I 

109TH CONGRESS 

1ST SESSION H. R. 3375 

To amend the Fair Credit Reporting Act to provide for secure financial 

data, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JULY 21, 2005 

Ms. PRYCE of Ohio (for herself, Mr. CASTLE, and Mr. MOORE of Kansas) introduced the following bill; which was referred to the Committee on Financial Services 

A BILL 

To amend the Fair Credit Reporting Act to provide for 

secure financial data, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Financial Data Secu5 rity Act of 2005’’. 

6 SEC. 2. DATA SECURITY SAFEGUARDS. 

7 (a) IN GENERAL.—The Fair Credit Reporting Act 

8 (15 U.S.C. 1681) is amended by adding at the end the 

9 following new section: 
2 

•HR 3375 IH 

1 ‘‘§ 630. Data security safeguards 

2 ‘‘(a) SECURITY POLICIES AND PROCEDURES.—Each 

3 consumer reporter shall have an affirmative and con4 tinuing obligation to maintain reasonable policies and pro5 cedures to protect the security and confidentiality of sen6 sitive financial account information and sensitive financial 

7 identity information of any consumer that is maintained 

8 or received by or on behalf of such consumer reporter 

9 against any unauthorized use that is reasonably likely to 

10 result in substantial inconvenience or substantial harm to 

11 such consumer. 

12 ‘‘(b) INVESTIGATION REQUIREMENTS.— 

13 ‘‘(1) PROTECTING AGAINST IDENTITY THEFT.— 

14 ‘‘(A) INVESTIGATION REQUIRED.—If a 

15 consumer reporter is aware that a breach of 

16 data security has occurred, or is reasonably 

17 likely to have occurred, with respect to sensitive 

18 financial identity information maintained by or 

19 on behalf of the consumer reporter, the con20 sumer reporter shall conduct an investigation to 

21 determine the likelihood that such information 

22 will be misused against any consumer to whom 

23 any of such information relates in a manner 

24 that would cause substantial inconvenience or 

25 substantial harm to any such consumer. 
3 

•HR 3375 IH 

1 ‘‘(B) SCOPE OF INVESTIGATION.—An in2 vestigation conducted under subparagraph (A) 

3 shall be commensurate with the nature and the 

4 amount of the sensitive financial identity infor5 mation that is subject to the breach of data se6 curity. 

7 ‘‘(C) FACTORS TO BE CONSIDERED.—In 

8 determining the likelihood that sensitive finan9 cial identity information that was the subject of 

10 a breach of data security has been or will be 

11 misused, the consumer reporter shall consider 

12 all available relevant facts, including whether 

13 the information that was subject to the breach 

14 was unencrypted or unredacted, or required 

15 technology to use that is not generally commer16 cially available. 

17 ‘‘(2) PROTECTING AGAINST FRAUDULENT

18 TRANSACTIONS.— 

19 ‘‘(A) INVESTIGATION REQUIRED.—If a 

20 consumer reporter is aware that a breach of 

21 data security has occurred or is reasonably like22 ly to have occurred with respect to sensitive fi23 nancial account information, maintained by or 

24 on behalf of the consumer reporter, the con25 sumer reporter shall conduct an investigation to 
4 

•HR 3375 IH 

1 determine the likelihood that such information 

2 will be misused against any consumer to whom 

3 any of such information relates to make 1 or 

4 more fraudulent transactions on a financial ac5 count to which the sensitive financial account 

6 information relates in a manner that would 

7 cause substantial inconvenience or substantial 

8 harm to such consumer. 

9 ‘‘(B) SCOPE OF INVESTIGATION.—An in10 vestigation conducted under subparagraph (A) 

11 shall be commensurate with the nature and the 

12 amount of the sensitive financial account infor13 mation that is subject to the breach of data se14 curity. 

15 ‘‘(C) FACTORS TO BE CONSIDERED.—In 

16 determining the likelihood that the sensitive fi17 nancial account information that was the sub18 ject of a breach of data security has been or 

19 will be misused, the consumer reporter shall 

20 consider all available relevant facts, including 

21 whether— 

22 ‘‘(i) the information that was subject 

23 to the breach was unencrypted, 

24 unredacted, or required technology to use 
5 

•HR 3375 IH 

1 that is not generally commercially avail2 able; and 

3 ‘‘(ii) on an ongoing basis, any security 

4 programs used by, or on behalf of, the con5 sumer reporter have detected, or are likely 

6 to detect, fraudulent transactions resulting 

7 from the breach of data security. 

