II 

115TH CONGRESS 

1ST SESSION S. 2188 

To amend the Fair Credit Reporting Act to provide protections for consumers 

after a data breach at a consumer reporting agency, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

DECEMBER 4, 2017 

Mr. MENENDEZ introduced the following bill; which was read twice and 

referred to the Committee on Banking, Housing, and Urban Affairs 

A BILL 

To amend the Fair Credit Reporting Act to provide protections for consumers after a data breach at a consumer 

reporting agency, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Consumer Data Pro5 tection Act’’. 

6 SEC. 2. DATA SECURITY. 

7 (a) IN GENERAL.—The Fair Credit Reporting Act 

8 (15 U.S.C. 1681 et seq.) is amended by inserting after 

9 section 605B (15 U.S.C. 1681c–2) the following: 


lotter on DSKBCFDHB2PROD with BILLS
2 

•S 2188 IS

1 ‘‘SEC. 605C. DATA SECURITY AT CONSUMER REPORTING 

2 AGENCIES. 

3 ‘‘(a) DEFINITIONS.—In this section— 

4 ‘‘(1) the term ‘affected individual’ means an in5 dividual, the sensitive personal information of whom 

6 is lost, stolen, or accessed without authorization be7 cause of a data breach; 

8 ‘‘(2) the term ‘appropriate committees of Con9 gress’ means— 

10 ‘‘(A) the Committee on the Judiciary of 

11 the Senate; 

12 ‘‘(B) the Committee on Banking, Housing, 

13 and Urban Affairs of the Senate; 

14 ‘‘(C) the Committee on the Judiciary of 

15 the House of Representatives; and 

16 ‘‘(D) the Committee on Financial Services 

17 of the House of Representatives; 

18 ‘‘(3) the term ‘covered action’ means an action 

19 that restricts the legal rights available to a con20 sumer, including— 

21 ‘‘(A) requiring the consumer to— 

22 ‘‘(i) waive the right of the consumer 

23 to— 

24 ‘‘(I) file a civil action in an ap25 propriate court; or 


lotter on DSKBCFDHB2PROD with BILLS
3 

•S 2188 IS

1 ‘‘(II) bring, or participate in, a 

2 class action; or 

3 ‘‘(ii) engage in settlement negotiations 

4 before bringing an action under subsection 

5 (c)(3); and 

6 ‘‘(B) offering a financial inducement in ex7 change for the consumer waiving any right of 

8 the consumer; 

9 ‘‘(4) the term ‘credit freeze’— 

10 ‘‘(A) except as provided in subparagraph 

11 (B), means a restriction placed on the consumer 

12 report of a consumer at the request of the con13 sumer, or a personal representative of the con14 sumer, that prohibits a consumer reporting 

15 agency from releasing the consumer report for 

16 any purpose; and 

17 ‘‘(B) with respect to the consumer report 

18 of a consumer, shall not apply to the use of the 

19 consumer report by— 

20 ‘‘(i) a person, or a subsidiary, affil21 iate, agent, subcontractor, or assignee of 

22 the person, with which the consumer has, 

23 or before assignment had, an account, con24 tract, or debtor-creditor relationship for 

25 the purposes of— 


lotter on DSKBCFDHB2PROD with BILLS
4 

•S 2188 IS

1 ‘‘(I) reviewing the active account; 

2 or 

3 ‘‘(II) collecting the financial obli4 gation owed on the account, contract, 

5 or debt; 

6 ‘‘(ii) any person acting under a court 

7 order, warrant, or subpoena; 

8 ‘‘(iii) a Federal, State, or local gov9 ernment or an agent or assignee of a Fed10 eral, State, or local government; 

11 ‘‘(iv) any person for the sole purpose 

12 of providing a credit monitoring or identity 

13 theft protection service to which the con14 sumer has subscribed; 

15 ‘‘(v) any person for the purpose of 

16 providing a consumer with a copy of the 

17 consumer report, credit score, or edu18 cational credit score of the consumer upon 

