U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

1 

69–010 

" ! SENATE 110TH CONGRESS

1st Session 

REPORT

2007

110–235 

Calendar No. 520 

IDENTITY THEFT PREVENTION ACT OF 2007 

R E P O R T 

OF THE

COMMITTEE ON COMMERCE, SCIENCE, AND 

TRANSPORTATION 

ON

S.1178 

DECEMBER 5, 2007.—Ordered to be printed 


ycherry on PRODPC74 with HEARINGcongress.#13
(II) 

SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION 

ONE HUNDRED TENTH CONGRESS

FIRST SESSION

DANIEL K. INOUYE, Hawaii, Chairman 

TED STEVENS, Alaska, Vice-Chairman 

JOHN D. ROCKEFELLER IV, West Virginia 

JOHN F. KERRY, Massachusetts 

BYRON L. DORGAN, North Dakota 

BARBARA BOXER, California 

BILL NELSON, Florida 

MARIA CANTWELL, Washington 

FRANK R. LAUTENBERG, New Jersey 

MARK PRYOR, Arkansas 

THOMAS CARPER, Delaware 

CLAIRE McCASKILL, Missouri 

AMY KLOBUCHAR, Minnesota 

JOHN McCAIN, Arizona 

TRENT LOTT, Mississippi 

KAY BAILEY HUTCHISON, Texas 

OLYMPIA J. SNOWE, Maine 

GORDON H. SMITH, Oregon 

JOHN ENSIGN, Nevada 

JOHN E. SUNUNU, New Hampshire 

JIM DEMINT, South Carolina 

DAVID VITTER, Louisiana 

JOHN THUNE, South Dakota 

MARGARET CUMMISKY, Staff Director and Chief Counsel 

LILA HELMS, Deputy Staff Director and Policy Director 

JEAN TOAL EISEN, Senior Advisor and Deputy Policy Director 

CHRISTINE KURTH, Republican Staff Director and General Counsel 

PAUL J. NAGLE, Republican Chief Counsel 

MIMI BRANIFF, Republican Deputy Chief Counsel 


ycherry on PRODPC74 with HEARING
Calendar No. 520 

110TH CONGRESS REPORT " ! SENATE 1st Session 110–235 

IDENTITY THEFT PREVENTION ACT OF 2007 

DECEMBER 5, 2007.—Ordered to be printed 

Mr. INOUYE, from the Committee on Commerce, Science, and 

Transportation, submitted the following 

R E P O R T 

[To accompany S. 1178] 

The Committee on Commerce, Science, and Transportation, to 

which was referred the bill (S. 1178) to strengthen data protection 

and safeguards, require data breach notification, and further prevent identity theft, having considered the same, reports favorably 

thereon with amendments and recommends that the bill (as 

amended) do pass. 

PURPOSE OF THE BILL

S. 1178 would bolster data security procedures for covered entities that collect, dispose, maintain, sell, or transfer sensitive personal information. The bill would require covered entities to provide consumer notification under circumstances when that entity 

suffers a breach of security, and the exposure of that sensitive personal information would create a reasonable risk that an identity 

theft may occur. S. 1178 also would direct the Federal Trade Commission (FTC) to develop rules that would require procedures for 

authenticating the credentials of third parties to which sensitive 

personal information may be sold or otherwise transferred. To further protect consumers from identity theft, S. 1178 would allow 

consumers to freeze their credit report. As amended, S. 1178 also 

would prohibit the solicitation, sale, or display of Social Security 

numbers by covered entities, except under certain specified circumstances, and would require Federal agencies to protect sensitive personal information and provide notification to affected individuals in the event of a breach of security that creates a reasonable risk of identity theft. 


ycherry on PRODPC74 with HEARING
2 

1P.L. 105-318, 112 Stat. 3007 (Oct. 30, 1998) 

218 U.S.C. 1028 (‘‘Fraud and related activity in connection with identification documents’’) 

BACKGROUND AND NEEDS

Data Security 

In 1998, Congress responded to an explosion in identity theft activity by passing the Identity Theft Assumption and Deterrence 

Act.1 This Act addressed identity theft in 2 ways: First, the Act 

strengthened then-existing criminal law governing identity theft2

to make it a Federal crime to knowingly transfer or use, without 

lawful authority, a means of identification of another person with 

the intent to commit, or to aid or abet, any unlawful activity. Second, the Act required the FTC to develop a centralized complaint 

and consumer education service for victims of identity theft. This 

FTC clearinghouse was established and currently serves as an investigative tool for the FTC and Federal law enforcement to track 

and thwart identity theft. 

Despite the existence of several Federal and State laws designed 

to reduce identity theft, the crime continues to be perpetrated 

against American consumers at an alarming rate. A 2003 FTC survey found that, during a one-year period, identity thieves victimized nearly 10 million Americans, or roughly 4.6 percent of the domestic adult population. The FTC has further reported that identity theft—physical and online—accounted for 36 percent of the 

more than 674,000 consumer fraud complaints filed last year with 

the agency. 

The aggregation and distribution of consumers’ sensitive personal information for marketing, lending, and other purposes has 

expanded significantly over the past few decades in the United 

States, enabled by increased, affordable computing power. Such 

practices have increased the opportunities for identity thieves to 

access and misappropriate sensitive personal information. 

Starting in 2005, a string of highly publicized data breaches occurred at a variety of private and public organizations ranging 

from financial institutions and commercial retailers, to public universities, to the Federal government. These data breaches involved 

the sensitive personal information of millions of consumers, including Social Security numbers and financial information. Many of 

these security breaches led to identity theft. The most widely publicized data breaches involved the unauthorized access of data held 

by 2 large information (or data) brokers. These breaches raised a 

question as to whether consumers’ sensitive personal information is 

adequately protected from identity thieves by the entities that collect, maintain, and transfer sensitive personal information. 

While several Federal laws address data security in different 

contexts, there is no single Federal law that requires the protection 

of sensitive personal information regardless of the type of entity 

that is in possession of that information. In addition, no Federal 

law requires all entities that possess sensitive personal information 

to notify consumers when a breach involving such consumers’ sensitive personal information has occurred. S. 1178 is intended to fill 

gaps in current Federal data security laws and provide a uniform 

preemptive Federal standard for the safeguarding of sensitive personal information for all entities not currently covered by law. The 

legislation ensures the adequate security of sensitive personal inVerDate Aug 31 2005 08:24 Dec 06, 2007 Jkt 069010 PO 00000 Frm 00004 Fmt 6659 Sfmt 6601 E:\HR\OC\SR235.XXX SR235

ycherry on PRODPC74 with HEARING
3 

315 U.S.C. 1681-1681u, as amended; In 2003, FCRA was enhanced by the Fair and Accurate 

Credit Transactions Act (FACT) Act. The FTC has not completed implementation of the FACT 

Act. 415 U.S.C. 1681(a)(4) 

515 U.S.C. 1681b(a)(3)(A) through (F) 

615 U.S.C. 6801-09 

715 U.S.C. 6801(b) 

842 U.S.C. 1320d et seq. 

formation, while permitting the legitimate free flow of information 

that is necessary to the U.S. economy. 

Congress has legislated data privacy and security in several contexts. Among other things, Congress has placed certain limits on 

the dissemination of credit report, financial, motor vehicle, and 

health information. The following is a brief description of existing 

data security laws. 

The Fair Credit Reporting Act (FCRA)3 was enacted, in part, to 

ensure that ‘‘consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer’s right to privacy.’’4 The FCRA requires that consumer reporting agencies only disclose consumer credit reports if such a disclosure is for a ‘‘permissible purpose’’ as defined in the statute.5

In the FCRA, a permissible purpose is generally a legitimate 

business need by the individual or entity seeking the credit report, 

which includes, among others, verification for employment, extension of credit or insurance, or property tenancy background checks. 

The FCRA also requires credit-reporting agencies (CRAs) to use 

reasonable procedures to ensure that those requesting consumer 

credit reports are who they claim to be, and that they are eligible 

to receive the report for a permissible purpose. 

Title V of the Gramm-Leach-Bliley Act (GLBA)6 was enacted to 

ensure the privacy and security of personally identifiable information handled by financial institutions. Title V of the GLBA requires 

financial institutions to provide notice to customers of a possible 

disclosure of non-public personal information to non-affiliates and 

an opportunity to opt out of such disclosure. This non-public information includes an individual’s address, as well as Social Security 

number, telephone number, and mother’s maiden name. The prohibition against disclosure of this information without notice and the 

ability to opt out are subject to statutory exceptions provided in the 

GLBA. These exceptions allow for disclosure primarily for reasons 

of law enforcement, prosecution, or fraud prevention. The GLBA’s 

privacy rule for re-disclosure binds recipients of non-public personal financial information. The GLBA requires financial institutions to adopt and implement appropriate safeguards for the personal information of their customers.7

The Health Information Portability and Accountability Act 

(HIPAA)8 was enacted partly to provide strong Federal protections 

for the privacy rights of patients. The HIPAA privacy rule prohibits 

health care providers from disclosing personal health information 

except when required or permitted under the rule. The HIPAA Privacy Rule permits health care providers to disclose personal health 

information for the purpose of carrying out essential health care 

functions such as patient treatment, payment for care, or health 

care operations that support treatment and payment. The rule also 

requires disclosure of personal health information when requested 

by the Department of Health and Human Services (HHS) for an inVerDate Aug 31 2005 08:24 Dec 06, 2007 Jkt 069010 PO 00000 Frm 00005 Fmt 6659 Sfmt 6601 E:\HR\OC\SR235.XXX SR235

ycherry on PRODPC74 with HEARING
4 

945 C.F.R. 164.530(c) 

1015 U.S.C. 45(a) 1115 U.S.C. 2721-25 12P. L. 108-159, 111 Stat. 1952 

vestigation or to determine compliance with the privacy rule, or at 

the request of a patient or health care enrollee. Like the GLBA, the 

HIPAA requires health care providers to adopt and implement appropriate safeguards to protect personal health information.9

Section 5 of the Federal Trade Commission Act (FTCA)10 grants 

authority to the FTC to prevent unfair or deceptive trade practices 

in or affecting interstate commerce. Entities operating in interstate 

commerce are subject to section 5 of the FTCA to the extent that 

they deceptively make false claims concerning their information security policies on which consumers rely to their detriment. Such 

entities are subject to section 5 of the FTCA if they falsely claim 

to have adequate information security safeguards in place, and/or 

if they knowingly cause consumers substantial economic injury 

that could have been reasonably avoided. 

The Driver’s Privacy Protection Act (DPPA)11 prohibits the disclosure of personal information by State departments of motor vehicles except for uses specifically stated by DPPA. It contains 14 permissible uses, mostly for purposes of law enforcement, vehicle insurance claims or policies, or judicial proceedings. 

In April 2004, the California legislature enacted SB 1386, which 

represented the first effort by a State legislature to address data 

breach notification. The law provides strict disclosure requirements 

for commercial entities or government agencies that experience security breaches when the breaches may contain the personal information of California residents. According to many observers, were 

it not for the breach notification requirements of the California 

law, most of the data security breaches that were highly publicized 

in 2005 would not have become publicly known. Thirty-four other 

States and the District of Columbia have passed data breach legislation. Two prevalent themes among these initiatives are consumer 

notification requirements in the event of a data breach and consumer redress in the event of such breach. 

Credit Freeze 

The Fair and Accurate Credit Transaction Act (FACTA) of 

2003,12 added new sections to the FCRA that were intended to provide consumers with tools to combat the effects of identity theft. 

FACTA allows a consumer who seeks to mitigate or prevent the occurrence of identity theft to contact CRAs and place a ‘‘fraud alert’’ on their credit file. Once placed, any entity that attempts to extend 

credit to the consumer is required to contact the consumer by telephone and take other reasonable steps to ensure that the credit application is not that of an identity thief. Failure to contact the consumer in such instances subjects the entity to civil penalty. The 

fraud alert is effective initially for 90 days and can be extended for 

up to 7 years for victims of identity theft by providing a police report or an affidavit proving a theft occurred. 

S. 1178 would take an added step to protect consumers by allowing them to place a ‘‘freeze’’ on their credit report for a fee of no 

more than $10. A freeze effectively would preclude (with limited exceptions) unauthorized third parties from accessing a credit report. 

Victims of identity theft, individuals age 65 and older, and individVerDate Aug 31 2005 08:24 Dec 06, 2007 Jkt 069010 PO 00000 Frm 00006 Fmt 6659 Sfmt 6601 E:\HR\OC\SR235.XXX SR235

ycherry on PRODPC74 with HEARING
5 

1216 C.F.R. Part 314. The FTC was required to promulgate this rule in GLBA, 15 U.S.C. Subchapter I, Sec. 6801-6809 (Disclosure of Nonpublic Personal Information). 

uals on active duty or in the ready reserve component of an armed 

force of the United States, as well as their spouses, would be permitted to place freezes on their credit report without a fee. 

The credit freeze provision of the bill provides consumers with a 

proactive tool to combat the threat of identity theft. Currently, 

more than 35 States and the District of Columbia have enacted 

credit freeze laws. 

SUMMARY OF PROVISIONS

S. 1178, the Identity Theft Prevention Act, would require covered 

entities to comply with the existing requirements of the FTC rules 

on Standards for Safeguarding Customer Information and Disposal 

of Consumer Report Information and Records (Safeguards Rule),13

which require covered entities to develop, implement, maintain, 

and enforce written programs for the security of sensitive personal 

information to ensure security of and protect against any anticipated threats or unauthorized access to consumers’ sensitive personal information. 

The bill would apply the Safeguards Rule to entities not currently subject to the rule and require those entities that handle 

sensitive personal information to provide notice to affected consumers in the event of a security breach. S. 1178 also would allow 

consumers to place, remove, and temporarily remove a security 

freeze on their credit, which would prevent credit from being extended to third parties without authorization from the consumer. 

In addition, S. 1178 would prohibit (with limited exceptions) the 

sale or purchase of consumers’ Social Security numbers. This provision would prohibit employers, educational institutions, and others 

from using Social Security numbers for any employee benefit plan, 

card, or tag that is provided by employers, educational institutions, 

and others, for the purpose of identification. The use of Social Security numbers as identifiers on State driver’s licenses would be prohibited as well. S. 1178 also would require Federal agencies to develop, implement, maintain, and enforce a written program for the 

security of sensitive personal information and to notify affected individuals in the event of a breach of security that creates a reasonable risk of identity theft. These requirements would be enforced 

by the inspector general of the respective Federal agency. 

LEGISLATIVE HISTORY

On April 10, 2007, the Committee held an oversight hearing, 

chaired by Chairman Inouye, on the FTC during which all 5 FTC 

Commissioners testified on various issues including data security 

and identity theft. On May 10, 2005, and June 16, 2005, the Committee held hearings to examine the issues pertaining to data security. At those hearings, representatives of private companies, industry trade associations, public interest groups, State Attorneys 

General, and each of the FTC Commissioners testified before the 

Committee. 

On April 20, 2007, Chairman Inouye introduced S. 1178, ‘‘The 

Identity Theft Prevention Act,’’ which was referred to the ComVerDate Aug 31 2005 08:24 Dec 06, 2007 Jkt 069010 PO 00000 Frm 00007 Fmt 6659 Sfmt 6601 E:\HR\OC\SR235.XXX SR235

ycherry on PRODPC74 with HEARING
6 

mittee. Senators Stevens, Pryor, and Smith were original co-sponsors of the bill. 

