January 6, 2009 CONGRESSIONAL RECORD — SENATE S115 

provided to Bear Stearns in March, $200 

billion available to Fannie Mae and 

Freddie Mac, $150 billion to AIG, $700 

billion for TARP, plus the direct lending programs at the Federal Reserve— 

we are talking about well over 1 trillion Federal dollars. 

I certainly don’t think it is unreasonable for the public to know how their 

money is being spent, and I am not the 

only Member of Congress or elected official who feels this way. 

In response to questions posed by the 

Congressional Oversight Panel for Economic Stabilization, the Treasury Department noted that it was committed 

to rigorous oversight of executive compensation packages. This may be the 

case, but executive compensation is 

only the beginning. 

While I am pleased that CEOs at 

some financial institutions that accepted Federal assistance did not accept their annual bonuses last year, we 

still do not have an official accounting 

of how Federal funds were used. 

Certainly Americans deserve assurances that struggling firms will not use 

public funds to pay exorbitant salaries 

or bonuses. 

The same can be said for these funds 

going towards dividend payments, or 

mergers and acquisitions. 

The Government Accountability Office, GAO, has reported that the Treasury Department had no strong accountability or oversight function to 

ensure that banks were using rescue 

assistance with the best interests of 

the public in mind. 

It noted that Treasury had little 

ability to ensure that participating 

firms complied with laws already limiting executive compensation and conflicts of interest. 

An investigation last month by the 

Associated Press found that many 

banks that have accepted Federal assistance are not able to say with certainty exactly how they have used the 

money. Some of these banks would not 

even discuss the issue. 

We cannot be sure that the rescue 

funds are being used to stabilize the 

economy if banks are not keeping proper accounting of their use, and those 

that do will not disclose it. 

Shining light on how firms use public 

dollars not only makes good sense, but 

it will also act as a deterrent to irresponsible behavior. 

On October 16, 2008, the Wall Street 

Journal reported that AIG, which received billions of dollars in Federal rescue funds, was continuing to lobby 

State regulators to delay implementation of strengthened licensing standards for mortgage brokers and lenders. 

AIG was lobbying against sensible 

standards created by the SAFE Mortgage Licensing Act. This bill, introduced by Senator MARTINEZ and myself, established basic minimum regulations for the mortgage industry to 

ensure consumers were adequately protected. 

Before this bill, in some States virtually anyone—even those with criminal records—could go out and get a 

mortgage broker’s license. 

Left unchecked, and with no regulations to stop them, unscrupulous mortgage brokers and lenders flooded the 

markets with subprime loans that they 

knew would never be paid back. 

Of course, this has served as one of 

the catalysts for our current economic 

predicament. 

And now AIG, propped up by billions 

in Government money after having 

succumbed to bad investments, was 

lobbying against the strong enforcement of State laws that might have 

helped prevent this catastrophe in the 

first place. 

Senator MARTINEZ and I wrote a letter to AIG and, to the company’s credit, CEO Edward Liddy immediately suspended the company’s lobbying operations. 

I find it completely unacceptable 

that taxpayer dollars intended to stabilize the economy could find their way 

into the bank accounts of lobbying 

firms. The legislation which I am reintroducing today will make sure that 

does not happen. 

I do not mean to pick on AIG, but 

they have also been the poster child for 

wasteful spending by rescued firms. 

In September 2008, just days after receiving an $85 billion Federal lifeline, 

the management of AIG treated itself 

to a $444,000 spa weekend at the St. 

Regis resort in Monarch Beach, California. This included $200,000 for rooms, 

$150,000 for fine dining and $23,000 in 

spa charges. 

AIG executives spent the last 2 days 

of September 2008 on a golf outing at 

Mandalay Bay in Las Vegas at a cost of 

up to $500,000. They were planning to 

follow this with a few days at the Ritz 

Carlton in Half Moon Bay, but cancelled after it hit the news and drew 

fire from congressional leaders. 

As news of these wasteful expenditures was making headlines, AIG received another $37.8 billion in emergency loans from the Federal Government. 

Shortly thereafter, the Associated 

Press reported that—even as AIG was 

asking Congress for these loans—AIG 

executives were spending $86,000 on a 

pheasant hunting expedition in England. During the trip, they stayed at a 

17th century manor. 

One AIG executive named Sebastian 

Preil was quoted as saying that: ‘‘The 

recession will go on until about 2011, 

but the shooting was great today and 

we are relaxing fine.’’ 

Once these lapses in judgment came 

to light, AIG chief executive Edward 

Liddy informed Congress that he was 

putting an end to all nonessential expenditures. Yet weeks later, an undercover news crew caught AIG executives 

at the Hilton Squaw Peak Resort in 

Phoenix, hosting a seminar for financial planners complete with cocktails 

and limousines. 

