II 

109TH CONGRESS 

1ST SESSION S. 116 

To require the consent of an individual prior to the sale and marketing 

of such individual’s personally identifiable information, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JANUARY 24, 2005 

Mrs. FEINSTEIN introduced the following bill; which was read twice and 

referred to the Committee on the Judiciary 

A BILL 

To require the consent of an individual prior to the sale 

and marketing of such individual’s personally identifiable 

information, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 

4 (a) SHORT TITLE.—This Act may be cited as the 

5 ‘‘Privacy Act of 2005’’. 

6 (b) TABLE OF CONTENTS.—The table of contents of 

7 this Act is as follows: 

Sec. 1. Short title; table of contents 

TITLE I—COMMERCIAL SALE AND MARKETING OF PERSONALLY 

IDENTIFIABLE INFORMATION 

Sec. 101. Collection and distribution of personally identifiable information 
2 

•S 116 IS

Sec. 102. Enforcement 

Sec. 103. Safe harbor 

Sec. 104. Definitions 

Sec. 105. Preemption 

Sec. 106. Effective Date 

TITLE II—SOCIAL SECURITY NUMBER MISUSE PREVENTION 

Sec. 201. Findings 

Sec. 202. Prohibition of the display, sale, or purchase of social security numbers 

Sec. 203. Application of prohibition of the display, sale, or purchase of social 

security numbers to public records 

Sec. 204. Rulemaking authority of the Attorney General 

Sec. 205. Treatment of social security numbers on government documents 

Sec. 206. Limits on personal disclosure of a social security number for consumer 

transactions 

Sec. 207. Extension of civil monetary penalties for misuse of a social security 

number 

Sec. 208. Criminal penalties for the misuse of a social security number 

Sec. 209. Civil actions and civil penalties 

Sec. 210. Federal injunctive authority 

TITLE III—LIMITATIONS ON SALE AND SHARING OF NONPUBLIC 

PERSONAL FINANCIAL INFORMATION 

Sec. 301. Definition of sale 

Sec. 302. Rules applicable to sale of nonpublic personal information 

Sec. 303. Exceptions to disclosure prohibition 

Sec. 304. Conforming amendments 

Sec. 305. Regulatory authority 

Sec. 306. Effective date 

TITLE IV—LIMITATIONS ON THE PROVISION OF PROTECTED 

HEALTH INFORMATION 

Sec. 401. Definitions 

Sec. 402. Prohibition against selling protected health information 

Sec. 403. Authorization for sale or marketing of protected health information 

by noncovered entities 

Sec. 404. Prohibition against retaliation 

Sec. 405. Rule of construction 

Sec. 406. Regulations 

Sec. 407. Enforcement 

TITLE V—DRIVER’S LICENSE PRIVACY 

Sec. 501. Driver’s license privacy 

TITLE VI—MISCELLANEOUS 

Sec. 601. Enforcement by State Attorneys General 

Sec. 602. Federal injunctive authority 
3 

•S 116 IS

1 TITLE I—COMMERCIAL SALE 

2 AND MARKETING OF PERSON3 ALLY IDENTIFIABLE INFOR4 MATION 

5 SEC. 101. COLLECTION AND DISTRIBUTION OF PERSON6 ALLY IDENTIFIABLE INFORMATION. 

7 (a) PROHIBITION.— 

8 (1) IN GENERAL.—It is unlawful for a commer9 cial entity to collect personally identifiable informa10 tion and disclose such information to any non11 affiliated third party for marketing purposes or sell 

12 such information to any nonaffiliated third party, 

13 unless the commercial entity provides— 

14 (A) notice to the individual to whom the 

15 information relates in accordance with the re16 quirements of subsection (b); and 

17 (B) an opportunity for such individual to 

18 restrict the disclosure or sale of such informa19 tion. 

20 (2) EXCEPTION.—A commercial entity may col21 lect personally identifiable information and use such 

22 information to market to potential customers such 

23 entity’s product. 

24 (b) NOTICE.— 
4 

•S 116 IS

1 (1) IN GENERAL.—A notice under subsection 

2 (a) shall contain statements describing the following: 

3 (A) The identity of the commercial entity 

4 collecting the personally identifiable informa5 tion. 

6 (B) The types of personally identifiable in7 formation that are being collected on the indi8 vidual. 

9 (C) How the commercial entity may use 

10 such information. 

11 (D) A description of the categories of po12 tential recipients of such personally identifiable 

13 information. 

14 (E) Whether the individual is required to 

15 provide personally identifiable information in 

16 order to do business with the commercial entity. 

17 (F) How an individual may decline to have 

18 such personally identifiable information used or 

19 sold as described in subsection (a). 

20 (2) TIME OF NOTICE.—Notice shall be conveyed 

21 prior to the sale or use of the personally identifiable 

22 information as described in subsection (a) in such a 

23 manner as to allow the individual a reasonable pe24 riod of time to consider the notice and limit such 

25 sale or use. 
5 

•S 116 IS

1 (3) MEDIUM OF NOTICE.—The medium for pro2 viding notice must be— 

3 (A) the same medium in which the person4 ally identifiable information is or will be col5 lected, or a medium approved by the individual; 

6 or 

7 (B) in the case of oral communication, no8 tice may be conveyed orally or in writing. 

9 (4) FORM OF NOTICE.—The notice shall be 

10 clear and conspicuous. 

11 (c) OPT-OUT.— 

12 (1) OPPORTUNITY TO OPT-OUT OF SALE OR

13 MARKETING.—The opportunity provided to limit the 

14 sale of personally identifiable information to non15 affiliated third parties or the disclosure of such in16 formation for marketing purposes, shall be easy to 

17 use, accessible and available in the medium the in18 formation is collected, or in a medium approved by 

19 the individual. 

20 (2) DURATION OF LIMITATION.—An individ21 ual’s limitation on the sale or marketing of person22 ally identifiable information shall be considered per23 manent, unless otherwise specified by the individual. 

24 (3) REVOCATION OF CONSENT.—After an indi25 vidual grants consent to the use of that individual’s 
6 

•S 116 IS

1 personally identifiable information, the individual 

2 may revoke the consent at any time, except to the 

3 extent that the commercial entity has taken action 

4 in reliance thereon. The commercial entity shall pro5 vide the individual an opportunity to revoke consent 

6 that is easy to use, accessible, and available in the 

7 medium the information was or is collected. 

8 (4) NOT APPLICABLE.—This section shall not 

9 apply to disclosure of personally identifiable informa10 tion— 

11 (A) that is necessary to facilitate a trans12 action specifically requested by the consumer; 

13 (B) is used for the sole purpose of facili14 tating this transaction; and 

15 (C) in which the entity receiving or obtain16 ing such information is limited, by contract, to 

17 use such formation for the purpose of com18 pleting the transaction. 

19 SEC. 102. ENFORCEMENT. 

20 (a) IN GENERAL.—In accordance with the provisions 

21 of this section, the Federal Trade Commission shall have 

22 the authority to enforce any violation of section 101 of 

23 this Act. 

24 (b) VIOLATIONS.—The Federal Trade Commission 

25 shall treat a violation of section 101 as a violation of a 
7 

•S 116 IS

1 rule under section 18a(a)(1)(B) of the Federal Trade 

2 Commission Act (15 U.S.C. 57a(a)(1)(B)). 

3 (c) TRANSFER OF ENFORCEMENT AUTHORITY.—The 

4 Federal Trade Commission shall promulgate rules in ac5 cordance with section 553 of title 5, United States Code, 

6 allowing for the transfer of enforcement authority from 

7 the Federal Trade Commission to a Federal agency re8 garding section 101 of this Act. The Federal Trade Com9 mission may permit a Federal agency to enforce any viola10 tion of section 101 if such agency submits a written re11 quest to the Commission to enforce such violations and 

12 includes in such request— 

13 (1) a description of the entities regulated by 

14 such agency that will be subject to the provisions of 

15 section 101; 

16 (2) an assurance that such agency has suffi17 cient authority over the entities to enforce violations 

18 of section 101; and 

19 (3) a list of proposed rules that such agency 

20 shall use in regulating such entities and enforcing 

21 section 101. 

22 (d) ACTIONS BY THE COMMISSION.—Absent transfer 

23 of enforcement authority to a Federal agency under sub24 section (c), the Federal Trade Commission shall prevent 

25 any person from violating section 101 in the same manner, 
8 

•S 116 IS

1 by the same means, and with the same jurisdiction, pow2 ers, and duties as provided to such Commission under the 

3 Federal Trade Commission Act (15 U.S.C. 41 et seq.). 

4 Any entity that violates section 101 is subject to the pen5 alties and entitled to the privileges and immunities pro6 vided in such Act in the same manner, by the same means, 

7 and with the same jurisdiction, power, and duties under 

8 such Act. 

9 (e) RELATIONSHIP TO OTHER LAWS.— 

10 (1) COMMISSION AUTHORITY.—Nothing con11 tained in this title shall be construed to limit author12 ity provided to the Commission under any other law. 

13 (2) COMMUNICATIONS ACT.—Nothing in section 

14 101 requires an operator of a website to take any 

15 action that is inconsistent with the requirements of 

16 section 222 or 631 of the Communications Act of 

17 1934 (47 U.S.C. 222 and 5551). 

18 (3) OTHER ACTS.—Nothing in this title is in19 tended to affect the applicability or the enforce20 ability of any provision of, or any amendment made 

21 by— 

22 (A) the Children’s Online Privacy Protec23 tion Act of 1998 (15 U.S.C. 6501 et seq.); 

24 (B) title V of the Gramm-Leach-Bliley Act; 
9 

•S 116 IS

1 (C) the Health Insurance Portability and 

2 Accountability Act of 1996; or 

3 (D) the Fair Credit Reporting Act. 

4 (f) PUBLIC RECORDS.—Nothing in this title shall be 

5 construed to restrict commercial entities from obtaining 

6 or disclosing personally identifying information from pub7 lic records. 

8 (g) CIVIL PENALTIES.—In addition to any other pen9 alty applicable to a violation of section 101(a), a penalty 

10 of up to $25,000 may be issued for each violation. 

11 (h) ENFORCEMENT REGARDING PROGRAMS.— 

12 (1) IN GENERAL.—A Federal agency or depart13 ment providing financial assistance to any entity re14 quired to comply with section 101 of this Act shall 

15 issue regulations requiring that such entity comply 

16 with such section or forfeit some or all of such as17 sistance. Such regulations shall prescribe sanctions 

18 for noncompliance, require that such department or 

19 agency provide notice of failure to comply with such 

20 section prior to any action being taken against such 

21 recipient, and require that a determination be made 

22 prior to any action being taken against such recipi23 ent that compliance cannot be secured by voluntary 

24 means. 
10 

•S 116 IS

1 (2) FEDERAL FINANCIAL ASSISTANCE.—The 

2 term ‘‘Federal financial assistance’’ means assist3 ance through a grant, cooperative agreement, loan, 

4 or contract other than a contract of insurance or 

5 guaranty. 

6 SEC. 103. SAFE HARBOR. 

7 A commercial entity may not be held to have violated 

8 any provision of this title if such entity complies with self9 regulatory guidelines that— 

10 (1) are issued by seal programs or representa11 tives of the marketing or online industries or by any 

12 other person; and 

13 (2) are approved by the Federal Trade Commis14 sion, after public comment has been received on such 

15 guidelines by the Commission, as meeting the re16 quirements of this title. 

17 SEC. 104. DEFINITIONS. 

18 In this title: 

19 (1) COMMERCIAL ENTITY.—The term ‘‘commer20 cial entity’’— 

21 (A) means any person offering products or 

22 services involving commerce— 

23 (i) among the several States or with 1 

24 or more foreign nations; 
11 

•S 116 IS

1 (ii) in any territory of the United 

2 States or in the District of Columbia, or 

3 between any such territory and— 

4 (I) another such territory; or 

5 (II) any State or foreign nation; 

6 or 

7 (iii) between the District of Columbia 

8 and any State, territory, or foreign nation; 

9 and 

10 (B) does not include— 

11 (i) any nonprofit entity that would 

12 otherwise be exempt from coverage under 

13 section 5 of the Federal Trade Commission 

14 Act (15 U.S.C. 45); 

15 (ii) any financial institution that is 

16 subject to title V of the Gramm-Leach-Bli17 ley Act (15 U.S.C. 6801 et seq.); or 

18 (iii) any group health plan, health in19 surance issuer, or other entity that is sub20 ject to the Health Insurance Portability 

21 and Accountability Act of 1996 (42 U.S.C. 

22 201 note). 

23 (2) COMMISSION.—The term ‘‘Commission’’ 

24 means the Federal Trade Commission. 
12 

•S 116 IS

1 (3) INDIVIDUAL.—The term ‘‘individual’’ means 

2 a person whose personally identifying information 

3 has been, is, or will be collected by a commercial en4 tity. 