8 ‘‘(c) NOTICE REQUIREMENT.— 

9 ‘‘(1) NOTICE OF POTENTIAL IDENTITY THEFT

10 RISK.—In the case of any actual or reasonably likely 

11 breach of data security with respect to sensitive fi12 nancial identity information for which an investiga13 tion is required under subsection (b)(1)(A), unless 

14 the consumer reporter determines (after conducting 

15 a reasonable investigation that meets the require16 ments of such subsection) that it is not reasonably 

17 likely that such information will be misused to com18 mit financial fraud against any consumer to whom 

19 such sensitive financial identity information relates 

20 in a manner that would cause substantial inconven21 ience or substantial harm to such consumer, the con22 sumer reporter shall provide notice, in the manner 

23 provided in subsection (e), to— 

24 ‘‘(A) any appropriate law enforcement 

25 agency; 
6 

•HR 3375 IH 

1 ‘‘(B) the appropriate functional regulatory 

2 agency for the consumer reporter; 

3 ‘‘(C) if the information relates to a finan4 cial account provided to, maintained for, or 

5 serviced for any consumer by a person other 

6 than the consumer reporter, the person that 

7 provides, maintains, or services the financial ac8 count for the consumer; 

9 ‘‘(D) if the consumer reporter determines 

10 that it is likely to be providing notice under this 

11 paragraph to 1,000 or more consumers for any 

12 breach of data security— 

13 ‘‘(i) each nationwide consumer report14 ing agency; and 

15 ‘‘(ii) any other consumer reporting 

16 agency that the consumer reporter identi17 fies, or expects to identify, in the notice 

18 provided to the consumer under subpara19 graph (E); 

20 ‘‘(E) any consumer to whom the sensitive 

21 financial identity information relates; and 

22 ‘‘(F) if the sensitive financial identity in23 formation concerning any consumer is provided 

24 to, maintained by, or serviced by a person other 

25 than the consumer reporter, that person. 
7 

•HR 3375 IH 

1 ‘‘(2) NOTICE OF POTENTIAL FRAUDULENT

2 TRANSACTION RISK.—In the case of any actual or 

3 reasonably likely breach of data security with respect 

4 to sensitive financial account information for which 

5 an investigation is required under subsection 

6 (b)(2)(A), unless the consumer reporter determines 

7 (after conducting a reasonable investigation that 

8 meets the requirements of such subparagraph) that 

9 it is not reasonably likely that such information will 

10 be misused against the consumers to whom such 

11 sensitive financial account information relates to 

12 make 1 or more fraudulent transactions on a finan13 cial account to which such information relates in a 

14 manner that would cause substantial inconvenience 

15 or substantial harm to any such consumer, the con16 sumer reporter shall provide notice, in the manner 

17 provided in subsection (e), to— 

18 ‘‘(A) an appropriate law enforcement agen19 cy; 

20 ‘‘(B) the appropriate functional regulatory 

21 agency for the consumer reporter; 

22 ‘‘(C) if the information relates to a finan23 cial account provided to, maintained for, or 

24 serviced for any consumer by a person other 

25 than the consumer reporter, the person that 
8 

•HR 3375 IH 

1 provides, maintains, or services the financial ac2 count for the consumer; and 

3 ‘‘(D) subject to subsections (d)(2) and (e), 

4 any consumer to whom the sensitive financial 

5 account information relates. 

6 ‘‘(d) INVESTIGATION AND NOTICE REQUIREMENTS

7 FOR THIRD PARTY AGREEMENTS.— 

8 ‘‘(1) CONTRACTUAL OBLIGATION REQUIRED.— 

9 No consumer reporter may provide sensitive finan10 cial identity information or sensitive financial ac11 count information to a third party to receive, main12 tain, or service on behalf of the consumer reporter, 

13 unless such third party agrees that whenever the 

14 third party becomes aware that a breach of data se15 curity has occurred or is reasonably likely to have 

16 occurred with respect to such information received, 

17 maintained, or serviced by such third party, the 

18 third party shall be obligated— 

19 ‘‘(A) to provide notice of the breach to the 

20 consumer reporter; 

