II 

Calendar No. 320 

109TH CONGRESS 

1ST SESSION S. 1408 

[Report No. 109–203] 

To strengthen data protection and safeguards, require data breach 

notification, and further prevent identity theft. 

IN THE SENATE OF THE UNITED STATES 

JULY 14, 2005 

Mr. SMITH (for himself, Mr. NELSON of Florida, Mr. STEVENS, Mr. INOUYE, 

Mr. MCCAIN, Mr. PRYOR and Mrs. CLINTON) introduced the following 

bill; which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

DECEMBER 8, 2005 

Reported under authority of the order of the Senate of November 18, 2005, 

by Mr. STEVENS, with an amendment 

[Strike all after the enacting clause and insert the part printed in italic] 

A BILL 

To strengthen data protection and safeguards, require data 

breach notification, and further prevent identity theft. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 
2 

•S 1408 RS 

1 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 

2 (a) SHORT TITLE.—This Act may be cited as the 

3 ‘‘Identity Theft Protection Act’’. 

4 (b) TABLE OF CONTENTS.—The table of contents for 

5 this Act is as follows: 

Sec. 1. Short title; table of contents. 

Sec. 2. Protection of sensitive personal information. 

Sec. 3. Notification of security breach risk. 

Sec. 4. Security freeze. 

Sec. 5. Enforcement. 

Sec. 6. Enforcement by State attorneys general. 

Sec. 7. Preemption of State law. 

Sec. 8. Social security and driver’s license number protection. 

Sec. 9. Information security working group. 

Sec. 10. Definitions. 

Sec. 11. Authorization of appropriations. 

Sec. 12. Effective dates. 

6 SEC. 2. PROTECTION OF SENSITIVE PERSONAL INFORMA7 TION. 

8 (a) IN GENERAL.—In accordance with regulations 

9 prescribed by the Federal Trade Commission under sub10 section (b), a covered entity shall take reasonable steps 

11 to protect against security breaches and to prevent unau12 thorized access to sensitive personal information the cov13 ered entity sells, maintains, collects, or transfers. 

14 (b) REGULATIONS.—Not later than 1 year after the 

15 date of enactment of this Act, the Commission shall pro16 mulgate regulations to implement subsection (a), including 

17 regulations that— 

18 (1) require covered entities to develop, imple19 ment, and maintain an effective information security 

20 program that contains administrative, technical, and 
3 

•S 1408 RS 

1 physical safeguards for sensitive personal informa2 tion, taking into account the use of technological 

3 safeguards, including encryption, truncation, and 

4 other safeguards available or being developed for 

5 such purposes; 

6 (2) require procedures for verifying the creden7 tials of any third party seeking to obtain the sen8 sitive personal information of another person; and 

9 (3) require disposal procedures to be followed 

10 by covered entities that— 

11 (A) dispose of sensitive personal informa12 tion; or 

13 (B) transfer sensitive personal information 

14 to third parties for disposal. 

15 SEC. 3. NOTIFICATION OF SECURITY BREACH RISK. 

16 (a) SECURITY BREACHES AFFECTING 1,000 OR

17 MORE INDIVIDUALS.— 

18 (1) IN GENERAL.—If a covered entity discovers 

19 a breach of security and determines that the breach 

20 of security affects the sensitive personal information 

21 of 1,000 or more individuals, then, before conducting 

22 the notification required by subsection (b), it shall— 

23 (A) report the breach to the Commission 

24 (or other appropriate Federal regulator under 

25 section 5); and 
4 

•S 1408 RS 

1 (B) notify all consumer reporting agencies 

2 described in section 603(p)(1) of the Fair Cred3 it Reporting Act (15 U.S.C. 1681a(p)(1)) of the 

4 breach. 

5 (2) FTC WEBSITE PUBLICATIONS.—Whenever 

6 the Commission receives a report under paragraph 

7 (1)(A), it shall post a report of the breach of secu8 rity on its website without disclosing any sensitive 

9 personal information or the names of the individuals 

10 affected. 

11 (b) NOTIFICATION OF CONSUMERS.—Whenever a 

12 covered entity discovers a breach of security and deter13 mines that the breach of security has resulted in, or that 

14 there is a basis for concluding that a reasonable risk of 

15 identity theft to 1 or more individuals, the covered entity 

16 shall notify each such individual. 

17 (c) METHODS OF NOTIFICATION; NOTICE CON18 TENT.—Within 1 year after the date of enactment of this 

19 Act, the Commission shall promulgate regulations that es20 tablish methods of notification to be followed by covered 

21 entities in complying with the requirements of this section 

22 and the content of the notices required. In promulgating 

23 those regulations, the Commission shall take into consider24 ation the types of sensitive personal information involved, 

25 the nature and scope of the security breach, other appro-
5 

•S 1408 RS 

1 priate factors, and the most effective means of notifying 

2 affected individuals. 

3 (d) TIMING OF NOTIFICATION.— 

4 (1) IN GENERAL.—Except as provided in para5 graph (2), notice required by subsection (a) shall be 

6 given— 

7 (A) in the most expedient manner prac8 ticable; 

9 (B) without unreasonable delay, but not 

10 later than 90 days after the date on which the 

11 breach of security was discovered by the covered 

12 entity; and 

13 (C) in a manner that is consistent with 

14 any measures necessary to determine the scope 

15 of the breach and restore the security and in16 tegrity of the data system. 

17 (2) LAW ENFORCEMENT AND HOMELAND SECU18 RITY RELATED DELAYS.—Notwithstanding para19 graph (1), the giving of notice as required by that 

20 paragraph may be delayed for a reasonable period of 

21 time if— 

22 (A) a Federal law enforcement agency de23 termines that the timely giving of notice under 

24 subsections (a) and (b), as required by para-
6 

•S 1408 RS 

1 graph (1), would materially impede a civil or 

2 criminal investigation; or 

3 (B) a Federal national security or home4 land security agency determines that such time5 ly giving of notice would threaten national or 

6 homeland security. 

7 SEC. 4. SECURITY FREEZE. 

8 (a) In General.— 

9 (1) EMPLACEMENT.—A consumer may place a 

10 security freeze on his or her credit report by making 

11 a request to a consumer credit reporting agency in 

12 writing or by telephone. 

13 (2) CONSUMER DISCLOSURE.—If a consumer 

14 requests a security freeze, the consumer credit re15 porting agency shall disclose to the consumer the 

16 process of placing and removing the security freeze 

17 and explain to the consumer the potential con18 sequences of the security freeze. 

19 (b) EFFECT OF SECURITY FREEZE.— 

20 (1) RELEASE OF INFORMATION BLOCKED.—If a 

21 security freeze is in place on a consumer’s credit re22 port, a consumer reporting agency may not release 

23 information from the credit report to a third party 

24 without prior express authorization from the con25 sumer. 
7 

•S 1408 RS 

1 (2) INFORMATION PROVIDED TO THIRD PAR2 TIES.—Paragraph (2) does not prevent a consumer 

3 credit reporting agency from advising a third party 

4 that a security freeze is in effect with respect to the 

5 consumer’s credit report. If a third party, in connec6 tion with an application for credit, requests access to 

7 a consumer credit report on which a security freeze 

8 is in place, the third party may treat the application 

9 as incomplete. 

10 (c) REMOVAL; TEMPORARY SUSPENSION.— 

11 (1) IN GENERAL.—Except as provided in para12 graph (4), a security freeze shall remain in place 

13 until the consumer requests that the security freeze 

14 be removed. A consumer may remove a security 

15 freeze on his or her credit report by making a re16 quest to a consumer credit reporting agency in writ17 ing or by telephone. 

18 (2) CONDITIONS.—A consumer credit reporting 

19 agency may remove a security freeze placed on a 

20 consumer’s credit report only— 

21 (A) upon the consumer’s request, pursuant 

22 to paragraph (1); or 

23 (B) if the agency determines that the con24 sumer’s credit report was frozen due to a mate25 rial misrepresentation of fact by the consumer. 
8 

•S 1408 RS 

1 (3) NOTIFICATION TO CONSUMER.—If a con2 sumer credit reporting agency intends to remove a 

3 freeze upon a consumer’s credit report pursuant to 

4 paragraph (2)(B), the consumer credit reporting 

5 agency shall notify the consumer in writing prior to 

6 removing the freeze on the consumer’s credit report. 

7 (4) TEMPORARY SUSPENSION.—A consumer 

8 may have a security freeze on his or her credit re9 port temporarily suspended by making a request to 

10 a consumer credit reporting agency in writing or by 

11 telephone and specifying beginning and ending dates 

12 for the period during which the security freeze is not 

13 to apply to that consumer’s credit report. 

14 (d) RESPONSE TIMES; NOTIFICATION OF OTHER EN15 TITIES.— 

16 (1) IN GENERAL.—A consumer credit reporting 

17 agency shall— 

18 (A) place a security freeze on a consumer’s 

19 credit report under subsection (a) no later than 

20 5 business days after receiving a request from 

21 the consumer under subsection (a)(1); and 

22 (B) remove, or temporarily suspend, a se23 curity freeze within 3 business days after re24 ceiving a request for removal or temporary sus-
9 

•S 1408 RS 

1 pension from the consumer under subsection 

2 (c). 

3 (2) NOTIFICATION OF OTHER COVERED ENTI4 TIES.—If the consumer requests in writing or by 

5 telephone that other covered entities be notified of 

6 the request, the consumer reporting agency shall no7 tify all other consumer reporting agencies described 

8 in section 603(p)(1) of the Fair Credit Reporting 

9 Act (15 U.S.C. 1681a(p)(1)) of the request within 3 

10 days after placing, removing, or temporarily sus11 pending a security freeze on the consumer’s credit 

12 report under subsection (a), (c)(2)(A), or subsection 

13 (c)(4), respectively. 

