II 

109TH CONGRESS 

2D SESSION S. 3486 

To protect the privacy of veterans, spouses of veterans, and other persons 

affected by the security breach at the Department of Veterans Affairs 

on May 3, 2006, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JUNE 8, 2006 

Mr. REID (for Mr. ROCKEFELLER (for himself, Mr. JEFFORDS, Mr. BAUCUS, 

Mr. LEAHY, and Ms. STABENOW)) introduced the following bill; which 

was read twice and referred to the Committee on Banking, Housing, and 

Urban Affairs 

A BILL 

To protect the privacy of veterans, spouses of veterans, and 

other persons affected by the security breach at the 

Department of Veterans Affairs on May 3, 2006, and 

for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Veterans and Military 

5 Privacy Protection Act of 2006’’. 


sroberts on PROD1PC70 with BILLS
2 

•S 3486 IS

1 SEC. 2. FEDERAL TRADE COMMISSION PROGRAM FOR VET2 ERANS, SPOUSES OF VETERANS, AND OTHERS 

3 AT RISK OF IDENTITY THEFT. 

4 (a) PROGRAM REQUIRED.—The Federal Trade Com5 mission shall, in consultation with the Secretary of Vet6 erans Affairs, develop and implement a program to pro7 vide financial counseling and support to any veteran, 

8 spouse, or other person described in subsection (e). 

9 (b) ACCESS.—The program required by subsection 

10 (a) shall be accessible through a toll-free telephone num11 ber (commonly referred to as an ‘‘800 number’’) estab12 lished and operated by the Federal Trade Commission for 

13 purposes of the program. 

14 (c) ELEMENTS.—Under the program required by 

15 subsection (a), the Federal Trade Commission shall— 

16 (1) provide to veterans, spouses, and other per17 sons described in subsection (e) such financial and 

18 other counseling as the Commission considers appro19 priate relating to identity theft and the theft of data 

20 as described in that subsection; and 

21 (2) upon request of any veteran, spouse, or 

22 other person described in subsection (e), assist such 

23 individual in securing the placement of an extended 

24 fraud alert or credit security freeze under sections 

25 605A(b)(3) and 605C of the Fair Credit Reporting 

26 Act, as added by this Act, respectively. 


sroberts on PROD1PC70 with BILLS
3 

•S 3486 IS

1 (d) PERSONS NOT SUBJECT TO IDENTITY THEFT.— 

2 (1) NOTICE TO FTC OF IDENTIFICATION OF

3 VETERANS OR OTHERS NOT SUBJECT TO IDENTITY

4 THEFT.—Upon conclusively identifying any veteran, 

5 spouse, or other person described in subsection (e) 

6 as not being at risk of identity theft as a result of 

7 the security breach at the Department of Veterans 

8 Affairs on May 3, 2006, the Secretary shall imme9 diately notify the Federal Trade Commission of such 

10 identification. 

11 (2) NOTICE TO VETERANS AND OTHERS.—The 

12 program required by subsection (a) shall include 

13 mechanisms to ensure that any veteran, spouse, or 

14 other person who seeks counseling and support 

15 under the program after receipt by the Commission 

16 of notice under paragraph (1) covering such veteran 

17 is informed that such veteran or person is no longer 

18 subject to identity theft as a result of the security 

19 breach at the Department of Veterans Affairs on 

20 May 3, 2006. 

21 (e) APPLICABILITY.—This section shall apply with re22 spect to— 

23 (1) any veteran, as defined in section 101 of 

24 title 38, United States Code, who may be a victim 


sroberts on PROD1PC70 with BILLS
4 

•S 3486 IS

1 of identity theft as a result of the security breach at 

2 the Department of Veterans Affairs on May 3, 2006; 

3 (2) any spouse (or former spouse) of such vet4 eran who the Secretary of Veterans Affairs has con5 clusively identified as being at risk of identity theft 

6 as a result of that security breach; and 

7 (3) any other person who the Secretary of Vet8 erans Affairs has conclusively identified as being at 

9 risk of identity theft as a result of that security 

10 breach. 

