II 

Calendar No. 520 

110TH CONGRESS 

1ST SESSION S. 1178 

[Report No. 110–235] 

To strengthen data protection and safeguards, require data breach 

notification, and further prevent identity theft. 

IN THE SENATE OF THE UNITED STATES 

APRIL 20, 2007 

Mr. INOUYE (for himself, Mr. STEVENS, Mr. PRYOR, Mr. SMITH, and Mr. 

NELSON of Florida) introduced the following bill; which was read twice 

and referred to the Committee on Commerce, Science, and Transportation 

DECEMBER 5, 2007 

Reported by Mr. INOUYE, with amendments 

[Omit the part struck through and insert the part printed in italic] 

A BILL 

To strengthen data protection and safeguards, require data 

breach notification, and further prevent identity theft. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 

4 (a) SHORT TITLE.—This Act may be cited as the 

5 ‘‘Identity Theft Prevention Act’’. 


bajohnson on PROD1PC69 with BILLS
2 

•S 1178 RS 

1 (b) TABLE OF CONTENTS.—The table of contents for 

2 this Act is as follows: 

Sec. 1. Short title; table of contents. 

Sec. 2. Protection of sensitive personal information. 

Sec. 3. Notification of security breach risk. 

Sec. 4. Security freeze. 

Sec. 5. Information security and consumer privacy advisory committee. 

Sec. 6. Related crime study. 

Sec. 7. Prohibition on technology mandates. 

Sec. 8. Enforcement. 

Sec. 9. Enforcement by State attorneys general. 

Sec. 10. Preemption of State law. 

Sec. 11. Definitions. 

Sec. 12. Authorization of appropriations. 

Sec. 13. Effective dates. 

Sec. 11. Social Security number protection. 

Sec. 12. Protection of information at Federal agencies. 

Sec. 13. Definitions. 

Sec. 14. Authorization of appropriations. 

Sec. 15. Effective dates. 

3 SEC. 2. PROTECTION OF SENSITIVE PERSONAL INFORMA4 TION. 

5 (a) IN GENERAL.—A covered entity shall develop, im6 plement, maintain, and enforce a written program for the 

7 security of sensitive personal information the entity col8 lects, maintains, sells, transfers, or disposes of, containing 

9 administrative, technical, and physical safeguards— 

10 (1) to ensure the security and confidentiality of 

11 such data; 

12 (2) to protect against any anticipated threats or 

13 hazards to the security or integrity of such data; and 

14 (3) to protect against unauthorized access to, or 

15 use of, such data that could result in substantial 

16 harm to any individual. 


bajohnson on PROD1PC69 with BILLS
3 

•S 1178 RS 

1 (b) COMPLIANCE WITH FTC STANDARDS RE2 QUIRED.—A covered entity that is in full compliance with 

3 the requirements of the Commission’s rules on Standards 

4 for Safeguarding Customer Information and Disposal of 

5 Consumer Report Information and Records is deemed to 

6 be in compliance with the requirements of subsection (a). 

7 (c) REGULATIONS.—Not later than 1 year after the 

8 date of enactment of this Act, the Commission shall pro9 mulgate regulations, in accordance with section 553 of 

10 title 5, United States Code, that require procedures for 

11 authenticating the credentials of any third party to which 

12 sensitive personal information is to be transferred or sold 

13 by a covered entity. 

14 SEC. 3. NOTIFICATION OF SECURITY BREACH RISK. 

15 (a) SECURITY BREACHES AFFECTING 1,000 OR

16 MORE INDIVIDUALS.— 

17 (1) IN GENERAL.—If a covered entity discovers 

18 a breach of security that affects 1,000 or more indi19 viduals, then, before conducting the notification re20 quired by subsection (c), within 5 business days after 

21 the discovery of the breach of security, it shall— 

22 (A) report the breach to the Commission 

23 (or other appropriate Federal regulator under 

24 section 8); and 


bajohnson on PROD1PC69 with BILLS
4 

•S 1178 RS 

1 (B) notify all consumer reporting agencies 

2 described in section 603(p)(1) of the Fair Cred3 it Reporting Act (15 U.S.C. 1681a(p)(1)) of the 

4 breach. 

5 (2) FTC WEBSITE PUBLICATION.—Whenever 

6 the Commission receives a report under paragraph 

7 (1)(A), after the notification required by subsection 

8 (c) has begun, it shall post a report of the breach 

9 of security on its website without disclosing any sen10 sitive personal information pertaining to the individ11 uals affected (including their names). 

12 (3) CONTENTS OF REPORT.—The report de13 scribed in paragraph (2) shall include— 

14 (A) the number of individuals impacted by 

15 the breach of security; and 

16 (B) confirmation that the covered entity 

17 has taken action to comply with the require18 ments of subsection (c). 

19 (b) SECURITY BREACHES AFFECTING FEWER THAN

20 1,000 INDIVIDUALS.— 

21 (1) IN GENERAL.—If a covered entity discovers 

22 a breach of security that affects the sensitive per23 sonal information of fewer than 1,000 1,000, but 

24 more than 50, individuals and determines that the 

25 breach of security does not create a reasonable risk 


bajohnson on PROD1PC69 with BILLS
5 

•S 1178 RS 

1 of identity theft, it shall report the breach to the 

2 Commission (or other appropriate Federal regulator 

3 under section 8). 

4 (2) REPORT CONTENTS.—The report shall con5 tain the number of individuals affected and the type 

6 of information that was exposed because of the 

7 breach of security. 

8 (3) LIMITATION ON COMMISSION RESPONSE.— 

9 With respect to a report under paragraph (1) re10 ceived by the Commission, the Commission may 

11 not— 

12 (A) disclose any sensitive personal informa13 tion relating to the individuals (including their 

14 names); or 

15 (B) publish such a report on its website. 

16 (4) DETERMINATION OF REASONABLE RISK OF

17 IDENTITY THEFT.— 

18 (A) IN GENERAL.—If a covered entity can19 not make a determination as to whether the 

20 breach of security creates a reasonable risk of 

21 identity theft, it may request guidance from the 

22 Commission in writing as to a suggested course 

23 of action that may be required under this Act. 

24 (B) TIME AND MANNER OF RESPONSE.— 

25 The Commission shall respond to a request 


bajohnson on PROD1PC69 with BILLS
6 

•S 1178 RS 

1 from a covered entity under subparagraph (A) 

2 in writing within 5 business days after the date 

3 on which it receives the request. 

4 (c) NOTIFICATION OF CONSUMERS.— 

5 (1) IN GENERAL.—A covered entity shall use 

6 due diligence to investigate any suspected breach of 

7 security affecting sensitive personal information 

8 maintained by that covered entity. If, after the exer9 cise of such due diligence, the covered entity dis10 covers a breach of security and determines that the 

11 breach of security creates a reasonable risk of iden12 tity theft, the covered entity shall notify each such 

13 individual. In determining whether a reasonable risk 

14 of identity theft exists, a covered entity shall con15 sider such factors as whether— 

16 (A) data containing sensitive personal in17 formation is usable or could be made usable by 

18 an unauthorized third party; and 

19 (B) the data is in the possession and con20 trol of an unauthorized third party. 

21 (2) DIRECT RELATIONSHIP WITH CONSUMER

22 REQUIRED.—The Where the breach involves a situa23 tion in which an entity has a direct relationship with 

24 consumers, the notice required by paragraph (1) 

25 must be provided by the entity which has a direct 


bajohnson on PROD1PC69 with BILLS
7 

•S 1178 RS 

1 relationship with the parties whose information was 

2 subject to the breach. Unless there is an agreement 

3 to the contrary, the entity providing the notice shall 

4 be compensated for the cost of the notice required 

5 by the covered entity subject to the breach of secu6 rity. 