5 (4) MARKETING.—The term ‘‘marketing’’ 

6 means to make a communication about a product or 

7 service a purpose of which is to encourage recipients 

8 of the communication to purchase or use the product 

9 or service. 

10 (5) MEDIUM.—The term ‘‘medium’’ means any 

11 channel or system of communication including oral, 

12 written, and online communication. 

13 (6) NONAFFILIATED THIRD PARTY.—The term 

14 ‘‘nonaffiliated third party’’ means any entity that is 

15 not related by common ownership or affiliated by 

16 corporate control with, the commercial entity, but 

17 does not include a joint employee of such institution. 

18 (7) PERSONALLY IDENTIFIABLE INFORMA19 TION.—The term ‘‘personally identifiable informa20 tion’’ means individually identifiable information 

21 about the individual that is collected including— 

22 (A) a first, middle, or last name, whether 

23 given at birth or adoption, assumed, or legally 

24 changed; 
13 

•S 116 IS

1 (B) a home or other physical address, in2 cluding the street name, zip code, and name of 

3 a city or town; 

4 (C) an e-mail address; 

5 (D) a telephone number; 

6 (E) a photograph or other form of visual 

7 identification; 

8 (F) a birth date, birth certificate number, 

9 or place of birth for that person; or 

10 (G) information concerning the individual 

11 that is combined with any other identifier in 

12 this paragraph. 

13 (8) SALE; SELL; SOLD.—The terms ‘‘sale’’, 

14 ‘‘sell’’, and ‘‘sold’’, with respect to personally identi15 fiable information, mean the exchanging of such in16 formation for any thing of value, directly or indi17 rectly, including the licensing, bartering, or renting 

18 of such information. 

19 (9) WRITING.—The term ‘‘writing’’ means writ20 ing in either a paper-based or computer-based form, 

21 including electronic and digital signatures. 

22 SEC. 105. PREEMPTION. 

23 The provisions of this title shall supersede any statu24 tory and common law of States and their political subdivi-
14 

•S 116 IS

1 sions insofar as that law may now or hereafter relate to 

2 the— 

3 (1) collection and disclosure of personally iden4 tifiable information for marketing purposes; and 

5 (2) collection and sale of personally identifiable 

6 information. 

7 SEC. 106. EFFECTIVE DATE. 

8 This title and the amendments made by this title 

9 shall take effect 1 year after the date of enactment of this 

10 Act. 

11 TITLE II—SOCIAL SECURITY 

12 NUMBER MISUSE PREVENTION 

13 SEC. 201. FINDINGS. 

14 Congress makes the following findings: 

15 (1) The inappropriate display, sale, or purchase 

16 of social security numbers has contributed to a 

17 growing range of illegal activities, including fraud, 

18 identity theft, and, in some cases, stalking and other 

19 violent crimes. 

20 (2) While financial institutions, health care pro21 viders, and other entities have often used social se22 curity numbers to confirm the identity of an indi23 vidual, the general display to the public, sale, or pur24 chase of these numbers has been used to commit 
15 

•S 116 IS

1 crimes, and also can result in serious invasions of in2 dividual privacy. 

3 (3) The Federal Government requires virtually 

4 every individual in the United States to obtain and 

5 maintain a social security number in order to pay 

6 taxes, to qualify for social security benefits, or to 

7 seek employment. An unintended consequence of 

8 these requirements is that social security numbers 

9 have become one of the tools that can be used to fa10 cilitate crime, fraud, and invasions of the privacy of 

11 the individuals to whom the numbers are assigned. 

12 Because the Federal Government created and main13 tains this system, and because the Federal Govern14 ment does not permit individuals to exempt them15 selves from those requirements, it is appropriate for 

16 the Federal Government to take steps to stem the 

17 abuse of social security numbers. 

18 (4) The display, sale, or purchase of social secu19 rity numbers in no way facilitates uninhibited, ro20 bust, and wide-open public debate, and restrictions 

21 on such display, sale, or purchase would not affect 

22 public debate. 

23 (5) No one should seek to profit from the dis24 play, sale, or purchase of social security numbers in 

25 circumstances that create a substantial risk of phys-
16 

•S 116 IS

1 ical, emotional, or financial harm to the individuals 

2 to whom those numbers are assigned. 

3 (6) Consequently, this title provides each indi4 vidual that has been assigned a social security num5 ber some degree of protection from the display, sale, 

6 and purchase of that number in any circumstance 

7 that might facilitate unlawful conduct. 

8 SEC. 202. PROHIBITION OF THE DISPLAY, SALE, OR PUR9 CHASE OF SOCIAL SECURITY NUMBERS. 

10 (a) PROHIBITION.— 

11 (1) IN GENERAL.—Chapter 47 of title 18, 

12 United States Code, is amended by inserting after 

13 section 1028 the following: 

14 ‘‘§ 1028A. Prohibition of the display, sale, or purchase 

15 of social security numbers 

16 ‘‘(a) DEFINITIONS.—In this section: 

17 ‘‘(1) DISPLAY.—The term ‘display’ means to in18 tentionally communicate or otherwise make available 

19 (on the Internet or in any other manner) to the gen20 eral public an individual’s social security number. 

21 ‘‘(2) PERSON.—The term ‘person’ means any 

22 individual, partnership, corporation, trust, estate, co23 operative, association, or any other entity. 
17 

•S 116 IS

1 ‘‘(3) PURCHASE.—The term ‘purchase’ means 

2 providing directly or indirectly, anything of value in 

3 exchange for a social security number. 

4 ‘‘(4) SALE.—The term ‘sale’ means obtaining, 

5 directly or indirectly, anything of value in exchange 

6 for a social security number. 

7 ‘‘(5) STATE.—The term ‘State’ means any 

8 State of the United States, the District of Columbia, 

9 Puerto Rico, the Northern Mariana Islands, the 

10 United States Virgin Islands, Guam, American 

11 Samoa, and any territory or possession of the 

12 United States. 

13 ‘‘(b) LIMITATION ON DISPLAY.—Except as provided 

14 in section 1028B, no person may display any individual’s 

15 social security number to the general public without the 

16 affirmatively expressed consent of the individual. 

17 ‘‘(c) LIMITATION ON SALE OR PURCHASE.—Except 

18 as otherwise provided in this section, no person may sell 

19 or purchase any individual’s social security number with20 out the affirmatively expressed consent of the individual. 

21 ‘‘(d) PREREQUISITES FOR CONSENT.—In order for 

22 consent to exist under subsection (b) or (c), the person 

23 displaying or seeking to display, selling or attempting to 

24 sell, or purchasing or attempting to purchase, an individ25 ual’s social security number shall— 
18 

•S 116 IS

1 ‘‘(1) inform the individual of the general pur2 pose for which the number will be used, the types of 

3 persons to whom the number may be available, and 

4 the scope of transactions permitted by the consent; 

5 and 

6 ‘‘(2) obtain the affirmatively expressed consent 

7 (electronically or in writing) of the individual. 

8 ‘‘(e) EXCEPTIONS.—Nothing in this section shall be 

9 construed to prohibit or limit the display, sale, or purchase 

10 of a social security number— 

11 ‘‘(1) required, authorized, or excepted under 

12 any Federal law; 

13 ‘‘(2) for a public health purpose, including the 

14 protection of the health or safety of an individual in 

15 an emergency situation; 

16 ‘‘(3) for a national security purpose; 

17 ‘‘(4) for a law enforcement purpose, including 

18 the investigation of fraud and the enforcement of a 

19 child support obligation; 

20 ‘‘(5) if the display, sale, or purchase of the 

21 number is for a use occurring as a result of an inter22 action between businesses, governments, or business 

23 and government (regardless of which entity initiates 

24 the interaction), including, but not limited to— 
19 

•S 116 IS

1 ‘‘(A) the prevention of fraud (including 

2 fraud in protecting an employee’s right to em3 ployment benefits); 

4 ‘‘(B) the facilitation of credit checks or the 

5 facilitation of background checks of employees, 

6 prospective employees, or volunteers; 

7 ‘‘(C) the retrieval of other information 

8 from other businesses, commercial enterprises, 

9 government entities, or private nonprofit orga10 nizations; or 

11 ‘‘(D) when the transmission of the number 

12 is incidental to, and in the course of, the sale, 

13 lease, franchising, or merger of all, or a portion 

14 of, a business; 

15 ‘‘(6) if the transfer of such a number is part of 

16 a data matching program involving a Federal, State, 

17 or local agency; or 

18 ‘‘(7) if such number is required to be submitted 

19 as part of the process for applying for any type of 

20 Federal, State, or local government benefit or pro21 gram; 

22 except that, nothing in this subsection shall be construed 

23 as permitting a professional or commercial user to display 

24 or sell a social security number to the general public. 
20 

•S 116 IS

1 ‘‘(f) LIMITATION.—Nothing in this section shall pro2 hibit or limit the display, sale, or purchase of social secu3 rity numbers as permitted under title V of the Gramm4 Leach-Bliley Act, or for the purpose of affiliate sharing 

5 as permitted under the Fair Credit Reporting Act, except 

6 that no entity regulated under such Acts may make social 

7 security numbers available to the general public, as may 

8 be determined by the appropriate regulators under such 

9 Acts. For purposes of this subsection, the general public 

10 shall not include affiliates or unaffiliated third-party busi11 ness entities as may be defined by the appropriate regu12 lators.’’. 

13 (2) CONFORMING AMENDMENT.—The chapter 

14 analysis for chapter 47 of title 18, United States 

15 Code, is amended by inserting after the item relating 

16 to section 1028 the following: 

‘‘1028A. Prohibition of the display, sale, or purchase of social security numbers.’’. 

17 (b) STUDY; REPORT.— 

18 (1) IN GENERAL.—The Attorney General shall 

19 conduct a study and prepare a report on all of the 

20 uses of social security numbers permitted, required, 

21 authorized, or excepted under any Federal law. The 

22 report shall include a detailed description of the uses 

23 allowed as of the date of enactment of this Act and 
21 

•S 116 IS

1 shall evaluate whether such uses should be continued 

2 or discontinued by appropriate legislative action. 

3 (2) REPORT.—Not later than 1 year after the 

4 date of enactment of this Act, the Attorney General 

5 shall report to Congress findings under this sub6 section. The report shall include such recommenda7 tions for legislation based on criteria the Attorney 

8 General determines to be appropriate. 

9 (c) EFFECTIVE DATE.—The amendments made by 

10 this section shall take effect on the date that is 30 days 

11 after the date on which the final regulations promulgated 

12 under section 5 are published in the Federal Register. 

13 SEC. 203. APPLICATION OF PROHIBITION OF THE DISPLAY, 

14 SALE, OR PURCHASE OF SOCIAL SECURITY 

15 NUMBERS TO PUBLIC RECORDS. 

16 (a) PUBLIC RECORDS EXCEPTION.— 

17 (1) IN GENERAL.—Chapter 47 of title 18, 

18 United States Code (as amended by section 3(a)(1)), 

19 is amended by inserting after section 1028A the fol20 lowing: 

21 ‘‘§ 1028B. Display, sale, or purchase of public records 

22 containing social security numbers 

23 ‘‘(a) DEFINITION.—In this section, the term ‘public 

24 record’ means any governmental record that is made avail25 able to the general public. 
22 

•S 116 IS

1 ‘‘(b) IN GENERAL.—Except as provided in sub2 sections (c), (d), and (e), section 1028A shall not apply 

3 to a public record. 

4 ‘‘(c) PUBLIC RECORDS ON THE INTERNET OR IN AN

5 ELECTRONIC MEDIUM.— 

6 ‘‘(1) IN GENERAL.—Section 1028A shall apply 

7 to any public record first posted onto the Internet 

8 or provided in an electronic medium by, or on behalf 

9 of a government entity after the date of enactment 

10 of this section, except as limited by the Attorney 

11 General in accordance with paragraph (2). 

12 ‘‘(2) EXCEPTION FOR GOVERNMENT ENTITIES

13 ALREADY PLACING PUBLIC RECORDS ON THE INTER14 NET OR IN ELECTRONIC FORM.—Not later than 60 

15 days after the date of enactment of this section, the 

16 Attorney General shall issue regulations regarding 

17 the applicability of section 1028A to any record of 

18 a category of public records first posted onto the 

19 Internet or provided in an electronic medium by, or 

20 on behalf of a government entity prior to the date 

21 of enactment of this section. The regulations will de22 termine which individual records within categories of 

23 records of these government entities, if any, may 

24 continue to be posted on the Internet or in electronic 

25 form after the effective date of this section. In pro-
23 

•S 116 IS

1 mulgating these regulations, the Attorney General 

2 may include in the regulations a set of procedures 

3 for implementing the regulations and shall consider 

4 the following: 

5 ‘‘(A) The cost and availability of tech6 nology available to a governmental entity to re7 dact social security numbers from public 

8 records first provided in electronic form after 

9 the effective date of this section. 

10 ‘‘(B) The cost or burden to the general 

11 public, businesses, commercial enterprises, non12 profit organizations, and to Federal, State, and 

13 local governments of complying with section 

14 1028A with respect to such records. 

