II 

110TH CONGRESS 

1ST SESSION S. 1178 

To strengthen data protection and safeguards, require data breach 

notification, and further prevent identity theft. 

IN THE SENATE OF THE UNITED STATES 

APRIL 20, 2007 

Mr. INOUYE (for himself, Mr. STEVENS, Mr. PRYOR, and Mr. SMITH) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation 

A BILL 

To strengthen data protection and safeguards, require data 

breach notification, and further prevent identity theft. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 

4 (a) SHORT TITLE.—This Act may be cited as the 

5 ‘‘Identity Theft Prevention Act’’. 

6 (b) TABLE OF CONTENTS.—The table of contents for 

7 this Act is as follows: 

Sec. 1. Short title; table of contents. 

Sec. 2. Protection of sensitive personal information. 

Sec. 3. Notification of security breach risk. 

Sec. 4. Security freeze. 

Sec. 5. Information security and consumer privacy advisory committee. 

Sec. 6. Related crime study. 


jlentini on PROD1PC65 with BILLS
2 

•S 1178 IS 

Sec. 7. Prohibition on technology mandates. 

Sec. 8. Enforcement. 

Sec. 9. Enforcement by State attorneys general. 

Sec. 10. Preemption of State law. 

Sec. 11. Definitions. 

Sec. 12. Authorization of appropriations. 

Sec. 13. Effective dates. 

1 SEC. 2. PROTECTION OF SENSITIVE PERSONAL INFORMA2 TION. 

3 (a) IN GENERAL.—A covered entity shall develop, im4 plement, maintain, and enforce a written program for the 

5 security of sensitive personal information the entity col6 lects, maintains, sells, transfers, or disposes of, containing 

7 administrative, technical, and physical safeguards— 

8 (1) to ensure the security and confidentiality of 

9 such data; 

10 (2) to protect against any anticipated threats or 

11 hazards to the security or integrity of such data; and 

12 (3) to protect against unauthorized access to, or 

13 use of, such data that could result in substantial 

14 harm to any individual. 

15 (b) COMPLIANCE WITH FTC STANDARDS RE16 QUIRED.—A covered entity that is in full compliance with 

17 the requirements of the Commission’s rules on Standards 

18 for Safeguarding Customer Information and Disposal of 

19 Consumer Report Information and Records is deemed to 

20 be in compliance with the requirements of subsection (a). 

21 (c) REGULATIONS.—Not later than 1 year after the 

22 date of enactment of this Act, the Commission shall proVerDate Aug 31 2005 18:10 Apr 22, 2007 Jkt 059200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S1178.IS S1178

jlentini on PROD1PC65 with BILLS
3 

•S 1178 IS 

1 mulgate regulations, in accordance with section 553 of 

2 title 5, United States Code, that require procedures for 

3 authenticating the credentials of any third party to which 

4 sensitive personal information is to be transferred or sold 

5 by a covered entity. 

6 SEC. 3. NOTIFICATION OF SECURITY BREACH RISK. 

7 (a) SECURITY BREACHES AFFECTING 1,000 OR

8 MORE INDIVIDUALS.— 

9 (1) IN GENERAL.—If a covered entity discovers 

10 a breach of security that affects 1,000 or more indi11 viduals, then, before conducting the notification re12 quired by subsection (c), it shall— 

13 (A) report the breach to the Commission 

14 (or other appropriate Federal regulator under 

15 section 8); and 

16 (B) notify all consumer reporting agencies 

17 described in section 603(p)(1) of the Fair Cred18 it Reporting Act (15 U.S.C. 1681a(p)(1)) of the 

19 breach. 

20 (2) FTC WEBSITE PUBLICATION.—Whenever 

21 the Commission receives a report under paragraph 

22 (1)(A), after the notification required by subsection 

23 (c) has begun, it shall post a report of the breach 

24 of security on its website without disclosing any senVerDate Aug 31 2005 18:10 Apr 22, 2007 Jkt 059200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S1178.IS S1178

jlentini on PROD1PC65 with BILLS
4 

•S 1178 IS 

1 sitive personal information pertaining to the individ2 uals affected (including their names). 

3 (3) CONTENTS OF REPORT.—The report de4 scribed in paragraph (2) shall include— 

5 (A) the number of individuals impacted by 

6 the breach of security; and 

7 (B) confirmation that the covered entity 

8 has taken action to comply with the require9 ments of subsection (c). 

10 (b) SECURITY BREACHES AFFECTING FEWER THAN

11 1,000 INDIVIDUALS.— 

12 (1) IN GENERAL.—If a covered entity discovers 

13 a breach of security that affects the sensitive per14 sonal information of fewer than 1,000 individuals 

15 and determines that the breach of security does not 

16 create a reasonable risk of identity theft, it shall re17 port the breach to the Commission (or other appro18 priate Federal regulator under section 8). 

19 (2) REPORT CONTENTS.—The report shall con20 tain the number of individuals affected and the type 

21 of information that was exposed because of the 

22 breach of security. 

23 (3) LIMITATION ON COMMISSION RESPONSE.— 

24 With respect to a report under paragraph (1) reVerDate Aug 31 2005 18:10 Apr 22, 2007 Jkt 059200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S1178.IS S1178

jlentini on PROD1PC65 with BILLS
5 

•S 1178 IS 

1 ceived by the Commission, the Commission may 

2 not— 

3 (A) disclose any sensitive personal informa4 tion relating to the individuals (including their 

5 names); or 

6 (B) publish such a report on its website. 

7 (4) DETERMINATION OF REASONABLE RISK OF

8 IDENTITY THEFT.— 

9 (A) IN GENERAL.—If a covered entity can10 not make a determination as to whether the 

11 breach of security creates a reasonable risk of 

12 identity theft, it may request guidance from the 

13 Commission in writing as to a suggested course 

14 of action that may be required under this Act. 

