II 

109TH CONGRESS 

1ST SESSION S. 2169 

To amend the Fair Credit Reporting Act to provide for secure financial 

data, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

DECEMBER 21, 2005 

Mr. CARPER (for himself and Mr. MARTINEZ) introduced the following bill; 

which was read twice and referred to the Committee on Banking, Housing, and Urban Affairs 

A BILL 

To amend the Fair Credit Reporting Act to provide for 

secure financial data, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Financial Data Protec5 tion Act of 2005’’. 

6 SEC. 2. DATA SECURITY SAFEGUARDS. 

7 (a) IN GENERAL.—The Fair Credit Reporting Act 

8 (15 U.S.C. 1681) is amended by adding at the end the 

9 following new section: 
2 

•S 2169 IS 

1 ‘‘§ 630. Data security safeguards 

2 ‘‘(a) SECURITY POLICIES AND PROCEDURES.—Each 

3 consumer reporter shall have an affirmative obligation to 

4 implement, and a continuing obligation to maintain, rea5 sonable policies and procedures to protect the security and 

6 confidentiality of sensitive financial personal information 

7 relating to any consumer that is maintained, serviced, or 

8 communicated by or on behalf of such consumer reporter 

9 against any unauthorized use that is reasonably likely to 

10 result in substantial harm or inconvenience to such con11 sumer. 

12 ‘‘(b) INVESTIGATION REQUIREMENTS.— 

13 ‘‘(1) INVESTIGATION REQUIRED.—Whenever 

14 any consumer reporter determines or becomes aware 

15 of information that would reasonably indicate that a 

16 breach of data security has or may have occurred or 

17 is reasonably likely to be about to occur, or receives 

18 notice under subsection (d), the consumer reporter 

19 shall immediately conduct a reasonable investigation 

20 to— 

21 ‘‘(A) assess the nature and scope of the 

22 potential breach; 

23 ‘‘(B) identify the sensitive financial per24 sonal information involved; and 

25 ‘‘(C) determine if the potential breach is 

26 reasonably likely to result in substantial harm 
3 

•S 2169 IS 

1 or inconvenience to any consumer to whom the 

2 information relates. 

3 ‘‘(2) SCOPE OF INVESTIGATION.—An investiga4 tion conducted under paragraph (1) shall be com5 mensurate with the nature and the amount of the 

6 sensitive financial personal information that is sub7 ject to the breach of data security. 

8 ‘‘(3) FACTORS TO BE CONSIDERED.—In deter9 mining the likelihood under this section that sen10 sitive financial personal information that was the 

11 subject of a breach of data security has been or will 

12 be misused, the consumer reporter shall consider all 

13 available relevant facts, including whether the infor14 mation that was subject to the breach was 

15 encrypted, redacted, required technology to use that 

16 is not generally commercially available, or is other17 wise unreadable or unusable. 

18 ‘‘(c) INVESTIGATION NOTICES AND SYSTEM RES19 TORATION REQUIREMENTS.—If a consumer reporter de20 termines after commencing an investigation under sub21 section (b) that a potential breach of data security may 

22 result in substantial harm or inconvenience to any con23 sumer to whom the sensitive financial personal informa24 tion involved in such potential breach relates, the con25 sumer reporter shall— 
4 

•S 2169 IS 

1 ‘‘(1) promptly notify the United States Secret 

2 Service; 

3 ‘‘(2) promptly notify the appropriate functional 

4 regulatory agency for the consumer reporter; 

5 ‘‘(3) notify as appropriate and without unrea6 sonable delay— 

7 ‘‘(A) any entity that owns or is obligated 

8 on a financial account that may be subject to 

9 unauthorized transactions as a result of the 

10 breach, to the extent the breach involves related 

11 sensitive financial account information, includ12 ing in such notification information reasonably 

13 identifying the nature and scope of the breach 

14 and the sensitive financial personal information 

15 involved; 

16 ‘‘(B) each nationwide consumer reporting 

17 agency, in the case of a breach involving sen18 sitive financial identity information relating to 

19 1,000 or more consumers; and 

20 ‘‘(C) any other appropriate critical third 

21 parties— 

22 ‘‘(i) whose involvement is necessary to 

23 investigate the breach; or 

24 ‘‘(ii) who will be required to undertake 

25 further action with respect to such infor-
5 

•S 2169 IS 

1 mation to protect such consumers from re2 sulting fraud or identity theft; 

3 ‘‘(4) to the extent possible and practicable, take 

4 reasonable measures to repair the breach and restore 

5 the security and confidentiality of the sensitive fi6 nancial personal information involved to limit fur7 ther unauthorized use of such information; and 

8 ‘‘(5) take reasonable measures to restore the in9 tegrity of the affected data security safeguards and 

10 make appropriate improvements to data security 

11 policies and procedures. 

12 ‘‘(d) THIRD PARTY DUTIES.— 

13 ‘‘(1) COORDINATED INVESTIGATION.—When14 ever any consumer reporter that maintains or re15 ceives sensitive financial personal information for or 

16 on behalf of another party determines, or has reason 

17 to believe, that a breach of data security has oc18 curred with respect to such information, the con19 sumer reporter shall— 

20 ‘‘(A) promptly notify the other party of the 

21 breach; 

22 ‘‘(B) conduct a coordinated investigation 

23 with the other party as described in subsection 

24 (b); and 
6 

•S 2169 IS 

1 ‘‘(C) ensure that the appropriate notices 

2 are provided as required under subsection (e). 

