To protect and enhance consumer privacy, and for other purposes.

OF IDENTITY THEFT DISPUTES.

    The Commission shall require entities that receive disputes 
regarding the unauthorized use of accounts of such entities from 
consumers that have reason to believe that they are a victim of 
identity theft to conduct any necessary investigation and decide an 
outcome of a claim within 90 days from the date on which all necessary 
information to investigate the claim has been submitted to the entity.

SEC. 204. IMPROVEMENTS TO CONSUMER CLEARINGHOUSE.

    The Commission shall utilize the Identity Theft Clearinghouse to 
permit consumers that have a reasonable belief that they are victim of 
identity theft to submit any information relevant to such identity 
theft to the Clearinghouse (including by means of an Identity Theft 
Affidavit), so that such information may be transmitted by the 
Clearinghouse to appropriate entities for necessary protective action 
and to mitigate losses resulting from such identity theft.

SEC. 205. IMPROVED IDENTITY THEFT DATA.

    (a) In General.--The Commission shall--
            (1) establish a process to contact, not less than annually, 
        public and private entities that receive and process complaints 
        from consumers that have a reasonable belief that they are a 
        victim of identity theft; and
            (2) obtain accurate data on the incidences and nature of 
        complaints from such entitles.
    (b) Inclusion in Database.--Such information shall be made part of 
the Commission's Identity Theft Clearinghouse database.

SEC. 206. CHANGE OF ADDRESS PROTECTIONS.

    The Commission shall require appropriate entities to take 
reasonable steps to verify the accuracy of a consumer's address, 
including by confirming a consumer's change of address by sending a 
confirmation of such change to the old and the new address of the 
consumer.

SEC. 207. EFFECTIVE DATE.

    This title shall take effect 180 days after the date of enactment 
of this Act.

                  TITLE III--INTERNATIONAL PROVISIONS

SEC. 301. STUDY BY COMPTROLLER GENERAL.

    The Comptroller General of the United States shall conduct a study 
and issue a report analyzing the impact on the interstate and foreign 
commerce of the United States of information privacy laws, regulations, 
or agreements enacted, promulgated, or adopted by other nations, 
including regional or international agreements between nations, and 
whether the enforcement mechanisms or procedures of those laws, 
regulations, or agreements result in discriminatory treatment of United 
States entities. The first report under this section shall be issued 
not later than 120 days after the date of enactment of this Act and 
subsequent reports shall be issued every 3 years thereafter.

SEC. 302. REMEDIATION OF DISCRIMINATORY IMPACT BY SECRETARY OF 
              COMMERCE.

    If the Comptroller General of the United States finds, in the study 
and report under subsection (a), that such information privacy laws, 
regulations, or agreements substantially impede interstate and foreign 
commerce of the United States and that the enforcement mechanisms or 
procedures of the information privacy laws, regulations, or agreements 
described in such subsection result in discriminatory treatment of 
United States entities, the Secretary of Commerce shall, to the extent 
permitted by law take all steps necessary to mitigate against such 
discriminatory impact within 180 days after the report making such 
findings is issued.

SEC. 303. EFFECT OF NONREMEDIATION.

    (a) Recommendations.--If by the end of the 180-day period described 
in section 302, the Secretary of Commerce has not attained complete 
relief from the discriminatory impact described in such subsection, the 
Secretary shall report to the Congress and the President 
recommendations on action to relieve any such remaining discriminatory 
impact.
    (b) Federal Agency Action After Consideration by Congress.--During 
the period after the Secretary reports recommendations under subsection 
(b) for mitigation of discriminatory impact and before the Congress 
acts with respect to such recommendations, no officer or employee of 
any Federal agency may take or continue any action to enjoin, or impose 
any penalty on, a United States entity, or a citizen or legal resident 
of the United States, for the purpose of fulfilling an international 
obligation of the United States under an international privacy 
agreement (other than such an obligation under a ratified treaty) that 
resulted in such discriminatory impact.

SEC. 304. HARMONIZATION OF INTERNATIONAL PRIVACY LAWS, REGULATIONS, AND 
              AGREEMENTS.

    Beginning on the date of enactment of this Act, the Secretary of 
Commerce shall provide notice of the provisions of this Act to other 
nations, individually, or as members of international organizations or 
unions that have enacted, promulgated, or adopted information privacy 
laws, regulations, or agreements, and shall seek recognition of this 
Act by such nations, organizations, or unions. The Secretary shall seek 
the harmonization of this Act with such information privacy laws, 
regulations, or agreements, to the extent such harmonization is 
necessary for the advancement of transnational commerce, including 
electronic commerce.

                      TITLE IV--GENERAL PROVISIONS

SEC. 401. DEFINITIONS.