21 ‘‘(B) to conduct a joint investigation with 

22 the consumer reporter to determine the likeli23 hood that such information will be misused 

24 against the consumers to whom the information 

25 relates in a manner that would cause substan-
9 

•HR 3375 IH 

1 tial inconvenience or substantial harm to any 

2 such consumers; and 

3 ‘‘(C) unless the consumer reporter and 

4 third party determine, after conducting a rea5 sonable investigation, that it is not reasonably 

6 likely that such information will be misused to 

7 commit financial fraud against any consumer to 

8 whom any of such sensitive personal informa9 tion relates in a manner that would cause sub10 stantial inconvenience or substantial harm to 

11 such consumer, to provide joint notice with the 

12 consumer reporter under paragraph (2). 

13 ‘‘(2) JOINT NOTICE REQUIREMENT UNDER CER14 TAIN CIRCUMSTANCES.—In the case of any breach of 

15 data security involving a third party referred to in 

16 paragraph (1) for which a notice is required to be 

17 provided by a consumer reporter to a consumer 

18 under subsection (c)— 

19 ‘‘(A) both the consumer reporter and any 

20 person that provides or maintains the financial 

21 account for the consumer shall be responsible 

22 for providing the notice under such subsection 

23 to the consumer jointly; 

24 ‘‘(B) the notice shall— 
10 

•HR 3375 IH 

1 ‘‘(i) clearly indicate on its face (such 

2 as the envelope for mailed notices) the 

3 identity of a person or consumer reporter 

4 that has the direct relationship with the 

5 consumer; and 

6 ‘‘(ii) clearly identify the consumer re7 porter that directly suffered the breach of 

8 data security and indicate the notice is 

9 being provided to the consumer on account 

10 of such breach; and 

11 ‘‘(C) the consumer reporter shall be re12 sponsible for the reasonable actual costs of such 

13 notice, except as otherwise established by agree14 ment. 

15 ‘‘(e) TIME AND MANNER OF NOTICES.— 

16 ‘‘(1) PROMPT NOTICE REQUIRED.—Except as 

17 provided in paragraph (2), any notice required under 

18 subsection (c), including any joint notice in accord19 ance with subsection (d)(2)(A), shall be made 

20 promptly following completion of reasonable meas21 ures undertaken to determine the scope of the 

22 breach of data security. 

23 ‘‘(2) DELAY OF NOTICE FOR LAW ENFORCE24 MENT PURPOSES.—If a consumer reporter receives a 

25 written request from an appropriate law enforcement 
11 

•HR 3375 IH 

1 agency that is approved by a court of competent ju2 risdiction indicating that providing a particular no3 tice to any consumer under this section would im4 pede a criminal or civil investigation by that law en5 forcement agency, or an oral request from an appro6 priate law enforcement agency indicating that such 

7 a written request will be provided, the consumer re8 porter shall delay, or in the case of a foreign law en9 forcement agency may delay, providing such notice 

10 until— 

11 ‘‘(A) the law enforcement agency informs 

12 the consumer reporter that such notice will no 

13 longer impede the investigation; or 

14 ‘‘(B) the law enforcement agency fails to— 

15 ‘‘(i) confirm that a continued delay is 

16 necessary to avoid impeding such investiga17 tion; or 

18 ‘‘(ii) provide a written request within 

19 a reasonable time following an oral request 

20 for such delay. 

21 ‘‘(3) ORDER OF NOTICE.—The notices required 

22 under subsection (c), including any joint notice in 

23 accordance with subsection (d)(2)(A), shall be made 

24 in the order of the subparagraphs in paragraph (1) 

25 or (2) of subsection (c), as the case may be. 
12 

•HR 3375 IH 

1 ‘‘(4) CONTENT OF CONSUMER NOTICE.—Any 

2 notice required to be provided to a consumer under 

3 paragraph (1) or (2) of subsection (c), including any 

4 joint notice in accordance with subsection (d)(2)(A), 

5 shall include— 

6 ‘‘(A) a clear and conspicuous heading or 

7 notice title on the envelope or transmission title 

8 indicating the nature of the notice, such as 

9 ‘LEGAL NOTICE OF DATA SECURITY 

10 BREACH’; 

11 ‘‘(B) a brief description of the breach of 

12 data security, including a statement of the 

13 types of sensitive financial account and sensitive 

14 financial identity information involved in such 

15 breach; 

16 ‘‘(C) appropriate instructions to the con17 sumer to mitigate against financial fraud; and 

18 ‘‘(D) appropriate contact information that 

19 the consumer may use to obtain additional in20 formation. 

