U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

1 

49–010 

" ! SENATE 109TH CONGRESS

1st Session 

REPORT

2005

109–203 

Calendar No. 320 

IDENTITY THEFT PROTECTION ACT 

R E P O R T 

OF THE

COMMITTEE ON COMMERCE, SCIENCE, AND 

TRANSPORTATION 

ON

S. 1408 

DECEMBER 8, 2005.—Ordered to be printed 

Filed under authority of the order of the Senate of November 18, 2005 


E:\Seals\Congress.#13
(II) 

SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION 

ONE HUNDRED NINTH CONGRESS

FIRST SESSION

TED STEVENS, Alaska, Chairman 

DANIEL K. INOUYE, Hawaii, Co-Chairman 

JOHN MCCAIN, Arizona 

CONRAD BURNS, Montana 

TRENT LOTT, Mississippi 

KAY BAILEY HUTCHISON, Texas 

OLYMPIA J. SNOWE, Maine 

GORDON H. SMITH, Oregon 

JOHN ENSIGN, Nevada 

GEORGE ALLEN, Virginia 

JOHN E. SUNUNU, New Hampshire 

JIM DEMINT, South Carolina 

DAVID VITTER, Louisiana 

JOHN D. ROCKEFELLER IV, West Virginia 

JOHN F. KERRY, Massachusetts 

BYRON L. DORGAN, North Dakota 

BARBARA BOXER, California 

BILL NELSON, Florida 

MARIA CANTWELL, Washington 

FRANK LAUTENBERG, New Jersey 

E. BENJAMIN NELSON, Nebraska 

MARK PRYOR, Arkansas 

LISA SUTHERLAND, Staff Director 

CHRISTINE DRAGER KURTH, Deputy Staff Director 

DAVID RUSSELL, Chief Counsel 

MARGARET CUMMISKY, Democratic Staff Director and Chief Counsel 

SAMUEL WHITEHORN, Democratic Deputy Staff Director and General Counsel 

Calendar No. 320 

109TH CONGRESS REPORT " ! SENATE 1st Session 109–203 

IDENTITY THEFT PROTECTION ACT 

DECEMBER 8, 2005.—Ordered to be printed 

Filed under authority of the order of the Senate of November 18, 2005 

Mr. STEVENS, from the Committee on Commerce, Science, and 

Transportation, submitted the following 

R E P O R T 

[To accompany S. 1408] 

The Committee on Commerce, Science, and Transportation, to 

which was referred the bill (S. 1408) to strengthen data protection 

and safeguards, require data breach notification, and further prevent identity theft, having considered the same, reports favorably 

thereon with an amendment (in the nature of a substitute) and recommends that the bill (as amended) do pass. 

PURPOSE OF THE BILL

S. 1408 would bolster data security procedures for covered entities that collect, dispose, maintain, sell, or transfer sensitive personal information. The bill would require covered entities to provide consumer notification under circumstances when that entity 

suffers a breach of security, and the exposure of that sensitive personal information would create a reasonable risk that an identity 

theft may occur. S. 1408 also would direct the Federal Trade Commission (FTC) to develop rules that would require procedures for 

authenticating the credentials of third parties to which sensitive 

personal information may be sold or otherwise transferred. To further protect consumers from identity theft, S. 1408 would allow 

consumers to freeze their credit report for a reasonable fee. As 

amended, S. 1408 also would prohibit the solicitation, sale, or display of social security numbers by covered entities, except under 

certain specified circumstances. 

2 

1P.L. 105-318, 112 Stat. 3007 (Oct. 30, 1998) 

2 18 U.S.C. 1028 (‘‘Fraud and related activity in connection with identification documents’’) 

BACKGROUND AND NEEDS

Data Security 

In 1998, Congress responded to an explosion in identity theft activity by passing the Identity Theft Assumption and Deterrence 

Act. 1 This Act addressed identity theft in two ways: First, the Act 

strengthened then-existing criminal law governing identity theft 2

to make it a Federal crime to knowingly transfer or use, without 

lawful authority, a means of identification of another person with 

the intent to commit, or to aid or abet, any unlawful activity; and 

second, the Act required the FTC to develop a centralized complaint and consumer education service for victims of identity theft. 

This FTC clearinghouse was established and currently serves as an 

investigative tool for the FTC and Federal law enforcement to track 

and thwart identity theft. 

Despite the existence of several Federal and State laws designed 

to reduce identity theft, the crime continues to be perpetrated 

against American consumers at an alarming rate. A 2003 FTC survey found that, during a one-year period, identity thieves victimized nearly 10 million Americans, or roughly 4.6 percent of the domestic adult population. The FTC has further reported that identity theft—physical and online—accounted for 39 percent of the 

more than 635,000 consumer fraud complaints filed last year with 

the agency. 

While the aggregation and distribution of consumers’ sensitive 

personal information for marketing, lending, and other purposes 

are vital to commerce in the United States, such practices have in 

some ways made it easier for identity thieves to access and misappropriate sensitive personal information in the possession of 

businesses and other entities. 

In 2005, a string of highly publicized data breaches occurred at 

a variety of private and public organizations ranging from financial 

institutions and commercial retailers, to public universities. These 

data breaches involved the sensitive personal information of millions of consumers, including social security numbers and financial 

information. Many of these security breaches led to identity theft. 

The most widely publicized data breaches involved the unauthorized access of data held by two large information (or data) brokers. 

These breaches raised the question whether consumers’ sensitive 

personal information is adequately protected from identity thieves 

by the entities that collect, maintain, and transfer sensitive personal information. 

While several Federal laws address data security in different 

contexts, there is no single Federal law that requires the protection 

of sensitive personal information regardless of the type of entity 

that is in possession of that information. In addition, relevant Federal law that does exist does not require all entities that possess 

sensitive personal information to notify consumers when a breach 

involving such consumers’ sensitive personal information has occurred. S. 1408 is intended to fill gaps in current Federal data security laws and provide a uniform preemptive Federal standard for 

the safeguarding of sensitive personal information regardless of the 

entity with possession. The legislation would strike a balance beVerDate Aug 31 2005 13:27 Dec 19, 2005 Jkt 049010 PO 00000 Frm 00004 Fmt 6659 Sfmt 6602 E:\HR\OC\SR203.XXX SR203
3 

3 15 U.S.C. 1681-1681u, as amended; In 2003, FCRA was enhanced by the Fair and Accurate 

Credit Transactions Act (FACT) Act. The FTC has not completed implementation of the FACT 

Act. 4 15 U.S.C. 1681(a)(4) 

5 15 U.S.C. 1681b(a)(3)(A) through (F) 

6 15 U.S.C. 6801-09 

7 15 U.S.C. 6801(b) 

8 42 U.S.C. 1320d et seq. 

tween ensuring adequate security of sensitive personal information 

and not inhibiting the legitimate free flow of information that is 

vital to the U.S. economy. 

Congress has legislated in several contexts in the area of data 

privacy and security. Among other things, Congress has placed certain limits on the dissemination of credit report, financial, motor 

vehicle, and health information. The following is a brief description 

of existing data security laws. 

The Fair Credit Reporting Act (FCRA) 3 was enacted partly to ensure that ‘‘consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer’s right to privacy.’’ 4 FCRA requires that consumer reporting 

agencies only disclose consumer credit reports if such a disclosure 

is for a ‘‘permissible purpose’’ as defined in the statute. 5

In FCRA, a permissible purpose is generally a legitimate business need by the individual or entity seeking the credit report, 

which includes, among others, verification for employment, extension of credit or insurance, or property tenancy background checks. 

FCRA also requires credit-reporting agencies to use reasonable procedures to ensure that those requesting consumer credit reports are 

who they claim to be, and that they are eligible to receive the report for a permissible purpose. 

Title V of the Gramm-Leach-Bliley Act (GLBA) 6 was enacted to 

ensure the privacy and security of personally identifiable information handled by financial institutions. Title V of GLBA requires financial institutions to provide notice to customers of a possible disclosure of non-public personal information to non-affiliates and an 

opportunity to opt out of such disclosure. This non-public information includes an individual’s address, as well as social security 

number, telephone number, and mother’s maiden name. The prohibition against disclosure of this information without notice and the 

ability to opt out are subject to statutory exceptions provided in 

GLBA. These exceptions allow for disclosure primarily for reasons 

of law enforcement, prosecution, or fraud prevention. GLBA’s Privacy Rule for re-disclosure binds recipients of non-public personal 

financial information. The GLBA requires financial institutions to 

adopt and implement appropriate safeguards for the personal information of their customers. 7

The Health Information Portability and Accountability Act 

(HIPAA) 8 was enacted partly to provide strong Federal protections 

for the privacy rights of patients. The HIPAA Privacy Rule prohibits health care providers from disclosing personal health information except when required or permitted under the Rule. The 

HIPAA Privacy Rule permits health care providers to disclose personal health information for the purpose of carrying out essential 

health care functions such as patient treatment, payment for care, 

or health care operations that support treatment and payment. The 

Rule also requires disclosure of personal health information when 

4 

9 45 C.F.R. 164.530(c) 

10 15 U.S.C. 45(a) 11 15 U.S.C. 2721-25 12Pub. L. 108-159, 111 Stat. 1952 13FACTA is being phased in beginning in December 2004 and ending in September 2005. 

requested by the Department of Health and Human Services (HHS) 

for an investigation or to determine compliance with the Privacy 

Rule, or at the request of a patient or health care enrollee. Like 

GLBA, HIPAA requires health care providers to adopt and implement appropriate safeguards to protect personal health information. 9

Section 5 of the Federal Trade Commission Act (FTCA) 10 grants 

authority to the FTC to prevent unfair or deceptive trade practices 

in or affecting interstate commerce. Entities operating in interstate 

commerce are subject to section 5 of the FTCA to the extent that 

they deceptively make false claims concerning their information security policies on which consumers rely to their detriment. Such 

entities are subject to section 5 of the FTCA if they falsely claim 

to have adequate information security safeguards in place, and/or 

if they knowingly cause consumers substantial economic injury 

that could have been reasonably avoided. 

The Driver’s Privacy Protection Act (DPPA) 11 prohibits the disclosure of personal information by State departments of motor vehicles except for uses specifically stated by DPPA. It contains fourteen permissible uses, mostly for purposes of law enforcement, vehicle insurance claims or policies, or judicial proceedings. 

In April 2004, the California legislature enacted SB 1386, which 

represented the first effort by a State legislature to address data 

breach notification. The law provides strict disclosure requirements 

for commercial entities or government agencies that experience security breaches when the breaches may contain the personal information of California residents. According to many observers, were 

it not for the breach notification requirements of the California 

law, most of the data security breaches that were highly publicized 

in 2005 would not have become publicly known. Thirty-three other 

States have passed or are considering data breach legislation. The 

two prevalent themes among these initiatives are consumer notification requirements in the event of a data breach, and consumer 

redress in the event of such breach. 

Credit Freeze 

The Fair and Accurate Credit Transaction Act (FACTA) of 

2003, 12 which became effective in some States in December 

2004, 13 added new sections to FCRA that were intended to provide 

consumers with tools to combat the effects of identity theft. FACTA 

allows a consumer who seeks to mitigate or prevent the occurrence 

of identity theft to contact credit-reporting agencies and place a 

‘‘fraud alert’’ on their credit file. Once placed, any entity that attempts to extend credit to the consumer is required to contact the 

consumer by telephone and take other reasonable steps to ensure 

that the credit application is not that of an identity thief. Failure 

to contact the consumer in such instances subjects the entity to 

civil penalty. The fraud alert is effective initially for 90 days, and 

can be extended for up to seven years for victims of identity theft 

by providing a police report or an affidavit proving a theft occurred. 

5 

14 16 C.F.R. Part 314. The FTC was required to promulgate this rule in GLBA, 15 U.S.C. Subchapter I, Sec. 6801-6809 (Disclosure of Nonpublic Personal Information). 

S. 1408 would take an added step toward providing consumers 

with tools to combat identity theft by allowing consumers to place 

a ‘‘freeze’’ on their credit report for a reasonable fee. A freeze effectively would preclude (with limited exceptions) unauthorized third 

parties from accessing a credit report. Victims of identity theft 

would be permitted to place freezes on their credit report without 

a fee. 

The credit freeze provision of the bill is a response to a growing 

number of inconsistent State laws that have been enacted since the 

passage of FACTA. There are currently 11 similar State credit 

freeze laws, with the possibility of many more within the next few 

years. 

SUMMARY OF PROVISIONS

S. 1408, the Identity Theft Protection Act, would require covered 

entities to comply with the existing requirements of the FTC rules 

on Standards for Safeguarding Customer Information and Disposal 

of Consumer Report Information and Records (Safeguards Rule), 14

which require covered entities to develop, implement, maintain, 

and enforce written programs for the security of sensitive personal 

information to ensure security, protect against any anticipated 

threats, or unauthorized access to consumers’ sensitive personal information. 

The bill would apply the Safeguards Rule to entities not currently covered and require those entities that handle sensitive personal information to provide notice to affected consumers in the 

event of a security breach. S. 1408 also would allow consumers to 

place, lift, and temporarily remove a security freeze on their credit, 

which would prevent credit from being extended to third parties 

without authorization from the consumer. In addition, S. 1408 

would prohibit (with limited exceptions) the sale or purchase of 

consumers’ social security numbers. This provision would prohibit 

employers, educational institutions, and others from using social 

security numbers for any employee benefit plan, card, or tag that 

is provided by employers, educational institutions, and others, for 

the purpose of identification. The use of social security numbers as 

identifiers on State drivers’ licenses would be prohibited as well. 

LEGISLATIVE HISTORY

On May 10, 2005, and June 16, 2005, the Committee held hearings chaired by Chairman Stevens and Senator Smith, respectively, 

to examine the issues pertaining to data security. Those testifying 

before the Committee were representatives of private companies, 

industry trade associations, public interest groups, State Attorneys 

General, and each of the FTC Commissioners. 

On July 14, 2005, Senator Smith introduced S. 1408, ‘‘The Identity Theft Protection Act,’’ which was referred to the Committee. 

Senators Stevens, Inouye, McCain, Nelson, and Pryor were original 

co-sponsors of the bill. 

On July 28, 2005, the Committee met in open executive session 

to consider an amendment in the nature of a substitute to S. 1408 

offered by Senator Smith that made several substantive changes to 

6 

the bill’s provisions as introduced. Senator Boxer offered an amendment during the executive session, which would limit the amount 

of time a covered entity would have to notify consumers in the 

event of a data breach. The Committee agreed to incorporate Senator Boxer’s amendment into Senator Smith’s amendment in the 

nature of a substitute. In addition, the Committee adopted an 

amendment offered by Chairman Stevens containing technical corrections to the substitute amendment, and an amendment offered 

by Senator Dorgan that would prohibit the sale of Social Security 

numbers with a few exceptions, including for the purposes of public 

health or national security. The amendments were adopted and the 

bill, as amended, and the Committee ordered the bill to be reported. 

ESTIMATED COSTS

In accordance with paragraph 11(a) of rule XXVI of the Standing 

Rules of the Senate and section 403 of the Congressional Budget 

Act of 1974, the Committee provides the following cost estimate, 

prepared by the Congressional Budget Office: 

NOVEMBER 3, 2005. 