3 ‘‘(2) CONTRACTUAL OBLIGATION REQUIRED.— 

4 No consumer reporter may provide sensitive finan5 cial personal information to a third party to main6 tain, receive, or communicate on behalf of the con7 sumer reporter, unless such third party agrees that 

8 whenever the third party becomes aware that a 

9 breach of data security has occurred or is reasonably 

10 likely to have occurred with respect to such informa11 tion maintained, received, or communicated by such 

12 third party, the third party shall be obligated— 

13 ‘‘(A) to provide notice of the breach to the 

14 consumer reporter; 

15 ‘‘(B) to conduct a coordinated investigation 

16 with the consumer reporter to determine the 

17 likelihood that such information will be misused 

18 against the consumers to whom the information 

19 relates in a manner that would cause substan20 tial harm or inconvenience to any such con21 sumers; and 

22 ‘‘(C) provide any consumer notices re23 quired under subsection (e), except to the ex24 tent that such notices are provided by the con-
7 

•S 2169 IS 

1 sumer reporter in a manner meeting the re2 quirements of such subsection. 

3 ‘‘(e) CONSUMER NOTICE.— 

4 ‘‘(1) POTENTIAL IDENTITY THEFT RISK.—A 

5 consumer reporter shall provide a consumer notice in 

6 accordance with subsection (f) if, after being re7 quired to commence an investigation pursuant to 

8 this section, the consumer reporter becomes aware— 

9 ‘‘(A) that a breach of data security is rea10 sonably likely to have occurred, with respect to 

11 sensitive financial identity information main12 tained, received, or communicated by or on be13 half of the consumer reporter; 

14 ‘‘(B) of information reasonably identi15 fying— 

16 ‘‘(i) the nature and scope of the 

17 breach, and 

18 ‘‘(ii) the sensitive financial identity in19 formation involved; and 

20 ‘‘(C) that such information has been or is 

21 reasonably likely to be misused in a manner 

22 causing substantial harm or inconvenience 

23 against the consumers to whom such informa24 tion relates to commit identity theft. 
8 

•S 2169 IS 

1 ‘‘(2) POTENTIAL FRAUDULENT TRANSACTION

2 RISK.— 

3 ‘‘(A) IN GENERAL.—A consumer reporter 

4 shall provide a consumer notice in accordance 

5 with subsection (f) if, after being required to 

6 commence an investigation pursuant to this sec7 tion, the consumer reporter becomes aware— 

8 ‘‘(i) that a breach of data security is 

9 reasonably likely to have occurred, with re10 spect to sensitive financial account infor11 mation maintained, serviced, or commu12 nicated by or on behalf of the consumer re13 porter; 

14 ‘‘(ii) of information reasonably identi15 fying— 

16 ‘‘(I) the nature and scope of the 

17 breach, and 

18 ‘‘(II) the sensitive financial ac19 count information involved; and 

20 ‘‘(iii) that such information has been 

21 or is reasonably likely to be misused in a 

22 manner causing substantial harm or incon23 venience against consumers to whom such 

24 information relates to make fraudulent 
9 

•S 2169 IS 

1 transactions on such consumers’ financial 

2 accounts. 

3 ‘‘(B) POTENTIAL DELAYED DETERMINA4 TION FOR INFORMATION SECURITY PRO5 GRAMS.—In determining the likelihood of mis6 use of sensitive financial account information 

7 under subparagraph (A), the consumer reporter 

8 may additionally consider whether any neural 

9 networks or security programs used by, or on 

10 behalf of, the consumer reporter have detected, 

11 or are likely to detect on an ongoing basis over 

12 a reasonable period of time, fraudulent trans13 actions resulting from the breach of data secu14 rity. 

15 ‘‘(f) TIMING, CONTENT, AND MANNER OF NO16 TICES.— 

17 ‘‘(1) ORDER OF NOTICE.—The notices required 

18 under this section shall be made promptly to the en19 tities described in paragraphs (1) and (2) of sub20 section (c), then promptly to any appropriate third 

21 parties, and then without unreasonable delay to any 

22 consumers described in subsection (e)(1)(C) or 

23 (e)(2)(A)(iii), in accordance with such subsections. 

24 ‘‘(2) DELAY OF NOTICE FOR LAW ENFORCE25 MENT PURPOSES.—If a consumer reporter receives a 
10 

•S 2169 IS 

1 written request from an appropriate law enforcement 

2 agency indicating that providing a notice under sub3 section (c)(3) or (e) would impede a criminal or civil 

4 investigation by that law enforcement agency, or an 

5 oral request from an appropriate law enforcement 

6 agency indicating that such a written request will be 

7 provided within 2 business days— 

8 ‘‘(A) the consumer reporter shall delay, or 

9 in the case of a foreign law enforcement agency 

10 may delay, providing such notice until— 

11 ‘‘(i) the law enforcement agency in12 forms the consumer reporter that such no13 tice will no longer impede the investigation; 

14 or 

15 ‘‘(ii) the law enforcement agency fails 

16 to— 

17 ‘‘(I) provide a written request 

18 within 2 business days following an 

19 oral request for a delay; or 

20 ‘‘(II) provide within 10 days a 

21 written request to continue such delay 

22 for a specific time that is approved by 

23 a court of competent jurisdiction; 

24 ‘‘(B) the consumer reporter shall not be 

25 liable for any losses that would not have oc-
11 

•S 2169 IS 

1 curred but for the delay provided for under this 

2 paragraph or but for the communication of any 

3 information provided to any law enforcement 

4 agency pursuant to this section, except that 

5 nothing in this subparagraph shall be construed 

6 as creating any inference with respect to the es7 tablishment or existence of any such liability; 

8 and 

9 ‘‘(C) the consumer reporter may— 

10 ‘‘(i) conduct appropriate security 

11 measures that are not inconsistent with 

12 such request; and 

13 ‘‘(ii) contact any law enforcement 

14 agency to determine whether any such in15 consistency would be created by such 

16 measures. 

