II 

108TH CONGRESS 

2D SESSION S. 2471

To regulate the transmission of personally identifiable information to foreign 

affiliates and subcontractors 

IN THE SENATE OF THE UNITED STATES 

MAY 20, 2004

Mrs. CLINTON introduced the following bill; which was read twice and referred 

to the Committee on the Judiciary 

A BILL

To regulate the transmission of personally identifiable 

information to foreign affiliates and subcontractors

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Safeguarding Ameri5 cans From Exporting Identification Data Act’’ or the 

6 ‘‘SAFE–ID Act’’. 

7 SEC. 2. DEFINITIONS. 

8 As used in this Act, the following definitions shall 

9 apply: 
2

•S 2471 IS 

1 (1) BUSINESS ENTERPRISE.—The term ‘‘busi2 ness enterprise’’ means— 

3 (A) any organization, association, or ven4 ture established to make a profit; 

5 (B) any health care business; 

6 (C) any private, nonprofit organization; or 

7 (D) any contractor, subcontractor, or po8 tential subcontractor of an entity described in 

9 subparagraph (A), (B), or (C). 

10 (2) HEALTH CARE BUSINESS.—The term 

11 ‘‘health care business’’ means any business enter12 prise or private, nonprofit organization that collects 

13 or retains personally identifiable information about 

14 consumers in relation to medical care, including— 

15 (A) hospitals; 

16 (B) health maintenance organizations; 

17 (C) medical partnerships; 

18 (D) emergency medical transportation 

19 companies; 

20 (E) medical transcription companies; 

21 (F) banks that collect or process medical 

22 billing information; and 

23 (G) subcontractors, or potential sub24 contractors, of the entities described in sub25 paragraphs (A) through (F). 
3

•S 2471 IS 

1 (3) PERSONALLY IDENTIFIABLE INFORMA2 TION.—The term ‘‘personally identifiable informa3 tion’’ includes information such as— 

4 (A) name; 

5 (B) postal address; 

6 (C) financial information; 

7 (D) medical records; 

8 (E) date of birth; 

9 (F) phone number; 

10 (G) e-mail address; 

11 (H) social security number; 

12 (I) mother’s maiden name; 

13 (J) password; 

14 (K) state identification information; and 

15 (L) driver’s license number. 

16 SEC. 3. TRANSMISSION OF INFORMATION. 

17 (a) PROHIBITION.—A business enterprise may not 

18 disclose personally identifiable information regarding a 

19 resident of the United States to any foreign branch, affil20 iate, subcontractor, or unaffiliated third party located in 

21 a foreign country unless— 

22 (1) the business enterprise provides the notice 

23 of privacy protections described in sections 502 and 

24 503 of the Gramm-Leach-Bliley Act (15 U.S.C. 

25 6802 and 6803) or required by the regulations pro-
4

•S 2471 IS 

1 mulgated pursuant to section 264(c) of the Health 

2 Insurance Portability and Accountability Act of 

3 1996 (42 U.S.C. 1320d–2 note), as appropriate; 

4 (2) the business enterprise complies with the 

5 safeguards described in section 501(b) of the 

6 Gramm-Leach-Bliley Act (15 U.S.C. 6801(b)), as 

7 appropriate; 

8 (3) the consumer is given the opportunity, be9 fore the time that such information is initially dis10 closed, to object to the disclosure of such informa11 tion to such foreign branch, affiliate, subcontractor, 

12 or unaffiliated third party; and 

13 (4) the consumer is given an explanation of how 

14 the consumer can exercise the nondisclosure option 

15 described in paragraph (3). 

16 (b) HEALTH CARE BUSINESSES.—A health care 

17 business may not terminate an existing relationship with 

18 a consumer of health care services to avoid the consumer 

19 from objecting to the disclosure under subsection (a)(3). 

20 (c) EFFECT ON BUSINESS RELATIONSHIP.— 

21 (1) NONDISCRIMINATION.—A business enter22 prise may not discriminate against or deny an other23 wise qualified consumer a financial product or a 

24 health care service because the consumer has ob25 jected to the disclosure under subsection (a)(3).
5

•S 2471 IS 

1 (2) PRODUCTS AND SERVICES.—A business en2 terprise shall not be required to offer or provide a 

3 product or service through affiliated entities or joint4 ly with nonaffiliated business enterprises. 

5 (3) INCENTIVES AND DISCOUNTS.—Nothing in 

6 this subsection is intended to prohibit a business en7 terprise from offering incentives or discounts to elic8 it a specific response to the notice required under 

9 subsection (a). 