14 (3) IMPLEMENTATION BY OTHER COVERED EN15 TITIES.—A consumer reporting agency that is noti16 fied of a request under paragraph (2) to place, re17 move, or temporarily suspend a security freeze on a 

18 consumer’s credit report shall place, remove, or tem19 porarily suspend the security freeze on that credit 

20 report within 3 business days after receiving the no21 tification. 

22 (e) CONFIRMATION.—Whenever a consumer credit re23 porting agency places, removes, or temporarily suspends 

24 a security freeze on a consumer’s credit report at the re25 quest of that consumer under subsection (a) or (c), respec-
10 

•S 1408 RS 

1 tively, it shall send a written confirmation thereof to the 

2 consumer within 10 business days after placing, removing, 

3 or temporarily suspending the security freeze on the credit 

4 report. This subsection does not apply to the placement, 

5 removal, or temporary suspension of a security freeze by 

6 a consumer reporting agency because of a notification re7 ceived under subsection (d)(2). 

8 (f) ID REQUIRED.—A consumer credit reporting 

9 agency may not place, remove, or temporarily suspend a 

10 security freeze on a consumer’s credit report at the con11 sumer’s request unless the consumer provides proper iden12 tification (within the meaning of section 610(a)(1) of the 

13 Fair Credit Reporting Act (15 U.S.C. 1681h) and the reg14 ulations thereunder. 

15 (g) EXCEPTIONS.—This section does not apply to the 

16 use of a consumer credit report by any of the following: 

17 (1) A person or entity, or a subsidiary, affiliate, 

18 or agent of that person or entity, or an assignee of 

19 a financial obligation owing by the consumer to that 

20 person or entity, or a prospective assignee of a fi21 nancial obligation owing by the consumer to that 

22 person or entity in conjunction with the proposed 

23 purchase of the financial obligation, with which the 

24 consumer has or had prior to assignment an account 

25 or contract, including a demand deposit account, or 
11 

•S 1408 RS 

1 to whom the consumer issued a negotiable instru2 ment, for the purposes of reviewing the account or 

3 collecting the financial obligation owing for the ac4 count, contract, or negotiable instrument. 

5 (2) Any Federal, State or local agency, law en6 forcement agency, trial court, or private collection 

7 agency acting pursuant to a court order, warrant, or 

8 subpoena. 

9 (3) A child support agency or its agents or as10 signs acting pursuant to subtitle D of title IV of the 

11 Social Security Act (42 U.S.C. et seq.) or similar 

12 State law. 

13 (4) The Department of Health and Human 

14 Services, a similar State agency, or the agents or as15 signs of the Federal or State agency acting to inves16 tigate medicare or medicaid fraud. 

17 (5) The Internal Revenue Service or a State or 

18 municipal taxing authority, or a State department of 

19 motor vehicles, or any of the agents or assigns of 

20 these Federal, State, or municipal agencies acting to 

21 investigate or collect delinquent taxes or unpaid 

22 court orders or to fulfill any of their other statutory 

23 responsibilities. 

24 (6) The use of consumer credit information for 

25 the purposes of prescreening as provided for by the 
12 

•S 1408 RS 

1 Federal Fair Credit Reporting Act (15 U.S.C. 1681 

2 et seq.). 

3 (7) Any person or entity administering a credit 

4 file monitoring subscription to which the consumer 

5 has subscribed. 

6 (8) Any person or entity for the purpose of pro7 viding a consumer with a copy of his or her credit 

8 report or credit score upon the consumer’s request. 

9 (h) FEES.— 

10 (1) IN GENERAL.—Except as provided in para11 graph (2), a consumer credit reporting agency may 

12 charge a reasonable fee, as determined by the Com13 mission, for placing, removing, or temporarily sus14 pending a security freeze on a consumer’s credit re15 port. 

16 (2) ID THEFT VICTIMS.—A consumer credit re17 porting agency may not charge a fee for placing, re18 moving, or temporarily suspending a security freeze 

19 on a consumer’s credit report if— 

20 (A) the consumer is a victim of identity 

21 theft; and 

22 (B) the consumer has filed a police report 

23 with respect to the theft. 

24 (i) LIMITATION ON INFORMATION CHANGES IN FRO25 ZEN REPORTS.— 
13 

•S 1408 RS 

1 (1) IN GENERAL.—If a security freeze is in 

2 place on a consumer’s credit report, a consumer 

3 credit reporting agency may not change any of the 

4 following official information in that credit report 

5 without sending a written confirmation of the 

6 change to the consumer within 30 days after the 

7 change is made: 

8 (A) Name. 

9 (B) Date of birth. 

10 (C) Social Security number. 

11 (D) Address. 

12 (2) CONFIRMATION.—Paragraph (1) does not 

13 require written confirmation for technical modifica14 tions of a consumer’s official information, including 

15 name and street abbreviations, complete spellings, or 

16 transposition of numbers or letters. In the case of an 

17 address change, the written confirmation shall be 

18 sent to both the new address and to the former ad19 dress. 

20 (j) CERTAIN ENTITY EXEMPTIONS.— 

21 (1) AGGREGATORS AND OTHER AGENCIES.— 

22 The provisions of subsections (a) through (h) do not 

23 apply to a consumer credit reporting agency that 

24 acts only as a reseller of credit information by as25 sembling and merging information contained in the 
14 

•S 1408 RS 

1 data base of another consumer credit reporting 

2 agency or multiple consumer credit reporting agen3 cies, and does not maintain a permanent data base 

4 of credit information from which new consumer 

5 credit reports are produced. 

6 (2) OTHER EXEMPTED ENTITIES.—The fol7 lowing entities are not required to place a security 

8 freeze in a credit report: 

9 (A) A check services or fraud prevention 

10 services company, which issues reports on inci11 dents of fraud or authorizations for the purpose 

12 of approving or processing negotiable instru13 ments, electronic funds transfers, or similar 

14 methods of payments. 

15 (B) A deposit account information service 

16 company, which issues reports regarding ac17 count closures due to fraud, substantial over18 drafts, ATM abuse, or similar negative informa19 tion regarding a consumer, to inquiring banks 

20 or other financial institutions for use only in re21 viewing a consumer request for a deposit ac22 count at the inquiring bank or financial institu23 tion. 
15 

•S 1408 RS 

1 SEC. 5. ENFORCEMENT. 

2 (a) ENFORCEMENT BY COMMISSION.—Except as pro3 vided in subsection (c), this Act shall be enforced by the 

4 Commission. 

5 (b) VIOLATION IS UNFAIR OR DECEPTIVE ACT OR

6 PRACTICE.—The violation of any provision of this Act 

7 shall be treated as an unfair or deceptive act or practice 

8 proscribed under a rule issued under section 18(a)(1)(B) 

9 of the Federal Trade Commission Act (15 U.S.C. 

10 57a(a)(1)(B)). 

11 (c) ENFORCEMENT BY CERTAIN OTHER AGEN12 CIES.—Compliance with this Act shall be enforced 

13 under— 

14 (1) section 8 of the Federal Deposit Insurance 

15 Act (12 U.S.C. 1818), in the case of— 

16 (A) national banks, and Federal branches 

17 and Federal agencies of foreign banks, by the 

18 Office of the Comptroller of the Currency; 

19 (B) member banks of the Federal Reserve 

20 System (other than national banks), branches 

21 and agencies of foreign banks (other than Fed22 eral branches, Federal agencies, and insured 

23 State branches of foreign banks), commercial 

24 lending companies owned or controlled by for25 eign banks, and organizations operating under 
16 

•S 1408 RS 

1 section 25 or 25A of the Federal Reserve Act 

2 (12 U.S.C. 601 and 611), by the Board; and 

3 (C) banks insured by the Federal Deposit 

4 Insurance Corporation (other than members of 

5 the Federal Reserve System) and insured State 

6 branches of foreign banks, by the Board of Di7 rectors of the Federal Deposit Insurance Cor8 poration; 

9 (2) section 8 of the Federal Deposit Insurance 

10 Act (12 U.S.C. 1818), by the Director of the Office 

11 of Thrift Supervision, in the case of a savings asso12 ciation the deposits of which are insured by the Fed13 eral Deposit Insurance Corporation; 

14 (3) the Federal Credit Union Act (12 U.S.C. 

15 1751 et seq.) by the National Credit Union Adminis16 tration Board with respect to any Federal credit 

17 union; and 

18 (4) the Securities and Exchange Act of 1934 

19 (15 U.S.C. 78a et seq.) by the Securities and Ex20 change Commission with respect to— 

21 (A) a broker or dealer subject to that Act; 

22 (B) an investment company subject to the 

23 Investment Company Act of 1940 (15 U.S.C. 

24 80a–1 et seq.); and 
17 

•S 1408 RS 

1 (C) an investment advisor subject to the 

2 Investment Advisers Act of 1940 (15 U.S.C. 

3 80b–1 et seq.). 

4 (d) EXERCISE OF CERTAIN POWERS.—For the pur5 pose of the exercise by any agency referred to in sub6 section (c) of its powers under any Act referred to in that 

7 subsection, a violation of this Act is deemed to be a viola8 tion of a requirement imposed under that Act. In addition 

9 to its powers under any provision of law specifically re10 ferred to in subsection (c), each of the agencies referred 

11 to in that subsection may exercise, for the purpose of en12 forcing compliance with any requirement imposed under 

13 this Act, any other authority conferred on it by law. 

14 (e) PENALTIES.— 

15 (1) IN GENERAL.—Notwithstanding section 

16 5(m) of the Federal Trade Commission Act (15 

17 U.S.C. 45(m)), the Commission may not obtain a 

18 civil penalty under that section for a violation of this 

19 Act in excess of— 

20 (A) $11,000 for each such individual; and 

21 (B) $11,000,000 in the aggregate for all 

22 such individuals with respect to the same viola23 tion. 