17 ‘‘(3) CONTENT OF CONSUMER NOTICE.—Any 

18 notice required to be provided by a consumer re19 porter to a consumer under paragraph (1) or (2) of 

20 subsection (e), and any notice required in accord21 ance with subsection (d)(2)(A), shall be provided in 

22 a standardized envelope or transmission, and shall 

23 include the following in a clear and conspicuous 

24 manner: 
12 

•S 2169 IS 

1 ‘‘(A) An appropriate heading or notice 

2 title. 

3 ‘‘(B) A description of the nature and type 

4 of information that was, or is reasonably be5 lieved to have been, subject to the breach of 

6 data security. 

7 ‘‘(C) The identity and relationship to the 

8 consumer of any entity that suffered the 

9 breach. 

10 ‘‘(D) If known, the date, or a reasonable 

11 approximation of the period of time, on or with12 in which sensitive financial personal information 

13 related to the consumer was, or is reasonably 

14 believed to have been, subject to a breach. 

15 ‘‘(E) A general description of the actions 

16 taken by the consumer reporter to restore the 

17 security and confidentiality of the breached in18 formation. 

19 ‘‘(F) A telephone number by which a con20 sumer to whom the breached information re21 lates may call free of charge to obtain addi22 tional information about how to respond to the 

23 breach. 

24 ‘‘(G) With respect to notices involving sen25 sitive financial identity information, a summary 
13 

•S 2169 IS 

1 of rights of consumer victims of fraud or iden2 tity theft, such as that prepared by the Com3 mission under section 609(d), including any ad4 ditional appropriate information on how the 

5 consumer may— 

6 ‘‘(i) obtain a copy of a consumer re7 port free of charge in accordance with sec8 tion 612; 

9 ‘‘(ii) place a fraud alert in any file re10 lating to the consumer at a consumer re11 porting agency under section 605A to dis12 courage unauthorized use; and 

13 ‘‘(iii) contact the Commission for 

14 more detailed information. 

15 ‘‘(H) With respect to notices involving sen16 sitive financial identity information, appropriate 

17 instructions to the consumer for obtaining file 

18 monitoring mitigation under subsection (g), 

19 which shall include a mailing address for the 

20 consumer to make a request for such mitiga21 tion, and may also include additional contact in22 formation, such as an e-mail or website address 

23 or a telephone number. 

24 ‘‘(I) The approximate date the notice is 

25 being issued. 
14 

•S 2169 IS 

1 ‘‘(4) OTHER TRANSMISSION OF NOTICE.—The 

2 notice described in paragraph (3) may be made by 

3 other means of transmission (such as electronic or 

4 oral) to a consumer only if— 

5 ‘‘(A) the consumer has previously and ex6 pressly agreed to receive notice by such means; 

7 and 

8 ‘‘(B) all of the relevant information in 

9 paragraph (3) is communicated to such con10 sumer in such transmission. 

11 ‘‘(5) DUPLICATIVE NOTICES.— 

12 ‘‘(A) IN GENERAL.—A consumer reporter, 

13 whether acting directly or in coordination with 

14 another entity— 

15 ‘‘(i) shall not be required to provide 

16 more than 1 notice with respect to any 

17 breach of data security to any affected 

18 consumer, so long as such notice meets all 

19 the applicable requirements of this section, 

20 and 

21 ‘‘(ii) shall not be required to provide 

22 a notice with respect to any consumer if a 

23 notice meeting the applicable requirements 

24 of this section has already been provided 

25 by another entity. 
15 

•S 2169 IS 

1 ‘‘(B) UPDATING NOTICES.—If a consumer 

2 notice is provided to consumers pursuant only 

3 to subsection (e)(2) (relating to sensitive finan4 cial account information), and the consumer re5 porter subsequently becomes aware of a reason6 able likelihood that sensitive financial personal 

7 information involved in the breach is being mis8 used in a manner causing substantial harm or 

9 inconvenience against such consumer to commit 

10 identity theft, then an additional notice must be 

11 provided to such consumers as well any other 

12 appropriate parties under this section, including 

13 the summary of rights and file monitoring miti14 gation instructions under subparagraphs (G) 

15 and (H) of subsection (e)(3). 

16 ‘‘(6) RESPONSIBILITY AND COSTS.—Except as 

17 otherwise established by agreement, the entity that 

18 suffered a breach of data security shall be— 

19 ‘‘(A) primarily responsible for providing 

20 any consumer notices required under this sec21 tion with respect to such breach; and 

22 ‘‘(B) responsible for the reasonable actual 

23 costs of any notices provided under this section, 

24 except as otherwise established by agreement. 

