SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Identity Theft and Financial Privacy 
Protection Act of 2003''.

SEC. 2. FINDINGS.

    Congress finds that--
            (1) the crime of identity theft has become one of the major 
        law enforcement challenges of the new economy, as vast 
        quantities of sensitive, personal information are now 
        vulnerable to criminal interception and misuse;
            (2) according to the Attorney General, ``in addition to the 
        credit card and financial fraud crimes often committed, 
        identity theft is a major facilitator of international 
        terrorism'';
            (3) a number of indicators reveal that, despite increased 
        public awareness of the crime, the incidents of identity theft 
        continue to rise;
            (4) 1,000,000 consumers annually call the Fraud Victim 
        Assistance Department of one national consumer reporting 
        agency, a number that almost doubled from 1997 to 2001;
            (5) between January and December of 2002, the complaint 
        database operated by the Federal Trade Commission received 
        380,103 consumer fraud and identity theft complaints, with 
        reported losses from fraud of more than $343,000,000;
            (6) allegations of identity theft reported to the fraud 
        hotline of the Social Security Administration increased from 
        11,058 in fiscal year 1998 to 46,480 in fiscal year 2000;
            (7) in its fiscal year 2000 annual report, the Postal 
        Inspection Service noted that identity theft is a growing trend 
        and the agency's investigations of such crimes has ``increased 
        by 67 percent since last year'';
            (8) an integral part of many identity crimes involves the 
        interception of personal financial data or the fraudulent 
        acquisition of credit cards and other financial products in 
        another person's name;
            (9) identity theft is an act that violates the privacy of 
        our citizens and ruins their good names, victims can suffer 
        restricted access to credit and diminished employment 
        opportunities, and may spend years repairing damage to credit 
        histories;
            (10) the resources available to identity theft victims are 
        inadequate, and both private sector and Federal agencies should 
        provide better and more sympathetic assistance to such victims; 
        and
            (11) credit reporting agencies and issuers of credit should 
        have uniform reporting requirements and effective fraud alerts 
        to assist identity theft victims in repairing and protecting 
        their credit.

SEC. 3. IDENTITY THEFT PREVENTION.