21 ‘‘(5) NO DUPLICATIVE NOTICES REQUIRED.—A 

22 consumer reporter, whether acting directly or jointly 

23 with a third party under subsection (d), shall not be 

24 required to provide more than 1 notice with respect 

25 to any breach of data security to any affected con-
13 

•HR 3375 IH 

1 sumer, so long as such notice meets all the applica2 ble requirements of this section. 

3 ‘‘(f) FINANCIAL FRAUD MITIGATION.— 

4 ‘‘(1) FREE FILE MONITORING.—Any consumer 

5 reporter that is required to provide notice to a con6 sumer under subsection (c)(1), or that is deemed to 

7 be in compliance with such requirement by operation 

8 of subsection (g), shall offer and make available to 

9 the consumer, free of charge, a service that monitors 

10 nationwide credit activity regarding a consumer from 

11 a consumer reporting agency described in section 

12 603(p). 

13 ‘‘(2) JOINT RULEMAKING FOR SAFE HARBOR.— 

14 The Secretary of the Treasury, the Board of Gov15 ernors of the Federal Reserve System, and the Com16 mission shall jointly develop regulations, which shall 

17 be prescribed by all functional regulatory agencies, 

18 that, in any case in which— 

19 ‘‘(A) free file monitoring is offered under 

20 paragraph (1) to a consumer; 

21 ‘‘(B) subsequent to the offer, another 

22 party misuses sensitive financial identity infor23 mation on the consumer obtained through the 

24 breach of data security (that gave rise to such 
14 

•HR 3375 IH 

1 offer) to commit identity theft against the con2 sumer; and 

3 ‘‘(C) at the time of such breach the con4 sumer reporter maintained reasonable policies 

5 and procedures to comply with subsection (a), 

6 exempts the consumer reporter from any liability 

7 under State common law for any loss or harm to the 

8 consumer occurring after the date of such offer, 

9 other than any direct pecuniary loss provided under 

10 such law, resulting from such misuse. 

11 ‘‘(g) COMPLIANCE WITH GLBA.— 

12 ‘‘(1) IN GENERAL.—For the purposes of this 

13 section, any person subject to section 501(b) of title 

14 V of the Gramm-Leach-Bliley Act shall be deemed to 

15 be in compliance with— 

16 ‘‘(A) subsection (a) of this section, if the 

17 person is required to implement appropriate 

18 safeguards pursuant to regulations, guidelines, 

19 or guidance prescribed by or issued by an agen20 cy or authority in accordance with such sub21 section of the Gramm-Leach-Bliley Act; 

22 ‘‘(B) subsection (b) of this section, if the 

23 person is required to conduct investigations of 

24 breaches of information security pursuant to 

25 regulations, guidelines, or guidance prescribed 
15 

•HR 3375 IH 

1 by or issued by an agency or authority in ac2 cordance with such subsection of the Gramm3 Leach-Bliley Act; and 

4 ‘‘(C) subsection (c) of this section, if the 

5 person is required to implement a consumer no6 tification program after breaches of such data 

7 safeguards pursuant to regulations, guidelines, 

8 or guidance prescribed by or issued by an agen9 cy or authority in accordance with section 501 

10 of the Gramm-Leach-Bliley Act. 

11 ‘‘(2) RECIPROCAL COMPLIANCE ARRANGE12 MENTS.—If, with respect to any person, or any 

13 agent of a person, who is subject to section 501(b) 

14 of the Gramm-Leach-Bliley Act, the regulations, 

15 guidelines, or guidance prescribed or issued pursu16 ant to such section by the agencies or authorities de17 scribed in section 509 of the Gramm-Leach-Bliley 

18 Act, allow— 

19 ‘‘(A) any requirement that such person 

20 comply with such section to be satisfied by the 

21 person’s agent; or 

22 ‘‘(B) any requirement that a person’s 

23 agent comply with such section to be satisfied 

24 by the person, 
16 

•HR 3375 IH 

1 such reciprocal compliance treatment for such per2 son and agent shall also apply under subsections (a), 

3 (b), and (c) of this section in the same manner and 

4 to the same extent such treatment applies for pur5 poses of such section 501(b), except as otherwise 

6 provided by any such agency or authority. 