7 (3) DETERMINATION OF REASONABLE RISK OF

8 IDENTITY THEFT.— 

9 (A) IN GENERAL.—If a covered entity can10 not make a determination as to whether the 

11 breach of security creates a reasonable risk of 

12 identity theft, it may request guidance from the 

13 Commission or relevant enforcement agency in 

14 writing as to a suggested course of action that 

15 may be required under this Act. 

16 (B) TIME AND MANNER OF RESPONSE.—The 

17 Commission or relevant enforcement agency shall 

18 respond to a request from a covered entity under 

19 subparagraph (A) in writing within 5 business 

20 days after the date on which it receives the re21 quest. 

22 (d) METHODS OF NOTIFICATION; NOTICE CON23 TENT.— 

24 (1) IN GENERAL.—A covered entity shall pro25 vide notice pursuant to subsection (c) by— 


bajohnson on PROD1PC69 with BILLS
8 

•S 1178 RS 

1 (A) written notice; 

2 (B) electronic notice, if such notice is con3 sistent with the provisions of the Electronic 

4 Signatures in Global and National Commerce 

5 Act (15 U.S.C. 7001 et seq.); or 

6 (B) electronic notice, if the primary method 

7 used by the covered entity to communicate with 

8 the individual is by electronic means, or the in9 dividual has consented to receive such notice and 

10 the notice is consistent with the provisions of the 

11 Electronic Signatures in Global and National 

12 Commerce Act (15 U.S.C. 7001 et seq.); or 

13 (C) substitute notice, if the covered entity 

14 does not have sufficient contact information for 

15 the individuals to be notified, consisting of— 

16 (i) notice by electronic mail when the 

17 covered entity has an electronic mail ad18 dress for affected individuals; 

19 (ii) conspicuous posting of the secu20 rity breach on the Internet website of the 

21 covered entity for a reasonable period, if 

22 the covered entity maintains a website (ex23 cept that the information posted may not 

24 disclose any sensitive personal information 


bajohnson on PROD1PC69 with BILLS
9 

•S 1178 RS 

1 pertaining to the affected individuals (in2 cluding their names)); and 

3 (iii) notification to major statewide 

4 media of the breach of security. 

5 (2) CONTENT OF NOTICE.—The notice required 

6 under paragraphs (1)(A) and (B) shall consist of— 

7 (A) the name of the individual whose infor8 mation was the subject of the breach of secu9 rity; 

10 (B) the name of the covered entity that 

11 was the subject of the breach of security; 

12 (C) a description of the categories of sen13 sitive personal information of the individual 

14 that were the subject of the breach of security; 

15 (D) the date of discovery of such breach of 

16 security; and 

17 (E) the toll-free numbers necessary to con18 tact— 

19 (i) each covered entity that was the 

20 subject of the breach of security; 

21 (ii) each nationwide credit reporting 

22 agency; and 

23 (iii) the Commission. 

24 (e) TIMING OF NOTIFICATION.— 


bajohnson on PROD1PC69 with BILLS
10 

•S 1178 RS 

1 (1) IN GENERAL.—Except as provided in para2 graph (2), notice required by subsection (c) shall be 

3 given— 

4 (A) in a manner that is consistent with 

5 any measures necessary to determine the scope 

6 of the breach and restore the security and in7 tegrity of the data system; and 

8 (B) in the most expeditious manner prac9 ticable, but not later than 25 business days 

10 after the date on which the breach of security 

11 was discovered by the covered entity. 

12 (2) LAW ENFORCEMENT AND NATIONAL OR

13 HOMELAND SECURITY RELATED DELAYS.—Notwith14 standing paragraph (1), the giving of notice as re15 quired by that paragraph may be delayed for a rea16 sonable period of time if— 

17 (A) a Federal or State law enforcement 

18 agency determines that the timely giving of no19 tice under subsections (a) and (c), as required 

20 by paragraph (1), would materially impede a 

21 civil or criminal investigation; or 

22 (B) a Federal national security or home23 land security agency determines that such time24 ly giving of notice would threaten national or 

25 homeland security. 


bajohnson on PROD1PC69 with BILLS
11 

•S 1178 RS 

1 (f) CERTAIN SERVICE PROVIDERS.—Section 2 and 

2 subsections (a), (b), and (c) of this section do not apply 

3 to electronic communication of a third party stored by a 

4 cable operator, information service, or telecommunications 

5 carrier in the network of such operator, service or carrier 

6 in the course of transferring or transmitting such commu7 nication. Any term used in this subsection that is defined 

8 in the Communications Act of 1934 (47 U.S.C. 151 et 

9 seq.) has the meaning given it in that Act. 

10 SEC. 4. SECURITY FREEZE. 

11 (a) IN GENERAL.— 

12 (1) EMPLACEMENT.—A consumer may place a 

13 security freeze on the consumer’s credit report by 

14 making a request to a consumer credit reporting 

15 agency in writing, by telephone, or through a secure 

16 electronic connection if such a connection is made 

17 available by the consumer credit reporting agency. 

18 (2) CONSUMER DISCLOSURE.—If a consumer 

19 requests a security freeze, the consumer credit re20 porting agency shall disclose to the consumer the 

21 process of placing and removing the security freeze. 

22 A consumer credit reporting agency may not imply 

23 or inform a consumer that the placement or pres24 ence of a security freeze on the consumer’s credit reVerDate Aug 31 2005 00:19 Dec 06, 2007 Jkt 069200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S1178.RS S1178

bajohnson on PROD1PC69 with BILLS
12 

•S 1178 RS 

1 port may negatively affect the consumer’s credit 

2 score. 

3 (b) EFFECT OF SECURITY FREEZE.— 

4 (1) RELEASE OF INFORMATION BLOCKED.—If a 

5 security freeze is in place on a consumer’s credit re6 port, a consumer credit reporting agency may not 

7 release the credit report for consumer credit review 

8 purposes to a third party without prior express au9 thorization from the consumer. 

10 (2) INFORMATION PROVIDED TO THIRD PAR11 TIES.—Paragraph (1) does not prevent a consumer 

12 credit reporting agency from advising a third party 

13 that a security freeze is in effect with respect to the 

14 consumer’s credit report. If a third party, in connec15 tion with a request for information in any cir16 cumstance under which a consumer credit reporting 

17 agency may furnish a consumer report under section 

18 604(a) of the Fair Credit Reporting Act (15 U.S.C. 

19 1681b), requests access to a consumer credit report 

20 on which a security freeze is in place, the third party 

21 may treat any application associated with the re22 quest as incomplete. 

23 (3) CONSUMER CREDIT SCORE NOT AF24 FECTED.—The placement of a security freeze on a 

25 credit report may not be taken into account for any 


bajohnson on PROD1PC69 with BILLS
13 

•S 1178 RS 

1 purpose in determining the credit score of the con2 sumer to whom the account relates. 

3 (c) REMOVAL; TEMPORARY SUSPENSION.— 

4 (1) IN GENERAL.—Except as provided in para5 graphs (2)(B) and (4), a security freeze shall remain 

6 in place until the consumer requests that the secu7 rity freeze be removed. A consumer may remove a 

8 security freeze on the consumer’s credit report by 

9 making a request to a consumer credit reporting 

10 agency in writing, by telephone, or through a secure 

11 electronic connection made available by the con12 sumer credit reporting agency. 

13 (2) CONDITIONS.—A consumer credit reporting 

14 agency may remove a security freeze placed on a 

15 consumer’s credit report only— 

16 (A) upon the consumer’s request, pursuant 

17 to paragraph (1); or 

18 (B) if the agency determines that the con19 sumer’s credit report was frozen due to a mate20 rial misrepresentation of fact by the consumer. 