10 (d) LIABILITY.— 

11 (1) IN GENERAL.—A business enterprise that 

12 knowingly and directly transfers personally identifi13 able information to a foreign branch, affiliate, sub14 contractor, or unaffiliated third party shall be liable 

15 to any person suffering damages resulting from the 

16 improper storage, duplication, sharing, or other mis17 use of such information by the transferee. 

18 (2) CIVIL ACTION.—An injured party under 

19 paragraph (1) may sue in law or in equity in any 

20 court of competent jurisdiction to recover the dam21 ages sustained as a result of a violation of this sec22 tion. 

23 (e) RULEMAKING.—The Chairman of the Federal 

24 Trade Commission shall promulgate regulations through 

25 which the Chairman may enforce the provisions of this 
6

•S 2471 IS 

1 section and impose a civil penalty for a violation of this 

2 section. 

3 SEC. 4. PRIVACY FOR CONSUMERS OF HEALTH SERVICES. 

4 The Secretary of Health and Human Services shall 

5 revise the regulations promulgated pursuant to section 

6 264(c) of the Health Insurance Portability and Account7 ability Act of 1996 (42 U.S.C. 1320d–2 note) to require 

8 a covered entity (as defined under such regulations) that 

9 outsources protected health information (as defined under 

10 such regulations) outside the United States to include in 

11 such entity’s notice of privacy protections— 

12 (1) notification that the covered entity 

13 outsources protected health information to business 

14 associates (as defined under such regulations) for 

15 processing outside the United States; 

16 (2) a description of the privacy laws of the 

17 country to which the protected health information 

18 will be sent; 

19 (3) any additional risks and consequences to 

20 the privacy and security of protected health informa21 tion that arise as a result of the processing of such 

22 information in a foreign country; 

23 (4) additional measures the covered entity is 

24 taking to protect the protected health information 

25 outsourced for processing outside the United States; 
7

•S 2471 IS 

1 (5) notification that the protected health infor2 mation will not be outsourced outside the United 

3 States if the consumer objects; and 

4 (6) a certification that— 

5 (A) the covered entity has taken reason6 able steps to identify the locations where pro7 tected health information is outsourced by such 

8 business associates; 

9 (B) attests to the privacy and security of 

10 the protected health information outsourced for 

11 processing outside the United States; and 

12 (C) states the reasons for the determina13 tion by the covered entity that the privacy and 

14 security of such information is maintained. 

15 SEC. 5. PRIVACY FOR CONSUMERS OF FINANCIAL SERV16 ICES. 

17 Section 503(b) of the Gramm-Leach-Bliley Act (15 

18 U.S.C. 6803(b)) is amended— 

19 (1) in paragraph (3), by striking ‘‘and’’ after 

20 the semicolon; 

21 (2) in paragraph (4), by striking the period at 

22 the end and inserting ‘‘; and’’; and 

23 (3) by adding at the end the following: 
8

•S 2471 IS 

1 ‘‘(5) if the financial institution outsources non2 public personal information outside the United 

3 States— 

4 ‘‘(A) information informing the consumer 

5 in simple language— 

6 ‘‘(i) that the financial institution 

7 outsources nonpublic personal information 

8 to entities for processing outside the 

9 United States; 

10 ‘‘(ii) of the privacy laws of the coun11 try to which nonpublic personal informa12 tion will be sent; 

13 ‘‘(iii) of any additional risks and con14 sequences to the privacy and security of an 

15 individual’s nonpublic personal information 

16 that arise as a result of the processing of 

17 such information in a foreign country; and 

18 ‘‘(iv) of the additional measures the 

19 financial institution is taking to protect the 

20 nonpublic personal information outsourced 

21 for processing outside the United States; 

22 and 

23 ‘‘(B) a certification that— 

24 ‘‘(i) the financial institution has taken 

25 reasonable steps to identify the locations 
9

•S 2471 IS 

1 where nonpublic personal information is 

2 outsourced by such entities; 

3 ‘‘(ii) attests to the privacy and secu4 rity of the nonpublic personal information 

5 outsourced for processing outside the 

6 United States; and 

7 ‘‘(iii) states the reasons for the deter8 mination by the institution that the privacy 

9 and security of such information is main10 tained.’’ 

11 SEC. 6. EFFECTIVE DATE. 

12 This Act shall take effect on the expiration of the 

13 date which is 90 days after the date of enactment of this 

14 Act.

Æ