I 

108TH CONGRESS 

1ST SESSION H. R. 2617

To protect American consumers from identity theft and other forms of fraud. 

IN THE HOUSE OF REPRESENTATIVES 

JUNE 26, 2003

Mr. SHADEGG introduced the following bill; which was referred to the Committee on Financial Services, and in addition to the Committees on Ways 

and Means, and Energy and Commerce, for a period to be subsequently 

determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned 

A BILL

To protect American consumers from identity theft and other 

forms of fraud.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Consumer Identity and 

5 Information Security Act of 2003’’. 

6 SEC. 2. PROHIBITED ACTIONS WITH RESPECT TO SOCIAL 

7 SECURITY NUMBERS. 

8 (a) DEFINITIONS.—For purposes of this section, the 

9 following definitions shall apply: 
2

•HR 2617 IH 

1 (1) DISPLAY.—The term ‘‘display’’ means to in2 tentionally communicate or otherwise make available 

3 (on the Internet or in any other manner) to the gen4 eral public an individual’s social security number. 

5 (2) PERSON.—The term ‘‘person’’ means any 

6 individual, partnership, corporation, trust, estate, co7 operative, association, or any other entity. 

8 (3) STATE.—The term ‘‘State’’ means any 

9 State of the United States, the District of Columbia, 

10 Puerto Rico, the Northern Mariana Islands, the 

11 United States Virgin Islands, Guam, American 

12 Samoa, and any territory or possession of the 

13 United States. 

14 (b) PROHIBITED ACTIONS WITH RESPECT TO AN IN15 DIVIDUAL’S SOCIAL SECURITY NUMBER.—Subject to sub16 sections (c) and (d), no person may engage in any of the 

17 following: 

18 (1) Display in any manner an individual’s social 

19 security number. 

20 (2) Print or otherwise display an individual’s 

21 social security number on any card, or other means 

22 of access, required for the individual to access prod23 ucts or services provided by the person to the indi24 vidual. 
3

•HR 2617 IH 

1 (3) Require an individual to transmit the indi2 vidual’s social security number over the Internet, un3 less the connection is secure or the social security 

4 number is encrypted. 

5 (4) Require an individual to use the individual’s 

6 social security number to access an Internet Web 

7 site, unless a password, unique personal identifica8 tion number, or other authentication device is also 

9 required to access the Internet Web site. 

10 (5) Print or otherwise display an individual’s 

11 social security number on any communications by 

12 the person to the individual, unless Federal or State 

13 law, or any Federal agency or any contractor with 

14 the Federal Government (under color of Federal 

15 law), requires the individual’s social security number 

16 to be included on such documents. 

17 (c) EXCEPTION FOR CERTAIN COMMUNICATIONS.—

18 Subsection (b)(5) shall not apply with respect an individ19 ual’s social security number included on documents sent 

20 by mail—

21 (1) in connection with an application or enroll22 ment process initiated by the individual; or 

23 (2) to establish, amend, or terminate an ac24 count held by the individual with the person; or 
4

•HR 2617 IH 

1 (3) to verify the accuracy of the individual’s so2 cial security number. 

3 (d) EXCEPTION FOR PRIOR ON-GOING USE.—Sub4 section (b) shall not apply to the use by a person of an 

5 individual’s social security number in a manner that is in6 consistent with such subsection if—

7 (1) the use by such person of the individual’s 

8 social security number in such manner began before 

9 the date of the enactment of this Act; 

10 (2) the use by such person of the social security 

11 number in such manner is continuous; and 

12 (3) the person notifies the individual, in writ13 ing, before the end of the 30-day period beginning 

14 on the date of the enactment of this Act and annu15 ally thereafter, that the individual has the right to 

16 require such person to stop using the individual’s so17 cial security number in a manner inconsistent with 

18 subsection (b). 

19 (e) INDIVIDUAL’S REQUEST TO STOP INCONSISTENT

20 USE.—

21 (1) IN GENERAL.—If a person receives a writ22 ten request from an individual to stop using the in23 dividual’s social security number in a manner that is

24 inconsistent with subsection (b), the person shall 

25 fully comply with such request before the end of the 
5

•HR 2617 IH 

1 30-day period beginning on the date of the receipt 

2 of the request. 