15 ‘‘(C) The benefit to the general public, 

16 businesses, commercial enterprises, non-profit 

17 organizations, and to Federal, State, and local 

18 governments if the Attorney General were to 

19 determine that section 1028A should apply to 

20 such records. 

21 Nothing in the regulation shall permit a public enti22 ty to post a category of public records on the Inter23 net or in electronic form after the effective date of 

24 this section if such category had not been placed on 
24 

•S 116 IS

1 the Internet or in electronic form prior to such effec2 tive date. 

3 ‘‘(d) HARVESTED SOCIAL SECURITY NUMBERS.— 

4 Section 1028A shall apply to any public record of a gov5 ernment entity which contains social security numbers ex6 tracted from other public records for the purpose of dis7 playing or selling such numbers to the general public. 

8 ‘‘(e) ATTORNEY GENERAL RULEMAKING ON PAPER

9 RECORDS.— 

10 ‘‘(1) IN GENERAL.—Not later than 60 days 

11 after the date of enactment of this section, the At12 torney General shall determine the feasibility and 

13 advisability of applying section 1028A to the records 

14 listed in paragraph (2) when they appear on paper 

15 or on another nonelectronic medium. If the Attorney 

16 General deems it appropriate, the Attorney General 

17 may issue regulations applying section 1028A to 

18 such records. 

19 ‘‘(2) LIST OF PAPER AND OTHER NONELEC20 TRONIC RECORDS.—The records listed in this para21 graph are as follows: 

22 ‘‘(A) Professional or occupational licenses. 

23 ‘‘(B) Marriage licenses. 

24 ‘‘(C) Birth certificates. 

25 ‘‘(D) Death certificates. 
25 

•S 116 IS

1 ‘‘(E) Other short public documents that 

2 display a social security number in a routine 

3 and consistent manner on the face of the docu4 ment. 

5 ‘‘(3) CRITERIA FOR ATTORNEY GENERAL RE6 VIEW.—In determining whether section 1028A 

7 should apply to the records listed in paragraph (2), 

8 the Attorney General shall consider the following: 

9 ‘‘(A) The cost or burden to the general 

10 public, businesses, commercial enterprises, non11 profit organizations, and to Federal, State, and 

12 local governments of complying with section 

13 1028A. 

14 ‘‘(B) The benefit to the general public, 

15 businesses, commercial enterprises, non-profit 

16 organizations, and to Federal, State, and local 

17 governments if the Attorney General were to 

18 determine that section 1028A should apply to 

19 such records.’’. 

20 (2) CONFORMING AMENDMENT.—The chapter 

21 analysis for chapter 47 of title 18, United States 

22 Code (as amended by section 202(a)(2)), is amended 

23 by inserting after the item relating to section 1028A 

24 the following: 

‘‘1028B. Display, sale, or purchase of public records containing social security 

numbers.’’. 
26 

•S 116 IS

1 (b) STUDY AND REPORT ON SOCIAL SECURITY NUM2 BERS IN PUBLIC RECORDS.— 

3 (1) STUDY.—The Comptroller General of the 

4 United States shall conduct a study and prepare a 

5 report on social security numbers in public records. 

6 In developing the report, the Comptroller General 

7 shall consult with the Administrative Office of the 

8 United States Courts, State and local governments 

9 that store, maintain, or disseminate public records, 

10 and other stakeholders, including members of the 

11 private sector who routinely use public records that 

12 contain social security numbers. 

13 (2) REPORT.—Not later than 1 year after the 

14 date of enactment of this Act, the Comptroller Gen15 eral of the United States shall submit to Congress 

16 a report on the study conducted under paragraph 

17 (1). The report shall include a detailed description 

18 of the activities and results of the study and rec19 ommendations for such legislative action as the 

20 Comptroller General considers appropriate. The re21 port, at a minimum, shall include— 

22 (A) a review of the uses of social security 

23 numbers in non-federal public records; 
27 

•S 116 IS

1 (B) a review of the manner in which public 

2 records are stored (with separate reviews for 

3 both paper records and electronic records); 

4 (C) a review of the advantages or utility of 

5 public records that contain social security num6 bers, including the utility for law enforcement, 

7 and for the promotion of homeland security; 

8 (D) a review of the disadvantages or draw9 backs of public records that contain social secu10 rity numbers, including criminal activity, com11 promised personal privacy, or threats to home12 land security; 

13 (E) the costs and benefits for State and 

14 local governments of removing social security 

15 numbers from public records, including a review 

16 of current technologies and procedures for re17 moving social security numbers from public 

18 records; and 

19 (F) an assessment of the benefits and 

20 costs to businesses, their customers, and the 

21 general public of prohibiting the display of so22 cial security numbers on public records (with 

23 separate assessments for both paper records 

24 and electronic records). 
28 

•S 116 IS

1 (c) EFFECTIVE DATE.—The prohibition with respect 

2 to electronic versions of new classes of public records 

3 under section 1028B(b) of title 18, United States Code 

4 (as added by subsection (a)(1)) shall not take effect until 

5 the date that is 60 days after the date of enactment of 

6 this Act. 

7 SEC. 204. RULEMAKING AUTHORITY OF THE ATTORNEY 

8 GENERAL. 

9 (a) IN GENERAL.—Except as provided in subsection 

10 (b), the Attorney General may prescribe such rules and 

11 regulations as the Attorney General deems necessary to 

12 carry out the provisions of section 1028A(e)(5) of title 18, 

13 United States Code (as added by section 202(a)(1)). 

14 (b) DISPLAY, SALE, OR PURCHASE RULEMAKING

15 WITH RESPECT TO INTERACTIONS BETWEEN BUSI16 NESSES, GOVERNMENTS, OR BUSINESS AND GOVERN17 MENT.— 

18 (1) IN GENERAL.—Not later than 1 year after 

19 the date of enactment of this Act, the Attorney Gen20 eral, in consultation with the Commissioner of Social 

21 Security, the Chairman of the Federal Trade Com22 mission, and such other heads of Federal agencies as 

23 the Attorney General determines appropriate, shall 

24 conduct such rulemaking procedures in accordance 

25 with subchapter II of chapter 5 of title 5, United 
29 

•S 116 IS

1 States Code, as are necessary to promulgate regula2 tions to implement and clarify the uses occurring as 

3 a result of an interaction between businesses, gov4 ernments, or business and government (regardless of 

5 which entity initiates the interaction) permitted 

6 under section 1028A(e)(5) of title 18, United States 

7 Code (as added by section 202(a)(1)). 

8 (2) FACTORS TO BE CONSIDERED.—In promul9 gating the regulations required under paragraph (1), 

10 the Attorney General shall, at a minimum, consider 

11 the following: 

12 (A) The benefit to a particular business, to 

13 customers of the business, and to the general 

14 public of the display, sale, or purchase of an in15 dividual’s social security number. 

16 (B) The costs that businesses, customers 

17 of businesses, and the general public may incur 

18 as a result of prohibitions on the display, sale, 

19 or purchase of social security numbers. 

20 (C) The risk that a particular business 

21 practice will promote the use of a social security 

22 number to commit fraud, deception, or crime. 

23 (D) The presence of adequate safeguards 

24 and procedures to prevent— 
30 

•S 116 IS

1 (i) misuse of social security numbers 

2 by employees within a business; and 

3 (ii) misappropriation of social security 

4 numbers by the general public, while per5 mitting internal business uses of such 

6 numbers. 

7 (E) The presence of procedures to prevent 

8 identity thieves, stalkers, and other individuals 

9 with ill intent from posing as legitimate busi10 nesses to obtain social security numbers. 

11 SEC. 205. TREATMENT OF SOCIAL SECURITY NUMBERS ON 

12 GOVERNMENT DOCUMENTS. 

13 (a) PROHIBITION OF USE OF SOCIAL SECURITY AC14 COUNT NUMBERS ON CHECKS ISSUED FOR PAYMENT BY

15 GOVERNMENTAL AGENCIES.— 

16 (1) IN GENERAL.—Section 205(c)(2)(C) of the 

17 Social Security Act (42 U.S.C. 405(c)(2)(C)) is 

18 amended by adding at the end the following: 

19 ‘‘(x) No Federal, State, or local agency may display 

20 the social security account number of any individual, or 

21 any derivative of such number, on any check issued for 

22 any payment by the Federal, State, or local agency.’’. 

23 (2) EFFECTIVE DATE.—The amendment made 

24 by this subsection shall apply with respect to viola25 tions of section 205(c)(2)(C)(x) of the Social Secu-
31 

•S 116 IS

1 rity Act (42 U.S.C. 405(c)(2)(C)(x)), as added by 

2 paragraph (1), occurring after the date that is 3 

3 years after the date of enactment of this Act. 

4 (b) PROHIBITION OF APPEARANCE OF SOCIAL SECU5 RITY ACCOUNT NUMBERS ON DRIVER’S LICENSES OR

6 MOTOR VEHICLE REGISTRATION.— 

7 (1) IN GENERAL.—Section 205(c)(2)(C)(vi) of 

8 the Social Security Act (42 U.S.C. 405(c)(2)(C)(vi)) 

9 is amended— 

10 (A) by inserting ‘‘(I)’’ after ‘‘(vi)’’; and 

11 (B) by adding at the end the following: 

12 ‘‘(II)(aa) An agency of a State (or political subdivi13 sion thereof), in the administration of any driver’s license 

14 or motor vehicle registration law within its jurisdiction, 

15 may not display the social security account numbers 

16 issued by the Commissioner of Social Security, or any de17 rivative of such numbers, on the face of any driver’s li18 cense or motor vehicle registration or any other document 

19 issued by such State (or political subdivision thereof) to 

20 an individual for purposes of identification of such indi21 vidual. 

22 ‘‘(bb) Nothing in this subclause shall be construed 

23 as precluding an agency of a State (or political subdivision 

24 thereof), in the administration of any driver’s license or 

25 motor vehicle registration law within its jurisdiction, from 
32 

•S 116 IS

1 using a social security account number for an internal use 

2 or to link with the database of an agency of another State 

3 that is responsible for the administration of any driver’s 

4 license or motor vehicle registration law.’’. 

5 (2) EFFECTIVE DATE.—The amendments made 

6 by this subsection shall apply with respect to li7 censes, registrations, and other documents issued or 

8 reissued after the date that is 1 year after the date 

9 of enactment of this Act. 

10 (c) PROHIBITION OF INMATE ACCESS TO SOCIAL SE11 CURITY ACCOUNT NUMBERS.— 

12 (1) IN GENERAL.—Section 205(c)(2)(C) of the 

13 Social Security Act (42 U.S.C. 405(c)(2)(C)) (as 

14 amended by subsection (b)) is amended by adding at 

15 the end the following: 

16 ‘‘(xi) No Federal, State, or local agency may employ, 

17 or enter into a contract for the use or employment of, pris18 oners in any capacity that would allow such prisoners ac19 cess to the social security account numbers of other indi20 viduals. For purposes of this clause, the term ‘prisoner’ 

21 means an individual confined in a jail, prison, or other 

22 penal institution or correctional facility pursuant to such 

23 individual’s conviction of a criminal offense.’’. 

24 (2) EFFECTIVE DATE.—The amendment made 

25 by this subsection shall apply with respect to em-
33 

•S 116 IS

1 ployment of prisoners, or entry into contract with 

2 prisoners, after the date that is 1 year after the date 

3 of enactment of this Act. 

4 SEC. 206. LIMITS ON PERSONAL DISCLOSURE OF A SOCIAL 

5 SECURITY NUMBER FOR CONSUMER TRANS6 ACTIONS. 

7 (a) IN GENERAL.—Part A of title XI of the Social 

8 Security Act (42 U.S.C. 1301 et seq.) is amended by add9 ing at the end the following: 

10 ‘‘SEC. 1150A. LIMITS ON PERSONAL DISCLOSURE OF A SO11 CIAL SECURITY NUMBER FOR CONSUMER 

12 TRANSACTIONS. 

13 ‘‘(a) IN GENERAL.—A commercial entity may not re14 quire an individual to provide the individual’s social secu15 rity number when purchasing a commercial good or service 

16 or deny an individual the good or service for refusing to 

17 provide that number except— 

18 ‘‘(1) for any purpose relating to— 

19 ‘‘(A) obtaining a consumer report for any 

20 purpose permitted under the Fair Credit Re21 porting Act; 

22 ‘‘(B) a background check of the individual 

23 conducted by a landlord, lessor, employer, vol24 untary service agency, or other entity as deter25 mined by the Attorney General; 
34 

•S 116 IS

1 ‘‘(C) law enforcement; or 

2 ‘‘(D) a Federal, State, or local law require3 ment; or 

4 ‘‘(2) if the social security number is necessary 

5 to verify the identity of the consumer to effect, ad6 minister, or enforce the specific transaction re7 quested or authorized by the consumer, or to prevent 

8 fraud. 