15 (B) TIME AND MANNER OF RESPONSE.— 

16 The Commission shall respond to a request 

17 from a covered entity under subparagraph (A) 

18 in writing within 5 business days after the date 

19 on which it receives the request. 

20 (c) NOTIFICATION OF CONSUMERS.— 

21 (1) IN GENERAL.—A covered entity shall use 

22 due diligence to investigate any suspected breach of 

23 security affecting sensitive personal information 

24 maintained by that covered entity. If, after the exer25 cise of such due diligence, the covered entity disVerDate Aug 31 2005 18:10 Apr 22, 2007 Jkt 059200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S1178.IS S1178

jlentini on PROD1PC65 with BILLS
6 

•S 1178 IS 

1 covers a breach of security and determines that the 

2 breach of security creates a reasonable risk of iden3 tity theft, the covered entity shall notify each such 

4 individual. In determining whether a reasonable risk 

5 of identity theft exists, a covered entity shall con6 sider such factors as whether— 

7 (A) data containing sensitive personal in8 formation is usable or could be made usable by 

9 an unauthorized third party; and 

10 (B) the data is in the possession and con11 trol of an unauthorized third party. 

12 (2) DIRECT RELATIONSHIP WITH CONSUMER

13 REQUIRED.—The notice required by paragraph (1) 

14 must be provided by the entity which has a direct 

15 relationship with the parties whose information was 

16 subject to the breach. Unless there is an agreement 

17 to the contrary, the entity providing the notice shall 

18 be compensated for the cost of the notice required 

19 by the covered entity subject to the breach of secu20 rity. 

21 (d) METHODS OF NOTIFICATION; NOTICE CON22 TENT.— 

23 (1) IN GENERAL.—A covered entity shall pro24 vide notice pursuant to subsection (c) by— 

25 (A) written notice; 


jlentini on PROD1PC65 with BILLS
7 

•S 1178 IS 

1 (B) electronic notice, if such notice is con2 sistent with the provisions of the Electronic 

3 Signatures in Global and National Commerce 

4 Act (15 U.S.C. 7001 et seq.); or 

5 (C) substitute notice, if the covered entity 

6 does not have sufficient contact information for 

7 the individuals to be notified, consisting of— 

8 (i) notice by electronic mail when the 

9 covered entity has an electronic mail ad10 dress for affected individuals; 

11 (ii) conspicuous posting of the secu12 rity breach on the Internet website of the 

13 covered entity for a reasonable period, if 

14 the covered entity maintains a website (ex15 cept that the information posted may not 

16 disclose any sensitive personal information 

17 pertaining to the affected individuals (in18 cluding their names)); and 

19 (iii) notification to major statewide 

20 media of the breach of security. 

21 (2) CONTENT OF NOTICE.—The notice required 

22 under paragraphs (1)(A) and (B) shall consist of— 

23 (A) the name of the individual whose infor24 mation was the subject of the breach of secu25 rity; 


jlentini on PROD1PC65 with BILLS
8 

•S 1178 IS 

1 (B) the name of the covered entity that 

2 was the subject of the breach of security; 

3 (C) a description of the categories of sen4 sitive personal information of the individual 

5 that were the subject of the breach of security; 

6 (D) the date of discovery of such breach of 

7 security; and 

8 (E) the toll-free numbers necessary to con9 tact— 

10 (i) each covered entity that was the 

11 subject of the breach of security; 

12 (ii) each nationwide credit reporting 

13 agency; and 

14 (iii) the Commission. 

15 (e) TIMING OF NOTIFICATION.— 

16 (1) IN GENERAL.—Except as provided in para17 graph (2), notice required by subsection (c) shall be 

18 given— 

19 (A) in a manner that is consistent with 

20 any measures necessary to determine the scope 

21 of the breach and restore the security and in22 tegrity of the data system; and 

23 (B) in the most expeditious manner prac24 ticable, but not later than 25 business days 


jlentini on PROD1PC65 with BILLS
9 

•S 1178 IS 

1 after the date on which the breach of security 

2 was discovered by the covered entity. 

3 (2) LAW ENFORCEMENT AND NATIONAL OR

4 HOMELAND SECURITY RELATED DELAYS.—Notwith5 standing paragraph (1), the giving of notice as re6 quired by that paragraph may be delayed for a rea7 sonable period of time if— 

8 (A) a Federal or State law enforcement 

9 agency determines that the timely giving of no10 tice under subsections (a) and (c), as required 

11 by paragraph (1), would materially impede a 

12 civil or criminal investigation; or 

13 (B) a Federal national security or home14 land security agency determines that such time15 ly giving of notice would threaten national or 

16 homeland security. 

17 (f) CERTAIN SERVICE PROVIDERS.—Section 2 and 

18 subsections (a), (b), and (c) of this section do not apply 

19 to electronic communication of a third party stored by a 

20 cable operator, information service, or telecommunications 

21 carrier in the network of such operator, service or carrier 

22 in the course of transferring or transmitting such commu23 nication. Any term used in this subsection that is defined 

24 in the Communications Act of 1934 (47 U.S.C. 151 et 

25 seq.) has the meaning given it in that Act. 


jlentini on PROD1PC65 with BILLS
10 

•S 1178 IS 

1 SEC. 4. SECURITY FREEZE. 

2 (a) IN GENERAL.— 

3 (1) EMPLACEMENT.—A consumer may place a 

4 security freeze on the consumer’s credit report by 

5 making a request to a consumer credit reporting 

6 agency in writing, by telephone, or through a secure 

7 electronic connection if such a connection is made 

8 available by the consumer credit reporting agency. 

9 (2) CONSUMER DISCLOSURE.—If a consumer 

10 requests a security freeze, the consumer credit re11 porting agency shall disclose to the consumer the 

12 process of placing and removing the security freeze. 

13 A consumer credit reporting agency may not imply 

14 or inform a consumer that the placement or pres15 ence of a security freeze on the consumer’s credit re16 port may negatively affect the consumer’s credit 

17 score. 