24 (2) OTHER AUTHORITY NOT AFFECTED.—Noth25 ing in this Act shall be construed to limit or affect 
18 

•S 1408 RS 

1 in any way the Commission’s authority to bring en2 forcement actions or take any other measure under 

3 the Federal Trade Commission Act (15 U.S.C. 41 et 

4 seq.) or any other provision of law. 

5 (f) NO PRIVATE CAUSE OF ACTION.—Nothing in this 

6 Act establishes a private cause of action against a covered 

7 entity for the violation of any provision of this Act. 

8 (g) COMPLIANCE WITH GRAMM-LEACH-BLILEY

9 ACT.—Any person to which title V of the Gramm-Leach10 Bliley Act (15 U.S.C. 6801 et seq.) applies shall be 

11 deemed to be in compliance with the notification require12 ments of this Act with respect to a breach of security if 

13 that person is in compliance with the notification require14 ments of that title with respect to that breach of security. 

15 SEC. 6. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 

16 (a) IN GENERAL.—A State, as parens patriae, may 

17 bring a civil action on behalf of its residents in an appro18 priate district court of the United States to enforce the 

19 provisions of this Act, or to impose the civil penalties au20 thorized by section 5, whenever the attorney general of 

21 the State has reason to believe that the interests of the 

22 residents of the State have been or are being threatened 

23 or adversely affected by a covered entity that violates this 

24 Act or a regulation under this Act. 
19 

•S 1408 RS 

1 (b) NOTICE.—The State shall serve written notice to 

2 the Commission (or other appropriate Federal regulator 

3 under section 5) of any civil action under subsection (a) 

4 prior to initiating such civil action. The notice shall in5 clude a copy of the complaint to be filed to initiate such 

6 civil action, except that if it is not feasible for the State 

7 to provide such prior notice, the State shall provide such 

8 notice immediately upon instituting such civil action. 

9 (c) AUTHORITY TO INTERVENE.—Upon receiving the 

10 notice required by subsection (b), the Commission (or 

11 other appropriate Federal regulator under section 5) may 

12 intervene in such civil action and upon intervening— 

13 (1) be heard on all matters arising in such civil 

14 action; and 

15 (2) file petitions for appeal of a decision in such 

16 civil action. 

17 (d) CONSTRUCTION.—For purposes of bringing any 

18 civil action under subsection (a), nothing in this section 

19 shall prevent the attorney general of a State from exer20 cising the powers conferred on the attorney general by the 

21 laws of such State to conduct investigations or to admin22 ister oaths or affirmations or to compel the attendance 

23 of witnesses or the production of documentary and other 

24 evidence. 
20 

•S 1408 RS 

1 (e) VENUE; SERVICE OF PROCESS.—In a civil action 

2 brought under subsection (a)— 

3 (1) the venue shall be a judicial district in 

4 which— 

5 (A) the covered entity operates; 

6 (B) the covered entity was authorized to do 

7 business; or 

8 (C) where the defendant in the civil action 

9 is found; 

10 (2) process may be served without regard to the 

11 territorial limits of the district or of the State in 

12 which the civil action is instituted; and 

13 (3) a person who participated with a covered 

14 entity in an alleged violation that is being litigated 

15 in the civil action may be joined in the civil action 

16 without regard to the residence of the person. 

17 (f) LIMITATION ON STATE ACTION WHILE FEDERAL

18 ACTION IS PENDING.—If the Commission (or other appro19 priate Federal agency under section 5) has instituted a 

20 civil action or an administrative action for violation of this 

21 Act, no State attorney general, or official or agency of a 

22 State, may bring an action under this subsection during 

23 the pendency of that action against any defendant named 

24 in the complaint of the Commission or the other agency 

25 for any violation of this Act alleged in the complaint. 
21 

•S 1408 RS 

1 (g) ENFORCEMENT OF STATE LAW.—Nothing con2 tained in this section shall prohibit an authorized State 

3 official from proceeding in State court to enforce a civil 

4 or criminal statute of such State. 

5 SEC. 7. PREEMPTION OF STATE LAW. 

6 (a) IN GENERAL.—This Act preempts any State or 

7 local law, regulation, or rule that requires a covered enti8 ty— 

9 (1) to develop, implement, or maintain informa10 tion security programs to which this Act applies; or 

11 (2) to notify individuals of breaches of security 

12 regarding their sensitive personal information. 

13 (b) LIABILITY.—This Act preempts any State or local 

14 law, regulation, rule, administrative procedure, or judicial 

15 precedent under which liability is imposed on a covered 

16 entity for failure— 

17 (1) to implement and maintain an adequate in18 formation security program; or 

19 (2) to notify an individual of any breach of se20 curity pertaining to any sensitive personal informa21 tion about that individual. 

22 (c) SECURITY FREEZE.—This Act preempts any 

23 State or local law, regulation, or rule that requires con24 sumer reporting agencies to impose a security freeze on 

25 consumer credit reports at the request of a consumer. 
22 

•S 1408 RS 

1 SEC. 8. SOCIAL SECURITY NUMBER PROTECTION. 

2 (a) PROHIBITION OF UNNECESSARY SOLICITATION

3 OF SOCIAL SECURITY NUMBERS.—No covered entity may 

4 solicit any social security number from an individual un5 less there is a specific use of the social security number 

6 for which no other identifier reasonably can be used. 

7 (b) PROHIBITION OF THE DISPLAY OF SOCIAL SECU8 RITY NUMBERS ON EMPLOYEE IDENTIFICATION CARDS, 

9 ETC.— 

10 (1) IN GENERAL.—No covered entity may dis11 play the social security number (or any derivative of 

12 such number) of an individual on any card or tag 

13 that is commonly provided to employees (or to their 

14 family members), faculty, staff, or students for pur15 poses of identification. 

16 (2) DRIVER’S LICENSES.—A State may not dis17 play the social security number of an individual on 

18 driver’s licenses issued by that State. 

19 (c) PROHIBITION OF INMATE ACCESS TO SOCIAL SE20 CURITY ACCOUNT NUMBERS.— 

21 (1) IN GENERAL.—Section 205(c)(2)(C) of the 

22 Social Security Act (42 U.S.C. 405(c)(2)(C)), as 

23 amended by subsection (b), is amended by adding at 

24 the end the following new clause: 

25 ‘‘(xi) No executive, legislative, or judicial agency or 

26 instrumentality of the Federal Government or of a State 
23 

•S 1408 RS 

1 or political subdivision thereof (or person acting as an 

2 agent of such an agency or instrumentality) may employ, 

3 or enter into a contract for the use or employment of, pris4 oners in any capacity that would allow such prisoners ac5 cess to the social security account numbers of other indi6 viduals. For purposes of this clause, the term ‘prisoner’ 

7 means an individual confined in a jail, prison, or other 

8 penal institution or correctional facility.’’. 

9 (2) TREATMENT OF CURRENT ARRANGE10 MENTS.—In the case of— 

11 (i) prisoners employed as described in 

12 clause (xi) of section 205(c)(2)(C) of the 

13 Social Security Act (42 U.S.C. 

14 405(c)(2)(C)), as added by paragraph (1), 

15 on the date of enactment of this Act, and 

16 (ii) contracts described in such clause 

17 in effect on such date, 

18 the amendment made by this section shall take 

19 effect 90 days after the date of enactment of 

20 this Act. 

21 SEC. 9. INFORMATION SECURITY WORKING GROUP. 

22 (a) INFORMATION SECURITY WORKING GROUP.— 

23 The Chairman of the Commission shall establish an Infor24 mation Security Working Group to develop best practices 

25 to protect sensitive personal information stored and trans-
24 

•S 1408 RS 

1 ferred. The Working Group shall be composed of industry 

2 participants, consumer groups, and other interested par3 ties. 

4 (b) REPORT.—Not later than 12 months after the 

5 date on which the Working Group is established under 

6 subsection (a), the Working Group shall submit to Con7 gress a report on their findings. 

8 SEC. 10. DEFINITIONS. 

9 In this Act: 

10 (1) BREACH OF SECURITY.—The term ‘‘breach 

11 of security’’ means unauthorized access to and ac12 quisition of data in any form or format containing 

13 sensitive personal information that compromises the 

14 security or confidentiality of such information and 

15 establishes a basis to conclude that a reasonable risk 

16 of identity theft to an individual exists. 

17 (2) COMMISSION.—The term ‘‘Commission’’ 

18 means the Federal Trade Commission. 

19 (3) CONSUMER CREDIT REPORTING AGENCY.— 

20 The term ‘‘consumer credit reporting agency’’ means 

21 any person which, for monetary fees, dues, or on a 

22 cooperative nonprofit basis, regularly engages in 

23 whole or in part in the practice of assembling or 

24 evaluating consumer credit information or other in25 formation on consumers for the purpose of fur-
25 

•S 1408 RS 

1 nishing credit reports to third parties, and which 

2 uses any means or facility of interstate commerce 

3 for the purpose of preparing or furnishing credit re4 ports. 

5 (4) COVERED ENTITY.—The term ‘‘covered en6 tity’’ means a sole proprietorship, partnership, cor7 poration, trust, estate, cooperative, association, or 

8 other commercial entity, and any charitable, edu9 cational, or nonprofit organization, that acquires, 

10 maintains, or utilizes sensitive personal information. 

11 (5) CREDIT REPORT.—The term ‘‘credit report’’ 

12 means a consumer report, as defined in section 

13 603(d) of the Federal Fair Credit Reporting Act (15 

14 U.S.C. 1681a(p)), that is used or expected to be 

15 used or collected in whole or in part for the purpose 

16 of serving as a factor in establishing a consumer’s 

17 eligibility for credit for personal, family or household 

18 purposes. 

