II 

109TH CONGRESS 

1ST SESSION S. 1408 

To strengthen data protection and safeguards, require data breach 

notification, and further prevent identity theft. 

IN THE SENATE OF THE UNITED STATES 

JULY 14, 2005 

Mr. SMITH (for himself, Mr. NELSON of Florida, Mr. STEVENS, Mr. INOUYE, 

Mr. MCCAIN, and Mr. PRYOR) introduced the following bill; which was 

read twice and referred to the Committee on Commerce, Science, and 

Transportation 

A BILL 

To strengthen data protection and safeguards, require data 

breach notification, and further prevent identity theft. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 

4 (a) SHORT TITLE.—This Act may be cited as the 

5 ‘‘Identity Theft Protection Act’’. 

6 (b) TABLE OF CONTENTS.—The table of contents for 

7 this Act is as follows: 

Sec. 1. Short title; table of contents. 

Sec. 2. Protection of sensitive personal information. 

Sec. 3. Notification of security breach risk. 

Sec. 4. Security freeze. 

Sec. 5. Enforcement. 
2 

•S 1408 IS 

Sec. 6. Enforcement by State attorneys general. 

Sec. 7. Preemption of State law. 

Sec. 8. Social security and driver’s license number protection. 

Sec. 9. Information security working group. 

Sec. 10. Definitions. 

Sec. 11. Authorization of appropriations. 

Sec. 12. Effective dates. 

1 SEC. 2. PROTECTION OF SENSITIVE PERSONAL INFORMA2 TION. 

3 (a) IN GENERAL.—In accordance with regulations 

4 prescribed by the Federal Trade Commission under sub5 section (b), a covered entity shall take reasonable steps 

6 to protect against security breaches and to prevent unau7 thorized access to sensitive personal information the cov8 ered entity sells, maintains, collects, or transfers. 

9 (b) REGULATIONS.—Not later than 1 year after the 

10 date of enactment of this Act, the Commission shall pro11 mulgate regulations to implement subsection (a), including 

12 regulations that— 

13 (1) require covered entities to develop, imple14 ment, and maintain an effective information security 

15 program that contains administrative, technical, and 

16 physical safeguards for sensitive personal informa17 tion, taking into account the use of technological 

18 safeguards, including encryption, truncation, and 

19 other safeguards available or being developed for 

20 such purposes; 
3 

•S 1408 IS 

1 (2) require procedures for verifying the creden2 tials of any third party seeking to obtain the sen3 sitive personal information of another person; and 

4 (3) require disposal procedures to be followed 

5 by covered entities that— 

6 (A) dispose of sensitive personal informa7 tion; or 

8 (B) transfer sensitive personal information 

9 to third parties for disposal. 

10 SEC. 3. NOTIFICATION OF SECURITY BREACH RISK. 

11 (a) SECURITY BREACHES AFFECTING 1,000 OR

12 MORE INDIVIDUALS.— 

13 (1) IN GENERAL.—If a covered entity discovers 

14 a breach of security and determines that the breach 

15 of security affects the sensitive personal information 

16 of 1,000 or more individuals, then, before conducting 

17 the notification required by subsection (b), it shall— 

18 (A) report the breach to the Commission 

19 (or other appropriate Federal regulator under 

20 section 5); and 

21 (B) notify all consumer reporting agencies 

22 described in section 603(p)(1) of the Fair Cred23 it Reporting Act (15 U.S.C. 1681a(p)(1)) of the 

24 breach. 
4 

•S 1408 IS 

1 (2) FTC WEBSITE PUBLICATIONS.—Whenever 

2 the Commission receives a report under paragraph 

3 (1)(A), it shall post a report of the breach of secu4 rity on its website without disclosing any sensitive 

5 personal information or the names of the individuals 

6 affected. 

7 (b) NOTIFICATION OF CONSUMERS.—Whenever a 

8 covered entity discovers a breach of security and deter9 mines that the breach of security has resulted in, or that 

10 there is a basis for concluding that a reasonable risk of 

11 identity theft to 1 or more individuals, the covered entity 

12 shall notify each such individual. 

