IB 

Union Calendar No. 487 

115TH CONGRESS 

2D SESSION H. R. 5192 

[Report No. 115–636] 

To authorize the Commissioner of Social Security to provide confirmation 

of fraud protection data to certain permitted entities, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

MARCH 7, 2018 

Mr. CURBELO of Florida (for himself, Mr. MARCHANT, Ms. SINEMA, and Mr. 

HULTGREN) introduced the following bill; which was referred to the Committee on Ways and Means 

APRIL 13, 2018 

Additional sponsors: Mr. ROYCE of California, Mr. MESSER, Mr. MCHENRY, 

Mr. HIMES, Mr. PERLMUTTER, Mr. DUFFY, Mr. HUIZENGA, Mr. 

DELANEY, Mr. SESSIONS, Mr. TIPTON, and Mr. YOUNG of Iowa 

APRIL 13, 2018 

Reported with an amendment, committed to the Committee of the Whole 

House on the State of the Union, and ordered to be printed 

[Strike out all after the enacting clause and insert the part printed in italic] 

[For text of introduced bill, see copy of bill as introduced on March 7, 2018] 


khammond on DSK30JT082PROD with BILLS
2 

•HR 5192 RH

A BILL 

To authorize the Commissioner of Social Security to provide 

confirmation of fraud protection data to certain permitted entities, and for other purposes. 


khammond on DSK30JT082PROD with BILLS
3 

•HR 5192 RH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Protecting Children from 

5 Identity Theft Act’’. 

6 SEC. 2. REDUCING IDENTITY FRAUD. 

7 (a) PURPOSE.—The purpose of this section is to reduce 

8 the prevalence of synthetic identity fraud, which 

9 disproportionally affects vulnerable populations, such as 

10 minors and recent immigrants, by facilitating the valida11 tion by permitted entities of fraud protection data, pursu12 ant to electronically received consumer consent, through use 

13 of a database maintained by the Commissioner. 

14 (b) DEFINITIONS.—In this section: 

15 (1) COMMISSIONER.—The term ‘‘Commissioner’’ 

16 means the Commissioner of the Social Security Ad17 ministration. 

18 (2) FINANCIAL INSTITUTION.—The term ‘‘finan19 cial institution’’ has the meaning given the term in 

20 section 509 of the Gramm-Leach-Bliley Act (15 

21 U.S.C. 6809). 

22 (3) FRAUD PROTECTION DATA.—The term ‘‘fraud 

23 protection data’’ means a combination of the fol24 lowing information with respect to an individual: 


khammond on DSK30JT082PROD with BILLS
4 

•HR 5192 RH

1 (A) The name of the individual (including 

2 the first name and any family forename or sur3 name of the individual). 

4 (B) The Social Security account number of 

5 the individual. 

6 (C) The date of birth (including the month, 

7 day, and year) of the individual. 

8 (4) PERMITTED ENTITY.—The term ‘‘permitted 

9 entity’’ means a financial institution or a service 

10 provider, subsidiary, affiliate, agent, contractor, or 

11 assignee of a financial institution. 

12 (c) EFFICIENCY.— 

13 (1) RELIANCE ON EXISTING METHODS.—The 

14 Commissioner shall evaluate the feasibility of making 

15 modifications to any database that is in existence as 

16 of the date of enactment of this Act or a similar re17 source such that the database or resource— 

18 (A) is reasonably designed to effectuate the 

19 purpose of this section; and 

20 (B) meets the requirements of subsection (d). 

21 (2) EXECUTION.—The Commissioner shall estab22 lish a system to carry out subsection (a), in accord23 ance with section 1106 of the Social Security Act. In 

24 doing so, the Commissioner shall make the modifica25 tions necessary to any database that is in existence as 


khammond on DSK30JT082PROD with BILLS
5 

•HR 5192 RH

1 of the date of enactment of this Act or similar re2 source, or develop a database or similar resource. 

