II 

109TH CONGRESS 

1ST SESSION S. 500 

To regulate information brokers and protect individual rights with respect 

to personally identifiable information. 

IN THE SENATE OF THE UNITED STATES 

MARCH 3, 2005 

Mr. NELSON of Florida introduced the following bill; which was read twice and 

referred to the Committee on Commerce, Science, and Transportation 

A BILL 

To regulate information brokers and protect individual rights 

with respect to personally identifiable information. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Information Protection 

5 and Security Act’’. 

6 SEC. 2. CONGRESSIONAL FINDINGS; PURPOSE. 

7 (a) FINDINGS.—Congress finds the following: 

8 (1) Entities commonly known as ‘‘information 

9 brokers’’ have created up to several billion personal 

10 records on individuals. 
2 

•S 500 IS

1 (2) Information made available by information 

2 brokers is used in the determination of opportunities 

3 for credit, employment, housing, insurance, means of 

4 travel, and other commercial decisions, and must 

5 therefore be as accurate, transparent to the indi6 vidual, and secure as possible. Inaccurate informa7 tion pertaining to an individual that is made avail8 able by an information broker may significantly 

9 interfere with the individual’s economic opportuni10 ties. For these reasons, there is a vital need to en11 sure that information brokers exercise their impor12 tant responsibilities with fairness, impartiality, accu13 racy, and respect for individuals’ rights to privacy 

14 and security, and that information brokers properly 

15 safeguard individuals’ personally identifiable infor16 mation. 

17 (3) In 2004, an identity theft operation improp18 erly gained access to hundreds of thousands of indi19 vidual profiles maintained by one large information 

20 broker. Many of these individuals have and will be21 come victims of identity theft. The full extent of this 

22 incident will not be known for years. 

23 (4) Identity thieves illegally exploit information 

24 technology to take advantage of innocent individuals. 

25 Identity thieves typically steal individuals’ names, 
3 

•S 500 IS

1 addresses, telephone numbers, social security num2 bers, bank account information, and personal finan3 cial and medical data. Due to identity thieves mis4 using this personal information, some individuals are 

5 denied jobs, faced with debts that are not their own, 

6 and arrested for crimes they did not commit. 

7 (5) According to the Federal Trade Commis8 sion, 10,000,000 Americans were affected by iden9 tity theft in 2004, and the problem is growing worse. 

10 Identity theft is now the most common fraud per11 petrated on individuals. In 2004, identity theft ac12 counted for 39 percent of consumer fraud com13 plaints filed with the Federal Trade Commission. 

14 (6) According to a survey cited by the Federal 

15 Trade Commission, identity theft cost the United 

16 States $52,600,000,000 in 2004. Both individuals 

17 and businesses bear this heavy financial burden. 

18 (7) The increasing power of computers and in19 formation technology has greatly magnified the risk 

20 to individual privacy that can occur from any collec21 tion, maintenance, use, or dissemination of person22 ally identifiable information, as well as the number 

23 of individuals who can be harmed. 

24 (8) There is a clear difference between a com25 pilation of personally identifiable information and 
4 

•S 500 IS

1 the compilation’s component parts. Even for infor2 mation contained in public records, items of data 

3 that appear in widely scattered sources are different 

4 from the collection and assembly of that information 

5 into databases, reports, or profiles. The interest in 

6 maintaining the privacy and security of such data7 bases has always been, and will continue to be, very 

8 high. 

9 (9) In order to protect the privacy and security 

10 of individuals whose personally identifiable informa11 tion resides in systems maintained by information 

12 brokers, it is necessary and proper for Congress to 

13 regulate the collection, maintenance, use, and dis14 semination of such information by information bro15 kers by adopting a framework of fair information 

16 principles. It is the policy of Congress that informa17 tion brokers have an affirmative and continuing obli18 gation to protect the privacy and security of an indi19 vidual’s personally identifiable information. 

20 (b) PURPOSES.—The purposes of this Act are— 

21 (1) to regulate the narrow category of business 

22 entities commonly known as ‘‘information brokers’’, 

23 but not to extend the regulations to businesses other 

24 than information broker businesses, or to weaken or 
5 

•S 500 IS

1 alter the protections provided by other applicable 

2 laws; 

3 (2) to protect individual rights in relation to in4 formation brokers; and 

5 (3) to ensure that information brokers compete 

6 fairly in the processing and sale of personally identi7 fiable information. 

