II 

109TH CONGRESS 

1ST SESSION S. 1336 

To establish procedures for the protection of consumers from misuse of, 

and unauthorized access to, sensitive personal information contained in 

private information files maintained by commercial entities engaged in, 

or affecting, interstate commerce, provide for enforcement of those procedures by the Federal Trade Commission, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JUNE 29, 2005 

Mr. PRYOR introduced the following bill; which was read twice and referred 

to the Committee on Commerce, Science, and Transportation 

A BILL 

To establish procedures for the protection of consumers from 

misuse of, and unauthorized access to, sensitive personal 

information contained in private information files maintained by commercial entities engaged in, or affecting, 

interstate commerce, provide for enforcement of those 

procedures by the Federal Trade Commission, and for 

other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS.. 

4 (a) SHORT TITLE.—This Act may be cited as the 

5 ‘‘Consumer Identity Protection and Security Act’’. 
2 

•S 1336 IS 

1 (b) TABLE OF CONTENTS.—The table of contents for 

2 this Act is as follows: 

Sec. 1. Short title; table of contents. 

Sec. 2. Consumer right to security freeze. 

Sec. 3. Limited or temporary access to frozen report. 

Sec. 4. Termination of security freeze. 

Sec. 5. Denial of third party requests. 

Sec. 6. Exceptions to security freeze. 

Sec. 7. Notification of violation. 

Sec. 8. Application to other consumer reporting agencies. 

Sec. 9. Enforcement. 

Sec. 10. Private right of action. 

Sec. 11. Service fees and charges. 

Sec. 12. Definitions. 

Sec. 13. Regulations. 

3 SEC. 2. CONSUMER RIGHT TO SECURITY FREEZE. 

4 (a) IN GENERAL.—A consumer reporting agency 

5 shall place a security freeze on a private information file 

6 when requested by the consumer to whom that file re7 lates— 

8 (1) by certified mail, 

9 (2) by telephone by providing certain sensitive 

10 personal information, or 

11 (3) through a secure electronic mail connection 

12 if such connection is made available by the consumer 

13 reporting agency. 

14 (b) TIMING.—A consumer reporting agency shall 

15 place the requested security freeze on the private informa16 tion file no later than 2 business days after receiving a 

17 written or telephone request from the consumer or 24 

18 hours after receiving a secure electronic mail request. 
3 

•S 1336 IS 

1 (c) CONFIRMATION.—Within 2 business days after 

2 placing a security freeze on a private information file 

3 under subsection (a), the consumer reporting agency that 

4 received the request from the consumer shall— 

5 (1) send a written confirmation of the security 

6 freeze to the consumer; and 

7 (2) provide to the consumer a unique personal 

8 identification number or password to be used by the 

9 consumer to authorize access to the private informa10 tion file or to remove the security freeze on the file. 

11 (d) PROHIBITION ON UNAUTHORIZED ACCESS.—A 

12 consumer reporting agency may not grant access to a pri13 vate information file on which a security freeze has been 

14 placed, or release information contained in a such a pri15 vate information file, except in accordance with the provi16 sions of this Act or other Federal law. 

17 SEC. 3. LIMITED OR TEMPORARY ACCESS TO FROZEN RE18 PORT. 

19 (a) IN GENERAL.—Within 3 business days after re20 ceiving a request from a consumer upon whose private in21 formation file a security freeze has been placed to allow 

22 access to that file to a third party, or for a period of time, 

23 specified by the consumer, a consumer reporting agency 

24 shall make the private information file available in accord25 ance with the request notwithstanding the security freeze. 
4 

•S 1336 IS 

1 Each consumer reporting agency shall develop procedures 

2 involving the use of telephone, facsimile machine, or, upon 

3 the consent of the consumer in the manner required by 

4 the Electronic Signatures in Global and National Com5 merce Act (15 U.S.C. 7001 et seq.) for notices legally re6 quired to be in writing, by the Internet, e-mail, or other 

7 electronic medium, to receive and process a request from 

8 a consumer to provide limited or temporary access to the 

9 private information file under this section in an expedited 

10 manner. 

11 (b) REQUEST REQUIREMENTS.—A consumer report12 ing agency may not allow access to a private information 

13 file under subsection (a) unless— 

14 (1) the request was made by the consumer by 

15 telephone, certified mail, or security electronic mail 

16 (except as provided in accordance with procedures 

17 established pursuant to the second sentence of sub18 section (a)); and 

19 (2) the consumer provides— 

20 (A) proper identification, 

21 (B) the unique personal identification 

22 number or password provided by the consumer 

23 reporting agency under this section; and 

24 (C) the proper information regarding the 

25 third party who is to receive the private infor-
5 

•S 1336 IS 

1 mation file or the time period for which the file 

2 shall be made available. 