3 (d) PROTECTION OF VULNERABLE CONSUMERS.—The 

4 database or similar resource described in subsection (c) 

5 shall— 

6 (1) compare fraud protection data provided in 

7 an inquiry by a permitted entity against such infor8 mation maintained by the Commissioner in order to 

9 confirm (or not confirm) the validity of the informa10 tion provided, and in such a manner as to deter 

11 fraudulent use of the database or similar resource; 

12 (2) be scalable and accommodate reasonably an13 ticipated volumes of verification requests from per14 mitted entities with commercially reasonable uptime 

15 and availability; and 

16 (3) allow permitted entities to submit— 

17 (A) one or more individual requests elec18 tronically for real-time machine-to-machine (or 

19 similar functionality) accurate responses; and 

20 (B) multiple requests electronically, such as 

21 those provided in a batch format, for accurate 

22 electronic responses within a reasonable period of 

23 time from submission, not to exceed 24 hours. 

24 (e) CERTIFICATION REQUIRED.—Before providing con25 firmation of fraud protection data to a permitted entity, 


khammond on DSK30JT082PROD with BILLS
6 

•HR 5192 RH

1 the Commissioner shall ensure that the Commissioner has 

2 a certification from the permitted entity that is dated not 

3 more than 2 years before the date on which that confirma4 tion is provided that includes the following declarations: 

5 (1) The entity is a permitted entity. 

6 (2) The entity is in compliance with this section. 

7 (3) The entity is, and will remain, in compli8 ance with its privacy and data security requirements, 

9 as described in title V of the Gramm-Leach-Bliley Act 

10 (15 U.S.C. 6801 et seq.) and as required by the Com11 missioner, with respect to information the entity re12 ceives from the Commissioner pursuant to this sec13 tion. 

14 (4) The entity will retain sufficient records to 

15 demonstrate its compliance with its certification and 

16 this section for a period of not less than 2 years. 

17 (f) CONSUMER CONSENT.— 

18 (1) IN GENERAL.—Notwithstanding any other 

19 provision of law or regulation, a permitted entity 

20 may submit a request to the database or similar re21 source described in subsection (c) only— 

22 (A) pursuant to the written, including elec23 tronic, consent received by a permitted entity 

24 from the individual who is the subject of the re25 quest; and 


khammond on DSK30JT082PROD with BILLS
7 

•HR 5192 RH

1 (B) in connection with any circumstance 

2 described in section 604 of the Fair Credit Re3 porting Act (15 U.S.C. 1681b). 

4 (2) ELECTRONIC CONSENT REQUIREMENTS.—For 

5 a permitted entity to use the consent of an individual 

6 received electronically pursuant to paragraph (1)(A), 

7 the permitted entity must obtain the individual’s elec8 tronic signature, as defined in section 106 of the Elec9 tronic Signatures in Global and National Commerce 

10 Act (15 U.S.C. 7006). Permitted entities must develop 

11 and use an electronic signature process in accordance 

12 with all Federal laws and requirements as designated 

13 by the Commissioner. 

14 (3) EFFECTUATING ELECTRONIC CONSENT.—No 

15 provision of law or requirement, including section 

16 552a of title 5, United States Code, shall prevent the 

17 use of electronic consent for purposes of this sub18 section or for use in any other consent based 

19 verification under the discretion of the Commissioner. 

20 (g) COMPLIANCE AND ENFORCEMENT.— 

21 (1) AUDITS AND MONITORING.— 

22 (A) IN GENERAL.—The Commissioner— 

23 (i) shall conduct audits and moni24 toring to— 


khammond on DSK30JT082PROD with BILLS
8 

•HR 5192 RH

1 (I) ensure proper use by permitted 

2 entities of the database or similar re3 source described in subsection (c); and 

4 (II) deter fraud and misuse by 

5 permitted entities with respect to the 

6 database or similar resource described 

7 in subsection (c); and 

8 (ii) may terminate services for any 

9 permitted entity that prevents or refuses to 

10 allow the Commissioner to carry out the ac11 tivities described in clause (i) and may ter12 minate or suspend services for any per13 mitted entity as necessary to enforce any 

14 violation of this section or of any certifi15 cation made under this section. 