25 ‘‘(g) FINANCIAL FRAUD MITIGATION.— 
16 

•S 2169 IS 

1 ‘‘(1) FREE FILE MONITORING.—Any consumer 

2 reporter that is required to provide notice to a con3 sumer under paragraph (1) of subsection (e), or that 

4 is deemed to be in compliance with such requirement 

5 by operation of subsection (h), if requested by the 

6 consumer before the end of the 90-day period begin7 ning on the date of such notice, shall make available 

8 to the consumer, free of charge and for at least a 

9 6-month period, a service that monitors nationwide 

10 credit activity regarding a consumer from a con11 sumer reporting agency described in section 603(p). 

12 ‘‘(2) JOINT RULEMAKING FOR SAFE HARBOR.— 

13 In accordance with subsection (i), the Secretary of 

14 the Treasury, the Board of Governors of the Federal 

15 Reserve System, and the Commission shall jointly 

16 develop standards and guidelines, which shall be 

17 issued by all functional regulatory agencies, that, in 

18 any case in which— 

19 ‘‘(A) free file monitoring is offered under 

20 paragraph (1) to a consumer; 

21 ‘‘(B) subsequent to the offer, another 

22 party misuses sensitive financial identity infor23 mation on the consumer obtained through the 

24 breach of data security (that gave rise to such 
17 

•S 2169 IS 

1 offer) to commit identity theft against the con2 sumer; and 

3 ‘‘(C) at the time of such breach the con4 sumer reporter met the requirements of sub5 section (a), 

6 exempts the consumer reporter from any liability for 

7 any harm to the consumer resulting from such mis8 use, other than any direct pecuniary loss or loss pur9 suant to agreement by the consumer reporter, except 

10 that nothing in this paragraph shall be construed as 

11 creating any inference with respect to the establish12 ment or existence of any such liability. 

13 ‘‘(h) COMPLIANCE WITH GLBA.— 

14 ‘‘(1) IN GENERAL.—For the purposes of this 

15 section, any person subject to section 501(b) of title 

16 V of the Gramm-Leach-Bliley Act shall be deemed to 

17 be in compliance with— 

18 ‘‘(A) subsection (a), if— 

19 ‘‘(i) the person is obliged to imple20 ment appropriate safeguards, with respect 

21 to customer records and information, pur22 suant to regulations, guidelines, or guid23 ance prescribed by or issued by an agency 

24 or authority in accordance with such sub25 section of the Gramm-Leach-Bliley Act; 
18 

•S 2169 IS 

1 ‘‘(ii) the person is substantially in 

2 compliance with such obligation; and 

3 ‘‘(iii) the safeguards are being applied 

4 by the person with respect to sensitive fi5 nancial personal information in the same 

6 manner as with respect to customer 

7 records and information; 

8 ‘‘(B) subsection (b), if— 

9 ‘‘(i) the person is obliged to conduct 

10 investigations of breaches of information 

11 security pursuant to regulations, guide12 lines, or guidance prescribed by or issued 

13 by an agency or authority in accordance 

14 with such subsection of the Gramm-Leach15 Bliley Act; 

16 ‘‘(ii) the person is substantially in 

17 compliance with such obligation; and 

18 ‘‘(iii) the person conducts such inves19 tigations with respect to sensitive financial 

20 personal information in the same manner 

21 as with other information subject to such 

22 regulation, guideline, or guidance; and 

23 ‘‘(C) subsections (c), (d), (e), and (f) 

24 (other than subsection (f)(3)), if— 
19 

•S 2169 IS 

1 ‘‘(i) the person is obliged to imple2 ment a consumer notification program 

3 after breaches of such data safeguards 

4 pursuant to regulations, guidelines, or 

5 guidance prescribed by or issued by an 

6 agency or authority in accordance with sec7 tion 501 of the Gramm-Leach-Bliley Act; 

8 ‘‘(ii) the person is substantially in 

9 compliance with such obligation; and 

10 ‘‘(iii) the person implements such con11 sumer notification program with respect to 

12 sensitive financial personal information in 

13 the same manner as with other informa14 tion subject to such regulations, guidelines, 

15 or guidance. 

16 ‘‘(2) COORDINATION WITH REQUIREMENTS FOR

17 GSES.—For purposes of paragraph (1), if— 

18 ‘‘(A) with respect to any requirement de19 scribed in subparagraph (A)(i), (B)(i), or (C)(i) 

20 of paragraph (1) relating to sensitive financial 

21 personal information— 

22 ‘‘(i) an enterprise (as defined in title 

23 XIII of the Housing and Community De24 velopment Act of 1992) is required to com25 ply with orders, guidance, or regulations 
20 

•S 2169 IS 

1 issued by the functional regulatory agency 

2 set forth in subsection (j)(1)(F); and 

3 ‘‘(ii) such orders, guidance, or regula4 tions of such functional regulatory agency 

5 are substantially consistent with regula6 tions, guidelines, or guidance prescribed by 

7 or issued by an agency or authority in ac8 cordance with section 501(b) of the 

9 Gramm-Leach-Bliley Act (without regard 

10 to whether such enterprise or functional 

11 regulatory agency is subject to such section 

12 501(b)) that relate to any requirement de13 scribed in subparagraph (A)(i), (B)(i), or 

14 (C)(i) of paragraph (1); 

15 ‘‘(B) the enterprise is substantially in com16 pliance with such requirement relating to sen17 sitive financial personal information; and 

18 ‘‘(C) the enterprise implements any such 

19 requirement with respect to sensitive financial 

20 personal information in the same manner as 

21 with other information subject to the regula22 tions, guidelines, or guidance prescribed or 

23 issued by the functional regulatory agency set 

24 forth in subsection (j)(1)(F), 
21 

•S 2169 IS 

1 the enterprise shall be treated as a person subject to 

2 section 501(b) of the Gramm-Leach-Bliley Act. 