3 (c) TERMINATION NOT PERMITTED.—A consumer 

4 reporting agency may not terminate a security freeze on 

5 the basis of a request under subsection (a) for limited ac6 cess to a private information file. 

7 SEC. 4. TERMINATION OF SECURITY FREEZE. 

8 (a) IN GENERAL.—A consumer reporting agency 

9 shall terminate a security freeze on a private information 

10 file if— 

11 (1) the consumer requests that the security 

12 freeze be terminated; or 

13 (2) the consumer reporting agency— 

14 (A) determines that the security freeze was 

15 placed on the private information file due to a 

16 material misrepresentation of fact by the con17 sumer; and 

18 (B) notifies the consumer in writing not 

19 less than 5 business days before terminating 

20 the security freeze under this paragraph. 

21 (b) TERMINATION REQUESTS.—Except as provided 

22 in subsection (a)(2), a consumer reporting agency may not 

23 terminate a security freeze on a private information file 

24 unless the consumer provides— 

25 (1) proper identification; and 
6 

•S 1336 IS 

1 (2) the unique personal identification number 

2 or password provided by the consumer reporting 

3 agency under this Act. 

4 (c) TIMING.—A consumer reporting agency shall ter5 minate a security freeze on a private information file with6 in 3 business days after receiving a request that meets 

7 the requirements of this section from the consumer to 

8 whom the file relates. 

9 SEC. 5. DENIAL OF THIRD PARTY REQUESTS. 

10 (a) REQUESTS DENIED DUE TO SECURITY

11 FREEZE.—Notwithstanding any other provision of law to 

12 the contrary, if a third party’s request for access to a pri13 vate information file is denied because there is a security 

14 freeze on it, that third party may treat any application 

15 in connection with which the request is made as incom16 plete. 

17 (b) NOTIFICATION OF CONSUMER.—If a consumer 

18 reporting agency denies a third party’s request for access 

19 to a private information file on which a security freeze 

20 has been placed for any purpose other than account re21 view, the consumer reporting agency shall notify the con22 sumer that it denied the request within 1 business day 

23 thereafter. The notice shall identify the third party mak24 ing the request and the stated purpose of the request. 
7 

•S 1336 IS 

1 SEC. 6. EXCEPTIONS TO SECURITY FREEZE. 

2 The provisions of this Act do not apply to requests 

3 for access to a private information file by any of the fol4 lowing: 

5 (1) A Federal, State, or local law enforcement 

6 agency acting within the scope of its authority or 

7 pursuant to a court order, warrant, or subpoena. 

8 (2) A Federal, State, or local agency that ad9 ministers a program for establishing an enforcing 

10 child support obligations. 

11 (3) A Federal, State, or local health agency or 

12 its agents or assignees acting to investigate fraud. 

13 (4) A Federal, State, or local tax agency, or its 

14 agents or assignees, acting to investigate or collect 

15 delinquent taxes or unpaid court orders or to fulfill 

16 any of its other statutory responsibilities. 

17 (5) A person, or the person’s subsidiary, affil18 iate, agent, or assignee with which the consumer has 

19 or, prior to assignment, had an account, contract, or 

20 debtor-creditor relationship for the purposes of re21 viewing the account or collecting the financial obliga22 tion owing for the account, contract, or debt. 

23 (6) A subsidiary, affiliate, agent, assignee, or 

24 prospective assignee of a person to whom access has 

25 been granted under paragraph (5) for purposes of 
8 

•S 1336 IS 

1 facilitating the extension of credit or other permis2 sible use. 

3 (7) Any person or entity for the purpose of pro4 viding a consumer with a copy of his or her private 

5 information file upon the consumer’s request. 

6 SEC. 7. NOTIFICATION OF VIOLATION. 

7 (a) NOTIFICATION.—If a consumer reporting agency 

8 violates the requirements of this Act with respect to access 

9 to a private information file, it shall notify the consumer 

10 in writing of the violation within 5 business days. The no11 tice shall include a description of the information to which 

12 access was granted and the name and address of the third 

13 party to whom such access was granted. 