Hon. TED STEVENS, Chairman, Committee on Commerce, Science, and Transportation, 

U.S. Senate, Washington, DC. 

DEAR MR. CHAIRMAN: The Congressional Budget Office has prepared the enclosed cost estimate for S. 1408, the Identity Theft 

Protection Act. 

If you wish further details on this estimate, we will be pleased 

to provide them. The CBO staff contacts are Melissa Z. Petersen 

(for federal costs), Sarah Puro ( for the state and local impact), and 

Selena Caldera (for the private-sector impact). 

Sincerely, 

DOUGLAS HOLTZ-EAKIN. 

Enclosure. 

S. 1408—Identity Theft Protection Act 

Summary: S. 1408 would require private companies to take certain precautions to safeguard the personal information of consumers and to notify consumers whenever there is a breach in the 

security of their personal information. Under the bill, consumers 

would have the option to freeze their credit reports in the event of 

a threat on their personal information. The bill also would restrict 

the use, display, and sale of Social Security numbers (SSNs). Under 

S. 1408, the Federal Trade Commission (FTC) would enforce these 

restrictions and requirements. Assuming appropriation of the 

amounts specifically authorized in the bill, CBO estimates that implementing S. 1408 would cost $1 million in 2006 and $5 million 

over the 2006–2010 period. 

Enacting S. 1408 could increase federal revenues and direct 

spending as a result of the collection of additional civil and criminal penalties assessed for violations of identity theft laws. Collections of criminal penalties are recorded in the budget as revenues, 

deposited in the Crime Victims Fund, and later spent. CBO estiVerDate Aug 31 2005 13:27 Dec 19, 2005 Jkt 049010 PO 00000 Frm 00008 Fmt 6659 Sfmt 6602 E:\HR\OC\SR203.XXX SR203
7 

mates, however, that any additional revenues and direct spending 

that would result from enacting the bill would not be significant 

because of the relatively small number of cases likely to be involved. 

S. 1408 contains several intergovernmental mandates as defined 

in the Unfunded Mandates Reform Act (UMRA), including limitations on the sale, display, and use of SSNs by state and local governments, requirements that schools—many of which are public— 

comply with FTC regulations regarding certain personal information that they collect, and explicit preemptions of state laws regarding the treatment of that information. While the aggregate cost of 

complying with those mandates is uncertain, CBO estimates that 

such costs would exceed the threshold established in UMRA ($62 

million in 2005, adjusted annually for inflation) in at least one of 

the first five years after the mandates go into effect. 

S. 1408 would impose private-sector mandates on employers, retailers, schools, colleges, consumer-credit-reporting agencies, and 

other entities that acquire, maintain, or utilize sensitive personal 

information. While CBO cannot estimate the direct cost of complying with each mandate, certain mandates in the bill would impose security standards and notification requirements on a large 

number of private-sector entities, including more than five million 

employers. Based on this information, CBO estimates that the total 

direct cost of mandates in the bill would exceed the annual threshold established by UMRA for private-sector mandates ($123 million 

in 2005, adjusted annually for inflation). 

Estimated cost to the Federal Government: The estimated budgetary impact of S. 1408 is shown in the following table. The costs 

of this legislation fall within budget function 370 (commerce and 

housing credit). CBO assumes that the bill will be enacted in calendar year 2006 and that the specified amounts will be appropriated for each year. CBO estimates that implementing the bill 

would cost $1 million in 2006 and $5 million over the 2006–2010 

period to issue regulations and enforce the bill’s new provisions restricting the use of personal information. 

By fiscal year, in millions of dollars— 

2006 2007 2008 2009 2010 

CHANGES IN SPENDING SUBJECT TO APPROPRIATION 

Authorization Level ........................................................................................ 1 1 1 1 1 

Estimated Outlays ......................................................................................... 1 1 1 1 1 

Estimated impact on state, local, and tribal governments: S. 1408 

contains several intergovernmental mandates as defined in UMRA. 

Specifically, the bill would: 

• Limit the sale, display, and use of Social Security numbers 

by state, local, and tribal governments; 

• Require that educational entities—many of which are public—comply with FTC regulations regarding the treatment of 

certain personal information that they collect; 

• Explicitly preempt state laws in at least 17 states regarding the treatment of personal information; and 

• Place certain notification requirements on state insurance 

authorities and State Attorneys General. 

8 

While there are a very large number of entities that would be required to make changes to existing systems, the aggregate cost of 

complying with those mandates is uncertain. Based on discussion 

with state and local officials, however, CBO estimates that the 

costs of complying with the mandates in the bill would exceed the 

threshold established in UMRA ($62 million in 2005, adjusted annually for inflation) in at least one of the first five years after the 

mandates go into effect. 

CBO estimates that the prohibitions against the sale, display, 

and use of Social Security numbers and the requirements on educational entities would impact the most significant costs on state 

and local governments. The remainder of this analysis focuses on 

those provisions. 

Social Security numbers 

While state and local governments have, in recent years, taken 

steps to reduce the use of SSNs on public documents, many continue to use them for a variety of purposes. The bill would restrict 

or prohibit governmental agencies from: • Selling or displaying Social Security numbers that have 

been disclosed to the agency because of a mandatory requirement; • Displaying SSNs on checks or check stubs; • Placing SSNs on drivers licenses, identification cards, vehicle registrations, or employee identification cards, or coding 

them into magnetic strips or bar codes on those documents; 

and • Allowing prisoners access to SSNs of other individuals. 

The bill would allow SSNs to be sold under certain circumstances, for example, when such sale is necessary for public 

health, national security, or tax-law purposes, when done in compliance with certain motor vehicle laws, or consumer-reporting 

practices, or for nonmarket research that advances the public good. 

If state and local governments do not currently have a system in 

place to safeguard SSNs, they would have to implement a new system for any documents issued after the regulations become effective (up to one year following enactment of the bill). If they use 

SSNs on checks and check-stubs as part of their recordkeeping and 

tracking procedures, they would have to alter those systems and 

remove the SSNs. Under the provisions of the bill, states would 

have to implement systems for removing SSNs from many documents that are available to the public. While there is some uncertainty about the extent of the requirements in this provision, CBO 

assumes that governmental entities would be required to remove 

SSNs from existing documents, a requirement that would impose 

significant costs on state and local governments. Further, some 

states may have to alter their systems for issuing driver’s licenses 

and vehicle registrations to remove SSNs that are coded electronically onto a magnetic strip or digitized as part of a bar code. Finally, any government agency that uses SSNs would have to implement safeguards to preclude unauthorized access to SSNs and their 

derivatives and to protect confidentiality. 

Generally, the use of SSNs by municipal governments for recordkeeping and identification is not widespread. There are over 75,000 

municipal governments, however, so even small one-time costs—for 

9 

example, as little as $5,000—would impose significant costs, in the 

aggregate, on intergovernmental entities. On the other hand, counties and states, while fewer in number (there are about 3,600 counties in the U.S.), are more dependent on SSNs for various recordkeeping and identification purposes and are thus likely to face significantly higher costs because of the complexity and scope of their 

recordkeeping systems. (Some counties estimate that altering their 

systems to use identifiers other than SSNs or to eliminate the display of SSNs would result in one-time costs ranging from $40,000 

to over $1,000,000, depending on the county and the scope of the 

changes that would need to be made.) In total, compliance costs for 

all state and local entities would likely be significant. 

Requirements on schools 

The bill would require elementary, secondary, and post-secondary 

educational institutions to: 

• Develop, implement, and maintain a written program to 

safeguard certain personal information in accordance with FTC 

regulations; 

• Notify affected individuals of any breach of security; and 

• Refrain from using Social Security numbers as identifiers 

in certain circumstances. 

Under current law, educational institutions that receive federal 

funds already are required to safeguard certain personal information and must comply with Department of Education standards. 

Depending on the differences between the rules promulgated by the 

FTC and those already required by the Department of Education, 

educational institutions may have to make changes to their current 

systems that could be costly. For example, if institutions are required to add additional systems or provide additional information, 

they could face added costs. Since there are over 100,000 institutions that would be affected by these changes, the total costs could 

be significant. 

A provision that would require schools to notify affected individuals of any breach of security in which personal information may 

have been compromised also could be costly. The bill would cap 

costs for each notification to $250,000. Examples from California— 

where a similar law was passed in 2002—suggest that a large university could expect to incur costs of between $100,000 and 

$200,000 to notify individuals whose personal information may 

have been compromised. The California experience suggests that, 

because the definition of a security breach is broad, public schools 

likely would incur some costs to comply with this provision. Because there is a large number of educational institutions nationwide (there are over 14,000 school districts composed of about 

100,000 schools and over 1,500 public institutions of higher education), total costs could be significant over time. However, CBO 

cannot estimate the likely frequency of such security breaches and 

thus cannot estimate the total costs of complying with this provision. 

The bill also would prohibit educational institutions from requesting and using a Social Security number unless no other type 

of identifier can be used in its place. Reprogramming systems that 

currently use SSNs as identifiers also could be costly. 

10 

Estimated impact on the private sector: S. 1408 would impose 

private-sector mandates on employers, retailers, schools, colleges, 

consumer-credit-reporting agencies, and other entities that acquire, 

maintain, or utilize sensitive personal information. The legislation 

defines sensitive personal information as a combination of name 

and Social Security number, driver’s license number, or credit card 

information. While CBO cannot determine the direct cost of complying with each mandate, certain mandates in S. 1408 would impose security standards and notification requirements on a large 

number of private-sector entities, including more than five million 

employers. Based on this information, CBO estimates that the total 

direct cost of mandates in the bill would exceed the annual threshold established by UMRA for private-sector mandates ($123 million 

in 2005, adjusted annually for inflation). 

Security program for the protection of sensitive information 

Section 2 would require covered entities to develop, implement, 

maintain, and enforce a written program containing administrative, technical, and physical safeguards to secure sensitive personal 

information. In the bill, covered entities would include businesses, 

employers, and educational and nonprofit institutions that acquire, 

maintain, and utilize sensitive personal information. The cost of 

this mandate depends on both the number of covered entities— 

more than five million—and the average cost to an entity of complying with the mandate. CBO does not have enough information 

to estimate the average cost to a covered entity to comply with the 

mandate. Because of the large number of covered entities, however, 

we expect that even if the average cost of writing the security program was small, the overall costs of this mandate could be significantly above the threshold established in UMRA. 

Notification of security breach risk 

The bill would set certain procedures for notifying consumers, 

the FTC, and credit reporting agencies of security breaches involving personal information. In the case of a security breach, section 

3(c) would require covered entities to investigate any suspected 

breach of security. If the breach creates a reasonable risk of identity theft, the entity would be required to notify all those individuals whose personal information was compromised and to notify 

the FTC and the credit-reporting agencies if the breach affects 

1,000 or more individuals. 

The cost of this mandate depends on the number of security 

breaches that occur, the average number of persons affected by a 

breach, and the cost per person of notification. There is very little 

information available on the number of breaches each year; only 

the largest of breaches are noticed and recorded. Nevertheless, information that is available suggests that security breaches are not 

rare. Although the cost to notify one person by mail may cost up 

to $2, the potentially large number of people in data systems maintained by some covered entities would make the cost of notification 

associated with one breach substantial. Furthermore, certain covered entities, such as retailers, do not maintain the mailing addresses of customers for whom they have name and credit card information. It would be costly for those entities to begin keeping 

that information. Based on this information, CBO expects that the 

11 

cost to comply with this mandate could be large relative to UMRA’s 

threshold for private-sector mandates. 

Security freeze 

Section 4 would allow consumers to place a security freeze on 

their credit report by making a request to a consumer-credit-reporting agency. The credit-reporting agency would be prevented from 

releasing the credit report to any third parties without an authorization from the consumer. The agency also would be required to 

notify all other reporting agencies of the security freeze at the consumer’s request. To comply with the mandates in section 4, creditreporting agencies would have to create and operate new systems 

to accept, impose, and release freezes on credit reports. Further, 

such agencies would incur costs in terms of the lost net income 

from being unable to sell credit reports that they would otherwise 

be able to sell under current law. CBO does not have sufficient information on how such systems would be added to existing operating systems or the expected revenue from credit report sales. 

Therefore, CBO has no basis to determine the cost of this mandate. 

Social Security number protection 

Section 8 would prevent covered entities from soliciting any Social Security numbers from individuals unless no other identifier 

can be used reasonably. There are many cases in which covered entities ask individuals for their Social Security numbers. For example, employers ask their employees to provide SSNs for the purpose 

of sending withheld taxes to the Internal Revenue Service; in this 

case, no other identifier would seem possible to use. Schools, on the 

other hand, ask students to provide SSNs on their applications 

where it may be possible to use another identifier. CBO does not 

have sufficient information about how often covered entities could 

use another identifier and, if so, how much it would cost for them 

to switch; therefore, CBO has no basis to estimate the cost of this 

mandate. 

This section also would prevent covered entities from displaying 

Social Security numbers, or any part of such a number, on any card 

or tag used for identification, such as student or employee identification cards. This is an increasingly rare practice; therefore, CBO 

estimates that the cost of this mandate would be small. 

Estimate prepared by: Federal Costs: Melissa Z. Peterson. Impact on State, Local, and Tribal Governments: Sarah Puro. Impact 

on the Private Sector: Selena Caldera and Nabeel Alsalam. 

Estimate approved by: Peter H. Fontaine, Deputy Assistance Director for Budget Analysis. 

REGULATORY IMPACT STATEMENT

In accordance with paragraph 11(b) of rule XXVI of the Standing 

Rules of the Senate, the Committee provides the following evaluation of the regulatory impact of the legislation, as reported: 

12 

NUMBER OF PERSONS COVERED

ECONOMIC IMPACT

S. 1408 would require covered entities to develop, implement, 

maintain, and enforce a written program for the security of sensitive personal information in their possession. In addition, covered 

entities would be required to notify consumers in event of any 

breach of sensitive personal information. While some covered entities may already have safeguards and notification procedures in 

place, nonetheless, the legislation may create compliance costs for 

such entities in the form of equipment upgrades or personnel addition in order to ensure that their practices satisfy the new Federal 

requirements. 

PRIVACY

S. 1408 would likely bolster consumer privacy by ensuring that 

covered entities that handle sensitive personal information take appropriate measures to safeguard such information. 

PAPERWORK

The legislation would increase paperwork requirements for private industry to the extent that such paperwork is necessary to 

comply with the information safeguards, breach notification, and 

credit freeze requirements, as well as the social security number 

use prohibitions, of this Act. The bill would require two reports 

submitted to Congress by the FTC. The first, a report by the FTC 

containing the findings of a working group established by the FTC 

Chairman pursuant to this Act. And, the second, a report by the 

FTC developed in conjunction with the Department of Justice 

(DOJ) on the correlation between methamphetamine use and identity theft crimes. 

SECTION-BY-SECTION ANALYSIS

Section 1. Short title 

This section would provide that the legislation be cited as the 

‘‘Identity Theft Protection Act.’’ 

Section 2. Protection of sensitive personal information 

Section 2 would require covered entities to include administrative, technical, and physical safeguards within the written program 

to ensure security, protect against any anticipated threats, and protect against unauthorized access to sensitive personal information. 

