II 

109TH CONGRESS 

1ST SESSION S. 1461 

To establish procedures for the protection of consumers from misuse of, 

and unauthorized access to, sensitive personal information contained in 

private information files maintained by commercial entities engaged in, 

or affecting, interstate commerce, provide for enforcement of those procedures by the Federal Trade Commission, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JULY 21, 2005 

Mr. SHELBY introduced the following bill; which was read twice and referred 

to the Committee on Banking, Housing, and Urban Affairs 

A BILL 

To establish procedures for the protection of consumers from 

misuse of, and unauthorized access to, sensitive personal 

information contained in private information files maintained by commercial entities engaged in, or affecting, 

interstate commerce, provide for enforcement of those 

procedures by the Federal Trade Commission, and for 

other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Consumer Identity 

5 Protection and Security Act’’. 
2 

•S 1461 IS

1 SEC. 2. SECURITY FREEZES. 

2 The Fair Credit Reporting Act (15 U.S.C. 1601 et 

3 seq.) is amended by inserting after section 605B the fol4 lowing: 

5 ‘‘SEC. 605C. SECURITY FREEZES. 

6 ‘‘(a) IN GENERAL.—A consumer reporting agency 

7 shall place a security freeze on a private information file 

8 when requested by the consumer to whom that file re9 lates— 

10 ‘‘(1) by certified mail, 

11 ‘‘(2) by telephone by providing certain sensitive 

12 personal information, or 

13 ‘‘(3) through a secure electronic mail connec14 tion if such connection is made available by the con15 sumer reporting agency. 

16 ‘‘(b) TIMING.—A consumer reporting agency shall 

17 place the requested security freeze on the private informa18 tion file no later than 2 business days after receiving a 

19 written or telephone request from the consumer or 24 

20 hours after receiving a secure electronic mail request. 

21 ‘‘(c) CONFIRMATION.—Within 2 business days after 

22 placing a security freeze on a private information file 

23 under subsection (a), the consumer reporting agency that 

24 received the request from the consumer shall— 

25 ‘‘(1) send a written confirmation of the security 

26 freeze to the consumer; and 
3 

•S 1461 IS

1 ‘‘(2) provide to the consumer a unique personal 

2 identification number or password to be used by the 

3 consumer to authorize access to the private informa4 tion file or to remove the security freeze on the file. 

5 ‘‘(d) PROHIBITION ON UNAUTHORIZED ACCESS.—A 

6 consumer reporting agency may not grant access to a pri7 vate information file on which a security freeze has been 

8 placed, or release information contained in a such a pri9 vate information file, except in accordance with the provi10 sions of this section or other Federal law. 

11 ‘‘(e) LIMITED OR TEMPORARY ACCESS TO FROZEN

12 REPORT.— 

13 ‘‘(1) IN GENERAL.—Within 3 business days 

14 after receiving a request from a consumer upon 

15 whose private information file a security freeze has 

16 been placed to allow access to that file to a third 

17 party, or for a period of time, specified by the con18 sumer, a consumer reporting agency shall make the 

19 private information file available in accordance with 

20 the request notwithstanding the security freeze. 

21 Each consumer reporting agency shall develop proce22 dures involving the use of telephone, facsimile ma23 chine, or, upon the consent of the consumer in the 

24 manner required by the Electronic Signatures in 

25 Global and National Commerce Act (15 U.S.C. 7001 
4 

•S 1461 IS

1 et seq.) for notices legally required to be in writing, 

2 by the Internet, e-mail, or other electronic medium, 

3 to receive and process a request from a consumer to 

4 provide limited or temporary access to the private 

5 information file under this section in an expedited 

6 manner. 