14 (b) COMPLAINTS TO CONSUMER PROTECTION AGEN15 CIES.—If a private information file on which a security 

16 freeze under this Act is accessed in violation of this Act, 

17 the consumer to whom the file relates may file a complaint 

18 with the Federal Trade Commission, the attorney general 

19 of the State in which the consumer resides, or any other 

20 Federal or State consumer protection agency. 

21 SEC. 8. APPLICATION TO OTHER CONSUMER REPORTING 

22 AGENCIES. 

23 (a) NOTIFICATION.—Whenever a consumer reporting 

24 agency receives a request from a consumer under this Act 

25 that meets the requirements of this Act to place a security 
9 

•S 1336 IS 

1 freeze on his or her private information file under section 

2 2, to provide temporary or limited access to such a private 

3 information file under section 3, or to terminate a security 

4 freeze on such a private information file under section 4, 

5 it shall notify (on a secure basis) every other consumer 

6 reporting agency in the United States that it knows, or 

7 has reason to know, to maintain a private information file 

8 on that consumer of the request. 

9 (b) COMPLIANCE BY OTHER CONSUMER REPORTING

10 AGENCIES.—A consumer reporting agency that receives a 

11 reported request under subsection (a) shall comply with 

12 the requirements of this Act with respect to that request 

13 to the same extent and in the same manner as if it had 

14 received the request from the consumer. 

15 (c) LIABILITY.—A consumer reporting agency re16 sponding to a notification from another consumer report17 ing agency under subsection (a) is liable for any violation 

18 of this Act with respect to the request to which the notifi19 cation relates to the same extent as if it had received the 

20 request from the consumer, except that such an agency 

21 shall not be liable for any violation attributable to incor22 rect information provided in the request from the notifying 

23 agency. 
10 

•S 1336 IS 

1 SEC. 9. ENFORCEMENT. 

2 (a) VIOLATION IS UNFAIR OR DECEPTIVE ACT OR

3 PRACTICE.—The violation of any provision of this Act is 

4 an unfair or deceptive act or practice proscribed under sec5 tion 18(a)(1)(B) of the Federal Trade Commission Act 

6 (15 U.S.C. 57a(a)(1)(B)). 

7 (b) ENFORCEMENT BY FEDERAL TRADE COMMIS8 SION.—Except as provided in subsection (c), this Act shall 

9 be enforced by the Federal Trade Commission. 

10 (c) ENFORCEMENT BY CERTAIN OTHER AGEN11 CIES.—Compliance with this Act shall be enforced 

12 under— 

13 (1) section 8 of the Federal Deposit Insurance 

14 Act (12 U.S.C. 1818), in the case of— 

15 (A) national banks, and Federal branches 

16 and Federal agencies of foreign banks, by the 

17 Office of the Comptroller of the Currency; 

18 (B) member banks of the Federal Reserve 

19 System (other than national banks), branches 

20 and agencies of foreign banks (other than Fed21 eral branches, Federal agencies, and insured 

22 State branches of foreign banks), commercial 

23 lending companies owned or controlled by for24 eign banks, and organizations operating under 

25 section 25 or 25A of the Federal Reserve Act 

26 (12 U.S.C. 601 and 611), by the Board; and 
11 

•S 1336 IS 

1 (C) banks insured by the Federal Deposit 

2 Insurance Corporation (other than members of 

3 the Federal Reserve System) and insured State 

4 branches of foreign banks, by the Board of Di5 rectors of the Federal Deposit Insurance Cor6 poration; 

7 (2) section 8 of the Federal Deposit Insurance 

8 Act (12 U.S.C. 1818), by the Director of the Office 

9 of Thrift Supervision, in the case of a savings asso10 ciation the deposits of which are insured by the Fed11 eral Deposit Insurance Corporation; 

12 (3) the Federal Credit Union Act (12 U.S.C. 

13 1751 et seq.) by the National Credit Union Adminis14 tration Board with respect to any Federal credit 

15 union; 

16 (4) part A of subtitle VII of title 49, United 

17 States Code, by the Secretary of Transportation 

18 with respect to any air carrier or foreign air carrier 

19 subject to that part; 

20 (5) the Packers and Stockyards Act, 1921 (7 

21 U.S.C. 181 et seq.) (except as provided in section 

22 406 of that Act (7 U.S.C. 226, 227)), by the Sec23 retary of Agriculture with respect to any activities 

24 subject to that Act; 
12 

•S 1336 IS 

1 (6) the Farm Credit Act of 1971 (12 U.S.C. 