13 (c) METHODS OF NOTIFICATION; NOTICE CON14 TENT.—Within 1 year after the date of enactment of this 

15 Act, the Commission shall promulgate regulations that es16 tablish methods of notification to be followed by covered 

17 entities in complying with the requirements of this section 

18 and the content of the notices required. In promulgating 

19 those regulations, the Commission shall take into consider20 ation the types of sensitive personal information involved, 

21 the nature and scope of the security breach, other appro22 priate factors, and the most effective means of notifying 

23 affected individuals. 

24 (d) TIMING OF NOTIFICATION.— 
5 

•S 1408 IS 

1 (1) IN GENERAL.—Except as provided in para2 graph (2), notice required by subsection (a) shall be 

3 given— 

4 (A) in the most expedient manner prac5 ticable; 

6 (B) without unreasonable delay, but not 

7 later than 90 days after the date on which the 

8 breach of security was discovered by the covered 

9 entity; and 

10 (C) in a manner that is consistent with 

11 any measures necessary to determine the scope 

12 of the breach and restore the security and in13 tegrity of the data system. 

14 (2) LAW ENFORCEMENT AND HOMELAND SECU15 RITY RELATED DELAYS.—Notwithstanding para16 graph (1), the giving of notice as required by that 

17 paragraph may be delayed for a reasonable period of 

18 time if— 

19 (A) a Federal law enforcement agency de20 termines that the timely giving of notice under 

21 subsections (a) and (b), as required by para22 graph (1), would materially impede a civil or 

23 criminal investigation; or 

24 (B) a Federal national security or home25 land security agency determines that such time-
6 

•S 1408 IS 

1 ly giving of notice would threaten national or 

2 homeland security. 

3 SEC. 4. SECURITY FREEZE. 

4 (a) In General.— 

5 (1) EMPLACEMENT.—A consumer may place a 

6 security freeze on his or her credit report by making 

7 a request to a consumer credit reporting agency in 

8 writing or by telephone. 

9 (2) CONSUMER DISCLOSURE.—If a consumer 

10 requests a security freeze, the consumer credit re11 porting agency shall disclose to the consumer the 

12 process of placing and removing the security freeze 

13 and explain to the consumer the potential con14 sequences of the security freeze. 

15 (b) EFFECT OF SECURITY FREEZE.— 

16 (1) RELEASE OF INFORMATION BLOCKED.—If a 

17 security freeze is in place on a consumer’s credit re18 port, a consumer reporting agency may not release 

19 information from the credit report to a third party 

20 without prior express authorization from the con21 sumer. 

22 (2) INFORMATION PROVIDED TO THIRD PAR23 TIES.—Paragraph (2) does not prevent a consumer 

24 credit reporting agency from advising a third party 

25 that a security freeze is in effect with respect to the 
7 

•S 1408 IS 

1 consumer’s credit report. If a third party, in connec2 tion with an application for credit, requests access to 

3 a consumer credit report on which a security freeze 

4 is in place, the third party may treat the application 

5 as incomplete. 

6 (c) REMOVAL; TEMPORARY SUSPENSION.— 

7 (1) IN GENERAL.—Except as provided in para8 graph (4), a security freeze shall remain in place 

9 until the consumer requests that the security freeze 

10 be removed. A consumer may remove a security 

11 freeze on his or her credit report by making a re12 quest to a consumer credit reporting agency in writ13 ing or by telephone. 

14 (2) CONDITIONS.—A consumer credit reporting 

15 agency may remove a security freeze placed on a 

16 consumer’s credit report only— 

17 (A) upon the consumer’s request, pursuant 

18 to paragraph (1); or 

19 (B) if the agency determines that the con20 sumer’s credit report was frozen due to a mate21 rial misrepresentation of fact by the consumer. 

22 (3) NOTIFICATION TO CONSUMER.—If a con23 sumer credit reporting agency intends to remove a 

24 freeze upon a consumer’s credit report pursuant to 

25 paragraph (2)(B), the consumer credit reporting 
8 

•S 1408 IS 

1 agency shall notify the consumer in writing prior to 

2 removing the freeze on the consumer’s credit report. 