11 SEC. 3. EXTENDED CONSUMER CREDIT FRAUD ALERTS AND 

12 SECURITY FREEZES FOR VETERANS AND 

13 OTHER PERSONS AFFECTED BY SECURITY 

14 BREACH. 

15 (a) AUTOMATIC FRAUD ALERTS.—Section 605A(b) 

16 of the Fair Credit Reporting Act (15 U.S.C. 1681c–1(b)) 

17 is amended by adding at the end the following: 

18 ‘‘(3) AUTOMATIC EXTENDED FRAUD ALERTS

19 FOR CERTAIN VETERANS AND OTHERS AFFECTED BY

20 SECURITY BREACH.— 

21 ‘‘(A) IN GENERAL.—Upon the direct re22 quest of a veteran, spouse, or other person de23 scribed in subparagraph (D), each consumer re24 porting agency described in section 603(p)(1) 

25 that maintains a file on that individual shall 


sroberts on PROD1PC70 with BILLS
5 

•S 3486 IS

1 take the actions specified in subparagraphs (A) 

2 through (C) of paragraph (1) with respect to 

3 that individual. 

4 ‘‘(B) AUTOMATIC ALERTS.—Notwith5 standing the requirements of paragraph (1), a 

6 veteran, spouse, or other person described in 

7 subparagraph (D) is not required to submit any 

8 identity theft report, proof of identity, or other 

9 documentation with respect to an extended 

10 fraud alert required by subparagraph (A). 

11 ‘‘(C) VETERANS AND OTHERS NOT SUB12 JECT TO IDENTITY THEFT.—Upon conclusively 

13 identifying any veteran, spouse, or other person 

14 described in subparagraph (D) as not being at 

15 risk of identity theft as a result of the security 

16 breach described in subparagraph (A)— 

17 ‘‘(i) the Secretary of Veterans Affairs 

18 shall immediately notify each consumer re19 porting agency and the veteran, spouse, or 

20 other person involved that such individual 

21 is no longer subject to identity theft as a 

22 result of the security breach described in 

23 subparagraph (A); and 

24 ‘‘(ii) the requirements of subpara25 graph (A) shall no longer apply with reVerDate Aug 31 2005 19:04 Jun 11, 2006 Jkt 049200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S3486.IS S3486

sroberts on PROD1PC70 with BILLS
6 

•S 3486 IS

1 spect to any such veteran, spouse, or other 

2 person, as of the date of such notification. 

3 ‘‘(D) APPLICABILITY.—This paragraph 

4 shall apply to— 

5 ‘‘(i) any veteran, as defined in section 

6 101 of title 38, United States Code, who 

7 may be a victim of identity theft as a re8 sult of the security breach at the Depart9 ment of Veterans Affairs on May 3, 2006; 

10 ‘‘(ii) any spouse (or former spouse) of 

11 such veteran who the Secretary of Vet12 erans Affairs has conclusively identified as 

13 being at risk of identity theft as a result 

14 of that security breach; and 

15 ‘‘(iii) any other person who the Sec16 retary of Veterans Affairs has conclusively 

17 identified as being at risk of identity theft 

18 as a result of that security breach.’’. 

19 (b) SECURITY FREEZES FOR VETERANS.—The Fair 

20 Credit Reporting Act (15 U.S.C. 1681 et seq.) is amended 

21 by inserting after section 605B the following: 

22 ‘‘SEC. 605C. SECURITY FREEZES FOR CERTAIN VETERANS. 

23 ‘‘(a) APPLICABILITY.—This section shall apply with 

24 respect to— 


sroberts on PROD1PC70 with BILLS
7 

•S 3486 IS

1 ‘‘(1) any veteran, as defined in section 101 of 

2 title 38, United States Code, who may be a victim 

3 of identity theft as a result of the security breach at 

4 the Department of Veterans Affairs on May 3, 2006; 

5 ‘‘(2) any spouse (or former spouse) of such vet6 eran who the Secretary of Veterans Affairs has con7 clusively identified as being at risk of identity theft 

8 as a result of that security breach; and 

9 ‘‘(3) any other person who the Secretary of Vet10 erans Affairs has conclusively identified as being at 

11 risk of identity theft as a result of that security 

12 breach. 