3 ‘‘(3) HARMONIZATION OF GLBA.— 

4 ‘‘(A) IN GENERAL.—To the extent that 

5 compliance by any consumer reporter with the 

6 requirements of title V of the Gramm-Leach7 Bliley Act shall be deemed, pursuant to this 

8 subsection, to be compliance with this section, 

9 and the requirements of such title, and any reg10 ulations, guidelines, or orders issued or pre11 scribed under such title, differ in any way from 

12 this section, it is the sense of the Congress that 

13 the applicable regulators shall make every ap14 propriate effort as any relevant regulations are 

15 prescribed, reviewed, or updated to reconcile 

16 such differences to harmonize the corresponding 

17 requirements. 

18 ‘‘(B) AGENCIES THAT HAVE NOT FULLY

19 IMPLEMENTED TITLE V OF THE GLBA.—Any 

20 agency described in subsection (j) that has not 

21 issued or prescribed regulations, guidelines, or 

22 orders that are required or permitted under 

23 title V of the Gramm-Leach-Bliley Act and that 

24 set forth the requirements for compliance with 

25 such title, including with respect to providing 
22 

•S 2169 IS 

1 notice of a breach of data security, shall pre2 scribe such regulations, guidelines, or orders, as 

3 appropriate, before the end of the 12-month pe4 riod beginning on the date of the enactment of 

5 the Financial Data Protection Act of 2005, in 

6 a manner that— 

7 ‘‘(i) is consistent with this section; 

8 and 

9 ‘‘(ii) allows, to the extent practical, 

10 consistent standards across holding compa11 nies with respect to compliance with this 

12 section and section 501(b) of the Gramm13 Leach-Bliley Act that is deemed compli14 ance under this subsection. 

15 ‘‘(C) AGENCIES THAT HAVE IMPLEMENTED

16 TITLE V OF THE GLBA.—Any agency described 

17 in subsection (j) that has issued or prescribed 

18 regulations, guidelines, or orders that are re19 quired or permitted under title V of the 

20 Gramm-Leach-Bliley Act and that set forth the 

21 requirements for compliance with such title 

22 shall modify such regulations, guidelines, or or23 ders, as appropriate, before the end of the 12- 

24 month period beginning on the date of the en-
23 

•S 2169 IS 

1 actment of the Financial Data Protection Act 

2 of 2005, in a manner that— 

3 ‘‘(i) is consistent with this section; 

4 and 

5 ‘‘(ii) allows, to the extent practical, 

6 consistent standards across holding compa7 nies with respect to compliance with this 

8 section and section 501(b) of the Gramm9 Leach-Bliley Act that is deemed compli10 ance under this subsection. 

11 ‘‘(D) COORDINATION UNDER THIS SEC12 TION.—To the extent practical, any regulations, 

13 guidelines, standards, or orders issued or pre14 scribed under this section shall be issued or 

15 prescribed in a manner that— 

16 ‘‘(i) is consistent with this section; 

17 and 

18 ‘‘(ii) allows, to the extent practical, 

19 consistent standards across holding compa20 nies with respect to compliance with this 

21 section and section 501(b) of the Gramm22 Leach-Bliley Act that is deemed compli23 ance under this subsection. 

24 ‘‘(i) UNIFORM SECURITY REGULATIONS.— 
24 

•S 2169 IS 

1 ‘‘(1) UNIFORM STANDARDS.—The Secretary of 

2 the Treasury, the Board of Governors of the Federal 

3 Reserve System, and the Commission shall jointly 

4 develop appropriate standards and guidelines to im5 plement this section (other than subsection (h), in6 cluding— 

7 ‘‘(A) prescribing regulations requiring each 

8 consumer reporter to establish reasonable poli9 cies and procedures implementing such stand10 ards and guidelines, consistent, as appropriate, 

11 with subsection (h) and section 501(b) of title 

12 V of the Gramm-Leach-Bliley Act, and any reg13 ulations, guidelines, or orders issued or pre14 scribed under such section; 

15 ‘‘(B) prescribing specific regulations with 

16 respect to subsection (f)(3) setting forth a rea17 sonably unique and, pursuant to paragraph 

18 (2)(B), exclusive color and titling of the notice, 

19 and standardized formatting of the notice con20 tents described under such subsection to stand21 ardize such communications and make them 

22 more likely to be reviewed and understood by 

23 consumers; 
25 

•S 2169 IS 

1 ‘‘(C) providing in such standards and 

2 guidelines that the responsibility of a consumer 

3 reporter to provide notice under this section— 

4 ‘‘(i) has been satisfied with respect to 

5 any particular consumer, even if the con6 sumer reporter is unable to contact the 

7 consumer, so long as the consumer re8 porter has made reasonable efforts to ob9 tain a current address or other current 

10 contact information with respect to such 

11 consumer; 

12 ‘‘(ii) may be made by public notice in 

13 appropriate cases where such reasonable 

14 efforts have failed; and 

15 ‘‘(iii) with respect to paragraph (3) of 

16 subsection (c), may be communicated to 

17 entities in addition to those specifically re18 quired under such paragraph through any 

19 reasonable means, such as through an elec20 tronic transmission normally received by 

21 all of the consumer reporter’s business cus22 tomers; and 

23 ‘‘(D) providing in such standards and 

24 guidelines elaboration on how to determine 

25 whether a technology is generally commercially 
26 

•S 2169 IS 

1 available for the purposes of subsection (b), fo2 cusing on the availability of such technology to 

3 persons who potentially could seek to breach the 

4 data security of the consumer reporter. 