19 request by the consumer; 

20 ‘‘(vi) any person or entity for insur21 ance purposes, including use in setting or 

22 adjusting a rate, adjusting a claim, or un23 derwriting; and 

24 ‘‘(vii) any person acting under an au25 thorization from a consumer to use the 


lotter on DSKBCFDHB2PROD with BILLS
5 

•S 2188 IS

1 consumer report of the consumer for em2 ployment purposes; 

3 ‘‘(5) the term ‘data breach’ means the loss, 

4 theft, or other unauthorized access, other than ac5 cess that is incidental to the scope of employment, 

6 of data containing sensitive personal information, in 

7 electronic or printed form, that results in the poten8 tial compromise of the confidentiality or integrity of 

9 the data; and 

10 ‘‘(6) the term ‘sensitive personal information’ 

11 means, with respect to an individual, information— 

12 ‘‘(A) about the individual relating to the 

13 education, financial transactions, medical his14 tory, criminal history, or employment history of 

15 the individual; and 

16 ‘‘(B) that can be used to distinguish or 

17 trace the identity of the individual, including 

18 the name, social security number, date and 

19 place of birth, mother’s maiden name, and bio20 metric records of the individual. 

21 ‘‘(b) DATA BREACHES AT CONSUMER REPORTING

22 AGENCIES.—With respect to a data breach at a consumer 

23 reporting agency, the consumer reporting agency— 

24 ‘‘(1) shall notify— 


lotter on DSKBCFDHB2PROD with BILLS
6 

•S 2188 IS

1 ‘‘(A) not later than 2 days after the date 

2 on which the consumer reporting agency dis3 covers the data breach— 

4 ‘‘(i) the Federal Trade Commission; 

5 ‘‘(ii) the Bureau; and 

6 ‘‘(iii) appropriate law enforcement and 

7 intelligence agencies, as identified by the 

8 Secretary of Homeland Security; and 

9 ‘‘(B) subject to paragraph (2), not later 

10 than 3 days after the date on which the con11 sumer reporting agency discovers the data 

12 breach, and as quickly and efficiently as is 

13 practicable, each affected individual with re14 spect to the data breach; 

15 ‘‘(2) may receive an extension of the deadline 

16 described in paragraph (1)(B) if the Federal Trade 

17 Commission and the intelligence agencies identified 

18 under paragraph (1)(A)(iii) determine that there is 

19 a national security concern that requires granting 

20 such an extension; 

21 ‘‘(3) shall, upon request by any affected indi22 vidual with respect to the data breach, provide, with23 out charge to the affected individual and during the 

24 lifetime of the affected individual— 


lotter on DSKBCFDHB2PROD with BILLS
7 

•S 2188 IS

1 ‘‘(A) a credit freeze, including the cost re2 lating to imposing, lifting, or permanently re3 moving a credit freeze, with respect to the con4 sumer report of the affected individual at any 

5 consumer reporting agency described in section 

6 603(p); and 

7 ‘‘(B) credit monitoring services for the af8 fected individual at any consumer reporting 

9 agency described in section 603(p); and 

10 ‘‘(4) shall, in consultation with the Bureau, es11 tablish a consumer assistance unit— 

12 ‘‘(A) that shall— 

13 ‘‘(i) be carried out, and paid for, by 

14 the consumer reporting agency; and 

15 ‘‘(ii) provide assistance, free of charge 

16 and for a period of 10 years beginning on 

17 the date on which the consumer reporting 

18 agency submits the notifications required 

19 under paragraph (1)(A), to any affected 

20 individual who wants to dispute an item in 

21 the file of the affected individual that was 

22 entered into that file after the date on 

23 which the data breach occurred; and 

24 ‘‘(B) with respect to which the consumer 

25 reporting agency shall, as soon as practicable 


lotter on DSKBCFDHB2PROD with BILLS
8 

•S 2188 IS

1 after the date on which the consumer assistance 

2 unit is established, notify each affected indi3 vidual with respect to the data breach by mail 

4 and e-mail. 