3 (4) TEMPORARY SUSPENSION.—A consumer 

4 may have a security freeze on his or her credit re5 port temporarily suspended by making a request to 

6 a consumer credit reporting agency in writing or by 

7 telephone and specifying beginning and ending dates 

8 for the period during which the security freeze is not 

9 to apply to that consumer’s credit report. 

10 (d) RESPONSE TIMES; NOTIFICATION OF OTHER EN11 TITIES.— 

12 (1) IN GENERAL.—A consumer credit reporting 

13 agency shall— 

14 (A) place a security freeze on a consumer’s 

15 credit report under subsection (a) no later than 

16 5 business days after receiving a request from 

17 the consumer under subsection (a)(1); and 

18 (B) remove, or temporarily suspend, a se19 curity freeze within 3 business days after re20 ceiving a request for removal or temporary sus21 pension from the consumer under subsection 

22 (c). 

23 (2) NOTIFICATION OF OTHER COVERED ENTI24 TIES.—If the consumer requests in writing or by 

25 telephone that other covered entities be notified of 
9 

•S 1408 IS 

1 the request, the consumer reporting agency shall no2 tify all other consumer reporting agencies described 

3 in section 603(p)(1) of the Fair Credit Reporting 

4 Act (15 U.S.C. 1681a(p)(1)) of the request within 3 

5 days after placing, removing, or temporarily sus6 pending a security freeze on the consumer’s credit 

7 report under subsection (a), (c)(2)(A), or subsection 

8 (c)(4), respectively. 

9 (3) IMPLEMENTATION BY OTHER COVERED EN10 TITIES.—A consumer reporting agency that is noti11 fied of a request under paragraph (2) to place, re12 move, or temporarily suspend a security freeze on a 

13 consumer’s credit report shall place, remove, or tem14 porarily suspend the security freeze on that credit 

15 report within 3 business days after receiving the no16 tification. 

17 (e) CONFIRMATION.—Whenever a consumer credit re18 porting agency places, removes, or temporarily suspends 

19 a security freeze on a consumer’s credit report at the re20 quest of that consumer under subsection (a) or (c), respec21 tively, it shall send a written confirmation thereof to the 

22 consumer within 10 business days after placing, removing, 

23 or temporarily suspending the security freeze on the credit 

24 report. This subsection does not apply to the placement, 

25 removal, or temporary suspension of a security freeze by 
10 

•S 1408 IS 

1 a consumer reporting agency because of a notification re2 ceived under subsection (d)(2). 

3 (f) ID REQUIRED.—A consumer credit reporting 

4 agency may not place, remove, or temporarily suspend a 

5 security freeze on a consumer’s credit report at the con6 sumer’s request unless the consumer provides proper iden7 tification (within the meaning of section 610(a)(1) of the 

8 Fair Credit Reporting Act (15 U.S.C. 1681h) and the reg9 ulations thereunder. 

10 (g) EXCEPTIONS.—This section does not apply to the 

11 use of a consumer credit report by any of the following: 

12 (1) A person or entity, or a subsidiary, affiliate, 

13 or agent of that person or entity, or an assignee of 

14 a financial obligation owing by the consumer to that 

15 person or entity, or a prospective assignee of a fi16 nancial obligation owing by the consumer to that 

17 person or entity in conjunction with the proposed 

18 purchase of the financial obligation, with which the 

19 consumer has or had prior to assignment an account 

20 or contract, including a demand deposit account, or 

21 to whom the consumer issued a negotiable instru22 ment, for the purposes of reviewing the account or 

23 collecting the financial obligation owing for the ac24 count, contract, or negotiable instrument. 
11 

•S 1408 IS 

1 (2) Any Federal, State or local agency, law en2 forcement agency, trial court, or private collection 

3 agency acting pursuant to a court order, warrant, or 

4 subpoena. 

5 (3) A child support agency or its agents or as6 signs acting pursuant to subtitle D of title IV of the 

7 Social Security Act (42 U.S.C. et seq.) or similar 

8 State law. 

9 (4) The Department of Health and Human 

10 Services, a similar State agency, or the agents or as11 signs of the Federal or State agency acting to inves12 tigate medicare or medicaid fraud. 