5 ‘‘(2) ENFORCEMENT.— 

6 ‘‘(A) REGULATIONS.—Each of the func7 tional regulatory agencies shall prescribe such 

8 regulations as may be necessary, consistent 

9 with the standards in paragraph (1), to ensure 

10 compliance with this section with respect to the 

11 persons subject to the jurisdiction of such agen12 cy under subsection (i). 

13 ‘‘(B) MISUSE OF UNIQUE COLOR AND TI14 TLES OF NOTICES.—Any person who uses the 

15 unique color and titling adopted under para16 graph (1)(B) for notices under subsection (f)(3) 

17 in a way that is likely to create a false belief 

18 in a consumer that a communication is such a 

19 notice shall be liable in the same manner and 

20 to the same extent as a debt collector is liable 

21 under section 813 for any failure to comply 

22 with any provision of the Fair Debt Collection 

23 Practices Act. 

24 ‘‘(3) PROCEDURES AND DEADLINE.— 
27 

•S 2169 IS 

1 ‘‘(A) PROCEDURES.—Standards and guide2 lines issued under this subsection shall be 

3 issued in accordance with applicable require4 ments of title 5, United States Code. 

5 ‘‘(B) DEADLINE FOR INITIAL STANDARDS

6 AND GUIDELINES.—The standards and guide7 lines required to be issued under paragraph (1) 

8 shall be published in final form before the end 

9 of the 12-month period beginning on the date 

10 of the enactment of the Financial Data Protec11 tion Act of 2005. 

12 ‘‘(C) DEADLINE FOR ENFORCEMENT REG13 ULATIONS.—The standards and guidelines re14 quired to be issued under paragraph (2) shall 

15 be published in final form before the end of the 

16 6-month period beginning on the date standards 

17 and guidelines described in subparagraph (B) 

18 are published in final form. 

19 ‘‘(D) AUTHORITY TO GRANT EXCEP20 TIONS.—The regulations prescribed under para21 graph (2) may include such additional excep22 tions to this section as are deemed by the func23 tional regulatory agencies to be consistent with 

24 the purposes of this section. 
28 

•S 2169 IS 

1 ‘‘(E) CONSULTATION AND COORDINA2 TION.—The Secretary of the Treasury, the 

3 Board of Governors of the Federal Reserve Sys4 tem, and the Commission shall consult and co5 ordinate with the other functional regulatory 

6 agencies to the extent appropriate in pre7 scribing regulations under this subsection. 

8 ‘‘(F) FAILURE TO MEET DEADLINE.—Any 

9 agency or authority required to publish stand10 ards and guidelines or regulations under this 

11 subsection that fails to meet the deadline for 

12 such publishing shall submit a report to the 

13 Congress within 30 days of such deadline de14 scribing— 

15 ‘‘(i) the reasons for the failure to 

16 meet such deadline; 

17 ‘‘(ii) when the agency or authority ex18 pects to complete the publication required; 

19 and 

20 ‘‘(iii) the detriment such failure to 

21 publish by the required deadline will have 

22 on consumers and other affected parties. 

23 ‘‘(G) UNIFORM IMPLEMENTATION AND IN24 TERPRETATION.—It is the intention of the Con25 gress that the agencies and authorities de-
29 

•S 2169 IS 

1 scribed in subsection (j)(1)(G) will implement 

2 and interpret their enforcement regulations, in3 cluding any exceptions provided under subpara4 graph (D), in a uniform manner. 

5 ‘‘(4) APPROPRIATE EXEMPTIONS OR MODIFICA6 TIONS.—The Secretary of the Treasury, the Board 

7 of Governors of the Federal Reserve System, and the 

8 Commission, in consultation with the Administrator 

9 of the Small Business Administration and other 

10 functional regulatory agencies, shall provide appro11 priate exemptions or modifications from require12 ments of this section relating to sensitive financial 

13 personal information for consumer reporters that do 

14 not maintain, service, or communicate a large quan15 tity of sensitive financial account information or sen16 sitive financial identity information. 