7 ‘‘(h) UNIFORM SECURITY REGULATIONS.— 

8 ‘‘(1) UNIFORM STANDARDS.—The Secretary of 

9 the Treasury, the Board of Governors of the Federal 

10 Reserve System, and the Commission shall jointly— 

11 ‘‘(A) develop appropriate standards and 

12 guidelines in furtherance of the policy of this 

13 section; and 

14 ‘‘(B) prescribe regulations requiring each 

15 consumer reporter to establish reasonable poli16 cies and procedures implementing such stand17 ards and guidelines, consistent, as appropriate, 

18 with section 501(b) of title V of the Gramm19 Leach-Bliley Act. 

20 ‘‘(2) ENFORCEMENT REGULATIONS.—Each of 

21 the functional regulatory agencies shall prescribe 

22 such regulations as may be necessary, consistent 

23 with the standards in paragraph (1), to carry out 

24 the purposes of this section with respect to the per-
17 

•HR 3375 IH 

1 sons subject to the jurisdiction of such agency under 

2 subsection (i). 

3 ‘‘(3) PROCEDURES AND DEADLINE.— 

4 ‘‘(A) PROCEDURES.—Regulations pre5 scribed under this subsection shall be prescribed 

6 in accordance with applicable requirements of 

7 title 5, United States Code. 

8 ‘‘(B) DEADLINE FOR INITIAL REGULA9 TIONS.—The regulations required to be pre10 scribed under paragraph (1) shall be published 

11 in final form before the end of the 12-month 

12 period beginning on the date of the enactment 

13 of the Financial Data Security Act of 2005. 

14 ‘‘(C) DEADLINE FOR ENFORCEMENT REG15 ULATIONS.—The regulations required to be pre16 scribed under paragraph (2) shall be published 

17 in final form before the end of the 6-month pe18 riod beginning on the date regulations described 

19 in subparagraph (B) are published in final 

20 form. 

21 ‘‘(D) AUTHORITY TO GRANT EXCEP22 TIONS.—The regulations prescribed under para23 graph (2) may include such additional excep24 tions to this section as are deemed by the func-
18 

•HR 3375 IH 

1 tional regulatory agencies to be consistent with 

2 the purposes of this section. 

3 ‘‘(E) CONSULTATION AND COORDINA4 TION.—The Secretary of the Treasury, the 

5 Board of Governors of the Federal Reserve Sys6 tem, and the Commission shall consult and co7 ordinate with the other functional regulatory 

8 agencies to the extent appropriate in pre9 scribing regulations under this subsection. 

10 ‘‘(4) APPROPRIATE EXEMPTIONS.—The Sec11 retary of the Treasury, the Board, and the Commis12 sion, in consultation with the Administrator of the 

13 Small Business Administration, shall provide appro14 priate exemptions from requirements of this section 

15 relating to sensitive financial identity information 

16 for consumer reporter collectors that are small busi17 nesses. 

18 ‘‘(i) ADMINISTRATIVE ENFORCEMENT.—Notwith19 standing section 616, 617, or 621, this section and the 

20 regulations prescribed under this section shall be enforced 

21 exclusively by the functional regulatory agencies with re22 spect to financial institutions and other persons subject 

23 to jurisdiction of each such agency under applicable law, 

24 as follows: 
19 

•HR 3375 IH 

1 ‘‘(1) Under section 8 of the Federal Deposit In2 surance Act, in the case of— 

3 ‘‘(A) national banks, Federal branches and 

4 Federal agencies of foreign banks, and any sub5 sidiaries of such entities (except brokers, deal6 ers, persons providing insurance, investment 

7 companies, and investment advisers), by the 

8 Comptroller of the Currency; 

9 ‘‘(B) member banks of the Federal Reserve 

10 System (other than national banks), branches 

11 and agencies of foreign banks (other than Fed12 eral branches, Federal agencies, and insured 

13 State branches of foreign banks), commercial 

14 lending companies owned or controlled by for15 eign banks, organizations operating under sec16 tion 25 or 25A of the Federal Reserve Act, and 