19 (6) IDENTITY THEFT.—The term ‘‘identity 

20 theft’’ means the unauthorized acquisition, purchase, 

21 sale, or use by any person of an individual’s sensitive 

22 personal information that— 

23 (A) violates section 1028 of title 18, 

24 United States Code, or any provision of State 

25 law in pari materia; or 
26 

•S 1408 RS 

1 (B) results in economic loss to the indi2 vidual whose sensitive personal information was 

3 used. 

4 (7) REVIEWING THE ACCOUNT.—The term ‘‘re5 viewing the account’’ includes activities related to 

6 account maintenance, monitoring, credit line in7 creases, and account upgrades and enhancements. 

8 (8) SENSITIVE PERSONAL INFORMATION.— 

9 (A) IN GENERAL.—Except as provided in 

10 subparagraphs (B) and (C), the term ‘‘sensitive 

11 personal information’’ means an individual’s 

12 name, address, or telephone number combined 

13 with 1 or more of the following data elements 

14 related to that individual: 

15 (i) Social security number, taxpayer 

16 identification number, or employer identi17 fication number. 

18 (ii) Financial account number, or 

19 credit card or debit card number of such 

20 individual, combined with any required se21 curity code, access code, or password that 

22 would permit access to such individual’s 

23 account. 
27 

•S 1408 RS 

1 (iii) State driver’s license identifica2 tion number or State resident identifica3 tion number. 

4 (iv) Consumer credit report. 

5 (v) Employee, faculty, student, or 

6 United States armed forces serial number. 

7 (vi) Genetic or biometric information. 

8 (vii) Mother’s maiden name. 

9 (B) FTC MODIFICATIONS.—The Commis10 sion may, through a rulemaking proceeding, 

11 designate other identifying information that 

12 may be used to effectuate identity theft as sen13 sitive personal information for purposes of this 

14 Act and limit or exclude any information de15 scribed in subparagraph (A) from the definition 

16 of sensitive personal information for purposes of 

17 this Act. 

18 (C) PUBLIC RECORDS.—Nothing in this 

19 Act prohibits a covered entity from obtaining, 

20 aggregating, or using sensitive personal infor21 mation it lawfully obtains from public records 

22 in a manner that does not violate this Act. 
28 

•S 1408 RS 

1 SEC. 11. AUTHORIZATION OF APPROPRIATIONS. 

2 There are authorized to be appropriated to the Com3 mission $1,000,000 for each of fiscal years 2006 through 

4 2010 to carry out this Act. 

5 SEC. 12. EFFECTIVE DATES. 

6 (a) IN GENERAL.—Except as provided in subsection 

7 (b), the provisions of this Act take effect upon its enact8 ment. 

9 (b) PROVISIONS REQUIRING RULEMAKING.—The 

10 Commission shall initiate 1 or more rulemaking pro11 ceedings under sections 2, 3, and 4 within 45 days after 

12 the date of enactment of this Act. The Commission shall 

13 promulgate all final rules pursuant to those rulemaking 

14 proceedings within 1 year after the date of enactment of 

15 this Act. The provisions of sections 2, 3, and 4 shall take 

16 effect on the same date 6 months after the date on which 

17 the Commission promulgates the last final rule under the 

18 proceeding or proceedings commenced under the preceding 

19 sentence. 

20 (c) PREEMPTION.—Section 7 shall take effect at the 

21 same time as sections 2, 3, and 4 take effect. 

22 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 

23 (a) SHORT TITLE.—This Act may be cited as the 

24 ‘‘Identity Theft Protection Act’’. 

25 (b) TABLE OF CONTENTS.—The table of contents for 

26 this Act is as follows: 
29 

•S 1408 RS 

Sec. 1. Short title; table of contents. 

Sec. 2. Protection of sensitive personal information. 

Sec. 3. Notification of security breach risk. 

Sec. 4. Security freeze. 

Sec. 5. Enforcement. 

Sec. 6. Enforcement by State attorneys general. 

Sec. 7. Preemption of State law. 

Sec. 8. Social security and driver’s license number protection. 

Sec. 9. Information security working group. 

Sec. 10. Definitions. 

Sec. 11. Authorization of appropriations. 

Sec. 12. Related crime study. 

Sec. 13. Prohibition on technology mandates. 

Sec. 14. Effective dates. 

1 SEC. 2. PROTECTION OF SENSITIVE PERSONAL INFORMA2 TION. 

3 (a) IN GENERAL.—A covered entity shall develop, im4 plement, maintain, and enforce a written program for the 

5 security of sensitive personal information the entity collects, 

6 maintains, sells, transfers, or disposes of, containing ad7 ministrative, technical, and physical safeguards— 

8 (1) to ensure the security and confidentiality of 

9 such data; 

10 (2) to protect against any anticipated threats or 

11 hazards to the security or integrity of such data; and 

12 (3) to protect against unauthorized access to, or 

13 use of, such data that could result in substantial 

14 harm to any individual. 

15 (b) COMPLIANCE WITH FTC STANDARDS REQUIRED.— 

16 A covered entity that is in full compliance with the require17 ments of the Commission’s rules on Standards for Safe18 guarding Customer Information and Disposal of Consumer 
30 

•S 1408 RS 

1 Report Information and Records is deemed to be in compli2 ance with the requirements of subsection (a). 

3 (c) REGULATIONS.—Not later than 1 year after the 

4 date of enactment of this Act, the Commission shall promul5 gate regulations, in accordance with section 553 of title 5, 

6 United States Code, that require procedures for authen7 ticating the credentials of any third party to which sen8 sitive personal information is to be tranferred or sold by 

9 a covered entity. 

10 SEC. 3. NOTIFICATION OF SECURITY BREACH RISK. 

11 (a) SECURITY BREACHES AFFECTING 1,000 OR MORE

12 INDIVIDUALS.— 

13 (1) IN GENERAL.—If a covered entity discovers a 

14 breach of security that affects 1,000 or more individ15 uals, then, before conducting the notification required 

16 by subsection (c), it shall— 

17 (A) report the breach to the Commission (or 

18 other appropriate Federal regulator under sec19 tion 5); and 

20 (B) notify all consumer reporting agencies 

21 described in section 603(p)(1) of the Fair Credit 

22 Reporting Act (15 U.S.C. 1681a(p)(1)) of the 

23 breach. 

24 (2) FTC WEBSITE PUBLICATION.—Whenever the 

25 Commission receives a report under paragraph 
31 

•S 1408 RS 

1 (1)(A), after the notification required by subsection 

2 (c) it shall post a report of the breach of security on 

3 its website without disclosing any sensitive personal 

4 information pertaining to the individuals affected 

5 (including their names). 

6 (3) CONTENTS OF REPORT.—The report described 

7 in paragraph (2) shall include— 

8 (A) the number of individuals impacted by 

9 the breach of security; and 

10 (B) the fact that all impacted individuals 

11 were notified directly in accordance with this 

12 Act. 

13 (b) SECURITY BREACHES AFFECTING FEWER THAN

14 1,000 INDIVIDUALS.— 

15 (1) IN GENERAL.—If a covered entity discovers 

16 breach of security that affects the sensitive personal 

17 information of fewer than 1,000 individuals and de18 termines that the breach of security does not create a 

19 reasonable risk of identity theft, it shall report the 

20 breach to the Commission (or other appropriate Fed21 eral regulator under section 5). 

22 (2) REPORT CONTENTS.—The report shall con23 tain the number of individuals affected and the type 

24 of information that was exposed because of the breach 

25 of security. 
32 

•S 1408 RS 

1 (3) LIMITATION ON COMMISSION RESPONSE.— 

2 With respect to a report under paragraph (1) received 

3 by the Commission, the Commission may not— 

4 (A) disclose any sensitive personal informa5 tion relating to the individuals (including their 

6 names); or 

7 (B) publish such a report on its website. 

8 (c) NOTIFICATION OF CONSUMERS.—A covered entity 

9 shall use due diligence to investigate any suspected breach 

10 of security affecting sensitive personal information main11 tained by that covered entity. If, after the exercise of such 

12 due diligence, the covered entity discovers a breach of secu13 rity and determines that the breach of security creates a 

14 reasonable risk of identity theft, the covered entity shall no15 tify each such individual. In determining whether a reason16 able risk of identity theft exists, the covered entity shall con17 sider such factors as whether the data containing sensitive 

18 personal information is usable by an unauthorized third 

19 party and whether the data is in the possession and control 

20 of an unauthorized third party who is likely to commit 

21 identity theft. 

22 (d) METHODS OF NOTIFICATION; NOTICE CONTENT.— 

23 (1) IN GENERAL.—A covered entity shall provide 

24 notice pursuant to subsection (c) by— 

25 (A) written notice; 
33 

•S 1408 RS 

1 (B) electronic notice, if such notice is con2 sistent with the provisions of the Electronic Sig3 natures in Global and National Commerce Act 

4 (15 U.S.C. 7001 et seq.); 

5 (C) substitute notice— 

6 (i) if the covered entity demonstrates 

7 that— 

8 (I) the cost of providing such no9 tice would exceed $250,000; 

10 (II) the individuals to be notified 

11 exceed 500,000; or 

12 (III) the covered entity does not 

13 have sufficient contact information for 

14 the individuals to be notified; and 

15 (ii) consisting of— 

16 (I) notice by electronic mail when 

17 the covered entity has an electronic 

18 mail address for affected individuals; 

19 (II) conspicuous posting of such 

20 notice on the Internet website of the 

21 covered entity, if the covered entity 

22 maintains a website; and 

23 (III) notification to major State24 wide media of the breach of security. 
34 

•S 1408 RS 

1 (2) CONTENT OF NOTICE.—The notice required 

2 under subsection (c) shall consist of— 

3 (A) the name of the individual whose infor4 mation was the subject of the breach of security; 

5 (B) the name of the covered entity that was 

6 the subject of the breach of security; 

7 (C) a description of the categories of sen8 sitive personal information of the individual 

9 that were the subject of the breach of security; 

10 (D) the specific dates between the breach of 

11 security of the sensitive personal information of 

12 the individual and the date of discovery of such 

13 breach of security; and 

14 (E) the toll-free numbers necessary to con15 tact— 

16 (i) each covered entity that was the 

17 subject of the breach of security; 

18 (ii) each nationwide credit reporting 

19 agency; and 

20 (iii) the Commission. 