13 (5) The Internal Revenue Service or a State or 

14 municipal taxing authority, or a State department of 

15 motor vehicles, or any of the agents or assigns of 

16 these Federal, State, or municipal agencies acting to 

17 investigate or collect delinquent taxes or unpaid 

18 court orders or to fulfill any of their other statutory 

19 responsibilities. 

20 (6) The use of consumer credit information for 

21 the purposes of prescreening as provided for by the 

22 Federal Fair Credit Reporting Act (15 U.S.C. 1681 

23 et seq.). 
12 

•S 1408 IS 

1 (7) Any person or entity administering a credit 

2 file monitoring subscription to which the consumer 

3 has subscribed. 

4 (8) Any person or entity for the purpose of pro5 viding a consumer with a copy of his or her credit 

6 report or credit score upon the consumer’s request. 

7 (h) FEES.— 

8 (1) IN GENERAL.—Except as provided in para9 graph (2), a consumer credit reporting agency may 

10 charge a reasonable fee, as determined by the Com11 mission, for placing, removing, or temporarily sus12 pending a security freeze on a consumer’s credit re13 port. 

14 (2) ID THEFT VICTIMS.—A consumer credit re15 porting agency may not charge a fee for placing, re16 moving, or temporarily suspending a security freeze 

17 on a consumer’s credit report if— 

18 (A) the consumer is a victim of identity 

19 theft; and 

20 (B) the consumer has filed a police report 

21 with respect to the theft. 

22 (i) LIMITATION ON INFORMATION CHANGES IN FRO23 ZEN REPORTS.— 

24 (1) IN GENERAL.—If a security freeze is in 

25 place on a consumer’s credit report, a consumer 
13 

•S 1408 IS 

1 credit reporting agency may not change any of the 

2 following official information in that credit report 

3 without sending a written confirmation of the 

4 change to the consumer within 30 days after the 

5 change is made: 

6 (A) Name. 

7 (B) Date of birth. 

8 (C) Social Security number. 

9 (D) Address. 

10 (2) CONFIRMATION.—Paragraph (1) does not 

11 require written confirmation for technical modifica12 tions of a consumer’s official information, including 

13 name and street abbreviations, complete spellings, or 

14 transposition of numbers or letters. In the case of an 

15 address change, the written confirmation shall be 

16 sent to both the new address and to the former ad17 dress. 

18 (j) CERTAIN ENTITY EXEMPTIONS.— 

19 (1) AGGREGATORS AND OTHER AGENCIES.— 

20 The provisions of subsections (a) through (h) do not 

21 apply to a consumer credit reporting agency that 

22 acts only as a reseller of credit information by as23 sembling and merging information contained in the 

24 data base of another consumer credit reporting 

25 agency or multiple consumer credit reporting agen-
14 

•S 1408 IS 

1 cies, and does not maintain a permanent data base 

2 of credit information from which new consumer 

3 credit reports are produced. 

4 (2) OTHER EXEMPTED ENTITIES.—The fol5 lowing entities are not required to place a security 

6 freeze in a credit report: 

7 (A) A check services or fraud prevention 

8 services company, which issues reports on inci9 dents of fraud or authorizations for the purpose 

10 of approving or processing negotiable instru11 ments, electronic funds transfers, or similar 

12 methods of payments. 

13 (B) A deposit account information service 

14 company, which issues reports regarding ac15 count closures due to fraud, substantial over16 drafts, ATM abuse, or similar negative informa17 tion regarding a consumer, to inquiring banks 

18 or other financial institutions for use only in re19 viewing a consumer request for a deposit ac20 count at the inquiring bank or financial institu21 tion. 

22 SEC. 5. ENFORCEMENT. 

23 (a) ENFORCEMENT BY COMMISSION.—Except as pro24 vided in subsection (c), this Act shall be enforced by the 

25 Commission. 
15 

•S 1408 IS 

1 (b) VIOLATION IS UNFAIR OR DECEPTIVE ACT OR

2 PRACTICE.—The violation of any provision of this Act 

3 shall be treated as an unfair or deceptive act or practice 

4 proscribed under a rule issued under section 18(a)(1)(B) 

5 of the Federal Trade Commission Act (15 U.S.C. 