17 ‘‘(j) ADMINISTRATIVE ENFORCEMENT.— 

18 ‘‘(1) IN GENERAL.—Notwithstanding section 

19 616, 617, or 621, compliance with this section and 

20 the regulations prescribed under this section shall be 

21 enforced exclusively by the functional regulatory 

22 agencies with respect to financial institutions and 

23 other persons subject to the jurisdiction of each such 

24 agency under applicable law, as follows: 
30 

•S 2169 IS 

1 ‘‘(A) Under section 8 of the Federal De2 posit Insurance Act, in the case of— 

3 ‘‘(i) national banks, Federal branches 

4 and Federal agencies of foreign banks, and 

5 any subsidiaries of such entities (except 

6 brokers, dealers, persons providing insur7 ance, investment companies, and invest8 ment advisers), by the Comptroller of the 

9 Currency; 

10 ‘‘(ii) member banks of the Federal 

11 Reserve System (other than national 

12 banks), branches and agencies of foreign 

13 banks (other than Federal branches, Fed14 eral agencies, and insured State branches 

15 of foreign banks), commercial lending com16 panies owned or controlled by foreign 

17 banks, organizations operating under sec18 tion 25 or 25A of the Federal Reserve Act, 

19 and bank holding companies and their 

20 nonbank subsidiaries or affiliates (except 

21 brokers, dealers, persons providing insur22 ance, investment companies, and invest23 ment advisers), by the Board of Governors 

24 of the Federal Reserve System; 
31 

•S 2169 IS 

1 ‘‘(iii) banks insured by the Federal 

2 Deposit Insurance Corporation (other than 

3 members of the Federal Reserve System), 

4 insured State branches of foreign banks, 

5 and any subsidiaries of such entities (ex6 cept brokers, dealers, persons providing in7 surance, investment companies, and invest8 ment advisers), by the Board of Directors 

9 of the Federal Deposit Insurance Corpora10 tion; and 

11 ‘‘(iv) savings associations the deposits 

12 of which are insured by the Federal De13 posit Insurance Corporation, and any sub14 sidiaries of such savings associations (ex15 cept brokers, dealers, persons providing in16 surance, investment companies, and invest17 ment advisers), by the Director of the Of18 fice of Thrift Supervision. 

19 ‘‘(B) Under the Federal Credit Union Act, 

20 by the Board of the National Credit Union Ad21 ministration with respect to any federally in22 sured credit union, and any subsidiaries of such 

23 an entity. 

24 ‘‘(C) Under the Securities Exchange Act of 

25 1934, by the Securities and Exchange Commis-
32 

•S 2169 IS 

1 sion with respect to any broker, dealer, or 

2 nonbank transfer agent. 

3 ‘‘(D) Under the Investment Company Act 

4 of 1940, by the Securities and Exchange Com5 mission with respect to investment companies. 

6 ‘‘(E) Under the Investment Advisers Act 

7 of 1940, by the Securities and Exchange Com8 mission with respect to investment advisers reg9 istered with the Commission under such Act. 

10 ‘‘(F) Under the provisions of title XIII of 

11 the Housing and Community Development Act 

12 of 1992, by the Director of Federal Housing 

13 Enterprise Oversight (and any successor to 

14 such functional regulatory agency) with respect 

15 to the Federal National Mortgage Association, 

16 the Federal Home Loan Mortgage Corporation, 

17 and any other entity or enterprise (as defined 

18 in such title XIII) subject to the jurisdiction of 

19 such functional regulatory agency under such 

20 title, including any affiliate of any such enter21 prise. 

22 ‘‘(G) Under State insurance law, in the 

23 case of any person engaged in the business of 

24 insurance, by the applicable State insurance au-
33 

•S 2169 IS 

1 thority of the State in which the person is dom2 iciled. 

3 ‘‘(H) Under the Federal Trade Commis4 sion Act, by the Commission for any other per5 son that is not subject to the jurisdiction of any 

6 agency or authority under paragraphs (1) 

7 through (7) of this subsection. 

8 ‘‘(2) EXERCISE OF CERTAIN POWERS.—For the 

9 purpose of the exercise by any agency referred to in 

10 paragraph (1) of its powers under any Act referred 

11 to in that subsection, a violation of any requirement 

12 imposed under this subchapter shall be deemed to be 

13 a violation of a requirement imposed under that Act. 

14 In addition to its powers under any provision of law 

15 specifically referred to in paragraph (1), each of the 

16 agencies referred to in that paragraph may exercise, 

17 for the purpose of enforcing compliance with any re18 quirement imposed under this section, any other au19 thority conferred on it by law. 

20 ‘‘(k) DEFINITIONS.—For purposes of this section, the 

21 following definitions shall apply: 

22 ‘‘(1) BREACH OF DATA SECURITY.—The term 

23 ‘breach of data security’ means, with respect to sen24 sitive financial personal information that is main-
34 

•S 2169 IS 

1 tained, serviced, or communicated by or on behalf of 

2 any consumer reporter— 

3 ‘‘(A) an unauthorized acquisition of such 

4 information that could be used to commit finan5 cial fraud (such as identity theft or fraudulent 

6 transactions made on financial accounts); or 

7 ‘‘(B) an unusual pattern of use of such in8 formation indicative of financial fraud. 

9 ‘‘(2) CONSUMER.—The term ‘consumer’ means 

10 an individual. 

11 ‘‘(3) CONSUMER REPORTER AND RELATED

12 TERMS.— 

13 ‘‘(A) CONSUMER REPORT.—The term ‘con14 sumer report’ includes any written, oral, or 

15 other communication of any information by a 

16 consumer reporter bearing on a consumer’s 

17 credit worthiness, credit standing, credit capac18 ity, character, general reputation, personal 

19 characteristics, personal identifiers, financial 

20 account information, or mode of living. 