3 (2) DENIAL OF PRODUCTS OR SERVICES PRO4 HIBITED.—A person may not deny any product or 

5 service to an individual, or otherwise discriminate 

6 against such individual in the provision of any such 

7 product or service, solely on the basis that the indi8 vidual submitted a request described in paragraph 

9 (1). 

10 (f) COORDINATION WITH OTHER LAW.—

11 (1) IN GENERAL.—No provision of this section 

12 shall be construed as prohibiting or limiting the dis13 play or use of an individual’s social security number 

14 by any person—

15 (A) to the extent required or authorized 

16 under any Federal or State law, or by any Fed17 eral agency or any contractor with the Federal 

18 Government (under color of Federal law); 

19 (B) for internal verification or administra20 tive purposes of the person; 

21 (C) for a public health purpose, including 

22 the protection of the health or safety of an indi23 vidual in an emergency situation; 

24 (D) for a national security purpose; or 
6

•HR 2617 IH 

1 (E) for a law enforcement purpose, includ2 ing the investigation of fraud. 

3 (2) STUDY AND REPORT.—

4 (A) IN GENERAL.—The Secretary of 

5 Health and Human Services shall conduct a 

6 study and prepare a report on all of the uses 

7 of social security numbers permitted, required, 

8 authorized, or excepted under any Federal law 

9 and State and local uses of social security num10 bers. 

11 (B) REPORT.—Not later than 1 year after 

12 the date of enactment of this Act, the Secretary 

13 of Health and Human Services shall submit a 

14 report to Congress on the study conducted 

15 under this paragraph. 

16 (C) CONTENTS OF REPORT.—The report 

17 shall include—

18 (i) a detailed description of the uses 

19 of an individual’s social security number 

20 that are allowed as of the date of enact21 ment of this Act; 

22 (ii) an evaluation of whether such 

23 uses should be continued or discontinued 

24 by appropriate legislative action; and 
7

•HR 2617 IH 

1 (iii) such other recommendations for 

2 legislative or administrative action as the 

3 Secretary determines to be appropriate. 

4 (g) CIVIL PENALTIES.—

5 (1) IN GENERAL.—Any person who the Attor6 ney General determines has violated this section 

7 shall be subject, in addition to any other penalties 

8 that may be prescribed by law—

9 (A) to a civil penalty of not less than 

10 $5,000 for each such violation; and 

11 (B) to a civil penalty of not less than 

12 $50,000, if the violations have occurred with 

13 such frequency as to constitute a general busi14 ness practice. 

15 (2) DETERMINATION OF VIOLATIONS.—Any 

16 knowing violation committed contemporaneously 

17 with respect to the social security numbers of 2 or 

18 more individuals by means of mail, telecommuni19 cation, or otherwise, shall be treated as a separate 

20 violation with respect to each such individual. 

21 (3) ENFORCEMENT PROCEDURES.—The provi22 sions of section 1128A of the Social Security Act 

23 (42 U.S.C. 1320a–7a), other than subsections (a), 

24 (b), (f), (h), (i), (j), (m), and (n) and the first sen25 tence of subsection (c) of such section, and the pro-
8

•HR 2617 IH 

1 visions of subsections (d) and (e) of section 205 of 

2 such Act (42 U.S.C. 405) shall apply to a civil pen3 alty action under this subsection in the same man4 ner as such provisions apply to a penalty or pro5 ceeding under section 1128A(a) of such Act (42 

6 U.S.C. 1320a–7a(a)), except that, for purposes of 

7 this paragraph, any reference in section 1128A of 

8 such Act (42 U.S.C. 1320a–7a) to the Secretary 

9 shall be deemed to be a reference to the Attorney 

10 General. 

11 (h) EFFECTIVE DATE.—This section shall apply after 

12 the end of the 180-day period beginning on the date of 

13 the enactment of this Act. 