18 (b) EFFECT OF SECURITY FREEZE.— 

19 (1) RELEASE OF INFORMATION BLOCKED.—If a 

20 security freeze is in place on a consumer’s credit re21 port, a consumer credit reporting agency may not 

22 release the credit report for consumer credit review 

23 purposes to a third party without prior express au24 thorization from the consumer. 

25 (2) INFORMATION PROVIDED TO THIRD PAR26 TIES.—Paragraph (1) does not prevent a consumer 


jlentini on PROD1PC65 with BILLS
11 

•S 1178 IS 

1 credit reporting agency from advising a third party 

2 that a security freeze is in effect with respect to the 

3 consumer’s credit report. If a third party, in connec4 tion with a request for information in any cir5 cumstance under which a consumer credit reporting 

6 agency may furnish a consumer report under section 

7 604(a) of the Fair Credit Reporting Act (15 U.S.C. 

8 1681b), requests access to a consumer credit report 

9 on which a security freeze is in place, the third party 

10 may treat any application associated with the re11 quest as incomplete. 

12 (3) CONSUMER CREDIT SCORE NOT AF13 FECTED.—The placement of a security freeze on a 

14 credit report may not be taken into account for any 

15 purpose in determining the credit score of the con16 sumer to whom the account relates. 

17 (c) REMOVAL; TEMPORARY SUSPENSION.— 

18 (1) IN GENERAL.—Except as provided in para19 graphs (2)(B) and (4), a security freeze shall remain 

20 in place until the consumer requests that the secu21 rity freeze be removed. A consumer may remove a 

22 security freeze on the consumer’s credit report by 

23 making a request to a consumer credit reporting 

24 agency in writing, by telephone, or through a secure 


jlentini on PROD1PC65 with BILLS
12 

•S 1178 IS 

1 electronic connection made available by the con2 sumer credit reporting agency. 

3 (2) CONDITIONS.—A consumer credit reporting 

4 agency may remove a security freeze placed on a 

5 consumer’s credit report only— 

6 (A) upon the consumer’s request, pursuant 

7 to paragraph (1); or 

8 (B) if the agency determines that the con9 sumer’s credit report was frozen due to a mate10 rial misrepresentation of fact by the consumer. 

11 (3) NOTIFICATION TO CONSUMER.—If a con12 sumer credit reporting agency intends to remove a 

13 freeze upon a consumer’s credit report pursuant to 

14 paragraph (2)(B) or (4), the consumer credit report15 ing agency shall notify the consumer in writing prior 

16 to removing the freeze on the consumer’s credit re17 port. 

18 (4) TEMPORARY SUSPENSION.—A consumer 

19 may have a security freeze on the consumer’s credit 

20 report temporarily suspended by making a request 

21 to a consumer credit reporting agency in writing or 

22 through a secure electronic connection made avail23 able by the consumer credit reporting agency and— 

24 (A) specifying beginning and ending dates 

25 for the period during which the security freeze 


jlentini on PROD1PC65 with BILLS
13 

•S 1178 IS 

1 is not to apply to that consumer’s credit report; 

2 or 

3 (B) specifying a specific third party to 

4 which access to the credit report may be grant5 ed notwithstanding the freeze. 

6 (d) RESPONSE TIMES; NOTIFICATION OF OTHER EN7 TITIES.— 

8 (1) IN GENERAL.—A consumer credit reporting 

9 agency shall— 

10 (A) place a security freeze on a consumer’s 

11 credit report under subsection (a) no later than 

12 3 business days after receiving a request from 

13 the consumer under subsection (a)(1); 

14 (B) remove a security freeze within 3 busi15 ness days after receiving a request for removal 

16 from the consumer under subsection (c); and 

17 (C) temporarily suspend a security freeze 

18 within 1 business day after receiving a request 

19 under subsection (c)(4). 

20 (2) NOTIFICATION OF OTHER COVERED ENTI21 TIES.—If the consumer requests in writing, by tele22 phone, or by secure electronic connection that other 

23 covered entities be notified of the request, the con24 sumer credit reporting agency shall notify all other 

25 consumer credit reporting agencies described in secVerDate Aug 31 2005 18:10 Apr 22, 2007 Jkt 059200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6201 E:\BILLS\S1178.IS S1178

jlentini on PROD1PC65 with BILLS
14 

•S 1178 IS 

1 tion 603(p)(1) of the Fair Credit Reporting Act (15 

2 U.S.C. 1681a(p)(1)) of the request within 1 day of 

3 receiving the request. 

4 (3) IMPLEMENTATION BY OTHER COVERED EN5 TITIES.—A consumer credit reporting agency that is 

6 notified of a request under paragraph (2) to place, 

7 remove, or temporarily suspend a security freeze on 

8 a consumer’s credit report shall— 

9 (A) ensure the validity of the request, in10 cluding verifying the identity of the requesting 

11 consumer, within 3 business days after receiv12 ing the notification; and 

13 (B) place, remove, or temporarily suspend 

14 the security freeze on that credit report within 

15 3 business days after validating the request, in16 cluding verifying the identity of the requesting 

17 consumer and securing the fee under subsection 

18 (h)(1), if applicable. 

19 (e) CONFIRMATION.—Except as provided in sub20 section (c)(3), whenever a consumer credit reporting agen21 cy places, removes, or temporarily suspends a security 

22 freeze on a consumer’s credit report at the request of that 

23 consumer under subsection (a) or (c), respectively, it shall 

24 send a written confirmation thereof to the consumer with25 in 10 business days after placing, removing, or temporarily 


jlentini on PROD1PC65 with BILLS
15 

•S 1178 IS 

1 suspending the security freeze on the credit report. This 

2 subsection does not apply to the placement, removal, or 

3 temporary suspension of a security freeze by a consumer 

4 credit reporting agency because of a notification received 

5 under subsection (d)(2). 

