To amend the Fair Credit Reporting Act to provide individuals the ability to control access to their credit reports, and for other purposes.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Identity Theft Protection Act of 
2006''.

SEC. 2. PROTECTION OF DATA THROUGH SECURITY FREEZE.

    (a) In General.--The Fair Credit Reporting Act (15 U.S.C. 1681 et 
seq.) is amended by inserting after section 605B (relating to block 
resulting from identity theft) the following new section:
``Sec. 605C. Protection of data through security freeze
    ``(a) In General.--
            ``(1) Emplacement.--A consumer may place a security freeze 
        on the consumer report of the consumer by making a request to a 
        consumer reporting agency in writing or by telephone.
            ``(2) Consumer disclosure.--If a consumer requests a 
        security freeze, the consumer reporting agency shall disclose 
        to the consumer the process of placing and removing the 
        security freeze and explain to the consumer the potential 
        consequences of the security freeze.
    ``(b) Effect of Security Freeze.--
            ``(1) Release of information blocked.--If a security freeze 
        is in place on a consumer report of a consumer, a consumer 
        reporting agency may not release the consumer report or 
        information from the consumer report to a third party without 
        prior express authorization from the consumer.
            ``(2) Information provided to third parties.--Paragraph (2) 
        shall not be construed as preventing a consumer reporting 
        agency from advising a third party that a security freeze is in 
        effect with respect to a consumer report of a consumer.
            ``(3) Treatment as incomplete application.--If a third 
        party, in connection with an application for credit, requests 
        access to a consumer report on which a security freeze is in 
        place, the third party may treat the application as incomplete.
    ``(c) Removal; Temporary Suspension.--
            ``(1) In general.--Except as provided in paragraph (4), a 
        security freeze shall remain in place until the consumer 
        requests that the security freeze be removed. A consumer may 
        remove a security freeze on the consumer report of the consumer 
        by making a request to a consumer reporting agency in writing 
        or by telephone.
            ``(2) Conditions.--A consumer reporting agency may remove a 
        security freeze placed on the consumer report of a consumer 
        only--
                    ``(A) upon the consumer's request, pursuant to 
                paragraph (1); or
                    ``(B) if the agency determines that the consumer 
                report of a consumer was frozen due to a material 
                misrepresentation of fact by the consumer.
            ``(3) Notification to consumer.--If a consumer reporting 
        agency intends to remove a freeze upon the consumer report of a 
        consumer pursuant to paragraph (2)(B), the consumer reporting 
        agency shall notify the consumer in writing prior to removing 
        the freeze on the consumer report.
            ``(4) Temporary suspension.--A consumer may have a security 
        freeze on the consumer report of the consumer temporarily 
        suspended by making a request to a consumer reporting agency in 
        writing or by telephone and specifying beginning and ending 
        dates for the period during which the security freeze is not to 
        apply to the consumer report of the consumer.
    ``(d) Response Times; Notification of Other Entities.--
            ``(1) In general.--A consumer reporting agency shall--
                    ``(A) place a security freeze on the consumer 
                report of a consumer under subsection (a) not later 
                than 5 business days after receiving a request from the 
                consumer under subsection (a)(1); and
                    ``(B) remove, or temporarily suspend, a security 
                freeze within 3 business days after receiving a request 
                for removal or temporary suspension from the consumer 
                under subsection (c).
            ``(2) Notification of other covered entities.--If the 
        consumer requests in writing or by telephone that other covered 
        entities be notified of the request, the consumer reporting 
        agency shall notify all other consumer reporting agencies 
        described in section 603(p)(1) of the request within 3 days 
        after placing, removing, or temporarily suspending a security 
        freeze on the consumer report of the consumer under subsection 
        (a), (c)(2)(A), or (c)(4), respectively.
            ``(3) Implementation by other covered entities.--A consumer 
        reporting agency that is notified of a request under paragraph 
        (2) to place, remove, or temporarily suspend a security freeze 
        on a consumer report of a consumer shall place, remove, or 
        temporarily suspend the security freeze on that consumer report 
        within 3 business days after receiving the notification.
    ``(e) Confirmation.--
            ``(1) In general.--Whenever a consumer reporting agency 
        places, removes, or temporarily suspends a security freeze on 
        the consumer report of a consumer at the request of that 
        consumer under subsection (a) or (c), respectively, the 
        consumer reporting agency shall send a written confirmation of 
        such action to the consumer within 10 business days after 
        placing, removing, or temporarily suspending the security 
        freeze on the consumer report.
            ``(2) Exception.--This subsection shall not apply to the 
        placement, removal, or temporary suspension of a security 
        freeze by a consumer reporting agency because of a notification 
        received under subsection (d)(2).
    ``(f) ID Required.--A consumer reporting agency may not place, 
remove, or temporarily suspend a security freeze on the consumer report 
of a consumer at the consumer's request unless the consumer provides 
proper identification (within the meaning of section 610(a)(1)) and the 
regulations prescribed under such subsection.
    ``(g) Exceptions.--This section shall not apply to the use of a 
consumer credit report by any of the following:
            ``(1) A person or entity, or a subsidiary, affiliate, or 
        agent of that person or entity, or an assignee of a financial 
        obligation owing by the consumer to that person or entity, or a 
        prospective assignee of a financial obligation owing by the 
        consumer to that person or entity in conjunction with the 
        proposed purchase of the financial obligation, with which the 
        consumer has or had prior to assignment an account or contract, 
        including a demand deposit account, or to whom the consumer 
        issued a negotiable instrument, for the purposes of reviewing 
        the account or collecting the financial obligation owing for 
        the account, contract, or negotiable instrument.
            ``(2) Any Federal, State or local agency, law enforcement 
        agency, trial court, or private collection agency acting 
        pursuant to a court order, warrant, or subpoena.