14 SEC. 3. IMPROPER USE OF CREDIT CARD, DEBIT CARD, AND 

15 OTHER PAYMENT DEVICE NUMBERS. 

16 (a) IN GENERAL.—Except as provided in subsection 

17 (b), no person that accepts, in connection with the trans18 action of business, credit cards, debit cards, or other 

19 means of access to a consumer’s account for the purpose 

20 of initiating electronic fund transfers shall print, on any 

21 receipt provided to the cardholder or accountholder at the 

22 point of the business transaction—

23 (1) more than the last 5 digits of the account 

24 number of any such credit card, debit card, or con25 sumer account; or 
9

•HR 2617 IH 

1 (2) the expiration date of any such credit card, 

2 debit card, or other means of access to a consumer’s 

3 account. 

4 (b) SCOPE OF APPLICATION.—This section applies 

5 only to receipts that are electronically printed, and shall 

6 not apply to transactions in which the sole means of re7 cording the credit card or debit card account number, or 

8 the account number of a consumer’s account, is by hand9 writing or by an imprint or copy of the credit card, debit 

10 card, or other means of access. 

11 (c) DEFINITIONS.—For purposes of this section, the 

12 following definitions shall apply: 

13 (1) CONSUMER’S ACCOUNT.—The term ‘‘con14 sumer’s account’ means an account (as defined in 

15 paragraph (2) of section 903 of the Electronic Fund 

16 Transfer Act) of a consumer (as defined in para17 graph (5) of such section). 

18 (2) CREDIT CARD.—The term ‘‘credit card’’ has 

19 the same meaning as in section 103(k) of the Truth 

20 in Lending Act. 

21 (3) DEBIT CARD.—The term ‘‘debit card’’ 

22 means any card issued by a financial institution to 

23 a consumer for use in initiating electronic fund 

24 transfers from the account of the consumer at such 

25 financial institution for the purpose of transferring
10

•HR 2617 IH 

1 money between accounts or obtaining money, prop2 erty, labor, or services. 

3 (4) ELECTRONIC FUND TRANSFER.—The term 

4 ‘‘electronic fund transfer’’ has the same meaning as 

5 in section 903(6) of the Electronic Fund Transfer 

6 Act. 

7 (d) EFFECTIVE DATE.—This section shall take effect 

8 on January 1, 2005, with respect to any cash register or 

9 other machine or device that electronically prints receipts 

10 for credit card transactions. 

11 (e) CIVIL LIABILITY.—Any person who violates this 

12 section with regard to any credit card, debit card, or other 

13 means of access to a consumer’s account shall be liable 

14 for any damages or expenses, including reasonable attor15 ney’s fees, that the card holder or consumer incurs as a 

16 result of such violation, including losses incurred from the 

17 unauthorized use of the account number of any such credit 

18 card, debit card, or consumer’s account as a result of such 

19 violation. 

20 SEC. 4. IDENTITY THEFT PREVENTION. 

21 (a) DUTY OF ISSUERS OF CREDIT AND DEBIT

22 CARDS.—

23 (1) CREDIT CARDS.—Section 132 of the Truth 

24 in Lending Act (15 U.S.C. 1642) is amended—
11

•HR 2617 IH 

1 (A) by inserting ‘‘(a) IN GENERAL.—’’ be2 fore ‘‘No credit’’; and 

3 (B) by adding at the end the following: 

4 ‘‘(b) VERIFICATION OF CONSUMER IDENTITY UPON

5 RECEIVING A REQUEST FOR AN ADDITIONAL CARD

6 AFTER A CHANGE OF ADDRESS.—Each card issuer shall 

7 establish procedures for verifying the identification of a 

8 consumer whenever the card issuer receives a request from 

9 a consumer for an additional credit card with respect to 

10 an existing credit account not later than 30 days after 

11 receiving notification of a change of address for that ac12 count.’’. 

13 (2) DEBIT CARDS.—Section 911 of the Elec14 tronic Fund Transfer Act (15 U.S.C. 1693i) is 

15 amended by adding at the end the following new 

16 subsection: 

17 ‘‘(d) VERIFICATION OF CONSUMER IDENTITY UPON

18 RECEIVING A REQUEST AFTER A CHANGE OF AD19 DRESS.—Each person who issues to a consumer any code, 

20 card, or other means of access to such consumer’s account 

21 shall establish procedures for verifying the identification 

22 of the consumer whenever such person receives a request 

23 from a consumer for an additional card, code, or other 

24 means of access to the consumer’s account not later than 
12

•HR 2617 IH 

1 30 days after receiving notification of a change of address 

2 for that account.’’. 