21 ‘‘(B) CONSUMER REPORTER.—The term 

22 ‘consumer reporter’ means any consumer re23 porting agency or financial institution, or any 

24 person which, for monetary fees, dues, on a co25 operative nonprofit basis, or otherwise regularly 
35 

•S 2169 IS 

1 engages in whole or in part in the practice of 

2 assembling or evaluating consumer reports, con3 sumer credit information, or other information 

4 on consumers, for the purpose of furnishing 

5 consumer reports to third parties or to provide 

6 or collect payment for or market products and 

7 services, or for employment purposes, and 

8 which uses any means or facility of interstate 

9 commerce for such purposes. 

10 ‘‘(4) FINANCIAL INSTITUTION.—The term ‘fi11 nancial institution’ means— 

12 ‘‘(A) any person the business of which is 

13 engaging in activities that are financial in na14 ture as described in or determined under sec15 tion 4(k) of the Bank Holding Company Act; 

16 ‘‘(B) any entity that is primarily engaged 

17 in activities that are subject to the Fair Credit 

18 Reporting Act; and 

19 ‘‘(C) any person that is maintaining, re20 ceiving, or communicating sensitive financial 

21 personal information on an ongoing basis for 

22 the purposes of engaging in interstate com23 merce. 

24 ‘‘(5) FUNCTIONAL REGULATORY AGENCY.—The 

25 term ‘functional regulatory agency’ means any agen-
36 

•S 2169 IS 

1 cy described in subsection (j) with respect to the fi2 nancial institutions and other persons subject to the 

3 jurisdiction of such agency. 

4 ‘‘(6) NATIONWIDE CONSUMER REPORTING

5 AGENCY.—The term ‘nationwide consumer reporting 

6 agency’ means— 

7 ‘‘(A) a consumer reporting agency de8 scribed in section 603(p); 

9 ‘‘(B) any person who notifies the Commis10 sion that the person reasonably expects to be11 come a consumer reporting agency described in 

12 section 603(p) within a reasonable time; and 

13 ‘‘(C) a consumer reporting agency de14 scribed in section 603(w) that notifies the Com15 mission that the person wishes to receive breach 

16 of data security notices under this section that 

17 involve information of the type maintained by 

18 such agency. 

19 ‘‘(7) NEURAL NETWORK.—The term ‘neural 

20 network’ means an information security program 

21 that monitors financial account transactions for po22 tential fraud, using historical patterns to analyze 

23 and identify suspicious financial account trans24 actions. 
37 

•S 2169 IS 

1 ‘‘(8) SENSITIVE FINANCIAL ACCOUNT INFORMA2 TION.—The term ‘sensitive financial account infor3 mation’ means a financial account number of a con4 sumer, such as a credit card number or debit card 

5 number, in combination with any security code, ac6 cess code, biometric code, password, or other per7 sonal identification information that would allow ac8 cess to the financial account. 

9 ‘‘(9) SENSITIVE FINANCIAL IDENTITY INFORMA10 TION.—The term ‘sensitive financial identity infor11 mation’ means the first and last name, the address, 

12 or the telephone number of a consumer, in combina13 tion with any of the following of the consumer: 

14 ‘‘(A) Social Security number. 

15 ‘‘(B) Driver’s license number or equivalent 

16 State identification number. 

17 ‘‘(C) Taxpayer identification number. 

18 ‘‘(10) SENSITIVE FINANCIAL PERSONAL INFOR19 MATION.—The term ‘sensitive financial personal in20 formation’ means any information that is sensitive 

21 financial account information, sensitive financial 

22 identity information, or both. 

23 ‘‘(11) SUBSTANTIAL HARM OR INCONVEN24 IENCE.—The term ‘substantial harm or inconven25 ience’ with respect to a consumer means material fi-
38 

•S 2169 IS 

1 nancial loss to or civil or criminal penalties imposed 

2 on the consumer or the need for the consumer to ex3 pend significant time and effort to correct erroneous 

4 information relating to the consumer, including in5 formation maintained by consumer reporting agen6 cies, financial institutions, or government entities, in 

7 order to avoid material financial loss or increased 

8 costs or civil or criminal penalties, due to unauthor9 ized use of sensitive financial personal information 

10 relating to such consumer, but does not include 

11 other harm or inconvenience that is not substantial, 

12 including changing a financial account number or 

13 closing a financial account. 

14 ‘‘(l) RELATION TO STATE LAWS.—No requirement or 

15 prohibition may be imposed under the laws of any State 

16 with respect to the responsibilities of any person— 

17 ‘‘(1) to protect the security or confidentiality of 

18 information on consumers maintained by or on be19 half of the person; 

20 ‘‘(2) to safeguard such information from poten21 tial misuse; 

22 ‘‘(3) to investigate or provide notices of any un23 authorized access to information concerning the con24 sumer, or the potential misuse of such information, 

25 for fraudulent purposes; or 
39 

•S 2169 IS 

1 ‘‘(4) to mitigate any loss or harm resulting 

2 from such unauthorized access or misuse.’’. 

3 (b) CLERICAL AMENDMENT.—The table of sections 

4 for the Fair Credit Reporting Act is amended by inserting 

5 after the item relating to section 629 the following new 

6 item: 

‘‘630. Data security safeguards.’’. 

7 (c) EFFECTIVE DATE.—The provisions of section 630 

8 of the Fair Credit Reporting Act (as added by this sec9 tion), other than subsection (h) of such section, shall take 

10 effect on the date of publication of the regulations re11 quired under paragraph (3) of such subsection, with re12 spect to any person under the jurisdiction of each regu13 latory agency publishing such regulations. 

Æ