9 ‘‘(b) APPLICATION OF CIVIL MONEY PENALTIES.— 

10 A violation of this section shall be deemed to be a violation 

11 of section 1129(a)(3)(F). 

12 ‘‘(c) APPLICATION OF CRIMINAL PENALTIES.—A vio13 lation of this section shall be deemed to be a violation of 

14 section 208(a)(8). 

15 ‘‘(d) LIMITATION ON CLASS ACTIONS.—No class ac16 tion alleging a violation of this section shall be maintained 

17 under this section by an individual or any private party 

18 in Federal or State court. 

19 ‘‘(e) STATE ATTORNEY GENERAL ENFORCEMENT.— 

20 ‘‘(1) IN GENERAL.— 

21 ‘‘(A) CIVIL ACTIONS.—In any case in 

22 which the attorney general of a State has rea23 son to believe that an interest of the residents 

24 of that State has been or is threatened or ad25 versely affected by the engagement of any per-
35 

•S 116 IS

1 son in a practice that is prohibited under this 

2 section, the State, as parens patriae, may bring 

3 a civil action on behalf of the residents of the 

4 State in a district court of the United States of 

5 appropriate jurisdiction to— 

6 ‘‘(i) enjoin that practice; 

7 ‘‘(ii) enforce compliance with such 

8 section; 

9 ‘‘(iii) obtain damages, restitution, or 

10 other compensation on behalf of residents 

11 of the State; or 

12 ‘‘(iv) obtain such other relief as the 

13 court may consider appropriate. 

14 ‘‘(B) NOTICE.— 

15 ‘‘(i) IN GENERAL.—Before filing an 

16 action under subparagraph (A), the attor17 ney general of the State involved shall pro18 vide to the Attorney General— 

19 ‘‘(I) written notice of the action; 

20 and 

21 ‘‘(II) a copy of the complaint for 

22 the action. 

23 ‘‘(ii) EXEMPTION.— 

24 ‘‘(I) IN GENERAL.—Clause (i) 

25 shall not apply with respect to the fil-
36 

•S 116 IS

1 ing of an action by an attorney gen2 eral of a State under this subsection, 

3 if the State attorney general deter4 mines that it is not feasible to provide 

5 the notice described in such subpara6 graph before the filing of the action. 

7 ‘‘(II) NOTIFICATION.—With re8 spect to an action described in sub9 clause (I), the attorney general of a 

10 State shall provide notice and a copy 

11 of the complaint to the Attorney Gen12 eral at the same time as the State at13 torney general files the action. 

14 ‘‘(2) INTERVENTION.— 

15 ‘‘(A) IN GENERAL.—On receiving notice 

16 under paragraph (1)(B), the Attorney General 

17 shall have the right to intervene in the action 

18 that is the subject of the notice. 

19 ‘‘(B) EFFECT OF INTERVENTION.—If the 

20 Attorney General intervenes in the action under 

21 paragraph (1), the Attorney General shall have 

22 the right to be heard with respect to any matter 

23 that arises in that action. 

24 ‘‘(3) CONSTRUCTION.—For purposes of bring25 ing any civil action under paragraph (1), nothing in 
37 

•S 116 IS

1 this section shall be construed to prevent an attor2 ney general of a State from exercising the powers 

3 conferred on such attorney general by the laws of 

4 that State to— 

5 ‘‘(A) conduct investigations; 

6 ‘‘(B) administer oaths or affirmations; or 

7 ‘‘(C) compel the attendance of witnesses or 

8 the production of documentary and other evi9 dence. 

10 ‘‘(4) ACTIONS BY THE ATTORNEY GENERAL OF

11 THE UNITED STATES.—In any case in which an ac12 tion is instituted by or on behalf of the Attorney 

13 General for violation of a practice that is prohibited 

14 under this section, no State may, during the pend15 ency of that action, institute an action under para16 graph (1) against any defendant named in the com17 plaint in that action for violation of that practice. 

18 ‘‘(5) VENUE; SERVICE OF PROCESS.— 

19 ‘‘(A) VENUE.—Any action brought under 

20 paragraph (1) may be brought in the district 

21 court of the United States that meets applicable 

22 requirements relating to venue under section 

23 1391 of title 28, United States Code. 
38 

•S 116 IS

1 ‘‘(B) SERVICE OF PROCESS.—In an action 

2 brought under paragraph (1), process may be 

3 served in any district in which the defendant— 

4 ‘‘(i) is an inhabitant; or 

5 ‘‘(ii) may be found. 

6 ‘‘(f) SUNSET.—This section shall not apply on or 

7 after the date that is 6 years after the effective date of 

8 this section.’’. 

9 (b) EVALUATION AND REPORT.—Not later than the 

10 date that is 6 years and 6 months after the date of enact11 ment of this Act, the Attorney General, in consultation 

12 with the chairman of the Federal Trade Commission, shall 

13 issue a report evaluating the effectiveness and efficiency 

14 of section 1150A of the Social Security Act (as added by 

15 subsection (a)) and shall make recommendations to Con16 gress as to any legislative action determined to be nec17 essary or advisable with respect to such section, including 

18 a recommendation regarding whether to reauthorize such 

19 section. 

20 (c) EFFECTIVE DATE.—The amendment made by 

21 subsection (a) shall apply to requests to provide a social 

22 security number occurring after the date that is 1 year 

23 after the date of enactment of this Act. 
39 

•S 116 IS

1 SEC. 207. EXTENSION OF CIVIL MONETARY PENALTIES FOR 

2 MISUSE OF A SOCIAL SECURITY NUMBER. 

3 (a) TREATMENT OF WITHHOLDING OF MATERIAL

4 FACTS.— 

5 (1) CIVIL PENALTIES.—The first sentence of 

6 section 1129(a)(1) of the Social Security Act (42 

7 U.S.C. 1320a–8(a)(1)) is amended— 

8 (A) by striking ‘‘who’’ and inserting 

9 ‘‘who—’’; 

10 (B) by striking ‘‘makes’’ and all that fol11 lows through ‘‘shall be subject to’’ and inserting 

12 the following: 

13 ‘‘(A) makes, or causes to be made, a statement 

14 or representation of a material fact, for use in deter15 mining any initial or continuing right to or the 

16 amount of monthly insurance benefits under title II 

17 or benefits or payments under title VIII or XVI, 

18 that the person knows or should know is false or 

19 misleading; 

20 ‘‘(B) makes such a statement or representation 

21 for such use with knowing disregard for the truth; 

22 or 

23 ‘‘(C) omits from a statement or representation 

24 for such use, or otherwise withholds disclosure of, a 

25 fact which the individual knows or should know is 

26 material to the determination of any initial or con-
40 

•S 116 IS

1 tinuing right to or the amount of monthly insurance 

2 benefits under title II or benefits or payments under 

3 title VIII or XVI and the individual knows, or 

4 should know, that the statement or representation 

5 with such omission is false or misleading or that the 

6 withholding of such disclosure is misleading, shall be 

7 subject to’’; 

8 (C) by inserting ‘‘or each receipt of such 

9 benefits while withholding disclosure of such 

10 fact’’ after ‘‘each such statement or representa11 tion’’; 

12 (D) by inserting ‘‘or because of such with13 holding of disclosure of a material fact’’ after 

14 ‘‘because of such statement or representation’’; 

15 and 

16 (E) by inserting ‘‘or such a withholding of 

17 disclosure’’ after ‘‘such a statement or rep18 resentation’’. 

19 (2) ADMINISTRATIVE PROCEDURE FOR IMPOS20 ING PENALTIES.—The first sentence of section 

21 1129A(a) of the Social Security Act (42 U.S.C. 

22 1320a–8a(a)) is amended— 

23 (A) by striking ‘‘who’’ and inserting 

24 ‘‘who—’’; and 
41 

•S 116 IS

1 (B) by striking ‘‘makes’’ and all that fol2 lows through ‘‘shall be subject to’’ and inserting 

3 the following: 

4 ‘‘(1) makes, or causes to be made, a statement 

5 or representation of a material fact, for use in deter6 mining any initial or continuing right to or the 

7 amount of monthly insurance benefits under title II 

8 or benefits or payments under title VIII or XVI, 

9 that the person knows or should know is false or 

10 misleading; 

11 ‘‘(2) makes such a statement or representation 

12 for such use with knowing disregard for the truth; 

13 or 

14 ‘‘(3) omits from a statement or representation 

15 for such use, or otherwise withholds disclosure of, a 

16 fact which the individual knows or should know is 

17 material to the determination of any initial or con18 tinuing right to or the amount of monthly insurance 

19 benefits under title II or benefits or payments under 

20 title VIII or XVI and the individual knows, or 

21 should know, that the statement or representation 

22 with such omission is false or misleading or that the 

23 withholding of such disclosure is misleading, shall be 

24 subject to’’. 
42 

•S 116 IS

1 (b) APPLICATION OF CIVIL MONEY PENALTIES TO

2 ELEMENTS OF CRIMINAL VIOLATIONS.—Section 1129(a) 

3 of the Social Security Act (42 U.S.C. 1320a–8(a)), as 

4 amended by subsection (a)(1), is amended— 

5 (1) by redesignating paragraph (2) as para6 graph (4); 

7 (2) by redesignating the last sentence of para8 graph (1) as paragraph (2) and inserting such para9 graph after paragraph (1); and 

10 (3) by inserting after paragraph (2) (as so re11 designated) the following: 

12 ‘‘(3) Any person (including an organization, agency, 

13 or other entity) who— 

14 ‘‘(A) uses a social security account number that 

15 such person knows or should know has been as16 signed by the Commissioner of Social Security (in an 

17 exercise of authority under section 205(c)(2) to es18 tablish and maintain records) on the basis of false 

19 information furnished to the Commissioner by any 

20 person; 

21 ‘‘(B) falsely represents a number to be the so22 cial security account number assigned by the Com23 missioner of Social Security to any individual, when 

24 such person knows or should know that such number 
43 

•S 116 IS

1 is not the social security account number assigned 

2 by the Commissioner to such individual; 

3 ‘‘(C) knowingly alters a social security card 

4 issued by the Commissioner of Social Security, or 

5 possesses such a card with intent to alter it; 

6 ‘‘(D) knowingly displays, sells, or purchases a 

7 card that is, or purports to be, a card issued by the 

8 Commissioner of Social Security, or possesses such 

9 a card with intent to display, purchase, or sell it; 

10 ‘‘(E) counterfeits a social security card, or pos11 sesses a counterfeit social security card with intent 

12 to display, sell, or purchase it; 

13 ‘‘(F) discloses, uses, compels the disclosure of, 

14 or knowingly displays, sells, or purchases the social 

15 security account number of any person in violation 

16 of the laws of the United States; 

17 ‘‘(G) with intent to deceive the Commissioner of 

18 Social Security as to such person’s true identity (or 

19 the true identity of any other person) furnishes or 

20 causes to be furnished false information to the Com21 missioner with respect to any information required 

22 by the Commissioner in connection with the estab23 lishment and maintenance of the records provided 

24 for in section 205(c)(2); 
44 

•S 116 IS

1 ‘‘(H) offers, for a fee, to acquire for any indi2 vidual, or to assist in acquiring for any individual, 

3 an additional social security account number or a 

4 number which purports to be a social security ac5 count number; or 

6 ‘‘(I) being an officer or employee of a Federal, 

7 State, or local agency in possession of any individ8 ual’s social security account number, willfully acts or 

9 fails to act so as to cause a violation by such agency 

10 of clause (vi)(II) or (x) of section 205(c)(2)(C), shall 

11 be subject to, in addition to any other penalties that 

12 may be prescribed by law, a civil money penalty of 

13 not more than $5,000 for each violation. Such per14 son shall also be subject to an assessment, in lieu of 

15 damages sustained by the United States resulting 

16 from such violation, of not more than twice the 

17 amount of any benefits or payments paid as a result 

18 of such violation.’’. 

19 (c) CLARIFICATION OF TREATMENT OF RECOVERED

20 AMOUNTS.—Section 1129(e)(2)(B) of the Social Security 

21 Act (42 U.S.C. 1320a–8(e)(2)(B)) is amended by striking 

22 ‘‘In the case of amounts recovered arising out of a deter23 mination relating to title VIII or XVI,’’ and inserting ‘‘In 

24 the case of any other amounts recovered under this sec25 tion,’’. 
45 

•S 116 IS

1 (d) CONFORMING AMENDMENTS.— 

2 (1) Section 1129(b)(3)(A) of the Social Secu3 rity Act (42 U.S.C. 1320a–8(b)(3)(A)) is amended 

4 by striking ‘‘charging fraud or false statements’’. 

5 (2) Section 1129(c)(1) of the Social Security 

6 Act (42 U.S.C. 1320a–8(c)(1)) is amended by strik7 ing ‘‘and representations’’ and inserting ‘‘, represen8 tations, or actions’’. 

