I 

109TH CONGRESS 

1ST SESSION H. R. 3501 

To require financial institutions and financial service providers to notify 

customers of the unauthorized use of personal financial information, 

and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JULY 28, 2005 

Ms. CARSON introduced the following bill; which was referred to the Committee on Energy and Commerce, and in addition to the Committees on 

Government Reform and Financial Services, for a period to be subsequently determined by the Speaker, in each case for consideration of such 

provisions as fall within the jurisdiction of the committee concerned 

A BILL 

To require financial institutions and financial service providers to notify customers of the unauthorized use of 

personal financial information, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Consumer Access 

5 Rights Defense Act (CARD) of 2005’’. 

6 SEC. 2. DEFINITIONS. 

7 In this Act, the following definitions shall apply: 
2 

•HR 3501 IH 

1 (1) AGENCY.—The term ‘‘agency’’ has the same 

2 meaning given such term in section 551(1) of title 

3 5, United States Code. 

4 (2) BREACH OF SECURITY OF THE SYSTEM.— 

5 The term ‘‘breach of security of the system’’— 

6 (A) means the compromise of the security, 

7 confidentiality, or integrity of data that results 

8 in, or there is a reasonable basis to conclude 

9 has resulted in, the unauthorized acquisition of 

10 personal information maintained by the person 

11 or business; and 

12 (B) does not include good faith acquisition 

13 of personal information by an employee or 

14 agent of the person or business for the purposes 

15 of the person or business, if the personal infor16 mation is not used or subject to further unau17 thorized disclosure. 

18 (3) PERSON.—The term ‘‘person’’ has the same 

19 meaning given such term in section 551(2) of title 

20 5, United States Code. 

21 (4) PERSONAL INFORMATION.—The term ‘‘per22 sonal information’’ means an individual’s last name 

23 in combination with any 1 or more of the following 

24 data elements: 

25 (A) Social Security number. 
3 

•HR 3501 IH 

1 (B) Driver’s license number or State iden2 tification number. 

3 (C) Account number or credit or debit card 

4 number, or, if a security code, access code, or 

5 password is required for access to an individ6 ual’s account, the account number or credit or 

7 debit card number, in combination with the re8 quired code or password. 

9 (5) SUBSTITUTE NOTICE.—The term ‘‘sub10 stitute notice’’ means— 

11 (A) conspicuous posting of the notice on 

12 the Internet site of the agency or person, if the 

13 agency or person maintains a public Internet 

14 site; and 

15 (B) notification to major print and broad16 cast media, including major media in metropoli17 tan and rural areas where the individual whose 

18 personal information was, or is reasonably be19 lieved to have been, acquired resides. The notice 

20 to media shall include a toll-free phone number 

21 where an individual can learn whether or not 

22 that individual’s personal data is included in 

23 the security breach. 

24 SEC. 3. DATABASE SECURITY. 

25 (a) DISCLOSURE OF SECURITY BREACH.— 
4 

•HR 3501 IH 

1 (1) IN GENERAL.—Any agency, or person en2 gaged in interstate commerce, that owns, licenses, or 

3 collects data, whether or not held in electronic form, 

4 containing personal information shall, following the 

5 discovery of a breach of security of the system main6 tained by the agency or person that contains such 

7 data, or upon receipt of notice under paragraph (2), 

8 notify any individual of the United States whose per9 sonal information was, or is reasonably believed to 

10 have been, acquired by an unauthorized person. 

11 (2) NOTIFICATION OF OWNER OR LICENSEE.— 

12 Any agency, or person engaged in interstate com13 merce, in possession of data, whether or not held in 

14 electronic form, containing personal information that 

15 the agency does not own or license shall notify the 

16 owner or licensee of the information if the personal 

17 information was, or is reasonably believed to have 

18 been, acquired by an unauthorized person through a 

19 breach of security of the system containing such 

20 data. 

21 (3) TIMELINESS OF NOTIFICATION.— 

22 (A) IN GENERAL.—All notifications re23 quired under paragraph (1) or (2) shall be 

24 made without unreasonable delay following— 
5 

•HR 3501 IH 

1 (i) the discovery by the agency or per2 son of a breach of security of the system; 

3 (ii) any measures necessary to deter4 mine the scope of the breach, prevent fur5 ther disclosures, and restore the reasonable 

6 integrity of the data system; and 

7 (iii) receipt of written notice that a 

8 law enforcement agency has determined 

9 that the notification will no longer seri10 ously impede its investigation, where notifi11 cation is delayed as provided in paragraph 

12 (4). 