5 ‘‘(c) ENFORCEMENT.— 

6 ‘‘(1) IN GENERAL.—Subject to subtitle B of the 

7 Consumer Financial Protection Act of 2010 (12 

8 U.S.C. 5511 et seq.), the Federal Trade Commission 

9 or the Bureau may bring a civil action to recover a 

10 civil penalty in an appropriate district court of the 

11 United States against any person that negligently, 

12 knowingly, or willingly causes a data breach at a 

13 consumer reporting agency. 

14 ‘‘(2) PENALTY AMOUNT.— 

15 ‘‘(A) IN GENERAL.—In a successful action 

16 brought under paragraph (1), the person 

17 against which the action is brought shall be lia18 ble for a civil penalty of not more than— 

19 ‘‘(i) $2,500 for each affected indi20 vidual with respect to the data breach 

21 caused by the person; and 

22 ‘‘(ii) $25,000,000 in total. 

23 ‘‘(B) CONSIDERATIONS.—In determining 

24 the amount of a civil penalty in a successful ac25 tion brought under paragraph (1), the court 


lotter on DSKBCFDHB2PROD with BILLS
9 

•S 2188 IS

1 shall consider, with respect to the person 

2 against which the action is brought— 

3 ‘‘(i) the degree of culpability of the 

4 person; 

5 ‘‘(ii) any history of similar prior con6 duct by the person; 

7 ‘‘(iii) the ability of the person to pay; 

8 ‘‘(iv) the effect of the penalty on the 

9 ability of the person to continue to do busi10 ness; and 

11 ‘‘(v) any other factor as justice may 

12 require. 

13 ‘‘(3) PRIVATE CAUSE OF ACTION.— 

14 ‘‘(A) DEFINITION.—In this paragraph, the 

15 term ‘actual loss’ means the total cost to an af16 fected individual as a result of a data breach at 

17 a consumer reporting agency, including— 

18 ‘‘(i) the costs incurred by the affected 

19 individual— 

20 ‘‘(I) in responding to the data 

21 breach; and 

22 ‘‘(II) as a result of— 

23 ‘‘(aa) reviewing accounts of 

24 the affected individual for fraud25 ulent charges; 


lotter on DSKBCFDHB2PROD with BILLS
10 

•S 2188 IS

1 ‘‘(bb) closing accounts of the 

2 affected individual that may have 

3 been compromised by the data 

4 breach; and 

5 ‘‘(cc) imposing credit freezes 

6 and obtaining credit monitoring 

7 services; and 

8 ‘‘(ii) any revenue lost, or cost or con9 sequential damage incurred, by the af10 fected individual relating to the interrup11 tion of the ability of the affected individual 

12 to obtain credit. 

13 ‘‘(B) CAUSE OF ACTION.— 

14 ‘‘(i) IN GENERAL.—An affected indi15 vidual may bring an action in an appro16 priate district court of the United States 

17 against any person that negligently, know18 ingly, or willingly caused a data breach at 

19 a consumer reporting agency in which the 

20 sensitive personal information of the af21 fected individual was lost, stolen, or 

22 accessed without authorization. 

23 ‘‘(ii) DAMAGES.—In a successful ac24 tion brought by an affected individual 


lotter on DSKBCFDHB2PROD with BILLS
11 

•S 2188 IS

1 under clause (i), the affected individual 

2 may recover— 

3 ‘‘(I) the greater of— 

4 ‘‘(aa) the actual loss to the 

5 affected individual with respect 

6 to the data breach described in 

7 that clause; or 

8 ‘‘(bb) $1,000 in liquidated 

9 damages; 

10 ‘‘(II) punitive damages, as the 

11 court may allow; and 

12 ‘‘(III) the costs of the action, to13 gether with reasonable attorney’s fees, 

14 as determined by the court. 