6 57a(a)(1)(B)). 

7 (c) ENFORCEMENT BY CERTAIN OTHER AGEN8 CIES.—Compliance with this Act shall be enforced 

9 under— 

10 (1) section 8 of the Federal Deposit Insurance 

11 Act (12 U.S.C. 1818), in the case of— 

12 (A) national banks, and Federal branches 

13 and Federal agencies of foreign banks, by the 

14 Office of the Comptroller of the Currency; 

15 (B) member banks of the Federal Reserve 

16 System (other than national banks), branches 

17 and agencies of foreign banks (other than Fed18 eral branches, Federal agencies, and insured 

19 State branches of foreign banks), commercial 

20 lending companies owned or controlled by for21 eign banks, and organizations operating under 

22 section 25 or 25A of the Federal Reserve Act 

23 (12 U.S.C. 601 and 611), by the Board; and 

24 (C) banks insured by the Federal Deposit 

25 Insurance Corporation (other than members of 
16 

•S 1408 IS 

1 the Federal Reserve System) and insured State 

2 branches of foreign banks, by the Board of Di3 rectors of the Federal Deposit Insurance Cor4 poration; 

5 (2) section 8 of the Federal Deposit Insurance 

6 Act (12 U.S.C. 1818), by the Director of the Office 

7 of Thrift Supervision, in the case of a savings asso8 ciation the deposits of which are insured by the Fed9 eral Deposit Insurance Corporation; 

10 (3) the Federal Credit Union Act (12 U.S.C. 

11 1751 et seq.) by the National Credit Union Adminis12 tration Board with respect to any Federal credit 

13 union; and 

14 (4) the Securities and Exchange Act of 1934 

15 (15 U.S.C. 78a et seq.) by the Securities and Ex16 change Commission with respect to— 

17 (A) a broker or dealer subject to that Act; 

18 (B) an investment company subject to the 

19 Investment Company Act of 1940 (15 U.S.C. 

20 80a–1 et seq.); and 

21 (C) an investment advisor subject to the 

22 Investment Advisers Act of 1940 (15 U.S.C. 

23 80b–1 et seq.). 

24 (d) EXERCISE OF CERTAIN POWERS.—For the pur25 pose of the exercise by any agency referred to in sub-
17 

•S 1408 IS 

1 section (c) of its powers under any Act referred to in that 

2 subsection, a violation of this Act is deemed to be a viola3 tion of a requirement imposed under that Act. In addition 

4 to its powers under any provision of law specifically re5 ferred to in subsection (c), each of the agencies referred 

6 to in that subsection may exercise, for the purpose of en7 forcing compliance with any requirement imposed under 

8 this Act, any other authority conferred on it by law. 

9 (e) PENALTIES.— 

10 (1) IN GENERAL.—Notwithstanding section 

11 5(m) of the Federal Trade Commission Act (15 

12 U.S.C. 45(m)), the Commission may not obtain a 

13 civil penalty under that section for a violation of this 

14 Act in excess of— 

15 (A) $11,000 for each such individual; and 

16 (B) $11,000,000 in the aggregate for all 

17 such individuals with respect to the same viola18 tion. 

19 (2) OTHER AUTHORITY NOT AFFECTED.—Noth20 ing in this Act shall be construed to limit or affect 

21 in any way the Commission’s authority to bring en22 forcement actions or take any other measure under 

23 the Federal Trade Commission Act (15 U.S.C. 41 et 

24 seq.) or any other provision of law. 
18 

•S 1408 IS 

1 (f) NO PRIVATE CAUSE OF ACTION.—Nothing in this 

2 Act establishes a private cause of action against a covered 

3 entity for the violation of any provision of this Act. 

4 (g) COMPLIANCE WITH GRAMM-LEACH-BLILEY

5 ACT.—Any person to which title V of the Gramm-Leach6 Bliley Act (15 U.S.C. 6801 et seq.) applies shall be 

7 deemed to be in compliance with the notification require8 ments of this Act with respect to a breach of security if 

9 that person is in compliance with the notification require10 ments of that title with respect to that breach of security. 