13 (B) BURDEN OF PROOF.—The agency or 

14 person required to provide notification under 

15 this subsection shall have the burden of dem16 onstrating that all notifications were made as 

17 required under this paragraph, including evi18 dence demonstrating the necessity of any delay. 

19 (4) DELAY OF NOTIFICATION AUTHORIZED FOR

20 LAW ENFORCEMENT PURPOSES.—If a law enforce21 ment agency determines that the notification re22 quired under this subsection would seriously impede 

23 a criminal investigation, such notification may be de24 layed upon the written request of the law enforce25 ment agency. 
6 

•HR 3501 IH 

1 (5) EXCEPTION FOR NATIONAL SECURITY AND

2 LAW ENFORCEMENT.— 

3 (A) IN GENERAL.—This subsection shall 

4 not apply to an agency if the head of the agen5 cy certifies, in writing, that notification of the 

6 breach as required by this subsection reason7 ably could be expected to— 

8 (i) cause damage to the national secu9 rity; and 

10 (ii) hinder a law enforcement inves11 tigation or the ability of the agency to con12 duct law enforcement investigations. 

13 (B) LIMITS ON CERTIFICATIONS.—The 

14 head of an agency may not execute a certifi15 cation under subparagraph (A) to— 

16 (i) conceal violations of law, ineffi17 ciency, or administrative error; 

18 (ii) prevent embarrassment to a per19 son, organization, or agency; or 

20 (iii) restrain competition. 

21 (C) NOTICE.—In every case in which a 

22 head of an agency issues a certification under 

23 subparagraph (A), a copy of the certification, 

24 accompanied by a concise description of the fac-
7 

•HR 3501 IH 

1 tual basis for the certification, shall be imme2 diately provided to the Congress. 

3 (6) METHODS OF NOTICE.—An agency, or per4 son engaged in interstate commerce, shall be in com5 pliance with this subsection if it provides the indi6 vidual, with— 

7 (A) written notification; 

8 (B) e-mail notice, if the individual has con9 sented to receive such notice and the notice is 

10 consistent with the provisions permitting elec11 tronic transmission of notices under section 101 

12 of the Electronic Signatures in Global and Na13 tional Commerce Act (15 U.S.C. 7001); or 

14 (C) substitute notice, if— 

15 (i) the agency or person demonstrates 

16 that the cost of providing direct notice 

17 would exceed $500,000; 

18 (ii) the number of individuals to be 

19 notified exceeds 500,000; or 

20 (iii) the agency or person does not 

21 have sufficient contact information for 

22 those to be notified. 

23 (7) CONTENT OF NOTIFICATION.—Regardless 

24 of the method by which notice is provided to individ-
8 

•HR 3501 IH 

1 uals under paragraphs (1) and (2), such notice shall 

2 include— 

3 (A) to the extent possible, a description of 

4 the categories of information that was, or is 

5 reasonably believed to have been, acquired by 

6 an unauthorized person, including social secu7 rity numbers, driver’s license or State identi8 fication numbers and financial data; 

9 (B) a toll-free number— 

10 (i) that the individual may use to con11 tact the agency or person, or the agent of 

12 the agency or person; and 

13 (ii) from which the individual may 

14 learn— 

15 (I) what types of information the 

16 agency or person maintained about 

17 that individual or about individuals in 

18 general; and 

19 (II) whether or not the agency or 

20 person maintained information about 

21 that individual; and 

22 (C) the toll-free contact telephone numbers 

23 and addresses for the major credit reporting 

24 agencies. 
9 

•HR 3501 IH 

1 (8) COORDINATION OF NOTIFICATION WITH

2 CREDIT REPORTING AGENCIES.—If an agency or 

3 person is required to provide notification to more 

4 than 1,000 individuals under this subsection, the 

5 agency or person shall also notify, without unreason6 able delay, all consumer reporting agencies that 

7 compile and maintain files on consumers on a na8 tionwide basis (as defined in section 603(p) of the 

9 Fair Credit Reporting Act) of the timing and dis10 tribution of the notices. 

11 (b) CIVIL REMEDIES.— 

12 (1) PENALTIES.—Any agency, or person en13 gaged in interstate commerce, that violates sub14 section (a) shall be subject to a civil money penalty 

15 of— 

16 (A) not more than $1,000 per individual 

17 whose personal information was, or is reason18 ably believed to have been, acquired by an un19 authorized person; or 

20 (B) not more than $50,000 per day while 

21 the failure to give notice under subsection (a) 

22 persists. 