21 (e) TIMING OF NOTIFICATION.— 

22 (1) IN GENERAL.—Except as provided in para23 graph (2), notice required by subsection (c) shall be 

24 given— 
35 

•S 1408 RS 

1 (A) in the most expedient manner prac2 ticable, but not later than 45 days after the date 

3 on which the breach of security was discovered 

4 by the covered entity; and 

5 (B) in a manner that is consistent with any 

6 measures necessary to determine the scope of the 

7 breach and restore the security and integrity of 

8 the data system. 

9 (2) LAW ENFORCEMENT AND HOMELAND SECU10 RITY RELATED DELAYS.—Notwithstanding paragraph 

11 (1), the giving of notice as required by that para12 graph may be delayed for a reasonable period of time 

13 if— 

14 (A) a Federal or State law enforcement 

15 agency determines that the timely giving of no16 tice under subsections (a) and (c), as required by 

17 paragraph (1), would materially impede a civil 

18 or criminal investigation; or 

19 (B) a Federal national security or home20 land security agency determines that such timely 

21 giving of notice would threaten national or 

22 homeland security. 

23 (f) CERTAIN SERVICE PROVIDERS.—Section 2 and 

24 subsections (a), (b), and (c) of this section do not apply 

25 to electronic communication of a third party stored by a 
36 

•S 1408 RS 

1 cable operator, information service, or telecommunications 

2 carrier in the network of such operator, service or carrier 

3 in the course of transferring or transmitting such commu4 nication. Any term used in this subsection that is defined 

5 in the Communications Act of 1934 (47 U.S.C. 151 et seq.) 

6 has the meaning given it in that Act. 

7 SEC. 4. SECURITY FREEZE. 

8 (a) IN GENERAL.— 

9 (1) EMPLACEMENT.—A consumer may place a 

10 security freeze on his or her credit report by making 

11 a request to a consumer credit reporting agency in 

12 writing, by telephone, or through a secure electronic 

13 connection made available by the consumer credit re14 porting agency. 

15 (2) CONSUMER DISCLOSURE.—If a consumer re16 quests a security freeze, the consumer credit reporting 

17 agency shall disclose to the consumer the process of 

18 placing and removing the security freeze and explain 

19 to the consumer the potential consequences of the secu20 rity freeze. A consumer credit reporting agency may 

21 not imply or inform a consumer that the placement 

22 or presence of a security freeze on the consumer’s 

23 credit report may negatively affect the consumer’s 

24 credit score. 

25 (b) EFFECT OF SECURITY FREEZE.— 
37 

•S 1408 RS 

1 (1) RELEASE OF INFORMATION BLOCKED.—If a 

2 security freeze is in place on a consumer’s credit re3 port, a consumer reporting agency may not release 

4 the credit report for consumer credit purposes to a 

5 third party without prior express authorization from 

6 the consumer. 

7 (2) INFORMATION PROVIDED TO THIRD PAR8 TIES.—Paragraph (2) does not prevent a consumer 

9 credit reporting agency from advising a third party 

10 that a security freeze is in effect with respect to the 

11 consumer’s credit report. If a third party, in connec12 tion with an application for credit, requests access to 

13 a consumer credit report on which a security freeze 

14 is in place, the third party may treat the application 

15 as incomplete. 

16 (3) CONSUMER CREDIT SCORE NOT AFFECTED.— 

17 The placement of a security freeze on a credit report 

18 may not be taken into account for any purpose in de19 termining the credit score of the consumer to whom 

20 the account relates. 

21 (c) REMOVAL; TEMPORARY SUSPENSION.— 

22 (1) IN GENERAL.—Except as provided in para23 graph (4), a security freeze shall remain in place 

24 until the consumer requests that the security freeze be 

25 removed. A consumer may remove a security freeze on 
38 

•S 1408 RS 

1 his or her credit report by making a request to a con2 sumer credit reporting agency in writing, by tele3 phone, or through a secure electronic connection made 

4 available by the consumer reporting agency. 

5 (2) CONDITIONS.—A consumer credit reporting 

6 agency may remove a security freeze placed on a con7 sumer’s credit report only— 

8 (A) upon the consumer’s request, pursuant 

9 to paragraph (1); or 

10 (B) if the agency determines that the con11 sumer’s credit report was frozen due to a mate12 rial misrepresentation of fact by the consumer. 

13 (3) NOTIFICATION TO CONSUMER.—If a con14 sumer credit reporting agency intends to remove a 

15 freeze upon a consumer’s credit report pursuant to 

16 paragraph (2)(B), the consumer credit reporting 

17 agency shall notify the consumer in writing prior to 

18 removing the freeze on the consumer’s credit report. 

19 (4) TEMPORARY SUSPENSION.—A consumer may 

20 have a security freeze on his or her credit report tem21 porarily suspended by making a request to a con22 sumer credit reporting agency in writing or by tele23 phone and specifying beginning and ending dates for 

24 the period during which the security freeze is not to 

25 apply to that consumer’s credit report. 
39 

•S 1408 RS 

1 (d) RESPONSE TIMES; NOTIFICATION OF OTHER ENTI2 TIES.— 

3 (1) IN GENERAL.—A consumer credit reporting 

4 agency shall— 

5 (A) place a security freeze on a consumer’s 

6 credit report under subsection (a) no later than 

7 5 business days after receiving a request from the 

8 consumer under subsection (a)(1); and 

9 (B) remove, or temporarily suspend, a secu10 rity freeze within 3 business days after receiving 

11 a request for removal or temporary suspension 

12 from the consumer under subsection (c). 

13 (2) NOTIFICATION OF OTHER COVERED ENTI14 TIES.—If the consumer requests in writing or by tele15 phone that other covered entities be notified of the re16 quest, the consumer reporting agency shall notify all 

17 other consumer reporting agencies described in section 

18 603(p)(1) of the Fair Credit Reporting Act (15 U.S.C. 

19 1681a(p)(1)) of the request within 3 days after plac20 ing, removing, or temporarily suspending a security 

21 freeze on the consumer’s credit report under subsection 

22 (a), (c)(2)(A), or subsection (c)(4), respectively. 

23 (3) IMPLEMENTATION BY OTHER COVERED ENTI24 TIES.—A consumer reporting agency that is notified 

25 of a request under paragraph (2) to place, remove, or 
40 

•S 1408 RS 

1 temporarily suspend a security freeze on a consumer’s 

2 credit report shall— 

3 (A) request propert identification from the 

4 consumer, in accordance with subsection (f), 

5 within 3 business days after receiving the notifi6 cation; and 

7 (B) place, remove, or temporarily suspend 

8 the security freeze on that credit report within 3 

9 business days after receiving proper identifica10 tion. 

11 (e) CONFIRMATION.—Except as provided in subsection 

12 (c)(3), whenever a consumer credit reporting agency places, 

13 removes, or temporarily suspends a security freeze on a con14 sumer’s credit report at the request of that consumer under 

15 subsection (a) or (c), respectively, it shall send a written 

16 confirmation thereof to the consumer within 10 business 

17 days after placing, removing, or temporarily suspending the 

18 security freeze on the credit report. This subsection does not 

19 apply to the placement, removal, or temporary suspension 

20 of a security freeze by a consumer reporting agency because 

21 of a notification received under subsection (d)(2). 

22 (f) ID REQUIRED.—A consumer credit reporting agen23 cy may not place, remove, or temporarily suspend a secu24 rity freeze on a consumer’s credit report at the consumer’s 

25 request unless the consumer provides proper identification 
41 

•S 1408 RS 

1 (within the meaning of section 610(a)(1) of the Fair Credit 

2 Reporting Act (15 U.S.C. 1681h) and the regulations there3 under. 

4 (g) EXCEPTIONS.—This section does not apply to the 

5 use of a consumer credit report by any of the following: 

6 (1) A person or entity, or a subsidiary, affiliate, 

7 or agent of that person or entity, or an assignee of 

8 a financial obligation owing by the consumer to that 

9 person or entity, or a prospective assignee of a finan10 cial obligation owing by the consumer to that person 

11 or entity in conjunction with the proposed purchase 

12 of the financial obligation, with which the consumer 

13 has or had prior to assignment an account or con14 tract, including a demand deposit account, or to 

15 whom the consumer issued a negotiable instrument, 

16 for the purposes of reviewing the account or collecting 

17 the financial obligation owing for the account, con18 tract, or negotiable instrument. 

19 (2) Any Federal, State or local agency, law en20 forcement agency, trial court, or private collection 

21 agency acting pursuant to a court order, warrant, 

22 subpoena, or other compulsory process. 

23 (3) A child support agency or its agents or as24 signs acting pursuant to subtitle D of title IV of the 
42 

•S 1408 RS 

1 Social Security Act (42 U.S.C. et seq.) or similar 

2 State law. 

3 (4) The Department of Health and Human Serv4 ices, a similar State agency, or the agents or assigns 

5 of the Federal or State agency acting to investigate 

6 medicare or medicaid fraud. 

7 (5) The Internal Revenue Service or a State or 

8 municipal taxing authority, or a State department of 

9 motor vehicles, or any of the agents or assigns of these 

10 Federal, State, or municipal agencies acting to inves11 tigate or collect delinquent taxes or unpaid court or12 ders or to fulfill any of their other statutory respon13 sibilities. 