The Committee notes that the implementation and enforcement of 

the data security policy is as important as the data security policy 

itself. Covered entities that are in full compliance with the current 

FTC Safeguards Rule would be deemed in compliance with this section. The Act also would require that, within one year of enactment, the FTC promulgate regulations that would require procedures for authenticating the credentials of third parties to which 

sensitive personal information is to be transferred or sold. 

The Committee’s purposes for allowing covered entities the option of complying with the existing FTC Safeguards Rule are twofold: first, to provide covered entities regulatory consistency without an interim gap that would require such entities to modify their 

13 

safeguards procedures more than once in order to comply; and, second, to take into account the impact of mandating safeguards rules 

on small businesses, particularly sole proprietors. With respect to 

the latter purpose, the Committee draws a parallel between the 

Safeguards Rule and S. 1408 to the extent that small businesses 

should be afforded flexibility to comply with S. 1408 in a manner 

that is dependent on their size and complexity, the nature and 

scope of their activities, and the sensitivity of the information that 

they handle. 

Accordingly, in promulgating the regulations required under subsection 3(c), the FTC should consider the impact that such regulations would have on small businesses, as the FTC did when developing the existing Safeguards Rule. 

The Committee encourages the FTC in its promulgation of rules 

to fulfill the requirements of section 2 to take into account the use 

of technological safeguards and effective alternative methods to reduce the chances of identity theft. 

Section 3. Notification of security breach risk 

Section 3 would require a covered entity that, after using due 

diligence, determines that a breach of security has resulted in identity theft for one or more individuals, or that a reasonable risk of 

identity theft exists, to notify every individual affected by the 

breach of security. In determining whether a reasonable risk of 

identity theft exists, a covered entity would be required to consider 

factors about the nature of the breach, such as if the data is usable 

by an unauthorized third party and whether the data is in the possession and control of an unauthorized third party who is likely to 

commit identity theft. 

This section also would require covered entities that suffer a 

breach of security that affects 1,000 or more individuals to report 

the breach to the FTC or other appropriate market regulator and 

notify all consumer-reporting agencies (CRA) of the breach. The 

FTC would be required in such an instance to post a report of the 

breach of security on the agency’s website without personally identifying any individual affected by the breach. In the event that the 

breach of security affects less than 1,000 individuals, and a covered 

entity determines that the breach of security does not create a reasonable risk of identity theft, it shall report the breach to the FTC 

or appropriate market regulator under section 5 of this Act. The report would be required to contain the number of individuals affected, and the type of information that was exposed, as a result 

of the breach of security. 

If a covered entity determines that notification to consumers of 

the breach of security is warranted, the entity would be required 

to contact individuals affected by the breach through a written or 

electronic notice. If the cost of issuing a notice would exceed 

$250,000, involve contacting more than 500,000 individuals, or the 

entity lacks the contact information of affected individuals, the entity would have the option to provide a substitute notice through 

a posting on the website of the entity or via appropriate Statewide 

or regional media. In the event that this substitute notice is necessary, the covered entity would be required to include in such notice the name of the entity suffering the breach, the affected individuals’ names, a description of the sensitive personal information 

14 

that was compromised, and the dates indicating the period between 

the breach of the data and the discovery of the breach. 

Section 3 would require a covered entity to give notice to consumers when required by this Act in the most expedient manner 

possible, but not later than 45 days following the discovery of the 

breach, unless a Federal or State law enforcement agency determines that the timely giving of notice would materially impede a 

civil or criminal investigation, or threaten national security or 

homeland security. 

This section would not apply to electronic communications of a 

third party stored by a cable operator, information service, or telecommunications carrier in the network of such operator, service, or 

carrier in the course of transferring or transmitting such communication. 

The Committee’s consumer notification requirement is meant to 

provide warning to consumers who may become victims of identity 

theft as a result of a data security breach. The Committee recognizes, however, that setting the threshold for notification too low 

may result in unnecessary consumer notification, which would reduce the effectiveness of the warning and create unnecessary costs. 

When deciding to provide notice, the entity should evaluate the 

usability of the information and the likelihood that the information 

is in the possession of an unauthorized party. If the compromised 

sensitive personal information is usable, but it has merely been 

misplaced and is not likely in the possession of an unauthorized 

third party, consumer notification would not be required. Similarly, 

consumer notification would not be warranted when sensitive personal information has been compromised and is likely in the possession of an unauthorized third party, but the information is not 

usable. Should a covered entity discover a breach of security, and 

that the compromised sensitive personal information is both usable 

and possessed by an unauthorized third party who is likely to commit identity theft, the covered entity must then determine whether 

a reasonable risk of identity theft to one or more individuals exists. 

If this analysis yields an affirmative conclusion, then the covered 

entity would be required to provide consumer notification under 

this section. 

Section 4. Security freeze 

Section 4 would allow a consumer to place a security freeze on 

his or her credit report by making a request to a CRA in writing, 

by telephone, or through a secure electronic connection made available by the CRA. The security freeze would prevent a consumer’s 

credit report from being released to a third party without express 

authorization from the consumer. The Committee encourages the 

CRAs to provide consumers the most expedient means to place and 

lift security freezes. 

A CRA would have up to five days after receiving a written request by a consumer to place a security freeze, and three days to 

either lift a freeze either temporarily or permanently. This Act 

would allow the FTC to determine through a rulemaking what constitutes a reasonable fee that can be charged to consumers by 

CRAs for placing and lifting a credit freeze. 

The consumer whose credit report was frozen would be permitted 

to remove a security freeze on his or her credit report only upon 

15 

request to the CRA. The CRA would be permitted to remove a security freeze upon the consumer’s request, or if the CRA believes the 

report was frozen due to a material misrepresentation of fact. If a 

consumer requests that a security freeze be lifted, after providing 

proper identification, the CRA must lift the freeze within three 

days. 

This section would allow a consumer who places, removes, or 

temporarily suspends a security freeze to request that the CRA 

that initiates the action on the security freeze notify all other CRAs 

of the request within three days. A CRA that is notified of such a 

request may request proper identification from the consumer within three business days after receiving the request, and place the security freeze no later than three days after receiving the consumer 

identification. 

Victims of identity theft would be permitted under subsection 

4(h)(2) to place a security freeze without charge by requesting in 

writing, in addition to filing a police report or identity theft report 

(as defined in section 603 (q)(4) of FCRA (15 U.S.C. 1681a(q)(4))), 

to a CRA within 90 days after the theft occurred or was discovered 

by the consumer. 

Section 4 would not apply to the use of a credit report by any 

of the following: a person or entity with which the consumer has 

had a prior business relationship for the purpose of reviewing an 

account or collecting the financial obligation owing from an account 

or contract; any Federal, State or local agency, law enforcement 

agency, trial court, or private collection agency acting pursuant to 

a court order, warrant, or subpoena; HHS or any similar State 

agency acting to investigate Medicare or Medicaid fraud; the Internal Revenue Service or a State municipal taxing authority to investigate or collect delinquent taxes or unpaid court orders or any of 

their other statutory responsibilities; the use of consumer credit information for prescreening; any person administering a credit file 

monitoring subscription to which the consumer has subscribed; any 

person or entity for the purpose of providing a consumer with his 

or her credit report or credit score at the consumer’s request; a 

check services or fraud prevention services company, which issues 

reports on incidents of fraud; or a deposit account information service company, which issues report regarding account closures due to 

fraud, substantial overdrafts, or similar negative information. 

Section 4 would exempt any CRA that acts only as a reseller of 

credit information by assembling and merging information contained in the data base of another CRA, and does not maintain a 

permanent data base of credit information from which new consumer reports are produced. 

Section 5. Enforcement 

Section 5 provides new authority for the FTC to take action 

against covered entities that fail to develop, implement, maintain, 

or enforce a written program for the security of sensitive personal 

information as unfair or deceptive acts or practices proscribed 

under section 18(a)(1)(B) of the FTCA (15 U.S.C. 57a(a)(1)(B)). This 

new authority is analogous to the authority that the FTC currently 

possesses under Title V of GLBA with respect to financial institutions. 

16 

This section also would provide that compliance with this Act be 

enforced exclusively by agencies under the Federal Deposit Insurance Act (for foreign banks, commercial lenders, bank holding companies, and savings associations), the Federal Credit Union Act (for 

credit unions), the Securities Exchange Act of 1934 (for brokers and 

dealers), the Investment Company Act of 1940 (for investment companies), the Investment Advisers Act of 1940 (for investment advisers), and State insurance law. 

Section 5 would allow the FTC to seek civil penalties in its enforcement actions against covered entities in an amount up to 

$11,000 for each individual; and up to $11,000,000 in the aggregate 

for all such individuals with respect to the same violation by a covered entity under section 3 of this Act. 

This section also would provide that nothing in this Act would 

establish a private cause of action against a covered entity for the 

violation of any provision in this Act. However, nothing would affect a consumer’s right to bring a civil action that is not under this 

Act in State or Federal court. 

In addition, any covered entity to which title V of GLBA (15 

U.S.C. 6801 et seq.) or section 607 of FCRA (15 U.S.C. 1681e) applies would be deemed in compliance with sections 2 and 3 of this 

Act to the extent that the person is in compliance with the provisions of those Acts, which require the protection of sensitive personal information and notification in the event of a breach of security. 

It is not the intent of this Committee to impose prohibitively onerous safeguards and notification requirements on small businesses. Thus, the FTC or appropriate market regulator should consider the size of the business and its ability to comply as one of 

many factors when enforcing this Act. 

Section 6. Enforcement of State Attorneys General 

Section 6 would allow a State to bring an action under this Act 

in Federal court on behalf of its residents. The State would be required to notify the FTC or the appropriate Federal market regulator of the action at least 60 days prior to bringing the action. In 

the event that such notice is not feasible, the State would be required to provide notice immediately upon instituting the action. 

The FTC or appropriate Federal market regulator would be authorized to intervene in such civil action. If the FTC or appropriate 

Federal market regulator institutes an action for a violation of this 

Act, no State attorney general, or official or agency of the State, 

would be permitted to bring an action during the pendency of that 

action against any defendant named in the complaint. 

Section 7. Preemption of State law 

Section 7 of this Act would preempt any State or local law that 

requires, or holds liable, a covered entity for safeguarding sensitive 

personal information, notifying affected individuals of breaches of 

security, or allowing a consumer to place, remove, or temporarily 

suspend a security freeze on his or her credit report. This section 

also would provide that any State or local law, regulation, or rule 

prohibiting or limiting the solicitation or display of social security 

numbers would be preempted by this Act. 

17 

Section 8. Social Security number protection 

Subsection 8(a) would prohibit the solicitation of a social security 

number from an individual unless there is a specific use of the 

number for which no other identifying number reasonably can be 

used. Subsection 8(b) would prohibit employers, educational institutions, and others from using social security numbers for any employee benefit plan, card, or tag that is provided by employers, educational institutions, and others for the purpose of identification. 

This subsection also would prohibit the use of social security numbers as driver identifiers on State drivers’ licenses. 

Subsection 8(a) would provide certain exceptions for the solicitation of a social security number, including: for the purpose of obtaining a consumer report or any purpose permitted under FCRA 

(15 U.S.C. 1681 et seq.); for the purpose of verifying or obtaining 

proof of identity by a CRA; for any purpose permitted under section 

502(e) of GLBA (15 U.S.C. 6802(e)); or to identify or locate missing 

or abducted children, witnesses, criminals and fugitives, parties to 

lawsuits, parents delinquent in child support payments, organ and 

bone marrow donors, pension fund beneficiaries, and missing heirs. 

Subsection 8(c) would amend the Social Security Act (42 U.S.C. 

405(c)(2)(C)) to prohibit any Federal, State, or judicial agency from 

employing or entering into a contract to utilize inmates who would 

have access to the social security account numbers of other individuals. This prohibition would go into effect 90 days after the date 

of enactment. 

Subsection 8(d) would prohibit the sale or purchase of social security numbers. Exceptions to this prohibition would be for: national security purposes; public health purposes; emergency situations to protect the health or safety of an individual; compliance 

with a tax law of the United States or of any State; or if the sale 

or purchase is to or by a CRA. This section would allow the sale 

or purchase of an individual’s social security if written consent is 

obtained. The Committee recognizes that there are legitimate uses 

for social security numbers as indicated in the exceptions to this 

subsection, and that barring such usage may result in unintended 

consequences. Therefore, the Committee intends to develop the language of this section as the legislation progresses toward full Senate consideration. 

Subsection 8(d) also would require the FTC to promulgate regulations concerning the prohibition of sale within 1 year after the 

date of enactment of this Act. 

Section 9. Information security working group 

Section 9 would require the Chairman of the FTC to establish an 

Information Working Group comprised of industry participants, 

consumer groups, and other interested parties to collect, review, 

disseminate, and advise on best practices to protect sensitive personal information. The Information Working Group would be required to submit to Congress a report on its findings within 12 

months after its establishment. The FTC, after notifying Congress, 

would be authorized to terminate the Working Group if the Commission finds that the work and annual reports are no longer necessary. 

18 

Section 10. Definitions 

Section 10 would provide for a number of notable definitions, as 

follows: 

Breach of Security: The unauthorized access to, and acquisition 

of, data in any form or format containing sensitive personal information that compromises the security or confidentiality of such information and creates a reasonable risk of identity theft. 

Consumer Reporting Agency: Any person engaging in the practice 

of assembling or evaluating consumer credit information or other 

information on consumers for the purpose of furnishing credit reports to third parties. 

Covered Entity: A sole proprietorship, partnership, corporation, 

trust, estate, cooperative, sole propriety, association, or other commercial entity, and any charitable, educational, or nonprofit organization, that acquires, maintains, or utilizes sensitive personal information. 

Credit Report: A consumer report as defined in section 603(d) of 

FCRA (15 U.S.C. 1681a(p)), that is used for the purpose of serving 

as a factor in establishing a consumer’s eligibility for credit for personal, family or household purposes. 

Identity Theft: The unauthorized acquisition, purchase, sale, or 

use by any person of an individual’s sensitive personal information 

that violates section 1028 of title 18, U.S.C., or any provision of 

State law; or that results in economic loss to the individual whose 

sensitive personal information was used. 

Reasonable Risk of Identity Theft: The term ‘‘reasonable risk of 

identity theft’’ means that the preponderance of the evidence available to the covered entity that has experienced a breach of security 

establishes that identity theft for one or more individuals from the 

breach of security is foreseeable. 

Sensitive Personal Information: An individual’s name, address, or 

phone number linked with one or more data elements as listed in 

this definition. The FTC would be authorized through a rulemaking 

to designate or delete data elements or identifying information that 

may be used to effectuate identity theft as sensitive personal information. The Committee has included this FTC authority to add or 

subtract types of information from this definition with the intention that such authority would be exercised only when necessary to 

address any change in circumstances by which a new category of 

information, if breached, would create a reasonable risk of identity 

theft pursuant to this Act. The Committee understands that additions to or subtractions from the information list may yield economic consequences to covered entities, and particularly small businesses. Therefore, the FTC should proceed under this authority, 

and, if utilized, the FTC should develop a clear record showing how 

the information to be added or subtracted would or would not effectuate identity theft. The Committee did not include the following 

identifiers within the definition of sensitive personal information: 

genetic or biometric information; electronic mail signature; electronic identifier or screen name with password; consumer credit report information, mother’s maiden name; and employee, faculty, 

student or U.S. Armed forces serial number. These identifiers were 

excluded because the Committee did not possess clear evidence 

that obtaining this information would effectuate identity theft. The 

Committee encourages the Federal Trade Commission to evaluate 

19 

these identifiers to decide if they should be included as sensitive 

personal information. 

