I 

109TH CONGRESS 

2D SESSION H. R. 5487 

To require the Secretary of Veterans Affairs to take certain actions to 

mitigate the effects of the breach of data security that occurred, or 

is likely to have occurred, in May, 2006, at the Department of Veterans 

Affairs, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

MAY 25, 2006 

Ms. HOOLEY (for herself, Mr. LATOURETTE, Ms. BEAN, Mr. BAKER, Mr. 

MOORE of Kansas, Mr. KANJORSKI, Mr. CROWLEY, Mrs. MCCARTHY, Mr. 

MEEKS of New York, Mr. HINOJOSA, Ms. MOORE of Wisconsin, Mr. 

CLAY, Mrs. KELLY, Ms. HARMAN, Mr. LARSON of Connecticut, Mr. RAHALL, Mr. DELAHUNT, Ms. CORRINE BROWN of Florida, Mr. KUCINICH, 

Mr. MICHAUD, Mr. DAVIS of Alabama, Mr. AL GREEN of Texas, Mr. 

SCOTT of Georgia, Mr. LYNCH, Mr. GRIJALVA, Ms. DEGETTE, Ms. 

BORDALLO, Mr. BACA, Mr. SMITH of Washington, Mr. CLYBURN, Mr. 

CONYERS, Mr. THOMPSON of Mississippi, Mr. DICKS, Mr. INSLEE, Mr. 

POMEROY, Mr. FILNER, Mr. RAMSTAD, Ms. WASSERMAN SCHULTZ, Mr. 

WALDEN of Oregon, Mr. DEFAZIO, Mr. BAIRD, and Ms. HERSETH) introduced the following bill; which was referred to the Committee on Veterans’ Affairs 

A BILL 

To require the Secretary of Veterans Affairs to take certain 

actions to mitigate the effects of the breach of data 

security that occurred, or is likely to have occurred, 

in May, 2006, at the Department of Veterans Affairs, 

and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


CCOLEMAN on PROD1PC71 with BILLS
2 

•HR 5487 IH

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Veterans’ ID Theft 

3 Protection Act of 2006’’. 

4 SEC. 2. ACTIONS REQUIRED WITH RESPECT TO VETERANS 

5 ADMINISTRATION DATA BREACH. 

6 (a) IN GENERAL.—With respect to the breach of data 

7 security that occurred, or is likely to have occurred, in 

8 May, 2006, at the Department of Veterans Affairs, the 

9 Secretary of Veterans Affairs shall take the following ac10 tions with respect to such breach in addition to any other 

11 actions the Secretary may determine to be appropriate. 

12 (1) SYSTEM RESTORATION REQUIREMENTS.— 

13 The Secretary shall take prompt and reasonable 

14 measures to— 

15 (A) repair the breach and restore the secu16 rity and confidentiality of the sensitive financial 

17 personal information involved to limit further 

18 unauthorized misuse of such information; and 

19 (B) restore the integrity of the Depart20 ment’s data security safeguards and make ap21 propriate improvements to its data security 

22 policies and procedures. 

23 (2) NOTICE REQUIREMENTS.— 

24 (A) IN GENERAL.—The Secretary shall 

25 without unreasonable delay notify any person 


CCOLEMAN on PROD1PC71 with BILLS
3 

•HR 5487 IH

1 affected by the breach in the manner provided 

2 in this paragraph, as well as— 

3 (i) each nationwide consumer report4 ing agency described in section 603(p) of 

5 the Fair Credit Reporting Act with respect 

6 to the breach itself and each person af7 fected by the breach; and 

8 (ii) any other appropriate critical 

9 third parties who will be required to under10 take further action with respect to such in11 formation to protect such persons from re12 sulting fraud or identity theft. 

13 (B) CONTENT OF NOTICE.—Any notice re14 quired to be provided under subparagraph (A) 

15 by the Secretary to any person affected by the 

16 breach shall be provided in a standardized 

17 transmission or envelope clearly marked as con18 taining an important notice from the Depart19 ment of Veterans Affairs on stolen identity in20 formation, and shall include the following in a 

21 clear and conspicuous manner: 

22 (i) An appropriate heading or notice 

23 title. 