13 ‘‘(b) SECURITY FREEZES.— 

14 ‘‘(1) EMPLACEMENT.—A veteran, spouse, or 

15 other person described in subsection (a) may include 

16 a security freeze in the file of that veteran, spouse, 

17 or other person maintained by a consumer reporting 

18 agency described in section 603(p)(1), by making a 

19 request to the consumer reporting agency in writing, 

20 by telephone, or through a secure electronic connec21 tion made available by the consumer reporting agen22 cy. 

23 ‘‘(2) CONSUMER DISCLOSURE.—If a veteran, 

24 spouse, or other person described in subsection (a) 

25 requests a security freeze under this section, the 


sroberts on PROD1PC70 with BILLS
8 

•S 3486 IS

1 consumer reporting agency shall disclose to that in2 dividual the process of placing and removing the se3 curity freeze and explain to that individual the po4 tential consequences of the security freeze. A con5 sumer reporting agency may not imply or inform a 

6 veteran, spouse, or other person described in sub7 section (a) that the placement or presence of a secu8 rity freeze on the file of that individual may nega9 tively affect their credit score. 

10 ‘‘(c) EFFECT OF SECURITY FREEZE.— 

11 ‘‘(1) RELEASE OF INFORMATION BLOCKED.—If 

12 a security freeze is in place in the file of a veteran, 

13 spouse, or other person described in subsection (a), 

14 a consumer reporting agency may not release infor15 mation from the file of that individual for consumer 

16 credit purposes to a third party without prior ex17 press written authorization from that individual. 

18 ‘‘(2) INFORMATION PROVIDED TO THIRD PAR19 TIES.—Paragraph (2) does not prevent a consumer 

20 reporting agency from advising a third party that a 

21 security freeze is in effect with respect to the file of 

22 a veteran, spouse, or other person described in sub23 section (a). If a third party, in connection with an 

24 application for credit, requests access to a consumer 

25 file on which a security freeze is in place under this 


sroberts on PROD1PC70 with BILLS
9 

•S 3486 IS

1 section, the third party may treat the application as 

2 incomplete. 

3 ‘‘(3) CREDIT SCORE NOT AFFECTED.—The 

4 placement of a security freeze under this section 

5 may not be taken into account for any purpose in 

6 determining the credit score of the veteran, spouse, 

7 or other person to whom the security freeze relates. 

8 ‘‘(d) REMOVAL; TEMPORARY SUSPENSION.— 

9 ‘‘(1) IN GENERAL.—Except as provided in para10 graph (4), a security freeze under this section shall 

11 remain in place until the veteran, spouse, or other 

12 person to whom it relates requests that the security 

13 freeze be removed. The veteran, spouse, or other 

14 person may remove a security freeze on his or her 

15 file by making a request to the consumer reporting 

16 agency in writing, by telephone, or through a secure 

17 electronic connection made available by the con18 sumer reporting agency. 

19 ‘‘(2) CONDITIONS.—A consumer reporting 

20 agency may remove a security freeze placed in the 

21 file of a veteran, spouse, or other person under this 

22 section only— 

23 ‘‘(A) upon request of the veteran, spouse, 

24 or other person, pursuant to paragraph (1); or 


sroberts on PROD1PC70 with BILLS
10 

•S 3486 IS

1 ‘‘(B) if the agency determines that the file 

2 of that veteran, spouse, or other person was 

3 frozen due to a material misrepresentation of 

4 fact by that veteran, spouse, or other person. 

5 ‘‘(3) NOTIFICATION TO CONSUMER.—If a con6 sumer reporting agency intends to remove a security 

7 freeze pursuant to paragraph (2)(B), the consumer 

8 reporting agency shall notify the veteran, spouse, or 

9 other person to whom the security freeze relates in 

10 writing prior to removing the freeze. 

11 ‘‘(4) TEMPORARY SUSPENSION.—A veteran, 

12 spouse, or other person described in subsection (a) 

13 may have a security freeze under this section tempo14 rarily suspended by making a request to the con15 sumer reporting agency in writing or by telephone 

16 and specifying beginning and ending dates for the 

17 period during which the security freeze is not to 

18 apply. 

