To strengthen the authority of the Federal Government to protect individuals from certain acts and practices in the sale and purchase of Social Security numbers and Social Security account numbers, and for other purposes.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Social Security Number Protection 
Act of 2007''.

SEC. 2. DEFINITIONS.

    In this Act:
            (1) Commission.--The term ``Commission'' means the Federal 
        Trade Commission.
            (2) Person.--The term ``person'' means any individual, 
        partnership, corporation, trust, estate, cooperative, 
        association, or any other entity.
            (3) Sale.--The term ``sale'' means obtaining, directly or 
        indirectly, anything of value in exchange for a Social Security 
        number or Social Security account number. Such term does not 
        include the submission of such numbers as part of the process 
        for applying for any type of Government benefit or programs 
        (such as grant or loan applications or welfare or other public 
        assistance programs). Such term also does not include transfers 
        of such numbers as part of a data matching program under the 
        Computer Matching and Privacy Protection Act.
            (4) Purchase.--The term ``purchase'' means providing 
        directly or indirectly, anything of value in exchange for a 
        Social Security number or Social Security account number. Such 
        term does not include the submission of such numbers as part of 
        the process for applying for any type of Government benefit or 
        programs (such as grant or loan applications or welfare or 
        other public assistance programs). Such term also does not 
        include transfers of such numbers as part of a data matching 
        program under the Computer Matching and Privacy Protection Act.
            (5) Social security number.--The term ``Social Security 
        number'' means the social security account number assigned to 
        an individual under section 205(c)(2)(B) of the Social Security 
        Act (42 U.S.C. 405(c)(2)(B)).
            (6) State.--The term ``State'' means any State of the 
        United States, the District of Columbia, Puerto Rico, the 
        Northern Mariana Islands, the United States Virgin Islands, 
        Guam, American Samoa, and any territory or possession of the 
        United States.

SEC. 3. REGULATION OF THE SALE AND PURCHASE OF SOCIAL SECURITY NUMBERS.

