I 

115TH CONGRESS 

2D SESSION H. R. 5166 

To direct the Federal Trade Commission to review and potentially revise 

its standards for safeguarding customer information to ensure that such 

standards require certain consumer reporting agencies and service providers of such agencies to maintain sufficient safeguards against cyber 

attacks and related threats, to provide for additional authority to enforce 

such standards with respect to such agencies and providers, and for 

other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

MARCH 5, 2018 

Mr. TED LIEU of California introduced the following bill; which was referred 

to the Committee on Financial Services, and in addition to the Committee 

on Energy and Commerce, for a period to be subsequently determined by 

the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned 

A BILL 

To direct the Federal Trade Commission to review and potentially revise its standards for safeguarding customer 

information to ensure that such standards require certain 

consumer reporting agencies and service providers of 

such agencies to maintain sufficient safeguards against 

cyber attacks and related threats, to provide for additional authority to enforce such standards with respect 

to such agencies and providers, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


amozie on DSK30RV082PROD with BILLS
2 

•HR 5166 IH

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Protecting Consumer 

3 Information Act of 2018’’. 

4 SEC. 2. STANDARDS FOR CYBERSECURITY SAFEGUARDS 

5 FOR CERTAIN CONSUMER REPORTING AGEN6 CIES AND SERVICE PROVIDERS. 

7 (a) REVIEW OF STANDARDS; POTENTIAL REVI8 SION.— 

9 (1) REVIEW.—Not later than 90 days after the 

10 date of the enactment of this Act, the Commission 

11 shall complete a review of the standards contained in 

12 the regulations issued by the Commission under sec13 tion 501 of the Gramm-Leach-Bliley Act (15 U.S.C. 

14 6801) to determine whether such standards require 

15 covered consumer reporting agencies and covered 

16 service providers to maintain sufficient safeguards to 

17 protect customer records and information against 

18 cyber attacks and related threats. 

19 (2) REVISION.—If the Commission determines 

20 in the review completed under paragraph (1) that 

21 the standards contained in the regulations issued by 

22 the Commission under section 501 of the Gramm23 Leach-Bliley Act (15 U.S.C. 6801) do not require 

24 covered consumer reporting agencies and covered 

25 service providers to maintain sufficient safeguards to 

26 protect customer records and information against 


amozie on DSK30RV082PROD with BILLS
3 

•HR 5166 IH

1 cyber attacks and related threats, not later than 180 

2 days after the date of the completion of the review, 

3 the Commission shall, pursuant to section 553 of 

4 title 5, United States Code, revise such regulations 

5 so as to provide for standards applicable to covered 

6 consumer reporting agencies and covered service 

7 providers that require such agencies and providers to 

8 maintain sufficient safeguards to protect customer 

9 records and information against cyber attacks and 

10 related threats. 

11 (b) INVESTIGATIONS.— 

12 (1) INITIAL INVESTIGATION.— 

13 (A) IN GENERAL.—Not later than 18 

14 months after the date described in subpara15 graph (B), the Commission shall complete an 

16 investigation of each person or entity that, as of 

17 the date described in such subparagraph, is a 

18 covered consumer reporting agency or covered 

19 service provider, to determine whether such 

20 agency or provider is in compliance with the 

21 regulations issued by the Commission under 

22 section 501 of the Gramm-Leach-Bliley Act (15 

23 U.S.C. 6801). 

24 (B) DATE DESCRIBED.—The date de25 scribed in this subparagraph is— 


amozie on DSK30RV082PROD with BILLS
4 

•HR 5166 IH

1 (i) if no revision of such regulations is 

2 required by paragraph (2) of subsection 

3 (a), the date of the completion of the re4 view required by paragraph (1) of such 

5 subsection; or 

6 (ii) if revision of such regulations is 

7 required by paragraph (2) of such sub8 section, the date on which the Commission 

9 issues the revised regulations. 

10 (2) SUBSEQUENT INVESTIGATIONS.—From time 

11 to time after the date that is 18 months after the 

12 date described in paragraph (1)(B), the Commission 

13 shall complete an investigation of each covered con14 sumer reporting agency and each covered service 

15 provider to determine whether such agency or pro16 vider is in compliance with the regulations issued by 

17 the Commission under section 501 of the Gramm18 Leach-Bliley Act (15 U.S.C. 6801). 

19 SEC. 3. ENFORCEMENT BY FEDERAL TRADE COMMISSION. 

20 (a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 

21 A violation of a regulation issued by the Commission 

22 under section 501 of the Gramm-Leach-Bliley Act (15 

23 U.S.C. 6801) by a covered consumer reporting agency or 

24 a covered service provider shall be treated as a violation 

25 of a rule under section 18(a)(1)(B) of the Federal Trade 


amozie on DSK30RV082PROD with BILLS
5 

•HR 5166 IH

1 Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding un2 fair or deceptive acts or practices. 