24 (ii) A description of the nature and 

25 types of information and accounts as apVerDate Aug 31 2005 04:00 Jun 03, 2006 Jkt 049200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H5487.IH H5487

CCOLEMAN on PROD1PC71 with BILLS
4 

•HR 5487 IH

1 propriate that were, or are reasonably be2 lieved to have been, subject to the breach 

3 of data security. 

4 (iii) If known, the date, or the best 

5 reasonable approximation of the period of 

6 time, on or within which sensitive personal 

7 information related to the consumer was, 

8 or is reasonably believed to have been, sub9 ject to a breach. 

10 (iv) A general description of the ac11 tions taken by the Secretary to restore the 

12 security and confidentiality of the breached 

13 information. 

14 (v) A telephone number by which any 

15 person affected by the breach may call the 

16 Department of Veterans Affairs, free of 

17 charge, to obtain additional information 

18 about how to respond to the breach. 

19 (vi) A copy of the summary of rights 

20 of consumer victims of fraud or identity 

21 theft prepared by the Federal Trade Com22 mission under section 609(d) of the Fair 

23 Credit Reporting Act, as well as any addi24 tional appropriate information on how the 

25 person affected by the breach may— 


CCOLEMAN on PROD1PC71 with BILLS
5 

•HR 5487 IH

1 (I) obtain a copy of a consumer 

2 report free of charge in accordance 

3 with section 612 of the Fair Credit 

4 Reporting Act; 

5 (II) place a fraud alert in any file 

6 relating to the person at a consumer 

7 reporting agency under section 605A 

8 of such Act to discourage unauthor9 ized use; and 

10 (III) contact the Federal Trade 

11 Commission for more detailed infor12 mation. 

13 (vii) A prominent statement that file 

14 monitoring will be made available upon re15 quest in accordance with paragraph (3) to 

16 the person affected by the breach free of 

17 charge for a period of not less than 6 

18 months, together with a telephone number 

19 at the Department of Veterans Affair for 

20 requesting such services. The statement 

21 may also include such additional contact 

22 information as a mailing address, e-mail, 

23 or Internet website address. 

24 (viii) The approximate date the notice 

25 is being issued. 


CCOLEMAN on PROD1PC71 with BILLS
6 

•HR 5487 IH

1 (C) RESPONSIBILITY AND COSTS.— 

2 (i) IN GENERAL.—The Secretary of 

3 Veterans Affairs shall be— 

4 (I) responsible for providing any 

5 notices and file monitoring required 

6 under this section with respect to such 

7 breach; and 

8 (II) responsible for the reason9 able actual costs of any notices pro10 vided under this section. 

11 (ii) NO CHARGE TO PERSONS AF12 FECTED BY THE BREACH.—The cost for 

13 the notices and file monitoring described in 

14 clause (i) may not be charged to the per15 sons affected by the breach. 

16 (3) FREE FILE MONITORING.—The Secretary of 

17 Veterans Affairs, if requested by the person affected 

18 by the breach before the end of the 90-day period 

19 beginning on the date of such notice, shall make 

20 available to the person, free of charge and for at 

21 least a 6-month period a service that monitors na22 tionwide credit activity regarding a consumer from a 

23 consumer reporting agency described in section 

24 603(p) of the Fair Credit Reporting Act. 


CCOLEMAN on PROD1PC71 with BILLS
7 

•HR 5487 IH

1 (b) NEGOTIATING AUTHORITY.—The Secretary of 

2 Veterans Affairs shall have broad authority to secure the 

3 best possible price for credit monitoring services on behalf 

4 of taxpayers. 

5 (c) AUTHORIZATION OF APPROPRIATIONS.—There 

6 are authorized to be appropriated to the Secretary of Vet7 erans Affairs the sum of $100,000,000 to carry out the 

8 requirements of this section. 

Æ 


CCOLEMAN on PROD1PC71 with BILLS