6 (f) ID REQUIRED.—A consumer credit reporting 

7 agency may not place, remove, or temporarily suspend a 

8 security freeze on a consumer’s credit report at the con9 sumer’s request unless the consumer provides proper iden10 tification (within the meaning of section 610(a)(1) of the 

11 Fair Credit Reporting Act (15 U.S.C. 1681(h)(a)(1)) and 

12 the regulations thereunder. 

13 (g) EXCEPTIONS.—This section does not apply to the 

14 use of a consumer credit report by any of the following: 

15 (1) A person or entity, or a subsidiary, affiliate, 

16 or agent of that person or entity, or an assignee of 

17 a financial obligation owing by the consumer to that 

18 person or entity, or a prospective assignee of a fi19 nancial obligation owing by the consumer to that 

20 person or entity in conjunction with the proposed 

21 purchase of the financial obligation, with which the 

22 consumer has or had prior to assignment an account 

23 or contract, including a demand deposit account, or 

24 to whom the consumer issued a negotiable instru25 ment, for the purposes of reviewing the account or 


jlentini on PROD1PC65 with BILLS
16 

•S 1178 IS 

1 collecting the financial obligation owing for the ac2 count, contract, or negotiable instrument. 

3 (2) Any Federal, State or local agency, law en4 forcement agency, trial court, or private collection 

5 agency acting pursuant to a court order, warrant, 

6 subpoena, or other compulsory process. 

7 (3) A child support agency or its agents or as8 signs acting pursuant to subtitle D of title IV of the 

9 Social Security Act (42 U.S.C. et seq.) or similar 

10 State law. 

11 (4) The Department of Health and Human 

12 Services, a similar State agency, or the agents or as13 signs of the Federal or State agency acting to inves14 tigate medicare or medicaid fraud. 

15 (5) The Internal Revenue Service or a State or 

16 municipal taxing authority, or a State department of 

17 motor vehicles, or any of the agents or assigns of 

18 these Federal, State, or municipal agencies acting to 

19 investigate or collect delinquent taxes or unpaid 

20 court orders or to fulfill any of their other statutory 

21 responsibilities. 

22 (6) Any person or entity administering a credit 

23 file monitoring subscription to which the consumer 

24 has subscribed. 


jlentini on PROD1PC65 with BILLS
17 

•S 1178 IS 

1 (7) Any person or entity for the purpose of pro2 viding a consumer with a copy of the consumer’s 

3 credit report or credit score upon the consumer’s re4 quest. 

5 (8) Except when access is restricted to a spe6 cific third party during a temporary suspension of a 

7 security freeze under subsection (c)(4)(B), any per8 son who seeks access during the time period that a 

9 security freeze is temporarily suspended for the pur10 pose of facilitating the extension of credit or another 

11 permissible use. 

12 (h) FEES.— 

13 (1) IN GENERAL.—Except as provided in para14 graph (2), a consumer credit reporting agency may 

15 charge a fee, not in excess of $10, for placing a se16 curity freeze on a consumer’s credit report. A con17 sumer reporting agency may not charge a consumer 

18 for up to 2 requests per year per credit reporting 

19 agency for temporary suspension of a security 

20 freeze. If the consumer requests more than 2 tem21 porary suspensions of a security freeze from a credit 

22 reporting agency within a year, then that consumer 

23 credit reporting agency may charge the consumer a 

24 fee for each such additional request, but that con25 sumer credit reporting agency may not charge in exVerDate Aug 31 2005 18:10 Apr 22, 2007 Jkt 059200 PO 00000 Frm 00017 Fmt 6652 Sfmt 6201 E:\BILLS\S1178.IS S1178

jlentini on PROD1PC65 with BILLS
18 

•S 1178 IS 

1 cess of $5 per request. A consumer credit reporting 

2 agency may not charge a consumer for removing a 

3 security freeze. 

4 (2) FEES PROHIBITED.— 

5 (A) ID THEFT VICTIMS.—A consumer 

6 credit reporting agency may not charge a fee 

7 for placing, removing, or temporarily sus8 pending a security freeze on a consumer’s credit 

9 report if— 

10 (i) the consumer is a victim of identity 

11 theft; 

12 (ii) the consumer requests the security 

13 freeze in writing; 

14 (iii) the consumer has filed a police 

15 report with respect to the theft, or an iden16 tity theft report (as defined in section 

17 603(q)(4) of the Fair Credit Reporting Act 

18 (15 U.S.C. 1681a(q)(4))), within 180 days 

19 after the theft occurred or was discovered 

20 by the consumer; and 

21 (iv) the consumer provides a copy of 

22 the report to the credit reporting agency. 

23 (B) CATEGORICAL CLASSES.—A consumer 

24 credit reporting agency may not charge a fee 

25 for placing, removing, or temporarily susVerDate Aug 31 2005 18:10 Apr 22, 2007 Jkt 059200 PO 00000 Frm 00018 Fmt 6652 Sfmt 6201 E:\BILLS\S1178.IS S1178

jlentini on PROD1PC65 with BILLS
19 

•S 1178 IS 

1 pending a credit freeze on a consumer’s credit 

2 report if the consumer requesting it— 

3 (i) has attained the age of 65 years; 

4 (ii) is on active duty or in the ready 

5 reserve component of an armed force of 

6 the United States; or 

7 (iii) is the spouse of an individual de8 scribed in clause (ii). 

9 (i) LIMITATION ON INFORMATION CHANGES IN FRO10 ZEN REPORTS.— 

11 (1) IN GENERAL.—If a security freeze is in 

12 place on a consumer’s credit report, a consumer 

13 credit reporting agency may not change any of the 

14 following official information in that credit report 

15 without sending a written confirmation of the 

16 change to the consumer within 30 days after the 

17 change is made: 

18 (A) Name. 

19 (B) Date of birth. 