9 (3) Section 1129(e)(1)(A) of the Social Security 

10 Act (42 U.S.C. 1320a–8(e)(1)(A)) is amended by 

11 striking ‘‘statement or representation referred to in 

12 subsection (a) was made’’ and inserting ‘‘violation 

13 occurred’’. 

14 (e) EFFECTIVE DATES.— 

15 (1) IN GENERAL.—Except as provided in para16 graph (2), the amendments made by this section 

17 shall apply with respect to violations of sections 

18 1129 and 1129A of the Social Security Act (42 

19 U.S.C. 1320–8 and 1320a–8a), as amended by this 

20 section, committed after the date of enactment of 

21 this Act. 

22 (2) VIOLATIONS BY GOVERNMENT AGENTS IN

23 POSSESSION OF SOCIAL SECURITY NUMBERS.—Sec24 tion 1129(a)(3)(I) of the Social Security Act (42 

25 U.S.C. 1320a–8(a)(3)(I)), as added by subsection 
46 

•S 116 IS

1 (b), shall apply with respect to violations of that sec2 tion occurring on or after the effective date de3 scribed in section 202(c). 

4 SEC. 208. CRIMINAL PENALTIES FOR THE MISUSE OF A SO5 CIAL SECURITY NUMBER. 

6 (a) PROHIBITION OF WRONGFUL USE AS PERSONAL

7 IDENTIFICATION NUMBER.—No person may obtain any 

8 individual’s social security number for purposes of locating 

9 or identifying an individual with the intent to physically 

10 injure, harm, or use the identity of the individual for any 

11 illegal purpose. 

12 (b) CRIMINAL SANCTIONS.—Section 208(a) of the 

13 Social Security Act (42 U.S.C. 408(a)) is amended— 

14 (1) in paragraph (8), by inserting ‘‘or’’ after 

15 the semicolon; and 

16 (2) by inserting after paragraph (8) the fol17 lowing: 

18 ‘‘(9) except as provided in subsections (e) and 

19 (f) of section 1028A of title 18, United States Code, 

20 knowingly and willfully displays, sells, or purchases 

21 (as those terms are defined in section 1028A(a) of 

22 title 18, United States Code) any individual’s social 

23 security account number without having met the 

24 prerequisites for consent under section 1028A(d) of 

25 title 18, United States Code; or 
47 

•S 116 IS

1 ‘‘(10) obtains any individual’s social security 

2 number for the purpose of locating or identifying the 

3 individual with the intent to injure or to harm that 

4 individual, or to use the identity of that individual 

5 for an illegal purpose;’’. 

6 SEC. 209. CIVIL ACTIONS AND CIVIL PENALTIES. 

7 (a) CIVIL ACTION IN STATE COURTS.— 

8 (1) IN GENERAL.—Any individual aggrieved by 

9 an act of any person in violation of this title or any 

10 amendments made by this title may, if otherwise 

11 permitted by the laws or rules of the court of a 

12 State, bring in an appropriate court of that State— 

13 (A) an action to enjoin such violation; 

14 (B) an action to recover for actual mone15 tary loss from such a violation, or to receive up 

16 to $500 in damages for each such violation, 

17 whichever is greater; or 

18 (C) both such actions. 

19 It shall be an affirmative defense in any action 

20 brought under this paragraph that the defendant 

21 has established and implemented, with due care, rea22 sonable practices and procedures to effectively pre23 vent violations of the regulations prescribed under 

24 this title. If the court finds that the defendant will25 fully or knowingly violated the regulations prescribed 
48 

•S 116 IS

1 under this subsection, the court may, in its discre2 tion, increase the amount of the award to an amount 

3 equal to not more than 3 times the amount available 

4 under subparagraph (B). 

5 (2) STATUTE OF LIMITATIONS.—An action may 

6 be commenced under this subsection not later than 

7 the earlier of— 

8 (A) 5 years after the date on which the al9 leged violation occurred; or 

10 (B) 3 years after the date on which the al11 leged violation was or should have been reason12 ably discovered by the aggrieved individual. 

13 (3) NONEXCLUSIVE REMEDY.—The remedy pro14 vided under this subsection shall be in addition to 

15 any other remedies available to the individual. 

16 (b) CIVIL PENALTIES.— 

17 (1) IN GENERAL.—Any person who the Attor18 ney General determines has violated any section of 

19 this title or of any amendments made by this title 

20 shall be subject, in addition to any other penalties 

21 that may be prescribed by law— 

22 (A) to a civil penalty of not more than 

23 $5,000 for each such violation; and 

24 (B) to a civil penalty of not more than 

25 $50,000, if the violations have occurred with 
49 

•S 116 IS

1 such frequency as to constitute a general busi2 ness practice. 

3 (2) DETERMINATION OF VIOLATIONS.—Any 

4 willful violation committed contemporaneously with 

5 respect to the social security numbers of 2 or more 

6 individuals by means of mail, telecommunication, or 

7 otherwise, shall be treated as a separate violation 

8 with respect to each such individual. 

9 (3) ENFORCEMENT PROCEDURES.—The provi10 sions of section 1128A of the Social Security Act 

11 (42 U.S.C. 1320a–7a), other than subsections (a), 

12 (b), (f), (h), (i), (j), (m), and (n) and the first sen13 tence of subsection (c) of such section, and the pro14 visions of subsections (d) and (e) of section 205 of 

15 such Act (42 U.S.C. 405) shall apply to a civil pen16 alty action under this subsection in the same man17 ner as such provisions apply to a penalty or pro18 ceeding under section 1128A(a) of such Act (42 

19 U.S.C. 1320a–7a(a)), except that, for purposes of 

20 this paragraph, any reference in section 1128A of 

21 such Act (42 U.S.C. 1320a–7a) to the Secretary 

22 shall be deemed to be a reference to the Attorney 

23 General. 
50 

•S 116 IS

1 SEC. 210. FEDERAL INJUNCTIVE AUTHORITY. 

2 In addition to any other enforcement authority con3 ferred under this title or the amendments made by this 

4 title, the Federal Government shall have injunctive author5 ity with respect to any violation by a public entity of any 

6 provision of this title or of any amendments made by this 

7 title. 

8 TITLE III—LIMITATIONS ON 

9 SALE AND SHARING OF NON10 PUBLIC PERSONAL FINAN11 CIAL INFORMATION 

12 SEC. 301. DEFINITION OF SALE. 

13 Section 509 of the Gramm-Leach-Bliley Act (15 

14 U.S.C. 6809) is amended by adding at the end the fol15 lowing: 

16 ‘‘(12) SALE.—The terms ‘sale’, ‘sell’, and ‘sold’, 

17 with respect to nonpublic personal information, 

18 mean the exchange of such information for any 

19 thing of value, directly or indirectly, including the li20 censing, bartering, or renting of such information.’’. 

21 SEC. 302. RULES APPLICABLE TO SALE OF NONPUBLIC 

22 PERSONAL INFORMATION. 

23 Section 502 of the Gramm-Leach-Bliley Act (15 

24 U.S.C. 6802) is amended— 

25 (1) in the section heading, by inserting ‘‘SALES, 

26 AND OTHER SHARING’’ after ‘‘DISCLOSURES’’; 
51 

•S 116 IS

1 (2) in subsection (a), by striking ‘‘disclose to’’ 

2 and inserting ‘‘sell or otherwise disclose to an affil3 iate or’’; 

4 (3) in subsection (b)— 

5 (A) in the subsection heading, by inserting 

6 ‘‘FOR DISCLOSURES TO AFFILIATES’’ before the 

7 period; 

8 (B) by striking ‘‘a nonaffiliated third 

9 party’’ each place that term appears and insert10 ing ‘‘an affiliate’’; 

11 (C) by striking ‘‘such third party’’ each 

12 place that term appears and inserting ‘‘such af13 filiate’’; 

14 (D) by striking ‘‘may not disclose’’ and in15 serting ‘‘may not sell or otherwise disclose’’; 

16 and 

17 (E) by striking paragraph (2) and insert18 ing the following: 

19 ‘‘(2) EXCEPTION.—This subsection shall not 

20 prevent a financial institution from providing non21 public personal information to an affiliated third 

22 party to perform services for or functions on behalf 

23 of the financial institution, including marketing of 

24 the financial institution’s own products or services, 

25 if the financial institution fully discloses the provi-
52 

•S 116 IS

1 sion of such information and requires the affiliate to 

2 maintain the confidentiality of such information.’’; 

3 (4) in subsection (d), by striking ‘‘disclose’’ and 

4 inserting ‘‘sell or otherwise disclose’’; 

5 (5) by striking subsection (e); 

6 (6) by redesignating subsections (c) and (d) as 

7 subsections (e) and (f), respectively; and 

8 (7) by inserting after subsection (b) the fol9 lowing: 

10 ‘‘(c) OPT IN FOR DISCLOSURES TO NONAFFILIATED

11 THIRD PARTIES.— 

12 ‘‘(1) AFFIRMATIVE CONSENT REQUIRED.—A fi13 nancial institution may not sell or otherwise disclose 

14 nonpublic personal information to any nonaffiliated 

15 third party, unless the consumer to whom the infor16 mation pertains— 

17 ‘‘(A) has affirmatively consented to the 

18 sale or disclosure of such information; and 

19 ‘‘(B) has not withdrawn the consent. 

20 ‘‘(2) EXCEPTION.—This subsection shall not 

21 prevent a financial institution from providing non22 public personal information to a nonaffiliated third 

23 party to perform services for or functions on behalf 

24 of the financial institution, including marketing of 

25 the financial institution’s own products or services 
53 

•S 116 IS

1 (subject to subsection (d) with respect to joint agree2 ments between 2 or more financial institutions), if 

3 the financial institution fully discloses the provision 

4 of such information and enters into a contractual 

5 agreement with the nonaffiliated third party that re6 quires that third party to maintain the confiden7 tiality of such information. 

8 ‘‘(d) OPT OUT FOR JOINT AGREEMENTS.—A finan9 cial institution may not sell or otherwise disclose nonpublic 

10 personal information to a nonaffiliated third party for the 

11 purpose of offering financial products or services pursuant 

12 to a joint agreement between 2 or more financial institu13 tions, unless— 

14 ‘‘(1) the financial institution clearly and con15 spicuously discloses to the consumer to whom the in16 formation pertains, in writing or in electronic form 

17 or other form permitted by the regulations pre18 scribed under section 504, that such information 

19 may be disclosed to such nonaffiliated third party; 

20 ‘‘(2) the consumer is given the opportunity, be21 fore the time that such information is initially dis22 closed, to direct that such information not be dis23 closed to such nonaffiliated third party; 
54 

•S 116 IS

1 ‘‘(3) the consumer is given an explanation of 

2 how the consumer can exercise that nondisclosure 

3 option; and 

4 ‘‘(4) the financial institution receiving the non5 public personal information signs a written agree6 ment obliging it— 

7 ‘‘(A) to maintain the confidentiality of the 

8 information; and 

9 ‘‘(B) to refrain from using, selling, or oth10 erwise disclosing the information other than to 

11 carry out the joint offering or servicing of the 

12 financial product or financial service that is the 

13 subject of the written agreement.’’. 