    (a) Prohibition.--It shall be unlawful for any person to sell or 
purchase a Social Security number in a manner that violates a 
regulation promulgated by the Commission under subsection (b) of this 
section.
    (b) Regulations.--
            (1) Restrictions authorized.--The Commission, after 
        consultation with the Commissioner of Social Security, the 
        Attorney General, and other agencies as the Commission deems 
        appropriate, shall promulgate regulations restricting the sale 
        and purchase of Social Security numbers and any unfair or 
        deceptive acts or practices in connection with the sale and 
        purchase of Social Security numbers.
            (2) Limitations on restrictions.--In promulgating such 
        regulations, the Commission shall impose restrictions and 
        conditions on the sale and purchase of Social Security numbers 
        that are no broader than necessary--
                    (A) to provide reasonable assurance that Social 
                Security numbers will not be used to commit or 
                facilitate fraud, deception, or crime; and
                    (B) to prevent an undue risk of bodily, emotional, 
                or financial harm to individuals.
        For purposes of subparagraph (B), the Commission shall consider 
        the nature, likelihood, and severity of the anticipated harm; 
        the nature, likelihood, and extent of any benefits that could 
        be realized from the sale or purchase of the numbers; and any 
        other relevant factors.
            (3) Exceptions.--The regulations promulgated pursuant to 
        paragraph (1) shall include exceptions which permit the sale 
        and purchase of Social Security numbers--
                    (A) to the extent necessary for law enforcement or 
                national security purposes;
                    (B) to the extent necessary for public health 
                purposes;
                    (C) to the extent necessary in emergency situations 
                to protect the health or safety of 1 or more 
                individuals;
                    (D) to the extent necessary for research conducted 
                for the purpose of advancing public knowledge, on the 
                condition that the researcher provides adequate 
                assurances that--
                            (i) the Social Security numbers will not be 
                        used to harass, target, or publicly reveal 
                        information concerning any identifiable 
                        individuals;
                            (ii) information about identifiable 
                        individuals obtained from the research will not 
                        be used to make decisions that directly affect 
                        the rights, benefits, or privileges of specific 
                        individuals; and
                            (iii) the researcher has in place 
                        appropriate safeguards to protect the privacy 
                        and confidentiality of any information about 
                        identifiable individuals;
                    (E) to the extent consistent with an individual's 
                voluntary and affirmative written consent to the sale 
                or purchase of a Social Security number that has been 
                assigned to that individual;
                    (F) to the extent necessary for legitimate consumer 
                credit verification, if the Social Security numbers 
                used for such verification are redacted in accordance 
                with uniform redaction standards established by the 
                Commission in such regulations; and
                    (G) under other appropriate circumstances as the 
                Commission may determine and as are consistent with the 
                principles in paragraph (2).
    (c) Rulemaking.--
            (1) Deadline for action.--Not later than 1 year after the 
        date of enactment of this Act, the Commission shall promulgate 
        the regulations under subsection (b) of this section, in 
        accordance with section 553 of title 5, United States Code.
            (2) Effective dates.--Subsection (a) and the regulations 
        promulgated under subsection (b) shall take effect 30 days 
        after the date on which the final regulations issued under this 
        section are published in the Federal Register.
    (d) Enforcement.--Any violation of a regulation promulgated under 
subsection (b) of this section shall be treated as a violation of a 
regulation under section 18(a)(1)(B) of the Federal Trade Commission 
Act (15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive acts or 
practices.
    (e) Administration and Enforcement.--
            (1) The commission.--The Commission shall prevent any 
        person from violating this section, and any regulation 
        promulgated thereunder, in the same manner, by the same means, 
        and with the same jurisdiction, powers, and duties as though 
        all applicable terms and provisions of the Federal Trade 
        Commission Act (15 U.S.C. 41 et seq.) were incorporated into 
        and made a part of this Act. Any person who violates such 
        regulation shall be subject to the penalties and entitled to 
        the privileges and immunities provided in the Federal Trade 
        Commission Act (15 U.S.C. 41 et seq.) as though all applicable 
        terms and provisions of the Federal Trade Commission Act (15 
        U.S.C. 41 et seq.) were incorporated into and made a part of 
        this Act. Nothing contained in this Act shall be construed to 
        limit the authority of the Commission under any other provision 
        of law.
            (2) Actions by states.--
                    (A) Civil actions.--In any case in which the 
                attorney general of a State has reason to believe that 
                an interest of the residents of that State has been or 
                is threatened or adversely affected by an act or 
                practice that violates any regulation of the Commission 
                promulgated under subsection (b), the State, as parens 
                patriae, may bring a civil action on behalf of the 
                residents of the State in a district court of the 
                United States of appropriate jurisdiction, to--
                            (i) enjoin that act or practice;
                            (ii) enforce compliance with the 
                        regulation;
                            (iii) obtain civil penalties in an amount 
                        of $11,000 per violation not to exceed a total 
                        of $5,000,000; or
                            (iv) obtain such other legal and equitable 
                        relief as the district court may consider to be 
                        appropriate.
                Before filing an action under this subsection, the 
                attorney general of the State involved shall provide to 
                the Commission and to the Attorney General a written 
                notice of that action and a copy of the complaint for 
                that action. If the State attorney general determines 
                that it is not feasible to provide the notice described 
                in this subparagraph before the filing of the action, 
                the State attorney general shall provide the written 
                notice and the copy of the complaint to the Commission 
                and to the Attorney General as soon after the filing of 
                the complaint as practicable.
                    (B) Commission and attorney general authority.--On 
                receiving notice under subparagraph (A), the Commission 
                and the Attorney General each shall have the right--
                            (i) to move to stay the action, pending the 
                        final disposition of a pending Federal matter 
                        as described in subparagraph (c);
                            (ii) to intervene in an action under clause 
                        (I);
                            (iii) upon so intervening, to be heard on 
                        all matters arising therein; and
                            (iv) to file petitions for appeal.
                    (C) Pending criminal proceedings.--If the Attorney 
                General has instituted a criminal proceeding or the 
                Commission has instituted a civil action for a 
                violation of this Act or any regulations thereunder, no 
                State may, during the pendency of such proceeding or 
                action, bring an action under this section against any 
                defendant named in the criminal proceeding or civil 
                action for any violation of this section that is 
                alleged in that proceeding or action.
                    (D) Rule of construction.--For purposes of bringing 
                any civil action under subparagraph (A), nothing in 
                this Act shall be construed to prevent an attorney 
                general of a State from exercising the powers conferred 
                on the attorney general by the laws of that State to 
                conduct investigations, administer oaths and 
                affirmations, or compel the attendance of witnesses or 
                the production of documentary and other evidence.
                    (E) Venue; service of process.--Any action brought 
                under this section may be brought in any district court 
                of the United States that meets applicable requirements 
                relating to venue under section 1391 of title 28, 
                United States Code. In an action brought under this 
                section, process may be served in any district in which 
                the defendant is an inhabitant or may be found.

SEC. 4. EFFECT ON OTHER LAWS.

    This Act supersedes any provision of a statute, regulation, or rule 
of a State or political subdivision of a State that expressly restricts 
or prohibits the sale or purchase of Social Security numbers in a 
manner consistent with the regulations promulgated under section 3(b).

Summary: Social Security Number Protection Act of 2007 - Amends title II of the Social Security Act (SSA) to make it unlawful for any person, except in certain circumstances, to: (1) intentionally display the Social Security number of another individual on a website generally accessible to the public or providing an individual with access to another individual's Social Security number through the Internet. (2) require an individual who is a customer of or member associated with such person to use the individual's Social Security number as a password for access to any good or service, including any account or protected access website. Or (3) display any individual's Social Security number on any membership or identity card. Amends SSA title II to make it unlawful for any person to sell or purchase a Social Security number, without an individual's voluntary written consent, in a manner that violates a regulation promulgated by the Federal Trade Commission (FTC), except in certain circumstances related to law enforcement, national security, public health, or emergency safety and health. Prescribes requirements for such a sale or purchase in other circumstances related to consumer credit verification or specified research. Requires the Commission to study and report to Congress on the feasibility of banning use of the Social Security number as a primary means of authenticating identity or verifying it for commercial transactions. Requires the study also to examine possible alternatives to Social Security numbers for such purposes and uses.