14 (6) The use of consumer credit information for 

15 the purposes of prescreening as provided for by the 

16 Federal Fair Credit Reporting Act (15 U.S.C. 1681 

17 et seq.). 

18 (7) Any person or entity administering a credit 

19 file monitoring subscription to which the consumer 

20 has subscribed. 

21 (8) Any person or entity for the purpose of pro22 viding a consumer with a copy of his or her credit 

23 report or credit score upon the consumer’s request. 

24 (h) FEES.— 
43 

•S 1408 RS 

1 (1) IN GENERAL.—Except as provided in para2 graph (2), a consumer credit reporting agency may 

3 charge a reasonable fee, as determined by the Com4 mission by rule, promulgated in accordance with sec5 tion 553 of title 5, United States Code, for placing, 

6 removing, or temporarily suspending a security freeze 

7 on a consumer’s credit report. 

8 (2) ID THEFT VICTIMS.—A consumer credit re9 porting agency may not charge a fee for placing, re10 moving, or temporarily suspending a security freeze 

11 on a consumer’s credit report if— 

12 (A) the consumer is a victim of identity 

13 theft; 

14 (B) the consumer requests the security freeze 

15 in writing; 

16 (C) the consumer has filed a police report 

17 with respect to the theft, or an identity theft re18 port (as defined in section 603(q)(4) of the Fair 

19 Credit Reporting Act (15 U.S.C. 1681a(q)(4))), 

20 within 90 days after the theft occured or was dis21 covered by the consumer; and 

22 (D) the consumer provides a copy of the re23 port to the credit reporting agency. 

24 (i) LIMITATION ON INFORMATION CHANGES IN FRO25 ZEN REPORTS.— 
44 

•S 1408 RS 

1 (1) IN GENERAL.—If a security freeze is in place 

2 on a consumer’s credit report, a consumer credit re3 porting agency may not change any of the following 

4 official information in that credit report without 

5 sending a written confirmation of the change to the 

6 consumer within 30 days after the change is made: 

7 (A) Name. 

8 (B) Date of birth. 

9 (C) Social Security number. 

10 (D) Address. 

11 (2) CONFIRMATION.—Paragraph (1) does not re12 quire written confirmation for technical modifications 

13 of a consumer’s official information, including name 

14 and street abbreviations, complete spellings, or trans15 position of numbers or letters. In the case of an ad16 dress change, the written confirmation shall be sent to 

17 both the new address and to the former address. 

18 (j) CERTAIN ENTITY EXEMPTIONS.— 

19 (1) AGGREGATORS AND OTHER AGENCIES.—The 

20 provisions of subsections (a) through (h) do not apply 

21 to a consumer credit reporting agency that acts only 

22 as a reseller of credit information by assembling and 

23 merging information contained in the data base of 

24 another consumer credit reporting agency or multiple 

25 consumer credit reporting agencies, and does not 
45 

•S 1408 RS 

1 maintain a permanent data base of credit informa2 tion from which new consumer credit reports are pro3 duced. 

4 (2) OTHER EXEMPTED ENTITIES.—The following 

5 entities are not required to place a security freeze in 

6 a credit report: 

7 (A) A check services or fraud prevention 

8 services company, which issues reports on inci9 dents of fraud or authorizations for the purpose 

10 of approving or processing negotiable instru11 ments, electronic funds transfers, or similar 

12 methods of payments. 

13 (B) A deposit account information service 

14 company, which issues reports regarding account 

15 closures due to fraud, substantial overdrafts, 

16 ATM abuse, or similar negative information re17 garding a consumer, to inquiring banks or other 

18 financial institutions for use only in reviewing 

19 a consumer request for a deposit account at the 

20 inquiring bank or financial institution. 

21 SEC. 5. ENFORCEMENT. 

22 (a) ENFORCEMENT BY COMMISSION.—Except as pro23 vided in subsection (c), this Act shall be enforced by the 

24 Commission. 
46 

•S 1408 RS 

1 (b) VIOLATION IS UNFAIR OR DECEPTIVE ACT OR

2 PRACTICE.—The violation of any provision of this Act shall 

3 be treated as an unfair or deceptive act or practice pro4 scribed under a rule issued under section 18(a)(1)(B) of the 

5 Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)). 

6 (c) ENFORCEMENT BY CERTAIN OTHER AGENCIES.— 

7 Compliance with this Act shall be enforced exclusively 

8 under— 

9 (1) section 8 of the Federal Deposit Insurance 

10 Act (12 U.S.C. 1818), in the case of— 

11 (A) national banks, and Federal branches 

12 and Federal agencies of foreign banks, and any 

13 subsidiaries of such entities (except brokers, deal14 ers, persons providing insurance, investment 

15 companies, and investment advisers), by the Of16 fice of the Comptroller of the Currency; 

17 (B) member banks of the Federal Reserve 

18 System (other than national banks), branches 

19 and agencies of foreign banks (other than Fed20 eral branches, Federal agencies, and insured 

21 State branches of foreign banks), commercial 

22 lending companies owned or controlled by for23 eign banks, organizations operating under sec24 tion 25 or 25A of the Federal Reserve Act (12 

25 U.S.C. 601 and 611), and bank holding compa-
47 

•S 1408 RS 

1 nies and their nonbank subsidiaries or affiliates 

2 (except brokers, dealers, persons providing insur3 ance, investment companies and investment ad4 visers), by the Board of Governors of the Federal 

5 Reserve System; 

6 (C) banks insured by the Federal Deposit 

7 Insurance Corporation (other than members of 

8 the Federal Reserve System), insured State 

9 branches of foreign banks, and any subsidiaries 

10 of such entities (except brokers, dealers, persons 

11 providing insurance, investment companies and 

12 investment advisers), by the Board of Directors 

13 of the Federal Deposit Insurance Corporation; 

14 and 

15 (D) savings associations the deposits of 

16 which are insured by the Federal Deposit Insur17 ance Corporation, and any subsidiaries of such 

18 savings associations (except brokers, dealers, per19 sons providing insurance, investment companies 

20 and investment advisers), by the Director of the 

21 Office of Thrift Supervision; 

22 (2) the Federal Credit Union Act (12 U.S.C. 

23 1751 et seq.) by the Board of the National Credit 

24 Union Administration Board with respect to any 
48 

•S 1408 RS 

1 Federal credit union and any subsidiaries of such a 

2 credit union; 

3 (3) the Securities and Exchange Act of 1934 (15 

4 U.S.C. 78a et seq.) by the Securities and Exchange 

5 Commission with respect to— 

6 (A) a broker or dealer subject to that Act; 

7 (B) an investment company subject to the 

8 Investment Company Act of 1940 (15 U.S.C. 

9 80a-1 et seq.); and 

10 (C) an investment advisor subject to the In11 vestment Advisers Act of 1940 (15 U.S.C. 80b-1 

12 et seq.); and 

13 (4) State insurance law, in the case of any per14 son engaged in providing insurance, by the applicable 

15 State insurance authority of the State in which the 

16 person is domiciled. 

17 (d) EXERCISE OF CERTAIN POWERS.—For the purpose 

18 of the exercise by any agency referred to in subsection (c) 

19 of its powers under any Act referred to in that subsection, 

20 a violation of this Act is deemed to be a violation of a re21 quirement imposed under that Act. In addition to its pow22 ers under any provision of law specifically referred to in 

23 subsection (c), each of the agencies referred to in that sub24 section may exercise, for the purpose of enforcing compli-
49 

•S 1408 RS 

1 ance with any requirement imposed under this Act, any 

2 other authority conferred on it by law. 

3 (e) PENALTIES.— 

4 (1) IN GENERAL.—Notwithstanding section 5(m) 

5 of the Federal Trade Commission Act (15 U.S.C. 

6 45(m)), the Commission may not obtain a civil pen7 alty under that section for a violation of section 3 of 

8 this Act by a covered entity in excess of— 

9 (A) $11,000 for each such individual; and 

10 (B) $11,000,000 in the aggregate for all 

11 such individuals with respect to the same viola12 tion by that covered entity. 

13 (2) OTHER AUTHORITY NOT AFFECTED.—Noth14 ing in this Act shall be construed to limit or affect 

15 in any way the Commission’s authority to bring en16 forcement actions or take any other measure under 

17 the Federal Trade Commission Act (15 U.S.C. 41 et 

18 seq.) or any other provision of law. 

19 (f) NO PRIVATE CAUSE OF ACTION.— 

20 (1) IN GENERAL.—No private right of action or 

21 class action shall be brought under this Act. 

22 (2) STATE ATTORNEY GENERAL AUTHORITY.—No 

23 person other than the attorney general of a State may 

24 bring a civil action under the law of any State is 
50 

•S 1408 RS 

1 such action is premised upon the defendant violating 

2 any provision of this Act. 

3 (g) COMPLIANCE WITH GRAMM-LEACH-BLILEY ACT.— 

4 Any covered entity is deemed to be in compliance with the 

5 notification requirements of this Act with respect to any 

6 breach of security for which it complies with requirements 

7 regarding notification established for such entities under 

8 title V of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 et 

9 seq.). Any covered entity is deemed to be in compliance with 

10 the requirements of this Act to protect sensitive personal 

11 information with respect to any such information for which 

12 it complies with the information protection requirements es13 tablished for such entities under title V of that Act and 

14 under section 607(a) of the Fair Credit Reporting Act (15 

15 U.S.C. 1681e(a)). 

16 SEC. 6. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 

17 (a) IN GENERAL.—Except as provided in section 5(c), 

18 a State, as parens patriae, may bring a civil action on 

19 behalf of its residents in an appropriate district court of 

20 the United States to enforce the provisions of this Act, to 

21 obtain damages, restitution, or other compensation on be22 half of such residents, or to obtain such further and other 

23 relief as the court may deem appropriate, whenever the at24 torney general of the State has reason to believe that the 

25 interests of the residents of the State have been or are being 
51 

•S 1408 RS 

1 threatened or adversely affected by a covered entity that vio2 lates this Act or a regulation under this Act. 

