I 

108TH CONGRESS 

1ST SESSION H. R. 3233

To require financial institutions and financial service providers to notify 

customers of the unauthorized use of personal information, to amend 

the Fair Credit Reporting Act to require fraud alerts to be included 

in consumer credit files in such cases, and to provide customers with 

enhanced access to credit reports in such cases. 

IN THE HOUSE OF REPRESENTATIVES 

OCTOBER 2, 2003

Mr. GUTIERREZ introduced the following bill; which was referred to the 

Committee on Financial Services 

A BILL

To require financial institutions and financial service providers to notify customers of the unauthorized use of 

personal information, to amend the Fair Credit Reporting Act to require fraud alerts to be included in consumer credit files in such cases, and to provide customers 

with enhanced access to credit reports in such cases.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Identity Theft Notifi5 cation and Credit Restoration Act of 2003’’. 
2

•HR 3233 IH 

1 SEC. 2. FINDINGS. 

2 The Congress finds as follows: 

3 (1) The privacy and financial security of indi4 viduals is increasingly at risk due to the ever more 

5 widespread collection of personal information by 

6 both the private and public sector. 

7 (2) Credit card transactions, real estate 

8 records, consumer surveys, credit reports, and Inter9 net websites are all sources of personal information 

10 and form the source material for identity thieves. 

11 (3) Identity theft is one of the fastest growing 

12 crimes committed in the United States, and identity 

13 theft has become one of the major law enforcement 

14 challenges of the new economy, as vast quantities of 

15 sensitive personal information are now vulnerable to 

16 criminal interception and misuse. 

17 (4) Criminals who steal personal information 

18 use the information to open fraudulent credit card 

19 accounts, write bad checks, buy products, and com20 mit other financial crimes with assumed financial 

21 identities. 

22 (5) In September of 2003, the Federal Trade 

23 Commission released a survey showing that 

24 27,300,000 Americans have been victims of identity 

25 theft in the last 5 years, including 9,900,000 people 

26 in the last year alone. 
3

•HR 3233 IH 

1 (6) According to the survey, last year’s identity 

2 theft losses to businesses and financial institutions 

3 totaled nearly $48,000,000,000 and consumer vic4 tims reported $5,000,000,000 in out-of-pocket ex5 penses. 

6 (7) Identity theft is costly to consumers and to 

7 the United States marketplace. 

8 (8) Victims of identity theft are often required 

9 to contact numerous Federal, State, and local law 

10 enforcement agencies, consumer credit reporting 

11 agencies, and creditors over many years, as each 

12 event of fraud arises. 

13 (9) The Federal Government, financial institu14 tions, financial service providers, and credit report15 ing agencies that handle sensitive personal informa16 tion of consumers have a shared responsibility to 

17 protect the information from identity thieves, to as18 sist identity theft victims, and to mitigate the harm 

19 that results from fraud perpetrated in the name of 

20 the victim. 

21 (10) The private sector can better protect con22 sumers by improving customer notification, imple23 menting effective fraud alerts, affording greater con24 sumer access to credit reports, and establishing 

25 other financial identity theft prevention measures. 
4

•HR 3233 IH 

1 SEC. 3. TIMELY NOTIFICATION OF UNAUTHORIZED ACCESS 

2 TO PERSONAL INFORMATION. 

3 Subtitle B of title V of the Gramm-Leach-Bliley Act 

4 (15 U.S.C. 6821 et seq.) is amended—

5 (1) by redesignating sections 526 and 527 as 

6 sections 528 and 529, respectively; and 

7 (2) by inserting after section 525 the following: 

8 ‘‘SEC. 526. NOTIFICATION TO CUSTOMERS OF UNAUTHOR9 IZED ACCESS TO PERSONAL INFORMATION. 

10 ‘‘(a) DEFINITIONS.—For purposes of this section, the 

11 following definitions shall apply: 

12 ‘‘(1) BREACH.—The term ‘breach’—

13 ‘‘(A) means unauthorized acquisition of 

14 computerized data or paper records which com15 promises the security, confidentiality, or integ16 rity of personal information maintained by or 

17 on behalf of a financial institution; and 

18 ‘‘(B) does not include a good faith acquisi19 tion of personal information by an employee or 

20 agent of a financial institution for a business 

21 purpose of the institution, if the personal infor22 mation is not subject to further unauthorized 

23 disclosure; and 

24 ‘‘(2) PERSONAL INFORMATION.—With respect 

25 to a customer of a financial institution, the term 

26 ‘personal information’ means the first name or first 
5

•HR 3233 IH 

1 initial and last name of the customer, in combina2 tion with any 1 or more of the following data ele3 ments, when either the name or the data element is 

4 not encrypted: 

5 ‘‘(A) A social security number. 