2 2001 et seq.) by the Farm Credit Administration 

3 with respect to any Federal land bank, Federal land 

4 bank association, Federal intermediate credit bank, 

5 or production credit association; 

6 (7) the Securities and Exchange Act of 1934 

7 (15 U.S.C. 78a et seq.) by the Securities and Ex8 change Commission with respect to— 

9 (A) a broker or dealer subject to that Act; 

10 (B) an investment company subject to the 

11 Investment Company Act of 1940 (15 U.S.C. 

12 80a–1 et seq.); and 

13 (C) an investment advisor subject to the 

14 Investment Advisers Act of 1940 (15 U.S.C. 

15 80b–1 et seq.); 

16 (8) the Communications Act of 1934 (47 

17 U.S.C. 151 et seq.) by the Federal Communications 

18 Commission with respect to common carriers subject 

19 to the Communications Act of 1934 and excluded 

20 from the jurisdiction of the Federal Trade Commis21 sion by section 5(a)(2) of the Federal Trade Com22 mission Act (15 U.S.C. 45(a)(2)); and 

23 (9) the State insurance law (applying the insur24 ance law of that State subject to section 104 of the 

25 Gramm-Bliley-Leach Act (15 U.S.C. 6701)) of a 
13 

•S 1336 IS 

1 State in which a covered entity engaged in providing 

2 insurance is domiciled, by the State insurance au3 thority of that State with respect to such an entity, 

4 except that in any State in which the State insur5 ance authority elects not to exercise this power, com6 pliance with this Act shall be enforced by the Fed7 eral Trade Commission. 

8 (d) EXERCISE OF CERTAIN POWERS.—For the pur9 pose of the exercise by any agency referred to in sub10 section (c) of its powers under any Act referred to in that 

11 subsection, a violation of this Act is deemed to be a viola12 tion of a requirement imposed under that Act. In addition 

13 to its powers under any provision of law specifically re14 ferred to in subsection (c), each of the agencies referred 

15 to in that subsection may exercise, for the purpose of en16 forcing compliance with any requirement imposed under 

17 this Act, any other authority conferred on it by law. 

18 (e) ACTIONS BY THE COMMISSION.—The Commission 

19 shall prevent any person from violating this Act in the 

20 same manner, by the same means, and with the same ju21 risdiction, powers, and duties as though all applicable 

22 terms and provisions of the Federal Trade Commission 

23 Act (15 U.S.C. 41 et seq.) were incorporated into and 

24 made a part of this Act. A consumer reporting agency that 

25 violates a provision of this Act is subject to the penalties 
14 

•S 1336 IS 

1 and entitled to the privileges and immunities provided in 

2 the Federal Trade Commission Act in the same manner, 

3 by the same means, and with the same jurisdiction, power, 

4 and duties as though all applicable terms and provisions 

5 of the Federal Trade Commission Act were incorporated 

6 into and made a part of this Act. 

7 SEC. 10. PRIVATE RIGHT OF ACTION. 

8 (a) IN GENERAL.—If a consumer reporting agency 

9 violates the requirements of this Act with respect to access 

10 to a private information file, the consumer may file a civil 

11 action in any court of competent jurisdiction. 

12 (b) REMEDIES.—A court in which such a civil action 

13 has been brought may— 

14 (1) impose a civil penalty of not more than 

15 $10,000 for each violation of this Act with respect 

16 to the plaintiff’s private information file; and 

17 (2) provide such additional relief as the court 

18 deems appropriate, including the award of court 

19 costs, investigative costs, and reasonable attorney’s 

20 fees. 

21 SEC. 11. SERVICE FEES AND CHARGES. 

22 (a) FEES PROHIBITED.—A consumer reporting agen23 cy may not impose a charge or fee for placing a security 

24 freeze on a private information file under section 2, for 

25 providing limited access to a private information file under 
15 

•S 1336 IS 

1 section 3, or for terminating a security freeze on a private 

2 information file under section 4. 

3 (b) REPLACEMENT IDENTIFICATION CODES AND

4 PASSWORDS.—A consumer reporting agency— 

5 (1) may not impose a fee for the replacement 

6 or reissue of a lost or forgotten personal identifica7 tion number or password the first time the replace8 ment or reissue is provided to the consumer; but 

9 (2) may impose a fee of not more than $5 for 

10 a second or subsequent replacement or reissue of 

11 such a personal identification number or password. 

12 SEC. 12. DEFINITIONS. 

13 In this Act: 

14 (1) ACCOUNT REVIEW.—The term ‘‘account re15 view’’ means any activity related to account mainte16 nance, monitoring, credit line increases, or account 

17 upgrades and enhancements. 