3 (b) NOTICE.—The State shall serve written notice to 

4 the Commission (or other appropriate Federal regulator 

5 under section 5) of any civil action under subsection (a) 

6 at least 60 days prior to initiating such civil action. The 

7 notice shall include a copy of the complaint to be filed to 

8 initiate such civil action, except that if it is not feasible 

9 for the State to provide such prior notice, the State shall 

10 provide such notice immediately upon instituting such civil 

11 action. 

12 (c) AUTHORITY TO INTERVENE.—Upon receiving the 

13 notice required by subsection (b), the Commission (or other 

14 appropriate Federal regulator under section 5) may inter15 vene in such civil action and upon intervening— 

16 (1) be heard on all matters arising in such civil 

17 action; and 

18 (2) file petitions for appeal of a decision in such 

19 civil action. 

20 (d) CONSTRUCTION.—For purposes of bringing any 

21 civil action under subsection (a), nothing in this section 

22 shall prevent the attorney general of a State from exercising 

23 the powers conferred on the attorney general by the laws 

24 of such State to conduct investigations or to administer 
52 

•S 1408 RS 

1 oaths or affirmations or to compel the attendance of wit2 nesses or the production of documentary and other evidence. 

3 (e) VENUE; SERVICE OF PROCESS.—In a civil action 

4 brought under subsection (a)— 

5 (1) the venue shall be a judicial district in 

6 which— 

7 (A) the covered entity operates; 

8 (B) the covered entity was authorized to do 

9 business; or 

10 (C) where the defendant in the civil action 

11 is found; 

12 (2) process may be served without regard to the 

13 territorial limits of the district or of the State in 

14 which the civil action is instituted; and 

15 (3) a person who participated with a covered en16 tity in an alleged violation that is being litigated in 

17 the civil action may be joined in the civil action 

18 without regard to the residence of the person. 

19 (f) LIMITATION ON STATE ACTION WHILE FEDERAL

20 ACTION IS PENDING.—If the Commission (or other appro21 priate Federal agency under section 5) has instituted a civil 

22 action or an administrative action for violation of this Act, 

23 no State attorney general, or official or agency of a State, 

24 may bring an action under this subsection during the pend25 ency of that action against any defendant named in the 
53 

•S 1408 RS 

1 complaint of the Commission or the other agency for any 

2 violation of this Act alleged in the complaint. 

3 SEC. 7. PREEMPTION OF STATE LAW. 

4 (a) IN GENERAL.—This Act preempts any State or 

5 local law, regulation, or rule that requires a covered enti6 ty— 

7 (1) to develop, implement, maintain, or enforce 

8 information security programs to which this Act ap9 plies; or 

10 (2) to notify individuals of breaches of security 

11 pertaining to them. 

12 (b) LIABILITY.—This Act preempts any State or local 

13 law, regulation, rule, administrative procedure, or judicial 

14 precedent under which liability is imposed on a covered en15 tity for failure— 

16 (1) to implement and maintain an adequate in17 formation security program; or 

18 (2) to notify an individual of any breach of secu19 rity pertaining to any sensitive personal information 

20 about that individual. 

21 (c) SECURITY FREEZE.—This Act preempts any State 

22 or local law, regulation, or rule that requires consumer re23 porting agencies to comply with a consumer’s request to 

24 place, remove, or temporarily suspend a prohibition on the 
54 

•S 1408 RS 

1 release by a consumer reporting agency of information from 

2 its files on that consumer. 

3 (d) SOCIAL SECURITY NUMBERS.—Section 8 of this 

4 Act, and the amendments made by that section, preempt 

5 any State or local law, regulation, or rule prohibiting or 

6 limiting the solicitation or display of Social Security ac7 count numbers. 

8 (e) LIMITATION OF PREEMPTION.—Federal preemp9 tion under this Act shall only apply to matters expressly 

10 described in subsections (a) through (d) of this section, and 

11 shall have no effect on other State or local jurisidiction over 

12 covered entities. 

13 SEC. 8. SOCIAL SECURITY NUMBER PROTECTION. 

14 (a) PROHIBITION OF UNNECESSARY SOLICITATION OF

15 SOCIAL SECURITY NUMBERS.— 

16 (1) IN GENERAL.—No covered entity may solicit 

17 a social security number from an individual unless 

18 there is a specific use of the social security number 

19 for which no other identifier reasonably can be used. 

20 (2) EXCEPTIONS.—Paragraph (1) does not apply 

21 to the solicitation of a social security number— 

22 (A) for the purpose of obtaining a consumer 

23 report for any purpose permitted under the Fair 

24 Credit Reporting Act (15 U.S.C. 1681 et seq.), 
55 

•S 1408 RS 

1 (B) by a consumer reporting agency for the 

2 purpose of authenticating or obtaining appro3 priate proof of a consumer’s identity, as required 

4 under that Act; 

5 (C) for any purpose permitted under section 

6 502(e) of the Gramm-Leach-Bliley Act (15 

7 U.S.C. 6802(e)); or 

8 (D) to identify or locate missing or ab9 ducted children, witnesses, criminals and fugi10 tives, parties to lawsuits, parents delinquent in 

11 child support payments, organ and bone marrow 

12 donors, pension fund beneficiaries, and missing 

13 heirs. 

14 (b) PROHIBITION OF THE DISPLAY OF SOCIAL SECU15 RITY NUMBERS ON EMPLOYEE IDENTIFICATION CARDS, 

16 ETC..— 

17 (1) IN GENERAL.—No covered entity may display the 

18 social security number (or any derivative of such number) 

19 of an individual on any card or tag that is commonly pro20 vided to employees (or to their family members), faculty, 

21 staff, or students for purposes of identification. 

22 (2) DRIVER’S LICENSES.—A State may not display 

23 the social security number of an individual on driver’s li24 censes issued by that State. 
56 

•S 1408 RS 

1 (c) PROHIBITION OF PRISONER ACCESS TO SOCIAL

2 SECURITY ACCOUNT NUMBERS.— 

3 (1) IN GENERAL.—Section 205(c)(2)(C) of the 

4 Social Security Act (42 U.S.C. 405(c)(2)(C)) is 

5 amended by adding at the end the following new 

6 clause: 

7 ‘‘(x) No executive, legislative, or judicial agency or in8 strumentality of the Federal Government or of a State or 

9 political subdivision thereof (or person acting as an agent 

10 of such an agency or instrumentality) may employ, or enter 

11 into a contract for the use or employment of, prisoners in 

12 any capacity that would allow such prisoners access to the 

13 social security account numbers of other individuals. For 

14 purposes of this clause, the term ‘prisoner’ means an indi15 vidual who is confined in a jail, prison, or other penal in16 stitution or correctional facility, serving community service 

17 as a term of probation or parole, or serving a sentence 

18 through a work-furlough program.’’. 

19 (2) TREATMENT OF CURRENT ARRANGEMENTS.— 

20 In the case of— 

21 (A) prisoners employed as described in 

22 clause (xi) of section 205(c)(2)(C) of the Social 

23 Security Act (42 U.S.C. 405(c)(2)(C)), as added 

24 by paragraph (1), on the date of enactment of 

25 this Act, and 
57 

•S 1408 RS 

1 (B) contracts described in such clause in ef2 fect on such date, 

3 the amendment made by paragraph (1) shall take ef4 fect 90 days after the date of enactment of this Act. 

5 (d) PROHIBITION OF SALE, PURCHASE, AND DISPLAY

6 OF SOCIAL SECURITY NUMBERS TO THE GENERAL PUB7 LIC.— 

8 (1) IN GENERAL.—Except as provided in para9 graph (2), it shall be unlawful for any person to— 

10 (A) sell or purchase a social security ac11 count number or display to the general public a 

12 social security account number, or 

13 (B) obtain or use any individual’s social se14 curity account number for the purpose of locat15 ing or identifying such individual with the in16 tent to physically injure or harm such indi17 vidual or using the identity of such individual 

18 for any illegal purpose. 

19 (2) EXCEPTIONS.—Notwithstanding paragraph 

20 (1), and subject to paragraph (3), a social security 

21 account number may be sold or purchased by any 

22 person to the extent provided in this subsection (and 

23 for no other purpose)— 

24 (A) to the extent necessary for national se25 curity purposes; 
58 

•S 1408 RS 

1 (B) to the extent necessary for public health 

2 purposes; 

3 (C) to the extent necessary in emergency sit4 uations to protect the health or safety of 1 or 

5 more individuals; 

6 (D) to the extent that the sale or purchase 

7 is required to comply with a tax law of the 

8 United States or of any State (or political sub9 division thereof); 

10 (E) to the extent that the sale or purchase 

11 is to or by a consumer reporting agency (as de12 fined in section 603(f) of the Fair Credit Report13 ing Act (15 U.S.C. 1681a(f))) for use or disclo14 sure solely for permissible purposes described in 

15 section 604(a) of such Act (15 U.S.C. 1681b(a)); 

16 and 

17 (F) to the extent necessary for research 

18 (other than market research) conducted by an 

19 agency or instrumentality of the United States 

20 or of a State or political subdivision thereof (or 

21 an agent of such an agency or instrumentality) 

22 for the purpose of advancing the public good, on 

23 the condition that the researcher provides ade24 quate assurances that— 
59 

•S 1408 RS 

1 (i) the social security account numbers 

2 will not be used to harass, target, or pub3 licly reveal information concerning any 

4 identifiable individuals; 

5 (ii) information about identifiable in6 dividuals obtained from the research will 

7 not be used to make decisions that directly 

8 affect the rights, benefits, or privileges of 

9 specific individuals; and 

10 (iii) the researcher has in place appro11 priate safeguards to protect the privacy and 

12 confidentiality of any information about 

13 identifiable individuals, including proce14 dures to ensure that the social security ac15 count numbers will be encrypted or other16 wise appropriately secured from unauthor17 ized disclosure. 

