Consumer Data Protection Act

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Consumer Data Protection Act''.

SEC. 2. DATA SECURITY.

    (a) In General.--The Fair Credit Reporting Act (15 U.S.C. 1681 et 
seq.) is amended by inserting after section 605B (15 U.S.C. 1681c-2) 
the following:

``SEC. 605C. DATA SECURITY AT CONSUMER REPORTING AGENCIES.

    ``(a) Definitions.--In this section--
            ``(1) the term `affected individual' means an individual, 
        the sensitive personal information of whom is lost, stolen, or 
        accessed without authorization because of a data breach;
            ``(2) the term `appropriate committees of Congress' means--
                    ``(A) the Committee on the Judiciary of the Senate;
                    ``(B) the Committee on Banking, Housing, and Urban 
                Affairs of the Senate;
                    ``(C) the Committee on the Judiciary of the House 
                of Representatives; and
                    ``(D) the Committee on Financial Services of the 
                House of Representatives;
            ``(3) the term `covered action' means an action that 
        restricts the legal rights available to a consumer, including--
                    ``(A) requiring the consumer to--
                            ``(i) waive the right of the consumer to--
                                    ``(I) file a civil action in an 
                                appropriate court; or
                                    ``(II) bring, or participate in, a 
                                class action; or
                            ``(ii) engage in settlement negotiations 
                        before bringing an action under subsection 
                        (c)(3); and
                    ``(B) offering a financial inducement in exchange 
                for the consumer waiving any right of the consumer;
            ``(4) the term `credit freeze'--
                    ``(A) except as provided in subparagraph (B), means 
                a restriction placed on the consumer report of a 
                consumer at the request of the consumer, or a personal 
                representative of the consumer, that prohibits a 
                consumer reporting agency from releasing the consumer 
                report for any purpose; and
                    ``(B) with respect to the consumer report of a 
                consumer, shall not apply to the use of the consumer 
                report by--
                            ``(i) a person, or a subsidiary, affiliate, 
                        agent, subcontractor, or assignee of the 
                        person, with which the consumer has, or before 
                        assignment had, an account, contract, or 
                        debtor-creditor relationship for the purposes 
                        of--
                                    ``(I) reviewing the active account; 
                                or
                                    ``(II) collecting the financial 
                                obligation owed on the account, 
                                contract, or debt;
                            ``(ii) any person acting under a court 
                        order, warrant, or subpoena;
                            ``(iii) a Federal, State, or local 
                        government or an agent or assignee of a 
                        Federal, State, or local government;
                            ``(iv) any person for the sole purpose of 
                        providing a credit monitoring or identity theft 
                        protection service to which the consumer has 
                        subscribed;
                            ``(v) any person for the purpose of 
                        providing a consumer with a copy of the 
                        consumer report, credit score, or educational 
                        credit score of the consumer upon request by 
                        the consumer;
                            ``(vi) any person or entity for insurance 
                        purposes, including use in setting or adjusting 
                        a rate, adjusting a claim, or underwriting; and
                            ``(vii) any person acting under an 
                        authorization from a consumer to use the 
                        consumer report of the consumer for employment 
                        purposes;
            ``(5) the term `data breach' means the loss, theft, or 
        other unauthorized access, other than access that is incidental 
        to the scope of employment, of data containing sensitive 
        personal information, in electronic or printed form, that 
        results in the potential compromise of the confidentiality or 
        integrity of the data; and
            ``(6) the term `sensitive personal information' means, with 
        respect to an individual, information--
                    ``(A) about the individual relating to the 
                education, financial transactions, medical history, 
                criminal history, or employment history of the 
                individual; and
                    ``(B) that can be used to distinguish or trace the 
                identity of the individual, including the name, social 
                security number, date and place of birth, mother's 
                maiden name, and biometric records of the individual.
    ``(b) Data Breaches at Consumer Reporting Agencies.--With respect 
to a data breach at a consumer reporting agency, the consumer reporting 
agency--
            ``(1) subject to paragraph (2), shall notify--
                    ``(A) not later than 2 days after the date on which 
                the consumer reporting agency discovers the data 
                breach--
                            ``(i) the Federal Trade Commission;
                            ``(ii) the Bureau; and
                            ``(iii) appropriate law enforcement and 