One would think that a brush with 

collapse and total failure might have a 

sobering effect on some of these firms. 

But this penchant for wasteful junkets in the face of complete failure was 

not unique to AIG. 

Following enactment of TARP, news 

reports have uncovered multiple instances in which rescued firms have 

been caught making unnecessary and 

outrageous expenditures, leading many 

taxpayers to question why these firms 

are receiving Federal assistance in the 

first place. 

In November, Treasury Secretary 

Paulson announced that the $700 billion approved by Congress to stabilize 

financial markets would not be used to 

purchase illiquid assets but rather to 

make direct capital injections into financial institutions. 

Given this new mission, the need for 

additional transparency and disclosure 

is striking. 

We have learned that we cannot necessarily count on these firms and their 

executives to act sensibly and do what 

is right. 

The public needs to know that their 

tax dollars are being put to good use. 

A simple ‘‘trust me’’ from the bank 

executives is not enough. 

Americans are struggling, and the 

pain in my State of California, where 

unemployment is 8.4 percent, and foreclosure filings exceeded 750,000 last 

year, is especially acute. 

This bill puts in place commonsense 

solutions to fix some of the deficiencies 

in the economic stabilization bill. 

This legislation is significant and 

sorely needed. 

We must act soon to help restore confidence in this effort and shed light on 

how public funds are used. We promised 

the American people transparency and 

oversight, and this legislation will 

make good on that promise. 

I hope my colleagues will join me to 

ensure that taxpayer dollars are spent 

efficiently and responsibly. 

By Mr. KERRY (for himself, Ms. 

SNOWE, and Mrs. LINCOLN): 

S. 138. A bill to amend the Internal 

Revenue Code of 1986 to repeal alternative minimum tax limitations on 

private activity bond interest, and for 

other purposes; to the Committee on 

Finance. 

Mr. KERRY. Mr. President, today 

Senator SNOWE and I are introduce legislation to exempt private activity 

bond interest from the alternative minimum tax, AMT. My colleague from 

Massachusetts, Representative RICHARD NEAL has introduced similar legislation. Under current law, interest paid 

on private activity bonds is subject to 

the alternative minimum tax. This results in the bonds not being very marketable in these difficult economic 

times. 

Making private activity bonds no 

longer subject to the AMT would help 

with the issuance of bonds. This legislation would assist in needed relief to 

State and local governments across the 

Nation. It would provide more buyers 

to the market, resulting in interest 

savings for issuers, and ultimately taxpayers. 


wwoods2 on PRODPC68 with SENATE
S116 CONGRESSIONAL RECORD — SENATE January 6, 2009 

Subjecting private activity bond interest to the AMT could cost an issuer 

25 to 30 more basis points when issuing 

an AMT bond compared to a non-AMT 

bond. However, the recent freezing of 

the municipal credit market has led 

the difference to rise as much as 100 

basis points. This results in increased 

costs for various infrastructure 

projects including airports, docks and 

other transportation-related facilities; 

water, sewer and other utility facilities; and solid and hazardous waste disposal facilities. 

Last Congress, I worked on a provision to exempt the interest from private activity housing bonds from the 

AMT and this provision was included in 

the Housing and Economic Recovery 

Act of 2008. The legislation Senator 

SNOWE and I are introducing builds on 

this provision by exempting interest 

from all private activity bonds from 

the AMT. 

I believe this legislation will help 

spur the economy and create jobs. This 

legislation will provide better funding 

options for essential infrastructure 

projects and create jobs across the 

country. I look forward to working 

with my colleagues on this important 

legislation. 

By Mrs. FEINSTEIN: 

S. 139. A bill to require Federal agencies, and persons engaged in interstate 

commerce, in possession of data containing sensitive personally identifiable information, to disclose any 

breach of such information; to the 

Committee on the Judiciary. 

Mrs. FEINSTEIN. Mr. President, I 

rise to introduce the Data Breach Notification Act. 

This is a commonsense bill that is 

aimed at protecting personal information and preventing identity theft. The 

bill would require businesses and government agencies to notify individuals 

when their sensitive personal information has been exposed in a data breach. 

As many of you know, I have been 

urging the Senate to adopt this legislation since 2003, when California first 

imposed a State notification requirement. 

That legislation has helped consumers in my State. Federal data 

breach law would provide uniformity 

and protect consumers throughout the 

country. 

With every year that passes, the evidence in support of this legislation has 

only continued to mount. 

The cost of identity theft is enormous—estimated at more than $50 billion per year. Some of the costs fall on 

businesses and banks, which suffer 

losses from fraudulent transactions. 

Some of the costs are also borne by 

consumers, whose finances and credit 

ratings are disrupted. 