7 ‘‘(2) REQUEST REQUIREMENTS.—A consumer 

8 reporting agency may not allow access to a private 

9 information file under paragraph (1) unless— 

10 ‘‘(A) the request was made by the con11 sumer by telephone, certified mail, or security 

12 electronic mail (except as provided in accord13 ance with procedures established pursuant to 

14 the second sentence of paragraph (1)); and 

15 ‘‘(B) the consumer provides— 

16 ‘‘(i) proper identification, 

17 ‘‘(ii) the unique personal identification 

18 number or password provided by the con19 sumer reporting agency under this section; 

20 and 

21 ‘‘(iii) the proper information regard22 ing the third party who is to receive the 

23 private information file or the time period 

24 for which the file shall be made available. 
5 

•S 1461 IS

1 ‘‘(3) TERMINATION NOT PERMITTED.—A con2 sumer reporting agency may not terminate a secu3 rity freeze on the basis of a request under paragraph 

4 (1) for limited access to a private information file. 

5 ‘‘(f) TERMINATION OF SECURITY FREEZE.— 

6 ‘‘(1) IN GENERAL.—A consumer reporting 

7 agency shall terminate a security freeze on a private 

8 information file if— 

9 ‘‘(A) the consumer requests that the secu10 rity freeze be terminated; or 

11 ‘‘(B) the consumer reporting agency— 

12 ‘‘(i) determines that the security 

13 freeze was placed on the private informa14 tion file due to a material misrepresenta15 tion of fact by the consumer; and 

16 ‘‘(ii) notifies the consumer in writing 

17 not less than 5 business days before termi18 nating the security freeze under this sub19 paragraph. 

20 ‘‘(2) TERMINATION REQUESTS.—Except as pro21 vided in paragraph (1)(B), a consumer reporting 

22 agency may not terminate a security freeze on a pri23 vate information file unless the consumer provides— 

24 ‘‘(A) proper identification; and 
6 

•S 1461 IS

1 ‘‘(B) the unique personal identification 

2 number or password provided by the consumer 

3 reporting agency under this section. 

4 ‘‘(3) TIMING.—A consumer reporting agency 

5 shall terminate a security freeze on a private infor6 mation file within 3 business days after receiving a 

7 request that meets the requirements of this sub8 section from the consumer to whom the file relates. 

9 ‘‘(g) DENIAL OF THIRD PARTY REQUESTS.— 

10 ‘‘(1) REQUESTS DENIED DUE TO SECURITY

11 FREEZE.—Notwithstanding any other provision of 

12 law to the contrary, if a third party’s request for ac13 cess to a private information file is denied because 

14 there is a security freeze on it, that third party may 

15 treat any application in connection with which the 

16 request is made as incomplete. 

17 ‘‘(2) NOTIFICATION OF CONSUMER.—If a con18 sumer reporting agency denies a third party’s re19 quest for access to a private information file on 

20 which a security freeze has been placed for any pur21 pose other than account review, the consumer re22 porting agency shall notify the consumer that it de23 nied the request within 1 business day thereafter. 

24 The notice shall identify the third party making the 

25 request and the stated purpose of the request. 
7 

•S 1461 IS

1 ‘‘(h) EXCEPTIONS TO SECURITY FREEZE.—The pro2 visions of this section do not apply to requests for access 

3 to a private information file by— 

4 ‘‘(1) a Federal, State, or local law enforcement 

5 agency acting within the scope of its authority or 

6 pursuant to a court order, warrant, or subpoena; 

7 ‘‘(2) a Federal, State, or local agency that ad8 ministers a program for establishing an enforcing 

9 child support obligations; 

10 ‘‘(3) a Federal, State, or local health agency or 

11 its agents or assignees acting to investigate fraud; 

12 ‘‘(4) a Federal, State, or local tax agency, or its 

13 agents or assignees, acting to investigate or collect 

14 delinquent taxes or unpaid court orders or to fulfill 

15 any of its other statutory responsibilities; 

16 ‘‘(5) a person, or the person’s subsidiary, affil17 iate, agent, or assignee with which the consumer has 

18 or, prior to assignment, had an account, contract, or 

19 debtor-creditor relationship for the purposes of re20 viewing the account or collecting the financial obliga21 tion owing for the account, contract, or debt; 

22 ‘‘(6) a subsidiary, affiliate, agent, assignee, or 

23 prospective assignee of a person to whom access has 

24 been granted under paragraph (5) for purposes of 
8 

•S 1461 IS

1 facilitating the extension of credit or other permis2 sible use; or 

3 ‘‘(7) any person or entity for the purpose of 

4 providing a consumer with a copy of his or her pri5 vate information file upon the consumer’s request. 