On April 25, 2007, the Committee met in open executive session 

and by voice vote ordered S. 1178 reported with amendments. The 

managers’ package of amendments included 8 items: 1) Senator 

Dorgan’s amendment to add separate provisions dealing with Social Security numbers; 2) Chairman Inouye’s technical amendment; 

3) Senator Carper’s second degree amendment to the Inouye technical amendment to apply sensitive personal information safeguard 

and notification obligations to the agencies of the Federal government; 4) Senator Pryor’s second degree amendment to the Inouye 

technical to clarify the reference to consumer credit reporting entities in the notification process; 5) Senators Cantwell and Stevens’ amendment to move up the completion date for the study of the 

correlation, if any, between methamphetamine use and identity 

theft crimes; 6) Senator Cantwell’s amendment to allow State Attorneys General to recover reasonable costs and attorneys fees if 

they prevail; 7) Senators Snowe and Kerry’s amendment to require 

the Chairman of the FTC to consult representatives of the small 

business community in selecting the members of the Information 

Security and Consumer Privacy Advisory Committee; and 8) Senators Snowe and Kerry’s amendment to clarify that companies that 

use e-mails as the primary form of communication are allowed to 

use e-mail to send security breach notices. 

ESTIMATED COSTS

In accordance with paragraph 11(a) of rule XXVI of the Standing 

Rules of the Senate and section 403 of the Congressional Budget 

Act of 1974, the Committee provides the following cost estimate, 

prepared by the Congressional Budget Office: 

S. 1178—Identity Theft Protection Act 

Summary: S. 1178 would require private companies and federal 

agencies to develop and enforce a system to safeguard the personal 

information of consumers and to notify consumers whenever there 

has been a breach in the security system. Under the bill, consumers also would have the option to freeze their credit reports in 

the event of a threat to their personal information. The bill also 

would restrict the use, display, and sale of Social Security numbers 

(SSNs). The Federal Trade Commission (FTC) would enforce those 

restrictions and requirements. Assuming appropriation of amounts 

specifically authorized in the bill, CBO estimates that implementing S. 1178 would cost $2 million in 2008 and $8 million over 

the 2008–2012 period. 

Enacting S. 1178 could increase federal revenues as a result of 

the collection of additional civil and criminal penalties assessed for 

violations of data security regulations. Collections of criminal penalties are recorded on the budget as revenues, deposited in the 

Crime Victims 

Fund, and later spent. CBO estimates, however, that any additional revenues that would result from enacting the bill would not 

be significant because of the relatively small number of cases likely 

to be involved. 

S. 1178 contains a number of intergovernmental mandates as defined in the Unfunded 


ycherry on PRODPC74 with HEARING
7 

Mandates Reform Act (UMRA): some would preempt state law 

and others would place new requirements on state, local, and tribal 

governments (particularly on educational organizations and 

schools). The preemptions of state law would not impose significant 

direct costs on states. The other requirements of the bill could result in additional spending for the affected public entities, but CBO 

estimates that the costs of those mandates would not exceed the 

threshold established in UMRA ($66 million in 2007, adjusted annually for inflation). 

S. 1178 would impose private-sector mandates on consumer credit-reporting agencies and other entities that acquire, maintain, or 

utilize sensitive personal information, including 

Social Security numbers. Because of uncertainty about the number of entities that are already in compliance with most of the 

mandates in the bill, CBO cannot estimate the incremental cost of 

complying with those mandates and cannot determine whether the 

aggregate direct cost of all the mandates in the bill would exceed 

the annual threshold established by UMRA for private-sector mandates ($131 million in 2007, adjusted annually for inflation). 

Estimated Cost to the Federal Government: The estimated budgetary impact of S. 1178 is shown in the following table. The costs 

of this legislation fall within budget function 370 (commerce and 

housing credit). 

By fiscal year, in millions of dollars— 

2008 2009 2010 2011 2012 

CHANGES IN SPENDING SUBJECT TO APPROPRIATION 1

Authorization Level .................................................................................................. 2 2 2 2 0 

Estimated Outlays ................................................................................................... 2 2 2 2 0 

1 Enacting S. 1178 also could affect revenues from the assessment of civil criminal penalties; and it could affect direct spending from the 

expenditure of any criminal penalties assessed. CBO estimates that any such effects would be less than $500,000 a year. 

Basis of Estimate: For this estimate, CBO assumes that the bill 

will be enacted in 2007 and that the specified amounts will be appropriated for each year. CBO estimates that implementing the bill 

would cost $2 million in 2008 and $8 million over the 2008–2012 

period to issue regulations and enforce the bill’s new provisions restricting the use of personal information. 

Section 12 would require federal agencies to develop, implement, 

maintain, and enforce programs for the security of personal information an agency possesses. In the event of a security breach involving a reasonable risk of identity theft, S. 1178 would require 

government agencies to notify an individual whose information 

may have been compromised. Notification would be in the form of 

individual notice (written notice to a home mailing address or via 

e-mail) as well as through an Internet Web site and the mass 

media. The legislation also would require the agency to provide affected individuals with a description of the accessed information, a 

toll-free number to contact the agency, the names and toll-free telephone numbers of the major credit reporting agencies, and a tollfree telephone number and Web site that the individual can use to 

obtain information on identity theft. 

This provision would codify the current practice of the federal 

government regarding data security and security breach notification. The Federal Information Security Management Act of 2002 

provides requirements for securing the federal government’s inforVerDate Aug 31 2005 08:24 Dec 06, 2007 Jkt 069010 PO 00000 Frm 00009 Fmt 6659 Sfmt 6601 E:\HR\OC\SR235.XXX SR235

ycherry on PRODPC74 with HEARING
8 

mation systems, including the protection of personal privacy. The 

National Institute of Standards and Technology develops information security standards and guidelines for other federal agencies, 

and the Office of Management and Budget (OMB) oversees information technology security policies and practices. OMB estimates 

that federal agencies spend around $5.5 billion a year to secure the 

government’s information systems. 

While existing laws generally do not require agencies to notify affected individuals of data breaches, this has been the practice of 

agencies that have experienced security breaches. Therefore, CBO 

expects that implementing this provision would probably not lead 

to a significant increase in spending. Nonetheless, the federal government is also one of the largest providers, collectors, consumers, 

and disseminators of personnel information in the United States. 

Although CBO cannot anticipate the number of security breaches 

nor the extent of any such occurances, a significant breach of security involving a major collector of personnel information-such as 

the Internal Revenue Service or the Social Security Administration-could involve millions of individuals, and there would be significant costs to notify individuals of such a security breach. 

Estimated impact on state, local, and tribal governments: S. 1178 

contains a number of intergovernmental mandates, but CBO estimates that the costs of those mandates would not exceed the 

threshold established in UMRA ($66 million in 2007, adjusted annually for inflation). 

Safeguarding personal information and notifying individuals of security breaches 

The bill would establish new requirements for safeguarding personal information and put in place a new federal requirement for 

notifying individuals and the Federal Trade Commission in the 

event that personal information is compromised. Those new federal 

requirements would apply to educational organizations and schools, 

including public school systems and universities. (It would not 

apply to state, local, or tribal governments broadly.) 

Under current law, educational institutions that receive federal 

funds already are required to safeguard certain personal information and must comply with standards required under the Family 

Educational Rights and Privacy Act and established by the Department of Education. 

Depending on the differences between the rules promulgated by 

the FTC and those already required by the department, educational institutions may have to make changes to their current 

systems. The bill also would require schools to notify affected individuals of any breach of security in which personal information of 

more than 1,000 individuals may have been compromised and to 

maintain a toll-free number for contacting the school. If schools are 

required to change procedures for handling information, implement 

new controls on computer systems, provide additional information 

to the FTC, or provide notifications, they could face added costs. 

However, existing regulations cover, at least in a broad manner, 

many of the issues that S. 1178 addresses; additional costs likely 

would not exceed the threshold. 


ycherry on PRODPC74 with HEARING
9 

Preemptions of state and local laws 

S. 1178 would preempt a number of state and local laws that establish rules for safeguarding personal information and that restrict the use of SSNs. The bill would preempt state laws that require schools or other entities that collect personal information to 

notify individuals in the event of a security breach, and it would 

preempt state laws that do not afford individuals greater protection 

regarding the release of private information by credit-reporting 

agencies. The bill also would establish a federal law that would 

place a number of restrictions on the display, collection, sale, and 

transfer of SSNs and would preempt similar state and local laws. 

Those preemptions would be intergovernmental mandates as defined in UMRA, but they would impose no duty on states that 

would result in additional spending. 

The bill would place notification requirements on state attorneys 

general that prosecute cases involving breaches of security or violations of the new rules governing Social Security numbers. Since 

state laws would be preempted by the bill, the new federal law 

would be the primary avenue for prosecuting cases. Consequently, 

the notification requirements would be an intergovernmental mandate, but CBO estimates that the costs of such notifications would 

be small. 

Social Security Numbers 

In some cases, the bill’s restrictions on the collection, sale, or use 

of SSNs would place requirements on state and local governments, 

including schools. The bill would prohibit states from displaying 

SSNs on driver’s licenses, but this practice is already prohibited by 

federal law as part of the Intelligence Reform and Terrorism Prevention Act of 2004. The bill also would prohibit state and local 

governments from allowing prisoners access to SSNs of other individuals. While those prohibitions would be intergovernmental mandates, they would place no new requirement on states that would 

result in significant additional spending. 

The bill would prohibit schools from displaying SSNs on identification cards or tags. Federal law currently places some restrictions on the use of SSNs by colleges, universities, and other schools 

that receive federal funding. While the specific prohibition on the 

use of SSNs on identification materials would be new, indications 

from organizations that represent public schools and universities 

are that few schools, if any, still use SSNs as identifiers. Consequently, CBO estimates any additional costs as a result of this 

requirement would be small. 

Estimated impact on the private sector: S. 1178 would impose 

private-sector mandates on credit-reporting agencies and other entities that acquire, maintain, or utilize sensitive personal information, including SSNs. Because of uncertainty about the number of 

entities that are already in compliance with most of the mandates 

in the bill, CBO cannot estimate the incremental cost of complying 

with those mandates. Therefore, CBO cannot determine the total 

direct cost of the mandates contained in the bill or whether such 

costs would exceed the annual threshold established by UMRA for 

private-sector mandates ($131 million in 2007, adjusted annually 

for inflation). 


ycherry on PRODPC74 with HEARING
10 

Security program 

Section 2 of S. 1178 would require covered entities to implement 

and enforce a written program to secure sensitive personal information, which includes a person’s name, address, or telephone 

number in combination with their social security number. Covered 

entities include businesses, employers, educational and nonprofit 

institutions that acquire, maintain, and utilize sensitive personal 

information. According to industry and government sources, many 

states already have laws requiring business entities to utilize data 

security programs. Moreover, it is the current practice of many 

businesses to use security measures to protect sensitive data. However, because of uncertainty about the number of entities that are 

already in compliance with the data security mandates, CBO cannot estimate the incremental cost of complying with those mandates. Additionally, this section would require the FTC to promulgate regulations that would require procedures for authenticating 

the credentials of any third party to which a covered entity transfers or sells sensitive personal information. CBO cannot estimate 

the cost of complying with this mandate because the cost would depend on the rules to be established by the FTC. 

Notification of security breach risk 

In the case of a security breach affecting 1,000 or more persons, 

section 3 would require covered entities to report the breach to the 

Federal Trade Commission and notify all consumer reporting agencies. If the required investigation of the breach finds that there is 

a reasonable risk of identity theft, the entity also would be required to notify all affected individuals. According to industry and 

government sources, millions of individuals’ sensitive personally 

identifiable information is illegally accessed every year. However, 

according to those sources, a majority of states already have laws 

requiring notification in the event of a security breach. In addition, 

it is the current practice of many business entities to notify individuals in the event of a security breach. Because of uncertainty about 

the number of entities that are already in compliance with the notification mandates, CBO cannot estimate the incremental cost of 

complying with the notification requirement under the bill. 

Security freeze on credit reports 

Section 4 would allow consumers to place a security freeze on 

their credit report by making a request to a consumer credit reporting agency. The credit reporting agency would be prevented from 

releasing the credit report to any third parties without prior authorization from the consumer. The agency also would be required 

to notify all other consumer reporting agencies of the security 

freeze at the consumer’s request. According to industry sources, 

most states currently have credit freeze laws in place. Because of 

uncertainty about the number of entities that are already in compliance with the security freeze mandate, CBO cannot estimate the 

incremental cost of complying with the notification requirement 

under the bill. 

Social Security Number protection 

Section 11 would prevent covered entities from soliciting a social 

security number from an individual unless no other identifier can 


ycherry on PRODPC74 with HEARING
11 

be used reasonably. This section also would prevent covered entities from displaying SSNs, or any part of such a number, on any 

card or tag used for identification, such as student or employee 

identification cards. CBO estimates that the cost imposed on all 

covered entities would be small, since relatively few covered entities still use SSNs in this manner. 

Estimate prepared by: Federal Costs: Susan Willie and Matthew 

Pickford Impact on State, Local, and Tribal Governments: Leo Lex 

Impact on the Private Sector: Fatimot Ladipo. 

Estimate approved by: Peter H. Fontaine Deputy Assistant Director for Budget Analysis. 

REGULATORY IMPACT STATEMENT

In accordance with paragraph 11(b) of rule XXVI of the Standing 

Rules of the Senate, the Committee provides the following evaluation of the regulatory impact of the legislation, as reported: 

NUMBER OF PERSONS COVERED

The notice and safeguards provisions would apply to all sole proprietorships, partnerships, corporations, trusts, estates, cooperatives, sole proprietors, associations, or other commercial entities, 

and any charitable, educational, or nonprofit organizations that acquire, maintain, or utilize sensitive personal information. The security freeze protections in section 4 would be available to every person with a consumer credit report and would be enforced against 

every consumer reporting agency. The Social Security number protections would protect every person with a Social Security number, 

and be enforceable against all non-governmental entities that sell, 

transmit, or use Social Security numbers. 

ECONOMIC IMPACT

S. 1178 would require covered entities to develop, implement, 

maintain, and enforce a written program for the security of sensitive personal information in their possession. In addition, covered 

entities would be required to notify consumers in the event of a 

breach of sensitive personal information that creates a reasonable 

risk of identity theft. While some covered entities may already have 

safeguards and notification procedures in place, nonetheless, the 

legislation may create compliance costs for such entities in the 

form of equipment upgrades or personnel addition in order to ensure that their practices satisfy the new Federal requirements. 

PRIVACY

S. 1178 would likely bolster consumer privacy by ensuring that 

covered entities that handle sensitive personal information take appropriate measures to safeguard such information. 

PAPERWORK

The legislation would increase paperwork requirements for private industry and the Federal government to the extent that such 

paperwork is necessary to comply with the information safeguards, 

breach notification, and credit freeze requirements, as well as the 

Social Security number use prohibitions of this Act. The bill would 

require 2 reports submitted to Congress by the FTC. The first, a 


ycherry on PRODPC74 with HEARING
12 

report by the FTC containing the findings of an advisory committee 

established by the FTC Chairman pursuant to this Act. And, the 

second, a report by the FTC developed in conjunction with the Department of Justice (DOJ) on the correlation between methamphetamine use and identity theft crimes. 