21 (3) NOTIFICATION TO CONSUMER.—If a con22 sumer credit reporting agency intends to remove a 

23 freeze upon a consumer’s credit report pursuant to 

24 paragraph (2)(B) or (4), 2(B) the consumer credit 

25 reporting agency shall notify the consumer in writVerDate Aug 31 2005 00:19 Dec 06, 2007 Jkt 069200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6201 E:\BILLS\S1178.RS S1178

bajohnson on PROD1PC69 with BILLS
14 

•S 1178 RS 

1 ing prior to removing the freeze on the consumer’s 

2 credit report. 

3 (4) TEMPORARY SUSPENSION.—A consumer 

4 may have a security freeze on the consumer’s credit 

5 report temporarily suspended by making a request 

6 to a consumer credit reporting agency in writing 

7 writing, by telephone, or through a secure electronic 

8 connection made available by the consumer credit re9 porting agency and— 

10 (A) specifying beginning and ending dates 

11 for the period during which the security freeze 

12 is not to apply to that consumer’s credit report; 

13 or 

14 (B) specifying a specific third party to 

15 which access to the credit report may be grant16 ed notwithstanding the freeze. 

17 (d) RESPONSE TIMES; NOTIFICATION OF OTHER EN18 TITIES.— 

19 (1) IN GENERAL.—A consumer credit reporting 

20 agency shall— 

21 (A) place a security freeze on a consumer’s 

22 credit report under subsection (a) no later than 

23 3 business days after receiving a request from 

24 the consumer under subsection (a)(1); 


bajohnson on PROD1PC69 with BILLS
15 

•S 1178 RS 

1 (B) remove a security freeze within 3 busi2 ness days after receiving a request for removal 

3 from the consumer under subsection (c); and 

4 (C) temporarily suspend a security freeze 

5 within 1 business day after receiving a request 

6 under subsection (c)(4). 

7 (2) NOTIFICATION OF OTHER COVERED ENTI8 TIES.—If the consumer requests in writing, by tele9 phone, or by secure electronic connection to a con10 sumer credit reporting agency described in section 

11 603(p) of the Fair Credit Reporting Act (15 U.S.C. 

12 1681a(p)) that other covered entities be notified of 

13 the request, the consumer credit reporting agency 

14 shall notify all other consumer credit reporting agen15 cies described in section 603(p)(1) 603(p) of the 

16 Fair Credit Reporting Act (15 U.S.C. 1681a(p)(1)) 

17 1681a(p)) of the request within 1 day of receiving 

18 the request. 

19 (3) IMPLEMENTATION BY OTHER COVERED EN20 TITIES.—A consumer credit reporting agency de21 scribed in section 603(p) of the Fair Credit Reporting 

22 Act (15 U.S.C. 1681a(p)) that is notified of a request 

23 under paragraph (2) to place, remove, or tempo24 rarily suspend a security freeze on a consumer’s 

25 credit report shall— 


bajohnson on PROD1PC69 with BILLS
16 

•S 1178 RS 

1 (A) ensure the validity of the request, in2 cluding verifying the identity of the requesting 

3 consumer, within 3 business days after receiv4 ing the notification; and 

5 (B) place, remove, or temporarily suspend 

6 the security freeze on that credit report within 

7 3 business days after validating the request, in8 cluding verifying the identity of the requesting 

9 consumer and securing the fee under subsection 

10 (h)(1), if applicable. 

11 (e) CONFIRMATION.—Except as provided in sub12 section (c)(3), whenever a consumer credit reporting agen13 cy places, removes, or temporarily suspends a security 

14 freeze on a consumer’s credit report at the request of that 

15 consumer under subsection (a) or (c), respectively, it shall 

16 send a written confirmation thereof to the consumer with17 in 10 business days after placing, removing, or temporarily 

18 suspending the security freeze on the credit report. This 

19 subsection does not apply to the placement, removal, or 

20 temporary suspension of a security freeze by a consumer 

21 credit reporting agency because of a notification received 

22 under subsection (d)(2). 

23 (f) ID REQUIRED.—A consumer credit reporting 

24 agency may not place, remove, or temporarily suspend a 

25 security freeze on a consumer’s credit report at the conVerDate Aug 31 2005 00:19 Dec 06, 2007 Jkt 069200 PO 00000 Frm 00016 Fmt 6652 Sfmt 6201 E:\BILLS\S1178.RS S1178

bajohnson on PROD1PC69 with BILLS
17 

•S 1178 RS 

1 sumer’s request unless the consumer provides proper iden2 tification (within the meaning of section 610(a)(1) of the 

3 Fair Credit Reporting Act (15 U.S.C. 1681(h)(a)(1)) and 

4 the regulations thereunder. 

5 (g) EXCEPTIONS.—This section does not apply to the 

6 use of a consumer credit report by any of the following: 

7 (1) A person or entity, or a subsidiary, affiliate, 

8 or agent of that person or entity, or an assignee of 

9 a financial obligation owing by the consumer to that 

10 person or entity, or a prospective assignee of a fi11 nancial obligation owing by the consumer to that 

12 person or entity in conjunction with the proposed 

13 purchase of the financial obligation, with which the 

14 consumer has or had prior to assignment an account 

15 or contract, including a demand deposit account, or 

16 to whom the consumer issued a negotiable instru17 ment, for the purposes of reviewing the account or 

18 collecting the financial obligation owing for the ac19 count, contract, or negotiable instrument. 

20 (2) Any Federal, State or local agency, law en21 forcement agency, trial court, or private collection 

22 agency acting pursuant to a court order, warrant, 

23 subpoena, or other compulsory process. 

24 (3) A child support agency or its agents or as25 signs acting pursuant to subtitle D of title IV of the 


bajohnson on PROD1PC69 with BILLS
18 

•S 1178 RS 

1 Social Security Act (42 U.S.C. et seq.) or similar 

2 State law. 

3 (4) The Department of Health and Human 

4 Services, a similar State agency, or the agents or as5 signs of the Federal or State agency acting to inves6 tigate medicare or medicaid fraud. 

7 (5) The Internal Revenue Service or a State or 

8 municipal taxing authority, or a State department of 

9 motor vehicles, or any of the agents or assigns of 

10 these Federal, State, or municipal agencies acting to 

11 investigate or collect delinquent taxes or unpaid 

12 court orders or to fulfill any of their other statutory 

13 responsibilities. 

14 (6) Any person or entity administering a credit 

15 file monitoring subscription to which the consumer 

16 has subscribed. 

17 (7) Any person or entity for the purpose of pro18 viding a consumer with a copy of the consumer’s 

19 credit report or credit score upon the consumer’s re20 quest. 

21 (8) Except when access is restricted to a spe22 cific third party during a temporary suspension of a 

23 security freeze under subsection (c)(4)(B), any per24 son who seeks access during the time period that a 

25 security freeze is temporarily suspended for the purVerDate Aug 31 2005 00:19 Dec 06, 2007 Jkt 069200 PO 00000 Frm 00018 Fmt 6652 Sfmt 6201 E:\BILLS\S1178.RS S1178

bajohnson on PROD1PC69 with BILLS
19 

•S 1178 RS 

1 pose of facilitating the extension of credit or another 

2 permissible use. 

3 (h) FEES.— 

4 (1) IN GENERAL.—Except as provided in para5 graph (2), a consumer credit reporting agency may 

6 charge a fee, not in excess of $10, for placing a se7 curity freeze on a consumer’s credit report. A con8 sumer reporting agency may not charge a consumer 

9 for up to 2 requests per year per credit reporting 

10 agency for temporary suspension of a security 

11 freeze. If the consumer requests more than 2 tem12 porary suspensions of a security freeze from a credit 

13 reporting agency within a year, then that consumer 

14 credit reporting agency may charge the consumer a 

15 fee for each such additional request, but that con16 sumer credit reporting agency may not charge in ex17 cess of $5 per request. A consumer credit reporting 

18 agency may not charge a consumer for removing a 

19 security freeze. 

