I 

116TH CONGRESS 

1ST SESSION H. R. 4480 

To amend the Small Business Act to require that credit reporting companies 

provide certain protections to small businesses, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

SEPTEMBER 24, 2019 

Mr. STEUBE (for himself and Mr. HAGEDORN) introduced the following bill; 

which was referred to the Committee on Small Business 

A BILL 

To amend the Small Business Act to require that credit 

reporting companies provide certain protections to small 

businesses, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Small Business Credit 

5 Protection Act of 2019’’. 

6 SEC. 2. DATA BREACHES. 

7 (a) IN GENERAL.—The Small Business Act (15 

8 U.S.C. 631 et seq.) is amended— 

9 (1) by redesignating section 49 (15 U.S.C. 631 

10 note) as section 50; and 


pamtmann on DSKBC07HB2PROD with BILLS
2 

•HR 4480 IH

1 (2) by inserting after section 48 (15 U.S.C. 

2 657u) the following new section: 

3 ‘‘SEC. 49. DATA BREACHES. 

4 ‘‘(a) DEFINITION.—In this section— 

5 ‘‘(1) the term ‘consumer report’ has the mean6 ing given the term in section 603 of the Fair Credit 

7 Reporting Act (15 U.S.C. 1681a); and 

8 ‘‘(2) the term ‘credit reporting company’— 

9 ‘‘(A) has the meaning given the term ‘con10 sumer reporting agency’ in section 603 of the 

11 Fair Credit Reporting Act (15 U.S.C. 1681a); 

12 and 

13 ‘‘(B) includes an entity that collects com14 mercial credit data. 

15 ‘‘(b) REQUIREMENTS FOR REPORTING BREACHES.— 

16 ‘‘(1) APPLICABLE STATE LAW.— 

17 ‘‘(A) IN GENERAL.—Except as provided in 

18 paragraph (2), if nonpublic data of a small 

19 business concern that is collected or stored by 

20 a credit reporting company has been breached, 

21 the credit reporting company shall report the 

22 breach promptly and not later than as required 

23 under the law of the State in which the small 

24 business concern is located. 


pamtmann on DSKBC07HB2PROD with BILLS
3 

•HR 4480 IH

1 ‘‘(B) LOCATIONS IN MULTIPLE STATES.— 

2 If a small business concern that is affected by 

3 a breach described in subparagraph (A) has lo4 cations in more than 1 State, for the purposes 

5 of that subparagraph, the law of the State that 

6 imposes the shortest period for the reporting of 

7 the breach shall apply. 

8 ‘‘(2) EXCEPTION.— 

9 ‘‘(A) IN GENERAL.—If a small business 

10 concern that is affected by a breach described 

11 in paragraph (1)(A) is located in a State that 

12 does not have a law that imposes a set period 

13 for the reporting of the breach, the credit re14 porting company to which the requirement 

15 under that paragraph applies shall report the 

16 breach in the most expeditious manner prac17 ticable and without unreasonable delay. 

18 ‘‘(B) RULE OF CONSTRUCTION REGARDING

19 A LAW ENFORCEMENT REQUEST.—For the pur20 poses of subparagraph (A), a delay with respect 

21 to the reporting of a breach described in that 

22 subparagraph that is caused by a requirement 

23 to respond to a request submitted by a law en24 forcement agency shall be construed to be a 

25 reasonable delay. 


pamtmann on DSKBC07HB2PROD with BILLS
4 

•HR 4480 IH

1 ‘‘(c) PROHIBITION.—During the 180-day period be2 ginning on the date on which a breach described in sub3 section (b)(1)(A) occurs, a credit reporting company may 

4 not charge a small business concern that is affected by 

5 that breach for providing the small business concern with 

6 the consumer report of the small business concern. 

7 ‘‘(d) NO PREEMPTION.—Nothing in this section shall 

8 preempt any State law with respect to credit reporting 

9 companies.’’. 

10 (b) GAO REPORT.— 

11 (1) DEFINITIONS.—In this subsection, the term 

12 ‘‘credit reporting company’’— 

13 (A) has the meaning given the term ‘‘con14 sumer reporting agency’’ in section 603 of the 

15 Fair Credit Reporting Act (15 U.S.C. 1681a); 

16 and 

17 (B) includes an entity that collects com18 mercial credit data. 

19 (2) REPORT.—Not later than 1 year after the 

20 date of enactment of this Act, the Comptroller Gen21 eral of the United States shall submit to Congress 

22 a report regarding the economic harm incurred by 

23 small business concerns as a result of data breaches 

24 at credit reporting companies. 

Æ 


pamtmann on DSKBC07HB2PROD with BILLS