19 ‘‘(e) RESPONSE TIMES; NOTIFICATION OF OTHER

20 ENTITIES.— 

21 ‘‘(1) IN GENERAL.—A consumer reporting 

22 agency shall— 

23 ‘‘(A) place a security freeze in the file of 

24 a veteran, spouse, or other person under sub25 section (b) not later than 5 business days after 


sroberts on PROD1PC70 with BILLS
11 

•S 3486 IS

1 receiving a request from the veteran, spouse, or 

2 other person under subsection (b)(1); and 

3 ‘‘(B) remove or temporarily suspend a se4 curity freeze not later than 3 business days 

5 after receiving a request for removal or tem6 porary suspension from the veteran, spouse, or 

7 other person under subsection (d). 

8 ‘‘(2) NOTIFICATION OF OTHER AGENCIES.—A 

9 consumer reporting agency shall notify all other con10 sumer reporting agencies described in section 

11 603(p)(1) of a request under this section not later 

12 than 3 days after placing, removing, or temporarily 

13 suspending a security freeze in the file of the vet14 eran, spouse, or other person under subsection (b), 

15 (d)(2)(A), or (d)(4). 

16 ‘‘(3) IMPLEMENTATION BY OTHER AGENCIES.— 

17 A consumer reporting agency that is notified of a re18 quest under paragraph (2) to place, remove, or tem19 porarily suspend a security freeze in the file of a vet20 eran, spouse, or other person shall— 

21 ‘‘(A) request proper identification from the 

22 veteran, spouse, or other person, in accordance 

23 with subsection (g), not later than 3 business 

24 days after receiving the notification; and 


sroberts on PROD1PC70 with BILLS
12 

•S 3486 IS

1 ‘‘(B) place, remove, or temporarily suspend 

2 the security freeze on that credit report not 

3 later than 3 business days after receiving prop4 er identification. 

5 ‘‘(f) CONFIRMATION.—Except as provided in sub6 section (c)(3), whenever a consumer reporting agency 

7 places, removes, or temporarily suspends a security freeze 

8 at the request of a veteran, spouse, or other person under 

9 subsection (b) or (d), respectively, it shall send a written 

10 confirmation thereof to the veteran, spouse, or other per11 son not later than 10 business days after placing, remov12 ing, or temporarily suspending the security freeze. This 

13 subsection does not apply to the placement, removal, or 

14 temporary suspension of a security freeze by a consumer 

15 reporting agency because of a notification received under 

16 subsection (e)(2). 

17 ‘‘(g) ID REQUIRED.—A consumer reporting agency 

18 may not place, remove, or temporarily suspend a security 

19 freeze in the file of a veteran, spouse, or other person de20 scribed in subsection (a) at the request of the veteran, 

21 spouse, or other person, unless the veteran, spouse, or 

22 other person provides proper identification (within the 

23 meaning of section 610(a)(1)) and the regulations there24 under. 


sroberts on PROD1PC70 with BILLS
13 

•S 3486 IS

1 ‘‘(h) EXCEPTIONS.—This section does not apply to 

2 the use of the file of a veteran, spouse, or other person 

3 described in subsection (a) maintained by a consumer re4 porting agency by any of the following: 

5 ‘‘(1) A person or entity, or a subsidiary, affil6 iate, or agent of that person or entity, or an as7 signee of a financial obligation owing by the veteran, 

8 spouse, or other person to that person or entity, or 

9 a prospective assignee of a financial obligation owing 

10 by the veteran, spouse, or other person to that per11 son or entity in conjunction with the proposed pur12 chase of the financial obligation, with which the vet13 eran, spouse, or other person has or had prior to as14 signment an account or contract, including a de15 mand deposit account, or to whom the veteran, 

16 spouse, or other person issued a negotiable instru17 ment, for the purposes of reviewing the account or 

18 collecting the financial obligation owing for the ac19 count, contract, or negotiable instrument. 

20 ‘‘(2) Any Federal, State, or local agency, law 

21 enforcement agency, trial court, or private collection 

22 agency acting pursuant to a court order, warrant, 

23 subpoena, or other compulsory process. 