SECTION-BY-SECTION ANALYSIS

Section 1. Short title 

This section would provide that the legislation be cited as the 

‘‘Identity Theft Prevention Act.’’

Section 2. Protection of sensitive personal information 

Section 2 would require covered entities to include administrative, technical, and physical safeguards within the written program 

to ensure security, protect against any anticipated threats, and protect against unauthorized access to sensitive personal information. 

The Committee notes that the implementation and enforcement of 

the data security policy is as important as the data security policy 

itself. Covered entities that are in full compliance with the current 

FTC Safeguards Rule would be deemed in compliance with this section. The Act also would require that, within 1 year of enactment, 

the FTC promulgate regulations that would require procedures for 

authenticating the credentials of third parties to which sensitive 

personal information is to be transferred or sold. 

The Committee’s purposes for allowing covered entities the option of complying with the existing FTC Safeguards Rule are twofold: First, to provide covered entities regulatory consistency without an interim gap that would require such entities to modify their 

safeguards procedures more than once in order to comply; and, second, to take into account the impact of mandating safeguards rules 

on small businesses, particularly sole proprietors. With respect to 

the latter purpose, the Committee draws a parallel between the 

Safeguards Rule and S. 1178 to the extent that small businesses 

should be afforded flexibility to comply with S. 1178 in a manner 

that is dependent on their size and complexity, the nature and 

scope of their activities, and the sensitivity of the information that 

they handle. 

Accordingly, in promulgating the regulations required under section 3(c), the FTC should consider the impact that such regulations 

would have on small businesses, as the FTC did when developing 

the existing Safeguards Rule. 

The Committee encourages the FTC in its promulgation of rules 

to fulfill the requirements of section 2 to take into account the use 

of technological safeguards and effective alternative methods to reduce the chances of identity theft. 

Section 3. Notification of security breach risk 

Section 3 would require a covered entity that, after using due 

diligence, determines that a breach of security has created a reasonable risk of identity theft exists, to notify each individual affected by the breach of security. In determining whether a reasonable risk of identity theft exists, a covered entity shall consider factors about the nature of the breach, such as if the data is usable 

or could be made usable by an unauthorized third party and 


ycherry on PRODPC74 with HEARING
13 

whether the data is in the possession and control of an unauthorized third party. If a covered entity cannot make a determination 

of whether the breach of security creates a reasonable risk of identity theft, it may request guidance from the FTC or relevant enforcement agency and the relevant agency would be required to respond in writing within 5 business days after receiving the request. 

This section also would require covered entities that suffer a 

breach of security that affects 1,000 or more individuals to report 

the breach to the FTC or other appropriate market regulator and 

notify all CRAs of the breach. The FTC would be required in such 

an instance to post a report of the breach of security on the agency’s website without personally identifying any individual affected 

by the breach. The report would include the number of individuals 

impacted by the breach of security. In the event that the breach of 

security affects fewer than 1,000, but more than 50, individuals, 

and a covered entity determines that the breach of security does 

not create a reasonable risk of identity theft, it shall report the 

breach to the FTC or appropriate market regulator under section 

5 of this Act. The report would be required to contain the number 

of individuals affected, and the type of information that was exposed, as a result of the breach of security. 

If a covered entity determines that notification to consumers of 

the breach of security is warranted, the entity would be required 

to contact individuals affected by the breach through a written or 

electronic notice. Where there is a direct relationship between the 

affected individual and an entity, the entity shall provide notice of 

the breach to the individual even if the entity is not the covered 

entity subject to the breach of security. For example, if a retailer 

hires a third party to maintain the sensitive personal data of its 

customers and the third party is subject to a breach of security, 

then the retailer shall notify the affected customers of the breach. 

If a covered entity lacks the contact information for affected individuals, the entity would have the option to provide a substitute 

notice through electronic mail, a posting on the website of the entity, and via appropriate Statewide or regional media. In the event 

that this substitute notice is necessary, the covered entity would be 

required to include in such notice the name of the individual whose 

information was subject to the security breach, the name of the entity suffering the breach, a description of the sensitive personal information that was compromised, the date indicating the discovery 

of the breach, and the toll-free numbers necessary to contact the 

entity, CRAs, and the FTC. 

Section 3 would require a covered entity to give notice to consumers when required by this Act in the most expeditious manner 

practicable, but not later than 25 business days following the discovery of the breach, unless a Federal or State law enforcement 

agency determines that the timely provision of notice would materially impede a civil or criminal investigation, or a Federal national 

security or homeland security agency determines that notice would 

threaten national security or homeland security. 

This section would not apply to electronic communications of a 

third party stored by a cable operator, information service, or telecommunications carrier in the network of such operator, service, or 

carrier in the course of transferring or transmitting such communication. 


ycherry on PRODPC74 with HEARING
14 

Section 4. Security freeze 

Section 4 would allow a consumer to place a security freeze on 

his or her credit report by making a request to a CRA in writing, 

by telephone, or through a secure electronic connection made available by the CRA. The security freeze would prevent a consumer’s 

credit report from being released to a third party without express 

authorization from the consumer. The placing of a freeze on a credit report may not be taken into account in calculating the credit 

score of the consumer. The Committee encourages the CRAs to provide consumers the most expedient means to place and lift security 

freezes. 

The consumer whose credit report was frozen would be permitted 

to remove a security freeze on his or her credit report only upon 

request to the CRA. The CRA would be permitted to remove a security freeze upon the consumer’s request, or if the CRA believes the 

report was frozen due to a material misrepresentation of fact. A 

consumer may have a security freeze temporarily lifted upon request to the CRA. Such request shall specify the time period of the 

temporary lift or specifying a specific third party to which access 

to the consumer’s credit report may be granted. 

A CRA would have up to 3 business days after receiving a request by a consumer to place a security freeze, and 3 days after receiving a request to lift a freeze permanently. A CRA would be required to temporarily suspend a security freeze within 1 business 

day after receiving a request. 

This section would allow a consumer who places, removes, or 

temporarily suspends a security freeze to request that the CRA 

that initiates the action on the security freeze notify all other CRAs 

of the request within 1 day. A CRA that is notified of such a request shall ensure the validity of the request, including the identity 

of the requesting consumer within 3 business days after receiving 

the notification, and comply with the request no later than 3 days 

after validating the request. 

Under this section, a CRA would be required to send written confirmation to a consumer within 10 days after placing, removing, or 

temporarily suspending a security freeze. A CRA may not place, remove, or temporarily suspend a security freeze unless the consumer provides proper identification within the meaning of section 

610(a)(1) of the FCRA. A CRA may not change the name, date of 

birth, Social Security number, or address in a frozen credit report 

without sending a written confirmation to the consumer with 30 

days after the change is made. 

Section 4 would not apply to the use of a credit report by any 

of the following: a person or entity with which the consumer has 

had a prior business relationship for the purpose of reviewing an 

account or collecting the financial obligation owing from an account 

or contract; any Federal, State or local agency, law enforcement 

agency, trial court, or private collection agency acting pursuant to 

a court order, warrant, or subpoena; a child support agency or its 

agents acting pursuant to subtitle D of title IV of the Social Security Act; HHS or any similar State agency acting to investigate 

Medicare or Medicaid fraud; the Internal Revenue Service or a 

State municipal taxing authority to investigate or collect delinquent taxes or unpaid court orders or any of their other statutory 

responsibilities; any person administering a credit file monitoring 


ycherry on PRODPC74 with HEARING
15 

subscription to which the consumer has subscribed; any person or 

entity for the purpose of providing a consumer with his or her credit report or credit score at the consumer’s request; or any person 

who seeks access during the time period that a security freeze is 

temporarily suspended for the purpose of facilitating the extension 

of credit or another permissible use. 

This section would allow a CRA to charge a fee, not in excess of $10, for placing a security freeze. A CRA could not charge a consumer for up to 2 requests per year per credit reporting agency for 

temporary suspension of a credit freeze. CRAs would be permitted 

to charge no more than $5 for each additional temporary suspension. A CRA could not charge for removing a security freeze permanently. Notwithstanding the foregoing, CRAs could not charge a fee 

for placing, removing, or temporarily suspending a consumer’s credit report if the consumer: is a victim of identity theft; is age 65 or 

older; is on active duty or in the ready reserve component of an 

armed force of the United States; or is the spouse of an individual 

on active duty or in the ready reserve component. 

Section 4 would exempt any CRA that acts only as a reseller of 

credit information by assembling and merging information contained in the data base of another CRA and does not maintain a 

permanent data base of credit information from which new consumer reports are produced. This section, further, would exempt 

check services or fraud prevention services companies and a deposit 

account information services companies from having to place a security freeze in a credit report. 

Section 5. Information security and consumer privacy advisory committee 

Section 5 would require the Chairman of the FTC to establish a 

5 member Information Security and Consumer Privacy Advisory 

Committee comprised of at least 1 member from the following 

groups: a non-profit consumer advocacy group; a business organization that collects personally identifiable information; and state attorney general’s office. The advisory committee would collect, review, disseminate, and advise on guidance to protect sensitive personal information. The advisory committee would be required to 

submit to Congress a report on its findings within 12 months after 

its establishment. 

Section 6. Related crime study 

Section 6 would require the FTC, in conjunction with the DOJ, 

to conduct a study within 9 months of enactment of this Act to examine the correlation, if any, between methamphetamine use and 

identity theft crimes, as well as the needs of law enforcement to address methamphetamine crimes related to identity theft and the 

Federal government’s role in addressing and deterring identity 

theft crimes. The FTC would be required to submit a report of its 

findings and recommendations to Congress not later than 9 months 

after the date of enactment. 

Section 7. Prohibition on technology mandates 

This section would make clear that nothing in this Act should be 

construed as authorizing the FTC to issue regulations that require 

or impose a specific technology, product, or technological standard. 


ycherry on PRODPC74 with HEARING
16 

Section 8. Enforcement 

Section 8 would provide new authority for the FTC to take action 

against covered entities that fail to develop, implement, maintain, 

or enforce a written program for the security of sensitive personal 

information as unfair or deceptive acts or practices proscribed 

under section 18(a)(1)(B) of the FTCA (15 U.S.C. 57a(a)(1)(B)). This 

authority is analogous to the authority that the FTC currently possesses under Title V of the GLBA with respect to financial institutions. 

This section also would provide that compliance with this Act 

with respect to certain entities be enforced by the agency traditionally regulating the entity under the statute of jurisdiction. 

In addition, any covered entity to which title V of the GLBA (15 

U.S.C. 6801 et seq.) or section 607(a) of the FCRA (15 U.S.C. 

1681e(a)) applies would be deemed in compliance with sections 2 

and 3 of this Act to the extent that the person is in compliance 

with the provisions of those Acts, which require the protection of 

sensitive personal information and notification in the event of a 

breach of security. 

It is not the intent of this Committee to impose prohibitively onerous safeguards and notification requirements on small businesses. Thus, it is the Committee’s expectation that the FTC or appropriate market regulator should consider the size of the business 

and its ability to comply as 1 of many factors when enforcing this 

Act. 

Section 9. Enforcement by State Attorneys General 

Section 9 would allow a State to bring an action under this Act 

in State or Federal court on behalf of its residents. The State would 

be required to notify the FTC or the appropriate Federal market 

regulator of the action at least 60 days prior to bringing the action. 

In the event that such notice is not feasible, the State would be required to provide notice immediately upon instituting the action. 

The FTC or appropriate Federal market regulator would be authorized to intervene in such civil action. If the FTC or appropriate 

Federal market regulator institutes an action for a violation of this 

Act, no State attorney general, or official or agency of the State, 

would be permitted to bring an action during the pendency of that 

action against any defendant named in the complaint. If a State 

prevails in a civil action under the Act, it could recover reasonable 

costs and attorney fees from the defendant. 

Nothing in this section would prevent the attorney general of a 

State from exercising the powers conferred on the Attorney General 

by the laws of such State with respect to the conducting of investigations, compelling of witnesses, and production of evidence. 

Section 10. Preemption of State law 

Section 10 of this Act would preempt any State or local law that 

requires a covered entity to develop implement, maintain or enforce 

information security programs to which this Act applies and any 

State or local law that requires a covered entity to notify individuals of breaches of security related to their sensitive personal information. This section, further, would preempt State and local laws 

with respect to CRAs’ compliance with a consumer’s request to 

place, remove, or temporarily suspend the prohibition on the reVerDate Aug 31 2005 08:24 Dec 06, 2007 Jkt 069010 PO 00000 Frm 00018 Fmt 6659 Sfmt 6601 E:\HR\OC\SR235.XXX SR235

ycherry on PRODPC74 with HEARING
17 

lease of information from a consumer’s credit report only to the extent that they conflict with the provisions of this Act. State laws 

that afford greater protections with respect to CRAs’ compliance 

with a consumer’s request to place, remove, or temporarily suspend 

the prohibition on the release of information from a consumer’s 

credit report are not inconsistent with the Act. Section 10 would 

preempt any State or local law prohibiting or limiting collection, solicitation, sale, provision, or display of Social Security numbers of 

the type described in section 11. 

Section 11. Social Security number protection 

Section 11(a) would prohibit the solicitation of a Social Security 

number from an individual unless there is a specific use of the 

number for which no other identifying number reasonably can be 

used. Section 11(a) would provide certain exceptions for the solicitation of a Social Security number, including: for use in an identification, verification, accuracy, or identity proofing process; for any 

purpose permitted under section 502(e) of the GLBA (15 U.S.C. 

6802(e)) or the FCRA (15 U.S.C. 1681 et seq.); to comply with a requirement of Federal, State, or local law; for the purpose of 

verifying or obtaining proof of identity by a CRA; to the extent necessary for verifying the accuracy of information submitted to a company, organization, or others; to identify or locate missing or abducted children, witnesses, criminals and fugitives, parties to lawsuits, parents delinquent in child support payments, organ and 

bone marrow donors, pension fund beneficiaries, and missing heirs; 

or to the extent necessary to prevent, detect, or investigate fraud, 

unauthorized transactions, or to facilitate the enforcement of an obligation of, or collection of, a debt from a consumer. 

Section 11(b) would prohibit employers, educational institutions, 

and others from using Social Security numbers for any employee 

card, or tag that is provided by employers, educational institutions, 

and others for the purpose of identification. This subsection also 

would prohibit the use of Social Security numbers as driver identifiers on State driver’s licenses. 

Section 11(c) would amend the Social Security Act (42 U.S.C. 

405(c)(2)(C)) to prohibit any Federal, State, or judicial agency from 

employing or entering into a contract to utilize inmates who would 

have access to the Social Security numbers of other individuals. 

This prohibition would go into effect 90 days after the date of enactment. 