6 ‘‘(B) A driver’s license number or other of7 ficially recognized form of identification. 

8 ‘‘(C) A credit card number, debit card 

9 number, or any required security code, access 

10 code, or password that would permit access to 

11 financial account information relating to that 

12 customer. 

13 ‘‘(b) NOTIFICATION RELATING TO BREACH OF PER14 SONAL INFORMATION.—

15 ‘‘(1) FINANCIAL INSTITUTION REQUIREMENT.—

16 In any case in which there has been a breach of per17 sonal information at a financial institution, or such 

18 a breach is reasonably believed to have occurred, the 

19 financial institution shall promptly notify—

20 ‘‘(A) each customer affected by the viola21 tion or suspected violation; 

22 ‘‘(B) each consumer reporting agency de23 scribed in section 603(p) of the Fair Credit Re24 porting Act; and 
6

•HR 3233 IH 

1 ‘‘(C) appropriate law enforcement agencies, 

2 in any case in which the financial institution 

3 has reason to believe that the breach or sus4 pected breach affects a large number of cus5 tomers, including as described in subsection 

6 (e)(1)(C), subject to regulations of the Federal 

7 Trade Commission. 

8 ‘‘(2) OTHER ENTITIES.—For purposes of para9 graph (1), any person that maintains personal infor10 mation for or on behalf of a financial institution

11 shall promptly notify the financial institution of any 

12 case in which such customer information has been, 

13 or is reasonably believed to have been, breached. 

14 ‘‘(c) TIMING.—Any notification required by this sec15 tion shall be made—

16 ‘‘(1) promptly and without unreasonable delay, 

17 upon discovery of the breach or suspected breach; 

18 and 

19 ‘‘(2) consistent with—

20 ‘‘(A) the legitimate needs of law enforce21 ment, as provided in subsection (d); and 

22 ‘‘(B) any measures necessary to determine 

23 the scope of the breach or restore the reason24 able integrity of the information security system 

25 of the financial institution. 
7

•HR 3233 IH 

1 ‘‘(d) DELAYS FOR LAW ENFORCEMENT PURPOSES.—

2 Any notification required by this section may be delayed 

3 if a law enforcement agency determines that the notifica4 tion would impede a criminal investigation, and in any 

5 such case, notification shall be made promptly after the 

6 law enforcement agency determines that it would not com7 promise the investigation. 

8 ‘‘(e) FORM OF NOTICE.—Any notification required by 

9 this section may be provided—

10 ‘‘(1) to a customer—

11 ‘‘(A) in writing; 

12 ‘‘(B) in electronic form, if the notice pro13 vided is consistent with the provisions regarding 

14 electronic records and signatures set forth in 

15 section 101 of the Electronic Signatures in 

16 Global and National Commerce Act; 

17 ‘‘(C) if the Federal Trade Commission de18 termines that the number of all customers af19 fected by, or the cost of providing notifications 

20 relating to, a single breach or suspected breach 

21 would make other forms of notification prohibi22 tive, or in any case in which the financial insti23 tution certifies in writing to the Federal Trade 

24 Commission that it does not have sufficient cus-
8

•HR 3233 IH 

1 tomer contact information to comply with other 

2 forms of notification, in the form of—

3 ‘‘(i) an e-mail notice, if the financial 

4 institution has access to an e-mail address 

5 for the affected customer that it has rea6 son to believe is accurate; 

7 ‘‘(ii) a conspicuous posting on the 

8 Internet website of the financial institu9 tion, if the financial institution maintains 

10 such a website; or 

11 ‘‘(iii) notification through the media 

12 that a breach of personal information has 

13 occurred or is suspected that compromises 

14 the security, confidentiality, or integrity of 

15 customer information of the financial insti16 tution; or 

17 ‘‘(D) in such other form as the Federal 

18 Trade Commission may by rule prescribe; and 

19 ‘‘(2) to consumer reporting agencies and law 

20 enforcement agencies (where appropriate), in such 

21 form as the Federal Trade Commission may pre22 scribe, by rule. 