    (a) Changes of Address.--
            (1) Duty of issuers of credit.--Section 132 of the Truth in 
        Lending Act (15 U.S.C. 1642) is amended--
                    (A) by inserting ``(a) In General.--'' before ``No 
                credit''; and
                    (B) by adding at the end the following:
    ``(b) Confirmation of Changes of Address.--If a card issuer 
receives a request for an additional credit card with respect to an 
existing credit account not later than 30 days after receiving 
notification of a change of address for that account, the card issuer 
shall--
            ``(1) notify the cardholder of the request at both the new 
        address and the former address in accordance with reasonable 
        policies and procedures established by the card issuer pursuant 
        to regulations which the Board shall prescribe; and
            ``(2) provide to the cardholder a means of promptly 
        reporting incorrect changes.''.
            (2) Duty of consumer reporting agencies.--Section 605 of 
        the Fair Credit Reporting Act (15 U.S.C. 1681c) is amended by 
        adding at the end the following:
    ``(g) Notice of Potential Fraud.--In any case in which a person has 
requested a consumer report relating to a consumer, and the request 
includes an address for the consumer that substantially differs from 
the most recent address in the file of the consumer, the consumer 
reporting agency shall--
            ``(1) notify the requester of the discrepancy; and
            ``(2) reconcile or resolve any substantial variation 
        between the most recent address in the file of the consumer at 
        the agency and the address contained in the request, in 
        accordance with reasonable policies and procedures established 
        by the consumer reporting agency.''.
            (3) Enforcement.--
                    (A) Federal trade commission.--Except as provided 
                in subparagraph (B), compliance with section 132(b) of 
                the Truth in Lending Act (as added by this subsection) 
                shall be enforced by the Federal Trade Commission in 
                the same manner and with the same power and authority 
                as the Commission has under the Fair Debt Collection 
                Practices Act to enforce compliance with that Act.
                    (B) Other agencies in certain cases.--
                            (i) In general.--Compliance with section 
                        132(b) of the Truth in Lending Act (as added by 
this subsection) shall be enforced under--
                                    (I) section 8 of the Federal 
                                Deposit Insurance Act, in the case of a 
                                card issuer that is--
                                            (aa) a national bank or a 
                                        Federal branch or Federal 
                                        agency of a foreign bank, by 
                                        the Office of the Comptroller 
                                        of the Currency;
                                            (bb) a member bank of the 
                                        Federal Reserve System (other 
                                        than a national bank), a branch 
                                        or agency of a foreign bank 
                                        (other than a Federal branch, 
                                        Federal agency, or insured 
                                        State branch of a foreign 
                                        bank), a commercial lending 
                                        company owned or controlled by 
                                        a foreign bank, or an 
                                        organization operating under 
                                        section 25 or 25A of the 
                                        Federal Reserve Act, by the 
                                        Board of Governors of the 
                                        Federal Reserve System;
                                            (cc) a bank insured by the 
                                        Federal Deposit Insurance 
                                        Corporation (other than a 
                                        member of the Federal Reserve 
                                        System or a national nonmember 
                                        bank) or an insured State 
                                        branch of a foreign bank, by 
                                        the Board of Directors of the 
                                        Federal Deposit Insurance 
                                        Corporation; and
                                            (dd) a savings association, 
                                        the deposits of which are 
                                        insured by the Federal Deposit 
                                        Insurance Corporation, by the 
                                        Director of the Office of 
Thrift Supervision; and
                                    (II) the Federal Credit Union Act, 
                                by the Administrator of the National 
                                Credit Union Administration in the case 
                                of a card issuer that is a Federal 
                                credit union, as defined in that Act.
                    (C) Violations treated as violations of other 
                laws.--For the purpose of the exercise by any agency 
                referred to in this paragraph of its powers under any 
                Act referred to in this paragraph, a violation of 
                section 132(b) of the Truth in Lending Act (as added by 
                this subsection) shall be deemed to be a violation of a 
                requirement imposed under that Act. In addition to its 
                powers under any provision of law specifically referred 
                to in subparagraph (A) or (B), each of the agencies 
                referred to in those subparagraphs may exercise, for 
                the purpose of enforcing compliance with section 132(b) 
                of the Truth in Lending Act (as added by this 
                subsection), any other authority conferred on such 
                agency by law.
    (b) Fraud Alerts.--Section 605 of the Fair Credit Reporting Act (15 
U.S.C. 1681c) is amended by adding at the end the following:
    ``(h) Fraud Alerts.--
            ``(1) In general.--Upon the request of a consumer who 
        expresses a suspicion that the consumer has been or is about to 
        become a victim of fraud or related crime, and upon receiving 
        proper identification, a consumer reporting agency shall 
        include a fraud alert in the file of that consumer.
            ``(2) Notice to users.--A consumer reporting agency shall 
        notify each person procuring consumer credit information with 
        respect to a consumer of the existence of a fraud alert in the 
        file of that consumer, regardless of whether a full credit 
        report, credit score, or summary report is requested.
            ``(3) Penalties.--Any user of a consumer report who issues 
        or extends credit in the name of the consumer to a person other 
        than the consumer without attempting to comply with the 
        preauthorization procedures contained in a fraud alert in 
        effect for such consumer shall be in violation of this section.
            ``(4) Definition.--In this subsection, the term `fraud 
        alert' means a clear and conspicuous statement in the file of a 
        consumer that notifies all prospective users of a consumer 
        report made with respect to that consumer that the consumer 
        does not authorize the issuance or extension of credit in the 
        name of the consumer unless--
                    ``(A) the issuer of such credit first obtains 
                verbal authorization from the consumer at a telephone 
                number designated by the consumer; or
                    ``(B) the issuer of such credit utilizes another 
                reasonable means of communication to obtain the express 
                preauthorization of the consumer.
            ``(5) Exceptions.--
                    ``(A) Resellers.--
                            ``(i) In general.--The provisions of this 
                        subsection shall not apply to a consumer 
                        reporting agency that acts as a reseller of 
                        information by assembling and merging 
                        information contained in the database of 
                        another consumer reporting agency or multiple 
                        consumer reporting agencies, and does not 
                        maintain a permanent database of the assembled 
                        or merged information from which new consumer 
                        reports are produced.
                            ``(ii) Limitation.--A reseller of assembled 
                        or merged information shall preserve any fraud 
                        alert placed on a consumer report by another 
                        consumer reporting agency.
                    ``(B) Exempt institutions.--The requirement under 
                this subsection to place a fraud alert in a consumer 
                file shall not apply to--
                            ``(i) a check services company, which 
                        issues authorizations for the purpose of 
                        approving or processing negotiable instruments, 
                        electronic funds transfers, or similar methods 
                        of payments; or
                            ``(ii) a demand deposit account information 
                        service company, which issues reports regarding 
                        account closures due to fraud, substantial 
                        overdrafts, ATM abuse, or similar negative 
                        information regarding a consumer, to inquiring 
                        banks or other financial institutions for use 
                        only in reviewing a consumer request for a 
                        demand deposit account at the inquiring bank or 
                        financial institution.''.
    (c) Rules on Complaint Referral, Investigations, and Inquiries.--
Not later than 365 days after the date of enactment of this Act, the 
Federal Trade Commission (in this subsection referred to as the 
``Commission'') shall prescribe rules in accordance with section 553 of 
title 5, United States Code--
            (1) to develop procedures for referral of consumer 
        complaints about identity theft and fraud alerts between and 
        among the consumer reporting agencies and the Commission; and
            (2) to develop a model form and standard procedures to be 
        used by consumers who are victims of identity fraud for 
        contacting and informing creditors and consumer reporting 
        agencies of the fraud.