3 (b) CENTRALIZED REPORTING SYSTEM.—The Fed4 eral Trade Commission shall coordinate the establishment 

5 of a centralized reporting system in which all consumer 

6 reporting agencies (as defined in section 603 of the Fair 

7 Credit Reporting Act) shall participate that will—

8 (1) allow any consumer or business to report, 

9 through the use of an nationwide free telephone 

10 number and an Internet Web site address, any sus11 pected violation of section 1028 of title 18, United 

12 States Code; and 

13 (2) allow such information to be immediately 

14 shared among all such consumer reporting agencies. 

15 SEC. 5. FRAUD ALERTS. 

16 Section 605 of the Fair Credit Reporting Act (15 

17 U.S.C. 1681c) is amended by adding at the end the fol18 lowing new subsection: 

19 ‘‘(g) FRAUD ALERTS.—

20 ‘‘(1) FRAUD ALERT DEFINED.—For purposes of 

21 this subsection, the term ‘fraud alert’ means a state22 ment in the file of a consumer that notifies all pro23 spective users of a consumer report made with re24 spect to that consumer that—
13

•HR 2617 IH 

1 ‘‘(A) the consumer’s identity may have 

2 been used, without the consumer’s consent, to 

3 fraudulently obtain goods or services in the con4 sumer’s name; and 

5 ‘‘(B) the consumer does not authorize the 

6 issuance or extension of credit in the name of 

7 the consumer unless the issuer of such credit 

8 utilizes reasonable procedures established by the 

9 issuer to verify the consumer’s identity and ob10 tain the consumer’s authorization whenever the 

11 card issuer receives a request for credit. 

12 ‘‘(2) INCLUSION OF FRAUD ALERT IN CON13 SUMER FILE.—Upon the request of a consumer, or 

14 another third party who has the consumer’s consent 

15 to request a fraud alert on the consumer’s behalf, 

16 and upon receiving proper identification, a consumer 

17 reporting agency shall include a fraud alert in the 

18 file of that consumer and shall maintain the fraud 

19 alert for not less than 1 year, unless the consumer 

20 requests a shorter time period. 

21 ‘‘(3) NOTICE SENT BY CONSUMER REPORTING

22 AGENCIES TO USERS.—A consumer reporting agency 

23 shall notify each person procuring consumer credit 

24 information with respect to a consumer of the exist25 ence of a fraud alert in the file of that consumer, 
14

•HR 2617 IH 

1 regardless of whether a full credit report, credit 

2 score, or summary report is requested. 

3 ‘‘(4) NOTICE TO NATIONWIDE CONSUMER RE4 PORTING AGENCIES.—Whenever a consumer report5 ing agency that compiles and maintains files on con6 sumers on a nationwide basis receives a request 

7 from a consumer, directly or through another con8 sumer reporting agency, to include a fraud alert in 

9 the consumer’s file, the consumer reporting agency 

10 shall promptly notify every other consumer reporting 

11 agency that compiles and maintains files on con12 sumers on a nationwide basis that such request has 

13 been received and each such other agency shall com14 ply with paragraph (2) in the same manner as if the 

15 agency had received the request directly from the 

16 consumer. 

17 ‘‘(5) TOLL-FREE TELEPHONE NUMBER.—Each 

18 consumer reporting agency referred to in paragraph 

19 (4) shall establish and maintain a toll-free telephone 

20 number for consumers to request fraud alerts. 

21 ‘‘(6) PROCEDURES TO RECEIVE FRAUD

22 ALERTS.—Any person who uses a consumer credit 

23 report in connection with a credit transaction shall 

24 establish reasonable procedures to receive fraud 

25 alerts transmitted by consumer reporting agencies.
15

•HR 2617 IH 

1 ‘‘(7) VIOLATIONS.—

2 ‘‘(A) CONSUMER REPORTING AGENCY.—

3 Any consumer reporting agency that fails to no4 tify any user of a consumer credit report of the 

5 existence of a fraud alert in that report shall be 

6 in violation of this section. 

7 ‘‘(B) USER OF A CONSUMER REPORT.—

8 Any user of a consumer report that fails to 

9 comply with preauthorization procedures con10 tained in a fraud alert and issues or extends 

11 credit in the name of the consumer to a person 

12 other than the consumer shall be in violation of 

13 this section. 