11 SEC. 6. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 

12 (a) IN GENERAL.—A State, as parens patriae, may 

13 bring a civil action on behalf of its residents in an appro14 priate district court of the United States to enforce the 

15 provisions of this Act, or to impose the civil penalties au16 thorized by section 5, whenever the attorney general of 

17 the State has reason to believe that the interests of the 

18 residents of the State have been or are being threatened 

19 or adversely affected by a covered entity that violates this 

20 Act or a regulation under this Act. 

21 (b) NOTICE.—The State shall serve written notice to 

22 the Commission (or other appropriate Federal regulator 

23 under section 5) of any civil action under subsection (a) 

24 prior to initiating such civil action. The notice shall in25 clude a copy of the complaint to be filed to initiate such 
19 

•S 1408 IS 

1 civil action, except that if it is not feasible for the State 

2 to provide such prior notice, the State shall provide such 

3 notice immediately upon instituting such civil action. 

4 (c) AUTHORITY TO INTERVENE.—Upon receiving the 

5 notice required by subsection (b), the Commission (or 

6 other appropriate Federal regulator under section 5) may 

7 intervene in such civil action and upon intervening— 

8 (1) be heard on all matters arising in such civil 

9 action; and 

10 (2) file petitions for appeal of a decision in such 

11 civil action. 

12 (d) CONSTRUCTION.—For purposes of bringing any 

13 civil action under subsection (a), nothing in this section 

14 shall prevent the attorney general of a State from exer15 cising the powers conferred on the attorney general by the 

16 laws of such State to conduct investigations or to admin17 ister oaths or affirmations or to compel the attendance 

18 of witnesses or the production of documentary and other 

19 evidence. 

20 (e) VENUE; SERVICE OF PROCESS.—In a civil action 

21 brought under subsection (a)— 

22 (1) the venue shall be a judicial district in 

23 which— 

24 (A) the covered entity operates; 
20 

•S 1408 IS 

1 (B) the covered entity was authorized to do 

2 business; or 

3 (C) where the defendant in the civil action 

4 is found; 

5 (2) process may be served without regard to the 

6 territorial limits of the district or of the State in 

7 which the civil action is instituted; and 

8 (3) a person who participated with a covered 

9 entity in an alleged violation that is being litigated 

10 in the civil action may be joined in the civil action 

11 without regard to the residence of the person. 

12 (f) LIMITATION ON STATE ACTION WHILE FEDERAL

13 ACTION IS PENDING.—If the Commission (or other appro14 priate Federal agency under section 5) has instituted a 

15 civil action or an administrative action for violation of this 

16 Act, no State attorney general, or official or agency of a 

17 State, may bring an action under this subsection during 

18 the pendency of that action against any defendant named 

19 in the complaint of the Commission or the other agency 

20 for any violation of this Act alleged in the complaint. 

21 (g) ENFORCEMENT OF STATE LAW.—Nothing con22 tained in this section shall prohibit an authorized State 

23 official from proceeding in State court to enforce a civil 

24 or criminal statute of such State. 
21 

•S 1408 IS 

1 SEC. 7. PREEMPTION OF STATE LAW. 

2 (a) IN GENERAL.—This Act preempts any State or 

3 local law, regulation, or rule that requires a covered enti4 ty— 

5 (1) to develop, implement, or maintain informa6 tion security programs to which this Act applies; or 

7 (2) to notify individuals of breaches of security 

8 regarding their sensitive personal information. 

9 (b) LIABILITY.—This Act preempts any State or local 

10 law, regulation, rule, administrative procedure, or judicial 

11 precedent under which liability is imposed on a covered 

12 entity for failure— 

13 (1) to implement and maintain an adequate in14 formation security program; or 

15 (2) to notify an individual of any breach of se16 curity pertaining to any sensitive personal informa17 tion about that individual. 

18 (c) SECURITY FREEZE.—This Act preempts any 

19 State or local law, regulation, or rule that requires con20 sumer reporting agencies to impose a security freeze on 

21 consumer credit reports at the request of a consumer. 