SEC. 4. TRUNCATION OF CREDIT CARD AND DEBIT CARD ACCOUNT NUMBERS.

    (a) In General.--Except as provided in this section, no person, 
firm, partnership, association, corporation, or limited liability 
company that accepts credit cards or debit cards for the transaction of 
business shall print more than the last 4 digits of the credit card 
account number or the expiration date upon any receipt provided to the 
cardholder at the point of the sale or transaction.
    (b) Limitation.--This section applies only to receipts that are 
electronically printed, and does not apply to transactions in which the 
sole means of recording the person's credit card or debit card account 
number is by handwriting or by an imprint or copy of the credit card or 
debit card.
    (c) Definitions.--For purposes of this section, the following 
definitions shall apply:
            (1) Credit card.--The term ``credit card'' has the same 
        meaning as in section 103(k) of the Truth in Lending Act.
            (2) Debit card.--The term ``debit card'' means any card 
        issued by a financial institution to a consumer for use in 
        initiating electronic fund transfers (as defined in section 
        903(6) of the Electronic Fund Transfer Act) from the account of 
        the consumer at such financial institution for the purpose of 
        transferring money between accounts or obtaining money, 
        property, labor, or services.
    (d) Effective Date.--This section shall become effective on--
            (1) January 1, 2007, with respect to any cash register or 
        other machine or device that electronically prints receipts for 
        credit card transactions that is in use before January 1, 2005; 
        and
            (2) January 1, 2005, with respect to any cash register or 
        other machine or device that electronically prints receipts for 
        credit card transactions that is first put into use on or after 
        such date.

SEC. 5. FREE REPORTS ANNUALLY.

    Section 612(c) of the Fair Credit Reporting Act (15 U.S.C. 
1681j(c)) is amended to read as follows:
    ``(c) Free Annual Disclosure.--Upon the request of the consumer, a 
consumer reporting agency shall make all disclosures pursuant to 
section 609 once during any 12-month period without charge to the 
consumer.''.
Identity Theft and Financial Privacy Protection Act of 2003 - Amends the Truth in Lending Act to prescribe duties imposed upon: (1) a card issuer with respect to confirmation of a consumer's changes of address; and (2) a consumer reporting agency with respect to notice of potential fraud.

Amends the Fair Credit Reporting Act to prescribe duties imposed upon a consumer reporting agency with respect to notice of potential fraud.

Exempts from such requirements: (1) certain consumer reporting agencies acting as resellers of information; (2) certain check services companies; and (3) certain demand deposit account information service companies.

Mandates truncation of credit card and debit card account numbers.

Requires a consumer reporting agency to furnish, upon consumer request, a free annual disclosure of the information in the consumer's file.
To prevent identity theft, and for other purposes.