                        intelligence agencies, as identified by the 
                        Secretary of Homeland Security; and
                    ``(B) not later than 3 days after the date on which 
                the consumer reporting agency discovers the data 
                breach, and as quickly and efficiently as is 
                practicable, each affected individual with respect to 
                the data breach;
            ``(2) may receive an extension of the 2-day deadline 
        described in paragraph (1)(A) or the 3-day deadline described 
        in paragraph (1)(B) if the Federal Trade Commission and the 
        intelligence agencies identified under paragraph (1)(A)(iii) 
        determine that there is a national security concern that 
        requires granting such an extension;
            ``(3) shall, upon request by any affected individual with 
        respect to the data breach, provide, without charge to the 
        affected individual and during the lifetime of the affected 
        individual--
                    ``(A) a credit freeze, including the cost relating 
                to imposing, lifting, or permanently removing a credit 
                freeze, with respect to the consumer report of the 
                affected individual at any consumer reporting agency 
                described in section 603(p); and
                    ``(B) credit monitoring services for the affected 
                individual at any consumer reporting agency described 
                in section 603(p); and
            ``(4) shall, in consultation with the Bureau, establish a 
        consumer assistance unit--
                    ``(A) that shall--
                            ``(i) be carried out, and paid for, by the 
                        consumer reporting agency; and
                            ``(ii) provide assistance, free of charge 
                        and for a period of 10 years beginning on the 
                        date on which the consumer reporting agency 
                        submits the notifications required under 
                        paragraph (1)(A), to any affected individual 
                        who wants to dispute an item in the file of the 
                        affected individual that was entered into that 
                        file after the date on which the data breach 
                        occurred; and
                    ``(B) with respect to which the consumer reporting 
                agency shall, as soon as practicable after the date on 
                which the consumer assistance unit is established, 
                notify each affected individual with respect to the 
                data breach by mail and e-mail.
    ``(c) Enforcement.--
            ``(1) In general.--Subject to subtitle B of the Consumer 
        Financial Protection Act of 2010 (12 U.S.C. 5511 et seq.), the 
        Federal Trade Commission or the Bureau may bring a civil action 
        to recover a civil penalty in an appropriate district court of 
        the United States against any person that negligently, 
        knowingly, or willingly causes a data breach at a consumer 
        reporting agency.
            ``(2) Penalty amount.--
                    ``(A) In general.--In a successful action brought 
                under paragraph (1), the person against which the 
                action is brought shall be liable for a civil penalty 
                of not more than--
                            ``(i) $2,500 for each affected individual 
                        with respect to the data breach caused by the 
                        person; and
                            ``(ii) $25,000,000 in total.
                    ``(B) Considerations.--In determining the amount of 
                a civil penalty in a successful action brought under 
                paragraph (1), the court shall consider, with respect 
                to the person against which the action is brought--
                            ``(i) the degree of culpability of the 
                        person;
                            ``(ii) any history of similar prior conduct 
                        by the person;
                            ``(iii) the ability of the person to pay;
                            ``(iv) the effect of the penalty on the 
                        ability of the person to continue to do 
                        business; and
                            ``(v) any other factor as justice may 
                        require.
            ``(3) Private cause of action.--
                    ``(A) Definition.--In this paragraph, the term 
                `actual loss' means the total cost to an affected 
                individual as a result of a data breach at a consumer 
                reporting agency, including--
                            ``(i) the costs incurred by the affected 
                        individual--
                                    ``(I) in responding to the data 
                                breach; and
                                    ``(II) as a result of--
                                            ``(aa) reviewing accounts 
                                        of the affected individual for 
                                        fraudulent charges;
                                            ``(bb) closing accounts of 
                                        the affected individual that 
                                        may have been compromised by 
                                        the data breach; and
                                            ``(cc) imposing credit 
                                        freezes and obtaining credit 
                                        monitoring services; and
                            ``(ii) any revenue lost, or cost or 
                        consequential damage incurred, by the affected 
                        individual relating to the interruption of the 
                        ability of the affected individual to obtain 