6 ‘‘(i) NOTIFICATION OF VIOLATION.— 

7 ‘‘(1) NOTIFICATION.—If a consumer reporting 

8 agency violates the requirements of this section with 

9 respect to access to a private information file, it 

10 shall notify the consumer in writing of the violation 

11 within 5 business days. The notice shall include a 

12 description of the information to which access was 

13 granted and the name and address of the third party 

14 to whom such access was granted. 

15 ‘‘(2) COMPLAINTS TO CONSUMER PROTECTION

16 AGENCIES.—If a private information file on which a 

17 security freeze under this section is accessed in vio18 lation of this section, the consumer to whom the file 

19 relates may file a complaint with the Federal Trade 

20 Commission, the attorney general of the State in 

21 which the consumer resides, or any other Federal or 

22 State consumer protection agency. 

23 ‘‘(j) APPLICATION TO OTHER CONSUMER REPORTING

24 AGENCIES.— 
9 

•S 1461 IS

1 ‘‘(1) NOTIFICATION.—Whenever a consumer re2 porting agency receives a request from a consumer 

3 under this section that meets the requirements of 

4 this section to place a security freeze on his or her 

5 private information file under subsection (a), to pro6 vide temporary or limited access to such a private 

7 information file under subsection (e), or to terminate 

8 a security freeze on such a private information file 

9 under subsection (f), it shall notify (on a secure 

10 basis) every other consumer reporting agency in the 

11 United States that it knows, or has reason to know, 

12 to maintain a private information file on that con13 sumer of the request. 

14 ‘‘(2) COMPLIANCE BY OTHER CONSUMER RE15 PORTING AGENCIES.—A consumer reporting agency 

16 that receives a reported request under paragraph (1) 

17 shall comply with the requirements of this section 

18 with respect to that request to the same extent and 

19 in the same manner as if it had received the request 

20 from the consumer. 

21 ‘‘(3) LIABILITY.—A consumer reporting agency 

22 responding to a notification from another consumer 

23 reporting agency under paragraph (1) is liable for 

24 any violation of this section with respect to the re25 quest to which the notification relates, to the same 
10 

•S 1461 IS

1 extent as if it had received the request from the con2 sumer, except that such an agency shall not be liable 

3 for any violation attributable to incorrect informa4 tion provided in the request from the notifying agen5 cy. 

6 ‘‘(k) SERVICE FEES AND CHARGES.— 

7 ‘‘(1) FEES PROHIBITED.—A consumer report8 ing agency may not impose a charge or fee for plac9 ing a security freeze on a private information file 

10 under subsection (a), for providing limited access to 

11 a private information file under subsection (e), or 

12 for terminating a security freeze on a private infor13 mation file under subsection (f). 

14 ‘‘(2) REPLACEMENT IDENTIFICATION CODES

15 AND PASSWORDS.—A consumer reporting agency— 

16 ‘‘(A) may not impose a fee for the replace17 ment or reissue of a lost or forgotten personal 

18 identification number or password the first time 

19 the replacement or reissue is provided to the 

20 consumer; but 

21 ‘‘(B) may impose a fee of not more than 

22 $5 for a second or subsequent replacement or 

23 reissue of such a personal identification number 

24 or password.’’. 
11 

•S 1461 IS

1 SEC. 3. DEFINITIONS. 

2 Section 603 of the Fair Credit Reporting Act (15 

3 U.S.C. 1681a) is amended by adding at the end the fol4 lowing: 

5 ‘‘(y) DEFINITIONS RELATING TO SECURITY

6 FREEZES.—For purposes of section 605C, the following 

7 definitions shall apply: 

8 ‘‘(1) ACCOUNT REVIEW.—The term ‘account re9 view’ means any activity related to account mainte10 nance, monitoring, credit line increases, or account 

11 upgrades and enhancements. 