23 ‘‘(f) CONTENT OF NOTIFICATION.—Each notification 

24 to a customer under subsection (b) shall include—

25 ‘‘(1) a statement that—
9

•HR 3233 IH 

1 ‘‘(A) credit reporting agencies have been 

2 notified of the relevant breach or suspected 

3 breach; and 

4 ‘‘(B) the credit report and file of the cus5 tomer will contain a fraud alert to make credi6 tors aware of the breach or suspected breach, 

7 and to inform creditors that the express author8 ization of the customer is required for any new 

9 issuance or extension of credit (in accordance 

10 with section 605(g) of the Fair Credit Report11 ing Act); and 

12 ‘‘(2) such other information as the Federal 

13 Trade Commission determines is appropriate. 

14 ‘‘(g) COMPLIANCE.—Notwithstanding subsection (e), 

15 a financial institution shall be deemed to be in compliance 

16 with this section if— 

17 ‘‘(1) the financial institution has established a 

18 comprehensive information security program that is 

19 consistent with the standards prescribed by the ap20 propriate regulatory body under section 501(b); 

21 ‘‘(2) the financial institution notifies affected 

22 customers and consumer reporting agencies in ac23 cordance with its own internal information security 

24 policies in the event of a breach or suspected breach 

25 of personal information; and 
10

•HR 3233 IH 

1 ‘‘(3) such internal security policies incorporate 

2 notification procedures that are consistent with the 

3 requirements of this section and the rules of the 

4 Federal Trade Commission under this section. 

5 ‘‘(h) CIVIL PENALTIES.—

6 ‘‘(1) DAMAGES.—Any customer injured by a 

7 violation of this section may institute a civil action 

8 to recover damages arising from that violation. 

9 ‘‘(2) INJUNCTIONS.—Actions of a financial in10 stitution in violation or potential violation of this 

11 section may be enjoined. 

12 ‘‘(3) CUMULATIVE EFFECT.—The rights and 

13 remedies available under this section are in addition 

14 to any other rights and remedies available under ap15 plicable law. 

16 ‘‘(i) RULES OF CONSTRUCTION.—

17 ‘‘(1) IN GENERAL.—Compliance with this sec18 tion by a financial institution shall not be construed 

19 to be a violation of any provision of subtitle A, or 

20 any other provision of Federal or State law prohib21 iting the disclosure of financial information to third 

22 parties. 

23 ‘‘(2) LIMITATION.—Except as specifically pro24 vided in this section, nothing in this section requires 

25 or authorizes a financial institution to disclose infor-
11

•HR 3233 IH 

1 mation that it is otherwise prohibited from disclosing 

2 under subtitle A or any other provision of Federal 

3 or State law. 

4 ‘‘(3) NO NEW RECORDKEEPING OBLIGATION.—

5 No provision of this section shall be construed as 

6 creating an obligation on the part of a financial in7 stitution to obtain, retain, or maintain information 

8 or records that are not otherwise required to be ob9 tained, retained, or maintained in the ordinary 

10 course of business of the financial institution or 

11 under other applicable law.’’. 

12 SEC. 4. INCLUSION OF FRAUD ALERTS IN CONSUMER 

13 CREDIT REPORTS. 

14 Section 605 of the Fair Credit Reporting Act (15 

15 U.S.C. 1681c) is amended by adding at the end the fol16 lowing: 

17 ‘‘(g) FRAUD ALERTS.—

18 ‘‘(1) DEFINED TERM.—For purposes of this 

19 subsection, the term ‘fraud alert’ means a clear and 

20 conspicuous statement in the file of a consumer that

21 notifies all prospective users of the consumer credit 

22 report (or any portion thereof) relating to the con23 sumer, that—

24 ‘‘(A) the identity of the consumer may 

25 have been used, without the consent of the con-
12

•HR 3233 IH 

1 sumer, to fraudulently obtain goods or services 

2 in the name of the consumer; and 

3 ‘‘(B) the consumer does not authorize the 

4 issuance or extension of credit in the name of 

5 the consumer, unless the issuer of such credit, 

6 upon receiving appropriate evidence of the true 

7 identity of the consumer—

8 ‘‘(i) obtains express preauthorization 

9 from the consumer at a telephone number 

10 designated by the consumer; or 

11 ‘‘(ii) utilizes another reasonable means 

12 of communication to obtain the express 

13 preauthorization of the consumer. 

14 ‘‘(2) INCLUSION OF FRAUD ALERT IN CON15 SUMER FILE.—

16 ‘‘(A) UPON NOTIFICATION BY FINANCIAL

17 INSTITUTION.—A consumer reporting agency 

18 shall include a fraud alert meeting the require19 ments of this subsection in the file of a con20 sumer promptly upon receipt of a notice from 

21 a financial institution under section 

22 526(b)(1)(B) of the Gramm-Leach-Bliley Act 

23 relating to the consumer. 

