I 

115TH CONGRESS 

2D SESSION H. R. 5192 

To authorize the Commissioner of Social Security to provide confirmation 

of fraud protection data to certain permitted entities, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

MARCH 7, 2018 

Mr. CURBELO of Florida (for himself, Mr. MARCHANT, Ms. SINEMA, and Mr. 

HULTGREN) introduced the following bill; which was referred to the Committee on Ways and Means 

A BILL 

To authorize the Commissioner of Social Security to provide 

confirmation of fraud protection data to certain permitted entities, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Protecting Children 

5 from Identity Theft Act’’. 

6 SEC. 2. REDUCING IDENTITY FRAUD. 

7 (a) PURPOSE.—The purpose of this section is to re8 duce the prevalence of synthetic identity fraud, which 

9 disproportionally affects vulnerable populations, such as 


rfrederick on DSKBCBPHB2PROD with BILLS
2 

•HR 5192 IH

1 minors and recent immigrants, by facilitating the valida2 tion by permitted entities of fraud protection data, pursu3 ant to electronically received consumer consent, through 

4 use of a database maintained by the Commissioner. 

5 (b) DEFINITIONS.—In this section: 

6 (1) COMMISSIONER.—The term ‘‘Commis7 sioner’’ means the Commissioner of the Social Secu8 rity Administration. 

9 (2) FINANCIAL INSTITUTION.—The term ‘‘fi10 nancial institution’’ has the meaning given the term 

11 in section 509 of the Gramm-Leach-Bliley Act (15 

12 U.S.C. 6809). 

13 (3) FRAUD PROTECTION DATA.—The term 

14 ‘‘fraud protection data’’ means a combination of the 

15 following information with respect to an individual: 

16 (A) The name of the individual (including 

17 the first name and any family forename or sur18 name of the individual). 

19 (B) The Social Security number of the in20 dividual. 

21 (C) The date of birth (including the 

22 month, day, and year) of the individual. 

23 (4) PERMITTED ENTITY.—The term ‘‘permitted 

24 entity’’ means a financial institution or a service 


rfrederick on DSKBCBPHB2PROD with BILLS
3 

•HR 5192 IH

1 provider, subsidiary, affiliate, agent, subcontractor, 

2 or assignee of a financial institution. 

3 (c) EFFICIENCY.— 

4 (1) RELIANCE ON EXISTING METHODS.—The 

5 Commissioner shall evaluate the feasibility of mak6 ing modifications to any database that is in exist7 ence as of the date of enactment of this Act or a 

8 similar resource such that the database or re9 source— 

10 (A) is reasonably designed to effectuate the 

11 purpose of this section; and 

12 (B) meets the requirements of subsection 

13 (d). 

14 (2) EXECUTION.—The Commissioner shall 

15 make the modifications necessary to any database 

16 that is in existence as of the date of enactment of 

17 this Act or similar resource, or develop a database 

18 or similar resource, to effectuate the requirements 

19 described in paragraph (1). 

20 (d) PROTECTION OF VULNERABLE CONSUMERS.— 

21 The database or similar resource described in subsection 

22 (c) shall— 

23 (1) compare fraud protection data provided in 

24 an inquiry by a permitted entity against such infor25 mation maintained by the Commissioner in order to 


rfrederick on DSKBCBPHB2PROD with BILLS
4 

•HR 5192 IH

1 confirm (or not confirm) the validity of the informa2 tion provided; 

3 (2) be scalable and accommodate reasonably an4 ticipated volumes of verification requests from per5 mitted entities with commercially reasonable uptime 

6 and availability; and 

7 (3) allow permitted entities to submit— 

8 (A) one or more individual requests elec9 tronically for real-time machine-to-machine (or 

10 similar functionality) accurate responses; and 

11 (B) multiple requests electronically, such 

12 as those provided in a batch format, for accu13 rate electronic responses within a reasonable pe14 riod of time from submission, not to exceed 24 

15 hours. 

16 (e) CERTIFICATION REQUIRED.—Before providing 

17 confirmation of fraud protection data to a permitted enti18 ty, the Commissioner shall ensure that the Commissioner 

19 has a certification from the permitted entity that is dated 

20 not more than 2 years before the date on which that con21 firmation is provided that includes the following declara22 tions: 

23 (1) The entity is a permitted entity. 

24 (2) The entity is in compliance with this sec25 tion. 


rfrederick on DSKBCBPHB2PROD with BILLS
5 

•HR 5192 IH

1 (3) The entity is, and will remain, in compli2 ance with its privacy and data security requirements, 

3 as described in title V of the Gramm-Leach-Bliley 

4 Act (15 U.S.C. 6801 et seq.), with respect to infor5 mation the entity receives from the Commissioner 

6 pursuant to this section. 

7 (4) The entity will retain sufficient records to 

8 demonstrate its compliance with its certification and 

9 this section for a period of not less than 2 years. 