3 (b) POWERS OF COMMISSION.—The Commission 

4 shall enforce, with respect to covered consumer reporting 

5 agencies and covered service providers, the regulations 

6 issued by the Commission under section 501 of the 

7 Gramm-Leach-Bliley Act (15 U.S.C. 6801) in the same 

8 manner, by the same means, and with the same jurisdic9 tion, powers, and duties as though all applicable terms and 

10 provisions of the Federal Trade Commission Act (15 

11 U.S.C. 41 et seq.) were incorporated into and made a part 

12 of such section. Any covered consumer reporting agency 

13 or covered service provider that violates such a regulation 

14 shall be subject to the penalties and entitled to the privi15 leges and immunities provided in the Federal Trade Com16 mission Act. 

17 SEC. 4. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 

18 (a) IN GENERAL.—In any case in which the attorney 

19 general of a State, or an official or agency of a State, 

20 has reason to believe that an interest of the residents of 

21 such State has been or is threatened or adversely affected 

22 by an act or practice by a covered consumer reporting 

23 agency or covered service provider in violation of a regula24 tion issued by the Commission under section 501 of the 

25 Gramm-Leach-Bliley Act (15 U.S.C. 6801), the State, as 


amozie on DSK30RV082PROD with BILLS
6 

•HR 5166 IH

1 parens patriae, may bring a civil action on behalf of the 

2 residents of the State in an appropriate district court of 

3 the United States to— 

4 (1) enjoin such act or practice; 

5 (2) enforce compliance with such regulation; 

6 (3) obtain damages, restitution, or other com7 pensation on behalf of residents of the State; or 

8 (4) obtain such other legal and equitable relief 

9 as the court may consider to be appropriate. 

10 (b) NOTICE.—Before filing an action under this sec11 tion, the attorney general, official, or agency of the State 

12 involved shall provide to the Commission a written notice 

13 of such action and a copy of the complaint for such action. 

14 If the attorney general, official, or agency determines that 

15 it is not feasible to provide the notice described in this 

16 subsection before the filing of the action, the attorney gen17 eral, official, or agency shall provide written notice of the 

18 action and a copy of the complaint to the Commission im19 mediately upon the filing of the action. 

20 (c) AUTHORITY OF COMMISSION.— 

21 (1) IN GENERAL.—On receiving notice under 

22 subsection (b) of an action under this section, the 

23 Commission shall have the right— 

24 (A) to intervene in the action; 


amozie on DSK30RV082PROD with BILLS
7 

•HR 5166 IH

1 (B) upon so intervening, to be heard on all 

2 matters arising therein; and 

3 (C) to file petitions for appeal. 

4 (2) LIMITATION ON STATE ACTION WHILE FED5 ERAL ACTION IS PENDING.—If the Commission or 

6 the Attorney General of the United States has insti7 tuted a civil action for violation of a regulation 

8 issued by the Commission under section 501 of the 

9 Gramm-Leach-Bliley Act (15 U.S.C. 6801) by a cov10 ered consumer reporting agency or covered service 

11 provider (referred to in this paragraph as the ‘‘Fed12 eral action’’), no State attorney general, official, or 

13 agency may bring an action under this section dur14 ing the pendency of the Federal action against any 

15 defendant named in the complaint in the Federal ac16 tion for any violation of such regulation alleged in 

17 such complaint. 

18 (d) RULE OF CONSTRUCTION.—For purposes of 

19 bringing a civil action under this section, nothing in this 

20 Act shall be construed to prevent an attorney general, offi21 cial, or agency of a State from exercising the powers con22 ferred on the attorney general, official, or agency by the 

23 laws of such State to conduct investigations, administer 

24 oaths and affirmations, or compel the attendance of witVerDate Sep 11 2014 21:46 Mar 09, 2018 Jkt 079200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H5166.IH H5166

amozie on DSK30RV082PROD with BILLS
8 

•HR 5166 IH

1 nesses or the production of documentary and other evi2 dence. 

3 SEC. 5. DEFINITIONS. 

4 In this Act: 

5 (1) COMMISSION.—The term ‘‘Commission’’ 

6 means the Federal Trade Commission. 

7 (2) COVERED CONSUMER REPORTING AGEN8 CY.—The term ‘‘covered consumer reporting agency’’ 

9 means a consumer reporting agency that compiles 

10 and maintains files on consumers on a nationwide 

11 basis (as defined in section 603(p) of the Fair Cred12 it Reporting Act (15 U.S.C. 1681a(p))). 

13 (3) COVERED SERVICE PROVIDER.—The term 

14 ‘‘covered service provider’’ means any person or enti15 ty that is a service provider (as defined in section 

16 314.2 of title 16, Code of Federal Regulations) 

17 through provision of services to a covered consumer 

18 reporting agency. 

Æ 


amozie on DSK30RV082PROD with BILLS