Public Records: Nothing in the Act would prohibit a covered entity from obtaining, aggregating, or using sensitive personal information it lawfully obtains from public records in a manner that would 

not violate this Act. 

Section 11. Authorization of appropriations 

Section 11 would authorize $1,000,000 to be appropriated to the 

FTC to carry out this Act for fiscal years 2006 through 2010. 

Section 12. Related crime study 

Section 12 would require the FTC, in conjunction with DOJ, to 

conduct a study within 18 months of enactment of this Act to examine the correlation, if any, between methamphetamine use and 

identity theft crimes, as well as the needs of law enforcement to address methamphetamine crimes related to identity theft. 

Section 13. Prohibition on technology mandates 

This section would make clear that nothing in this Act should be 

construed as authorizing the FTC to issue regulations that require 

or impose a specific technology, product, technological standard, or 

solution. 

Section 14. Effective date 

This section would require covered entities under subsection 2(a) 

to implement the information safeguards program within 6 months 

after the date of enactment of this Act. 

Under this Act, the FTC would be required to initiate 

rulemakings under subsections 2(c), 4(h), and 8(d) within 45 days 

after enactment, and promulgate final rules within one year after 

the date of enactment. The requirements of the FTC rulemakings 

under subsections 2(c), 4(h), and 8(d) would take effect six months 

after each of the final rules are promulgated. All other provisions 

of this Act would take effect upon its enactment. 

ROLLCALL VOTES IN COMMITTEE

Senator Allen offered an amendment to Senator Smith’s 

amendment (in the nature of a substitute) to limit the authority of 

the FTC to change the definition of ‘‘sensitive personal information.’’ On a rollcall vote of 8 yeas and 14 nays as follows, the 

amendment was defeated: 

YEAS—8 NAYS—14 

Mr. Burns Mr. McCain1

Ms. Snowe Mr. Lott 

Mr. Ensign1 Mrs. Hutchison1

Mr. Allen Mr. Smith 

Mr. Sununu1 Mr. Inouye 

Mr. DeMint1 Mr. Rockefeller1

Mr. Vitter Mr. Kerry1

Mr. Nelson of Nebraska1 Mr. Dorgan 

Mrs. Boxer1

Mr. Nelson of Florida 

Ms. Cantwell 

20 

Mr. Lautenberg1

Mr. Pryor 

Mr. Stevens 1By proxy 

Senator Allen offered an amendment to Senator Smith’s 

amendment (in the nature of a substitute) to amend the definition 

in the bill of what constitutes a ‘‘reasonable risk of identity theft’’ 

that would require companies to notify consumers of a security 

breach or loss of personal information. On a rollcall vote of 8 yeas 

and 14 nays as follows, the amendment was defeated: 

YEAS—8 NAYS—14 

Mr. Burns1 Mr. Lott1

Mr. Smith Mrs. Hutchison1

Mr. Allen Ms. Snowe1

Mr. Sununu1 Mr. Inouye 

Mr. McCain1 Mr. Rockefeller1

Mr. Ensign1 Mr. Kerry1

Mr. DeMint1 Mrs. Boxer1

Mr. Vitter1 Mr. Nelson of Florida 

Ms. Cantwell1

Mr. Lautenberg1

Mr. Nelson of Nebraska1

Mr. Pryor 

Mr. Dorgan 

Mr. Stevens1

1By proxy 

Senator Bill Nelson offered an amendment to Senator Smith’s 

amendment (in the nature of a substitute) to require data brokers 

and others to provide consumers with the same rights to sensitive 

personal information about themselves that they now enjoy under 

FCRA. On a rollcall vote of 9 yeas and 13 nays as follows, the 

amendment was defeated: 

YEAS—9 NAYS—13 

Mr. Inouye Mr. McCain1

Mr. Rockefeller1 Mr. Burns1

Mr. Kerry1 Mr. Lott1

Mr. Dorgan1 Mrs. Hutchison1

Mrs. Boxer1 Ms. Snowe1

Mr. Nelson of Florida Mr. Smith 

Ms. Cantwell1 Mr. Ensign1

Mr. Lautenberg1 Mr. Allen1

Mr. Pryor Mr. Sununu1

Mr. DeMint1

Mr. Vitter1

Mr. Nelson of Nebraska1

Mr. Stevens1

1By proxy 

CHANGES IN EXISTING LAW

In compliance with paragraph 12 of rule XXVI of the Standing 

Rules of the Senate, changes in existing law made by the bill, as 

reported, are shown as follows (existing law proposed to be omitted 

21 

is enclosed in black brackets, new material is printed in italic, existing law in which no change is proposed is shown in roman): 

SOCIAL SECURITY ACT 

SEC. 205. EVIDENCE AND PROCEDURE FOR ESTABLISHMENT OF BENEFITS. 

[42 U.S.C. 405] 

(a) RULES AND REGULATIONS; PROCEDURES.—The Commissioner 

of Social Security shall have full power and authority to make rules 

and regulations and to establish procedures, not inconsistent with 

the provisions of this title, which are necessary or appropriate to 

carry out such provisions, and shall adopt reasonable and proper 

rules and regulations to regulate and provide for the nature and 

extent of the proofs and evidence and the method of taking and furnishing the same in order to establish the right to benefits hereunder. 

(b) ADMINISTRATIVE DETERMINATION OF ENTITLEMENT TO BENEFITS; FINDINGS OF FACT; HEARINGS; INVESTIGATIONS; EVIDENTIARY

HEARINGS IN RECONSIDERATIONS OF DISABILITY BENEFIT TERMINATIONS.— 

(1) The Commissioner of Social Security is directed to make 

findings of fact, and decisions as to the rights of any individual 

applying for a payment under this title. Any such decision by 

the Commissioner of Social Security which involves a determination of disability and which is in whole or in part unfavorable to such individual shall contain a statement of the case, 

in understandable language, setting forth a discussion of the 

evidence, and stating the Commissioner’s determination and 

the reason or reasons upon which it is based. Upon request by 

any such individual or upon request by a wife, divorced wife, 

surviving divorced mother, surviving divorced father husband, 

divorced husband, widower, surviving divorced husband, child, 

or parent who makes a showing in writing that his or her 

rights may be prejudiced by any decision the Commissioner of 

Social Security has rendered, the Commissioner shall give such 

applicant and such other individual reasonable notice and opportunity for a hearing with respect to such decision, and, if 

a hearing is held, shall, on the basis of evidence adduced at the 

hearing, affirm, modify, or reverse the Commissioner’s findings 

of fact and such decision. Any such request with respect to 

such a decision must be filed within sixty days after notice of 

such decision is received by the individual making such request. The Commissioner of Social Security is further authorized, on the Commissioner’s own motion, to hold such hearings 

and to conduct such investigations and other proceedings as 

the Commissioner may deem necessary or proper for the administration of this title. In the course of any hearing, investigation or other proceeding, the Commissioner may administer 

oaths and affirmations, examine witnesses and receive evidence. Evidence may be received at any hearing before the 

Commissioner of Social Security even though inadmissible 

under rules of evidence applicable to court procedure. 

(2) In any case where— 

22 

(A) an individual is a recipient of disability insurance 

benefits, or of child’s, widow’s, or widower’s insurance benefits based on disability, 

(B) the physical or mental impairment on the basis of 

which such benefits are payable is found to have ceased, 

not to have existed, or to no longer be disabling, and 

(C) as a consequence of the finding described in subparagraph (B), such individual is determined by the Commissioner of Social Security not to be entitled to such benefits, 

any reconsideration of the finding described in subparagraph (B), in connection with a reconsideration by the 

Commissioner of Social Security (before any hearing under 

paragraph (1) on the issue of such entitlement) of the 

Commissioner’s determination described in subparagraph 

(C), shall be made only after opportunity for an evidentiary hearing, with regard to the finding described in 

subparagraph (B), which is reasonably accessible to such 

individual. Any reconsideration of a finding described in 

subparagraph (B) may be made either by the State agency 

or the Commissioner of Social Security where the finding 

was originally made by the State agency, and shall be 

made by the Commissioner of Social Security where the 

finding was originally made by the Commissioner of Social 

Security. In the case of a reconsideration by a State agency 

of a finding described in subparagraph (B) which was 

originally made by such State agency, the evidentiary 

hearing shall be held by an adjudicatory unit of the State 

agency other than the unit that made the finding described in subparagraph (B). In the case of a reconsideration by the Commissioner of Social Security of a finding 

described in subparagraph (B) which was originally made 

by the Commissioner of Social Security, the evidentiary 

hearing shall be held by a person other than the person or 

persons who made the finding described in subparagraph 

(B). 

(3)(A) A failure to timely request review of an initial adverse 

determination with respect to an application for any benefit 

under this title or an adverse determination on reconsideration 

of such an initial determination shall not serve as a basis for 

denial of a subsequent application for any benefit under this 

title if the applicant demonstrates that the applicant, or any 

other individual referred to in paragraph (1), failed to so request such a review acting in good faith reliance upon incorrect, incomplete, or misleading information, relating to the consequences of reapplying for benefits in lieu of seeking review 

of an adverse determination, provided by any officer or employee of the Social Security Administration or any State agency acting under section 221. 

(B) In any notice of an adverse determination with respect 

to which a review may be requested under paragraph (1), the 

Commissioner of Social Security shall describe in clear and 

specific language the effect on possible entitlement to benefits 

under this title of choosing to reapply in lieu of requesting review of the determination. 

(c) RECORDS OF WAGES AND SELF-EMPLOYMENT INCOME.— 

23 

(1) For the purposes of this subsection— 

(A) The term ‘‘year’’ means a calendar year when used 

with respect to wages and a taxable year when used with 

respect to self-employment income. 

(B) The term ‘‘time limitation’’ means a period of three 

years, three months, and fifteen days. 

(C) The term ‘‘survivor’’ means an individual’s spouse, 

surviving divorced wife, surviving divorced husband, surviving divorced mother, surviving divorced father, child, or 

parent, who survives such individual. 

(D) The term ‘‘period’’ when used with respect to self-employment income means a taxable year and when used 

with respect to wages means— 

(i) a quarter if wages were reported or should have 

been reported on a quarterly basis on tax returns filed 

with the Secretary of the Treasury or his delegate 

under section 6011 of the Internal Revenue Code of 

1986 or regulations thereunder (or on reports filed by 

a State under section 218(e) (as in effect prior to December 31, 1986) or regulations thereunder), 

(ii) a year if wages were reported or should have 

been reported on a yearly basis on such tax returns or 

reports, or 

(iii) the half year beginning January 1 or July 1 in 

the case of wages which were reported or should have 

been reported for calendar year 1937. 

(2)(A) On the basis of information obtained by or submitted 

to the Commissioner of Social Security, and after such 

verification thereof as the Commissioner deems necessary, the 

Commissioner of Social Security shall establish and maintain 

records of the amounts of wages paid to, and the amounts of 

self-employment income derived by, each individual and of the 

periods in which such wages were paid and such income was 

derived and, upon request, shall inform any individual or his 

survivor, or the legal representative of such individual or his 

estate, of the amounts of wages and self-employment income of 

such individual and the periods during which such wages were 

paid and such income was derived, as shown by such records 

at the time of such request. 

(B)(i) In carrying out the Commissioner’s duties under subparagraph (A) and subparagraph (F), the Commissioner of Social Security shall take affirmative measures to assure that social security account numbers will, to the maximum extent 

practicable, be assigned to all members of appropriate groups 

of categories of individuals by assigning such numbers (or 

ascertaining that such numbers have already been assigned): 

(I) to aliens at the time of their lawful admission to the 

United States either for permanent residence or under 

other authority of law permitting them to engage in employment in the United States and to other aliens at such 

time as their status is so changed as to make it lawful for 

them to engage in such employment; 

(II) to any individual who is an applicant for or recipient 

of benefits under any program financed in whole or in part 

24 

from Federal funds including any child on whose behalf 

such benefits are claimed by another person; and 

(III) to any other individual when it appears that he 

could have been but was not assigned an account number 

under the provisions of subclauses (I) or (II) but only after 

such investigation as is necessary to establish to the satisfaction of the Commissioner of Social Security, the identity 

of such individual, the fact that an account number has 

not already been assigned to such individual, and the fact 

that such individual is a citizen or a noncitizen who is not, 

because of his alien status, prohibited from engaging in 

employment; and, in carrying out such duties, the Commissioner of Social Security is authorized to take affirmative measures to assure the issuance of social security 

numbers: 

(IV) to or on behalf of children who are below school age 

at the request of their parents or guardians; and 

(V) to children of school age at the time of their first enrollment in school. 

(ii) The Commissioner of Social Security shall require of applicants for social security account numbers such evidence as 

may be necessary to establish the age, citizenship, or alien status, and true identity of such applicants, and to determine 

which (if any) social security account number has previously 

been assigned to such individual. With respect to an application for a social security account number for an individual who 

has not attained the age of 18 before such application, such 

evidence shall include the information described in subparagraph (C)(ii). 

(iii) In carrying out the requirements of this subparagraph, 

the Commissioner of Social Security shall enter into such 

agreements as may be necessary with the Attorney General 

and other officials and with State and local welfare agencies 

and school authorities (including nonpublic school authorities). 

(C)(i) It is the policy of the United States that any State (or political subdivision thereof) may, in the administration of any tax, general public assistance, driver’s license, or motor vehicle registration 

law within its jurisdiction, utilize the social security account numbers issued by the Commissioner of Social Security for the purpose 

of establishing the identification of individuals affected by such 

law, and may require any individual who is or appears to be so affected to furnish to such State (or political subdivision thereof) or 

any agency thereof having administrative responsibility for the law 

involved, the social security account number (or numbers, if he has 

more than one such number) issued to him by the Commissioner 

of Social Security. 

(ii) In the administration of any law involving the issuance of a 

birth certificate, each State shall require each parent to furnish to 

such State (or political subdivision thereof) or any agency thereof 

having administrative responsibility for the law involved, the social 

security account number (or numbers, if the parent has more than 

one such number) issued to the parent unless the State (in accordance with regulations prescribed by the Commissioner of Social Security) finds good cause for not requiring the furnishing of such 

number. The State shall make numbers furnished under this subVerDate Aug 31 2005 13:27 Dec 19, 2005 Jkt 049010 PO 00000 Frm 00026 Fmt 6659 Sfmt 6601 E:\HR\OC\SR203.XXX SR203
25 

clause available to the Commissioner of Social Security and the 

agency administering the State’s plan under part D of title IV in 

accordance with Federal or State law and regulation. Such numbers shall not be recorded on the birth certificate. A State shall not 

use any social security account number, obtained with respect to 

the issuance by the State of a birth certificate, for any purpose 

other than for the enforcement of child support orders in effect in 

the State, unless section 7(a) of the Privacy Act of 1974 does not 

prohibit the State from requiring the disclosure of such number, by 

reason of the State having adopted, before January 1, 1975, a statute or regulation requiring such disclosure. 