18 (3) CONSENSUAL SALE.—Notwithstanding para19 graph (1), a social security account number assigned 

20 to an individual may be sold, purchased, or displayed 

21 to the general public by any person to the extent con22 sistent with such individual’s voluntary and affirma23 tive written consent to the sale, purchase, or display 

24 of the social security account number, but only if— 
60 

•S 1408 RS 

1 (A) the terms of the consent and the right 

2 to refuse consent are presented to the individual 

3 in a clear, conspicuous, and understandable 

4 manner; 

5 (B) the individual is placed under no obli6 gation to provide consent to any such sale, pur7 chase, or display; and 

8 (C) the terms of the consent authorize the 

9 individual to limit the sale, purchase, or display 

10 to purposes directly associated with the trans11 action with respect to which the consent is 

12 sought. 

13 (4) REGULATIONS.—Within 1 year after the date 

14 of enactment of this Act the Commission shall pro15 mulgate regulations under this subsection after con16 sultation with the Attorney General, the Commis17 sioner of Social Security, the Secretary of Homeland 

18 Security, State attorneys general, and such other gov19 ernmental agencies and instrumentalities as the At20 torney General considers appropriate. 

21 SEC. 9. INFORMATION SECURITY WORKING GROUP. 

22 (a) INFORMATION SECURITY WORKING GROUP.—The 

23 Chairman of the Commission shall establish an Information 

24 Security Working Group to collect, review, disseminate, and 

25 advise on best practices for covered entities to protect sen-
61 

•S 1408 RS 

1 sitive personal information stored and transferred. The 

2 Working Group shall be composed of industry participants, 

3 consumer groups, and other interested parties. 

4 (b) REPORT.—Not later than 12 months after the date 

5 on which the Working Group is established under subsection 

6 (a) and annually thereafter, the Working Group shall sub7 mit to Congress a report on its findings. 

8 (c) TERMINATION.—The Commission, after notifying 

9 the Congress in writing of its intent to terminate the Work10 ing Group, may terminate it after the Comission deter11 mines that the work and annual reports are no longer nec12 essary. 

13 SEC. 10. DEFINITIONS. 

14 In this Act: 

15 (1) BREACH OF SECURITY.—The term ‘‘breach of 

16 security’’ means unauthorized access to and acquisi17 tion of data in any form or format containing sen18 sitive personal information that compromises the se19 curity or confidentiality of such information and cre20 ates a reasonable risk of identity theft. 

21 (2) COMMISSION.—The term ‘‘Commission’’ 

22 means the Federal Trade Commission. 

23 (3) CONSUMER CREDIT REPORTING AGENCY.— 

24 The term ‘‘consumer credit reporting agency’’ means 

25 any person which, for monetary fees, dues, or on a co-
62 

•S 1408 RS 

1 operative nonprofit basis, regularly engages in whole 

2 or in part in the practice of assembling or evaluating 

3 consumer credit information or other information on 

4 consumers for the purpose of furnishing credit reports 

5 to third parties, and which uses any means or facility 

6 of interstate commerce for the purpose of preparing or 

7 furnishing credit reports. 

8 (4) COVERED ENTITY.—The term ‘‘covered enti9 ty’’ means a sole proprietorship, partnership, cor10 poration, trust, estate, cooperative, association, or 

11 other commercial entity, and any charitable, edu12 cational, or nonprofit organization, that acquires, 

13 maintains, or utilizes sensitive personal information. 

14 (5) CREDIT REPORT.—The term ‘‘credit report’’ 

15 means a consumer report, as defined in section 603(d) 

16 of the Federal Fair Credit Reporting Act (15 U.S.C. 

17 1681a(p)), that is used or expected to be used or col18 lected in whole or in part for the purpose of serving 

19 as a factor in establishing a consumer’s eligibility for 

20 credit for personal, family or household purposes. 

21 (6) IDENTITY THEFT.—The term ‘‘identity theft’’ 

22 means the unauthorized acquisition, purchase, sale, or 

23 use by any person of an individual’s sensitive per24 sonal information that— 
63 

•S 1408 RS 

1 (A) violates section 1028 of title 18, United 

2 States Code, or any provision of State law in 

3 pari materia; or 

4 (B) results in economic loss to the indi5 vidual whose sensitive personal information was 

6 used. 

7 (7) REASONABLE RISK OF IDENTITY THEFT.— 

8 The term ‘‘reasonable risk of identity theft’’ means 

9 that the preponderance of the evidence available to the 

10 covered entity that has experienced a breach of secu11 rity establishes that identity theft for 1 or more indi12 viduals from the breach of security is forseeable. 

13 (8) REVIEWING THE ACCOUNT.—The term ‘‘re14 viewing the account’’ includes activities related to ac15 count maintenance, monitoring, credit line increases, 

16 and account upgrades and enhancements. 

17 (9) SENSITIVE PERSONAL INFORMATION.— 

18 (A) IN GENERAL.—Except as provided in 

19 subparagraphs (B) and (C), the term ‘‘sensitive 

20 personal information’’ means an individual’s 

21 name, address, or telephone number combined 

22 with 1 or more of the following data elements re23 lated to that individual: 

24 (i) Social security number, taxpayer 

25 identification number, or an employer iden-
64 

•S 1408 RS 

1 tification number that is the same as or is 

2 derived from the social security number of 

3 that individual. 

4 (ii) Financial account number, or 

5 credit card or debit card number of such in6 dividual, combined with any required secu7 rity code, access code, or password that 

8 would permit access to such individual’s ac9 count. 

10 (iii) State driver’s license identifica11 tion number or State resident identification 

12 number. 

13 (B) FTC MODIFICATIONS.—The Commission 

14 may, through a rulemaking proceeding in ac15 cordance with section 553 of title 5, United 

16 States Code, designate other identifying informa17 tion that may be used to effectuate identity theft 

18 as sensitive personal information for purposes of 

19 this Act and limit or exclude any information 

20 described in subparagraph (A) from the defini21 tion of sensitive personal information for pur22 poses of this Act. 

23 (C) PUBLIC RECORDS.—Nothing in this Act 

24 prohibits a covered entity from obtaining, aggre25 gating, or using sensitive personal information it 
65 

•S 1408 RS 

1 lawfully obtains from public records in a man2 ner that does not violate this Act. 

3 SEC. 11. AUTHORIZATION OF APPROPRIATIONS. 

4 There are authorized to be appropriated to the Com5 mission $1,000,000 for each of fiscal years 2006 through 

6 2010 to carry out this Act. 

7 SEC. 12. RELATED CRIME STUDY. 

8 (a) IN GENERAL.—The Federal Trade Commission, in 

9 conjunction with the Department of Justice and other Fed10 eral agencies, shall undertake a study of— 

11 (1) the correlation between methamphetamine 

12 use and identity theft crimes; 

13 (2) the needs of law enforcement to address meth14 amphetamine crimes related to identity theft, includ15 ing production, trafficking, and the purchase of pre16 cursor chemicals; and 

17 (3) the Federal Government’s role in addressing 

18 and deterring identity theft crimes. 

19 (b) REPORT.—Not later than 18 months after the date 

20 of enactment of this Act, the Federal Trade Commission 

21 shall submit a report of its findings and recommendations 

22 to the Congress that includes— 

23 (1) a detailed analysis of the correlation between 

24 methamphetamine use and identity theft crimes; 
66 

•S 1408 RS 

1 (2) the needs of law enforcement to address meth2 amphetamine crimes related to identity theft: includ3 ing production, trafficking, and the purchase of pre4 cursor chemicals related to methamphetamine; 

5 (3) the Federal Government’s role in addressing 

6 and deterring identity theft crimes; and 

7 (4) specific recommendations for means of reduc8 ing and preventing crimes involving methamphet9 amine and identity theft, including recommendations 

10 for best practices for local law enforcement agencies. 

11 SEC. 13. PROHIBITION ON TECHNOLOGY MANDATES. 

12 Nothing in this Act shall be construed to permit the 

13 Commission to issue regulations that require or impose a 

14 specific technology, product, technological standards, or so15 lution. 

16 SEC. 14. EFFECTIVE DATES. 

17 (a) IN GENERAL.—Except as provided in subsections 

18 (b) and (c), the provisions of this Act take effect upon its 

19 enactment. 

20 (b) IMPLEMENTATION OF SECURITY PROGRAM.—A 

21 covered entity shall implement the program required by sec22 tion 2(a) within 6 months after the date of enactment of 

23 this Act. 

24 (c) PROVISIONS REQUIRING RULEMAKING.—The Com25 mission shall initiate 1 or more rulemaking proceedings 
67 

•S 1408 RS 

1 under sections 2(c), 3, and 4 within 45 days after the date 

2 of enactment of this Act. The Commission shall promulgate 

3 all final rules pursuant to those rulemaking proceedings 

4 within 1 year after the date of enactment of this Act. The 

5 provisions of sections 2(c), 3, and 4 shall take effect on the 

6 same date 6 months after the date on which the Commission 

7 promulgates the last final rule under the proceeding or pro8 ceedings commenced under the preceding sentence. 

9 (d) PREEMPTION.—Section 7 shall take effect at the 

10 same time as sections 2(c), 3, and 4 take effect. 
Calendar No. 320 

109TH CONGRESS 

1ST SESSION S. 1408 

[Report No. 109–203] 

A BILL 

To strengthen data protection and safeguards, revent identity theft. quire data breach notification, and further preDECEMBER 8, 2005 

Reported with an amendment