12 ‘‘(2) PRIVATE INFORMATION FILE.— 

13 ‘‘(A) IN GENERAL.—The term ‘private in14 formation file’ means any written, oral, or other 

15 communication of any information by a con16 sumer reporting agency bearing on a con17 sumer’s character, general reputation, personal 

18 characteristics, mode of living, employment, or 

19 personal financial information to be used in 

20 whole or in part for political campaign, chari21 table solicitation, commercial marketing pur22 poses or as a factor in establishing the con23 sumer’s eligibility for— 

24 ‘‘(i) credit or insurance to be used pri25 marily for personal, family, or household 

26 purposes; or 
12 

•S 1461 IS

1 ‘‘(ii) employment purposes. 

2 ‘‘(B) EXCLUSIONS.—Except as provided in 

3 subparagraph (C), the term ‘private informa4 tion file’ does not include— 

5 ‘‘(i) any report containing information 

6 solely as to transactions or experiences be7 tween the consumer and the person mak8 ing the report; 

9 ‘‘(ii) the communication of that infor10 mation among persons related by common 

11 ownership or affiliated by corporate con12 trol; or 

13 ‘‘(iii) the communication of other in14 formation among persons related by com15 mon ownership or affiliated by corporate 

16 control, if it is clearly and conspicuously 

17 disclosed to the consumer that the infor18 mation may be communicated among such 

19 persons and the consumer is given the op20 portunity, before the time that the infor21 mation is initially communicated, to direct 

22 that such information not be commu23 nicated among such persons; 

24 ‘‘(iv) any authorization or approval of 

25 a specific extension of credit directly or in-
13 

•S 1461 IS

1 directly by the issuer of a credit card or 

2 similar device; or 

3 ‘‘(v) any report in which a person who 

4 has been requested by a third party to 

5 make a specific extension of credit directly 

6 or indirectly to a consumer conveys his or 

7 her decision with respect to such request, 

8 if the third party advises the consumer of 

9 the name and address of the person to 

10 whom the request was made, and such per11 son makes the required disclosures to the 

12 consumer under Federal law. 

13 ‘‘(C) RESTRICTION ON SHARING OF MED14 ICAL INFORMATION.—Except for information or 

15 any communication of information disclosed as 

16 provided in Federal law, the exclusions in sub17 paragraph (B) do not apply with respect to in18 formation disclosed to any person related by 

19 common ownership or affiliated by corporate 

20 control, if the information is— 

21 ‘‘(i) medical information; 

22 ‘‘(ii) an individualized list or descrip23 tion based on the payment transactions of 

24 the consumer for medical products or serv25 ices; or 
14 

•S 1461 IS

1 ‘‘(iii) an aggregate list of identified 

2 consumers based on payment transactions 

3 for medical products or services.’’. 

4 SEC. 4. REGULATIONS. 

5 (a) RULEMAKING PROCEEDING.—Within 90 days 

6 after the date of enactment of this Act, the Federal Trade 

7 Commission shall initiate a rulemaking proceeding to pro8 vide rules, guidelines, and criteria for compliance with the 

9 requirements of section 605C of the Fair Credit Reporting 

10 Act, as added by this Act, including— 

11 (1) rules necessary to implement the provisions 

12 of that section 605C that include required contents 

13 for a request for a security freeze, criteria for identi14 fication verification of the requesting party, and con15 sumer notification requirements to ensure that con16 sumers are aware of their rights under that section; 

17 (2) rules to ensure that a request for a security 

18 freeze on a private information file, a request from 

19 a consumer for limited or temporary access to a pri20 vate information file, or a requested termination of 

21 such a freeze under that section, will be commu22 nicated by the consumer reporting agency receiving 

23 the request to other consumer reporting agencies, as 

24 required by subsection (j) of that section, and imple25 mented by those agencies in a timely manner; and 
15 

•S 1461 IS

1 (3) rules to provide for the application of that 

2 section in a manner that does not conflict with any 

3 other provision of Federal law governing the acquisi4 tion, maintenance, disposition, or access to informa5 tion contained in a private information file. 

6 (b) FINAL RULE.—The Commission shall issue final 

7 rules pursuant to the proceeding initiated under sub8 section (a) within 1 year after the date of enactment of 

9 this Act. 

Æ