14 SEC. 303. EXCEPTIONS TO DISCLOSURE PROHIBITION. 

15 (a) IN GENERAL.—Section 502 of the Gramm-Leach16 Bliley Act (15 U.S.C. 6802), as amended by this title, is 

17 amended by adding at the end the following: 

18 ‘‘(g) GENERAL EXCEPTIONS.—Notwithstanding any 

19 other provision of this section, this section does not pro20 hibit— 

21 ‘‘(1) the sale or other disclosure of nonpublic 

22 personal information to an affiliate or a nonaffiliated 

23 third party— 

24 ‘‘(A) as necessary to effect, administer, or 

25 enforce a transaction requested or authorized 
55 

•S 116 IS

1 by the consumer to whom the information per2 tains, or in connection with— 

3 ‘‘(i) servicing or processing a financial 

4 product or service requested or authorized 

5 by the consumer; 

6 ‘‘(ii) maintaining or servicing the ac7 count of the consumer with the financial 

8 institution, or with another entity as part 

9 of a private label credit card program or 

10 other extension of credit on behalf of such 

11 entity; or 

12 ‘‘(iii) a proposed or actual 

13 securitization, secondary market sale (in14 cluding sales of servicing rights), or similar 

15 transaction related to a transaction of the 

16 consumer; 

17 ‘‘(B) with the consent or at the direction 

18 of the consumer, in accordance with applicable 

19 rules prescribed under this subtitle; 

20 ‘‘(C) to the extent specifically permitted or 

21 required under other provisions of law and in 

22 accordance with the Right to Financial Privacy 

23 Act of 1978; or 

24 ‘‘(D) to law enforcement agencies (includ25 ing a Federal functional regulator, the Sec-
56 

•S 116 IS

1 retary of the Treasury, with respect to sub2 chapter II of chapter 53 of title 31, United 

3 States Code, and chapter 2 of title I of Public 

4 Law 91–508 (12 U.S.C. 1951–1959), a State 

5 insurance authority, or the Federal Trade Com6 mission), self-regulatory organizations, or for 

7 an investigation on a matter related to public 

8 safety; 

9 ‘‘(2) the disclosure, other than the sale, of non10 public personal information to identify or locate 

11 missing and abducted children, witnesses, criminals, 

12 and fugitives, parties to lawsuits, parents, 

13 delinquents in child support payments, organ and 

14 bone marrow donors, pension fund beneficiaries, and 

15 missing heirs; or 

16 ‘‘(3) the disclosure, other than the sale, of non17 public personal information— 

18 ‘‘(A) to protect the confidentiality or secu19 rity of the records of the financial institution 

20 pertaining to the consumer, the service or prod21 uct, or the transaction therein; 

22 ‘‘(B) to protect against or prevent actual 

23 or potential fraud, unauthorized transactions, 

24 claims, or other liability; 
57 

•S 116 IS

1 ‘‘(C) for required institutional risk control, 

2 or for resolving customer disputes or inquiries; 

3 ‘‘(D) to persons holding a legal or bene4 ficial interest relating to the consumer; 

5 ‘‘(E) to persons acting in a fiduciary or 

6 representative capacity on behalf of the con7 sumer; 

8 ‘‘(F) to provide information to insurance 

9 rate advisory organizations, guaranty funds or 

10 agencies, applicable rating agencies of the fi11 nancial institution, persons assessing the com12 pliance of the institution with industry stand13 ards, or the attorneys, accountants, or auditors 

14 of the institution; 

15 ‘‘(G) to a consumer reporting agency, in 

16 accordance with the Fair Credit Reporting Act 

17 or from a consumer report reported by a con18 sumer reporting agency, as those terms are de19 fined in that Act; 

20 ‘‘(H) in connection with a proposed or ac21 tual sale, merger, transfer, or exchange of all or 

22 a portion of a business or operating unit if the 

23 disclosure of nonpublic personal information 

24 concerns solely consumers of such business or 

25 unit; 
58 

•S 116 IS

1 ‘‘(I) to comply with Federal, State, or local 

2 laws, rules, or other applicable legal require3 ments, or with a properly authorized civil, 

4 criminal, or regulatory investigation or sub5 poena or summons by Federal, State, or local 

6 authorities; or 

7 ‘‘(J) to respond to judicial process or gov8 ernment regulatory authorities having jurisdic9 tion over the financial institution for examina10 tion, compliance, or other purposes, as author11 ized by law. 

12 ‘‘(h) DENIAL OF SERVICE PROHIBITED.—A financial 

13 institution may not deny any consumer a financial product 

14 or a financial service as a result of the refusal by the con15 sumer to grant consent to disclosure under this section 

16 or the exercise by the consumer of a nondisclosure option 

17 under this section, except that nothing in this subsection 

18 may be construed to prohibit a financial institution from 

19 offering incentives to elicit consumer consent to the use 

20 of his or her nonpublic personal information.’’. 

21 (b) REPEAL OF REGULATORY EXEMPTION AUTHOR22 ITY.—Section 504 of the Gramm-Leach-Bliley Act (15 

23 U.S.C. 6804) is amended— 

24 (1) by striking subsection (b); 
59 

•S 116 IS

1 (2) by striking ‘‘(a) REGULATORY AUTHOR2 ITY.—’’; 

3 (3) by redesignating paragraphs (1), (2), and 

4 (3) as subsections (a), (b), and (c), respectively, and 

5 moving the margins 2 ems to the left; and 

6 (4) by striking ‘‘paragraph (1)’’ and inserting 

7 ‘‘subsection (a)’’. 

8 SEC. 304. CONFORMING AMENDMENTS. 

9 Title V of the Gramm-Leach-Bliley Act (15 U.S.C. 

10 6801 et seq.) is amended— 

11 (1) in section 503(b)(1) (15 U.S.C. 

12 6803(b)(1))— 

13 (A) by inserting ‘‘affiliates and’’ before 

14 ‘‘nonaffiliated’’; and 

15 (B) in subparagraph (A), by striking 

16 ‘‘502(e)’’ and inserting ‘‘502(g)’’; and 

17 (2) in section 509(3)(D) (15 U.S.C. 

18 6809(3)(D)), by striking ‘‘502(e)(1)(C)’’ and insert19 ing ‘‘502(g)(1)(A)(iii)’’. 

20 SEC. 305. REGULATORY AUTHORITY. 

21 Not later than 6 months after the date of enactment 

22 of this Act, the agencies referred to in section 504(a)(1) 

23 of the Gramm-Leach-Bliley Act (15 U.S.C. 6804(a)(1)) 

24 shall promulgate final regulations in accordance with that 
60 

•S 116 IS

1 section 504 to carry out the amendments made by this 

2 Act. 

3 SEC. 306. EFFECTIVE DATE. 

4 This title and the amendments made by this title 

5 shall take effect 6 months after the date of enactment of 

6 this Act. 

7 TITLE IV—LIMITATIONS ON THE 

8 PROVISION OF PROTECTED 

9 HEALTH INFORMATION 

10 SEC. 401. DEFINITIONS. 

11 In this title: 

12 (1) BUSINESS ASSOCIATE.— 

13 (A) IN GENERAL.—Except as provided in 

14 subparagraph (B), the term ‘‘business asso15 ciate’’ means, with respect to a covered entity, 

16 a person who— 

17 (i) on behalf of such covered entity or 

18 of an organized health care arrangement in 

19 which the covered entity participates, but 

20 other than in the capacity of a member of 

21 the workforce of such covered entity or ar22 rangement, performs, or assists in the per23 formance of— 

24 (I) a function or activity involv25 ing the use or disclosure of individ-
61 

•S 116 IS

1 ually identifiable health information, 

2 including claims processing or admin3 istration, data analysis, processing or 

4 administration, utilization review, 

5 quality assurance, billing, benefit 

6 management, practice management, 

7 and repricing; or 

8 (II) any other function or activity 

9 regulated under subchapter C of title 

10 45, Code of Federal Regulations; or 

11 (ii) provides, other than in the capac12 ity of a member of the workforce of such 

13 covered entity, legal, actuarial, accounting, 

14 consulting, data aggregation (as defined in 

15 section 164.501 of title 45, Code of Fed16 eral Regulations), management, adminis17 trative, accreditation, or financial services 

18 to or for such covered entity, or to or for 

19 an organized health care arrangement in 

20 which the covered entity participates, 

21 where the provision of the service involves 

22 the disclosure of individually identifiable 

23 health information from such covered enti24 ty or arrangement, or from another busi-
62 

•S 116 IS

1 ness associate of such covered entity or ar2 rangement, to the person. 

3 (B) LIMITATIONS.— 

4 (i) IN GENERAL.—A covered entity 

5 participating in an organized health care 

6 arrangement that performs a function or 

7 activity as described by subparagraph 

8 (A)(i) for or on behalf of such organized 

9 health care arrangement, or that provides 

10 a service as described in subparagraph 

11 (A)(ii) to or for such organized health care 

12 arrangement, does not, simply through the 

13 performance of such function or activity or 

14 the provision of such service, become a 

15 business associate of other covered entities 

16 participating in such organized health care 

17 arrangement. 

18 (ii) LIMITATION.—A covered entity 

19 may be a business associate of another cov20 ered entity. 

21 (2) COVERED ENTITY.—The term ‘‘covered en22 tity’’ means— 

23 (A) a health plan; 

24 (B) a health care clearinghouse; and 
63 

•S 116 IS

1 (C) a health care provider who transmits 

2 any health information in electronic form in 

3 connection with a transaction covered by parts 

4 160 through 164 of title 45, Code of Federal 

5 Regulations. 

6 (3) DISCLOSURE.—The term ‘‘disclosure’’ 

7 means the release, transfer, provision of access to, or 

8 divulging in any other manner of information out9 side the entity holding the information. 

10 (4) EMPLOYER.—The term ‘‘employer’’ has the 

11 meaning given that term in section 3401(d) of the 

12 Internal Revenue Code of 1986. 

13 (5) GROUP HEALTH PLAN.—The term ‘‘group 

14 health plan’’ means an employee welfare benefit plan 

15 (as defined in section 3(1) of the Employee Retire16 ment Income and Security Act of 1974 (29 U.S.C. 

17 1002(1)), including insured and self-insured plans, 

18 to the extent that the plan provides medical care (as 

19 defined in section 2791(a)(2) of the Public Health 

20 Service Act, 42 U.S.C. 300gg–91(a)(2)), including 

21 items and services paid for as medical care, to em22 ployees or their dependents directly or through in23 surance, reimbursement, or otherwise, that— 

24 (A) has 50 or more participants (as de25 fined in section 3(7) of Employee Retirement 
64 

•S 116 IS

1 Income and Security Act of 1974, 29 U.S.C. 

2 1002(7)); or 

3 (B) is administered by an entity other than 

4 the employer that established and maintains the 

5 plan. 

6 (6) HEALTH CARE.—The term ‘‘health care’’ 

7 includes, but is not limited to, the following: 

8 (A) Preventive, diagnostic, therapeutic, re9 habilitative, maintenance, or palliative care and 

10 counseling, service, assessment, or procedure 

11 with respect to the physical or mental condition, 

12 or functional status, of an individual or that af13 fects the structure or function of the body. 

14 (B) The sale or dispensing of a drug, de15 vice, equipment, or other item in accordance 

16 with a prescription. 

17 (7) HEALTH CARE CLEARINGHOUSE.—The term 

18 ‘‘health care clearinghouse’’ means a public or pri19 vate entity, including a billing service, repricing com20 pany, community health management information 

21 system or community health information system, 

22 and value-added networks and switches, that— 

23 (A) processes or facilitates the processing 

24 of health information received from another en25 tity in a nonstandard format or containing non-
65 

•S 116 IS

1 standard data content into standard data ele2 ments or a standard transaction; or 

3 (B) receives a standard transaction from 

4 another entity and processes or facilitates the 

5 processing of health information into non6 standard format or nonstandard data content 

7 for the receiving entity. 

8 (8) HEALTH CARE PROVIDER.—The term 

9 ‘‘health care provider’’ has the meaning given the 

10 terms ‘‘provider of services’’ and ‘‘provider of med11 ical or health services’’ in subsections (u) and (s) of 

12 section 1861 of the Social Security Act (42 U.S.C. 

13 1395x), respectively, and includes any other person 

14 or organization who furnishes, bills, or is paid for 

15 health care in the normal course of business. 

16 (9) HEALTH INFORMATION.—The term ‘‘health 

17 information’’ means any information, whether oral 

18 or recorded in any form or medium, that— 

19 (A) is created or received by a health care 

20 provider, health plan, public health authority, 

21 employer, life insurer, school or university, or 

22 health care clearinghouse; and 

23 (B) relates to the past, present, or future 

24 physical or mental health or condition of an in25 dividual; the provision of health care to an indi-
66 

•S 116 IS

1 vidual; or the past, present, or future payment 

2 for the provision of health care to an individual. 

3 (10) HEALTH INSURANCE ISSUER.—The term 

4 ‘‘health insurance issuer’’ means a health insurance 

5 issuer (as defined in section 2791(b)(2) of the Pub6 lic Health Service Act, 42 U.S.C. 300gg–91(b)(2)) 

7 and used in the definition of health plan in this sec8 tion and includes an insurance company, insurance 

9 service, or insurance organization (including an 

10 HMO) that is licensed to engage in the business of 

11 insurance in a State and is subject to State law that 

12 regulates insurance. Such term does not include a 

13 group health plan. 

14 (11) HEALTH MAINTENANCE ORGANIZATION.— 

15 The term ‘‘health maintenance organization’’ 

16 (HMO) (as defined in section 2791(b)(3) of the 

17 Public Health Service Act, 42 U.S.C. 300gg–91 

18 (b)(3)) and used in the definition of health plan in 

19 this section, means a federally qualified HMO, an 

20 organization recognized as an HMO under State 

21 law, or a similar organization regulated for solvency 

22 under State law in the same manner and to the 

23 same extent as such an HMO. 

24 (12) HEALTH OVERSIGHT AGENCY.—The term 

25 ‘‘health oversight agency’’ means an agency or au-
67 

•S 116 IS

1 thority of the United States, a State, a territory, a 

2 political subdivision of a State or territory, or an In3 dian tribe, or a person or entity acting under a 

4 grant of authority from or contract with such public 

5 agency, including the employees or agents of such 

6 public agency or its contractors or persons or enti7 ties to whom it has granted authority, that is au8 thorized by law to oversee the health care system 

9 (whether public or private) or government programs 

10 in which health information is necessary to deter11 mine eligibility or compliance, or to enforce civil 

12 rights laws for which health information is relevant. 