20 (C) Social security account number. 

21 (D) Address. 

22 (2) CONFIRMATION.—Paragraph (1) does not 

23 require written confirmation for technical modifica24 tions of a consumer’s official information, including 

25 name and street abbreviations, complete spellings, or 


jlentini on PROD1PC65 with BILLS
20 

•S 1178 IS 

1 transposition of numbers or letters. In the case of an 

2 address change, the written confirmation shall be 

3 sent to both the new address and to the former ad4 dress. 

5 (j) CERTAIN ENTITY EXEMPTIONS.— 

6 (1) RESELLERS AND OTHER AGENCIES.— 

7 (A) IN GENERAL.—Except as provided in 

8 subparagraph (B), the provisions of this Act do 

9 not apply to a consumer credit reporting agency 

10 that acts only as a reseller of credit information 

11 by assembling and merging information con12 tained in the data base of another consumer 

13 credit reporting agency or multiple consumer 

14 credit reporting agencies, and does not main15 tain a permanent data base of credit informa16 tion from which new consumer credit reports 

17 are produced. 

18 (B) RESELLER TO HONOR FREEZES

19 PLACED BY CONSUMER REPORTING AGEN20 CIES.—Section 4(b), and, to the extent applica21 ble, section 8 of this Act apply to a consumer 

22 credit reporting agency described in subpara23 graph (A). 


jlentini on PROD1PC65 with BILLS
21 

•S 1178 IS 

1 (2) OTHER EXEMPTED ENTITIES.—The fol2 lowing entities are not required to place a security 

3 freeze in a credit report: 

4 (A) A check services or fraud prevention 

5 services company, which issues reports on inci6 dents of fraud or authorizations for the purpose 

7 of approving or processing negotiable instru8 ments, electronic funds transfers, or similar 

9 methods of payments. 

10 (B) A deposit account information service 

11 company, which issues reports regarding ac12 count closures due to fraud, substantial over13 drafts, ATM abuse, or similar negative informa14 tion regarding a consumer, to inquiring banks 

15 or other financial institutions for use only in re16 viewing a consumer request for a deposit ac17 count at the inquiring bank or financial institu18 tion. 

19 SEC. 5. INFORMATION SECURITY AND CONSUMER PRIVACY 

20 ADVISORY COMMITTEE. 

21 (a) ESTABLISHMENT.—Not later than 90 days after 

22 the date of enactment of this Act, the Chairman of the 

23 Commission shall establish the Information Security and 

24 Consumer Privacy Advisory Committee. 


jlentini on PROD1PC65 with BILLS
22 

•S 1178 IS 

1 (b) MEMBERSHIP.—The Advisory Committee shall 

2 consist of 5 members appointed by the Chairman after ap3 propriate consultations with relevant interested parties. Of 

4 the 5 members, the Advisory Committee shall contain at 

5 least 1 member from each of the following groups: 

6 (1) A non-profit consumer advocacy group. 

7 (2) A business organization that collects per8 sonally identifiable information. 

9 (3) A state Attorney General’s office. 

10 (c) CHAIRPERSON.—The Advisory Committee mem11 bers shall elect 1 member to serve as chairperson of the 

12 Advisory Committee. 

13 (d) FUNCTIONS.—The Advisory Committee shall col14 lect, review, disseminate, and advise on best practices for 

15 covered entities to protect sensitive personal information 

16 stored and transferred. 

17 (e) REPORT.—Not later than 12 months after the 

18 date on which the Advisory Committee is established 

19 under subsection (a) and annually thereafter, the Advisory 

20 Committee shall submit to Congress a report on its find21 ings. 

22 (f) NO TERMINATION.—Section 14(a)(2) of the Fed23 eral Advisory Committee Act (5 U.S.C. App 14(a)(2)) 

24 shall not apply to the Advisory Committee. 


jlentini on PROD1PC65 with BILLS
23 

•S 1178 IS 

1 SEC. 6. RELATED CRIME STUDY. 

2 (a) IN GENERAL.—The Federal Trade Commission, 

3 in conjunction with the Department of Justice and other 

4 Federal agencies, shall undertake a study of— 

5 (1) the correlation between methamphetamine 

6 use and identity theft crimes; 

7 (2) the needs of law enforcement to address 

8 methamphetamine crimes related to identity theft, 

9 including production, trafficking, and the purchase 

10 of precursor chemicals; and 

11 (3) the Federal Government’s role in addressing 

12 and deterring identity theft crimes. 

13 (b) REPORT.—Not later than 18 months after the 

14 date of enactment of this Act, the Commission shall sub15 mit a report of its findings and recommendations to the 

16 Congress that includes— 

17 (1) a detailed analysis of the correlation be18 tween methamphetamine use and identity theft 

19 crimes; 

20 (2) the needs of law enforcement to address 

21 methamphetamine crimes related to identity theft in22 cluding production, trafficking, and the purchase of 

23 precursor chemicals related to methamphetamine; 

24 (3) the Federal Government’s role in addressing 

25 and deterring identity theft crimes; and 


jlentini on PROD1PC65 with BILLS
24 

•S 1178 IS 

1 (4) specific recommendations for means of re2 ducing and preventing crimes involving methamphet3 amine and identity theft, including recommendations 

4 for best practices for local law enforcement agencies. 

5 SEC. 7. PROHIBITION ON TECHNOLOGY MANDATES. 

6 Nothing in this Act shall be construed to permit the 

7 Commission to issue regulations that require or impose a 

8 specific technology, product, technological standards, or 

9 solution. 

10 SEC. 8. ENFORCEMENT. 

11 (a) ENFORCEMENT BY COMMISSION.—Except as pro12 vided in subsection (c), this Act shall be enforced by the 

13 Commission. 

14 (b) VIOLATION IS UNFAIR OR DECEPTIVE ACT OR

15 PRACTICE.—The violation of any provision of this Act 

16 shall be treated as an unfair or deceptive act or practice 

17 proscribed under a rule issued under section 18(a)(1)(B) 

18 of the Federal Trade Commission Act (15 U.S.C. 