Section 11(d) would prohibit any person from selling, purchasing, 

or providing a Social Security number to the general public or to 

display Social Security numbers to the general public. The subsection would provide exceptions to this prohibition: to the extent 

necessary for law enforcement or national security purposes; to the 

extent necessary for public health purposes and emergency situations to protect the health or safety of an individual; to the extent 

that the sale or display is required or permitted under Federal or 

State law; for any purpose permitted under section 502(e) of the 

GLBA (15 U.S.C. 6802(e)) or the FCRA (15 U.S.C. 1681 et seq.); to 

the extent necessary for verifying the accuracy of information submitted to a company, organization, or others; to the extent necessary to identify or locate missing or abducted children, witnesses 

to a lawsuit, criminals, parents delinquent in child support payVerDate Aug 31 2005 08:24 Dec 06, 2007 Jkt 069010 PO 00000 Frm 00019 Fmt 6659 Sfmt 6601 E:\HR\OC\SR235.XXX SR235

ycherry on PRODPC74 with HEARING
18 

ments, organ donors, missing heirs, and for similar legal, medical, 

or family related purposes, provided that person providing or obtaining the information does not do so for marketing purposes; to 

the extent necessary to prevent, detect, or investigate fraud, unauthorized transactions, or to facilitate the enforcement of an obligation of, or collection of a debt from a consumer, provided that person providing or obtaining the information does not do so for marketing purposes; to the extent incidental to a merger or acquisition 

of a business; to the extent necessary for certain research conducted by the Federal, State, or local government; or to the extent 

incidental to the sale of a Federal, State, or local government document made available to the general public, which includes the Social Security number. Section 11(d) further would allow the sale or 

purchase of an individual’s Social Security number if written consent is obtained. 

Section 12. Protection of information at Federal agencies 

Section 12 would require each Federal agency to develop, implement, maintain, and enforce a written program for the security of 

sensitive personal information. Federal agencies would be required 

to investigate any suspected breach of security affecting sensitive 

personal information and to notify individuals if the breach creates 

a reasonable risk of identity theft. The inspector general of each 

Federal agency would enforce compliance with the requirements of 

this section. 

Section 13. Definitions 

Section 13 would provide for a number of notable definitions, as 

follows: 

Breach of Security: The unauthorized access to, and acquisition 

of, data in any form or format containing sensitive personal information that compromises the security or confidentiality of such information. 

Consumer Credit Reporting Agency: Any person engaging in the 

practice of assembling or evaluating consumer credit information or 

other information on consumers for the purpose of furnishing credit 

reports to third parties. 

Covered Entity: A sole proprietorship, partnership, corporation, 

trust, estate, cooperative, sole propriety, association, or other commercial entity, and any charitable, educational, or nonprofit organization, that acquires, maintains, or utilizes sensitive personal information. 

Credit Report: A consumer report as defined in section 603(d) of 

the FCRA (15 U.S.C. 1681a(p)), as well as any associated credit 

score, that is used for the purpose of serving as a factor in establishing a consumer’s eligibility for credit for personal, family, or 

household purposes. 

Identity Theft: The unauthorized acquisition, purchase, sale, or 

use by any person of an individual’s sensitive personal information 

that violates section 1028 of title 18, United States Code, or any 

provision of State law; or that results in harm to the individual 

whose sensitive personal information was used. 

Reasonable Risk of Identity Theft: The preponderance of the evidence available to the covered entity that has experienced a breach 


ycherry on PRODPC74 with HEARING
19 

of security establishes that identity theft for 1 or more individuals 

from the breach of security is foreseeable. 

Sensitive Personal Information: An individual’s name, address, 

or phone number combined with 1 or more data elements as listed 

in this definition. The term ‘‘sensitive personal information’’ also 

includes an account identifier combined with a password or other 

security code, which permits access to an account from which an 

individual can conduct certain financial transactions or gain access 

to information that could be used to identity theft. Sensitive personal information would not include information that has been 

made available to the general public by the Federal, State, or local 

government or that has been widely distributed in the media. In 

an enforcement action brought under this Act, the covered entity 

shall have the burden of proving that it had obtained the information at issue from a source permitted under this definition. The 

FTC would be authorized through a rulemaking to designate or delete data elements or identifying information that may be used to 

effectuate identity theft as sensitive personal information. 

Section 14. Authorization of appropriations 

Section 14 would authorize $2,000,000 to be appropriated to the 

FTC to carry out this Act for fiscal years 2007 through 2011. 

Section 15. Effective dates 

This section would require covered entities under section 2(a) to 

implement the information safeguards program within 6 months 

after the date of enactment of this Act. 

Under this Act, the FTC would be required to initiate 

rulemakings under sections 2(c), 3, and 4, including a rulemaking 

proceeding to determine what constitutes proper identification 

under 610(a)(1) of the FCRA (15 U.S.C. 1681(h)(a)(1)) within 45 

days after enactment and promulgate final rules within 1 year 

after the date of enactment. The provisions of sections 2(c), 3, and 

4 would take effect 6 months after each of the final rules are promulgated. Section 10 would take effect at the same time as sections 

2(c), 3, and 4. All other provisions of this Act would take effect 

upon its enactment. 


ycherry on PRODPC74 with HEARING
(20) 

CHANGES IN EXISTING LAW

In compliance with paragraph 12 of rule XXVI of the Standing 

Rules of the Senate, changes in existing law made by the bill, as 

reported, are shown as follows (existing law proposed to be omitted 

is enclosed in black brackets, new material is printed in italic, existing law in which no change is proposed is shown in roman): 

SOCIAL SECURITY ACT 

SEC. 205. EVIDENCE AND PROCEDURE FOR ESTABLISHMENT OF BENEFITS. 

[42 U.S.C. 405] 

(a) RULES AND REGULATIONS; PROCEDURES.—The Commissioner 

of Social Security shall have full power and authority to make rules 

and regulations and to establish procedures, not inconsistent with 

the provisions of this title, which are necessary or appropriate to 

carry out such provisions, and shall adopt reasonable and proper 

rules and regulations to regulate and provide for the nature and 

extent of the proofs and evidence and the method of taking and furnishing the same in order to establish the right to benefits hereunder. 

(b) ADMINISTRATIVE DETERMINATION OF ENTITLEMENT TO BENE- FITS; FINDINGS OF FACT; HEARINGS; INVESTIGATIONS; EVIDENTIARY

HEARINGS IN RECONSIDERATIONS OF DISABILITY BENEFIT TERMI- NATIONS.—(1) The Commissioner of Social Security is directed to make 

findings of fact, and decisions as to the rights of any individual 

applying for a payment under this title. Any such decision by 

the Commissioner of Social Security which involves a determination of disability and which is in whole or in part unfavorable to such individual shall contain a statement of the case, 

in understandable language, setting forth a discussion of the 

evidence, and stating the Commissioner’s determination and 

the reason or reasons upon which it is based. Upon request by 

any such individual or upon request by a wife, divorced wife, 

surviving divorced mother, surviving divorced father husband, 

divorced husband, widower, surviving divorced husband, child, 

or parent who makes a showing in writing that his or her 

rights may be prejudiced by any decision the Commissioner of 

Social Security has rendered, the Commissioner shall give such 

applicant and such other individual reasonable notice and opportunity for a hearing with respect to such decision, and, if 

a hearing is held, shall, on the basis of evidence adduced at the 

hearing, affirm, modify, or reverse the Commissioner’s findings 

of fact and such decision. Any such request with respect to 

such a decision must be filed within sixty days after notice of 

such decision is received by the individual making such request. The Commissioner of Social Security is further authorVerDate Aug 31 2005 08:24 Dec 06, 2007 Jkt 069010 PO 00000 Frm 00022 Fmt 6604 Sfmt 6601 E:\HR\OC\SR235.XXX SR235

ycherry on PRODPC74 with HEARING
21 

ized, on the Commissioner’s own motion, to hold such hearings 

and to conduct such investigations and other proceedings as 

the Commissioner may deem necessary or proper for the administration of this title. In the course of any hearing, investigation or other proceeding, the Commissioner may administer 

oaths and affirmations, examine witnesses and receive evidence. Evidence may be received at any hearing before the 

Commissioner of Social Security even though inadmissible 

under rules of evidence applicable to court procedure. 

(2) In any case where— (A) an individual is a recipient of disability insurance 

benefits, or of child’s, widow’s, or widower’s insurance benefits based on disability, 

(B) the physical or mental impairment on the basis of 

which such benefits are payable is found to have ceased, 

not to have existed, or to no longer be disabling, and 

(C) as a consequence of the finding described in subparagraph (B), such individual is determined by the Commissioner of Social Security not to be entitled to such benefits, 

any reconsideration of the finding described in subparagraph (B), in connection with a reconsideration by the 

Commissioner of Social Security (before any hearing under 

paragraph (1) on the issue of such entitlement) of the 

Commissioner’s determination described in subparagraph 

(C), shall be made only after opportunity for an evidentiary hearing, with regard to the finding described in 

subparagraph (B), which is reasonably accessible to such 

individual. Any reconsideration of a finding described in 

subparagraph (B) may be made either by the State agency 

or the Commissioner of Social Security where the finding 

was originally made by the State agency, and shall be 

made by the Commissioner of Social Security where the 

finding was originally made by the Commissioner of Social 

Security. In the case of a reconsideration by a State agency 

of a finding described in subparagraph (B) which was 

originally made by such State agency, the evidentiary 

hearing shall be held by an adjudicatory unit of the State 

agency other than the unit that made the finding described in subparagraph (B). In the case of a reconsideration by the Commissioner of Social Security of a finding 

described in subparagraph (B) which was originally made 

by the Commissioner of Social Security, the evidentiary 

hearing shall be held by a person other than the person or 

persons who made the finding described in subparagraph 

(B). 

(3)(A) A failure to timely request review of an initial adverse 

determination with respect to an application for any benefit 

under this title or an adverse determination on reconsideration 

of such an initial determination shall not serve as a basis for 

denial of a subsequent application for any benefit under this 

title if the applicant demonstrates that the applicant, or any 

other individual referred to in paragraph (1), failed to so request such a review acting in good faith reliance upon incorrect, incomplete, or misleading information, relating to the conVerDate Aug 31 2005 08:24 Dec 06, 2007 Jkt 069010 PO 00000 Frm 00023 Fmt 6604 Sfmt 6601 E:\HR\OC\SR235.XXX SR235

ycherry on PRODPC74 with HEARING
22 

sequences of reapplying for benefits in lieu of seeking review 

of an adverse determination, provided by any officer or employee of the Social Security Administration or any State agency acting under section 221. 

(B) In any notice of an adverse determination with respect 

to which a review may be requested under paragraph (1), the 

Commissioner of Social Security shall describe in clear and 

specific language the effect on possible entitlement to benefits 

under this title of choosing to reapply in lieu of requesting review of the determination. 

(c) RECORDS OF WAGES AND SELF-EMPLOYMENT INCOME.— (1) For the purposes of this subsection— (A) The term ‘‘year’’ means a calendar year when used 

with respect to wages and a taxable year when used with 

respect to self-employment income. 

(B) The term ‘‘time limitation’’ means a period of 3 

years, 3 months, and 15 days. 

(C) The term ‘‘survivor’’ means an individual’s spouse, 

surviving divorced wife, surviving divorced husband, surviving divorced mother, surviving divorced father, child, or 

parent, who survives such individual. 

(D) The term ‘‘period’’ when used with respect to self-employment income means a taxable year and when used 

with respect to wages means— (i) a quarter if wages were reported or should have 

been reported on a quarterly basis on tax returns filed 

with the Secretary of the Treasury or his delegate 

under section 6011 of the Internal Revenue Code of 

1986 or regulations thereunder (or on reports filed by 

a State under section 218(e) (as in effect prior to December 31, 1986) or regulations thereunder), 

(ii) a year if wages were reported or should have 

been reported on a yearly basis on such tax returns or 

reports, or 

(iii) the half year beginning January 1 or July 1 in 

the case of wages which were reported or should have 

been reported for calendar year 1937. 

(2)(A) On the basis of information obtained by or submitted 

to the Commissioner of Social Security, and after such 

verification thereof as the Commissioner deems necessary, the 

Commissioner of Social Security shall establish and maintain 

records of the amounts of wages paid to, and the amounts of 

self-employment income derived by, each individual and of the 

periods in which such wages were paid and such income was 

derived and, upon request, shall inform any individual or his 

survivor, or the legal representative of such individual or his 

estate, of the amounts of wages and self-employment income of 

such individual and the periods during which such wages were 

paid and such income was derived, as shown by such records 

at the time of such request. 

(B)(i) In carrying out the Commissioner’s duties under subparagraph (A) and subparagraph (F), the Commissioner of Social Security shall take affirmative measures to assure that social security account numbers will, to the maximum extent 


ycherry on PRODPC74 with HEARING
23 

practicable, be assigned to all members of appropriate groups 

of categories of individuals by assigning such numbers (or 

ascertaining that such numbers have already been assigned): 

(I) to aliens at the time of their lawful admission to the 

United States either for permanent residence or under 

other authority of law permitting them to engage in employment in the United States and to other aliens at such 

time as their status is so changed as to make it lawful for 

them to engage in such employment; 

(II) to any individual who is an applicant for or recipient 

of benefits under any program financed in whole or in part 

from Federal funds including any child on whose behalf 

such benefits are claimed by another person; and 

(III) to any other individual when it appears that he 

could have been but was not assigned an account number 

under the provisions of subclauses (I) or (II) but only after 

such investigation as is necessary to establish to the satisfaction of the Commissioner of Social Security, the identity 

of such individual, the fact that an account number has 

not already been assigned to such individual, and the fact 

that such individual is a citizen or a noncitizen who is not, 

because of his alien status, prohibited from engaging in 

employment; and, in carrying out such duties, the Commissioner of Social Security is authorized to take affirmative measures to assure the issuance of social security 

numbers: 

(IV) to or on behalf of children who are below school age 

at the request of their parents or guardians; and 

(V) to children of school age at the time of their first enrollment in school. 

(ii) The Commissioner of Social Security shall require of applicants for social security account numbers such evidence as 

may be necessary to establish the age, citizenship, or alien status, and true identity of such applicants, and to determine 

which (if any) social security account number has previously 

been assigned to such individual. With respect to an application for a social security account number for an individual who 

has not attained the age of 18 before such application, such 

evidence shall include the information described in subparagraph (C)(ii). 

(iii) In carrying out the requirements of this subparagraph, 

the Commissioner of Social Security shall enter into such 

agreements as may be necessary with the Attorney General 

and other officials and with State and local welfare agencies 

and school authorities (including nonpublic school authorities). 

(C)(i) It is the policy of the United States that any State (or political subdivision thereof) may, in the administration of any tax, general public assistance, driver’s license, or motor vehicle registration 

law within its jurisdiction, utilize the social security account numbers issued by the Commissioner of Social Security for the purpose 

of establishing the identification of individuals affected by such 

law, and may require any individual who is or appears to be so affected to furnish to such State (or political subdivision thereof) or 

any agency thereof having administrative responsibility for the law 


ycherry on PRODPC74 with HEARING
24 

involved, the social security account number (or numbers, if he has 

more than 1 such number) issued to him by the Commissioner of 

Social Security. 

(ii) In the administration of any law involving the issuance of a 

birth certificate, each State shall require each parent to furnish to 

such State (or political subdivision thereof) or any agency thereof 

having administrative responsibility for the law involved, the social 

security account number (or numbers, if the parent has more than 

1 such number) issued to the parent unless the State (in accordance with regulations prescribed by the Commissioner of Social Security) finds good cause for not requiring the furnishing of such 

number. The State shall make numbers furnished under this subclause available to the Commissioner of Social Security and the 

agency administering the State’s plan under part D of title IV in 

accordance with Federal or State law and regulation. Such numbers shall not be recorded on the birth certificate. A State shall not 

use any social security account number, obtained with respect to 

the issuance by the State of a birth certificate, for any purpose 

other than for the enforcement of child support orders in effect in 

the State, unless section 7(a) of the Privacy Act of 1974 does not 

prohibit the State from requiring the disclosure of such number, by 

reason of the State having adopted, before January 1, 1975, a statute or regulation requiring such disclosure. 