20 (2) FEES PROHIBITED.— 

21 (A) ID THEFT VICTIMS.—A consumer 

22 credit reporting agency may not charge a fee 

23 for placing, removing, or temporarily sus24 pending a security freeze on a consumer’s credit 

25 report if— 


bajohnson on PROD1PC69 with BILLS
20 

•S 1178 RS 

1 (i) the consumer is a victim of identity 

2 theft; 

3 (ii) the consumer requests the security 

4 freeze in writing; 

5 (iii) the consumer has filed a police 

6 report with respect to the theft, or an iden7 tity theft report (as defined in section 

8 603(q)(4) of the Fair Credit Reporting Act 

9 (15 U.S.C. 1681a(q)(4))), within 180 days 

10 after the theft occurred or was discovered 

11 by the consumer; and 

12 (iv) the consumer provides a copy of 

13 the report to the credit reporting agency. 

14 (B) CATEGORICAL CLASSES.—A consumer 

15 credit reporting agency may not charge a fee 

16 for placing, removing, or temporarily sus17 pending a credit freeze on a consumer’s credit 

18 report if the consumer requesting it— 

19 (i) has attained the age of 65 years; 

20 (ii) is on active duty or in the ready 

21 reserve component of an armed force of 

22 the United States; or 

23 (iii) is the spouse of an individual de24 scribed in clause (ii). 


bajohnson on PROD1PC69 with BILLS
21 

•S 1178 RS 

1 (i) LIMITATION ON INFORMATION CHANGES IN FRO2 ZEN REPORTS.— 

3 (1) IN GENERAL.—If a security freeze is in 

4 place on a consumer’s credit report, a consumer 

5 credit reporting agency may not change any of the 

6 following official information in that credit report 

7 without sending a written confirmation of the 

8 change to the consumer within 30 days after the 

9 change is made: 

10 (A) Name. 

11 (B) Date of birth. 

12 (C) Social security account number. 

13 (D) Address. 

14 (2) CONFIRMATION.—Paragraph (1) does not 

15 require written confirmation for technical modifica16 tions of a consumer’s official information, including 

17 name and street abbreviations, complete spellings, or 

18 transposition of numbers or letters. In the case of an 

19 address change, the written confirmation shall be 

20 sent to both the new address and to the former ad21 dress. 

22 (j) CERTAIN ENTITY EXEMPTIONS.— 

23 (1) RESELLERS AND OTHER AGENCIES.— 

24 (A) IN GENERAL.—Except as provided in 

25 subparagraph (B), the provisions of this Act do 


bajohnson on PROD1PC69 with BILLS
22 

•S 1178 RS 

1 not apply to a consumer credit reporting agency 

2 that acts only as a reseller of credit information 

3 by assembling and merging information con4 tained in the data base of another consumer 

5 credit reporting agency or multiple consumer 

6 credit reporting agencies, and does not main7 tain a permanent data base of credit informa8 tion from which new consumer credit reports 

9 are produced. 

10 (B) RESELLER TO HONOR FREEZES

11 PLACED BY CONSUMER REPORTING AGEN12 CIES.—Section 4(b), and, to the extent applica13 ble, section 8 sections 8 and 9 of this Act apply 

14 to a consumer credit reporting agency described 

15 in subparagraph (A). 

16 (2) OTHER EXEMPTED ENTITIES.—The fol17 lowing entities are not required to place a security 

18 freeze in a credit report: 

19 (A) A check services or fraud prevention 

20 services company, which issues reports on inci21 dents of fraud or authorizations for the purpose 

22 of approving or processing negotiable instru23 ments, electronic funds transfers, or similar 

24 methods of payments. 


bajohnson on PROD1PC69 with BILLS
23 

•S 1178 RS 

1 (B) A deposit account information service 

2 company, which issues reports regarding ac3 count closures due to fraud, substantial over4 drafts, ATM abuse, or similar negative informa5 tion regarding a consumer, to inquiring banks 

6 or other financial institutions for use only in re7 viewing a consumer request for a deposit ac8 count at the inquiring bank or financial institu9 tion. 

10 SEC. 5. INFORMATION SECURITY AND CONSUMER PRIVACY 

11 ADVISORY COMMITTEE. 

12 (a) ESTABLISHMENT.—Not later than 90 days after 

13 the date of enactment of this Act, the Chairman of the 

14 Commission shall establish the Information Security and 

15 Consumer Privacy Advisory Committee. 

16 (b) MEMBERSHIP.—The Advisory Committee shall 

17 consist of 5 members appointed by the Chairman after ap18 propriate consultations with relevant interested parties. 

19 parties, including representatives of the small business com20 munity. Of the 5 members, the Advisory Committee shall 

21 contain at least 1 member from each of the following 

22 groups: 

23 (1) A non-profit consumer advocacy group. 

24 (2) A business organization that collects per25 sonally identifiable information. 


bajohnson on PROD1PC69 with BILLS
24 

•S 1178 RS 

1 (3) A state Attorney General’s office. 

2 (c) CHAIRPERSON.—The Advisory Committee mem3 bers shall elect 1 member to serve as chairperson of the 

4 Advisory Committee. 

5 (d) FUNCTIONS.—The Advisory Committee shall col6 lect, review, disseminate, and advise on best practices 

7 guidance for covered entities to protect sensitive personal 

8 information stored and transferred. 

9 (e) REPORT.—Not later than 12 months after the 

10 date on which the Advisory Committee is established 

11 under subsection (a) and annually thereafter, the Advisory 

12 Committee shall submit to Congress a report on its find13 ings. 

14 (f) NO TERMINATION.—Section 14(a)(2) of the Fed15 eral Advisory Committee Act (5 U.S.C. App 14(a)(2)) 

16 shall not apply to the Advisory Committee. 

17 SEC. 6. RELATED CRIME STUDY. 

18 (a) IN GENERAL.—The Federal Trade Commission, 

19 in conjunction with the Department of Justice and other 

20 Federal agencies, shall undertake a study of— 

21 (1) the correlation between methamphetamine 

22 use and identity theft crimes; 

23 (2) the needs of law enforcement to address 

24 methamphetamine crimes related to identity theft, 


bajohnson on PROD1PC69 with BILLS
25 

•S 1178 RS 

1 including production, trafficking, and the purchase 

2 of precursor chemicals; and 

3 (3) the Federal Government’s role in addressing 

4 and deterring identity theft crimes. 

5 (b) REPORT.—Not later than 18 months 9 months 

6 after the date of enactment of this Act, the Commission 

7 shall submit a report of its findings and recommendations 

8 to the Congress that includes— 

9 (1) a detailed analysis of the correlation be10 tween methamphetamine use and identity theft 

11 crimes; 

12 (2) the needs of law enforcement to address 

13 methamphetamine crimes related to identity theft in14 cluding production, trafficking, and the purchase of 

15 precursor chemicals related to methamphetamine; 

16 (3) the Federal Government’s role in addressing 

17 and deterring identity theft crimes; and 

18 (4) specific recommendations for means of re19 ducing and preventing crimes involving methamphet20 amine and identity theft, including recommendations 

21 for best practices for local law enforcement agencies. 

22 SEC. 7. PROHIBITION ON TECHNOLOGY MANDATES. 

23 Nothing in this Act shall be construed to permit the 

24 Commission to issue regulations that require or impose a 


bajohnson on PROD1PC69 with BILLS
26 

•S 1178 RS 

1 specific technology, product, technological standards, or 

2 solution. or technological standards. 

3 SEC. 8. ENFORCEMENT. 

4 (a) ENFORCEMENT BY COMMISSION.—Except as pro5 vided in subsection (c), this Act shall be enforced by the 

6 Commission. 

7 (b) VIOLATION IS UNFAIR OR DECEPTIVE ACT OR

8 PRACTICE.—The violation of any provision of this Act 

9 shall be treated as an unfair or deceptive act or practice 

10 proscribed under a rule issued under section 18(a)(1)(B) 

11 of the Federal Trade Commission Act (15 U.S.C. 