(iii)(I) In the administration of section 9 of the Food Stamp Act 

of 1977 (7 U.S.C. 2018) involving the determination of the qualifications of applicants under such Act, the Secretary of Agriculture 

may require each applicant retail store or wholesale food concern 

to furnish to the Secretary of Agriculture the social security account number of each individual who is an officer of the store or 

concern and, in the case of a privately owned applicant, furnish the 

social security account numbers of the owners of such applicant. No 

officer or employee of the Department of Agriculture shall have access to any such number for any purpose other than the establishment and maintenance of a list of the names and social security account numbers of such individuals for use in determining those applicants who have been previously sanctioned or convicted under 

section 12 or 15 of such Act (7 U.S.C. 2021 or 2024). 

(II) The Secretary of Agriculture may share any information contained in any list referred to in subclause (I) with any other agency 

or instrumentality of the United States which otherwise has access 

to social security account numbers in accordance with this subsection or other applicable Federal law, except that the Secretary 

of Agriculture may share such information only to the extent that 

such Secretary determines such sharing would assist in verifying 

and matching such information against information maintained by 

such other agency or instrumentality. Any such information shared 

pursuant to this subclause may be used by such other agency or 

instrumentality only for the purpose of effective administration and 

enforcement of the Food Stamp Act of 1977 or for the purpose of 

investigation of violations of other Federal laws or enforcement of 

such laws. 

(III) The Secretary of Agriculture, and the head of any other 

agency or instrumentality referred to in this subclause, shall restrict, to the satisfaction of the Commissioner of Social Security, access to social security account numbers obtained pursuant to this 

clause only to officers and employees of the United States whose 

duties or responsibilities require access for the purposes described 

in subclause (II). 

(IV) The Secretary of Agriculture, and the head of any agency or 

instrumentality with which information is shared pursuant to 

clause (II), shall provide such other safeguards as the Commissioner of Social Security determines to be necessary or appropriate 

to protect the confidentiality of the social security account numbers. 

(iv) In the administration of section 506 of the Federal Crop Insurance Act, the Federal Crop Insurance Corporation may require 

each policyholder and each reinsured company to furnish to the inVerDate Aug 31 2005 13:27 Dec 19, 2005 Jkt 049010 PO 00000 Frm 00027 Fmt 6659 Sfmt 6601 E:\HR\OC\SR203.XXX SR203
26 

surer or to the Corporation the social security account number of 

such policyholder, subject to the requirements of this clause. No officer or employee of the Federal Crop Insurance Corporation shall 

have access to any such number for any purpose other than the establishment of a system of records necessary for the effective administration of such Act. The Manager of the Corporation may require each policyholder to provide to the Manager, at such times 

and in such manner as prescribed by the Manager, the social security account number of each individual that holds or acquires a 

substantial beneficial interest in the policyholder. For purposes of 

this clause, the term ‘‘substantial beneficial interest’’ means not 

less than 5 percent of all beneficial interest in the policyholder. The 

Secretary of Agriculture shall restrict, to the satisfaction of the 

Commissioner of Social Security, access to social security account 

numbers obtained pursuant to this clause only to officers and employees of the United States or authorized persons whose duties or 

responsibilities require access for the administration of the Federal 

Crop Insurance Act. The Secretary of Agriculture shall provide 

such other safeguards as the Commissioner of Social Security determines to be necessary or appropriate to protect the confidentiality of such social security account numbers. For purposes of this 

clause the term ‘‘authorized person’’ means an officer or employee 

of an insurer whom the Manager of the Corporation designates by 

rule, subject to appropriate safeguards including a prohibition 

against the release of such social security account number (other 

than to the Corporation) by such person. 

(v) If and to the extent that any provision of Federal law heretofore enacted is inconsistent with the policy set forth in clause (i), 

such provision shall, on and after the date of the enactment of this 

subparagraph, be null, void, and of no effect. If and to the extent 

that any such provision is inconsistent with the requirement set 

forth in clause (ii), such provision shall, on and after the date of 

the enactment of such subclause, be null, void, and of no effect. 

(vi)(I) For purposes of clause (i) of this subparagraph, an agency 

of a State (or political subdivision thereof) charged with the administration of any general public assistance, driver’s license, or motor 

vehicle registration law which did not use the social security account number for identification under a law or regulation adopted 

before January 1, 1975, may require an individual to disclose his 

or her social security number to such agency solely for the purpose 

of administering the laws referred to in clause (i) above and for the 

purpose of responding to requests for information from an agency 

administering a program funded under part A of title IV or an 

agency operating pursuant to the provisions of part D of such title. 

(II) Any State or political subdivision thereof (and any person 

acting as an agent of such an agency or instrumentality), in the administration of any driver’s license or motor vehicle registration 

law within its jurisdiction, may not display a social security account number issued by the Commissioner of Social Security (or 

any derivative of such number) on any driver’s license, motor vehicle registration, or personal identification card (as defined in section 7212(a)(2) of the 9/11 Commission Implementation Act of 

2004), or include, on any such license, registration, or personal 

identification card, a magnetic strip, bar code, or other means of 

communication which conveys such number (or derivative thereof). 

27 

(vii) For purposes of this subparagraph, the term ‘‘State’’ includes 

the District of Columbia, the Commonwealth of Puerto Rico, the 

Virgin Islands, Guam, the Commonwealth of the Northern Marianas, and the Trust Territory of the Pacific Islands. 

(viii)(I) Social security account numbers and related records that 

are obtained or maintained by authorized persons pursuant to any 

provision of law, enacted on or after October 1, 1990, shall be confidential, and no authorized person shall disclose any such social 

security account number or related record. 

(II) Paragraphs (1), (2), and (3) of section 7213(a) of the Internal 

Revenue Code of 1986 shall apply with respect to the unauthorized 

willful disclosure to any person of social security account numbers 

and related records obtained or maintained by an authorized person pursuant to a provision of law enacted on or after October 1, 

1990, in the same manner and to the same extent as such paragraphs as such paragraphs apply with respect to unauthorized disclosures of returns and return information described in such paragraphs. Paragraph (4) of such 7213(a) of such Code shall apply 

with respect to the willful offer of any item of material value in exchange for any such social security account number or related 

record in the same manner and to the same extent as such paragraph applies with respect to offers (in exchange for any return or 

return information) described in such paragraph. 

(III) For purposes of this clause, the term ‘‘authorized person’’ 

means an officer or employee of the United States, an officer or employee of any State, political subdivision of a State, or agency of a 

State or political subdivision of a State, and any other person (or 

officer or employee thereof), who has or had access to social security account numbers or related records pursuant to any provision 

of law enacted on or after October 1, 1990. For purposes of this 

subclause, the term ‘‘officer or employee’’ includes a former officer 

or employee. 

(IV) For purposes of this clause, the term ‘‘related record’’ means 

any record, list, or compilation that indicates, directly or indirectly, 

the identity of any individual with respect to whom a social security account number or a request for a social security account number is maintained pursuant to this clause. 

(ix) In the administration of the provisions of chapter 81 of title 

5, United States Code, and the Longshore and Harbor Workers’ 

Compensation Act (33 U.S.C. 901 et seq.), the Secretary of Labor 

may require by regulation that any person filing a notice of injury 

or a claim for benefits under such provisions provide as part of 

such notice or claim such person’s social security account number, 

subject to the requirements of this clause. No officer or employee 

of the Department of Labor shall have access to any such number 

for any purpose other than the establishment of a system of records 

necessary for the effective administration of such provisions. The 

Secretary of Labor shall restrict, to the satisfaction of the Commissioner of Social Security, access to social security account numbers 

obtained pursuant to this clause to officers and employees of the 

United States whose duties or responsibilities require access for 

the administration or enforcement of such provisions. The Secretary of Labor shall provide such other safeguards as the Commissioner of Social Security determines to be necessary or appropriate 

28 

to protect the confidentiality of the social security account numbers. 

(x) No executive, legislative, or judicial agency or instrumentality 

of the Federal Government or of a State or political subdivision 

thereof (or person acting as an agent of such an agency or instrumentality) may employ, or enter into a contract for the use or employment of, prisoners in any capacity that would allow such prisoners access to the social security account numbers of other individuals. For purposes of this clause, the term ‘prisoner’ means an individual who is confined in a jail, prison, or other penal institution 

or correctional facility, serving community service as a term of probation or parole, or serving a sentence through a work-furlough program. 

(D)(i) It is the policy of the United States that— 

(I) any State (or any political subdivision of a State) and any 

authorized blood donation facility may utilize the social security account numbers issued by the Commissioner of Social Security for the purpose of identifying blood donors, and 

(II) any State (or political subdivision of a State) may require 

any individual who donates blood within such State (or political subdivision) to furnish to such State (or political subdivision), to any agency thereof having related administrative responsibility, or to any authorized blood donation facility the social security account number (or numbers, if the donor has 

more than one such number) issued to the donor by the Commissioner of Social Security. 

(ii) If and to the extent that any provision of Federal law enacted 

before the date of the enactment of this subparagraph is inconsistent with the policy set forth in clause (i), such provision shall, 

on and after such date, be null, void, and of no effect. 

(iii) For purposes of this subparagraph— 

(I) the term ‘‘authorized blood donation facility’’ means an 

entity described in section 1141(h)(1)(B), and 

(II) the term ‘‘State’’ includes the District of Columbia, the 

Commonwealth of Puerto Rico, the Virgin Islands, Guam, the 

Commonwealth of the Northern Marianas, and the Trust Territory of the Pacific Islands. 

(E)(i) It is the policy of the United States that— 

(I) any State (or any political subdivision of a State) may utilize the social security account numbers issued by the Commissioner of Social Security for the additional purposes described 

in clause (ii) if such numbers have been collected and are otherwise utilized by such State (or political subdivision) in accordance with applicable law, and 

(II) any district court of the United States may use, for such 

additional purposes, any such social security account numbers 

which have been so collected and are so utilized by any State. 

(ii) The additional purposes described in this clause are the following: 

(I) Identifying duplicate names of individuals on master lists 

used for jury selection purposes. 

(II) Identifying on such master lists those individuals who 

are ineligible to serve on a jury by reason of their conviction 

of a felony. 

29 

(iii) To the extent that any provision of Federal law enacted before the date of the enactment of this subparagraph is inconsistent 

with the policy set forth in clause (i), such provision shall, on and 

after that date, be null, void, and of no effect. 

(iv) For purposes of this subparagraph, the term ‘‘State’’ has the 

meaning such term has in subparagraph (D). 

(F) The Commissioner of Social Security shall require, as a condition for receipt of benefits under this title, that an individual furnish satisfactory proof of a social security account number assigned 

to such individual by the Commissioner of Social Security or, in the 

case of an individual to whom no such number has been assigned, 

that such individual make proper application for assignment of 

such a number. 

(G) The Commissioner of Social Security shall issue a social security card to each individual at the time of the issuance of a social 

security account number to such individual. The social security 

card shall be made of banknote paper, and (to the maximum extent 

practicable) shall be a card which cannot be counterfeited. 

(H) The Commissioner of Social Security shall share with the 

Secretary of the Treasury the information obtained by the Commissioner pursuant to the second sentence of subparagraph (B)(ii) and 

to subparagraph (C)(ii) for the purpose of administering those sections of the Internal Revenue Code of 1986 which grant tax benefits based on support or residence of children. 

(3) The Commissioner’s records shall be evidence for the purpose of proceedings before the Commissioner of Social Security 

or any court of the amounts of wages paid to, and self- employment income derived by, an individual and of the periods in 

which such wages were paid and such income was derived. The 

absence of an entry in such records as to wages alleged to have 

been paid to, or as to self-employment income alleged to have 

been derived by, an individual in any period shall be evidence 

that no such alleged wages were paid to, or that no such alleged income was derived by, such individual during such period. 

(4) Prior to the expiration of the time limitation following 

any year the Commissioner of Social Security may, if it is 

brought to the Commissioner’s attention that any entry of 

wages or self- employment income in the Commissioner’s 

records for such year is erroneous or that any item of wages 

or self-employment income for such year has been omitted from 

such records, correct such entry or include such omitted item 

in the Commissioner’s records, as the case may be. After the 

expiration of the time limitation following any year— 

(A) the Commissioner’s records (with changes, if any, 

made pursuant to paragraph (5)) of the amounts of wages 

paid to, and self-employment income derived by, an individual during any period in such year shall be conclusive 

for the purposes of this title; 

(B) the absence of an entry in the Commissioner’s 

records as to the wages alleged to have been paid by an 

employer to an individual during any period in such year 

shall be presumptive evidence for the purposes of this title 

that no such alleged wages were paid to such individuals 

in such period; and 

30 

(C) the absence of an entry in the Commissioner’s 

records as to the self-employment income alleged to have 

been derived by an individual in such year shall be conclusive for the purposes of this title that no such alleged selfemployment income was derived by such individual in 

such year unless it is shown that he filed a tax return of 

his self-employment income for such year before the expiration of the time limitation following such year, in which 

case the Commissioner of Social Security shall include in 

the Commissioner’s records the self- employment income of 

such individual for such year. 

(5) After the expiration of the time limitation following any 

year in which wages were paid or alleged to have been paid to, 

or self-employment income was derived or alleged to have been 

derived by, an individual, the Commissioner of Social Security 

may change or delete any entry with respect to wages or selfemployment income in the Commissioner’s records of such year 

for such individual or include in the Commissioner’s records of 

such year for such individual any omitted item of wages or 

self-employment income but only— 

(A) if an application for monthly benefits or for a lumpsum death payment was filed within the time limitation 

following such year; except that no such change, deletion, 

or inclusion may be made pursuant to this subparagraph 

after a final decision upon the application for monthly benefits or lump-sum death payment; 

(B) if within the time limitation following such year an 

individual or his survivor makes a request for a change or 

deletion, or for an inclusion of an omitted item, and alleges 

in writing that the Commissioner’s records of the wages 

paid to, or the self-employment income derived by, such individual in such year are in one or more respects erroneous; except that no such change, deletion, or inclusion 

may be made pursuant to this subparagraph after a final 

decision upon such request. Written notice of the Commissioner’s decision on any such request shall be given to the 

individual who made the request; 

(C) to correct errors apparent on the face of such records; 

(D) to transfer items to records of the Railroad Retirement Board if such items were credited under this title 

when they should have been credited under the Railroad 

Retirement Act of 1937 or 1974, or to enter items transferred by the Railroad Retirement Board which have been 

credited under the Railroad Retirement Act of 1937 or 

1974 when they should have been credited under this title; 

(E) to delete or reduce the amount of any entry which 

is erroneous as a result of fraud; 

(F) to conform his records to— 

(i) tax returns or portions thereof (including information returns and other written statements) filed 

with the Commissioner of Internal Revenue under 

title VIII of the Social Security Act, under subchapter 

E of chapter 1 or subchapter A of chapter 9 of the Internal Revenue Code of 1939, under chapter 2 or 21 of 

the Internal Revenue Code of 1954 or the Internal 

31 

Revenue Code of 1986, or under regulations made 

under authority of such title, subchapter, or chapter; 

(ii) wage reports filed by a State pursuant to an 

agreement under section 218 or regulations of the 

Commissioner of Social Security thereunder; or 

(iii) assessments of amounts due under an agreement pursuant to section 218 (as in effect prior to December 31, 1986), if such assessments are made within 

the period specified in subsection (q) of such section 

(as so in effect), or allowances of credits or refunds of 

overpayments by a State under an agreement pursuant to such section; except that no amount of self-employment income of an individual for any taxable year 

(if such return or statement was filed after the expiration of the time limitation following the taxable year) 

shall be included in the Commissioner’s records pursuant to this subparagraph; 

(G) to correct errors made in the allocation, to individuals or periods, of wages or self- employment income entered in the records of the Commissioner of Social Security; 

(H) to include wages paid during any period in such year 

to an individual by an employer; 

(I) to enter items which constitute remuneration for employment under subsection (o), such entries to be in accordance with certified reports of records made by the 

Railroad Retirement Board pursuant to section 5(k)(3) of 

the Railroad Retirement Act of 1937 or section 7(b)(7) of 

the Railroad Retirement Act of 1974; or 

(J) to include self-employment income for any taxable 

year, up to, but not in excess of, the amount of wages deleted by the Commissioner of Social Security as payments 

erroneously included in such records as wages paid to such 

individual, if such income (or net earnings from self-employment), not already included in such records as self-employment income, is included in a return or statement (referred to in subparagraph (F)) filed before the expiration 

of the time limitation following the taxable year in which 

such deletion of wages is made. 