(iii)(I) In the administration of section 9 of the Food Stamp Act 

of 1977 (7 U.S.C 2018) involving the determination of the qualifications of applicants under such Act, the Secretary of Agriculture 

may require each applicant retail store or wholesale food concern 

to furnish to the Secretary of Agriculture the social security account number of each individual who is an officer of the store or 

concern and, in the case of a privately owned applicant, furnish the 

social security account numbers of the owners of such applicant. No 

officer or employee of the Department of Agriculture shall have access to any such number for any purpose other than the establishment and maintenance of a list of the names and social security account numbers of such individuals for use in determining those applicants who have been previously sanctioned or convicted under 

section 12 or 15 of such Act (7 U.S.C. 2021 or 2024). 

(II) The Secretary of Agriculture may share any information contained in any list referred to in subclause (I) with any other agency 

or instrumentality of the United States which otherwise has access 

to social security account numbers in accordance with this subsection or other applicable Federal law, except that the Secretary 

of Agriculture may share such information only to the extent that 

such Secretary determines such sharing would assist in verifying 

and matching such information against information maintained by 

such other agency or instrumentality. Any such information shared 

pursuant to this subclause may be used by such other agency or 

instrumentality only for the purpose of effective administration and 

enforcement of the Food Stamp Act of 1977 or for the purpose of 

investigation of violations of other Federal laws or enforcement of 

such laws. 

(III) The Secretary of Agriculture, and the head of any other 

agency or instrumentality referred to in this subclause, shall restrict, to the satisfaction of the Commissioner of Social Security, acVerDate Aug 31 2005 08:24 Dec 06, 2007 Jkt 069010 PO 00000 Frm 00026 Fmt 6604 Sfmt 6601 E:\HR\OC\SR235.XXX SR235

ycherry on PRODPC74 with HEARING
25 

cess to social security account numbers obtained pursuant to this 

clause only to officers and employees of the United States whose 

duties or responsibilities require access for the purposes described 

in subclause (II). 

(IV) The Secretary of Agriculture, and the head of any agency or 

instrumentality with which information is shared pursuant to 

clause (II), shall provide such other safeguards as the Commissioner of Social Security determines to be necessary or appropriate 

to protect the confidentiality of the social security account numbers. 

(iv) In the administration of section 506 of the Federal Crop Insurance Act, the Federal Crop Insurance Corporation may require 

each policyholder and each reinsured company to furnish to the insurer or to the Corporation the social security account number of 

such policyholder, subject to the requirements of this clause. No officer or employee of the Federal Crop Insurance Corporation shall 

have access to any such number for any purpose other than the establishment of a system of records necessary for the effective administration of such Act. The Manager of the Corporation may require each policyholder to provide to the Manager, at such times 

and in such manner as prescribed by the Manager, the social security account number of each individual that holds or acquires a 

substantial beneficial interest in the policyholder. For purposes of 

this clause, the term ‘‘substantial beneficial interest’’ means not 

less than 5 percent of all beneficial interest in the policyholder. The 

Secretary of Agriculture shall restrict, to the satisfaction of the 

Commissioner of Social Security, access to social security account 

numbers obtained pursuant to this clause only to officers and employees of the United States or authorized persons whose duties or 

responsibilities require access for the administration of the Federal 

Crop Insurance Act. The Secretary of Agriculture shall provide 

such other safeguards as the Commissioner of Social Security determines to be necessary or appropriate to protect the confidentiality of such social security account numbers. For purposes of this 

clause the term ‘‘authorized person’’ means an officer or employee 

of an insurer whom the Manager of the Corporation designates by 

rule, subject to appropriate safeguards including a prohibition 

against the release of such social security account number (other 

than to the Corporation) by such person. 

(v) If and to the extent that any provision of Federal law heretofore enacted is inconsistent with the policy set forth in clause (i), 

such provision shall, on and after the date of the enactment of this 

subparagraph, be null, void, and of no effect. If and to the extent 

that any such provision is inconsistent with the requirement set 

forth in clause (ii), such provision shall, on and after the date of 

the enactment of such subclause, be null, void, and of no effect. 

(vi)(I) For purposes of clause (i) of this subparagraph, an agency 

of a State (or political subdivision thereof) charged with the administration of any general public assistance, driver’s license, or motor 

vehicle registration law which did not use the social security account number for identification under a law or regulation adopted 

before January 1, 1975, may require an individual to disclose his 

or her social security number to such agency solely for the purpose 

of administering the laws referred to in clause (i) above and for the 


ycherry on PRODPC74 with HEARING
26 

purpose of responding to requests for information from an agency 

administering a program funded under part A of title IV or an 

agency operating pursuant to the provisions of part D of such title. 

(II) Any State or political subdivision thereof (and any person 

acting as an agent of such an agency or instrumentality), in the administration of any driver’s license or motor vehicle registration 

law within its jurisdiction, may not display a social security account number issued by the Commissioner of Social Security (or 

any derivative of such number) on any driver’s license, motor vehicle registration, or personal identification card (as defined in section 7212(a)(2) of the 9/11 Commission Implementation Act of 

2004), or include, on any such license, registration, or personal 

identification card, a magnetic strip, bar code, or other means of 

communication which conveys such number (or derivative thereof). 

(vii) For purposes of this subparagraph, the term ‘‘State’’ includes 

the District of Columbia, the Commonwealth of Puerto Rico, the 

Virgin Islands, Guam, the Commonwealth of the Northern Marianas, and the Trust Territory of the Pacific Islands. 

(viii)(I) Social security account numbers and related records that 

are obtained or maintained by authorized persons pursuant to any 

provision of law, enacted on or after October 1, 1990, shall be confidential, and no authorized person shall disclose any such social 

security account number or related record. 

(II) Paragraphs (1), (2), and (3) of section 7213(a) of the Internal 

Revenue Code of 1986 shall apply with respect to the unauthorized 

willful disclosure to any person of social security account numbers 

and related records obtained or maintained by an authorized person pursuant to a provision of law enacted on or after October 1, 

1990, in the same manner and to the same extent as such paragraphs as such paragraphs apply with respect to unauthorized disclosures of returns and return information described in such paragraphs. Paragraph (4) of such 7213(a) of such Code shall apply 

with respect to the willful offer of any item of material value in exchange for any such social security account number or related 

record in the same manner and to the same extent as such paragraph applies with respect to offers (in exchange for any return or 

return information) described in such paragraph. 

(III) For purposes of this clause, the term ‘‘authorized person’’

means an officer or employee of the United States, an officer or employee of any State, political subdivision of a State, or agency of a 

State or political subdivision of a State, and any other person (or 

officer or employee thereof), who has or had access to social security account numbers or related records pursuant to any provision 

of law enacted on or after October 1, 1990. For purposes of this 

subclause, the term ‘‘officer or employee’’ includes a former officer 

or employee. 

(IV) For purposes of this clause, the term ‘‘related record’’ means 

any record, list, or compilation that indicates, directly or indirectly, 

the identity of any individual with respect to whom a social security account number or a request for a social security account number is maintained pursuant to this clause. 

(ix) In the administration of the provisions of chapter 81 of title 

5, United States Code, and the Longshore and Harbor Workers’

Compensation Act (33 U.S.C. 901 et seq.), the Secretary of Labor 


ycherry on PRODPC74 with HEARING
27 

may require by regulation that any person filing a notice of injury 

or a claim for benefits under such provisions provide as part of 

such notice or claim such person’s social security account number, 

subject to the requirements of this clause. No officer or employee 

of the Department of Labor shall have access to any such number 

for any purpose other than the establishment of a system of records 

necessary for the effective administration of such provisions. The 

Secretary of Labor shall restrict, to the satisfaction of the Commissioner of Social Security, access to social security account numbers 

obtained pursuant to this clause to officers and employees of the 

United States whose duties or responsibilities require access for 

the administration or enforcement of such provisions. The Secretary of Labor shall provide such other safeguards as the Commissioner of Social Security determines to be necessary or appropriate 

to protect the confidentiality of the social security account numbers. 

(x) No executive, legislative, or judicial agency or instrumentality 

of the Federal Government or of a State or political subdivision 

thereof (or person acting as an agent of such an agency or instrumentality) may employ, or enter into a contract for the use or employment of, prisoners in any capacity that would allow such prisoners access to the social security account numbers of other individuals. For purposes of this clause, the term ‘prisoner’ means an individual who is confined in a jail, prison, or other penal institution 

or correctional facility, serving community service as a term of probation or parole, or serving a sentence through a work-furlough program. 

(D)(i) It is the policy of the United States that— (I) any State (or any political subdivision of a State) and any 

authorized blood donation facility may utilize the social security account numbers issued by the Commissioner of Social Security for the purpose of identifying blood donors, and 

(II) any State (or political subdivision of a State) may require 

any individual who donates blood within such State (or political subdivision) to furnish to such State (or political subdivision), to any agency thereof having related administrative responsibility, or to any authorized blood donation facility the social security account number (or numbers, if the donor has 

more than 1 such number) issued to the donor by the Commissioner of Social Security. 

(ii) If and to the extent that any provision of Federal law enacted 

before the date of the enactment of this subparagraph is inconsistent with the policy set forth in clause (i), such provision shall, 

on and after such date, be null, void, and of no effect. 

(iii) For purposes of this subparagraph—

(I) the term ‘‘authorized blood donation facility’’ means an 

entity described in section 1141(h)(1)(B), and 

(II) the term ‘‘State’’ includes the District of Columbia, the 

Commonwealth of Puerto Rico, the Virgin Islands, Guam, the 

Commonwealth of the Northern Marianas, and the Trust Territory of the Pacific Islands. 

(E)(i) It is the policy of the United States that—

(I) any State (or any political subdivision of a State) may utilize the social security account numbers issued by the CommisVerDate Aug 31 2005 08:24 Dec 06, 2007 Jkt 069010 PO 00000 Frm 00029 Fmt 6604 Sfmt 6601 E:\HR\OC\SR235.XXX SR235

ycherry on PRODPC74 with HEARING
28 

sioner of Social Security for the additional purposes described 

in clause (ii) if such numbers have been collected and are otherwise utilized by such State (or political subdivision) in accordance with applicable law, and 

(II) any district court of the United States may use, for such 

additional purposes, any such social security account numbers 

which have been so collected and are so utilized by any State. 

(ii) The additional purposes described in this clause are the following: 

(I) Identifying duplicate names of individuals on master lists 

used for jury selection purposes. 

(II) Identifying on such master lists those individuals who 

are ineligible to serve on a jury by reason of their conviction 

of a felony. 

(iii) To the extent that any provision of Federal law enacted before the date of the enactment of this subparagraph is inconsistent 

with the policy set forth in clause (i), such provision shall, on and 

after that date, be null, void, and of no effect. 

(iv) For purposes of this subparagraph, the term ‘‘State’’ has the 

meaning such term has in subparagraph (D). 

(F) The Commissioner of Social Security shall require, as a condition for receipt of benefits under this title, that an individual furnish satisfactory proof of a social security account number assigned 

to such individual by the Commissioner of Social Security or, in the 

case of an individual to whom no such number has been assigned, 

that such individual make proper application for assignment of 

such a number. 

(G) The Commissioner of Social Security shall issue a social security card to each individual at the time of the issuance of a social 

security account number to such individual. The social security 

card shall be made of banknote paper, and (to the maximum extent 

practicable) shall be a card which cannot be counterfeited. 

(H) The Commissioner of Social Security shall share with the 

Secretary of the Treasury the information obtained by the Commissioner pursuant to the second sentence of subparagraph (B)(ii) and 

to subparagraph (C)(ii) for the purpose of administering those sections of the Internal Revenue Code of 1986 which grant tax benefits based on support or residence of children. 

(3) The Commissioner’s records shall be evidence for the purpose of proceedings before the Commissioner of Social Security 

or any court of the amounts of wages paid to, and self-employment income derived by, an individual and of the periods in 

which such wages were paid and such income was derived. The 

absence of an entry in such records as to wages alleged to have 

been paid to, or as to self-employment income alleged to have 

been derived by, an individual in any period shall be evidence 

that no such alleged wages were paid to, or that no such alleged income was derived by, such individual during such period. 

(4) Prior to the expiration of the time limitation following 

any year the Commissioner of Social Security may, if it is 

brought to the Commissioner’s attention that any entry of 

wages or self-employment income in the Commissioner’s 

records for such year is erroneous or that any item of wages 


ycherry on PRODPC74 with HEARING
29 

or self-employment income for such year has been omitted from 

such records, correct such entry or include such omitted item 

in the Commissioner’s records, as the case may be. After the 

expiration of the time limitation following any year—

(A) the Commissioner’s records (with changes, if any, 

made pursuant to paragraph (5)) of the amounts of wages 

paid to, and self-employment income derived by, an individual during any period in such year shall be conclusive 

for the purposes of this title; 

(B) the absence of an entry in the Commissioner’s 

records as to the wages alleged to have been paid by an 

employer to an individual during any period in such year 

shall be presumptive evidence for the purposes of this title 

that no such alleged wages were paid to such individuals 

in such period; and 

(C) the absence of an entry in the Commissioner’s 

records as to the self-employment income alleged to have 

been derived by an individual in such year shall be conclusive for the purposes of this title that no such alleged selfemployment income was derived by such individual in 

such year unless it is shown that he filed a tax return of 

his self-employment income for such year before the expiration of the time limitation following such year, in which 

case the Commissioner of Social Security shall include in 

the Commissioner’s records the self-employment income of 

such individual for such year. 

(5) After the expiration of the time limitation following any 

year in which wages were paid or alleged to have been paid to, 

or self-employment income was derived or alleged to have been 

derived by, an individual, the Commissioner of Social Security 

may change or delete any entry with respect to wages or selfemployment income in the Commissioner’s records of such year 

for such individual or include in the Commissioner’s records of 

such year for such individual any omitted item of wages or 

self-employment income but only—

(A) if an application for monthly benefits or for a lumpsum death payment was filed within the time limitation 

following such year; except that no such change, deletion, 

or inclusion may be made pursuant to this subparagraph 

after a final decision upon the application for monthly benefits or lump-sum death payment; 

(B) if within the time limitation following such year an 

individual or his survivor makes a request for a change or 

deletion, or for an inclusion of an omitted item, and alleges 

in writing that the Commissioner’s records of the wages 

paid to, or the self-employment income derived by, such individual in such year are in 1 or more respects erroneous; 

except that no such change, deletion, or inclusion may be 

made pursuant to this subparagraph after a final decision 

upon such request. Written notice of the Commissioner’s 

decision on any such request shall be given to the individual who made the request; 

(C) to correct errors apparent on the face of such records; 


ycherry on PRODPC74 with HEARING
30 

(D) to transfer items to records of the Railroad Retirement Board if such items were credited under this title 

when they should have been credited under the Railroad 

Retirement Act of 1937 or 1974, or to enter items transferred by the Railroad Retirement Board which have been 

credited under the Railroad Retirement Act of 1937 or 

1974 when they should have been credited under this title; 

(E) to delete or reduce the amount of any entry which 

is erroneous as a result of fraud; 

(F) to conform his records to— (i) tax returns or portions thereof (including information returns and other written statements) filed 

with the Commissioner of Internal Revenue under 

title VIII of the Social Security Act, under subchapter 

E of chapter 1 or subchapter A of chapter 9 of the Internal Revenue Code of 1939, under chapter 2 or 21 of 

the Internal Revenue Code of 1954 or the Internal 

Revenue Code of 1986, or under regulations made 

under authority of such title, subchapter, or chapter; 

(ii) wage reports filed by a State pursuant to an 

agreement under section 218 or regulations of the 

Commissioner of Social Security thereunder; or 

(iii) assessments of amounts due under an agreement pursuant to section 218 (as in effect prior to December 31, 1986), if such assessments are made within 

the period specified in subsection (q) of such section 

(as so in effect), or allowances of credits or refunds of 

overpayments by a State under an agreement pursuant to such section; except that no amount of self-employment income of an individual for any taxable year 

(if such return or statement was filed after the expiration of the time limitation following the taxable year) 

shall be included in the Commissioner’s records pursuant to this subparagraph; 

(G) to correct errors made in the allocation, to individuals or periods, of wages or self-employment income entered in the records of the Commissioner of Social Security; 

(H) to include wages paid during any period in such year 

to an individual by an employer; 

(I) to enter items which constitute remuneration for employment under subsection (o), such entries to be in accordance with certified reports of records made by the 

Railroad Retirement Board pursuant to section 5(k)(3) of 

the Railroad Retirement Act of 1937 or section 7(b)(7) of 

the Railroad Retirement Act of 1974; or 

(J) to include self-employment income for any taxable 

year, up to, but not in excess of, the amount of wages deleted by the Commissioner of Social Security as payments 

erroneously included in such records as wages paid to such 

individual, if such income (or net earnings from self-employment), not already included in such records as self-employment income, is included in a return or statement (referred to in subparagraph (F)) filed before the expiration 


ycherry on PRODPC74 with HEARING
31 

of the time limitation following the taxable year in which 

such deletion of wages is made. 