17 bank holding companies and their nonbank sub18 sidiaries or affiliates (except brokers, dealers, 

19 persons providing insurance, investment compa20 nies, and investment advisers), by the Board of 

21 Governors of the Federal Reserve System; 

22 ‘‘(C) banks insured by the Federal Deposit 

23 Insurance Corporation (other than members of 

24 the Federal Reserve System), insured State 

25 branches of foreign banks, and any subsidiaries 
20 

•HR 3375 IH 

1 of such entities (except brokers, dealers, per2 sons providing insurance, investment compa3 nies, and investment advisers), by the Board of 

4 Directors of the Federal Deposit Insurance Cor5 poration; and 

6 ‘‘(D) savings associations the deposits of 

7 which are insured by the Federal Deposit In8 surance Corporation, and any subsidiaries of 

9 such savings associations (except brokers, deal10 ers, persons providing insurance, investment 

11 companies, and investment advisers), by the Di12 rector of the Office of Thrift Supervision. 

13 ‘‘(2) Under the Federal Credit Union Act, by 

14 the Board of the National Credit Union Administra15 tion with respect to any federally insured credit 

16 union, and any subsidiaries of such an entity. 

17 ‘‘(3) Under the Securities Exchange Act of 

18 1934, by the Securities and Exchange Commission 

19 with respect to any broker or dealer. 

20 ‘‘(4) Under the Investment Company Act of 

21 1940, by the Securities and Exchange Commission 

22 with respect to investment companies. 

23 ‘‘(5) Under the Investment Advisers Act of 

24 1940, by the Securities and Exchange Commission 
21 

•HR 3375 IH 

1 with respect to investment advisers registered with 

2 the Commission under such Act. 

3 ‘‘(6) Under State insurance law, in the case of 

4 any person engaged in the business of insurance, by 

5 the applicable State insurance authority of the State 

6 in which the person is domiciled. 

7 ‘‘(7) Under the Federal Trade Commission Act, 

8 by the Federal Trade Commission for any other per9 son that is not subject to the jurisdiction of any 

10 agency or authority under paragraphs (1) through 

11 (6) of this subsection. 

12 ‘‘(j) DEFINITIONS.—For purposes of this section, the 

13 following definitions shall apply: 

14 ‘‘(1) BREACH OF DATA SECURITY.—The term 

15 ‘breach of data security’ means, with respect to sen16 sitive financial account information or sensitive fi17 nancial identity information that is maintained, re18 ceived, serviced, or communicated by or on behalf of 

19 any financial institution— 

20 ‘‘(A) an unauthorized acquisition of such 

21 information that could be used to commit finan22 cial fraud (such as identity theft or fraudulent 

23 transactions made on financial accounts); or 

24 ‘‘(B) an unusual pattern of misuse of such 

25 information to commit financial fraud. 
22 

•HR 3375 IH 

1 ‘‘(2) CONSUMER REPORTER AND RELATED

2 TERMS.— 

3 ‘‘(A) CONSUMER REPORT.—The term ‘con4 sumer report’ includes any written, oral, or 

5 other communication of any information by a 

6 consumer reporter bearing on a consumer’s 

7 credit worthiness, credit standing, credit capac8 ity, character, general reputation, personal 

9 characteristics, personal identifiers, financial 

10 account information, or mode of living. 

11 ‘‘(B) CONSUMER REPORTING BROKER.— 

12 The term ‘consumer reporting broker’ means 

13 any person which, for monetary fees, dues, or 

14 on a cooperative nonprofit basis, regularly en15 gages in whole or in part in the practice of as16 sembling or evaluating consumer credit infor17 mation or other information on consumers for 

18 the purpose of furnishing consumer reports to 

19 third parties, and which uses any means or fa20 cility of interstate commerce for the purpose of 

21 preparing or furnishing consumer reports. 

22 ‘‘(C) CONSUMER REPORTING COL23 LECTOR.—The term ‘consumer reporting col24 lector’ means any person (other than a con25 sumer reporting agency or a consumer report-
23 

•HR 3375 IH 

1 ing broker) which, for monetary fees, dues, or 

2 on a cooperative nonprofit basis, or otherwise, 

3 regularly engages in whole or in part in the 

4 practice of assembling or evaluating consumer 

5 reports or other information on consumers to 

6 provide or market or collect payment for prod7 ucts or services, and which uses any means or 

8 facility of interstate commerce for the purpose 

9 of preparing or using consumer reports. 