Since the beginning of 2005, over 240 

million data records containing individuals’ sensitive personal data have 

been exposed in data breaches. 

It seems that not a week goes by 

without news of another security 

breach that exposes names, addresses, 

birth dates, social security numbers, or 

other personal data. 

These breaches have spawned a vast 

online market in stolen identities. 

Today, each person whose identity is 

sold on the internet faces a high risk of 

becoming a victim of identity theft. 

Each of them faces the expensive and 

time-consuming nightmare of trying to 

restore their finances and credit ratings. 

According to a report by the Identity 

Theft Resource Center, the news media 

reported more than 620 breaches involving personal information during 

2008. That works out to about one data 

security breach every 14 hours—and 

those are just the ones that are big 

enough to be covered in the media. 

Recent reports of security breaches 

involving sensitive personal data point 

out the extent of the problem. 

In December 2008, during a website 

development project at the Florida 

Agency for Workforce Innovation, the 

Social Security numbers of more than 

a quarter of a million people were accidentally posted online. 

In August of last year, an employee 

working weekends at Countrywide copied customer records from an office 

computer and then sold the personal 

information of an estimated 2,000,000 

mortgage applicants. 

In May of 2007, a breach at the Transportation Security Administration 

made the names, Social Security numbers, birth dates, payroll information, 

and bank account information of more 

than 100,000 former employees vulnerable to theft or sale. 

In January of that same year, hackers accessed information held by TJX 

stores, including more than 45 million 

credit card numbers and more than 

455,000 merchandise records containing 

customers’ drivers license numbers. 

In May of 2006, there was a breach at 

the Department of Veterans Affairs 

that involved the names, birth dates, 

and Social Security numbers of every 

veteran discharged from the military 

since 1975—more than 28 million veterans—every veteran discharged from 

the military since 1975. 

Another disturbing example took 

place last year at the State Department when the passport files of Senator CLINTON, Senator MCCAIN, and 

Senator OBAMA—the three leading 

presidential contenders at the time— 

were accessed by contractors working 

for the Department. Though the Department knew about the breaches 

right away, several months passed before our colleagues were told about the 

problem. 

Unfortunately, this delay is not surprising—because there is currently 

nothing to require a Federal agency to 

tell us when a security breach affects 

our personal data. 

That needs to change. That’s what 

my bill does. 

Specifically, this legislation requires 

the Federal Government and private 

businesses to notify individuals when 

there has been a security breach involving their sensitive personal data; 

ensures that the notice is provided 

without unreasonable delay; creates 

very limited exceptions to notification 

for national security and law enforcement purposes, and when law enforcement certifies that there is there is no 

significant risk of harm to the individual; establishes penalties against 

those who do not provide the required 

notice. The provisions of the bill would 

be enforced by the Federal and State 

attorneys general; and pre-empts State 

laws so that there is a single, nationwide notification requirement. 

Data security breaches have real consequences. For one thing, they are bad 

for business because they lead to a loss 

of confidence—especially in online 

commerce. A 2005 survey for Consumer 

Reports showed that 25 percent of 

Internet users stopped shopping online 

because of fears about identity theft. 

Of people who still shopped online, 29 

percent said that they had cut back on 

how often they buy products on the 

Internet. 

Data breaches also pose serious 

harms for consumers. A November 2007 

report from the Federal Trade Commission revealed that identity theft victims spent as much as $5,000 of their 

own money—and as many as 1,200 hours 

of their time—recovering from the 

harm to their finances caused by identity theft. 

While not all data breaches lead to 

identity theft, the cost of stolen identities is so enormous that we should be 

doing everything we can to solve this 

problem. 

The situation requires action. While 

Congress has been slow to act, the 

States have not. In the almost 6 years 

since the California law took effect, 43 

States, the District of Columbia, Puerto Rico, and the Virgin Islands have 

passed similar laws. 

A report issued by the Federal Trade 

Commission in December 2008 noted 

that these State data breach notification laws have had several indirect 

benefits; many businesses across the 

country have strengthened their safeguard practices in order to avoid data 

breaches. 

By forcing companies to consider the 

potential cost and liability that may 

ensue if information is compromised in 

a data breach, these laws have the indirect benefit of motivating companies 

to reassess their need to collect personally identifiable information in the 

first place. 

The same benefits would flow from 

Federal legislation. Additionally, the 

Data Breach Notification Act would 

improve the law by creating a single, 

uniform national standard. 

A September 2008 report issued by 

the President’s Identity Theft Task 

Force again emphasized the need for a 

unified Federal standard to replace the 

patchwork of varied state laws currently in place. The December 2008 FTC 

report made the same point. 

A Federal bill will simplify the process of compliance and notification for 


wwoods2 on PRODPC68 with SENATE