12 57a(a)(1)(B)). 

13 (c) ENFORCEMENT BY CERTAIN OTHER AGEN14 CIES.—Compliance with this Act shall be enforced exclu15 sively under— 

16 (1) section 8 of the Federal Deposit Insurance 

17 Act (12 U.S.C. 1818), in the case of— 

18 (A) national banks, and Federal branches 

19 and Federal agencies of foreign banks, and any 

20 subsidiaries of such entities (except brokers, 

21 dealers, persons providing insurance, invest22 ment companies, and investment advisers), by 

23 the Office of the Comptroller of the Currency; 

24 (B) member banks of the Federal Reserve 

25 System (other than national banks), branches 


bajohnson on PROD1PC69 with BILLS
27 

•S 1178 RS 

1 and agencies of foreign banks (other than Fed2 eral branches, Federal agencies, and insured 

3 State branches of foreign banks), commercial 

4 lending companies owned or controlled by for5 eign banks, organizations operating under sec6 tion 25 or 25A of the Federal Reserve Act (12 

7 U.S.C. 601 and 611), and bank holding compa8 nies and their nonbank subsidiaries or affiliates 

9 (except brokers, dealers, persons providing in10 surance, investment companies and investment 

11 advisers), by the Board of Governors of the 

12 Federal Reserve System; 

13 (C) banks insured by the Federal Deposit 

14 Insurance Corporation (other than members of 

15 the Federal Reserve System), insured State 

16 branches of foreign banks, and any subsidiaries 

17 of such entities (except brokers, dealers, per18 sons providing insurance, investment companies 

19 and investment advisers), by the Board of Di20 rectors of the Federal Deposit Insurance Cor21 poration; and 

22 (D) savings associations the deposits of 

23 which are insured by the Federal Deposit In24 surance Corporation, and any subsidiaries of 

25 such savings associations (except brokers, dealVerDate Aug 31 2005 00:19 Dec 06, 2007 Jkt 069200 PO 00000 Frm 00027 Fmt 6652 Sfmt 6201 E:\BILLS\S1178.RS S1178

bajohnson on PROD1PC69 with BILLS
28 

•S 1178 RS 

1 ers, persons providing insurance, investment 

2 companies and investment advisers), by the Di3 rector of the Office of Thrift Supervision; 

4 (2) the Federal Credit Union Act (12 U.S.C. 

5 1751 et seq.) by the Board of the National Credit 

6 Union Administration Board with respect to any 

7 Federal credit union and any subsidiaries of such a 

8 credit union; 

9 (3) the Securities and Exchange Act of 1934 

10 (15 U.S.C. 78a et seq.) by the Securities and Ex11 change Commission with respect to— 

12 (A) a broker or dealer subject to that Act; 

13 (B) an investment company subject to the 

14 Investment Company Act of 1940 (15 U.S.C. 

15 80a–1 et seq.); and 

16 (C) an investment advisor subject to the 

17 Investment Advisers Act of 1940 (15 U.S.C. 

18 80b–1 et seq.); and 

19 (4) State insurance law, in the case of any per20 son engaged in providing insurance, by the applica21 ble State insurance authority of the State in which 

22 the person is domiciled. 

23 (d) EXERCISE OF CERTAIN POWERS.—For the pur24 pose of the exercise by any agency referred to in sub25 section (c) of its powers under any Act referred to in that 


bajohnson on PROD1PC69 with BILLS
29 

•S 1178 RS 

1 subsection, a violation of this Act is deemed to be a viola2 tion of a requirement imposed under that Act. In addition 

3 to its powers under any provision of law specifically re4 ferred to in subsection (c), each of the agencies referred 

5 to in that subsection may exercise, for the purpose of en6 forcing compliance with any requirement imposed under 

7 this Act, any other authority conferred on it by law. 

8 (e) OTHER AUTHORITY NOT AFFECTED.—Nothing 

9 in this Act shall be construed to limit or affect in any 

10 way the Commission’s authority to bring enforcement ac11 tions or take any other measure under the Federal Trade 

12 Commission Act (15 U.S.C. 41 et seq.) or any other provi13 sion of law. 

14 (f) COMPLIANCE WITH GRAMM-LEACH-BLILEY

15 ACT.— 

16 (1) NOTICE.—Any covered entity that is subject 

17 to the Gramm-Leach-Bliley Act (15 U.S.C. 6801 et 

18 seq.), and gives notice in compliance with the notifi19 cation requirements established for such covered en20 tities under title V of that Act is deemed to be in 

21 compliance with section 3 of this Act. 

22 (2) SAFEGUARDS.—Any covered entity that is 

23 subject to the Gramm-Leach-Bliley Act (15 U.S.C. 

24 6801 et seq.), and fulfills the information protection 

25 requirements established for such entities under title 


bajohnson on PROD1PC69 with BILLS
30 

•S 1178 RS 

1 V of the Act and under section 607(a) of the Fair 

2 Credit Reporting Act (15 U.S.C. 1681e(a)) to pro3 tect sensitive personal information shall be deemed 

4 to be in compliance with section 2 of this Act. 

5 SEC. 9. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 

6 (a) IN GENERAL.—Except as provided in section 

7 8(c), a State, as parens patriae, may bring a civil action 

8 on behalf of its residents in an appropriate state or district 

9 court of the United States to enforce the provisions of this 

10 Act, to obtain damages, restitution, or other compensation 

11 on behalf of such residents, or to obtain such further and 

12 other relief as the court may deem appropriate, whenever 

13 the attorney general of the State has reason to believe that 

14 the interests of the residents of the State have been or 

15 are being threatened or adversely affected by a covered 

16 entity that violates this Act or a regulation under this Act. 

17 (b) NOTICE.—The State shall serve written notice to 

18 the Commission (or other appropriate Federal regulator 

19 under section 8) of any civil action under subsection (a) 

20 at least 60 days prior to initiating such civil action. The 

21 notice shall include a copy of the complaint to be filed 

22 to initiate such civil action, except that if it is not feasible 

23 for the State to provide such prior notice, the State shall 

24 provide such notice immediately upon instituting such civil 

25 action. 


bajohnson on PROD1PC69 with BILLS
31 

•S 1178 RS 

1 (c) AUTHORITY TO INTERVENE.—Upon receiving the 

2 notice required by subsection (b), the Commission (or 

3 other appropriate Federal regulator under section 8) may 

4 intervene in such civil action and upon intervening— 

5 (1) be heard on all matters arising in such civil 

6 action; and 

7 (2) file petitions for appeal of a decision in such 

8 civil action. 

9 (d) CONSTRUCTION.—For purposes of bringing any 

10 civil action under subsection (a), nothing in this section 

11 shall prevent the attorney general of a State from exer12 cising the powers conferred on the attorney general by the 

13 laws of such State to conduct investigations or to admin14 ister oaths or affirmations or to compel the attendance 

15 of witnesses or the production of documentary and other 

16 evidence. 

17 (e) VENUE; SERVICE OF PROCESS.—In a civil action 

18 brought under subsection (a)— 

19 (1) the venue shall be a judicial district in 

20 which— 

21 (A) the covered entity operates; or 

22 (B) the covered entity was authorized to do 

23 business; 


bajohnson on PROD1PC69 with BILLS
32 

•S 1178 RS 

1 (2) process may be served without regard to the 

2 territorial limits of the district or of the State in 

3 which the civil action is instituted; and 

4 (3) a person who participated with a covered 

5 entity in an alleged violation that is being litigated 

6 in the civil action may be joined in the civil action 

7 without regard to the residence of the person. 

8 (f) LIMITATION ON STATE ACTION WHILE FEDERAL

9 ACTION IS PENDING.—If the Commission (or other appro10 priate Federal agency under section 8) has instituted a 

11 civil action or an administrative action for violation of this 

12 Act, no State attorney general, or official or agency of a 

13 State, may bring an action under this subsection during 

14 the pendency of that action against any defendant named 

15 in the complaint of the Commission or the other agency 

16 for any violation of this Act alleged in the complaint. 

