications.
    ``(C) The Commissioner of Social Security may disclose death 
information, except for information furnished to or maintained by the 
Commissioner of Social Security pursuant to paragraphs (1) or (2), 
provided the requirements of this paragraph and the requirements of 
subparagraphs (A) and (B) of paragraph (3) are met.
    ``(D) The Commissioner may disclose--
            ``(i) to any entity, information maintained by the 
        Commissioner concerning individuals whose date of death 
        occurred at least 3 calendar years prior to the year that the 
        entity requests such information pursuant to a written 
        agreement; and
            ``(ii) to any entity `certified' by the Commissioner under 
        subparagraph (E), information maintained by the Commissioner 
        concerning individuals whose date of death does not satisfy the 
        requirements of clause (i), pursuant to a written agreement 
        between the Commissioner and the entity.
    ``(E) For purposes of this paragraph an entity is `certified' only 
if the Commissioner--
            ``(i) establishes procedures to certify and decertify 
        entities eligible to obtain such information;
            ``(ii) includes in the agreement with such an entity 
        provisions to require such entity to safeguard the information 
        provided, assure that the information is used only for the 
        purpose which was the basis for the certification, assure that 
        the information is not disclosed by the entity to any other 
        entity, and include contractual penalties, including monetary 
        penalties and loss of certification, for the violation of any 
        requirements imposed by the Commissioner as a condition of 
        receiving the information;
            ``(iii) requires that the entity demonstrate that--
                    ``(I) it has a legitimate business need for the 
                information, which shall include a requirement that the 
                information regarding a deceased individual will aid in 
                preventing financial harm to the entity or to a 
                customer or client of the entity or will aid in 
                permitting the entity to fulfill an obligation to a 
                beneficiary of an individual that is contingent upon 
                the death of such individual; or
                    ``(II) it has a legitimate interest in preventing 
                fraud or unauthorized financial transactions;
            ``(iv) requires that the entity demonstrate that it has 
        infrastructure and procedures in place to prevent wrongful 
        access to or the disclosure of information provided by the 
        Commissioner;
            ``(v) determines that the entity has adequate experience 
        and expertise in maintaining the confidentiality and security 
        of information;
            ``(vi) includes such other requirements and restrictions as 
        the Commissioner deems appropriate to assure the 
        confidentiality of the information; and
            ``(vii) requires that the entity permit periodic and 
        unscheduled audits of the entity to assure compliance with the 
        requirements established by the Commissioner.
    ``(F) The Commissioner shall establish application and other fees 
to be paid by entities seeking to be certified or to maintain 
certification under this paragraph so that the Commissioner is fully 
reimbursed for all costs associated with development of the 
certification process, evaluating applications, auditing compliance 
with the requirements established by the Commissioner, inspecting 
records and assuring compliance with contract requirements, and any 
other costs associated with assuring continuing eligibility for 
certification under this paragraph.
    ``(G) For purposes of this paragraph, the terms `entity' or 
`entities' includes `individual' and `individuals' respectively.
    ``(H) The Commissioner may delegate any of the activities under 
this paragraph to another agency and may perform any activity through a 
contractor, provided that the delegation or contract requires such 
agency or contractor to comply with all requirements of this section 
and of the implementing policies developed by the Commissioner.'';
            (6) by adding at the end the following new paragraph:
    ``(10) Information related to a deceased individual received by the 
Commissioner of Social Security other than as described in paragraph 
(1) shall be treated for purposes of paragraph (6) in the same manner 
as information received as described in paragraph (1).''.
    (b) Report.--Not later than 1 year after the date of the enactment 
of this Act and each year thereafter through 2019, the Commissioner of 
Social Security shall submit to the Committee on Finance of the Senate 
and the Committee on Ways and Means of the House of Representatives a 
report describing the entities certified by the Commissioner under 
section 205(r)(7) of the Social Security Act (42 U.S.C. 405(r)(7)) 
during the preceding year and their compliance with the requirements of 
subparagraph (E) of such section.
    (c) Effective Dates.--
            (1) In general.--Except as provided in paragraph (2), the 
        amendments made by this section take effect on the date that is 
        60 days after the date of the enactment of this Act.
            (2) Exception.--The amendment made by subsection (a)(6) 
        shall take effect on January 1, 2014.
    (d) Sunset.--Subparagraphs (C) through (H) of section 205(r)(7) of 
the Social Security Act (42 U.S.C. 405(r)(7)) (as amended by subsection 
(a)) shall cease to be effective on January 1, 2019, except that--
            (1) clauses (ii) and (iv) of subparagraph (E) of such 
        section shall continue to apply for purposes of section 
        205(r)(5)(B) of such Act (42 U.S.C. 405(r)(5)(B)) (as amended 
        by subsection (a)).