(6) Written notice of any deletion or reduction under paragraph (4) or (5) shall be given to the individual whose record 

is involved or to his survivor, except that (A) in the case of a 

deletion or reduction with respect to any entry of wages such 

notice shall be given to such individual only if he has previously been notified by the Commissioner of Social Security of 

the amount of his wages for the period involved, and (B) such 

notice shall be given to such survivor only if he or the individual whose record is involved has previously been notified by 

the Commissioner of Social Security of the amount of such individual’s wages and self-employment income for the period involved. 

(7) Upon request in writing (within such period, after any 

change or refusal of a request for a change of the Commissioner’s records pursuant to this subsection, as the Commissioner of Social Security may prescribe), opportunity for hearing with respect to such change or refusal shall be afforded to 

any individual or his survivor. If a hearing is held pursuant to 

this paragraph the Commissioner of Social Security shall make 

findings of fact and a decision based upon the evidence adduced at such hearing and shall include any omitted items, or 

change or delete any entry, in the Commissioner’s records as 

may be required by such findings and decision. 

(8) A translation into English by a third party of a statement 

made in a foreign language by an applicant for or beneficiary 

of monthly insurance benefits under this title shall not be regarded as reliable for any purpose under this title unless the 

third party, under penalty of perjury— (A) certifies that the translation is accurate; and 

(B) discloses the nature and scope of the relationship between the third party and the applicant or recipient, as 

the case may be. 

(9) Decisions of the Commissioner of Social Security under 

this subsection shall be reviewable by commencing a civil action in the United States district court as provided in subsection (g). 

(d) ISSUANCE OF SUBPENAS IN ADMINISTRATIVE PROCEEDINGS.— For the purpose of any hearing, investigation, or other proceeding 

authorized or directed under this title, or relative to any other matter within the the Commissioner’s jurisdiction hereunder, the Commissioner of Social Security shall have power to issue subpenas requiring the attendance and testimony of witnesses and the production of any evidence that relates to any matter under investigation 

or in question before the Commissioner of Social Security. Such attendance of witnesses and production of evidence at the designated 

place of such hearing, investigation, or other proceeding may be required from any place in the United States or in any Territory or 

possession thereof. Subpenas of the Commissioner of Social Security shall be served by anyone authorized by the Commissioner (1) 

by delivering a copy thereof to the individual named therein, or (2) 

by registered mail or by certified mail addressed to such individual 

at his last dwelling place or principal place of business. A verified 


ycherry on PRODPC74 with HEARING
32 

return by the individual so serving the subpena setting forth the 

manner of service, or, in the case of service by registered mail or 

by certified mail, the return post-office receipt therefor signed by 

the individual so served, shall be proof of service. Witnesses so subpenaed shall be paid the same fees and mileage as are paid witnesses in the district courts of the United States. 

(e) JUDICIAL ENFORCEMENT OF SUBPENAS; CONTEMPT.—In case of 

contumacy by, or refusal to obey a subpena duly served upon, any 

person, any district court of the United States for the judicial district in which said person charged with contumacy or refusal to 

obey is found or resides or transacts business, upon application by 

the Commissioner of Social Security, shall have jurisdiction to issue 

an order requiring such person to appear and give testimony, or to 

appear and produce evidence, or both; any failure to obey such 

order of the court may be punished by said court as contempt 

thereof. 

(f) [Repealed] 

(g) JUDICIAL REVIEW.—Any individual, after any final decision of 

the Commissioner of Social Security made after a hearing to which 

he was a party, irrespective of the amount in controversy, may obtain a review of such decision by a civil action commenced within 

sixty days after the mailing to him of notice of such decision or 

within such further time as the Commissioner of Social Security 

may allow. Such action shall be brought in the district court of the 

United States for the judicial district in which the plaintiff resides, 

or has his principal place of business, or, if he does not reside or 

have his principal place of business within any such judicial district, in the District Court of the United States for the District of 

Columbia. As part of the Commissioner’s answer the Commissioner 

of Social Security shall file a certified copy of the transcript of the 

record including the evidence upon which the findings and decision 

complained of are based. The court shall have power to enter, upon 

the pleadings and transcript of the record, a judgment affirming, 

modifying, or reversing the decision of the Commissioner of Social 

Security, with or without remanding the cause for a rehearing. The 

findings of the Commissioner of Social Security as to any fact, if 

supported by substantial evidence, shall be conclusive, and where 

a claim has been denied by the Commissioner of Social Security or 

a decision is rendered under subsection (b) hereof which is adverse 

to an individual who was a party to the hearing before the Commissioner of Social Security, because of failure of the claimant or 

such individual to submit proof in conformity with any regulation 

prescribed under subsection (a) hereof, the court shall review only 

the question of conformity with such regulations and the validity 

of such regulations. The court may, on motion of the Commissioner 

of Social Security made for good cause shown before the Commissioner files the Commissioner’s answer, remand the case to the 

Commissioner of Social Security for further action by the Commissioner of Social Security, and it may at any time order additional 

evidence to be taken before the Commissioner of Social Security, 

but only upon a showing that there is new evidence which is material and that there is good cause for the failure to incorporate such 

evidence into the record in a prior proceeding; and the Commissioner of Social Security shall, after the case is remanded, and 


ycherry on PRODPC74 with HEARING
33 

after hearing such additional evidence if so ordered, modify or affirm the Commissioner’s findings of fact or the Commissioner’s decision, or both, and shall file with the court any such additional 

and modified findings of fact and decision, and, in any case in 

which the Commissioner has not made a decision fully favorable to 

the individual, a transcript of the additional record and testimony 

upon which the Commissioner’s action in modifying or affirming 

was based. Such additional or modified findings of fact and decision 

shall be reviewable only to the extent provided for review of the 

original findings of fact and decision. The judgment of the court 

shall be final except that it shall be subject to review in the same 

manner as a judgment in other civil actions. Any action instituted 

in accordance with this subsection shall survive notwithstanding 

any change in the person occupying the office of Commissioner of 

Social Security or any vacancy in such office. 

(h) FINALITY OF COMMISSIONER’S DECISION.—The findings and decisions of the Commissioner of Social Security after a hearing shall 

be binding upon all individuals who were parties to such hearing. 

No findings of fact or decision of the Commissioner of Social Security shall be reviewed by any person, tribunal, or governmental 

agency except as herein provided. No action against the United 

States, the Commissioner of Social Security, or any officer or employee thereof shall be brought under section 1331 or 1346 of title 

28, United States Code, to recover on any claim arising under this 

title. 

(i) CERTIFICATION FOR PAYMENT.—Upon final decision of the 

Commissioner of Social Security, or upon final judgment of any 

court of competent jurisdiction, that any person is entitled to any 

payment or payments under this title, the Commissioner of Social 

Security shall certify to the Managing Trustee the name and address of the person so entitled to receive such payment or payments, the amount of such payment or payments, and the time at 

which such payment or payments should be made, and the Managing Trustee, through the Fiscal Service of the Department of the 

Treasury, and prior to any action thereon by the General Accounting Office, shall make payment in accordance with the certification 

of the Commissioner of Social Security (except that in the case of 

(A) an individual who will have completed 10 years of service (or 

5 or more years of service, all of which accrues after December 31, 

1995) creditable under the Railroad Retirement Act of 1937 or the 

Railroad Retirement Act of 1974, (B) the wife or husband of such 

an individual, (C) any survivor of such an individual if such survivor is entitled, or could upon application become entitled, to an 

annuity under section 2 of the Railroad Retirement Act of 1974, 

and (D) any other person entitled to benefits under section 202 of 

this Act on the basis of the wages and self-employment income of 

such an individual (except a survivor of such an individual where 

such individual did not have a current connection with the railroad 

industry, as defined in the Railroad Retirement Act of 1974, at the 

time of his death), such certification shall be made to the Railroad 

Retirement Board which shall provide for such payment or payments to such person on behalf of the Managing Trustee in accordance with the provisions of the Railroad Retirement Act of 1974): 

Provided, That where a review of the Commissioner’s decision is or 


ycherry on PRODPC74 with HEARING
34 

may be sought under subsection (g) the Commissioner of Social Security may withhold certification of payment pending such review. 

The Managing Trustee shall not be held personally liable for any 

payment or payments made in accordance with a certification by 

the Commissioner of Social Security. 

(j) REPRESENTATIVE PAYEES.— (1)(A) If the Commissioner of Social Security determines that 

the interest of any individual under this title would be served 

thereby, certification of payment of such individual’s benefit 

under this title may be made, regardless of the legal competency or incompetency of the individual, either for direct 

payment to the individual, or for his or her use and benefit, to 

another individual, or an organization, with respect to whom 

the requirements of paragraph (2) have been met (hereinafter 

in this subsection referred to as the individual’s ‘‘representative payee’’). If the Commissioner of Social Security or a court 

of competent jurisdiction determines that a representative 

payee has misused any individual’s benefit paid to such representative payee pursuant to this subsection or section 807 or 

1631(a)(2), the Commissioner of Social Security shall promptly 

revoke certification for payment of benefits to such representative payee pursuant to this subsection and certify payment to 

an alternative representative payee or, if the interest of the individual under this title would be served thereby, to the individual. 

(B) In the case of an individual entitled to benefits based on 

disability, the payment of such benefits shall be made to a representative payee if the Commissioner of Social Security determines that such payment would serve the interest of the individual because the individual also has an alcoholism or drug 

addiction condition (as determined by the Commissioner) and 

the individual is incapable of managing such benefits. 

(2)(A) Any certification made under paragraph (1) for payment of benefits to an individual’s representative payee shall 

be made on the basis of—

(i) an investigation by the Commissioner of Social Security of the person to serve as representative payee, which 

shall be conducted in advance of such certification and 

shall, to the extent practicable, include a face-to-face interview with such person, and 

(ii) adequate evidence that such certification is in the interest of such individual (as determined by the Commissioner of Social Security in regulations). 

(B)(i) As part of the investigation referred to in subparagraph (A)(i), the Commissioner of Social Security shall—

(I) require the person being investigated to submit documented proof of the identity of such person, unless information establishing such identity has been submitted with 

an application for benefits under this title, title VIII, or 

title XVI, 

(II) verify such person’s social security account number 

(or employer identification number), 

(III) determine whether such person has been convicted 

of a violation of section 208, 811, or 1632, 


ycherry on PRODPC74 with HEARING
35 

(IV) obtain information concerning whether such person 

has been convicted of any other offense under Federal or 

State law which resulted in imprisonment for more than 

1 year, 

(V) obtain information concerning whether such person 

is a person described in section 202(x)(1)(A)(iv), and 

(VI) determine whether certification of payment of benefits to such person has been revoked pursuant to this subsection, the designation of such person as a representative 

payee has been revoked pursuant to section 807(a), or payment of benefits to such person has been terminated pursuant to section 1631(a)(2)(A)(iii) by reason of misuse of 

funds paid as benefits under this title, title VIII, or title 

XVI. 

(ii) The Commissioner of Social Security shall establish and 

maintain a centralized file, which shall be updated periodically 

and which shall be in a form which renders it readily retrievable by each servicing office of the Social Security Administration. Such file shall consist of— (I) a list of the names and social security account numbers (or employer identification numbers) of all persons 

with respect to whom certification of payment of benefits 

has been revoked on or after January 1, 1991, pursuant to 

this subsection, whose designation as a representative 

payee has been revoked pursuant to section 807(a), or with 

respect to whom payment of benefits has been terminated 

on or after such date pursuant to section 1631(a)(2)(A)(iii), 

by reason of misuse of funds paid as benefits under this 

title, title VIII, or title XVI, and 

(II) a list of the names and social security account numbers (or employer identification numbers) of all persons 

who have been convicted of a violation of section 208, 811, 

or 1632. 

(iii) Notwithstanding the provisions of section 552a of title 5, 

United States Code, or any other provision of Federal or State 

law (other than section 6103 of the Internal Revenue Code of 

1986 and section 1106(c) of this Act), the Commissioner shall 

furnish any Federal, State, or local law enforcement officer, 

upon the written request of the officer, with the current address, social security account number, and photograph (if applicable) of any person investigated under this paragraph, if the 

officer furnishes the Commissioner with the name of such person and such other identifying information as may reasonably 

be required by the Commissioner to establish the unique identity of such person, and notifies the Commissioner that—

(I) such person is described in section 202(x)(1)(A)(iv), 

(II) such person has information that is necessary for the 

officer to conduct the officer’s official duties, and 

(III) the location or apprehension of such person is within the officer’s official duties. 

(C)(i) Benefits of an individual may not be certified for payment to any other person pursuant to this subsection if—

(I) such person has previously been convicted as described in subparagraph (B)(i)(III), 


ycherry on PRODPC74 with HEARING
36 

(II) except as provided in clause (ii), certification of payment of benefits to such person under this subsection has 

previously been revoked as described in subparagraph 

(B)(i)(VI) the designation of such person as a representative payee has been revoked pursuant to section 807(a), or 

payment of benefits to such person pursuant to section 

1631(a)(2)(A)(ii) has previously been terminated as described in section 1631(a)(2)(B)(ii)(VI), 

(III) except as provided in clause (iii), such person is a 

creditor of such individual who provides such individual 

with goods or services for consideration, 

(IV) such person has previously been convicted as described in subparagraph (B)(i)(IV), unless the Commissioner determines that such certification would be appropriate notwithstanding such conviction, or 

(V) such person is a person described in section 

202(x)(1)(A)(iv). 

(ii) The Commissioner of Social Security shall prescribe regulations under which the Commissioner of Social Security may 

grant exemptions to any person from the provisions of clause 

(i)(II) on a case-by-case basis if such exemption is in the best 

interest of the individual whose benefits would be paid to such 

person pursuant to this subsection. 