17 (g) RECOVERY OF REASONABLE COSTS AND FEES.— 

18 If the attorney general of the State prevails in any civil 

19 action under subsection (a), it can recover reasonable costs 

20 and attorney fees from the covered entity. 

21 SEC. 10. PREEMPTION OF STATE LAW. 

22 (a) NOTICE.—This Act preempts any State or local 

23 law, regulation, or rule that requires a covered entity to 

24 notify individuals of breaches of security pertaining to 

25 them. 


bajohnson on PROD1PC69 with BILLS
33 

•S 1178 RS 

1 (b) INFORMATION SECURITY PROGRAMS.—This Act 

2 preempts any State or local law, regulation, or rule that 

3 requires a covered entity to develop, implement, maintain, 

4 or enforce information security programs to which this Act 

5 applies. 

6 (c) SECURITY FREEZE.— 

7 (1) IN GENERAL.—This Act shall not be con8 strued as superseding, altering, or affecting any 

9 statute, regulation, order, or interpretation in effect 

10 in any State with regards to consumer credit report11 ing agencies compliance with a consumer’s request 

12 to place, remove, or temporarily suspend the prohibi13 tion on the release by a credit reporting agency of 

14 information from its files on that consumer, except 

15 to the extent that such statute, regulation, order, or 

16 interpretation is inconsistent with the provisions of 

17 this Act, and then only to the extent of the incon18 sistency. 

19 (2) GREATER PROTECTION UNDER STATE

20 LAW.—For purposes of this section, a State statute, 

21 regulation, order, or interpretation is not incon22 sistent with the provisions of this subtitle if the pro23 tection of afforded by such statute, regulation, order, 

24 or interpretation affords any person is greater than 

25 the protection provided under this Act in regards to 


bajohnson on PROD1PC69 with BILLS
34 

•S 1178 RS 

1 credit reporting agencies compliance with a con2 sumer’s request to place, remove, or temporarily sus3 pend the prohibition on the release by a consumer 

4 credit reporting agency of information from its files 

5 on that consumer. 

6 (d) SOCIAL SECURITY ACCOUNT NUMBERS.—Section 

7 11 of this Act, and the amendments made by that section, 

8 preempt any State or local law, regulation, or rule prohib9 iting or limiting the collection, solicitation, sale, provision, 

10 or display of social security account numbers of the types 

11 described in section 11. 

12 (d) (e) LIMITATION OF PREEMPTION.—Federal pre13 emption under this Act shall only apply to matters ex14 pressly described in subsection (a) or (b) (a), (b), or (d) 

15 of this section, and shall have no effect on other State 

16 or local laws, regulations, or rules over covered entities. 

17 SEC. 11. SOCIAL SECURITY NUMBER PROTECTION. 

18 (a) PROHIBITION OF UNNECESSARY SOLICITATION OF

19 SOCIAL SECURITY NUMBERS.— 

20 (1) IN GENERAL.—Unless there is a specific use 

21 of a social security account number for which no 

22 other identifier reasonably can be used, a covered en23 tity may not solicit a social security account number 

24 from an individual except for the following purposes: 


bajohnson on PROD1PC69 with BILLS
35 

•S 1178 RS 

1 (A) For use in an identification, 

2 verification, accuracy, or identity proofing proc3 ess. 

4 (B) For any purpose permitted under the 

5 Fair Credit Reporting Act (15 U.S.C. 1681 et 

6 seq.) or the Gramm-Leach-Bliley Act (15 U.S.C. 

7 6802(e)). 

8 (C) To comply with the requirement of Fed9 eral, State, or local law. 

10 (2) EXCEPTIONS.—Paragraph (1) does not apply 

11 to the solicitation of a social security account num12 ber— 

13 (A) for the purpose of obtaining a consumer 

14 report for any purpose permitted under the Fair 

15 Credit Reporting Act (15 U.S.C. 1681 et seq.), 

16 (B) by a consumer reporting agency for the 

17 purpose of authenticating or obtaining appro18 priate proof of a consumer’s identity, as required 

19 under that Act; 

20 (C) for any purpose permitted under section 

21 502(e) of the Gramm-Leach-Bliley Act (15 

22 U.S.C. 6802(e)); or 

23 (D) to the extent necessary for verifying the 

24 accuracy of information submitted by an indi25 vidual to a covered entity, its agents, contractors, 


bajohnson on PROD1PC69 with BILLS
36 

•S 1178 RS 

1 or employees or for the purpose of authenticating 

2 or obtaining appropriate proof of an individ3 ual’s identity; 

4 (E) to identify or locate missing or ab5 ducted children, witnesses, criminals, fugitives, 

6 parties to lawsuits, parents delinquent in child 

7 support payments, organ and bone marrow do8 nors, pension fund beneficiaries, and missing 

9 heirs; 

10 (F) to the extent necessary to prevent, de11 tect, or investigate fraud, unauthorized trans12 actions, or other financial liability or to facili13 tate the enforcement of an obligation of, or collec14 tion of a debt from, a consumer, provided that 

15 the person selling, providing, displaying, or ob16 taining the social security account number does 

17 not do so for marketing purposes. 

18 (b) PROHIBITION OF THE DISPLAY OF SOCIAL SECU19 RITY NUMBERS ON EMPLOYEE IDENTIFICATION CARDS, 

20 ETC.— 

21 (1) IN GENERAL.—A covered entity may not dis22 play an individual’s security account number (or any 

23 derivative of such number) on any card or tag that 

24 is commonly provided to employees (or to their family 


bajohnson on PROD1PC69 with BILLS
37 

•S 1178 RS 

1 members), faculty, staff, or students for purposes of 

2 identification. 

3 (2) DRIVER’S LICENSES.—A State may not dis4 play the social security account number of an indi5 vidual on driver’s licenses issued by that State. 

6 (c) PROHIBITION OF PRISONER ACCESS TO SOCIAL

7 SECURITY NUMBERS.— 

8 (1) IN GENERAL.—Section 205(c)(2)(C) of the 

9 Social Security Act (42 U.S.C. 405(c)(2)(C)) is 

10 amended by adding at the end the following: 

11 ‘‘(x) No executive, legislative, or judi12 cial agency or instrumentality of the Fed13 eral Government or of a State or political 

14 subdivision thereof (or person acting as an 

15 agent of such an agency or instrumentality) 

16 may employ, or enter into a contract for the 

17 use or employment of, prisoners in any ca18 pacity that would allow such prisoners ac19 cess to the social security account numbers 

20 of other individuals. For purposes of this 

21 clause, the term ‘prisoner’ means an indi22 vidual who is confined in a jail, prison, or 

23 other penal institution or correctional facil24 ity, serving community service as a term of 


bajohnson on PROD1PC69 with BILLS
38 

•S 1178 RS 

1 probation or parole, or serving a sentence 

2 through a work-furlough program.’’. 

3 (2) TREATMENT OF CURRENT ARRANGEMENTS.— 

4 In the case of— 

5 (A) prisoners employed as described in 

6 clause (x) of section 205(c)(2)(C) of the Social 

7 Security Act (42 U.S.C. 405(c)(2)(C)), as added 

8 by paragraph (1), on the date of enactment of 

9 this Act: and 

10 (B) contracts described in such clause in ef11 fect on such date, 

12 the amendment made by paragraph (1) shall take ef13 fect 90 days after the date of enactment of this Act. 