23 (2) EQUITABLE RELIEF.—Any agency or person 

24 that violates, proposes to violate, or has violated this 
10 

•HR 3501 IH 

1 section may be enjoined from further violations by a 

2 court of competent jurisdiction. 

3 (3) OTHER RIGHTS AND REMEDIES.—The 

4 rights and remedies available under this subsection 

5 are cumulative and shall not affect any other rights 

6 and remedies available under law. 

7 (4) DAMAGES.—Any person injured by a viola8 tion of subsection (a) may institute a civil action to 

9 recover damages arising from that violation. 

10 (c) ENFORCEMENT.—The Federal Trade Commission 

11 or other appropriate regulator, may enforce compliance 

12 with this section, including the assessment of fines under 

13 subsection (b)(1). 

14 (d) EXTENDED FRAUD ALERT.—Paragraph (1) of 

15 section 605A(b)(1) of the Fair Credit Reporting Act (15 

16 U.S.C. 1681c–1(b)(1)) is amended, in that portion of such 

17 paragraph that precedes subparagraph (A), by inserting 

18 ‘‘, or evidence that the consumer has received notice that 

19 the consumer’s personal financial information has or may 

20 have been compromised,’’ after ‘‘submits an identity theft 

21 report’’. 

22 SEC. 4. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 

23 (a) IN GENERAL.— 

24 (1) CIVIL ACTIONS.—In any case in which the 

25 attorney general of a State has reason to believe 
11 

•HR 3501 IH 

1 that an interest of the residents of that State has 

2 been or is threatened or adversely affected by the 

3 engagement of any person in a practice that is pro4 hibited under this Act, the State, as parens patriae, 

5 may bring a civil action on behalf of the residents 

6 of the State in a district court of the United States 

7 of appropriate jurisdiction or any other court of 

8 competent jurisdiction to— 

9 (A) enjoin that practice; 

10 (B) enforce compliance with this Act; 

11 (C) obtain damages, restitution, or other 

12 compensation on behalf of residents of the 

13 State; or 

14 (D) obtain such other relief as the court 

15 may consider to be appropriate. 

16 (2) NOTICE.— 

17 (A) IN GENERAL.—Before filing an action 

18 under paragraph (1), the attorney general of 

19 the State involved shall provide to the Attorney 

20 General of the United States— 

21 (i) written notice of the action; and 

22 (ii) a copy of the complaint for the ac23 tion. 

24 (B) EXEMPTION.— 
12 

•HR 3501 IH 

1 (i) IN GENERAL.—Subparagraph (A) 

2 shall not apply with respect to the filing of 

3 an action by an attorney general of a State 

4 under this subsection, if the State attorney 

5 general determines that it is not feasible to 

6 provide the notice described in such sub7 paragraph before the filing of the action. 

8 (ii) NOTIFICATION.—In an action de9 scribed in clause (i), the attorney general 

10 of a State shall provide notice and a copy 

11 of the complaint to the Attorney General 

12 at the time the State attorney general files 

13 the action. 

14 (b) CONSTRUCTION.—For purposes of bringing any 

15 civil action under subsection (a), nothing in this Act shall 

16 be construed to prevent an attorney general of a State 

17 from exercising the powers conferred on such attorney 

18 general by the laws of that State to— 

19 (1) conduct investigations; 

20 (2) administer oaths or affirmations; or 

21 (3) compel the attendance of witnesses or the 

22 production of documentary and other evidence. 

23 (c) VENUE; SERVICE OF PROCESS.— 

24 (1) VENUE.—Any action brought under sub25 section (a) may be brought in— 
13 

•HR 3501 IH 

1 (A) the district court of the United States 

2 that meets applicable requirements relating to 

3 venue under section 1391 of title 28, United 

4 States Code; or 

5 (B) another court of competent jurisdic6 tion. 

7 (2) SERVICE OF PROCESS.—In an action 

8 brought under subsection (a), process may be served 

9 in any district in which the defendant— 

10 (A) is an inhabitant; or 

11 (B) may be found. 

12 SEC. 5. EFFECT ON STATE LAW. 

13 The provisions of this Act shall supersede any incon14 sistent provisions of law of any State or unit of local gov15 ernment with respect to the conduct required by the spe16 cific provisions of this Act. 

17 SEC. 6. EFFECTIVE DATE. 

18 This Act shall take effect at the end of the 6-month 

19 period beginning on the date of the enactment of this Act. 

Æ