    In this Act:
            (1) The term ``Commission'' means the Federal Trade 
        Commission.
            (2) The term ``consumer'' means an individual acting in the 
        individual's personal, family, or household capacity.
            (3)(A) The term ``data collection organization'' means an 
        entity (or an agent or affiliate of the entity) that collects 
        (by any means, through any medium), sells, discloses for 
        consideration, or uses personally identifiable information of 
        the consumer.
            (B) Such term does not include--
                    (i) a governmental agency; or
                    (ii) a not-for-profit entity, to the extent that 
                personally identifiable information is not used for a 
                commercial purpose; or
                    (iii) an entity that--
                            (I) has annual gross revenue under 
                        $1,000,000 (based on the value of such amount 
                        in fiscal year 2000, adjusted for current 
                        dollars);
                            (II) has fewer than 25 employees;
                            (III) collects or uses personally 
                        identifiable information from fewer than 1,000 
                        consumers for a purpose unrelated to a 
                        transaction with the consumer;
                            (IV) does not process personally 
                        identifiable information of consumers; and
                            (V) does not sell or disclose for 
                        consideration such information to another 
                        person.
            (4)(A) The term ``personally identifiable information'', 
        with respect to a data collection organization means 
        individually identifiable information relating to a living 
        individual who can be identified from that information.
            (B) Such term includes--
                    (i) first and last name, whether given at birth or 
                adoption, assumed, or legally changed;
                    (ii) home or other physical address including 
                street name and name of a city or town;
                    (iii) electronic mail address;
                    (iv) telephone number;
                    (v) social security number; or
                    (vi) any other unique identifying information that 
                a data collector and processor collects and combines 
                with any information described in the preceding 
                subparagraphs of this paragraph.
            (C) Such term does not include--
                    (i) anonymous or aggregate data, or any other 
                information that does not identify a unique living 
                individual;
                    (ii) information about a consumer inferred from 
                data maintained about a consumer; or
                    (iii) information about a consumer obtained from a 
                public record.
            (5) The term ``affiliate'' means any company that controls, 
        is controlled by, or is under common control with another 
        company.
            (6) The term ``information-sharing partner'' means, with 
        respect to a data collection organization, an entity that is 
        contractually obligated to comply with the practices enumerated 
        under the privacy policy statement of the organization required 
        under section 102.
            (7) The term ``process'', with respect to personally 
        identifiable information, means any value-added activity 
        performed on data by automated means.
            (8) The term ``transaction'' means an interaction between a 
        consumer and a data collection organization resulting in--
                    (A) any use of information that is necessary to 
                complete the interaction in the course of which 
                information is collected, or to maintain the 
                provisioning of a good or service requested by the 
                consumer, including use--
                            (i) to approve, guarantee, process, 
                        administer, complete, enforce, provide, or 
                        market a product, service, account, benefit, 
                        transaction, or payment method that is 
                        requested or approved by the consumer; or
                            (ii) to deliver goods, services, funds, or 
                        other consideration to, or on behalf of, the 
                        consumer;
                    (B) any disclosure of information that is necessary 
                for the consumer to enforce any right of the consumer;
                    (C) any disclosure of information that is required 
                by law or by a court order; and
                    (D) any use of information to evaluate, detect, or 
                reduce the risk of fraud or other criminal activity, or 
                other risk-management activities.
            (9) The term ``display'' means intentionally communicating 
        or otherwise making available (on the Internet or in any other 
        manner) to another person.
            (10) The term ``public record'' means any item, collection, 
        or grouping of information about an individual that is 
        maintained by a Federal, State, or local government entity and 
        that is made available to the public.
            (11) The term ``purchase'' means providing, directly or 
        indirectly, anything of value in exchange for a benefit.
            (12) The term ``State'' includes the several States, the 
        District of Columbia, the Commonwealth of Puerto Rico, the 
        Commonwealth of the Northern Mariana Islands, American Samoa, 
        Guam, the Virgin Islands, the Freely Associated States, and any 
        other territory or possession of the United States.

Summary: Consumer Privacy Protection Act of 2002 - Requires data collection organizations, under specified conditions, to notify consumers: (1) at the time of collection that their personally identifiable information may be used for an unrelated transaction purpose. And (2) of any material change in the organization's privacy policy statement immediately after each change. Requires the organizations to establish a privacy policy with respect to the collection, sale, disclosure for consideration, or use of the consumer's information. Requires an organization to provide consumers, without charge, the opportunity to preclude the sale or disclosure of their information to any organization that is not an information-sharing partner. Allows a consumer an opportunity to limit other information practices of the organization. Directs an organization to prepare and implement an information security policy that prevents the unauthorized disclosure or release of a consumer's information. Requires the Federal Trade Commission (FTC) to presume that an organization is in compliance with this Act if it participates in an approved self-regulatory program for an eight-year period. Directs the FTC to: (1) facilitate electronic and promote the use of common identity theft affidavits, (2) require the timely resolution of identity theft disputes. (3) utilize the Identity Theft Clearinghouse to transmit information to appropriate entities for protective action and to mitigate losses. And (4) provide change of address protection for consumers. Requires: (1) the Comptroller General to analyze the impact on US interstate and foreign commerce of information privacy laws, regulations, or agreements enacted, promulgated, or adopted by other nations, and whether the enforcement mechanisms or procedures of them result in discriminatory treatment of US entities. And (2) the Secretary of Commerce, based on such results, to take steps to mitigate against such discriminatory impact. Directs the Secretary to seek harmonization of this Act with other international privacy laws, regulations, and agreements for the advancement of transnational and electronic commerce.