(6) Written notice of any deletion or reduction under paragraph (4) or (5) shall be given to the individual whose record 

is involved or to his survivor, except that (A) in the case of a 

deletion or reduction with respect to any entry of wages such 

notice shall be given to such individual only if he has previously been notified by the Commissioner of Social Security of 

the amount of his wages for the period involved, and (B) such 

notice shall be given to such survivor only if he or the individual whose record is involved has previously been notified by 

the Commissioner of Social Security of the amount of such individual’s wages and self-employment income for the period involved. 

(7) Upon request in writing (within such period, after any 

change or refusal of a request for a change of the Commissioner’s records pursuant to this subsection, as the Commissioner of Social Security may prescribe), opportunity for hearVerDate Aug 31 2005 13:27 Dec 19, 2005 Jkt 049010 PO 00000 Frm 00033 Fmt 6659 Sfmt 6601 E:\HR\OC\SR203.XXX SR203
32 

ing with respect to such change or refusal shall be afforded to 

any individual or his survivor. If a hearing is held pursuant to 

this paragraph the Commissioner of Social Security shall make 

findings of fact and a decision based upon the evidence adduced at such hearing and shall include any omitted items, or 

change or delete any entry, in the Commissioner’s records as 

may be required by such findings and decision. 

(8) A translation into English by a third party of a statement 

made in a foreign language by an applicant for or beneficiary 

of monthly insurance benefits under this title shall not be regarded as reliable for any purpose under this title unless the 

third party, under penalty of perjury— 

(A) certifies that the translation is accurate; and 

(B) discloses the nature and scope of the relationship between the third party and the applicant or recipient, as 

the case may be. 

(9) Decisions of the Commissioner of Social Security under 

this subsection shall be reviewable by commencing a civil action in the United States district court as provided in subsection (g). 

(d) ISSUANCE OF SUBPENAS IN ADMINISTRATIVE PROCEEDINGS.— For the purpose of any hearing, investigation, or other proceeding 

authorized or directed under this title, or relative to any other matter within the the Commissioner’s jurisdiction hereunder, the Commissioner of Social Security shall have power to issue subpenas requiring the attendance and testimony of witnesses and the production of any evidence that relates to any matter under investigation 

or in question before the Commissioner of Social Security. Such attendance of witnesses and production of evidence at the designated 

place of such hearing, investigation, or other proceeding may be required from any place in the United States or in any Territory or 

possession thereof. Subpenas of the Commissioner of Social Security shall be served by anyone authorized by the Commissioner (1) 

by delivering a copy thereof to the individual named therein, or (2) 

by registered mail or by certified mail addressed to such individual 

at his last dwelling place or principal place of business. A verified 

return by the individual so serving the subpena setting forth the 

manner of service, or, in the case of service by registered mail or 

by certified mail, the return post-office receipt therefor signed by 

the individual so served, shall be proof of service. Witnesses so subpenaed shall be paid the same fees and mileage as are paid witnesses in the district courts of the United States. 

(e) JUDICIAL ENFORCEMENT OF SUBPENAS; CONTEMPT.—In case of 

contumacy by, or refusal to obey a subpena duly served upon, any 

person, any district court of the United States for the judicial district in which said person charged with contumacy or refusal to 

obey is found or resides or transacts business, upon application by 

the Commissioner of Social Security, shall have jurisdiction to issue 

an order requiring such person to appear and give testimony, or to 

appear and produce evidence, or both; any failure to obey such 

order of the court may be punished by said court as contempt 

thereof. 

(f) [Repealed] 

(g) JUDICIAL REVIEW.—Any individual, after any final decision of 

the Commissioner of Social Security made after a hearing to which 

33 

he was a party, irrespective of the amount in controversy, may obtain a review of such decision by a civil action commenced within 

sixty days after the mailing to him of notice of such decision or 

within such further time as the Commissioner of Social Security 

may allow. Such action shall be brought in the district court of the 

United States for the judicial district in which the plaintiff resides, 

or has his principal place of business, or, if he does not reside or 

have his principal place of business within any such judicial district, in the District Court of the United States for the District of 

Columbia. As part of the Commissioner’s answer the Commissioner 

of Social Security shall file a certified copy of the transcript of the 

record including the evidence upon which the findings and decision 

complained of are based. The court shall have power to enter, upon 

the pleadings and transcript of the record, a judgment affirming, 

modifying, or reversing the decision of the Commissioner of Social 

Security, with or without remanding the cause for a rehearing. The 

findings of the Commissioner of Social Security as to any fact, if 

supported by substantial evidence, shall be conclusive, and where 

a claim has been denied by the Commissioner of Social Security or 

a decision is rendered under subsection (b) hereof which is adverse 

to an individual who was a party to the hearing before the Commissioner of Social Security, because of failure of the claimant or 

such individual to submit proof in conformity with any regulation 

prescribed under subsection (a) hereof, the court shall review only 

the question of conformity with such regulations and the validity 

of such regulations. The court may, on motion of the Commissioner 

of Social Security made for good cause shown before the Commissioner files the Commissioner’s answer, remand the case to the 

Commissioner of Social Security for further action by the Commissioner of Social Security, and it may at any time order additional 

evidence to be taken before the Commissioner of Social Security, 

but only upon a showing that there is new evidence which is material and that there is good cause for the failure to incorporate such 

evidence into the record in a prior proceeding; and the Commissioner of Social Security shall, after the case is remanded, and 

after hearing such additional evidence if so ordered, modify or affirm the Commissioner’s findings of fact or the Commissioner’s decision, or both, and shall file with the court any such additional 

and modified findings of fact and decision, and, in any case in 

which the Commissioner has not made a decision fully favorable to 

the individual, a transcript of the additional record and testimony 

upon which the Commissioner’s action in modifying or affirming 

was based. Such additional or modified findings of fact and decision 

shall be reviewable only to the extent provided for review of the 

original findings of fact and decision. The judgment of the court 

shall be final except that it shall be subject to review in the same 

manner as a judgment in other civil actions. Any action instituted 

in accordance with this subsection shall survive notwithstanding 

any change in the person occupying the office of Commissioner of 

Social Security or any vacancy in such office. 

(h) FINALITY OF COMMISSIONER’S DECISION.—The findings and decisions of the Commissioner of Social Security after a hearing shall 

be binding upon all individuals who were parties to such hearing. 

No findings of fact or decision of the Commissioner of Social Security shall be reviewed by any person, tribunal, or governmental 

34 

agency except as herein provided. No action against the United 

States, the Commissioner of Social Security, or any officer or employee thereof shall be brought under section 1331 or 1346 of title 

28, United States Code, to recover on any claim arising under this 

title. 

(i) CERTIFICATION FOR PAYMENT.—Upon final decision of the 

Commissioner of Social Security, or upon final judgment of any 

court of competent jurisdiction, that any person is entitled to any 

payment or payments under this title, the Commissioner of Social 

Security shall certify to the Managing Trustee the name and address of the person so entitled to receive such payment or payments, the amount of such payment or payments, and the time at 

which such payment or payments should be made, and the Managing Trustee, through the Fiscal Service of the Department of the 

Treasury, and prior to any action thereon by the General Accounting Office, shall make payment in accordance with the certification 

of the Commissioner of Social Security (except that in the case of 

(A) an individual who will have completed ten years of service (or 

five or more years of service, all of which accrues after December 

31, 1995) creditable under the Railroad Retirement Act of 1937 or 

the Railroad Retirement Act of 1974, (B) the wife or husband of 

such an individual, (C) any survivor of such an individual if such 

survivor is entitled, or could upon application become entitled, to 

an annuity under section 2 of the Railroad Retirement Act of 1974, 

and (D) any other person entitled to benefits under section 202 of 

this Act on the basis of the wages and self-employment income of 

such an individual (except a survivor of such an individual where 

such individual did not have a current connection with the railroad 

industry, as defined in the Railroad Retirement Act of 1974, at the 

time of his death), such certification shall be made to the Railroad 

Retirement Board which shall provide for such payment or payments to such person on behalf of the Managing Trustee in accordance with the provisions of the Railroad Retirement Act of 1974): 

Provided, That where a review of the Commissioner’s decision is or 

may be sought under subsection (g) the Commissioner of Social Security may withhold certification of payment pending such review. 

The Managing Trustee shall not be held personally liable for any 

payment or payments made in accordance with a certification by 

the Commissioner of Social Security. 

(j) REPRESENTATIVE PAYEES.— 

(1)(A) If the Commissioner of Social Security determines that 

the interest of any individual under this title would be served 

thereby, certification of payment of such individual’s benefit 

under this title may be made, regardless of the legal competency or incompetency of the individual, either for direct 

payment to the individual, or for his or her use and benefit, to 

another individual, or an organization, with respect to whom 

the requirements of paragraph (2) have been met (hereinafter 

in this subsection referred to as the individual’s ‘‘representative payee’’). If the Commissioner of Social Security or a court 

of competent jurisdiction determines that a representative 

payee has misused any individual’s benefit paid to such representative payee pursuant to this subsection or section 807 or 

1631(a)(2), the Commissioner of Social Security shall promptly 

revoke certification for payment of benefits to such representaVerDate Aug 31 2005 13:27 Dec 19, 2005 Jkt 049010 PO 00000 Frm 00036 Fmt 6659 Sfmt 6601 E:\HR\OC\SR203.XXX SR203
35 

tive payee pursuant to this subsection and certify payment to 

an alternative representative payee or, if the interest of the individual under this title would be served thereby, to the individual. 

(B) In the case of an individual entitled to benefits based on 

disability, the payment of such benefits shall be made to a representative payee if the Commissioner of Social Security determines that such payment would serve the interest of the individual because the individual also has an alcoholism or drug 

addiction condition (as determined by the Commissioner) and 

the individual is incapable of managing such benefits. 

(2)(A) Any certification made under paragraph (1) for payment of benefits to an individual’s representative payee shall 

be made on the basis of— 

(i) an investigation by the Commissioner of Social Security of the person to serve as representative payee, which 

shall be conducted in advance of such certification and 

shall, to the extent practicable, include a face-to-face interview with such person, and 

(ii) adequate evidence that such certification is in the interest of such individual (as determined by the Commissioner of Social Security in regulations). 

(B)(i) As part of the investigation referred to in subparagraph (A)(i), the Commissioner of Social Security shall— 

(I) require the person being investigated to submit documented proof of the identity of such person, unless information establishing such identity has been submitted with 

an application for benefits under this title, title VIII, or 

title XVI, 

(II) verify such person’s social security account number 

(or employer identification number), 

(III) determine whether such person has been convicted 

of a violation of section 208, 811, or 1632, 

(IV) obtain information concerning whether such person 

has been convicted of any other offense under Federal or 

State law which resulted in imprisonment for more than 

1 year, 

(V) obtain information concerning whether such person 

is a person described in section 202(x)(1)(A)(iv), and 

(VI) determine whether certification of payment of benefits to such person has been revoked pursuant to this subsection, the designation of such person as a representative 

payee has been revoked pursuant to section 807(a), or payment of benefits to such person has been terminated pursuant to section 1631(a)(2)(A)(iii) by reason of misuse of 

funds paid as benefits under this title, title VIII, or title 

XVI. 

(ii) The Commissioner of Social Security shall establish and 

maintain a centralized file, which shall be updated periodically 

and which shall be in a form which renders it readily retrievable by each servicing office of the Social Security Administration. Such file shall consist of— 

(I) a list of the names and social security account numbers (or employer identification numbers) of all persons 

with respect to whom certification of payment of benefits 

36 

has been revoked on or after January 1, 1991, pursuant to 

this subsection, whose designation as a representative 

payee has been revoked pursuant to section 807(a), or with 

respect to whom payment of benefits has been terminated 

on or after such date pursuant to section 1631(a)(2)(A)(iii), 

by reason of misuse of funds paid as benefits under this 

title, title VIII, or title XVI, and 

(II) a list of the names and social security account numbers (or employer identification numbers) of all persons 

who have been convicted of a violation of section 208, 811, 

or 1632. 

(iii) Notwithstanding the provisions of section 552a of title 5, 

United States Code, or any other provision of Federal or State 

law (other than section 6103 of the Internal Revenue Code of 

1986 and section 1106(c) of this Act), the Commissioner shall 

furnish any Federal, State, or local law enforcement officer, 

upon the written request of the officer, with the current address, social security account number, and photograph (if applicable) of any person investigated under this paragraph, if the 

officer furnishes the Commissioner with the name of such person and such other identifying information as may reasonably 

be required by the Commissioner to establish the unique identity of such person, and notifies the Commissioner that— 

(I) such person is described in section 202(x)(1)(A)(iv), 

(II) such person has information that is necessary for the 

officer to conduct the officer’s official duties, and 

(III) the location or apprehension of such person is within the officer’s official duties. 

(C)(i) Benefits of an individual may not be certified for payment to any other person pursuant to this subsection if— 

(I) such person has previously been convicted as described in subparagraph (B)(i)(III), 

(II) except as provided in clause (ii), certification of payment of benefits to such person under this subsection has 

previously been revoked as described in subparagraph 

(B)(i)(VI) the designation of such person as a representative payee has been revoked pursuant to section 807(a), or 

payment of benefits to such person pursuant to section 

1631(a)(2)(A)(ii) has previously been terminated as described in section 1631(a)(2)(B)(ii)(VI), 

(III) except as provided in clause (iii), such person is a 

creditor of such individual who provides such individual 

with goods or services for consideration, 

(IV) such person has previously been convicted as described in subparagraph (B)(i)(IV), unless the Commissioner determines that such certification would be appropriate notwithstanding such conviction, or 

(V) such person is a person described in section 

202(x)(1)(A)(iv). 