10 (f) CONSUMER CONSENT.— 

11 (1) IN GENERAL.—Notwithstanding any other 

12 provision of law or regulation, a permitted entity 

13 may submit a request to the database or similar re14 source described in subsection (c) only— 

15 (A) pursuant to the written, including elec16 tronic, consent received by a permitted entity 

17 from the individual who is the subject of the re18 quest; and 

19 (B) in connection with a credit transaction 

20 or any circumstance described in section 604 of 

21 the Fair Credit Reporting Act (15 U.S.C. 

22 1681b). 

23 (2) ELECTRONIC CONSENT REQUIREMENTS.— 

24 For a permitted entity to use the consent of an indi25 vidual received electronically pursuant to paragraph 


rfrederick on DSKBCBPHB2PROD with BILLS
6 

•HR 5192 IH

1 (1)(A), the permitted entity must obtain the individ2 ual’s electronic signature, as defined in section 106 

3 of the Electronic Signatures in Global and National 

4 Commerce Act (15 U.S.C. 7006). 

5 (3) EFFECTUATING ELECTRONIC CONSENT.— 

6 No provision of law or requirement, including section 

7 552a of title 5, United States Code, shall prevent 

8 the use of electronic consent for purposes of this 

9 subsection or for use in any other consent based 

10 verification under the discretion of the Commis11 sioner. 

12 (g) COMPLIANCE AND ENFORCEMENT.— 

13 (1) AUDITS AND MONITORING.— 

14 (A) IN GENERAL.—The Commissioner 

15 may— 

16 (i) conduct audits and monitoring 

17 to— 

18 (I) ensure proper use by per19 mitted entities of the database or 

20 similar resource described in sub21 section (c); and 

22 (II) deter fraud and misuse by 

23 permitted entities with respect to the 

24 database or similar resource described 

25 in subsection (c); and 


rfrederick on DSKBCBPHB2PROD with BILLS
7 

•HR 5192 IH

1 (ii) terminate services for any per2 mitted entity that prevents or refuses to 

3 allow the Commissioner to carry out the 

4 activities described in clause (i). 

5 (2) ENFORCEMENT.— 

6 (A) IN GENERAL.—Notwithstanding any 

7 other provision of law, including the matter pre8 ceding paragraph (1) of section 505(a) of the 

9 Gramm-Leach-Bliley Act (15 U.S.C. 6805(a)), 

10 any violation of this section and any certifi11 cation made under this section shall be enforced 

12 in accordance with paragraphs (1) through (7) 

13 of such section 505(a) by the agencies described 

14 in those paragraphs. 

15 (B) RELEVANT INFORMATION.—Upon dis16 covery by the Commissioner, pursuant to an 

17 audit described in paragraph (1)(A), of any vio18 lation of this section or any certification made 

19 under this section, the Commissioner shall for20 ward any relevant information pertaining to 

21 that violation to the appropriate agency de22 scribed in subparagraph (A) for evaluation by 

23 the agency for purposes of enforcing this sec24 tion. 

25 (h) RECOVERY OF COSTS.— 


rfrederick on DSKBCBPHB2PROD with BILLS
8 

•HR 5192 IH

1 (1) IN GENERAL.— 

2 (A) IN GENERAL.—Amounts obligated to 

3 carry out this section shall be fully recovered 

4 from the users of the database or verification 

5 system by way of advances, reimbursements, 

6 user fees, or other recoveries as determined by 

7 the Commissioner. The funds recovered under 

8 this paragraph shall be deposited as an offset9 ting collection to the account providing appro10 priations for the Social Security Administration, 

11 to be used for the administration of this section 

12 without fiscal year limitation. 

13 (B) PRICES FIXED BY COMMISSIONER.— 

14 The Commissioner shall establish the amount to 

15 be paid by the users under this paragraph, in16 cluding the costs of any services or work per17 formed, such as any appropriate upgrades, 

18 maintenance, and associated direct and indirect 

19 administrative costs, in support of carrying out 

20 the purposes described in this section, by reim21 bursement or in advance as determined by the 

22 Commissioner. The amount of such prices shall 

23 be periodically adjusted by the Commissioner to 

24 ensure that amounts collected are sufficient to 


rfrederick on DSKBCBPHB2PROD with BILLS
9 

•HR 5192 IH

1 fully offset the cost of the administration of this 

2 section. 

3 (2) INITIAL DEVELOPMENT.—The Commis4 sioner shall not begin development of a verification 

5 system to carry out this section until the Commis6 sioner determines that amounts equal to at least 50 

7 percent of program start-up costs have been col8 lected under paragraph (1). 

9 (3) EXISTING RESOURCES.—The Commissioner 

10 of Social Security may use funds designated for in11 formation technology modernization to carry out this 

12 section. 

13 (4) ANNUAL REPORT.—The Commissioner of 

14 Social Security shall annually submit to the Com15 mittee on Ways and Means of the House of Rep16 resentatives and the Committee on Finance of the 

17 Senate a report on the amount of indirect costs to 

18 the Social Security Administration arising as a re19 sult of the implementation of this section. 

Æ 


rfrederick on DSKBCBPHB2PROD with BILLS