II 

115TH CONGRESS 

2D SESSION S. 2498 

To reduce identity fraud. 

IN THE SENATE OF THE UNITED STATES 

MARCH 5, 2018 

Mr. SCOTT (for himself, Mrs. MCCASKILL, Mr. CASSIDY, and Mr. PETERS) 

introduced the following bill; which was read twice and referred to the 

Committee on Finance 

A BILL 

To reduce identity fraud. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Protecting Children 

5 From Identity Theft Act’’. 

6 SEC. 2. REDUCING IDENTITY FRAUD. 

7 (a) PURPOSE.—The purpose of this section is to re8 duce the prevalence of synthetic identity fraud, which 

9 disproportionally affects vulnerable populations, such as 

10 minors and recent immigrants, by facilitating the valida11 tion by permitted entities of fraud protection data, pursuVerDate Sep 11 2014 02:43 Mar 09, 2018 Jkt 079200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S2498.IS S2498

dlhill on DSK3GLQ082PROD with BILLS
2 

•S 2498 IS

1 ant to electronically received consumer consent, through 

2 use of a database maintained by the Commissioner. 

3 (b) DEFINITIONS.—In this section: 

4 (1) COMMISSIONER.—The term ‘‘Commis5 sioner’’ means the Commissioner of the Social Secu6 rity Administration. 

7 (2) FINANCIAL INSTITUTION.—The term ‘‘fi8 nancial institution’’ has the meaning given the term 

9 in section 509 of the Gramm-Leach-Bliley Act (15 

10 U.S.C. 6809). 

11 (3) FRAUD PROTECTION DATA.—The term 

12 ‘‘fraud protection data’’ means a combination of the 

13 following information with respect to an individual: 

14 (A) The name of the individual (including 

15 the first name and any family forename or sur16 name of the individual). 

17 (B) The Social Security number of the in18 dividual. 

19 (C) The date of birth (including the 

20 month, day, and year) of the individual. 

21 (4) PERMITTED ENTITY.—The term ‘‘permitted 

22 entity’’ means a financial institution or a service 

23 provider, subsidiary, affiliate, agent, subcontractor, 

24 or assignee of a financial institution. 

25 (c) EFFICIENCY.— 


dlhill on DSK3GLQ082PROD with BILLS
3 

•S 2498 IS

1 (1) RELIANCE ON EXISTING METHODS.—The 

2 Commissioner shall evaluate the feasibility of mak3 ing modifications to any database that is in exist4 ence as of the date of enactment of this Act or a 

5 similar resource such that the database or re6 source— 

7 (A) is reasonably designed to effectuate the 

8 purpose of this section; and 

9 (B) meets the requirements of subsection 

10 (d). 

11 (2) EXECUTION.—The Commissioner shall 

12 make the modifications necessary to any database 

13 that is in existence as of the date of enactment of 

14 this Act or similar resource, or develop a database 

15 or similar resource, to effectuate the requirements 

16 described in paragraph (1). 

17 (d) PROTECTION OF VULNERABLE CONSUMERS.— 

18 The database or similar resource described in subsection 

19 (c) shall— 

20 (1) compare fraud protection data provided in 

21 an inquiry by a permitted entity against such infor22 mation maintained by the Commissioner in order to 

23 confirm (or not confirm) the validity of the informa24 tion provided; 


dlhill on DSK3GLQ082PROD with BILLS
4 

•S 2498 IS

1 (2) be scalable and accommodate reasonably an2 ticipated volumes of verification requests from per3 mitted entities with commercially reasonable uptime 

4 and availability; 

5 (3) allow permitted entities to submit— 

6 (A) one or more individual requests elec7 tronically for real-time machine-to-machine (or 

8 similar functionality) accurate responses; and 

9 (B) multiple requests electronically, such 

10 as those provided in a batch format, for accu11 rate electronic responses within a reasonable pe12 riod of time from submission, not to exceed 24 

13 hours; 

14 (4) be funded, including any appropriate up15 grades, maintenance, and associated direct and indi16 rect administrative costs, by users of the database or 

17 similar resource, in a manner consistent with that 

18 described in section 1106(b) of the Social Security 

19 Act (42 U.S.C. 1306(b)); and 

20 (5) not later than 180 days after the date of 

21 enactment of this Act, be fully operational. 