(ii) The Commissioner of Social Security shall prescribe regulations under which the Commissioner of Social Security may 

grant exemptions to any person from the provisions of clause 

(i)(II) on a case-by-case basis if such exemption is in the best 

interest of the individual whose benefits would be paid to such 

person pursuant to this subsection. 

37 

(iii) Clause (i)(III) shall not apply with respect to any person 

who is a creditor referred to therein if such creditor is— 

(I) a relative of such individual if such relative resides 

in the same household as such individual, 

(II) a legal guardian or legal representative of such individual, 

(III) a facility that is licensed or certified as a care facility under the law of a State or a political subdivision of a 

State, 

(IV) a person who is an administrator, owner, or employee of a facility referred to in subclause (III) if such individual resides in such facility, and the certification of 

payment to such facility or such person is made only after 

good faith efforts have been made by the local servicing office of the Social Security Administration to locate an alternative representative payee to whom such certification 

of payment would serve the best interests of such individual, or 

(V) an individual who is determined by the Commissioner of Social Security, on the basis of written findings 

and under procedures which the Commissioner of Social 

Security shall prescribe by regulation, to be acceptable to 

serve as a representative payee. 

(iv) The procedures referred to in clause (iii)(V) shall require 

the individual who will serve as representative payee to establish, to the satisfaction of the Commissioner of Social Security, 

that— 

(I) such individual poses no risk to the beneficiary, 

(II) the financial relationship of such individual to the 

beneficiary poses no substantial conflict of interest, and 

(III) no other more suitable representative payee can be 

found. 

(v) In the case of an individual described in paragraph (1)(B), 

when selecting such individual’s representative payee, preference shall be given to— 

(I) a certified community-based nonprofit social service 

agency (as defined in paragraph (10)), 

(II) a Federal, State, or local government agency whose 

mission is to carry out income maintenance, social service, 

or health care-related activities, 

(III) a State or local government agency with fiduciary 

responsibilities, or 

(IV) a designee of an agency (other than of a Federal 

agency) referred to in the preceding subclauses of this 

clause, if the Commissioner of Social Security deems it appropriate, unless the Commissioner of Social Security determines that selection of a family member would be appropriate. 

(D)(i) Subject to clause (ii), if the Commissioner of Social Security makes a determination described in the first sentence of 

paragraph (1) with respect to any individual’s benefit and determines that direct payment of the benefit to the individual 

would cause substantial harm to the individual, the Commissioner of Social Security may defer (in the case of initial entitlement) or suspend (in the case of existing entitlement) direct 

38 

payment of such benefit to the individual, until such time as 

the selection of a representative payee is made pursuant to 

this subsection. 

(ii)(I) Except as provided in subclause (II), any deferral or 

suspension of direct payment of a benefit pursuant to clause (i) 

shall be for a period of not more than 1 month. 

(II) Subclause (I) shall not apply in any case in which the individual is, as of the date of the Commissioner’s determination, 

legally incompetent, under the age of 15 years, or described in 

paragraph (1)(B). 

(iii) Payment pursuant to this subsection of any benefits 

which are deferred or suspended pending the selection of a representative payee shall be made to the individual or the representative payee as a single sum or over such period of time 

as the Commissioner of Social Security determines is in the 

best interest of the individual entitled to such benefits. 

(E)(i) Any individual who is dissatisfied with a determination 

by the Commissioner of Social Security to certify payment of 

such individual’s benefit to a representative payee under paragraph (1) or with the designation of a particular person to 

serve as representative payee shall be entitled to a hearing by 

the Commissioner of Social Security to the same extent as is 

provided in subsection (b), and to judicial review of the Commissioner’s final decision as is provided in subsection (g). 

(ii) In advance of the certification of payment of an individual’s benefit to a representative payee under paragraph (1), the 

Commissioner of Social Security shall provide written notice of 

the Commissioner’s initial determination to certify such payment. Such notice shall be provided to such individual, except 

that, if such individual— 

(I) is under the age of 15, 

(II) is an unemancipated minor under the age of 18, or 

(III) is legally incompetent, then such notice shall be 

provided solely to the legal guardian or legal representative of such individual. 

(iii) Any notice described in clause (ii) shall be clearly written in language that is easily understandable to the reader, 

shall identify the person to be designated as such individual’s 

representative payee, and shall explain to the reader the right 

under clause (i) of such individual or of such individual’s legal 

guardian or legal representative— 

(I) to appeal a determination that a representative payee 

is necessary for such individual, 

(II) to appeal the designation of a particular person to 

serve as the representative payee of such individual, and 

(III) to review the evidence upon which such designation 

is based and submit additional evidence. 

(3)(A) In any case where payment under this title is made 

to a person other than the individual entitled to such payment, 

the Commissioner of Social Security shall establish a system of 

accountability monitoring whereby such person shall report not 

less often than annually with respect to the use of such payments. The Commissioner of Social Security shall establish and 

implement statistically valid procedures for reviewing such reVerDate Aug 31 2005 13:27 Dec 19, 2005 Jkt 049010 PO 00000 Frm 00040 Fmt 6659 Sfmt 6601 E:\HR\OC\SR203.XXX SR203
39 

ports in order to identify instances in which such persons are 

not properly using such payments. 

(B) Subparagraph (A) shall not apply in any case where the 

other person to whom such payment is made is a State institution. In such cases, the Commissioner of Social Security shall 

establish a system of accountability monitoring for institutions 

in each State. 

(C) Subparagraph (A) shall not apply in any case where the 

individual entitled to such payment is a resident of a Federal 

institution and the other person to whom such payment is 

made is the institution. 

(D) Notwithstanding subparagraphs (A), (B), and (C), the 

Commissioner of Social Security may require a report at any 

time from any person receiving payments on behalf of another, 

if the Commissioner of Social Security has reason to believe 

that the person receiving such payments is misusing such payments. 

(E) In any case in which the person described in subparagraph (A) or (D) receiving payments on behalf of another fails 

to submit a report required by the Commissioner of Social Security under subparagraph (A) or (D), the Commissioner may, 

after furnishing notice to such person and the individual entitled to such payment, require that such person appear in person at a field office of the Social Security Administration serving the area in which the individual resides in order to receive 

such payments. 

(F) The Commissioner of Social Security shall maintain a 

centralized file, which shall be updated periodically and which 

shall be in a form which will be readily retrievable by each 

servicing office of the Social Security Administration, of— 

(i) the address and the social security account number 

(or employer identification number) of each representative 

payee who is receiving benefit payments pursuant to this 

subsection, section 807, or section 1631(a)(2), and 

(ii) the address and social security account number of 

each individual for whom each representative payee is reported to be providing services as representative payee 

pursuant to this subsection, section 807, or section 

1631(a)(2). 

(G) Each servicing office of the Administration shall maintain a list, which shall be updated periodically, of public agencies and certified community-based nonprofit social service 

agencies (as defined in paragraph (10)) which are qualified to 

serve as representative payees pursuant to this subsection or 

section 807 or 1631(a)(2) and which are located in the area 

served by such servicing office. 

(4)(A)(i) Except as provided in the next sentence, a qualified 

organization may collect from an individual a monthly fee for 

expenses (including overhead) incurred by such organization in 

providing services performed as such individual’s representative payee pursuant to this subsection if such fee does not exceed the lesser of— 

(I) 10 percent of the monthly benefit involved, or 

(II) $25.00 per month ($50.00 per month in any case in 

which the individual is described in paragraph (1)(B)). A 

40 

qualified organization may not collect a fee from an individual for any month with respect to which the Commissioner of Social Security or a court of competent jurisdiction has determined that the organization misused all or 

part of the individual’s benefit, and any amount so collected by the qualified organization for such month shall 

be treated as a misused part of the individual’s benefit for 

purposes of paragraphs (5) and (6). The Commissioner of 

Social Security shall adjust annually (after 1995) each dollar amount set forth in subclause (II) under procedures 

providing for adjustments in the same manner and to the 

same extent as adjustments are provided for under the 

procedures used to adjust benefit amounts under section 

215(i)(2)(A), except that any amount so adjusted that is not 

a multiple of $ 1.00 shall be rounded to the nearest multiple of $1.00. 

(ii) In the case of an individual who is no longer currently 

entitled to monthly insurance benefits under this title but to 

whom all past-due benefits have not been paid, for purposes of 

clause (i), any amount of such past-due benefits payable in any 

month shall be treated as a monthly benefit referred to in 

clause (i)(I). Any agreement providing for a fee in excess of the 

amount permitted under this subparagraph shall be void and 

shall be treated as misuse by such organization of such individual’s benefits. 

(B) For purposes of this paragraph, the term ‘‘qualified organization’’ means any State or local government agency whose 

mission is to carry out income maintenance, social service, or 

health care-related activities, any State or local government 

agency with fiduciary responsibilities, or any certified community-based nonprofit social service agency (as defined in paragraph (10)), if such agency, in accordance with any applicable 

regulations of the Commissioner of Social Security— 

(i) regularly provides services as the representative 

payee, pursuant to this subsection or section 807 or 

1631(a)(2), concurrently to 5 or more individuals, 

(ii) demonstrates to the satisfaction of the Commissioner 

of Social Security that such agency is not otherwise a creditor of any such individual. The Commissioner of Social Security shall prescribe regulations under which the Commissioner of Social Security may grant an exception from 

clause (ii) for any individual on a case-by-case basis if such 

exception is in the best interests of such individual. 

(C) Any qualified organization which knowingly charges or 

collects, directly or indirectly, any fee in excess of the maximum fee prescribed under subparagraph (A) or makes any 

agreement, directly or indirectly, to charge or collect any fee in 

excess of such maximum fee, shall be fined in accordance with 

title 18, United States Code, or imprisoned not more than 6 

months, or both. 

(5) In cases where the negligent failure of the Commissioner 

of Social Security to investigate or monitor a representative 

payee results in misuse of benefits by the representative payee, 

the Commissioner of Social Security shall certify for payment 

to the beneficiary or the beneficiary’s alternative representaVerDate Aug 31 2005 13:27 Dec 19, 2005 Jkt 049010 PO 00000 Frm 00042 Fmt 6659 Sfmt 6601 E:\HR\OC\SR203.XXX SR203
41 

tive payee an amount equal to such misused benefits. In any 

case in which a representative payee that— 

(A) is not an individual (regardless of whether it is a 

‘‘qualified organization’’ within the meaning of paragraph 

(4)(B)); or 

(B) is an individual who, for any month during a period 

when misuse occurs, serves 15 or more individuals who are 

beneficiaries under this title, title VIII, title XVI, or any 

combination of such titles; misuses all or part of an individual’s benefit paid to such representative payee, the 

Commissioner of Social Security shall certify for payment 

to the beneficiary or the beneficiary’s alternative representative payee an amount equal to the amount of such 

benefit so misused. The provisions of this paragraph are 

subject to the limitations of paragraph (7)(B). The Commissioner of Social Security shall make a good faith effort 

to obtain restitution from the terminated representative 

payee. 

(6)(A) In addition to such other reviews of representative 

payees as the Commissioner of Social Security may otherwise 

conduct, the Commissioner shall provide for the periodic onsite 

review of any person or agency located in the United States 

that receives the benefits payable under this title (alone or in 

combination with benefits payable under title VIII or title XVI) 

to another individual pursuant to the appointment of such person or agency as a representative payee under this subsection, 

section 807, or section 1631(a)(2) in any case in which— 

(i) the representative payee is a person who serves in 

that capacity with respect to 15 or more such individuals; 

(ii) the representative payee is a certified communitybased nonprofit social service agency (as defined in paragraph (10) of this subsection or section 1631(a)(2)(I)); or 

(iii) the representative payee is an agency (other than an 

agency described in clause (ii)) that serves in that capacity 

with respect to 50 or more such individuals. 

(B) Within 120 days after the end of each fiscal year, the 

Commissioner shall submit to the Committee on Ways and 

Means of the House of Representatives and the Committee on 

Finance of the Senate a report on the results of periodic onsite 

reviews conducted during the fiscal year pursuant to subparagraph (A) and of any other reviews of representative payees 

conducted during such fiscal year in connection with benefits 

under this title. Each such report shall describe in detail all 

problems identified in such reviews and any corrective action 

taken or planned to be taken to correct such problems, and 

shall include— 

(i) the number of such reviews; 

(ii) the results of such reviews; 

(iii) the number of cases in which the representative 

payee was changed and why; 

(iv) the number of cases involving the exercise of expedited, targeted oversight of the representative payee by the 

Commissioner conducted upon receipt of an allegation of 

misuse of funds, failure to pay a vendor, or a similar irregularity; 

42 

(v) the number of cases discovered in which there was a 

misuse of funds; 

(vi) how any such cases of misuse of funds were dealt 

with by the Commissioner; 

(vii) the final disposition of such cases of misuse of 

funds, including any criminal penalties imposed; and 

(viii) such other information as the Commissioner deems 

appropriate. 

(7)(A) If the Commissioner of Social Security or a court of 

competent jurisdiction determines that a representative payee 

that is not a Federal, State, or local government agency has 

misused all or part of an individual’s benefit that was paid to 

such representative payee under this subsection, the representative payee shall be liable for the amount misused, and such 

amount (to the extent not repaid by the representative payee) 

shall be treated as an overpayment of benefits under this title 

to the representative payee for all purposes of this Act and related laws pertaining to the recovery of such overpayments. 

Subject to subparagraph (B), upon recovering all or any part 

of such amount, the Commissioner shall certify an amount 

equal to the recovered amount for payment to such individual 

or such individual’s alternative representative payee. 

(B) The total of the amount certified for payment to such individual or such individual’s alternative representative payee 

under subparagraph (A) and the amount certified for payment 

under paragraph (5) may not exceed the total benefit amount 

misused by the representative payee with respect to such individual. 

(8) For purposes of this subsection, the term ‘‘benefit based 

on disability’’ of an individual means a disability insurance 

benefit of such individual under section 223 or a child’s, widow’s, or widower’s insurance benefit of such individual under 

section 202 based on such individual’s disability. 

(9) For purposes of this subsection, misuse of benefits by a 

representative payee occurs in any case in which the representative payee receives payment under this title for the use and 

benefit of another person and converts such payment, or any 

part thereof, to a use other than for the use and benefit of such 

other person. The Commissioner of Social Security may prescribe by regulation the meaning of the term ‘‘use and benefit’’ 

for purposes of this paragraph. 

(10) For purposes of this subsection, the term ‘‘certified community-based nonprofit social service agency’’ means a community-based nonprofit social service agency which is in compliance with requirements, under regulations which shall be prescribed by the Commissioner, for annual certification to the 

Commissioner that it is bonded in accordance with requirements specified by the Commissioner and that it is licensed in 

each State in which it serves as a representative payee (if licensing is available in the State) in accordance with requirements specified by the Commissioner. Any such annual certification shall include a copy of any independent audit on the 

agency which may have been performed since the previous certification. 

