II 

117TH CONGRESS 

1ST SESSION S. 2034 

To amend the Small Business Act to require that consumer reporting agencies 

and other credit reporting companies provide certain protections to small 

businesses, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JUNE 10, 2021 

Mr. RUBIO (for himself, Mr. COONS, Mr. KENNEDY, and Mr. WARNOCK) introduced the following bill; which was read twice and referred to the Committee on Small Business and Entrepreneurship 

A BILL 

To amend the Small Business Act to require that consumer 

reporting agencies and other credit reporting companies 

provide certain protections to small businesses, and for 

other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Small Business Credit 

5 Protection Act’’. 

6 SEC. 2. DATA BREACHES. 

7 (a) IN GENERAL.—The Small Business Act (15 

8 U.S.C. 631 et seq.) is amended— 


kjohnson on DSK79L0C42PROD with BILLS
2 

•S 2034 IS

1 (1) by redesignating section 49 (15 U.S.C. 631 

2 note) as section 50; and 

3 (2) by inserting after section 48 (15 U.S.C. 

4 657u) the following: 

5 ‘‘SEC. 49. DATA BREACHES. 

6 ‘‘(a) DEFINITION.—In this section— 

7 ‘‘(1) the term ‘consumer report’ has the mean8 ing given the term in section 603 of the Fair Credit 

9 Reporting Act (15 U.S.C. 1681a); and 

10 ‘‘(2) the term ‘credit reporting company’— 

11 ‘‘(A) has the meaning given the term ‘con12 sumer reporting agency’ in section 603 of the 

13 Fair Credit Reporting Act (15 U.S.C. 1681a); 

14 and 

15 ‘‘(B) includes an entity that collects com16 mercial credit data. 

17 ‘‘(b) REQUIREMENTS FOR REPORTING BREACHES.— 

18 ‘‘(1) APPLICABLE STATE LAW.— 

19 ‘‘(A) IN GENERAL.—Except as provided in 

20 paragraph (2), if nonpublic data of a small 

21 business concern that is collected or stored by 

22 a credit reporting company has been breached, 

23 the credit reporting company shall report the 

24 breach promptly and not later than as required 


kjohnson on DSK79L0C42PROD with BILLS
3 

•S 2034 IS

1 under the law of the State in which the small 

2 business concern is located. 

3 ‘‘(B) LOCATIONS IN MULTIPLE STATES.— 

4 If a small business concern that is affected by 

5 a breach described in subparagraph (A) has lo6 cations in more than 1 State, for the purposes 

7 of that subparagraph, the law of the State that 

8 imposes the shortest period for the reporting of 

9 the breach shall apply. 

10 ‘‘(2) EXCEPTION.— 

11 ‘‘(A) IN GENERAL.—If a small business 

12 concern that is affected by a breach described 

13 in paragraph (1)(A) is located in a State that 

14 does not have a law that imposes a set period 

15 for the reporting of the breach, the credit re16 porting company to which the requirement 

17 under that paragraph applies shall report the 

18 breach in the most expeditious manner prac19 ticable and without unreasonable delay. 

20 ‘‘(B) RULE OF CONSTRUCTION REGARDING

21 A LAW ENFORCEMENT REQUEST.—For the pur22 poses of subparagraph (A), a delay with respect 

23 to the reporting of a breach described in that 

24 subparagraph that is caused by a requirement 

25 to respond to a request submitted by a law enVerDate Sep 11 2014 07:05 Jun 23, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S2034.IS S2034

kjohnson on DSK79L0C42PROD with BILLS
4 

•S 2034 IS

1 forcement agency shall be construed to be a 

2 reasonable delay. 

3 ‘‘(c) PROHIBITION.—During the 180-day period be4 ginning on the date on which a breach described in sub5 section (b)(1)(A) occurs, a credit reporting company may 

6 not charge a small business concern that is affected by 

7 that breach for providing the small business concern with 

8 the consumer report of the small business concern. 

9 ‘‘(d) NO PREEMPTION.—Nothing in this section shall 

10 preempt any State law with respect to credit reporting 

11 companies.’’. 

12 (b) GAO REPORT.— 

13 (1) DEFINITIONS.—In this subsection— 

14 (A) the term ‘‘credit reporting company’’— 

15 (i) has the meaning given the term 

16 ‘‘consumer reporting agency’’ in section 

17 603 of the Fair Credit Reporting Act (15 

18 U.S.C. 1681a); and 

19 (ii) includes an entity that collects 

20 commercial credit data; and 

21 (B) the term ‘‘small business concern’’ has 

22 the meaning given the term in section 3 of the 

23 Small Business Act (15 U.S.C. 632). 

24 (2) REPORT.—Not later than 1 year after the 

25 date of enactment of this Act, the Comptroller GenVerDate Sep 11 2014 07:05 Jun 23, 2021 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S2034.IS S2034

kjohnson on DSK79L0C42PROD with BILLS
5 

•S 2034 IS

1 eral of the United States shall submit to Congress 

2 a report regarding the economic harm incurred by 

3 small business concerns as a result of data breaches 

4 at credit reporting companies. 

Æ 


kjohnson on DSK79L0C42PROD with BILLS