                        credit.
                    ``(B) Cause of action.--
                            ``(i) In general.--An affected individual 
                        may bring an action in an appropriate district 
                        court of the United States against any person 
                        that negligently, knowingly, or willingly 
                        caused a data breach at a consumer reporting 
                        agency in which the sensitive personal 
                        information of the affected individual was 
                        lost, stolen, or accessed without 
                        authorization.
                            ``(ii) Damages.--In a successful action 
                        brought by an affected individual under clause 
                        (i), the affected individual may recover--
                                    ``(I) the greater of--
                                            ``(aa) the actual loss to 
                                        the affected individual with 
                                        respect to the data breach 
                                        described in that clause; or
                                            ``(bb) $1,000 in liquidated 
                                        damages;
                                    ``(II) punitive damages, as the 
                                court may allow; and
                                    ``(III) the costs of the action, 
                                together with reasonable attorney's 
                                fees, as determined by the court.
    ``(d) Review of Compliance With Standards for Safeguarding Customer 
Information.--
            ``(1) Definition.--In this subsection, the term `covered 
        person' has the meaning given the term in section 1002 of the 
        Consumer Financial Protection Act of 2010 (12 U.S.C. 5481).
            ``(2) Examination.--The Bureau may examine any consumer 
        reporting agency that is a covered person subject to 
        supervision under section 1024 of the Consumer Financial 
        Protection Act of 2010 (12 U.S.C. 5514) for compliance by that 
        agency with the standards established by the Federal Trade 
        Commission under section 501(b) of the Gramm-Leach-Bliley Act 
        (15 U.S.C. 6801(b)).
    ``(e) Protection of Legal Rights of Consumers.--A consumer 
reporting agency may not take a covered action--
            ``(1) as a condition of providing any service or product 
        to, or on behalf of, a consumer; and
            ``(2) that relates to the rights of a consumer after a data 
        breach at the consumer reporting agency in which the sensitive 
        personal information of the consumer is lost, stolen, or 
        accessed without authorization.
    ``(f) Annual Study and Report.--
            ``(1) In general.--Beginning in the first full year after 
        the date of enactment of this section, and annually thereafter, 
        the Bureau and the Federal Trade Commission, in consultation 
        with the Attorney General, shall conduct a study regarding the 
        costs to affected individuals from data breaches at consumer 
        reporting agencies, including--
                    ``(A) the economic costs to those affected 
                individuals;
                    ``(B) the effects on--
                            ``(i) the ability of those affected 
                        individuals to obtain credit and housing; and
                            ``(ii) the reputations of those affected 
                        individuals; and
                    ``(C) the costs relating to the emotional and 
                psychological stress of those affected individuals from 
                having the sensitive personal information of those 
                affected individuals lost, stolen, or accessed without 
                authorization.
            ``(2) Submission to congress.--Not later than 30 days after 
        the date on which each study conducted under paragraph (1) is 
        completed, the Bureau and the Federal Trade Commission shall 
        submit to the appropriate committees of Congress a report that 
        contains the results of the study.
            ``(3) Contents.--Each study conducted under paragraph (1) 
        and each report submitted under paragraph (2) shall contain a 
        survey of affected individuals who were contacted for the 
        purposes of conducting the study.
            ``(4) Authority.--In conducting any study under paragraph 
        (1), the Bureau, the Federal Trade Commission, and the Attorney 
        General may compel a consumer reporting agency to disclose 
        nonproprietary information.
    ``(g) Rule of Construction.--Nothing in this section may be 
construed as modifying, limiting, or superseding any provision of State 
law if the protection that the provision of State law provides to 
consumers is greater than the protection provided to consumers under 
this section.''.
    (b) Technical and Conforming Amendment.--The table of contents for 
the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.) is amended by 
inserting after the item relating to section 605B the following:

``605C. Data security at consumer reporting agencies.''.

Summary: Consumer Data Protection Act This bill amends the Fair Credit Reporting Act to direct a consumer reporting agency experiencing a data breach to: (1) notify the Federal Trade Commission, the Consumer Financial Protection Bureau (CFPB), other appropriate law enforcement agencies, and affected individuals. (2) provide affected individuals with free credit freezes and credit monitoring services. And (3) establish a consumer assistance unit. The bill also establishes legal enforcement provisions concerning data breaches at consumer reporting agencies. The CFPB may examine a consumer reporting agency to assess compliance with personal information protection laws.