43 

(k) PAYMENTS TO INCOMPETENTS.—Any payment made after December 31, 1939, under conditions set forth in subsection (j) any 

payment made before January 1, 1940, to, or on behalf of, a legally 

incompetent individual, and any payment made after December 31, 

1939, to a legally incompetent individual without knowledge by the 

Commissioner of Social Security of incompetency prior to certification of payment, if otherwise valid under this title, shall be a 

complete settlement and satisfaction of any claim, right, or interest 

in and to such payment. 

(l) DELEGATION OF POWERS AND DUTIES BY COMMISSIONER OF SOCIAL SECURITY.—The Commissioner of Social Security is authorized 

to delegate to any member, officer, or employee of the Social Security Administration designated by the Commissioner any of the 

powers conferred upon the Commissioner by this section, and is authorized to be represented by the Commissioner’s own attorneys in 

any court in any case or proceeding arising under the provisions of 

subsection (e). 

(m) [Repealed] 

(n) JOINT PAYMENTS.—The Commissioner of Social Security may, 

in the Commissioner’s discretion, certify to the Managing Trustee 

any two or more individuals of the same family for joint payment 

of the total benefits payable to such individuals for any month, and 

if one of such individuals dies before a check representing such 

joint payment is negotiated, payment of the amount of such unnegotiated check to the surviving individual or individuals may be authorized in accordance with regulations of the Secretary of the 

Treasury; except that appropriate adjustment or recovery shall be 

made under section 204(a) with respect to so much of the amount 

of such check as exceeds the amount to which such surviving individual or individuals are entitled under this title for such month. 

(o) CREDITING OF COMPENSATION UNDER THE RAILROAD RETIREMENT ACT.—If there is no person who would be entitled, upon application therefor, to an annuity under section 5 of the Railroad Retirement Act of 1974, or to a lump-sum payment under section 6(b) 

of such Act, with respect to the death of an employee (as defined 

in such Act), then, notwithstanding section 210(a)(10) of this Act, 

compensation (as defined in such Railroad Retirement Act, but excluding compensation attributable as having been paid during any 

month on account of military service creditable under section 3(i) 

of such Act if wages are deemed to have been paid to such employee during such month under subsection (a) or (e) of section 217 

of this Act) of such employee shall constitute remuneration for employment for purposes of determining (A) entitlement to and the 

amount of any lump-sum death payment under this title on the 

basis of such employee’s wages and self-employment income and 

(B) entitlement to and the amount of any monthly benefit under 

this title, for the month in which such employee died or for any 

month thereafter, on the basis of such wages and self-employment 

income. For such purposes, compensation (as so defined) paid in a 

calendar year before 1978 shall, in the absence of evidence to the 

contrary, be presumed to have been paid in equal proportions with 

respect to all months in the year in which the employee rendered 

services for such compensation. 

(p) SPECIAL RULES IN CASE OF FEDERAL SERVICE.— 

44 

(1) With respect to service included as employment under 

section 210 which is performed in the employ of the United 

States or in the employ of any instrumentality which is wholly 

owned by the United States, including service, performed as a 

member of a uniformed service, to which the provisions of subsection (l)(1) of such section are applicable, and including service, performed as a volunteer or volunteer leader within the 

meaning of the Peace Corps Act, to which the provisions of section 210(o) are applicable, the Commissioner of Social Security 

shall not make determinations as to the amounts of remuneration for such service, or the periods in which or for which such 

remuneration was paid, but shall accept the determinations 

with respect thereto of the head of the appropriate Federal 

agency or instrumentality, and of such agents as such head 

may designate, as evidenced by returns filed in accordance 

with the provisions of section 3122 of the Internal Revenue 

Code of 1954 and certifications made pursuant to this subsection. Such determinations shall be final and conclusive. 

Nothing in this paragraph shall be construed to affect the 

Commissioner’s authority to determine under sections 209 and 

210 whether any such service constitutes employment, the periods of such employment, and whether remuneration paid for 

any such service constitutes wages. 

(2) The head of any such agency or instrumentality is authorized and directed, upon written request of the Commissioner of Social Security, to make certification to the Commissioner with respect to any matter determinable for the Commissioner of Social Security by such head or his agents under 

this subsection, which the Commissioner of Social Security 

finds necessary in administering this title. 

(3) The provisions of paragraphs (1) and (2) shall be applicable in the case of service performed by a civilian employee, not 

compensated from funds appropriated by the Congress, in the 

Army and Air Force Exchange Service, Army and Air Force 

Motion Picture Service, Navy Exchanges, Marine Corps Exchanges, or other activities, conducted by an instrumentality of 

the United States subject to the jurisdiction of the Secretary of 

Defense, at installations of the Department of Defense for the 

comfort, pleasure, contentment, and mental and physical improvement of personnel of such Department; and for purposes 

of paragraphs (1) and (2) the Secretary of Defense shall be 

deemed to be the head of such instrumentality. The provisions 

of paragraphs (1) and (2) shall be applicable also in the case 

of service performed by a civilian employee, not compensated 

from funds appropriated by the Congress, in the Coast Guard 

Exchanges or other activities, conducted by an instrumentality 

of the United States subject to the jurisdiction of the Secretary 

of Transportation, at installations of the Coast Guard for the 

comfort, pleasure, contentment, and mental and physical improvement of personnel of the Coast Guard; and for purposes 

of paragraphs (1) and (2) the Secretary of Transportation shall 

be deemed to be the head of such instrumentality. 

(q) EXPEDITED BENEFIT PAYMENTS.— 

(1) The Commissioner of Social Security shall establish and 

put into effect procedures under which expedited payment of 

45 

monthly insurance benefits under this title will, subject to 

paragraph (4) of this subsection, be made as set forth in paragraphs (2) and (3) of this subsection. 

(2) In any case in which— 

(A) an individual makes an allegation that a monthly 

benefit under this title was due him in a particular month 

but was not paid to him, and 

(B) such individual submits a written request for the 

payment of such benefit— 

(i) in the case of an individual who received a regular monthly benefit in the month preceding the 

month with respect to which such allegation is made, 

not less than 30 days after the 15th day of the month 

with respect to which such allegation is made (and in 

the event that such request is submitted prior to the 

expiration of such 30-day period, it shall be deemed to 

have been submitted upon the expiration of such period), and 

(ii) in any other case, not less than 90 days after the 

later of (I) the date on which such benefit is alleged 

to have been due, or (II) the date on which such individual furnished the last information requested by the 

Commissioner of Social Security (and such written request will be deemed to be filed on the day on which 

it was filed, or the ninetieth day after the first day on 

which the Commissioner of Social Security has evidence that such allegation is true, whichever is later), 

the Commissioner of Social Security shall, if the Commissioner finds that benefits are due, certify such benefits for payment, and payment shall be made within 

15 days immediately following the date on which the 

written request is deemed to have been filed. 

(3) In any case in which the Commissioner of Social Security 

determines that there is evidence, although additional evidence 

might be required for a final decision, that an allegation described in paragraph (2)(A) is true, the Commissioner may 

make a preliminary certification of such benefit for payment 

even though the 30-day or 90-day periods described in paragraph (2)(B)(i) and (B)(ii) have not elapsed. 

(4) Any payment made pursuant to a certification under 

paragraph (3) of this subsection shall not be considered an incorrect payment for purposes of determining the liability of the 

certifying or disbursing officer. 

(5) For purposes of this subsection, benefits payable under 

section 228 shall be treated as monthly insurance benefits payable under this title. However, this subsection shall not apply 

with respect to any benefit for which a check has been negotiated, or with respect to any benefit alleged to be due under 

either section 223, or section 202 to a wife, husband, or child 

of an individual entitled to or applying for benefits under section 223, or to a child who has attained age 18 and is under 

a disability, or to a widow or widower on the basis of being 

under a disability. 

(r) USE OF DEATH CERTIFICATES TO CORRECT PROGRAM INFORMATION.— 

46 

(1) The Commissioner of Social Security shall undertake to 

establish a program under which— 

(A) States (or political subdivisions thereof) voluntarily 

contract with the Commissioner of Social Security to furnish the Commissioner of Social Security periodically with 

information (in a form established by the Commissioner of 

Social Security in consultation with the States) concerning 

individuals with respect to whom death certificates (or 

equivalent documents maintained by the States or subdivisions) have been officially filed with them; and 

(B) there will be (i) a comparison of such information on 

such individuals with information on such individuals in 

the records being used in the administration of this Act, 

(ii) validation of the results of such comparisons, and (iii) 

corrections in such records to accurately reflect the status 

of such individuals. 

(2) Each State (or political subdivision thereof) which furnishes the Commissioner of Social Security with information 

on records of deaths in the State or subdivision under this subsection may be paid by the Commissioner of Social Security 

from amounts available for administration of this Act the reasonable costs (established by the Commissioner of Social Security in consultations with the States) for transcribing and 

transmitting such information to the Commissioner of Social 

Security. 

(3) In the case of individuals with respect to whom federally 

funded benefits are provided by (or through) a Federal or State 

agency other than under this Act, the Commissioner of Social 

Security shall to the extent feasible provide such information 

through a cooperative arrangement with such agency, for ensuring proper payment of those benefits with respect to such 

individuals if— 

(A) under such arrangement the agency provides reimbursement to the Commissioner of Social Security for the 

reasonable cost of carrying out such arrangement, and 

(B) such arrangement does not conflict with the duties 

of the Commissioner of Social Security under paragraph 

(1). 

(4) The Commissioner of Social Security may enter into similar agreements with States to provide information for their use 

in programs wholly funded by the States if the requirements 

of subparagraphs (A) and (B) of paragraph (3) are met. 

(5) The Commissioner of Social Security may use or provide 

for the use of such records as may be corrected under this section, subject to such safeguards as the Commissioner of Social 

Security determines are necessary or appropriate to protect the 

information from unauthorized use or disclosure, for statistical 

and research activities conducted by Federal and State agencies. 

(6) Information furnished to the Commissioner of Social Security under this subsection may not be used for any purpose 

other than the purpose described in this subsection and is exempt from disclosure under section 552 of title 5, United States 

Code, and from the requirements of section 552a of such title. 

47 

(7) The Commissioner of Social Security shall include information on the status of the program established under this 

section and impediments to the effective implementation of the 

program in the 1984 report required under section 704 of the 

Act. 

(8)(A) The Commissioner of Social Security shall, upon the 

request of the official responsible for a State driver’s license 

agency pursuant to the Help America Vote Act of 2002— 

(i) enter into an agreement with such official for the purpose of verifying applicable information, so long as the requirements of subparagraphs (A) and (B) of paragraph (3) 

are met; and 

(ii) include in such agreement safeguards to assure the 

maintenance of the confidentiality of any applicable information disclosed and procedures to permit such agency to 

use the applicable information for the purpose of maintaining its records. 

(B) Information provided pursuant to an agreement under 

this paragraph shall be provided at such time, in such place, 

and in such manner as the Commissioner determines appropriate. 

(C) The Commissioner shall develop methods to verify the 

accuracy of information provided by the agency with respect to 

applications for voter registration, for whom the last 4 digits 

of a social security number are provided instead of a driver’s 

license number. 

(D) For purposes of this paragraph— 

(i) the term ‘‘applicable information’’ means information 

regarding whether— 

(I) the name (including the first name and any family forename or surname), the date of birth (including 

the month, day, and year), and social security number 

of an individual provided to the Commissioner match 

the information contained in the Commissioner’s 

records, and 

(II) such individual is shown on the records of the 

Commissioner as being deceased; and 

(ii) the term ‘‘State driver’s license agency’’ means the 

State agency which issues driver’s licenses to individuals 

within the State and maintains records relating to such licensure. 

(E) Nothing in this paragraph may be construed to require 

the provision of applicable information with regard to a request 

for a record of an individual if the Commissioner determines 

there are exceptional circumstances warranting an exception 

(such as safety of the individual or interference with an investigation). 

(F) Applicable information provided by the Commission pursuant to an agreement under this paragraph or by an individual to any agency that has entered into an agreement under 

this paragraph shall be considered as strictly confidential and 

shall be used only for the purposes described in this paragraph 

and for carrying out an agreement under this paragraph. Any 

officer or employee or former officer or employee of a State, or 

any officer or employee or former officer or employee of a conVerDate Aug 31 2005 13:27 Dec 19, 2005 Jkt 049010 PO 00000 Frm 00049 Fmt 6659 Sfmt 6601 E:\HR\OC\SR203.XXX SR203
48 

tractor of a State who, without the written authority of the 

Commissioner, publishes or communicates any applicable information in such individual’s possession by reason of such employment or position as such an officer, shall be guilty of a felony and upon conviction thereof shall be fined or imprisoned, 

or both, as described in section 208. 

(s) NOTICE REQUIREMENTS.—The Commissioner of Social Security 

shall take such actions as are necessary to ensure that any notice 

to one or more individuals issued pursuant to this title by the Commissioner of Social Security or by a State agency— 

(1) is written in simple and clear language, and 

(2) includes the address and telephone number of the local 

office of the Social Security Administration which serves the 

recipient. In the case of any such notice which is not generated 

by a local servicing office, the requirements of paragraph (2) 

shall be treated as satisfied if such notice includes the address 

of the local office of the Social Security Administration which 

services the recipient of the notice and a telephone number 

through which such office can be reached. 

(t) SAME-DAY PERSONAL INTERVIEWS AT FIELD OFFICES IN CASES

WHERE TIME IS OF THE ESSENCE.—In any case in which an individual visits a field office of the Social Security Administration and 

represents during the visit to an officer or employee of the Social 

Security Administration in the office that the individual’s visit is 

occasioned by— 

(1) the receipt of a notice from the Social Security Administration indicating a time limit for response by the individual, 

or 

(2) the theft, loss, or nonreceipt of a benefit payment under 

this title, the Commissioner of Social Security shall ensure 

that the individual is granted a face-to-face interview at the office with an officer or employee of the Social Security Administration before the close of business on the day of the visit. 

(u) REDETERMINATION OF ENTITLEMENT IN CASES OF FRAUD OR

SIMILAR FAULT.— (1)(A) The Commissioner of Social Security shall immediately redetermine the entitlement of individuals to monthly 

insurance benefits under this title if there is reason to believe 

that fraud or similar fault was involved in the application of 

the individual for such benefits, unless a United States attorney, or equivalent State prosecutor, with jurisdiction over potential or actual related criminal cases, certifies, in writing, 

that there is a substantial risk that such action by the Commissioner of Social Security with regard to beneficiaries in a 

particular investigation would jeopardize the criminal prosecution of a person involved in a suspected fraud. 

(B) When redetermining the entitlement, or making an initial determination of entitlement, of an individual under this 

title, the Commissioner of Social Security shall disregard any 

evidence if there is reason to believe that fraud or similar fault 

was involved in the providing of such evidence. 

(2) For purposes of paragraph (1), similar fault is involved 

with respect to a determination if— 

(A) an incorrect or incomplete statement that is material 

to the determination is knowingly made; or 

49 

(B) information that is material to the determination is 

knowingly concealed. 

(3) If, after redetermining pursuant to this subsection the entitlement of an individual to monthly insurance benefits, the 

Commissioner of Social Security determines that there is insufficient evidence to support such entitlement, the Commissioner 

of Social Security may terminate such entitlement and may 

treat benefits paid on the basis of such insufficient evidence as 

overpayments. 

Æ