24 ‘‘(3) A child support agency or its agents or as25 signs acting pursuant to subtitle D of title IV of the 


sroberts on PROD1PC70 with BILLS
14 

•S 3486 IS

1 Social Security Act (42 U.S.C. et seq.) or similar 

2 State law. 

3 ‘‘(4) The Department of Health and Human 

4 Services, a similar State agency, or the agents or as5 signs of the Federal or State agency acting to inves6 tigate medicare or medicaid fraud. 

7 ‘‘(5) The Internal Revenue Service or a State 

8 or municipal taxing authority, or a State department 

9 of motor vehicles, or any of the agents or assigns of 

10 these Federal, State, or municipal agencies acting to 

11 investigate or collect delinquent taxes or unpaid 

12 court orders or to fulfill any of their other statutory 

13 responsibilities. 

14 ‘‘(6) The use of consumer credit information for 

15 the purposes of prescreening, as provided for under 

16 this title. 

17 ‘‘(7) Any person or entity administering a cred18 it file monitoring subscription to which the veteran, 

19 spouse, or other person has subscribed. 

20 ‘‘(8) Any person or entity for the purpose of 

21 providing a veteran, spouse, or other person with a 

22 copy of his or her credit report or credit score upon 

23 request of the veteran, spouse, or other person. 

24 ‘‘(i) FEES.— 


sroberts on PROD1PC70 with BILLS
15 

•S 3486 IS

1 ‘‘(1) IN GENERAL.—Except as provided in para2 graph (2), a consumer reporting agency may charge 

3 a reasonable fee, for placing, removing, or tempo4 rarily suspending a security freeze in the file of the 

5 veteran, spouse, or other person described in sub6 section (a), which cost shall be submitted to and 

7 paid by the Department of Veterans Affairs, pursu8 ant to procedures established by the Secretary of 

9 Veterans Affairs. 

10 ‘‘(2) ID THEFT VICTIMS.—A consumer report11 ing agency may not charge a fee for placing, remov12 ing, or temporarily suspending a security freeze in 

13 the file of a veteran, spouse, or other person de14 scribed in subsection (a), if— 

15 ‘‘(A) the veteran, spouse, or other person 

16 is a victim of identity theft; 

17 ‘‘(B) the veteran, spouse, or other person 

18 requests the security freeze in writing; 

19 ‘‘(C) the veteran, spouse, or other person 

20 has filed a police report with respect to the 

21 theft, or an identity theft report (as defined in 

22 section 603(q)(4), within 90 days after the date 

23 on which the theft occurred or was discovered 

24 by the veteran, spouse, or other person; and 


sroberts on PROD1PC70 with BILLS
16 

•S 3486 IS

1 ‘‘(D) the veteran, spouse, or other person 

2 provides a copy of the report to the reporting 

3 agency. 

4 ‘‘(j) LIMITATION ON INFORMATION CHANGES IN

5 FROZEN REPORTS.— 

6 ‘‘(1) IN GENERAL.—If a security freeze is in 

7 place in the file of a veteran, spouse, or other person 

8 described in subsection (a), the consumer reporting 

9 agency may not change any of the following official 

10 information in that file without sending a written 

11 confirmation of the change to the veteran, spouse, or 

12 other person within 30 days after the date on which 

13 the change is made: 

14 ‘‘(A) Name. 

15 ‘‘(B) Date of birth. 

16 ‘‘(C) Social Security number. 

17 ‘‘(D) Address. 

18 ‘‘(2) CONFIRMATION.—Paragraph (1) does not 

19 require written confirmation for technical modifica20 tions of the official information of a veteran, spouse, 

21 or other person, including name and street abbrevia22 tions, complete spellings, or transposition of num23 bers or letters. In the case of an address change, the 

24 written confirmation shall be sent to both the new 


sroberts on PROD1PC70 with BILLS
17 

•S 3486 IS

1 address and to the former address of the veteran, 

2 spouse, or other person. 

3 ‘‘(k) CERTAIN ENTITY EXEMPTIONS.— 

4 ‘‘(1) AGGREGATORS AND OTHER AGENCIES.— 

5 The provisions of this section do not apply to a con6 sumer reporting agency that acts only as a reseller 

7 of credit information by assembling and merging in8 formation contained in the data base of another con9 sumer reporting agency or multiple consumer report10 ing agencies, and does not maintain a permanent 

11 data base of credit information from which new con12 sumer credit reports are produced. 