            ``(3) A child support agency or its agents or assigns 
        acting pursuant to subtitle D of title IV of the Social 
        Security Act or similar State law.
            ``(4) The Department of Health and Human Services, a 
        similar State agency, or the agents or assigns of the Federal 
        or State agency acting to investigate medicare or medicaid 
        fraud.
            ``(5) The Internal Revenue Service or a State or municipal 
        taxing authority, or a State department of motor vehicles, or 
        any of the agents or assigns of these Federal, State, or 
        municipal agencies acting to investigate or collect delinquent 
        taxes or unpaid court orders or to fulfill any of their other 
        statutory responsibilities.
            ``(6) The use of consumer credit information for the 
        purposes of prescreening as provided under this title.
            ``(7) Any person or entity administering a credit file 
        monitoring subscription to which the consumer has subscribed.
            ``(8) Any person or entity for the purpose of providing a 
        consumer with a copy of his or her credit report or credit 
        score upon the consumer's request.
    ``(h) Fees.--
            ``(1) In general.--
                    ``(A) Certain reasonable fees allowed.--Except as 
                provided in paragraph (2), a consumer reporting agency 
                may charge a reasonable fee, as determined by the 
                Commission, for placing or temporarily suspending a 
                security freeze on the consumer report of a consumer.
                    ``(B) Factors to be considered.--In considering 
                what is reasonable for the purpose of subparagraph (A), 
                the Commission shall consider the prevailing fees 
                permitted by State law immediately before the date of 
                the enactment of the Identity Theft Protection Act of 
                2006.
                    ``(C) Fee for removal of freeze prohibited.--No fee 
                may be charged for removal of a security freeze.
            ``(2) ID theft victims.--A consumer reporting agency may 
        not charge a fee for placing, removing, or temporarily 
        suspending a security freeze on the consumer report of a 
        consumer if--
                    ``(A) the consumer--
                            ``(i) is a victim of identity theft; and
                            ``(ii) has filed a police report, 
                        investigative report, or complaint made to a 
                        police department with respect to the theft; or
                    ``(B) the consumer is the recipient of a notice 
                that a breach of data security has occurred with 
                respect to information of the consumer that is required 
                by law to be maintained securely and in confidence.
    ``(i) Limitation on Information Changes in Frozen Reports.--
            ``(1) In general.--If a security freeze is in place on the 
        consumer report of a consumer, a consumer reporting agency may 
        not change any of the following official information in that 
        consumer report without sending a written confirmation of the 
        change to the consumer within 30 days after the change is made:
                    ``(A) Name.
                    ``(B) Date of birth.
                    ``(C) Social Security number.
                    ``(D) Address.
            ``(2) Confirmation.--
                    ``(A) In general.--Paragraph (1) shall not be 
                construed as requiring written confirmation for 
                technical modifications of a consumer's official 
                information, including name and street abbreviations, 
                complete spellings, or transposition of numbers or 
                letters.
                    ``(B) Old and new addresses.--In the case of an 
                address change, the written confirmation shall be sent 
                to both the new address and to the former address.
    ``(j) Certain Entity Exemptions.--
            ``(1) Aggregators and other agencies.--The provisions of 
        subsections (a) through (h) shall not apply to a consumer 
        reporting agency that acts only as a reseller of credit 
        information by assembling and merging information contained in 
        the data base of another consumer reporting agency or multiple 
        consumer reporting agencies, and does not maintain a permanent 
        data base of consumer information from which new consumer 
        reports are produced.
            ``(2) Other exempted entities.--The following entities 
        shall not be required to place a security freeze in a consumer 
        report under this section:
                    ``(A) A check services or fraud prevention services 
                company, which issues reports on incidents of fraud or 
                authorizations for the purpose of approving or 
                processing negotiable instruments, electronic funds 
                transfers, or similar methods of payments.
                    ``(B) A deposit account information service 
                company, which issues reports regarding account 
                closures due to fraud, substantial overdrafts, 
                automated teller machine abuse, or similar negative 
                information regarding a consumer, to inquiring 
                depository institutions or other financial institutions 
                for use only in reviewing a consumer request for a 
                deposit account at the inquiring depository institution 
                or other financial institution.''.
    (b) Effective Date.--The amendment made by subsection (a) shall 
take effect at the end of the 6-month period beginning on the date of 
the enactment of this Act.

Summary: Identity Theft Protection Act of 2006 - Amends the Fair Credit Reporting Act to permit a consumer to request a consumer reporting agency to place a security freeze upon his consumer report. Prohibits a consumer reporting agency, if a security freeze is in place, from releasing a consumer report to a third party without prior express authorization from the consumer. Prescribes procedures for removal and temporary suspension of a security freeze. Requires a consumer reporting agency to notify the consumer in writing before removing the security freeze. Identifies specified entities, including governmental agencies, to which these prohibitions and requirements do not apply. Permits a consumer reporting agency to charge a reasonable fee for placing or temporarily suspending a security freeze on a consumer report. Prohibits a consumer reporting agency from charging a fee for placing, removing, or temporarily suspending a security freeze if a consumer: (1) has either filed a police report, or made a complaint to a police department concerning identity theft. Or (2) has received notice that a breach of data security has occurred with respect to information required by law to be maintained securely and in confidence. Exempts specified entities from this Act, including certain aggregators and other agencies acting only as resellers of credit information which do not maintain a permanent data base of consumer information from which new consumer reports are produced.