19 57a(a)(1)(B)). 

20 (c) ENFORCEMENT BY CERTAIN OTHER AGEN21 CIES.—Compliance with this Act shall be enforced exclu22 sively under— 

23 (1) section 8 of the Federal Deposit Insurance 

24 Act (12 U.S.C. 1818), in the case of— 


jlentini on PROD1PC65 with BILLS
25 

•S 1178 IS 

1 (A) national banks, and Federal branches 

2 and Federal agencies of foreign banks, and any 

3 subsidiaries of such entities (except brokers, 

4 dealers, persons providing insurance, invest5 ment companies, and investment advisers), by 

6 the Office of the Comptroller of the Currency; 

7 (B) member banks of the Federal Reserve 

8 System (other than national banks), branches 

9 and agencies of foreign banks (other than Fed10 eral branches, Federal agencies, and insured 

11 State branches of foreign banks), commercial 

12 lending companies owned or controlled by for13 eign banks, organizations operating under sec14 tion 25 or 25A of the Federal Reserve Act (12 

15 U.S.C. 601 and 611), and bank holding compa16 nies and their nonbank subsidiaries or affiliates 

17 (except brokers, dealers, persons providing in18 surance, investment companies and investment 

19 advisers), by the Board of Governors of the 

20 Federal Reserve System; 

21 (C) banks insured by the Federal Deposit 

22 Insurance Corporation (other than members of 

23 the Federal Reserve System), insured State 

24 branches of foreign banks, and any subsidiaries 

25 of such entities (except brokers, dealers, perVerDate Aug 31 2005 18:10 Apr 22, 2007 Jkt 059200 PO 00000 Frm 00025 Fmt 6652 Sfmt 6201 E:\BILLS\S1178.IS S1178

jlentini on PROD1PC65 with BILLS
26 

•S 1178 IS 

1 sons providing insurance, investment companies 

2 and investment advisers), by the Board of Di3 rectors of the Federal Deposit Insurance Cor4 poration; and 

5 (D) savings associations the deposits of 

6 which are insured by the Federal Deposit In7 surance Corporation, and any subsidiaries of 

8 such savings associations (except brokers, deal9 ers, persons providing insurance, investment 

10 companies and investment advisers), by the Di11 rector of the Office of Thrift Supervision; 

12 (2) the Federal Credit Union Act (12 U.S.C. 

13 1751 et seq.) by the Board of the National Credit 

14 Union Administration Board with respect to any 

15 Federal credit union and any subsidiaries of such a 

16 credit union; 

17 (3) the Securities and Exchange Act of 1934 

18 (15 U.S.C. 78a et seq.) by the Securities and Ex19 change Commission with respect to— 

20 (A) a broker or dealer subject to that Act; 

21 (B) an investment company subject to the 

22 Investment Company Act of 1940 (15 U.S.C. 

23 80a–1 et seq.); and 


jlentini on PROD1PC65 with BILLS
27 

•S 1178 IS 

1 (C) an investment advisor subject to the 

2 Investment Advisers Act of 1940 (15 U.S.C. 

3 80b–1 et seq.); and 

4 (4) State insurance law, in the case of any per5 son engaged in providing insurance, by the applica6 ble State insurance authority of the State in which 

7 the person is domiciled. 

8 (d) EXERCISE OF CERTAIN POWERS.—For the pur9 pose of the exercise by any agency referred to in sub10 section (c) of its powers under any Act referred to in that 

11 subsection, a violation of this Act is deemed to be a viola12 tion of a requirement imposed under that Act. In addition 

13 to its powers under any provision of law specifically re14 ferred to in subsection (c), each of the agencies referred 

15 to in that subsection may exercise, for the purpose of en16 forcing compliance with any requirement imposed under 

17 this Act, any other authority conferred on it by law. 

18 (e) OTHER AUTHORITY NOT AFFECTED.—Nothing 

19 in this Act shall be construed to limit or affect in any 

20 way the Commission’s authority to bring enforcement ac21 tions or take any other measure under the Federal Trade 

22 Commission Act (15 U.S.C. 41 et seq.) or any other provi23 sion of law. 

24 (f) COMPLIANCE WITH GRAMM-LEACH-BLILEY

25 ACT.— 


jlentini on PROD1PC65 with BILLS
28 

•S 1178 IS 

1 (1) NOTICE.—Any covered entity that is subject 

2 to the Gramm-Leach-Bliley Act (15 U.S.C. 6801 et 

3 seq.), and gives notice in compliance with the notifi4 cation requirements established for such covered en5 tities under title V of that Act is deemed to be in 

6 compliance with section 3 of this Act. 

7 (2) SAFEGUARDS.—Any covered entity that is 

8 subject to the Gramm-Leach-Bliley Act (15 U.S.C. 

9 6801 et seq.), and fulfills the information protection 

10 requirements established for such entities under title 

11 V of the Act and under section 607(a) of the Fair 

12 Credit Reporting Act (15 U.S.C. 1681e(a)) to pro13 tect sensitive personal information shall be deemed 

14 to be in compliance with section 2 of this Act. 

15 SEC. 9. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 

16 (a) IN GENERAL.—Except as provided in section 

17 8(c), a State, as parens patriae, may bring a civil action 

18 on behalf of its residents in an appropriate state or district 

19 court of the United States to enforce the provisions of this 

20 Act, to obtain damages, restitution, or other compensation 

21 on behalf of such residents, or to obtain such further and 

22 other relief as the court may deem appropriate, whenever 

23 the attorney general of the State has reason to believe that 

24 the interests of the residents of the State have been or 


jlentini on PROD1PC65 with BILLS
29 

•S 1178 IS 

1 are being threatened or adversely affected by a covered 

2 entity that violates this Act or a regulation under this Act. 