22 SEC. 8. SOCIAL SECURITY NUMBER PROTECTION. 

23 (a) PROHIBITION OF UNNECESSARY SOLICITATION

24 OF SOCIAL SECURITY NUMBERS.—No covered entity may 

25 solicit any social security number from an individual un-
22 

•S 1408 IS 

1 less there is a specific use of the social security number 

2 for which no other identifier reasonably can be used. 

3 (b) PROHIBITION OF THE DISPLAY OF SOCIAL SECU4 RITY NUMBERS ON EMPLOYEE IDENTIFICATION CARDS, 

5 ETC.— 

6 (1) IN GENERAL.—No covered entity may dis7 play the social security number (or any derivative of 

8 such number) of an individual on any card or tag 

9 that is commonly provided to employees (or to their 

10 family members), faculty, staff, or students for pur11 poses of identification. 

12 (2) DRIVER’S LICENSES.—A State may not dis13 play the social security number of an individual on 

14 driver’s licenses issued by that State. 

15 (c) PROHIBITION OF INMATE ACCESS TO SOCIAL SE16 CURITY ACCOUNT NUMBERS.— 

17 (1) IN GENERAL.—Section 205(c)(2)(C) of the 

18 Social Security Act (42 U.S.C. 405(c)(2)(C)), as 

19 amended by subsection (b), is amended by adding at 

20 the end the following new clause: 

21 ‘‘(xi) No executive, legislative, or judicial agency or 

22 instrumentality of the Federal Government or of a State 

23 or political subdivision thereof (or person acting as an 

24 agent of such an agency or instrumentality) may employ, 

25 or enter into a contract for the use or employment of, pris-
23 

•S 1408 IS 

1 oners in any capacity that would allow such prisoners ac2 cess to the social security account numbers of other indi3 viduals. For purposes of this clause, the term ‘prisoner’ 

4 means an individual confined in a jail, prison, or other 

5 penal institution or correctional facility.’’. 

6 (2) TREATMENT OF CURRENT ARRANGE7 MENTS.—In the case of— 

8 (i) prisoners employed as described in 

9 clause (xi) of section 205(c)(2)(C) of the 

10 Social Security Act (42 U.S.C. 

11 405(c)(2)(C)), as added by paragraph (1), 

12 on the date of enactment of this Act, and 

13 (ii) contracts described in such clause 

14 in effect on such date, 

15 the amendment made by this section shall take 

16 effect 90 days after the date of enactment of 

17 this Act. 

18 SEC. 9. INFORMATION SECURITY WORKING GROUP. 

19 (a) INFORMATION SECURITY WORKING GROUP.— 

20 The Chairman of the Commission shall establish an Infor21 mation Security Working Group to develop best practices 

22 to protect sensitive personal information stored and trans23 ferred. The Working Group shall be composed of industry 

24 participants, consumer groups, and other interested par25 ties. 
24 

•S 1408 IS 

1 (b) REPORT.—Not later than 12 months after the 

2 date on which the Working Group is established under 

3 subsection (a), the Working Group shall submit to Con4 gress a report on their findings. 

5 SEC. 10. DEFINITIONS. 

6 In this Act: 

7 (1) BREACH OF SECURITY.—The term ‘‘breach 

8 of security’’ means unauthorized access to and ac9 quisition of data in any form or format containing 

10 sensitive personal information that compromises the 

11 security or confidentiality of such information and 

12 establishes a basis to conclude that a reasonable risk 

13 of identity theft to an individual exists. 

14 (2) COMMISSION.—The term ‘‘Commission’’ 

15 means the Federal Trade Commission. 

16 (3) CONSUMER CREDIT REPORTING AGENCY.— 

17 The term ‘‘consumer credit reporting agency’’ means 

18 any person which, for monetary fees, dues, or on a 

19 cooperative nonprofit basis, regularly engages in 

20 whole or in part in the practice of assembling or 

21 evaluating consumer credit information or other in22 formation on consumers for the purpose of fur23 nishing credit reports to third parties, and which 

24 uses any means or facility of interstate commerce 
25 

•S 1408 IS 

1 for the purpose of preparing or furnishing credit re2 ports. 