15 ‘‘(d) REVIEW OF COMPLIANCE WITH STANDARDS

16 FOR SAFEGUARDING CUSTOMER INFORMATION.— 

17 ‘‘(1) DEFINITION.—In this subsection, the term 

18 ‘covered person’ has the meaning given the term in 

19 section 1002 of the Consumer Financial Protection 

20 Act of 2010 (12 U.S.C. 5481). 

21 ‘‘(2) EXAMINATION.—The Bureau may examine 

22 any consumer reporting agency that is a covered 

23 person subject to supervision under section 1024 of 

24 the Consumer Financial Protection Act of 2010 (12 

25 U.S.C. 5514) for compliance by that agency with the 


lotter on DSKBCFDHB2PROD with BILLS
12 

•S 2188 IS

1 standards established by the Federal Trade Commis2 sion under section 501(b) of the Gramm-Leach-Bli3 ley Act (15 U.S.C. 6801(b)). 

4 ‘‘(e) PROTECTION OF LEGAL RIGHTS OF CON5 SUMERS.—A consumer reporting agency may not take a 

6 covered action— 

7 ‘‘(1) as a condition of providing any service or 

8 product to, or on behalf of, a consumer; and 

9 ‘‘(2) that relates to the rights of a consumer 

10 after a data breach at the consumer reporting agen11 cy in which the sensitive personal information of the 

12 consumer is lost, stolen, or accessed without author13 ization. 

14 ‘‘(f) ANNUAL STUDY AND REPORT.— 

15 ‘‘(1) IN GENERAL.—Beginning in the first full 

16 year after the date of enactment of this section, and 

17 annually thereafter, the Bureau and the Federal 

18 Trade Commission, in consultation with the Attor19 ney General, shall conduct a study regarding the 

20 costs to affected individuals from data breaches at 

21 consumer reporting agencies, including— 

22 ‘‘(A) the economic costs to those affected 

23 individuals; 

24 ‘‘(B) the effects on— 


lotter on DSKBCFDHB2PROD with BILLS
13 

•S 2188 IS

1 ‘‘(i) the ability of those affected indi2 viduals to obtain credit and housing; and 

3 ‘‘(ii) the reputations of those affected 

4 individuals; and 

5 ‘‘(C) the costs relating to the emotional 

6 and psychological stress of those affected indi7 viduals from having the sensitive personal infor8 mation of those affected individuals lost, stolen, 

9 or accessed without authorization. 

10 ‘‘(2) SUBMISSION TO CONGRESS.—Not later 

11 than 30 days after the date on which each study 

12 conducted under paragraph (1) is completed, the 

13 Bureau and the Federal Trade Commission shall 

14 submit to the appropriate committees of Congress a 

15 report that contains the results of the study. 

16 ‘‘(3) CONTENTS.—Each study conducted under 

17 paragraph (1) and each report submitted under 

18 paragraph (2) shall contain a survey of affected indi19 viduals who were contacted for the purposes of con20 ducting the study. 

21 ‘‘(4) AUTHORITY.—In conducting any study 

22 under paragraph (1), the Bureau, the Federal Trade 

23 Commission, and the Attorney General may compel 

24 a consumer reporting agency to disclose nonpropri25 etary information. 


lotter on DSKBCFDHB2PROD with BILLS
14 

•S 2188 IS

1 ‘‘(g) RULE OF CONSTRUCTION.—Nothing in this sec2 tion may be construed as modifying, limiting, or super3 seding any provision of State law if the protection that 

4 the provision of State law provides to consumers is greater 

5 than the protection provided to consumers under this sec6 tion.’’. 

7 (b) TECHNICAL AND CONFORMING AMENDMENT.— 

8 The table of contents for the Fair Credit Reporting Act 

9 (15 U.S.C. 1681 et seq.) is amended by inserting after 

10 the item relating to section 605B the following: 

‘‘605C. Data security at consumer reporting agencies.’’. 

Æ 


lotter on DSKBCFDHB2PROD with BILLS