3 (b) NOTICE.—The State shall serve written notice to 

4 the Commission (or other appropriate Federal regulator 

5 under section 8) of any civil action under subsection (a) 

6 at least 60 days prior to initiating such civil action. The 

7 notice shall include a copy of the complaint to be filed 

8 to initiate such civil action, except that if it is not feasible 

9 for the State to provide such prior notice, the State shall 

10 provide such notice immediately upon instituting such civil 

11 action. 

12 (c) AUTHORITY TO INTERVENE.—Upon receiving the 

13 notice required by subsection (b), the Commission (or 

14 other appropriate Federal regulator under section 8) may 

15 intervene in such civil action and upon intervening— 

16 (1) be heard on all matters arising in such civil 

17 action; and 

18 (2) file petitions for appeal of a decision in such 

19 civil action. 

20 (d) CONSTRUCTION.—For purposes of bringing any 

21 civil action under subsection (a), nothing in this section 

22 shall prevent the attorney general of a State from exer23 cising the powers conferred on the attorney general by the 

24 laws of such State to conduct investigations or to admin25 ister oaths or affirmations or to compel the attendance 


jlentini on PROD1PC65 with BILLS
30 

•S 1178 IS 

1 of witnesses or the production of documentary and other 

2 evidence. 

3 (e) VENUE; SERVICE OF PROCESS.—In a civil action 

4 brought under subsection (a)— 

5 (1) the venue shall be a judicial district in 

6 which— 

7 (A) the covered entity operates; or 

8 (B) the covered entity was authorized to do 

9 business; 

10 (2) process may be served without regard to the 

11 territorial limits of the district or of the State in 

12 which the civil action is instituted; and 

13 (3) a person who participated with a covered 

14 entity in an alleged violation that is being litigated 

15 in the civil action may be joined in the civil action 

16 without regard to the residence of the person. 

17 (f) LIMITATION ON STATE ACTION WHILE FEDERAL

18 ACTION IS PENDING.—If the Commission (or other appro19 priate Federal agency under section 8) has instituted a 

20 civil action or an administrative action for violation of this 

21 Act, no State attorney general, or official or agency of a 

22 State, may bring an action under this subsection during 

23 the pendency of that action against any defendant named 

24 in the complaint of the Commission or the other agency 

25 for any violation of this Act alleged in the complaint. 


jlentini on PROD1PC65 with BILLS
31 

•S 1178 IS 

1 SEC. 10. PREEMPTION OF STATE LAW. 

2 (a) NOTICE.—This Act preempts any State or local 

3 law, regulation, or rule that requires a covered entity to 

4 notify individuals of breaches of security pertaining to 

5 them. 

6 (b) INFORMATION SECURITY PROGRAMS.—This Act 

7 preempts any State or local law, regulation, or rule that 

8 requires a covered entity to develop, implement, maintain, 

9 or enforce information security programs to which this Act 

10 applies. 

11 (c) SECURITY FREEZE.— 

12 (1) IN GENERAL.—This Act shall not be con13 strued as superseding, altering, or affecting any 

14 statute, regulation, order, or interpretation in effect 

15 in any State with regards to consumer credit report16 ing agencies compliance with a consumer’s request 

17 to place, remove, or temporarily suspend the prohibi18 tion on the release by a credit reporting agency of 

19 information from its files on that consumer, except 

20 to the extent that such statute, regulation, order, or 

21 interpretation is inconsistent with the provisions of 

22 this Act, and then only to the extent of the incon23 sistency. 

24 (2) GREATER PROTECTION UNDER STATE

25 LAW.—For purposes of this section, a State statute, 

26 regulation, order, or interpretation is not inconVerDate Aug 31 2005 18:10 Apr 22, 2007 Jkt 059200 PO 00000 Frm 00031 Fmt 6652 Sfmt 6201 E:\BILLS\S1178.IS S1178

jlentini on PROD1PC65 with BILLS
32 

•S 1178 IS 

1 sistent with the provisions of this subtitle if the pro2 tection of such statute, regulation, order, or inter3 pretation affords any person is greater than the pro4 tection provided under this Act in regards to credit 

5 reporting agencies compliance with a consumer’s re6 quest to place, remove, or temporarily suspend the 

7 prohibition on the release by a consumer credit re8 porting agency of information from its files on that 

9 consumer. 

10 (d) LIMITATION OF PREEMPTION.—Federal preemp11 tion under this Act shall only apply to matters expressly 

12 described in subsection (a) or (b) of this section, and shall 

13 have no effect on other State or local laws, regulations, 

14 or rules over covered entities. 

15 SEC. 11. DEFINITIONS. 

16 In this Act: 

17 (1) BREACH OF SECURITY.—The term ‘‘breach 

18 of security’’ means unauthorized access to and ac19 quisition of data in any form or format containing 

20 sensitive personal information that compromises the 

21 security or confidentiality of such information. 

22 (2) COMMISSION.—The term ‘‘Commission’’ 

23 means the Federal Trade Commission. 

24 (3) CONSUMER CREDIT REPORTING AGENCY.— 

25 The term ‘‘consumer credit reporting agency’’ means 


jlentini on PROD1PC65 with BILLS
33 

•S 1178 IS 

1 any person which, for monetary fees, dues, or on a 

2 cooperative nonprofit basis, regularly engages in 

3 whole or in part in the practice of assembling or 

4 evaluating consumer credit information or other in5 formation on consumers for the purpose of fur6 nishing credit reports to third parties, and which 

7 uses any means or facility of interstate commerce 

8 for the purpose of preparing or furnishing credit re9 ports. 

10 (4) COVERED ENTITY.—The term ‘‘covered en11 tity’’ means a sole proprietorship, partnership, cor12 poration, trust, estate, cooperative, association, or 

13 other commercial entity, and any charitable, edu14 cational, or nonprofit organization, that acquires, 

15 maintains, or utilizes sensitive personal information. 