13 ‘‘(2) OTHER EXEMPTED ENTITIES.—The fol14 lowing entities are not required to place a security 

15 freeze in the file of a veteran, spouse, or other per16 son described in subsection (a) in accordance with 

17 this section: 

18 ‘‘(A) A check services or fraud prevention 

19 services company, which issues reports on inci20 dents of fraud or authorizations for the purpose 

21 of approving or processing negotiable instru22 ments, electronic fund transfers, or similar 

23 methods of payments. 

24 ‘‘(B) A deposit account information service 

25 company, which issues reports regarding acVerDate Aug 31 2005 19:04 Jun 11, 2006 Jkt 049200 PO 00000 Frm 00017 Fmt 6652 Sfmt 6201 E:\BILLS\S3486.IS S3486

sroberts on PROD1PC70 with BILLS
18 

•S 3486 IS

1 count closures due to fraud, substantial over2 drafts, ATM abuse, or similar negative informa3 tion regarding such veteran, spouse, or other 

4 person, to inquiring banks or other financial in5 stitutions for use only in reviewing the request 

6 of such veteran, spouse, or other person for a 

7 deposit account at the inquiring bank or finan8 cial institution.’’. 

9 (c) FEES.—Any fee associated with an extended 

10 fraud alert or security freeze required by the amendments 

11 made by this section that would otherwise be required to 

12 be paid by the consumer shall be paid by the Department 

13 of Veterans Affairs. 

14 SEC. 4. PENALTIES FOR IDENTITY THEFT OF VETERANS 

15 AND OTHERS RELATED TO SECURITY 

16 BREACH. 

17 Section 1028 of title 18, United States Code, is 

18 amended— 

19 (1) in subsection (b), by striking ‘‘The punish20 ment for’’ and inserting the following ‘‘Except as 

21 provided in subsection (j), the punishment for’’; and 

22 (2) by adding at the end the following: 

23 ‘‘(j) IDENTITY THEFT DUE TO DEPARTMENT OF

24 VETERANS AFFAIRS SECURITY BREACH.— 


sroberts on PROD1PC70 with BILLS
19 

•S 3486 IS

1 ‘‘(1) IN GENERAL.—In determining the punish2 ment applicable under subsection (b), if the offense 

3 is an offense described in paragraph (2), the fine 

4 and term of imprisonment otherwise applicable 

5 under subsection (b) shall be doubled. 

6 ‘‘(2) TYPE OF OFFENSE.—An offense described 

7 in this paragraph is an offense under subsection (a) 

8 that— 

9 ‘‘(A) involves any document or other infor10 mation— 

11 ‘‘(i) relating to a veteran (as defined 

12 in section 101 of title 38), a spouse of a 

13 veteran, or other person; and 

14 ‘‘(ii) obtained as a direct or indirect 

15 result of the security breach at the Depart16 ment of Veterans Affairs on May 3, 2006; 

17 and 

18 ‘‘(B) was committed after the date of en19 actment of this subsection.’’. 

20 SEC. 5. FUNDING. 

21 (a) REIMBURSEMENT.—The Secretary of Veterans 

22 Affairs shall reimburse the Federal Trade Commission for 

23 any costs incurred by the Commission in carrying out this 

24 Act and the amendments made by this Act. 


sroberts on PROD1PC70 with BILLS
20 

•S 3486 IS

1 (b) AVAILABILITY OF FUNDS.—Amounts appro2 priated to the Secretary and available for obligation may 

3 be utilized for purposes of reimbursement of the Federal 

4 Trade Commission under subsection (a). 

5 SEC. 6. COMPTROLLER GENERAL STUDIES ON DATA PRO6 TECTION AND OTHER MATTERS. 

7 (a) STUDY ON DATA PROTECTION BY DEPARTMENT

8 OF VETERANS AFFAIRS.— 

9 (1) IN GENERAL.—The Comptroller General of 

10 the United States shall conduct a study of the data 

11 protection procedures of the Department of Veterans 

12 Affairs. 

13 (2) ELEMENTS.—The study required by para14 graph (1) shall include the following: 

15 (A) A review and assessment of the data 

16 protection procedures of the Department of 

17 Veterans Affairs in effect before May 3, 2006. 

18 (B) A review and assessment of any modi19 fications of the data protection procedures of 

20 the Department of Veterans Affairs adopted as 

21 a result of the loss of data resulting from the 

22 security breach at the Department on May 3, 

23 2006. 