18 (2) CONSUMER REPORTING AGENCY.—The term 

19 ‘‘consumer reporting agency’’ means any person 

20 that, for fees, dues, or on a cooperative nonprofit 

21 basis, regularly engages in the practice of assem22 bling or evaluating information on consumers for the 

23 purpose of providing consumer credit reports, or in24 formation contained in such reports, to third parties. 

25 (3) PRIVATE INFORMATION FILE.— 
16 

•S 1336 IS 

1 (A) IN GENERAL.—The term ‘‘private in2 formation file’’ means any written, oral, or 

3 other communication of any information by a 

4 consumer reporting agency bearing on a con5 sumer’s character, general reputation, personal 

6 characteristics, mode of living, employment, or 

7 personal financial information to be used in 

8 whole or in part for political campaign, chari9 table solicitation, commercial marketing pur10 poses or as a factor in establishing the con11 sumer’s eligibility for— 

12 (i) credit or insurance to be used pri13 marily for personal, family, or household 

14 purposes; or 

15 (ii) employment purposes. 

16 (B) EXCLUSIONS.—Except as provided in 

17 subparagraph (C), the term ‘‘private informa18 tion file’’ does not include— 

19 (i) any report containing information 

20 solely as to transactions or experiences be21 tween the consumer and the person mak22 ing the report; 

23 (ii) the communication of that infor24 mation among persons related by common 
17 

•S 1336 IS 

1 ownership or affiliated by corporate con2 trol; or 

3 (iii) the communication of other infor4 mation among persons related by common 

5 ownership or affiliated by corporate con6 trol, if it is clearly and conspicuously dis7 closed to the consumer that the informa8 tion may be communicated among such 

9 persons and the consumer is given the op10 portunity, before the time that the infor11 mation is initially communicated, to direct 

12 that such information not be commu13 nicated among such persons; 

14 (iv) any authorization or approval of a 

15 specific extension of credit directly or indi16 rectly by the issuer of a credit card or 

17 similar device; or 

18 (v) any report in which a person who 

19 has been requested by a third party to 

20 make a specific extension of credit directly 

21 or indirectly to a consumer conveys his or 

22 her decision with respect to such request, 

23 if the third party advises the consumer of 

24 the name and address of the person to 

25 whom the request was made, and such per-
18 

•S 1336 IS 

1 son makes the required disclosures to the 

2 consumer under Federal law. 

3 (C) RESTRICTION ON SHARING OF MED4 ICAL INFORMATION.—Except for information or 

5 any communication of information disclosed as 

6 provided in Federal law, the exclusions in sub7 paragraph (B) do not apply with respect to in8 formation disclosed to any person related by 

9 common ownership or affiliated by corporate 

10 control, if the information is— 

11 (i) medical information; 

12 (ii) an individualized list or descrip13 tion based on the payment transactions of 

14 the consumer for medical products or serv15 ices; or 

16 (iii) an aggregate list of identified 

17 consumers based on payment transactions 

18 for medical products or services. 

19 SEC. 13. REGULATIONS. 

20 (a) RULEMAKING PROCEEDING.—Within 90 days 

21 after the date of enactment of this Act, the Federal Trade 

22 Commission shall initiate a rulemaking proceeding to pro23 vide rules, guidelines, and criteria for compliance with the 

24 requirements of this Act, including— 
19

•S 1336 IS 

1 (1) rules necessary to implement the provisions 

2 of this Act that include required contents for a re3 quest for a security freeze, criteria for identification 

4 verification of the requesting party, and consumer 

5 notification requirements to ensure that consumers 

6 are aware of their rights under this Act; 

7 (2) rules to ensure that a request, under section 

8 2 of this Act, for a security freeze on a private infor9 mation file, a request from a consumer for limited 

10 or temporary access to a private information file 

11 under section 3 of this Act, or a requested termi12 nation of such a freeze under section 4 of this Act, 

13 will be communicated by the consumer reporting 

14 agency receiving the request to other consumer re15 porting agencies as required by section 8 of this Act 

16 and implemented by those agencies in a timely man17 ner; and 

18 (3) rules to provide for the application of this 

19 Act in a manner that does not conflict with any 

20 other provision of Federal law governing the acquisi21 tion, maintenance, disposition, or access to informa22 tion contained in a private information file. 

23 (b) FINAL RULE.—The Commission shall issue final 

24 rules pursuant to the proceeding initiated under para-
20

•S 1336 IS 

1 graph (a) within 1 year after the date of enactment of 

2 this Act.

Æ