16 (5) CREDIT REPORT.—The term ‘‘credit report’’ 

17 means a consumer report, as defined in section 

18 603(d) of the Federal Fair Credit Reporting Act (15 

19 U.S.C. 1681a(p)), as well as any associated credit 

20 score that is used or expected to be used or collected 

21 in whole or in part for the purpose of serving as a 

22 factor in establishing a consumer’s eligibility for 

23 credit for personal, family or household purposes. 

24 (6) IDENTITY THEFT.—The term ‘‘identity 

25 theft’’ means the unauthorized acquisition, purchase, 


jlentini on PROD1PC65 with BILLS
34 

•S 1178 IS 

1 sale, or use by any person of an individual’s sensitive 

2 personal information that— 

3 (A) violates section 1028 of title 18, 

4 United States Code, or any provision of State 

5 law in pari materia; or 

6 (B) results in harm to the individual whose 

7 sensitive personal information was used. 

8 (7) REASONABLE RISK OF IDENTITY THEFT.— 

9 The term ‘‘reasonable risk of identity theft’’ means 

10 that the preponderance of the evidence available to 

11 the covered entity that has experienced a breach of 

12 security establishes that identity theft for 1 or more 

13 individuals from the breach of security is forseeable. 

14 (8) REVIEWING THE ACCOUNT.—The term ‘‘re15 viewing the account’’ includes activities related to 

16 account maintenance, monitoring, credit line in17 creases, and account upgrades and enhancements. 

18 (9) SENSITIVE PERSONAL INFORMATION.— 

19 (A) IN GENERAL.—Except as provided in 

20 subparagraphs (B), (C), and (D), the term 

21 ‘‘sensitive personal information’’ means an indi22 vidual’s name, address, or telephone number 

23 combined with 1 or more of the following data 

24 elements related to that individual: 


jlentini on PROD1PC65 with BILLS
35 

•S 1178 IS 

1 (i) Social security account number or 

2 an employer identification number that is 

3 the same as or is derived from the social 

4 security account number of that individual. 

5 (ii) Financial account number, or 

6 credit card or debit card number of such 

7 individual, combined with any required se8 curity code, access code, or password that 

9 would permit access to such individual’s 

10 account. 

11 (iii) State driver’s license identifica12 tion number or State resident identifica13 tion number. 

14 (B) PASSWORD ACCOUNTS.—An account 

15 identifier combined with a password, PIN, or 

16 security code to access the account, for any ac17 count from which any of the following can occur 

18 without further authentication after login: 

19 (i) A financial transaction. 

20 (ii) A purchase of goods or services. 

21 (iii) A charge to a payment card or 

22 account. 

23 (iv) A charge to a credit card or ac24 count. 


jlentini on PROD1PC65 with BILLS
36 

•S 1178 IS 

1 (v) Access to the account that reveals 

2 sufficient information to engage in any ac3 tivity described in clause (i), (ii), (iii), or 

4 (iv). 

5 (C) FTC MODIFICATIONS.—The Commis6 sion may, through a rulemaking proceeding in 

7 accordance with section 553 of title 5, United 

8 States Code, designate other identifying infor9 mation that may be used to effectuate identity 

10 theft as sensitive personal information for pur11 poses of this Act and limit or exclude any infor12 mation described in subparagraph (A) from the 

13 definition of sensitive personal information for 

14 purposes of this Act. 

15 (D) EXCEPTION.—The term ‘‘sensitive 

16 personal information’’ does not include informa17 tion that is obtained from— 

18 (i) Federal, State, or local govern19 ments that has been made available to the 

20 general public; or 

21 (ii) widely distributed media. 

22 The exception provided by this subparagraph 

23 does not apply if the information obtained from 

24 Federal, State, or local government records or 


jlentini on PROD1PC65 with BILLS
37 

•S 1178 IS 

1 widely distributed media is combined with infor2 mation obtained from non-public sources. 

3 (E) PUBLIC RECORDS.—Nothing in this 

4 Act prohibits a covered entity from obtaining, 

5 aggregating, or using sensitive personal infor6 mation it lawfully obtains from public records 

7 in a manner that does not violate this Act. 

8 SEC. 12. AUTHORIZATION OF APPROPRIATIONS. 

9 There are authorized to be appropriated to the Com10 mission $2,000,000 for each of fiscal years 2007 through 

11 2011 to carry out this Act. 

12 SEC. 13. EFFECTIVE DATES. 

13 (a) IN GENERAL.—Except as provided in subsections 

14 (b) and (c), the provisions of this Act take effect upon 

15 its enactment. 

16 (b) IMPLEMENTATION OF SECURITY PROGRAM.—A 

17 covered entity shall implement the program required by 

18 section 2(a) within 6 months after the date of enactment 

19 of this Act. 

20 (c) PROVISIONS REQUIRING RULEMAKING.—The 

21 Commission shall initiate 1 or more rulemaking pro22 ceedings under sections 2(c), 3, and 4 (including a rule23 making proceeding to determine what constitutes proper 

24 identification within the meaning of section 610(a)(1) of 

25 the Fair Credit Reporting Act (15 U.S.C. 1681(h)(a)(1))) 


jlentini on PROD1PC65 with BILLS
38 

•S 1178 IS 

1 within 45 days after the date of enactment of this Act. 

2 The Commission shall promulgate all final rules pursuant 

3 to those rulemaking proceedings within 1 year after the 

4 date of enactment of this Act. The provisions of sections 

5 2(c), 3, and 4 shall take effect on the same date 6 months 

6 after the date on which the Commission promulgates the 

7 last final rule under the proceeding or proceedings com8 menced under the preceding sentence. 

9 (d) PREEMPTION.—Section 10 shall take effect at the 

10 same time as sections 2(c), 3, and 4 take effect. 

Æ 


jlentini on PROD1PC65 with BILLS