13 (13) HEALTH PLAN.—The term ‘‘health plan’’ 

14 means an individual or group plan that provides, or 

15 pays the cost of, medical care, as defined in section 

16 2791(a)(2) of the Public Health Service Act (42 

17 U.S.C. 300gg–91(a)(2))— 

18 (A) including, singly or in combination— 

19 (i) a group health plan; 

20 (ii) a health insurance issuer; 

21 (iii) an HMO; 

22 (iv) part A or B of the medicare pro23 gram under title XVIII of the Social Secu24 rity Act (42 U.S.C. 1395 et seq.); 
68 

•S 116 IS

1 (v) the medicaid program under title 

2 XIX of the Social Security Act (42 U.S.C. 

3 1396 et seq.); 

4 (vi) an issuer of a medicare supple5 mental policy (as defined in section 

6 1882(g)(1) of the Social Security Act, 42 

7 U.S.C. 1395ss(g)(1)); 

8 (vii) an issuer of a long-term care pol9 icy, excluding a nursing home fixed-indem10 nity policy; 

11 (viii) an employee welfare benefit plan 

12 or any other arrangement that is estab13 lished or maintained for the purpose of of14 fering or providing health benefits to the 

15 employees of 2 or more employers; 

16 (ix) the health care program for active 

17 military personnel under title 10, United 

18 States Code; 

19 (x) the veterans health care program 

20 under chapter 17 of title 38, United States 

21 Code; 

22 (xi) the Civilian Health and Medical 

23 Program of the Uniformed Services 

24 (CHAMPUS) (as defined in section 

25 1072(4) of title 10, United States Code); 
69 

•S 116 IS

1 (xii) the Indian Health Service pro2 gram under the Indian Health Care Im3 provement Act (25 U.S.C. 1601 et seq.); 

4 (xiii) the Federal Employees Health 

5 Benefits Program under chapter 89 of title 

6 5, United States Code; 

7 (xiv) an approved State child health 

8 plan under title XXI of the Social Security 

9 Act (42 U.S.C. 1397aa et seq.), providing 

10 benefits for child health assistance that 

11 meet the requirements of section 2103 of 

12 such Act (42 U.S.C. 1397cc); 

13 (xv) the Medicare+Choice program 

14 under part C of title XVIII of the Social 

15 Security Act (42 U.S.C. 1395w–21 et 

16 seq.); 

17 (xvi) a high risk pool that is a mecha18 nism established under State law to pro19 vide health insurance coverage or com20 parable coverage to eligible individuals; and 

21 (xvii) any other individual or group 

22 plan, or combination of individual or group 

23 plans, that provides or pays for the cost of 

24 medical care (as defined in section 
70 

•S 116 IS

1 2791(a)(2) of the Public Health Service 

2 Act (42 U.S.C. 300gg–91(a)(2)); and 

3 (B) excluding— 

4 (i) any policy, plan, or program to the 

5 extent that it provides, or pays for the cost 

6 of, excepted benefits that are listed in sec7 tion 2791(c)(1) of the Public Health Serv8 ice Act (42 U.S.C. 300gg–91(c)(1)); and 

9 (ii) a government-funded program 

10 (other than 1 listed in clause (i) through 

11 (xvi) of subparagraph (A)), whose principal 

12 purpose is other than providing, or paying 

13 the cost of, health care, or whose principal 

14 activity is the direct provision of health 

15 care to persons, or the making of grants to 

16 fund the direct provision of health care to 

17 persons. 

18 (14) INDIVIDUALLY IDENTIFIABLE HEALTH IN19 FORMATION.—The term ‘‘individually identifiable 

20 health information’’ means information that is a 

21 subset of health information, including demographic 

22 information collected from an individual, that— 

23 (A) is created or received by a covered en24 tity or employer; and 
71 

•S 116 IS

1 (B)(i) relates to the past, present, or fu2 ture physical or mental health or condition of 

3 an individual, the provision of health care to an 

4 individual, or the past, present, or future pay5 ment for the provision of health care to an indi6 vidual; and 

7 (ii)(I) identifies an individual; or 

8 (II) with respect to which there is a rea9 sonable basis to believe that the information 

10 can be used to identify an individual. 

11 (15) LAW ENFORCEMENT OFFICIAL.—The term 

12 ‘‘law enforcement official’’ means an officer or em13 ployee of any agency or authority of the United 

14 States, a State, a territory, a political subdivision of 

15 a State or territory, or an Indian tribe, who is em16 powered by law to— 

17 (A) investigate or conduct an official in18 quiry into a potential violation of law; or 

19 (B) prosecute or otherwise conduct a 

20 criminal, civil, or administrative proceeding 

21 arising from an alleged violation of law. 

22 (16) LIFE INSURER.—The term ‘‘life insurer’’ 

23 means a life insurance company (as defined in sec24 tion 816 of the Internal Revenue Code of 1986), in25 cluding the employees and agents of such company. 
72 

•S 116 IS

1 (17) MARKETING.—The term ‘‘marketing’’ 

2 means to make a communication about a product or 

3 service that encourages recipients of the communica4 tion to purchase or use the product or service. 

5 (18) NONCOVERED ENTITY.—The term ‘‘non6 covered entity’’ means any person or public or pri7 vate entity that is not a covered entity, including but 

8 not limited to a business associate of a covered enti9 ty, a covered entity if such covered entity is acting 

10 as a business associate, a health researcher, school 

11 or university, life insurer, employer, public health 

12 authority, health oversight agency, or law enforce13 ment official, or any person acting as an agent of 

14 such entities or persons. 

15 (19) ORGANIZED HEALTH CARE ARRANGE16 MENT.—The term ‘‘organized health care arrange17 ment’’ means— 

18 (A) a clinically integrated care setting in 

19 which individuals typically receive health care 

20 from more than 1 health care provider; 

21 (B) an organized system of health care in 

22 which more than 1 covered entity participates, 

23 and in which the participating covered enti24 ties— 
73 

•S 116 IS

1 (i) hold themselves out to the public 

2 as participating in a joint arrangement; 

3 and 

4 (ii) participate in joint activities in5 cluding at least— 

6 (I) utilization review, in which 

7 health care decisions by participating 

8 covered entities are reviewed by other 

9 participating covered entities or by a 

10 third party on their behalf; 

11 (II) quality assessment and im12 provement activities, in which treat13 ment provided by participating cov14 ered entities is assessed by other par15 ticipating covered entities or by a 

16 third party on their behalf; or 

17 (III) payment activities, if the fi18 nancial risk for delivering health care 

19 is shared, in part or in whole, by par20 ticipating covered entities through the 

21 joint arrangement and if protected 

22 health information created or received 

23 by a covered entity is reviewed by 

24 other participating covered entities or 

25 by a third party on their behalf for 
74 

•S 116 IS

1 the purpose of administering the shar2 ing of financial risk; 

3 (C) a group health plan and a health in4 surance issuer or HMO with respect to such 

5 group health plan, but only with respect to pro6 tected health information created or received by 

7 such health insurance issuer or HMO that re8 lates to individuals who are or who have been 

9 participants or beneficiaries in such group 

10 health plan; 

11 (D) a group health plan and 1 or more 

12 other group health plans each of which are 

13 maintained by the same plan sponsor; or 

14 (E) the group health plans described in 

15 subparagraph (D) and health insurance issuers 

16 or HMOs with respect to such group health 

17 plans, but only with respect to protected health 

18 information created or received by such health 

19 insurance issuers or HMOs that relates to indi20 viduals who are or have been participants or 

21 beneficiaries in any of such group health plans. 

22 (20) PROTECTED HEALTH INFORMATION.— 

23 (A) IN GENERAL.—The term ‘‘protected 

24 health information’’ means individually identifi-
75 

•S 116 IS

1 able health information that, except as provided 

2 in subparagraph (B), is— 

3 (i) transmitted by electronic media; 

4 (ii) maintained in any medium de5 scribed in the definition of electronic media 

6 in section 162.103 of title 45, Code of 

7 Federal Regulations; or 

8 (iii) transmitted or maintained in any 

9 other form or medium. 

10 (B) EXCLUSIONS.—Such term does not in11 clude individually identifiable health informa12 tion in— 

13 (i) education records covered by the 

14 Family Educational Rights and Privacy 

15 Act of 1974 (section 444 of the General 

16 Education Provisions Act (20 U.S.C. 

17 1232g)); 

18 (ii) records described in subsection 

19 (a)(4)(B)(iv) of that Act; or 

20 (iii) employment records held by a 

21 covered entity in its role as an employer. 

22 (21) PUBLIC HEALTH AUTHORITY.—The term 

23 ‘‘public health authority’’ means an agency or au24 thority of the United States, a State, a territory, a 

25 political subdivision of a State or territory, or an In-
76 

•S 116 IS

1 dian tribe, or a person or entity acting under a 

2 grant of authority from or contract with such public 

3 agency, including employees or agents of such public 

4 agency or its contractors or persons or entities to 

5 whom it has granted authority, that is responsible 

6 for public health matters as part of its official man7 date. 

8 (22) SCHOOL OR UNIVERSITY.—The term 

9 ‘‘school or university’’ means an institution or place 

10 for instruction or education, including an elementary 

11 school, secondary school, or institution of higher 

12 learning, a college, or an assemblage of colleges 

13 united under 1 corporate organization or govern14 ment. 

15 (23) SECRETARY.—The term ‘‘Secretary’’ 

16 means the Secretary of Health and Human Services. 

17 (24) SALE; SELL; SOLD.—The terms ‘‘sale’’, 

18 ‘‘sell’’, and ‘‘sold’’, with respect to protected health 

19 information, mean the exchange of such information 

20 for anything of value, directly or indirectly, including 

21 the licensing, bartering, or renting of such informa22 tion. 

23 (25) USE.—The term ‘‘use’’ means, with re24 spect to individually identifiable health information, 

25 the sharing, employment, application, utilization, ex-
77 

•S 116 IS

1 amination, or analysis of such information within an 

2 entity that maintains such information. 

3 (26) WRITING.—The term ‘‘writing’’ means 

4 writing in either a paper-based or computer-based 

5 form, including electronic and digital signatures. 

6 SEC. 402. PROHIBITION AGAINST SELLING PROTECTED 

7 HEALTH INFORMATION. 

8 (a) VALID AUTHORIZATION REQUIRED.— 

9 (1) IN GENERAL.—A noncovered entity shall 

10 not sell the protected health information of an indi11 vidual or use such information for marketing pur12 poses without an authorization that is valid under 

13 section 403. When a noncovered entity obtains or re14 ceives authorization to sell such information, such 

15 sale must be consistent with such authorization. 

16 (2) NO DUPLICATE AUTHORIZATION RE17 QUIRED.—Nothing in paragraph (1) shall be con18 strued as requiring a noncovered entity that receives 

19 from a covered entity an authorization that is valid 

20 under section 403 to obtain a separate authorization 

21 from an individual before the sale or use of the indi22 vidual’s protected health information so long as the 

23 sale or use of the information is consistent with the 

24 terms of the authorization. 
78 

•S 116 IS

1 (b) SCOPE.—A sale of protected health information 

2 as described under subsection (a) shall be limited to the 

3 minimum amount of information necessary to accomplish 

4 the purpose for which the sale is made. 

5 (c) PURPOSE.—A recipient of information sold pursu6 ant to this title may use or disclose such information solely 

7 to carry out the purpose for which the information was 

8 sold. 

9 (d) NOT REQUIRED.—Nothing in this title permitting 

10 the sale of protected health information shall be construed 

11 to require such sale. 

12 (e) IDENTIFICATION OF INFORMATION AS PRO13 TECTED HEALTH INFORMATION.—Information sold pur14 suant to this title shall be clearly identified as protected 

15 health information. 

16 (f) NO WAIVER.—Except as provided in this title, an 

17 individual’s authorization to sell protected health informa18 tion shall not be construed as a waiver of any rights that 

19 the individual has under other Federal or State laws, the 

20 rules of evidence, or common law. 

21 SEC. 403. AUTHORIZATION FOR SALE OR MARKETING OF 

22 PROTECTED HEALTH INFORMATION BY NON23 COVERED ENTITIES. 

24 (a) VALID AUTHORIZATION.—A valid authorization is 

25 a document that complies with all requirements of this 
79 

•S 116 IS

1 section. Such authorization may include additional infor2 mation not required under this section, provided that such 

3 information is not inconsistent with the requirements of 

4 this section. 

5 (b) DEFECTIVE AUTHORIZATION.—An authorization 

6 is not valid, if the document submitted has any of the fol7 lowing defects: 

8 (1) The expiration date has passed or the expi9 ration event is known by the noncovered entity to 

10 have occurred. 

11 (2) The authorization has not been filled out 

12 completely, with respect to an element described in 

13 subsections (e) and (f). 

14 (3) The authorization is known by the non15 covered entity to have been revoked. 

16 (4) The authorization lacks an element required 

17 by subsections (e) and (f). 

18 (5) Any material information in the authoriza19 tion is known by the noncovered entity to be false. 

20 (c) REVOCATION OF AUTHORIZATION.—An individual 

21 may revoke an authorization provided under this section 

22 at any time provided that the revocation is in writing, ex23 cept to the extent that the noncovered entity has taken 

24 action in reliance thereon. 