14 (d) PROHIBITION OF SALE AND DISPLAY OF SOCIAL

15 SECURITY NUMBERS TO THE GENERAL PUBLIC.— 

16 (1) IN GENERAL.—Except as provided in para17 graph (2), it shall be unlawful for any person— 

18 (A) to sell, purchase, or provide a social se19 curity account number, to the general public or 

20 display to the general public social security ac21 count numbers; or 

22 (B) to obtain or use any individual’s social 

23 security account number for the purpose of locat24 ing or identifying such individual with the in25 tent to physically injure or harm such indiVerDate Aug 31 2005 00:19 Dec 06, 2007 Jkt 069200 PO 00000 Frm 00038 Fmt 6652 Sfmt 6203 E:\BILLS\S1178.RS S1178

bajohnson on PROD1PC69 with BILLS
39 

•S 1178 RS 

1 vidual or using the identity of such individual 

2 for any illegal purpose. 

3 (2) EXCEPTIONS.—Notwithstanding paragraph 

4 (1), and subject to paragraph (3), a social security 

5 account number may be sold, provided, displayed, or 

6 obtained by any person— 

7 (A) to the extent necessary for law enforce8 ment or national security purposes; 

9 (B) to the extent necessary for public health 

10 purposes; 

11 (C) to the extent necessary in emergency sit12 uations to protect the health or safety of 1 or 

13 more individuals; 

14 (D) to the extent that the sale or display is 

15 required, authorized, or permitted under any law 

16 of the United States or of any State, county, or 

17 municipality; 

18 (E) for any purposes allowed under the 

19 Fair Credit Reporting Act (15 U.S.C. 1681 et 

20 seq.) or the Gramm-Leach-Bliley Act (15 U.S.C. 

21 6802(e)); 

22 (F) to the extent necessary for verifying the 

23 accuracy of information submitted by an indi24 vidual to a covered entity, its agents, contractors, 

25 or employees or for the purpose of authenticating 


bajohnson on PROD1PC69 with BILLS
40 

•S 1178 RS 

1 or obtaining appropriate proof of the individ2 ual’s identity; 

3 (G) to the extent necessary to identify or lo4 cate missing or abducted children, witnesses to 

5 an ongoing or potential civil or criminal law6 suit, criminals, criminal suspects, parties to 

7 lawsuits, parents delinquent in child support 

8 payments, organ and bone marrow donors, pen9 sion fund beneficiaries, missing heirs, and for 

10 similar legal, medical, or family related pur11 poses, if the person selling, providing, dis12 playing, or obtaining the social security account 

13 number does not do so for marketing purposes; 

14 (H) to the extent necessary to prevent, de15 tect, or investigate fraud, unauthorized trans16 actions, or other financial liability or to facili17 tate the enforcement of an obligation of, or collec18 tion of a debt from, a consumer, if the person 

19 selling, providing, displaying, or obtaining the 

20 social security account number does not do so for 

21 marketing purposes; 

22 (I) to the extent the transmission of the 

23 number is incidental to, and in the course of, the 

24 sale, lease, franchising, or merger of all, or a 

25 portion of, a business; or 


bajohnson on PROD1PC69 with BILLS
41 

•S 1178 RS 

1 (J) to the extent necessary for research 

2 (other than market research) conducted by an 

3 agency or instrumentality of the United States 

4 or of a State or political subdivision thereof (or 

5 an agent of such an agency or instrumentality) 

6 for the purpose of advancing the public good, on 

7 the condition that the researcher provides ade8 quate assurances that— 

9 (i) the social security account numbers 

10 will not be used to harass, target, or pub11 licly reveal information concerning any 

12 identifiable individuals; 

13 (ii) information about identifiable in14 dividuals obtained from the research will 

15 not be used to make decisions that directly 

16 affect the rights, benefits, or privileges of 

17 specific individuals; and 

18 (iii) the researcher has in place appro19 priate safeguards to protect the privacy and 

20 confidentiality of any information about 

21 identifiable individuals, including proce22 dures to ensure that the social security ac23 count numbers will be encrypted or other24 wise appropriately secured from unauthor25 ized disclosure; or 


bajohnson on PROD1PC69 with BILLS
42 

•S 1178 RS 

1 (K) to the extent that the transmission of 

2 the social security account number is incidental 

3 to the sale or provision of a document lawfully 

4 obtained from— 

5 (i) the Federal Government or a State 

6 or local government, that the document has 

7 been made available to the general public; 

8 or 

9 (ii) the document has been made avail10 able to the general public via widely distrib11 uted media. 

12 (2) LIMITATION.—Paragraph (1)(K) does not 

13 apply to information obtained from publicly available 

14 sources or from Federal, State, or local government 

15 records if that information is combined with informa16 tion obtained from non-public sources. 

17 (3) CONSENSUAL SALE.—Notwithstanding para18 graph (1), a social security account number assigned 

19 to an individual may be sold, provided, or displayed 

20 to the general public by any person to the extent con21 sistent with such individual’s voluntary and affirma22 tive written consent to the sale, provision, or display 

23 of the social security account number only if— 

24 (A) the terms of the consent and the right 

25 to refuse consent are presented to the individual 


bajohnson on PROD1PC69 with BILLS
43 

•S 1178 RS 

1 in a clear, conspicuous, and understandable 

2 manner; 

3 (B) the individual is placed under no obli4 gation to provide consent to any such sale or dis5 play; and 

6 (C) the terms of the consent authorize the 

7 individual to limit the sale, provision, or display 

8 to purposes directly associated with the trans9 action with respect to which the consent is 

10 sought. 

11 SEC. 12. PROTECTION OF INFORMATION AT FEDERAL AGEN12 CIES. 

13 (a) DATA SECURITY STANDARDS.—Each agency shall 

14 develop, implement, maintain, and enforce a written pro15 gram for the security of sensitive personal information the 

16 agency collects, maintains, sells, transfers, or disposes of, 

17 containing administrative, technical and physical safe18 guards— 

19 (1) to insure the security and confidentiality of 

20 such data; 

21 (2) to protect against any anticipated threats or 

22 hazards to the security of such data; and 

23 (3) to protect against unauthorized access to, or 

24 use of, such data that could result in substantial 

25 harm to any individual misuse of such information, 


bajohnson on PROD1PC69 with BILLS
44 

•S 1178 RS 

1 which could result in substantial harm or inconven2 ience to a consumer. 

3 (b) SECURITY BREACH NOTIFICATION STANDARDS.— 

4 Each agency shall use due diligence to investigate any sus5 pected breach of security affecting sensitive personal infor6 mation maintained by the agency. If, after the exercise of 

7 such due diligence, the agency discovers a breach and deter8 mines that the breach of security creates a reasonable risk 

9 of identity theft, the agency shall notify each such indi10 vidual as prescribed in section 3(d) and (e). 

11 (c) AGENCY.—The term ‘agency’ has the same meaning 

12 given such term in section 551(1) of title 5, United States 

13 Code. 

14 (d) ENFORCEMENT.—The Inspector General of each 

15 Federal agency will be responsible for enforcing the provi16 sions of this Act in accordance with the Inspector General 

17 Act. 

18 SEC. 11. DEFINITIONS. 

19 SEC. 13. DEFINITIONS. 

20 In this Act: 

21 (1) BREACH OF SECURITY.—The term ‘‘breach 

22 of security’’ means unauthorized access to and ac23 quisition of data in any form or format containing 

24 sensitive personal information that compromises the 

25 security or confidentiality of such information. 


bajohnson on PROD1PC69 with BILLS
45 

•S 1178 RS 

1 (2) COMMISSION.—The term ‘‘Commission’’ 

2 means the Federal Trade Commission. 

3 (3) CONSUMER CREDIT REPORTING AGENCY.— 

4 The term ‘‘consumer credit reporting agency’’ means 

5 any person which, for monetary fees, dues, or on a 

6 cooperative nonprofit basis, regularly engages in 

7 whole or in part in the practice of assembling or 

8 evaluating consumer credit information or other in9 formation on consumers for the purpose of fur10 nishing credit reports to third parties, and which 

11 uses any means or facility of interstate commerce 

12 for the purpose of preparing or furnishing credit re13 ports. 