16 (2) ENFORCEMENT.— 

17 (A) IN GENERAL.—Notwithstanding any 

18 other provision of law, including the matter pre19 ceding paragraph (1) of section 505(a) of the 

20 Gramm-Leach-Bliley Act (15 U.S.C. 6805(a)), 

21 any violation of this section and any certifi22 cation made under this section shall be enforced 

23 in accordance with paragraphs (1) through (7) 

24 of such section 505(a) by the agencies described 

25 in those paragraphs. 


khammond on DSK30JT082PROD with BILLS
9 

•HR 5192 RH

1 (B) RELEVANT INFORMATION.—Upon dis2 covery by the Commissioner of any violation of 

3 this section or any certification made under this 

4 section, the Commissioner shall forward any rel5 evant information pertaining to that violation to 

6 the appropriate agency described in subpara7 graph (A) for evaluation by the agency for pur8 poses of enforcing this section. 

9 (h) RECOVERY OF COSTS.— 

10 (1) IN GENERAL.— 

11 (A) IN GENERAL.—Amounts obligated to 

12 carry out this section shall be fully recovered 

13 from the users of the database or verification sys14 tem by way of advances, reimbursements, user 

15 fees, or other recoveries as determined by the 

16 Commissioner. The funds recovered under this 

17 paragraph shall be deposited as an offsetting col18 lection to the account providing appropriations 

19 for the Social Security Administration, to be 

20 used for the administration of this section with21 out fiscal year limitation. 

22 (B) PRICES FIXED BY COMMISSIONER.—The 

23 Commissioner shall establish the amount to be 

24 paid by the users under this paragraph, includ25 ing the costs of any services or work performed, 


khammond on DSK30JT082PROD with BILLS
10 

•HR 5192 RH

1 such as any appropriate upgrades, maintenance, 

2 and associated direct and indirect administra3 tive costs, in support of carrying out the pur4 poses described in this section, by reimbursement 

5 or in advance as determined by the Commis6 sioner. The amount of such prices shall be peri7 odically adjusted by the Commissioner to ensure 

8 that amounts collected are sufficient to fully off9 set the cost of the administration of this section. 

10 (2) INITIAL DEVELOPMENT.—The Commissioner 

11 shall not begin development of a verification system 

12 to carry out this section until the Commissioner de13 termines that amounts equal to at least 50 percent of 

14 program start-up costs have been collected under 

15 paragraph (1). 

16 (3) EXISTING RESOURCES.—The Commissioner 

17 of Social Security may use funds designated for infor18 mation technology modernization to carry out this 

19 section, but in all cases shall be fully reimbursed 

20 under paragraph (1)(A). 

21 (4) ANNUAL REPORT.—The Commissioner of So22 cial Security shall annually submit to the Committee 

23 on Ways and Means of the House of Representatives 

24 and the Committee on Finance of the Senate a report 

25 on the amount of indirect costs to the Social Security 


khammond on DSK30JT082PROD with BILLS
11 

•HR 5192 RH

1 Administration arising as a result of the implementa2 tion of this section. 


khammond on DSK30JT082PROD with BILLS
Union Calendar No. 487 

115TH CONGRESS 

2D SESSION H. R. 5192 

[Report No. 115–636] 

A BILL 

To authorize the Commissioner of Social Security 

poses. to certain permitted entities, and for other purto provide confirmation of fraud protection data 

APRIL 13, 2018 

Reported with an amendment, committed to the Comand ordered to be printed mittee of the Whole House on the State of the Union, 


khammond on DSK30JT082PROD with BILLS