3 (4) COVERED ENTITY.—The term ‘‘covered en4 tity’’ means a sole proprietorship, partnership, cor5 poration, trust, estate, cooperative, association, or 

6 other commercial entity, and any charitable, edu7 cational, or nonprofit organization, that acquires, 

8 maintains, or utilizes sensitive personal information. 

9 (5) CREDIT REPORT.—The term ‘‘credit report’’ 

10 means a consumer report, as defined in section 

11 603(d) of the Federal Fair Credit Reporting Act (15 

12 U.S.C. 1681a(p)), that is used or expected to be 

13 used or collected in whole or in part for the purpose 

14 of serving as a factor in establishing a consumer’s 

15 eligibility for credit for personal, family or household 

16 purposes. 

17 (6) IDENTITY THEFT.—The term ‘‘identity 

18 theft’’ means the unauthorized acquisition, purchase, 

19 sale, or use by any person of an individual’s sensitive 

20 personal information that— 

21 (A) violates section 1028 of title 18, 

22 United States Code, or any provision of State 

23 law in pari materia; or 
26 

•S 1408 IS 

1 (B) results in economic loss to the indi2 vidual whose sensitive personal information was 

3 used. 

4 (7) REVIEWING THE ACCOUNT.—The term ‘‘re5 viewing the account’’ includes activities related to 

6 account maintenance, monitoring, credit line in7 creases, and account upgrades and enhancements. 

8 (8) SENSITIVE PERSONAL INFORMATION.— 

9 (A) IN GENERAL.—Except as provided in 

10 subparagraphs (B) and (C), the term ‘‘sensitive 

11 personal information’’ means an individual’s 

12 name, address, or telephone number combined 

13 with 1 or more of the following data elements 

14 related to that individual: 

15 (i) Social security number, taxpayer 

16 identification number, or employer identi17 fication number. 

18 (ii) Financial account number, or 

19 credit card or debit card number of such 

20 individual, combined with any required se21 curity code, access code, or password that 

22 would permit access to such individual’s 

23 account. 
27 

•S 1408 IS 

1 (iii) State driver’s license identifica2 tion number or State resident identifica3 tion number. 

4 (iv) Consumer credit report. 

5 (v) Employee, faculty, student, or 

6 United States armed forces serial number. 

7 (vi) Genetic or biometric information. 

8 (vii) Mother’s maiden name. 

9 (B) FTC MODIFICATIONS.—The Commis10 sion may, through a rulemaking proceeding, 

11 designate other identifying information that 

12 may be used to effectuate identity theft as sen13 sitive personal information for purposes of this 

14 Act and limit or exclude any information de15 scribed in subparagraph (A) from the definition 

16 of sensitive personal information for purposes of 

17 this Act. 

18 (C) PUBLIC RECORDS.—Nothing in this 

19 Act prohibits a covered entity from obtaining, 

20 aggregating, or using sensitive personal infor21 mation it lawfully obtains from public records 

22 in a manner that does not violate this Act. 
28 

•S 1408 IS 

1 SEC. 11. AUTHORIZATION OF APPROPRIATIONS. 

2 There are authorized to be appropriated to the Com3 mission $1,000,000 for each of fiscal years 2006 through 

4 2010 to carry out this Act. 

5 SEC. 12. EFFECTIVE DATES. 

6 (a) IN GENERAL.—Except as provided in subsection 

7 (b), the provisions of this Act take effect upon its enact8 ment. 

9 (b) PROVISIONS REQUIRING RULEMAKING.—The 

10 Commission shall initiate 1 or more rulemaking pro11 ceedings under sections 2, 3, and 4 within 45 days after 

12 the date of enactment of this Act. The Commission shall 

13 promulgate all final rules pursuant to those rulemaking 

14 proceedings within 1 year after the date of enactment of 

15 this Act. The provisions of sections 2, 3, and 4 shall take 

16 effect on the same date 6 months after the date on which 

17 the Commission promulgates the last final rule under the 

18 proceeding or proceedings commenced under the preceding 

19 sentence. 

20 (c) PREEMPTION.—Section 7 shall take effect at the 

21 same time as sections 2, 3, and 4 take effect. 

Æ