10 ‘‘(D) CONSUMER REPORTER.—The term 

11 ‘consumer reporter’ means any consumer re12 porting agency, consumer reporting broker, or 

13 consumer reporting collector. 

14 ‘‘(3) FINANCIAL INSTITUTION.—The term ‘fi15 nancial institution’ means any consumer reporter 

16 who maintains, receives, services, or communicates 

17 sensitive financial account information or sensitive 

18 financial identity information on an ongoing basis 

19 for the purposes of engaging in interstate commerce. 

20 ‘‘(4) FUNCTIONAL REGULATORY AGENCY.—The 

21 term ‘functional regulatory agency’ means any agen22 cy described in subsection (i) with respect to the fi23 nancial institutions and other persons subject to the 

24 jurisdiction of such agency. 
24 

•HR 3375 IH 

1 ‘‘(5) NATIONWIDE CONSUMER REPORTING

2 AGENCY.—The term ‘nationwide consumer reporting 

3 agency’ means— 

4 ‘‘(A) a consumer reporting agency de5 scribed in section 603(p); 

6 ‘‘(B) any person who notifies the Commis7 sion that the person reasonably expects to be8 come a consumer reporting agency described in 

9 subsection (p) of section 603 within a reason10 able time; and 

11 ‘‘(C) a consumer reporting agency de12 scribed in section 603(w) that notifies the Com13 mission that the person wishes to receive breach 

14 of data security notices under this section that 

15 involve information of the type maintained by 

16 such agency. 

17 ‘‘(6) SENSITIVE FINANCIAL ACCOUNT INFORMA18 TION.—The term ‘sensitive financial account infor19 mation’ means a financial account number of a con20 sumer, such as credit card number or debit card 

21 number, in combination with any security code, ac22 cess code, password, or other personal identification 

23 information that would allow access to the con24 sumer’s financial account. 
25 

•HR 3375 IH 

1 ‘‘(7) SENSITIVE FINANCIAL IDENTITY INFORMA2 TION.—The term ‘sensitive financial identity infor3 mation’ means the first and last name, the address, 

4 or the telephone number of a consumer, in combina5 tion with any of the following of the consumer: 

6 ‘‘(A) Social Security number. 

7 ‘‘(B) Driver’s license number or equivalent 

8 State identification number. 

9 ‘‘(C) Taxpayer identification number.’’. 

10 (b) CLERICAL AMENDMENT.—The table of sections 

11 for the Fair Credit Reporting Act is amended by inserting 

12 after the item relating to section 629 the following new 

13 item: 

‘‘630. Data security safeguards.’’. 

14 (c) EFFECTIVE DATE.—The provisions of section 630 

15 of the Fair Credit Reporting Act (as added by this sec16 tion), other than subsection (h) of such section, shall take 

17 effect on the earlier of— 

18 (1) the date of publication of the regulations re19 quired under paragraph (3) of such subsection, with 

20 respect to any person under the jurisdiction of each 

21 regulatory agency publishing such regulations; or 

22 (2) the end of the 24-month period beginning 

23 on the date of the enactment of this Act. 
26 

•HR 3375 IH 

1 SEC. 3. RELATION TO STATE LAWS. 

2 Subsection (b) of section 625 of the Fair Credit Re3 porting Act (15 U.S.C. 1681t) is amended— 

4 (1) by redesignating paragraphs (3), (4), and 

5 (5) as paragraphs (4), (5), and (6), respectively; and 

6 (2) by inserting after paragraph (2) the fol7 lowing new paragraph: 

8 ‘‘(3) with respect to the responsibilities of any 

9 person— 

10 ‘‘(A) to protect the security or confiden11 tiality of information on consumers maintained 

12 by or on behalf of the person; 

13 ‘‘(B) to safeguard such information from 

14 potential misuse; 

15 ‘‘(C) to investigate and provide notices to 

16 consumers of any unauthorized access to infor17 mation concerning the consumer, or the poten18 tial misuse of such information, for fraudulent 

19 purposes; and 

20 ‘‘(D) to mitigate any loss or harm result21 ing from such unauthorized access or misuse.’’. 

Æ