24 (b) STUDY ON SECURITY BREACH INVESTIGATION BY

25 DEPARTMENT OF VETERANS AFFAIRS.— 


sroberts on PROD1PC70 with BILLS
21 

•S 3486 IS

1 (1) IN GENERAL.—The Comptroller General of 

2 the United States shall conduct a review and assess3 ment of the investigation carried out by the Depart4 ment of Veterans Affairs with respect to the security 

5 breach at the Department on May 3, 2006. 

6 (2) COOPERATION.—The Secretary of Veterans 

7 Affairs shall ensure that the personnel of the De8 partment of Veterans Affairs cooperate fully with 

9 the Comptroller General in the conduct of the review 

10 and assessment required by paragraph (1). 

11 (c) STUDY ON FTC PROGRAM FOR VETERANS AND

12 OTHERS AT RISK OF IDENTITY THEFT.—The Comptroller 

13 General of the United States shall conduct a study of the 

14 program of the Federal Trade Commission for veterans, 

15 spouses of veterans, and other persons at risk of identity 

16 theft required by section 2. The study shall include an as17 sessment of the effectiveness of the program in meeting 

18 the financial counseling and similar needs of individuals 

19 seeking counseling and support through the program. 

20 (d) STUDY ON COMPLIANCE OF FEDERAL AGENCIES

21 WITH REQUIREMENTS ON PERSONAL DATA.— 

22 (1) IN GENERAL.—The Comptroller General of 

23 the United States shall conduct a study of the com24 pliance of the departments and agencies of the Fed25 eral Government with applicable requirements relatVerDate Aug 31 2005 19:04 Jun 11, 2006 Jkt 049200 PO 00000 Frm 00021 Fmt 6652 Sfmt 6201 E:\BILLS\S3486.IS S3486

sroberts on PROD1PC70 with BILLS
22 

•S 3486 IS

1 ing to the preservation of the confidentiality of per2 sonal data. 

3 (2) ELEMENTS.—The study required by para4 graph (1) shall include the following: 

5 (A) A review and assessment of the cur6 rent procedures and practices of the depart7 ments and agencies of the Federal Government 

8 regarding the preservation of the confidentiality 

9 of personal data. 

10 (B) A comparative analysis of the proce11 dures practices referred to in subparagraph (A) 

12 with current standards of the Federal Trade 

13 Commission for the preservation of the con14 fidentiality of personal data by commercial and 

15 non-commercial private entities. 

16 (C) A review and assessment of the modi17 fications of the data protection procedures 

18 adopted by the Department of Veterans Affairs 

19 as a result of the loss of data resulting from the 

20 security breach on May 3, 2006, including an 

21 assessment of the feasibility and advisability of 

22 the adoption of any such modifications by other 

23 departments and agencies of the Federal Gov24 ernment. 


sroberts on PROD1PC70 with BILLS
23 

•S 3486 IS

1 (D) An identification of recommendations 

2 for improvements to the procedures and prac3 tices of the departments and agencies of the 

4 Federal Government regarding the preservation 

5 of the confidentiality of personal data. 

6 (e) REPORT.—Not later than 18 months after the 

7 date of the enactment of this Act, the Comptroller General 

8 of the United States shall submit to Congress a report 

9 setting forth the results of each study conducted under 

10 this section. The report shall set forth the results of each 

11 study separately, and shall include such recommendations 

12 for legislative and administrative action as the Comp13 troller General considers appropriate in light of the stud14 ies. 

15 SEC. 7. AUTHORIZATION OF APPROPRIATIONS. 

16 There are authorized to be appropriated to the Sec17 retary of Veterans Affairs, such sums as may be necessary 

18 to carry out this Act and the amendments made by this 

19 Act. 

Æ 


sroberts on PROD1PC70 with BILLS