(iii) Clause (i)(III) shall not apply with respect to any person 

who is a creditor referred to therein if such creditor is—

(I) a relative of such individual if such relative resides 

in the same household as such individual, 

(II) a legal guardian or legal representative of such individual, 

(III) a facility that is licensed or certified as a care facility under the law of a State or a political subdivision of a 

State, 

(IV) a person who is an administrator, owner, or employee of a facility referred to in subclause (III) if such individual resides in such facility, and the certification of 

payment to such facility or such person is made only after 

good faith efforts have been made by the local servicing office of the Social Security Administration to locate an alternative representative payee to whom such certification 

of payment would serve the best interests of such individual, or 

(V) an individual who is determined by the Commissioner of Social Security, on the basis of written findings 

and under procedures which the Commissioner of Social 

Security shall prescribe by regulation, to be acceptable to 

serve as a representative payee. 

(iv) The procedures referred to in clause (iii)(V) shall require 

the individual who will serve as representative payee to establish, to the satisfaction of the Commissioner of Social Security, 

that—

(I) such individual poses no risk to the beneficiary, 

(II) the financial relationship of such individual to the 

beneficiary poses no substantial conflict of interest, and 


ycherry on PRODPC74 with HEARING
37 

(III) no other more suitable representative payee can be 

found. 

(v) In the case of an individual described in paragraph (1)(B), 

when selecting such individual’s representative payee, preference shall be given to—

(I) a certified community-based nonprofit social service 

agency (as defined in paragraph (10)), 

(II) a Federal, State, or local government agency whose 

mission is to carry out income maintenance, social service, 

or health care-related activities, 

(III) a State or local government agency with fiduciary 

responsibilities, or 

(IV) a designee of an agency (other than of a Federal 

agency) referred to in the preceding subclauses of this 

clause, if the Commissioner of Social Security deems it appropriate, unless the Commissioner of Social Security determines that selection of a family member would be appropriate. 

(D)(i) Subject to clause (ii), if the Commissioner of Social Security makes a determination described in the first sentence of 

paragraph (1) with respect to any individual’s benefit and determines that direct payment of the benefit to the individual 

would cause substantial harm to the individual, the Commissioner of Social Security may defer (in the case of initial entitlement) or suspend (in the case of existing entitlement) direct 

payment of such benefit to the individual, until such time as 

the selection of a representative payee is made pursuant to 

this subsection. 

(ii)(I) Except as provided in subclause (II), any deferral or 

suspension of direct payment of a benefit pursuant to clause (i) 

shall be for a period of not more than 1 month. 

(II) Subclause (I) shall not apply in any case in which the individual is, as of the date of the Commissioner’s determination, 

legally incompetent, under the age of 15 years, or described in 

paragraph (1)(B). 

(iii) Payment pursuant to this subsection of any benefits 

which are deferred or suspended pending the selection of a representative payee shall be made to the individual or the representative payee as a single sum or over such period of time 

as the Commissioner of Social Security determines is in the 

best interest of the individual entitled to such benefits. 

(E)(i) Any individual who is dissatisfied with a determination 

by the Commissioner of Social Security to certify payment of 

such individual’s benefit to a representative payee under paragraph (1) or with the designation of a particular person to 

serve as representative payee shall be entitled to a hearing by 

the Commissioner of Social Security to the same extent as is 

provided in subsection (b), and to judicial review of the Commissioner’s final decision as is provided in subsection (g). 

(ii) In advance of the certification of payment of an individual’s benefit to a representative payee under paragraph (1), the 

Commissioner of Social Security shall provide written notice of 

the Commissioner’s initial determination to certify such payVerDate Aug 31 2005 08:24 Dec 06, 2007 Jkt 069010 PO 00000 Frm 00039 Fmt 6604 Sfmt 6601 E:\HR\OC\SR235.XXX SR235

ycherry on PRODPC74 with HEARING
38 

ment. Such notice shall be provided to such individual, except 

that, if such individual— (I) is under the age of 15, 

(II) is an unemancipated minor under the age of 18, or 

(III) is legally incompetent, then such notice shall be 

provided solely to the legal guardian or legal representative of such individual. 

(iii) Any notice described in clause (ii) shall be clearly written in language that is easily understandable to the reader, 

shall identify the person to be designated as such individual’s 

representative payee, and shall explain to the reader the right 

under clause (i) of such individual or of such individual’s legal 

guardian or legal representative— (I) to appeal a determination that a representative payee 

is necessary for such individual, 

(II) to appeal the designation of a particular person to 

serve as the representative payee of such individual, and 

(III) to review the evidence upon which such designation 

is based and submit additional evidence. 

(3)(A) In any case where payment under this title is made 

to a person other than the individual entitled to such payment, 

the Commissioner of Social Security shall establish a system of 

accountability monitoring whereby such person shall report not 

less often than annually with respect to the use of such payments. The Commissioner of Social Security shall establish and 

implement statistically valid procedures for reviewing such reports in order to identify instances in which such persons are 

not properly using such payments. 

(B) Subparagraph (A) shall not apply in any case where the 

other person to whom such payment is made is a State institution. In such cases, the Commissioner of Social Security shall 

establish a system of accountability monitoring for institutions 

in each State. 

(C) Subparagraph (A) shall not apply in any case where the 

individual entitled to such payment is a resident of a Federal 

institution and the other person to whom such payment is 

made is the institution. 

(D) Notwithstanding subparagraphs (A), (B), and (C), the 

Commissioner of Social Security may require a report at any 

time from any person receiving payments on behalf of another, 

if the Commissioner of Social Security has reason to believe 

that the person receiving such payments is misusing such payments. 

(E) In any case in which the person described in subparagraph (A) or (D) receiving payments on behalf of another fails 

to submit a report required by the Commissioner of Social Security under subparagraph (A) or (D), the Commissioner may, 

after furnishing notice to such person and the individual entitled to such payment, require that such person appear in person at a field office of the Social Security Administration serving the area in which the individual resides in order to receive 

such payments. 

(F) The Commissioner of Social Security shall maintain a 

centralized file, which shall be updated periodically and which 


ycherry on PRODPC74 with HEARING
39 

shall be in a form which will be readily retrievable by each 

servicing office of the Social Security Administration, of— (i) the address and the social security account number 

(or employer identification number) of each representative 

payee who is receiving benefit payments pursuant to this 

subsection, section 807, or section 1631(a)(2), and 

(ii) the address and social security account number of 

each individual for whom each representative payee is reported to be providing services as representative payee 

pursuant to this subsection, section 807, or section 

1631(a)(2). 

(G) Each servicing office of the Administration shall maintain a list, which shall be updated periodically, of public agencies and certified community-based nonprofit social service 

agencies (as defined in paragraph (10)) which are qualified to 

serve as representative payees pursuant to this subsection or 

section 807 or 1631(a)(2) and which are located in the area 

served by such servicing office. 

(4)(A)(i) Except as provided in the next sentence, a qualified 

organization may collect from an individual a monthly fee for 

expenses (including overhead) incurred by such organization in 

providing services performed as such individual’s representative payee pursuant to this subsection if such fee does not exceed the lesser of— (I) 10 percent of the monthly benefit involved, or 

(II) $25.00 per month ($50.00 per month in any case in 

which the individual is described in paragraph (1)(B)). A 

qualified organization may not collect a fee from an individual for any month with respect to which the Commissioner of Social Security or a court of competent jurisdiction has determined that the organization misused all or 

part of the individual’s benefit, and any amount so collected by the qualified organization for such month shall 

be treated as a misused part of the individual’s benefit for 

purposes of paragraphs (5) and (6). The Commissioner of 

Social Security shall adjust annually (after 1995) each dollar amount set forth in subclause (II) under procedures 

providing for adjustments in the same manner and to the 

same extent as adjustments are provided for under the 

procedures used to adjust benefit amounts under section 

215(i)(2)(A), except that any amount so adjusted that is not 

a multiple of $1.00 shall be rounded to the nearest multiple of $1.00. 

(ii) In the case of an individual who is no longer currently 

entitled to monthly insurance benefits under this title but to 

whom all past-due benefits have not been paid, for purposes of 

clause (i), any amount of such past-due benefits payable in any 

month shall be treated as a monthly benefit referred to in 

clause (i)(I). Any agreement providing for a fee in excess of the 

amount permitted under this subparagraph shall be void and 

shall be treated as misuse by such organization of such individual’s benefits. 

(B) For purposes of this paragraph, the term ‘‘qualified organization’’ means any State or local government agency whose 


ycherry on PRODPC74 with HEARING
40 

mission is to carry out income maintenance, social service, or 

health care-related activities, any State or local government 

agency with fiduciary responsibilities, or any certified community-based nonprofit social service agency (as defined in paragraph (10)), if such agency, in accordance with any applicable 

regulations of the Commissioner of Social Security—

(i) regularly provides services as the representative 

payee, pursuant to this subsection or section 807 or 

1631(a)(2), concurrently to 5 or more individuals, 

(ii) demonstrates to the satisfaction of the Commissioner 

of Social Security that such agency is not otherwise a creditor of any such individual. The Commissioner of Social Security shall prescribe regulations under which the Commissioner of Social Security may grant an exception from 

clause (ii) for any individual on a case-by-case basis if such 

exception is in the best interests of such individual. 

(C) Any qualified organization which knowingly charges or 

collects, directly or indirectly, any fee in excess of the maximum fee prescribed under subparagraph (A) or makes any 

agreement, directly or indirectly, to charge or collect any fee in 

excess of such maximum fee, shall be fined in accordance with 

title 18, United States Code, or imprisoned not more than 6 

months, or both. 

(5) In cases where the negligent failure of the Commissioner 

of Social Security to investigate or monitor a representative 

payee results in misuse of benefits by the representative payee, 

the Commissioner of Social Security shall certify for payment 

to the beneficiary or the beneficiary’s alternative representative payee an amount equal to such misused benefits. In any 

case in which a representative payee that—

(A) is not an individual (regardless of whether it is a 

‘‘qualified organization’’ within the meaning of paragraph 

(4)(B)); or 

(B) is an individual who, for any month during a period 

when misuse occurs, serves 15 or more individuals who are 

beneficiaries under this title, title VIII, title XVI, or any 

combination of such titles; misuses all or part of an individual’s benefit paid to such representative payee, the 

Commissioner of Social Security shall certify for payment 

to the beneficiary or the beneficiary’s alternative representative payee an amount equal to the amount of such 

benefit so misused. The provisions of this paragraph are 

subject to the limitations of paragraph (7)(B). The Commissioner of Social Security shall make a good faith effort 

to obtain restitution from the terminated representative 

payee. 

(6)(A) In addition to such other reviews of representative 

payees as the Commissioner of Social Security may otherwise 

conduct, the Commissioner shall provide for the periodic onsite 

review of any person or agency located in the United States 

that receives the benefits payable under this title (alone or in 

combination with benefits payable under title VIII or title XVI) 

to another individual pursuant to the appointment of such perVerDate Aug 31 2005 08:24 Dec 06, 2007 Jkt 069010 PO 00000 Frm 00042 Fmt 6604 Sfmt 6601 E:\HR\OC\SR235.XXX SR235

ycherry on PRODPC74 with HEARING
41 

son or agency as a representative payee under this subsection, 

section 807, or section 1631(a)(2) in any case in which— (i) the representative payee is a person who serves in 

that capacity with respect to 15 or more such individuals; 

(ii) the representative payee is a certified communitybased nonprofit social service agency (as defined in paragraph (10) of this subsection or section 1631(a)(2)(I)); or 

(iii) the representative payee is an agency (other than an 

agency described in clause (ii)) that serves in that capacity 

with respect to 50 or more such individuals. 

(B) Within 120 days after the end of each fiscal year, the 

Commissioner shall submit to the Committee on Ways and 

Means of the House of Representatives and the Committee on 

Finance of the Senate a report on the results of periodic onsite 

reviews conducted during the fiscal year pursuant to subparagraph (A) and of any other reviews of representative payees 

conducted during such fiscal year in connection with benefits 

under this title. Each such report shall describe in detail all 

problems identified in such reviews and any corrective action 

taken or planned to be taken to correct such problems, and 

shall include— (i) the number of such reviews; 

(ii) the results of such reviews; 

(iii) the number of cases in which the representative 

payee was changed and why; 

(iv) the number of cases involving the exercise of expedited, targeted oversight of the representative payee by the 

Commissioner conducted upon receipt of an allegation of 

misuse of funds, failure to pay a vendor, or a similar irregularity; 

(v) the number of cases discovered in which there was a 

misuse of funds; 

(vi) how any such cases of misuse of funds were dealt 

with by the Commissioner; 

(vii) the final disposition of such cases of misuse of 

funds, including any criminal penalties imposed; and 

(viii) such other information as the Commissioner deems 

appropriate. 

(7)(A) If the Commissioner of Social Security or a court of 

competent jurisdiction determines that a representative payee 

that is not a Federal, State, or local government agency has 

misused all or part of an individual’s benefit that was paid to 

such representative payee under this subsection, the representative payee shall be liable for the amount misused, and such 

amount (to the extent not repaid by the representative payee) 

shall be treated as an overpayment of benefits under this title 

to the representative payee for all purposes of this Act and related laws pertaining to the recovery of such overpayments. 

Subject to subparagraph (B), upon recovering all or any part 

of such amount, the Commissioner shall certify an amount 

equal to the recovered amount for payment to such individual 

or such individual’s alternative representative payee. 

(B) The total of the amount certified for payment to such individual or such individual’s alternative representative payee 


ycherry on PRODPC74 with HEARING
42 

under subparagraph (A) and the amount certified for payment 

under paragraph (5) may not exceed the total benefit amount 

misused by the representative payee with respect to such individual. 

(8) For purposes of this subsection, the term ‘‘benefit based 

on disability’’ of an individual means a disability insurance 

benefit of such individual under section 223 or a child’s, widow’s, or widower’s insurance benefit of such individual under 

section 202 based on such individual’s disability. 

(9) For purposes of this subsection, misuse of benefits by a 

representative payee occurs in any case in which the representative payee receives payment under this title for the use and 

benefit of another person and converts such payment, or any 

part thereof, to a use other than for the use and benefit of such 

other person. The Commissioner of Social Security may prescribe by regulation the meaning of the term ‘‘use and benefit’’ for purposes of this paragraph. 

(10) For purposes of this subsection, the term ‘‘certified community-based nonprofit social service agency’’ means a community-based nonprofit social service agency which is in compliance with requirements, under regulations which shall be prescribed by the Commissioner, for annual certification to the 

Commissioner that it is bonded in accordance with requirements specified by the Commissioner and that it is licensed in 

each State in which it serves as a representative payee (if licensing is available in the State) in accordance with requirements specified by the Commissioner. Any such annual certification shall include a copy of any independent audit on the 

agency which may have been performed since the previous certification. 

(k) PAYMENTS TO INCOMPETENTS.—Any payment made after December 31, 1939, under conditions set forth in subsection (j) any 

payment made before January 1, 1940, to, or on behalf of, a legally 

incompetent individual, and any payment made after December 31, 

1939, to a legally incompetent individual without knowledge by the 

Commissioner of Social Security of incompetency prior to certification of payment, if otherwise valid under this title, shall be a 

complete settlement and satisfaction of any claim, right, or interest 

in and to such payment. 