14 ‘‘(8) EXEMPT INSTITUTIONS.—The requirement 

15 under this subsection to place a fraud alert in a con16 sumer file shall not apply to—

17 ‘‘(A) check services company or a fraud 

18 prevention company, which issues authoriza19 tions for the purpose of approving or processing 

20 negotiable instruments, electronic funds trans21 fers or similar methods of payments; or 

22 ‘‘(B) deposit account information service 

23 company, which issues reports regarding ac24 count closures due to fraud, substantial over25 drafts, automated teller machine abuse, or simi-
16

•HR 2617 IH 

1 lar negative information regarding a consumer, 

2 to inquiring banks or other financial institu3 tions for use only in reviewing a consumer re4 quest for a deposit account at the inquiring 

5 bank or financial institution. 

6 ‘‘(9) POLICY REVIEW AND REGULATION.—

7 ‘‘(A) REVIEW.—Any agency referred to in 

8 subsection (a) or (c) of section 621 shall, upon 

9 the request of any person under the jurisdiction 

10 of such agency pursuant to this title—

11 ‘‘(i) review any policy or procedure es12 tablished by such person to carry out the 

13 purposes of this subsection to determine 

14 the effectiveness and reasonableness of the 

15 policy or procedure for such purposes; and 

16 ‘‘(ii) make such recommendations to 

17 such person for improvement in such policy 

18 or procedure as the agency may determine 

19 to be appropriate. 

20 ‘‘(B) REGULATION.—Each agency referred 

21 to in subparagraph (A) shall establish proce22 dures for conducting reviews under such sub23 paragraph.’’. 
17

•HR 2617 IH 

1 SEC. 6. BUSINESS GUIDELINES. 

2 (a) IN GENERAL.—Not later than the end of the 1-

3 year period beginning on the date of the enactment of this 

4 Act, the Federal Trade Commission, after consultation 

5 with the Federal functional regulators (as defined in sec6 tion 509(2) of the Gramm-Leach-Bliley Act), shall estab7 lish procedures to—

8 (1) log and acknowledge the receipt of com9 plaints of any person who has a reasonable belief 

10 that information maintained in a database of such 

11 person relating to any other person has likely been 

12 stolen or compromised; 

13 (2) provide informational materials and guide14 lines for a business to follow when customer or other 

15 information in the business’ database has likely been 

16 stolen or compromised; 

17 (3) provide guidelines for a business to follow in 

18 notifying customers of the likelihood that informa19 tion concerning such customers has been stolen or 

20 compromised; and 

21 (4) refer complaints described in paragraph (1) 

22 to—

23 (A) each consumer reporting agency that 

24 compiles and maintains files on consumers on a 

25 nationwide basis (as defined in section 603 of 

26 the Fair Credit Reporting Act), together with 
18

•HR 2617 IH 

1 any recommendation for the implementation for 

2 such fraud alert as the Commission may deter3 mine to be appropriate; 

4 (B) appropriate law enforcement agencies. 

5 (b) POLICY REVIEW AND REGULATION.—

6 (1) REVIEW.—The Federal Trade Commission 

7 and any Federal functional regulator (as defined in 

8 section 509(2) of the Gramm-Leach-Bliley Act) 

9 shall, upon the request of any person under the ju10 risdiction of such agency—

11 (A) review any policy or procedure estab12 lished by such person to follow in the event that 

13 information maintained in a database of such 

14 person has likely been stolen or compromised to 

15 determine the effectiveness and reasonableness 

16 of the policy or procedure for such purposes; 

17 and 

18 (B) make such recommendations to such 

19 person for improvement in such policy or proce20 dure as the agency may determine to be appro21 priate. 

22 (2) REGULATION.—Each agency referred to in 

23 subparagraph (A) shall establish procedures for con24 ducting reviews under such subparagraph.’’. 
19

•HR 2617 IH 

1 SEC. 7. SPECIFICATION OF CONSTITUTIONAL AUTHORITY 

2 FOR ENACTMENT OF LAW. 

3 This Act is enacted pursuant to the power granted 

4 Congress under section 8 of article I of the United States 

5 Constitution.

Æ