14 (4) COVERED ENTITY.—The term ‘‘covered en15 tity’’ means a sole proprietorship, partnership, cor16 poration, trust, estate, cooperative, association, or 

17 other commercial entity, and any charitable, edu18 cational, or nonprofit organization, that acquires, 

19 maintains, or utilizes sensitive personal information. 

20 (5) CREDIT REPORT.—The term ‘‘credit report’’ 

21 means a consumer report, as defined in section 

22 603(d) of the Federal Fair Credit Reporting Act (15 

23 U.S.C. 1681a(p)), as well as any associated credit 

24 score that is used or expected to be used or collected 

25 in whole or in part for the purpose of serving as a 


bajohnson on PROD1PC69 with BILLS
46 

•S 1178 RS 

1 factor in establishing a consumer’s eligibility for 

2 credit for personal, family or household purposes. 

3 (6) IDENTITY THEFT.—The term ‘‘identity 

4 theft’’ means the unauthorized acquisition, purchase, 

5 sale, or use by any person of an individual’s sensitive 

6 personal information that— 

7 (A) violates section 1028 of title 18, 

8 United States Code, or any provision of State 

9 law in pari materia; or 

10 (B) results in harm to the individual whose 

11 sensitive personal information was used. 

12 (7) REASONABLE RISK OF IDENTITY THEFT.— 

13 The term ‘‘reasonable risk of identity theft’’ means 

14 that the preponderance of the evidence available to 

15 the covered entity that has experienced a breach of 

16 security establishes that identity theft for 1 or more 

17 individuals from the breach of security is forseeable. 

18 (8) REVIEWING THE ACCOUNT.—The term ‘‘re19 viewing the account’’ includes activities related to 

20 account maintenance, monitoring, credit line in21 creases, and account upgrades and enhancements. 

22 (9) SENSITIVE PERSONAL INFORMATION.— 

23 (A) IN GENERAL.—Except as provided in 

24 subparagraphs (B), (C), and (D), the term 

25 ‘‘sensitive personal information’’ means an indiVerDate Aug 31 2005 00:19 Dec 06, 2007 Jkt 069200 PO 00000 Frm 00046 Fmt 6652 Sfmt 6201 E:\BILLS\S1178.RS S1178

bajohnson on PROD1PC69 with BILLS
47 

•S 1178 RS 

1 vidual’s name, address, or telephone number 

2 combined with 1 or more of the following data 

3 elements related to that individual: 

4 (i) Social security account number or 

5 an employer identification number that is 

6 the same as or is derived from the social 

7 security account number of that individual. 

8 (ii) Financial account number, or 

9 credit card or debit card number of such 

10 individual, combined with any required se11 curity code, access code, or password that 

12 would permit access to such individual’s 

13 account. account number or card number. 

14 (iii) State driver’s license identifica15 tion number or State resident identifica16 tion number. 

17 (B) PASSWORD ACCOUNTS.—An The term 

18 ‘‘sensitive personal information’’ also includes 

19 an account identifier combined with a password, 

20 PIN, or security code to access the account, for 

21 any consumer account from which any of the 

22 following can occur without further authentica23 tion after login: 

24 (i) A financial transaction. 

25 (ii) A purchase of goods or services. 


bajohnson on PROD1PC69 with BILLS
48 

•S 1178 RS 

1 (iii) A charge to a payment card or 

2 account. 

3 (iv) A charge to a credit card or ac4 count. 

5 (v) Access to the account that reveals 

6 sufficient information to engage in any ac7 tivity described in clause (i), (ii), (iii), or 

8 (iv). 

9 (C) FTC MODIFICATIONS.—The Commis10 sion may, through a rulemaking proceeding in 

11 accordance with section 553 of title 5, United 

12 States Code, designate other identifying infor13 mation that may be used to effectuate identity 

14 theft as sensitive personal information for pur15 poses of this Act and limit or exclude any infor16 mation described in subparagraph (A) from the 

17 definition of sensitive personal information for 

18 purposes of this Act. 

19 (D) EXCEPTION.—The term ‘‘sensitive 

20 personal information’’ does not include informa21 tion that is obtained from— 

22 (i) Federal, State, or local govern23 ments that has been made available to the 

24 general public; or 

25 (ii) widely distributed media. 


bajohnson on PROD1PC69 with BILLS
49 

•S 1178 RS 

1 The exception provided by this subparagraph 

2 does not apply if the information obtained from 

3 Federal, State, or local government records or 

4 widely distributed media is combined with infor5 mation obtained from non-public sources. 

6 (E) PUBLIC RECORDS.—Nothing in this 

7 Act prohibits a covered entity from obtaining, 

8 aggregating, or using sensitive personal infor9 mation it lawfully obtains from public records 

10 in a manner that does not violate this Act. 

11 (E) BURDEN OF PROOF.—In an enforce12 ment action brought pursuant to section 8 or 9 

13 of this Act, the covered entity shall have the bur14 den of demonstrating that it has obtained the in15 formation from a source permitted as an excep16 tion in this paragraph. 

17 (11) SOCIAL SECURITY ACCOUNT NUMBER.—The 

18 term ‘‘social security account number’’ means a social 

19 security account number that contains more than 5 

20 digits of the full 9-digit number assigned by the So21 cial Security Administration but does not include so22 cial security account numbers to the extent that they 

23 are included in a publicly available information 

24 source, such as news reports, books, periodicals, or diVerDate Aug 31 2005 00:19 Dec 06, 2007 Jkt 069200 PO 00000 Frm 00049 Fmt 6652 Sfmt 6203 E:\BILLS\S1178.RS S1178

bajohnson on PROD1PC69 with BILLS
50 

•S 1178 RS 

1 rectories or Federal, State, or local government 

2 records. 

3 SEC. 12. AUTHORIZATION OF APPROPRIATIONS. 

4 SEC. 14. AUTHORIZATION OF APPROPRIATIONS. 

5 There are authorized to be appropriated to the Com6 mission $2,000,000 for each of fiscal years 2007 through 

7 2011 to carry out this Act. 

8 SEC. 13. EFFECTIVE DATES. 

9 SEC. 15. EFFECTIVE DATES. 

10 (a) IN GENERAL.—Except as provided in subsections 

11 (b) and (c), the provisions of this Act take effect upon 

12 its enactment. 

13 (b) IMPLEMENTATION OF SECURITY PROGRAM.—A 

14 covered entity shall implement the program required by 

15 section 2(a) within 6 months after the date of enactment 

16 of this Act. 

17 (c) PROVISIONS REQUIRING RULEMAKING.—The 

18 Commission shall initiate 1 or more rulemaking pro19 ceedings under sections 2(c), 3, and 4 (including a rule20 making proceeding to determine what constitutes proper 

21 identification within the meaning of section 610(a)(1) of 

22 the Fair Credit Reporting Act (15 U.S.C. 1681(h)(a)(1))) 

23 within 45 days after the date of enactment of this Act. 

24 The Commission shall promulgate all final rules pursuant 

25 to those rulemaking proceedings within 1 year after the 


bajohnson on PROD1PC69 with BILLS
51 

•S 1178 RS 

1 date of enactment of this Act. The provisions of sections 

2 2(c), 3, and 4 shall take effect on the same date 6 months 

3 after the date on which the Commission promulgates the 

4 last final rule under the proceeding or proceedings com5 menced under the preceding sentence. 

6 (d) PREEMPTION.—Section 10 shall take effect at the 

7 same time as sections 2(c), 3, and 4 take effect. 


bajohnson on PROD1PC69 with BILLS
Calendar No. 520 

110TH CONGRESS 

1ST SESSION S. 1178 

[Report No. 110

–235] 

A BILL 

To strengthen data protection and safeguards, revent identity theft. quire data breach notification, and further preDECEMBER 5, 2007 

Reported with amendments 


bajohnson on PROD1PC69 with BILLS