(l) DELEGATION OF POWERS AND DUTIES BY COMMISSIONER OF SOCIAL SECURITY.—The Commissioner of Social Security is authorized 

to delegate to any member, officer, or employee of the Social Security Administration designated by the Commissioner any of the 

powers conferred upon the Commissioner by this section, and is authorized to be represented by the Commissioner’s own attorneys in 

any court in any case or proceeding arising under the provisions of 

subsection (e). 

(m) [Repealed] 

(n) JOINT PAYMENTS.—The Commissioner of Social Security may, 

in the Commissioner’s discretion, certify to the Managing Trustee 

any 2 or more individuals of the same family for joint payment of 

the total benefits payable to such individuals for any month, and 

if 1 of such individuals dies before a check representing such joint 

payment is negotiated, payment of the amount of such unnegotiVerDate Aug 31 2005 08:24 Dec 06, 2007 Jkt 069010 PO 00000 Frm 00044 Fmt 6604 Sfmt 6601 E:\HR\OC\SR235.XXX SR235

ycherry on PRODPC74 with HEARING
43 

ated check to the surviving individual or individuals may be authorized in accordance with regulations of the Secretary of the 

Treasury; except that appropriate adjustment or recovery shall be 

made under section 204(a) with respect to so much of the amount 

of such check as exceeds the amount to which such surviving individual or individuals are entitled under this title for such month. 

(o) CREDITING OF COMPENSATION UNDER THE RAILROAD RETIREMENT ACT.—If there is no person who would be entitled, upon application therefor, to an annuity under section 5 of the Railroad Retirement Act of 1974, or to a lump-sum payment under section 6(b) 

of such Act, with respect to the death of an employee (as defined 

in such Act), then, notwithstanding section 210(a)(10) of this Act, 

compensation (as defined in such Railroad Retirement Act, but excluding compensation attributable as having been paid during any 

month on account of military service creditable under section 3(i) 

of such Act if wages are deemed to have been paid to such employee during such month under subsection (a) or (e) of section 217 

of this Act) of such employee shall constitute remuneration for employment for purposes of determining (A) entitlement to and the 

amount of any lump-sum death payment under this title on the 

basis of such employee’s wages and self-employment income and 

(B) entitlement to and the amount of any monthly benefit under 

this title, for the month in which such employee died or for any 

month thereafter, on the basis of such wages and self-employment 

income. For such purposes, compensation (as so defined) paid in a 

calendar year before 1978 shall, in the absence of evidence to the 

contrary, be presumed to have been paid in equal proportions with 

respect to all months in the year in which the employee rendered 

services for such compensation. 

(p) SPECIAL RULES IN CASE OF FEDERAL SERVICE.—

(1) With respect to service included as employment under 

section 210 which is performed in the employ of the United 

States or in the employ of any instrumentality which is wholly 

owned by the United States, including service, performed as a 

member of a uniformed service, to which the provisions of subsection (l)(1) of such section are applicable, and including service, performed as a volunteer or volunteer leader within the 

meaning of the Peace Corps Act, to which the provisions of section 210(o) are applicable, the Commissioner of Social Security 

shall not make determinations as to the amounts of remuneration for such service, or the periods in which or for which such 

remuneration was paid, but shall accept the determinations 

with respect thereto of the head of the appropriate Federal 

agency or instrumentality, and of such agents as such head 

may designate, as evidenced by returns filed in accordance 

with the provisions of section 3122 of the Internal Revenue 

Code of 1954 and certifications made pursuant to this subsection. Such determinations shall be final and conclusive. 

Nothing in this paragraph shall be construed to affect the 

Commissioner’s authority to determine under sections 209 and 

210 whether any such service constitutes employment, the periods of such employment, and whether remuneration paid for 

any such service constitutes wages. 


ycherry on PRODPC74 with HEARING
44 

(2) The head of any such agency or instrumentality is authorized and directed, upon written request of the Commissioner of Social Security, to make certification to the Commissioner with respect to any matter determinable for the Commissioner of Social Security by such head or his agents under 

this subsection, which the Commissioner of Social Security 

finds necessary in administering this title. 

(3) The provisions of paragraphs (1) and (2) shall be applicable in the case of service performed by a civilian employee, not 

compensated from funds appropriated by the Congress, in the 

Army and Air Force Exchange Service, Army and Air Force 

Motion Picture Service, Navy Exchanges, Marine Corps Exchanges, or other activities, conducted by an instrumentality of 

the United States subject to the jurisdiction of the Secretary of 

Defense, at installations of the Department of Defense for the 

comfort, pleasure, contentment, and mental and physical improvement of personnel of such Department; and for purposes 

of paragraphs (1) and (2) the Secretary of Defense shall be 

deemed to be the head of such instrumentality. The provisions 

of paragraphs (1) and (2) shall be applicable also in the case 

of service performed by a civilian employee, not compensated 

from funds appropriated by the Congress, in the Coast Guard 

Exchanges or other activities, conducted by an instrumentality 

of the United States subject to the jurisdiction of the Secretary 

of Transportation, at installations of the Coast Guard for the 

comfort, pleasure, contentment, and mental and physical improvement of personnel of the Coast Guard; and for purposes 

of paragraphs (1) and (2) the Secretary of Transportation shall 

be deemed to be the head of such instrumentality. 

(q) EXPEDITED BENEFIT PAYMENTS.—

(1) The Commissioner of Social Security shall establish and 

put into effect procedures under which expedited payment of 

monthly insurance benefits under this title will, subject to 

paragraph (4) of this subsection, be made as set forth in paragraphs (2) and (3) of this subsection. 

(2) In any case in which— (A) an individual makes an allegation that a monthly 

benefit under this title was due him in a particular month 

but was not paid to him, and 

(B) such individual submits a written request for the 

payment of such benefit— (i) in the case of an individual who received a regular monthly benefit in the month preceding the 

month with respect to which such allegation is made, 

not less than 30 days after the 15th day of the month 

with respect to which such allegation is made (and in 

the event that such request is submitted prior to the 

expiration of such 30-day period, it shall be deemed to 

have been submitted upon the expiration of such period), and 

(ii) in any other case, not less than 90 days after the 

later of (I) the date on which such benefit is alleged 

to have been due, or (II) the date on which such individual furnished the last information requested by the 


ycherry on PRODPC74 with HEARING
45 

Commissioner of Social Security (and such written request will be deemed to be filed on the day on which 

it was filed, or the ninetieth day after the first day on 

which the Commissioner of Social Security has evidence that such allegation is true, whichever is later), 

the Commissioner of Social Security shall, if the Commissioner finds that benefits are due, certify such benefits for payment, and payment shall be made within 

15 days immediately following the date on which the 

written request is deemed to have been filed. 

(3) In any case in which the Commissioner of Social Security 

determines that there is evidence, although additional evidence 

might be required for a final decision, that an allegation described in paragraph (2)(A) is true, the Commissioner may 

make a preliminary certification of such benefit for payment 

even though the 30-day or 90-day periods described in paragraph (2)(B)(i) and (B)(ii) have not elapsed. 

(4) Any payment made pursuant to a certification under 

paragraph (3) of this subsection shall not be considered an incorrect payment for purposes of determining the liability of the 

certifying or disbursing officer. 

(5) For purposes of this subsection, benefits payable under 

section 228 shall be treated as monthly insurance benefits payable under this title. However, this subsection shall not apply 

with respect to any benefit for which a check has been negotiated, or with respect to any benefit alleged to be due under 

either section 223, or section 202 to a wife, husband, or child 

of an individual entitled to or applying for benefits under section 223, or to a child who has attained age 18 and is under 

a disability, or to a widow or widower on the basis of being 

under a disability. 

(r) USE OF DEATH CERTIFICATES TO CORRECT PROGRAM INFORMATION.—

(1) The Commissioner of Social Security shall undertake to 

establish a program under which— (A) States (or political subdivisions thereof) voluntarily 

contract with the Commissioner of Social Security to furnish the Commissioner of Social Security periodically with 

information (in a form established by the Commissioner of 

Social Security in consultation with the States) concerning 

individuals with respect to whom death certificates (or 

equivalent documents maintained by the States or subdivisions) have been officially filed with them; and 

(B) there will be (i) a comparison of such information on 

such individuals with information on such individuals in 

the records being used in the administration of this Act, 

(ii) validation of the results of such comparisons, and (iii) 

corrections in such records to accurately reflect the status 

of such individuals. 

(2) Each State (or political subdivision thereof) which furnishes the Commissioner of Social Security with information 

on records of deaths in the State or subdivision under this subsection may be paid by the Commissioner of Social Security 

from amounts available for administration of this Act the reaVerDate Aug 31 2005 08:24 Dec 06, 2007 Jkt 069010 PO 00000 Frm 00047 Fmt 6604 Sfmt 6601 E:\HR\OC\SR235.XXX SR235

ycherry on PRODPC74 with HEARING
46 

sonable costs (established by the Commissioner of Social Security in consultations with the States) for transcribing and 

transmitting such information to the Commissioner of Social 

Security. 

(3) In the case of individuals with respect to whom federally 

funded benefits are provided by (or through) a Federal or State 

agency other than under this Act, the Commissioner of Social 

Security shall to the extent feasible provide such information 

through a cooperative arrangement with such agency, for ensuring proper payment of those benefits with respect to such 

individuals if— (A) under such arrangement the agency provides reimbursement to the Commissioner of Social Security for the 

reasonable cost of carrying out such arrangement, and 

(B) such arrangement does not conflict with the duties 

of the Commissioner of Social Security under paragraph 

(1). 

(4) The Commissioner of Social Security may enter into similar agreements with States to provide information for their use 

in programs wholly funded by the States if the requirements 

of subparagraphs (A) and (B) of paragraph (3) are met. 

(5) The Commissioner of Social Security may use or provide 

for the use of such records as may be corrected under this section, subject to such safeguards as the Commissioner of Social 

Security determines are necessary or appropriate to protect the 

information from unauthorized use or disclosure, for statistical 

and research activities conducted by Federal and State agencies. 

(6) Information furnished to the Commissioner of Social Security under this subsection may not be used for any purpose 

other than the purpose described in this subsection and is exempt from disclosure under section 552 of title 5, United States 

Code, and from the requirements of section 552a of such title. 

(7) The Commissioner of Social Security shall include information on the status of the program established under this 

section and impediments to the effective implementation of the 

program in the 1984 report required under section 704 of the 

Act. 

(8)(A) The Commissioner of Social Security shall, upon the 

request of the official responsible for a State driver’s license 

agency pursuant to the Help America Vote Act of 2002—

(i) enter into an agreement with such official for the purpose of verifying applicable information, so long as the requirements of subparagraphs (A) and (B) of paragraph (3) 

are met; and 

(ii) include in such agreement safeguards to assure the 

maintenance of the confidentiality of any applicable information disclosed and procedures to permit such agency to 

use the applicable information for the purpose of maintaining its records. 

(B) Information provided pursuant to an agreement under 

this paragraph shall be provided at such time, in such place, 

and in such manner as the Commissioner determines appropriate. 


ycherry on PRODPC74 with HEARING
47 

(C) The Commissioner shall develop methods to verify the 

accuracy of information provided by the agency with respect to 

applications for voter registration, for whom the last 4 digits 

of a social security number are provided instead of a driver’s 

license number. 

(D) For purposes of this paragraph—

(i) the term ‘‘applicable information’’ means information 

regarding whether—

(I) the name (including the first name and any family forename or surname), the date of birth (including 

the month, day, and year), and social security number 

of an individual provided to the Commissioner match 

the information contained in the Commissioner’s 

records, and 

(II) such individual is shown on the records of the 

Commissioner as being deceased; and 

(ii) the term ‘‘State driver’s license agency’’ means the 

State agency which issues driver’s licenses to individuals 

within the State and maintains records relating to such licensure. 

(E) Nothing in this paragraph may be construed to require 

the provision of applicable information with regard to a request 

for a record of an individual if the Commissioner determines 

there are exceptional circumstances warranting an exception 

(such as safety of the individual or interference with an investigation). 

(F) Applicable information provided by the Commission pursuant to an agreement under this paragraph or by an individual to any agency that has entered into an agreement under 

this paragraph shall be considered as strictly confidential and 

shall be used only for the purposes described in this paragraph 

and for carrying out an agreement under this paragraph. Any 

officer or employee or former officer or employee of a State, or 

any officer or employee or former officer or employee of a contractor of a State who, without the written authority of the 

Commissioner, publishes or communicates any applicable information in such individual’s possession by reason of such employment or position as such an officer, shall be guilty of a felony and upon conviction thereof shall be fined or imprisoned, 

or both, as described in section 208. 

(s) NOTICE REQUIREMENTS.—The Commissioner of Social Security 

shall take such actions as are necessary to ensure that any notice 

to 1 or more individuals issued pursuant to this title by the Commissioner of Social Security or by a State agency—

(1) is written in simple and clear language, and 

(2) includes the address and telephone number of the local 

office of the Social Security Administration which serves the 

recipient. In the case of any such notice which is not generated 

by a local servicing office, the requirements of paragraph (2) 

shall be treated as satisfied if such notice includes the address 

of the local office of the Social Security Administration which 

services the recipient of the notice and a telephone number 

through which such office can be reached. 


ycherry on PRODPC74 with HEARING
48 

(t) SAME-DAY PERSONAL INTERVIEWS AT FIELD OFFICES IN CASES

WHERE TIME IS OF THE ESSENCE.—In any case in which an individual visits a field office of the Social Security Administration and 

represents during the visit to an officer or employee of the Social 

Security Administration in the office that the individual’s visit is 

occasioned by— (1) the receipt of a notice from the Social Security Administration indicating a time limit for response by the individual, 

or 

(2) the theft, loss, or nonreceipt of a benefit payment under 

this title, the Commissioner of Social Security shall ensure 

that the individual is granted a face-to-face interview at the office with an officer or employee of the Social Security Administration before the close of business on the day of the visit. 

(u) REDETERMINATION OF ENTITLEMENT IN CASES OF FRAUD OR

SIMILAR FAULT.—

(1)(A) The Commissioner of Social Security shall immediately redetermine the entitlement of individuals to monthly 

insurance benefits under this title if there is reason to believe 

that fraud or similar fault was involved in the application of 

the individual for such benefits, unless a United States attorney, or equivalent State prosecutor, with jurisdiction over potential or actual related criminal cases, certifies, in writing, 

that there is a substantial risk that such action by the Commissioner of Social Security with regard to beneficiaries in a 

particular investigation would jeopardize the criminal prosecution of a person involved in a suspected fraud. 

(B) When redetermining the entitlement, or making an initial determination of entitlement, of an individual under this 

title, the Commissioner of Social Security shall disregard any 

evidence if there is reason to believe that fraud or similar fault 

was involved in the providing of such evidence. 

(2) For purposes of paragraph (1), similar fault is involved 

with respect to a determination if— (A) an incorrect or incomplete statement that is material 

to the determination is knowingly made; or 

(B) information that is material to the determination is 

knowingly concealed. 

(3) If, after redetermining pursuant to this subsection the entitlement of an individual to monthly insurance benefits, the 

Commissioner of Social Security determines that there is insufficient evidence to support such entitlement, the Commissioner 

of Social Security may terminate such entitlement and may 

treat benefits paid on the basis of such insufficient evidence as 

overpayments. 

Æ 


ycherry on PRODPC74 with HEARING