22 (e) CERTIFICATION REQUIRED.—Before providing 

23 confirmation of fraud protection data to a permitted enti24 ty, the Commissioner shall ensure that the Commissioner 

25 has a certification from the permitted entity that is dated 


dlhill on DSK3GLQ082PROD with BILLS
5 

•S 2498 IS

1 not more than 2 years before the date on which that con2 firmation is provided that includes the following declara3 tions: 

4 (1) The entity is a permitted entity. 

5 (2) The entity is in compliance with this sec6 tion. 

7 (3) The entity is, and will remain, in compli8 ance with its privacy and data security requirements, 

9 as described in title V of the Gramm-Leach-Bliley 

10 Act (15 U.S.C. 6801 et seq.), with respect to infor11 mation the entity receives from the Commissioner 

12 pursuant to this section. 

13 (4) The entity will retain sufficient records to 

14 demonstrate its compliance with its certification and 

15 this section for a period of not less than 2 years. 

16 (f) CONSUMER CONSENT.— 

17 (1) IN GENERAL.—Notwithstanding any other 

18 provision of law or regulation, a permitted entity 

19 may submit a request to the database or similar re20 source described in subsection (c) only— 

21 (A) pursuant to the written, including elec22 tronic, consent received by a permitted entity 

23 from the individual who is the subject of the re24 quest; and 


dlhill on DSK3GLQ082PROD with BILLS
6 

•S 2498 IS

1 (B) in connection with a credit transaction 

2 or any circumstance described in section 604 of 

3 the Fair Credit Reporting Act (15 U.S.C. 

4 1681b). 

5 (2) ELECTRONIC CONSENT REQUIREMENTS.— 

6 For a permitted entity to use the consent of an indi7 vidual received electronically pursuant to paragraph 

8 (1)(A), the permitted entity must obtain the individ9 ual’s electronic signature, as defined in section 106 

10 of the Electronic Signatures in Global and National 

11 Commerce Act (15 U.S.C. 7006). 

12 (3) EFFECTUATING ELECTRONIC CONSENT.— 

13 No provision of law or requirement, including section 

14 552a of title 5, United States Code, shall prevent 

15 the use of electronic consent for purposes of this 

16 subsection or for use in any other consent based 

17 verification under the discretion of the Commis18 sioner. 

19 (g) COMPLIANCE AND ENFORCEMENT.— 

20 (1) AUDITS AND MONITORING.— 

21 (A) IN GENERAL.—The Commissioner 

22 may— 

23 (i) conduct audits and monitoring 

24 to— 


dlhill on DSK3GLQ082PROD with BILLS
7 

•S 2498 IS

1 (I) ensure proper use by per2 mitted entities of the database or 

3 similar resource described in sub4 section (c); and 

5 (II) deter fraud and misuse by 

6 permitted entities with respect to the 

7 database or similar resource described 

8 in subsection (c); and 

9 (ii) terminate services for any per10 mitted entity that prevents or refuses to 

11 allow the Commissioner to carry out the 

12 activities described in clause (i). 

13 (2) ENFORCEMENT.— 

14 (A) IN GENERAL.—Notwithstanding any 

15 other provision of law, including the matter pre16 ceding paragraph (1) of section 505(a) of the 

17 Gramm-Leach-Bliley Act (15 U.S.C. 6805(a)), 

18 any violation of this section and any certifi19 cation made under this section shall be enforced 

20 in accordance with paragraphs (1) through (7) 

21 of such section 505(a) by the agencies described 

22 in those paragraphs. 

23 (B) RELEVANT INFORMATION.—Upon dis24 covery by the Commissioner, pursuant to an 

25 audit described in paragraph (1)(A), of any vioVerDate Sep 11 2014 02:43 Mar 09, 2018 Jkt 079200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S2498.IS S2498

dlhill on DSK3GLQ082PROD with BILLS
8 

•S 2498 IS

1 lation of this section or any certification made 

2 under this section, the Commissioner shall for3 ward any relevant information pertaining to 

4 that violation to the appropriate agency de5 scribed in subparagraph (A) for evaluation by 

6 the agency for purposes of enforcing this sec7 tion. 

Æ 


dlhill on DSK3GLQ082PROD with BILLS