24 ‘‘(B) UPON REQUEST OF CONSUMER.—A 

25 consumer reporting agency shall include a fraud 
13

•HR 3233 IH 

1 alert meeting the requirements of this sub2 section in the file of a consumer promptly upon 

3 receipt of—

4 ‘‘(i) a request by the consumer; and 

5 ‘‘(ii) appropriate evidence of—

6 ‘‘(I) the true identity of the per7 son making the request; and 

8 ‘‘(II) the claim of identity theft 

9 forming the basis for the request. 

10 ‘‘(3) CONSUMER REPORTING AGENCY RESPON11 SIBILITIES.—A consumer reporting agency shall en12 sure that each person procuring consumer credit in13 formation with respect to a consumer is made aware 

14 of the existence of a fraud alert in the file of that 

15 consumer, regardless of whether a full credit report, 

16 credit score, or summary report is requested. 

17 ‘‘(4) REMOVAL OF FRAUD ALERTS.—The Fed18 eral Trade Commission shall issue appropriate regu19 lations to establish—

20 ‘‘(A) the duration of fraud alerts required 

21 by this subsection, which standard shall be ap22 plied consistently to all consumer reporting 

23 agencies, to the extent possible; and 
14

•HR 3233 IH 

1 ‘‘(B) procedures for the removal of fraud 

2 alerts included in the files of consumers under 

3 this subsection. 

4 ‘‘(5) VIOLATIONS.—

5 ‘‘(A) CONSUMER REPORTING AGENCY.—A 

6 consumer reporting agency that fails to notify 

7 any user of a consumer credit report of the ex8 istence of a fraud alert in that report shall be 

9 in violation of this section. 

10 ‘‘(B) USER OF A CONSUMER REPORT.—A 

11 user of a consumer report that fails to comply 

12 with preauthorization procedures contained in a 

13 fraud alert in the file of a consumer and issues 

14 or extends credit in the name of the consumer 

15 to a person other than the consumer shall be in 

16 violation of this subsection. 

17 ‘‘(C) NO ADVERSE ACTION BASED SOLELY

18 ON FRAUD ALERT.—It shall be a violation of 

19 this title for the user of a consumer report to 

20 take adverse action with respect to a consumer 

21 based solely on the inclusion of a fraud alert in 

22 the file of that consumer, as required by this 

23 subsection.’’. 
15

•HR 3233 IH 

1 SEC. 5. ACCESS TO CREDIT REPORTS AND SCORES. 

2 (a) NO FEE IN CERTAIN CASES.—Section 612(c) of 

3 the Fair Credit Reporting Act (15 U.S.C. 1681j(c)) is 

4 amended to read as follows: 

5 ‘‘(c) NO-COST ACCESS TO CREDIT REPORTS AND

6 SCORES.—

7 ‘‘(1) IN GENERAL.—Upon request of a con8 sumer, and without charge to the consumer, a con9 sumer reporting agency shall make all of the disclo10 sures listed under section 609 to the consumer—

11 ‘‘(A) once during each calendar year; and 

12 ‘‘(B) once every 3 months during the 1-

13 year period beginning on the date on which a 

14 fraud alert is included in the file of a consumer 

15 under section 605(g). 

16 ‘‘(2) FEE AUTHORIZED.—A credit reporting 

17 agency may charge a reasonable fee for the costs of 

18 disclosures under paragraph (1)(B) to the financial 

19 institution providing the notification that is the basis 

20 for the subject fraud alert, as required by section 

21 526(b)(1)(B) of the Gramm-Leach-Bliley Act.’’. 

22 (b) INCLUSION OF CREDIT SCORES.—Section 

23 609(a)(1) of the Fair Credit Reporting Act (15 U.S.C. 

24 1681g(a)(1)) is amended by striking ‘‘except that’’ and 

25 all that follows through ‘‘predictors’’ and inserting ‘‘in26 cluding any credit score’’. 
16

•HR 3233 IH 

1 SEC. 6. REGULATIONS. 

2 Not later than 180 days after the date of enactment 

3 of this Act, the Federal Trade Commission, after consulta4 tion with Federal banking agencies, the Securities and Ex5 change Commission, and other appropriate financial serv6 ices regulatory agencies, shall issue final regulations to 

7 carry out the amendments made by this Act.

Æ