25 (d) DOCUMENTATION.— 
80 

•S 116 IS

1 (1) IN GENERAL.—A noncovered entity must 

2 document and retain any signed authorization under 

3 this section as required under paragraph (2). 

4 (2) STANDARD.—A noncovered entity shall, if a 

5 communication is required by this title to be in writ6 ing, maintain such writing, or an electronic copy, as 

7 documentation. 

8 (3) RETENTION PERIOD.—A noncovered entity 

9 shall retain the documentation required by this sec10 tion for 6 years from the date of its creation or the 

11 date when it last was in effect, whichever is later. 

12 (e) CONTENT OF AUTHORIZATION.— 

13 (1) CONTENT.—An authorization described in 

14 subsection (a) shall— 

15 (A) contain a description of the informa16 tion to be sold that identifies such information 

17 in a specific and meaningful manner; 

18 (B) contain the name or other specific 

19 identification of the person, or class of persons, 

20 authorized to sell the information; 

21 (C) contain the name or other specific 

22 identification of the person, or class of persons, 

23 to whom the information is to be sold; 

24 (D) include an expiration date or an expi25 ration event relating to the selling of such infor-
81 

•S 116 IS

1 mation that signifies that the authorization is 

2 valid until such date or event; 

3 (E) include a statement that the individual 

4 has a right to revoke the authorization in writ5 ing and the exceptions to the right to revoke, 

6 and a description of the procedure involved in 

7 such revocation; 

8 (F) be in writing and include the signature 

9 of the individual and the date, or if the author10 ization is signed by a personal representative of 

11 the individual, a description of such representa12 tive’s authority to act for the individual; and 

13 (G) include a statement explaining the 

14 purpose for which such information is sold. 

15 (2) PLAIN LANGUAGE.—The authorization shall 

16 be written in plain language. 

17 (f) NOTICE.— 

18 (1) IN GENERAL.—The authorization shall in19 clude a statement that the individual may— 

20 (A) inspect or copy the protected health in21 formation to be sold; and 

22 (B) refuse to sign the authorization. 

23 (2) COPY TO THE INDIVIDUAL.—A noncovered 

24 entity shall provide the individual with a copy of the 

25 signed authorization. 
82 

•S 116 IS

1 (g) MODEL AUTHORIZATIONS.—The Secretary, after 

2 notice and opportunity for public comment, shall develop 

3 and disseminate model written authorizations of the type 

4 described in this section and model statements of the limi5 tations on such authorizations. Any authorization obtained 

6 on a model authorization form developed by the Secretary 

7 pursuant to the preceding sentence shall be deemed to sat8 isfy the requirements of this section. 

9 (h) NONCOERCION.—A covered entity or noncovered 

10 entity shall not condition the purchase of a product or the 

11 provision of a service to an individual based on whether 

12 such individual provides an authorization to such entity 

13 as described in this section. 

14 SEC. 404. PROHIBITION AGAINST RETALIATION. 

15 A noncovered entity that collects protected health in16 formation, may not adversely affect another person, di17 rectly or indirectly, because such person has exercised a 

18 right under this title, disclosed information relating to a 

19 possible violation of this title, or associated with, or as20 sisted, a person in the exercise of a right under this title. 

21 SEC. 405. RULE OF CONSTRUCTION. 

22 The requirements of this title shall not be construed 

23 to impose any additional requirements or in any way alter 

24 the requirements imposed upon covered entities under 
83 

•S 116 IS

1 parts 160 through 164 of title 45, Code of Federal Regu2 lations. 

3 SEC. 406. REGULATIONS. 

4 (a) IN GENERAL.—The Secretary shall promulgate 

5 regulations implementing the provisions of this title. 

6 (b) TIMEFRAME.—Not later than 1 year after the 

7 date of enactment of this Act, the Secretary shall publish 

8 proposed regulations in the Federal Register. With regard 

9 to such proposed regulations, the Secretary shall provide 

10 an opportunity for submission of comments by interested 

11 persons during a period of not less than 90 days. Not later 

12 than 2 years after the date of enactment of this Act, the 

13 Secretary shall publish final regulations in the Federal 

14 Register. 

15 SEC. 407. ENFORCEMENT. 

16 (a) IN GENERAL.—A covered entity or noncovered 

17 entity that knowingly violates section 402 shall be subject 

18 to a civil money penalty under this section. 

19 (b) AMOUNT.—The civil money penalty described in 

20 subsection (a) shall not exceed $100,000. In determining 

21 the amount of any penalty to be assessed, the Secretary 

22 shall take into account the previous record of compliance 

23 of the entity being assessed with the applicable provisions 

24 of this title and the gravity of the violation. 

25 (c) ADMINISTRATIVE REVIEW.— 
84 

•S 116 IS

1 (1) OPPORTUNITY FOR HEARING.—The entity 

2 assessed shall be afforded an opportunity for a hear3 ing by the Secretary upon request made within 30 

4 days after the date of the issuance of a notice of as5 sessment. In such hearing the decision shall be made 

6 on the record pursuant to section 554 of title 5, 

7 United States Code. If no hearing is requested, the 

8 assessment shall constitute a final and unappealable 

9 order. 

10 (2) HEARING PROCEDURE.—If a hearing is re11 quested, the initial agency decision shall be made by 

12 an administrative law judge, and such decision shall 

13 become the final order unless the Secretary modifies 

14 or vacates the decision. Notice of intent to modify or 

15 vacate the decision of the administrative law judge 

16 shall be issued to the parties within 30 days after 

17 the date of the decision of the judge. A final order 

18 which takes effect under this paragraph shall be 

19 subject to review only as provided under subsection 

20 (d). 

21 (d) JUDICIAL REVIEW.— 

22 (1) FILING OF ACTION FOR REVIEW.—Any enti23 ty against whom an order imposing a civil money 

24 penalty has been entered after an agency hearing 

25 under this section may obtain review by the United 
85 

•S 116 IS

1 States district court for any district in which such 

2 entity is located or the United States District Court 

3 for the District of Columbia by filing a notice of ap4 peal in such court within 30 days from the date of 

5 such order, and simultaneously sending a copy of 

6 such notice by registered mail to the Secretary. 

7 (2) CERTIFICATION OF ADMINISTRATIVE

8 RECORD.—The Secretary shall promptly certify and 

9 file in such court the record upon which the penalty 

10 was imposed. 

11 (3) STANDARD FOR REVIEW.—The findings of 

12 the Secretary shall be set aside only if found to be 

13 unsupported by substantial evidence as provided by 

14 section 706(2)(E) of title 5, United States Code. 

15 (4) APPEAL.—Any final decision, order, or 

16 judgment of the district court concerning such re17 view shall be subject to appeal as provided in chap18 ter 83 of title 28 of such Code. 

19 (e) FAILURE TO PAY ASSESSMENT; MAINTENANCE

20 OF ACTION.— 

21 (1) FAILURE TO PAY ASSESSMENT.—If any en22 tity fails to pay an assessment after it has become 

23 a final and unappealable order, or after the court 

24 has entered final judgment in favor of the Secretary, 

25 the Secretary shall refer the matter to the Attorney 
86 

•S 116 IS

1 General who shall recover the amount assessed by 

2 action in the appropriate United States district 

3 court. 

4 (2) NONREVIEWABILITY.—In such action the 

5 validity and appropriateness of the final order im6 posing the penalty shall not be subject to review. 

7 (f) PAYMENT OF PENALTIES.—Except as otherwise 

8 provided, penalties collected under this section shall be 

9 paid to the Secretary (or other officer) imposing the pen10 alty and shall be available without appropriation and until 

11 expended for the purpose of enforcing the provisions with 

12 respect to which the penalty was imposed. 

13 TITLE V—DRIVER’S LICENSE 

14 PRIVACY 

15 SEC. 501. DRIVER’S LICENSE PRIVACY. 

16 Section 2725 of title 18, United States Code, is 

17 amended by striking paragraphs (2) through (4) and add18 ing the following: 

19 ‘‘(2) ‘person’ means an individual, organization, 

20 or entity, but does not include a State or agency 

21 thereof; 

22 ‘‘(3) ‘personal information’ means information 

23 that identifies an individual, including an individ24 ual’s photograph, social security number, driver 

25 identification number, name, address (but not the 5- 
87 

•S 116 IS

1 digit zip code), telephone number, medical or dis2 ability information, any physical copy of a driver’s li3 cense, birth date, information on physical character4 istics, including height, weight, sex or eye color, or 

5 any biometric identifiers on a license, including a 

6 finger print, but not information on vehicular acci7 dents, driving violations, and driver’s status; 

8 ‘‘(4) ‘highly restricted personal information’ 

9 means an individual’s photograph or image, social 

10 security number, medical or disability information, 

11 any physical copy of a driver’s license, driver identi12 fication number, birth date, information on physical 

13 characteristics, including height, weight, sex, or eye 

14 color, or any biometric identifiers on a license, in15 cluding a finger print; and’’. 

16 TITLE VI—MISCELLANEOUS 

17 SEC. 601. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 

18 (a) IN GENERAL.— 

19 (1) CIVIL ACTIONS.—In any case in which the 

20 attorney general of a State has reason to believe 

21 that an interest of the residents of that State has 

22 been or is threatened or adversely affected by the 

23 engagement of any person in a practice that is pro24 hibited under title I, II, or IV of this Act or under 

25 any amendment made by such a title, the State, as 
88 

•S 116 IS

1 parens patriae, may bring a civil action on behalf of 

2 the residents of the State in a district court of the 

3 United States of appropriate jurisdiction to— 

4 (A) enjoin that practice; 

5 (B) enforce compliance with such titles or 

6 such amendments; 

7 (C) obtain damage, restitution, or other 

8 compensation on behalf of residents of the 

9 State; or 

10 (D) obtain such other relief as the court 

11 may consider to be appropriate. 

12 (2) NOTICE.— 

13 (A) IN GENERAL.—Before filing an action 

14 under paragraph (1), the attorney general of 

15 the State involved shall provide to the Attorney 

16 General— 

17 (i) written notice of the action; and 

18 (ii) a copy of the complaint for the ac19 tion. 

20 (B) EXEMPTION.— 

21 (i) IN GENERAL.—Subparagraph (A) 

22 shall not apply with respect to the filing of 

23 an action by an attorney general of a State 

24 under this subsection, if the State attorney 

25 general determines that it is not feasible to 
89 

•S 116 IS

1 provide the notice described in such sub2 paragraph before the filing of the action. 

3 (ii) NOTIFICATION.—In an action de4 scribed in clause (i), the attorney general 

5 of a State shall provide notice and a copy 

6 of the complaint to the Attorney General 

7 at the same time as the State attorney 

8 general files the action. 

9 (b) INTERVENTION.— 

10 (1) IN GENERAL.—On receiving notice under 

11 subsection (a)(2), the Attorney General shall have 

12 the right to intervene in the action that is the sub13 ject of the notice. 

14 (2) EFFECT OF INTERVENTION.—If the Attor15 ney General intervenes in an action under subsection 

16 (a), the Attorney General shall have the right to be 

17 heard with respect to any matter that arises in that 

18 action. 

19 (c) CONSTRUCTION.—For purposes of bringing any 

20 civil action under subsection (a), nothing in this Act shall 

21 be construed to prevent an attorney general of a State 

22 from exercising the powers conferred on such attorney 

23 general by the laws of that State to— 

24 (1) conduct investigations; 

25 (2) administer oaths or affirmations; or 
90 

•S 116 IS

1 (3) compel the attendance of witnesses or the 

2 production of documentary and other evidence. 

3 (d) ACTIONS BY THE ATTORNEY GENERAL OF THE

4 UNITED STATES.—In any case in which an action is insti5 tuted by or on behalf of the Attorney General for violation 

6 of a practice that is prohibited under title I, II, IV, or 

7 V of this Act or under any amendment made by such a 

8 title, no State may, during the pendency of that action, 

9 institute an action under subsection (a) against any de10 fendant named in the complaint in that action for violation 

11 of that practice. 

12 (e) VENUE; SERVICE OF PROCESS.— 

13 (1) VENUE.—Any action brought under sub14 section (a) may be brought in the district court of 

15 the United States that meets applicable require16 ments relating to venue under section 1391 of title 

17 28, United States Code. 

18 (2) SERVICE OF PROCESS.—In an action 

19 brought under subsection (a), process may be served 

20 in any district in which the defendant— 

21 (A) is an inhabitant; or 

22 (B) may be found. 

23 SEC. 602. FEDERAL INJUNCTIVE AUTHORITY. 

24 In addition to any other enforcement authority con25 ferred under this Act or under an amendment made by 
91 

•S 116 IS

1 this Act, the Federal Government shall have injunctive au2 thority with respect to any violation of any provision of 

3 title I, II, or IV of this Act or of any amendment made 

4 by such a title, without regard to whether a public or pri5 vate entity violates such provision. 

Æ