8 SEC. 3. REGULATION BY FEDERAL TRADE COMMISSION. 

9 (a) REGULATIONS.— 

10 (1) IN GENERAL.—Not later than 6 months 

11 after the date of enactment of this Act, the Federal 

12 Trade Commission (in this Act referred to as ‘‘the 

13 Commission’’) shall promulgate regulations with re14 spect to the conduct of information brokers and the 

15 protection of personally identifiable information held 

16 by such brokers. 

17 (2) CONTENT OF REGULATIONS.—The regula18 tions promulgated under paragraph (1) shall include 

19 rules— 

20 (A) requiring that procedures for the col21 lection and maintenance of data guarantee 

22 maximum possible accuracy of personally identi23 fiable information held by any information 

24 broker; 
6 

•S 500 IS

1 (B) allowing an individual the right to ob2 tain disclosure of all personally identifiable in3 formation pertaining to the individual held by 

4 an information broker, and to be informed of 

5 the identity of each entity that procured any 

6 personally identifiable information from the 

7 broker; 

8 (C) allowing individuals the right to re9 quest and receive prompt correction of errors in 

10 personally identifiable information held by in11 formation brokers; 

12 (D) requiring information brokers to safe13 guard and protect the confidentiality of person14 ally identifiable information, appropriate to the 

15 nature and type of information involved; 

16 (E) requiring information brokers to au17 thenticate users before allowing access to per18 sonally identifiable information, and requiring 

19 that each use of personal information is em20 ployed only for a lawful purpose; 

21 (F) requiring procedures to be established 

22 to prevent and detect fraudulent, unlawful, or 

23 unauthorized access, use, or disclosure of per24 sonally identifiable information held by an in25 formation broker, and to mitigate any potential 
7 

•S 500 IS

1 harm to individuals from threats to the privacy 

2 or security of such information; 

3 (G) requiring information brokers to estab4 lish and maintain procedures that track users’ 

5 access to personally identifiable information 

6 held by the broker, and the lawful purpose for 

7 which each access was made; and 

8 (H) prohibiting information brokers from 

9 engaging in activities that fail to comply with 

10 the Commission’s regulations. 

11 (b) DEFINITIONS.—In this section: 

12 (1) INFORMATION BROKER.— 

13 (A) IN GENERAL.—The term ‘‘information 

14 broker’’ means a commercial entity whose busi15 ness is to collect, assemble, or maintain person16 ally identifiable information for the sale or 

17 transmission of such information or the provi18 sion of access to such information to any third 

19 party, whether such collection, assembly, or 

20 maintenance of personally identifiable informa21 tion is performed by the information broker di22 rectly, or by contract or subcontract with any 

23 other entity. 

24 (B) EXEMPTIONS.—The Commission, in 

25 promulgating regulations under subsection (a), 
8 

•S 500 IS

1 may exempt any commercial entity from such 

2 regulations, in whole or in part, if the Commis3 sion determines that granting such an exemp4 tion is in the public interest, consistent with the 

5 purposes of this Act, and if the entity’s collec6 tion, assembly, and maintenance of personally 

7 identifiable information is only incidental to the 

8 entity’s primary business. 

9 (2) PERSONALLY IDENTIFIABLE INFORMA10 TION.—The term ‘‘personally identifiable informa11 tion’’ means any personal information, as deter12 mined by the Commission, which may be used to 

13 identify a person or cause harm to such person. 

14 SEC. 4. ENFORCEMENT. 

15 (a) ENFORCEMENT BY FEDERAL TRADE COMMIS16 SION.— 

17 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC18 TICES.—A violation of a regulation promulgated 

19 under section 2 shall be treated as a violation of a 

20 regulation under section 18(a)(1)(B) of the Federal 

21 Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) re22 garding unfair or deceptive acts or practices. 

23 (2) POWERS OF COMMISSION.—The Commis24 sion shall enforce the regulations promulgated under 

25 section 2 in the same manner, by the same means, 
9 

•S 500 IS

1 and with the same jurisdiction, powers, and duties 

2 as though all applicable terms and provisions of the 

3 Federal Trade Commission Act (15 U.S.C. 41 et 

4 seq.) were incorporated into and made a part of this 

5 Act. Any person who violates such regulations shall 

6 be subject to the penalties and entitled to the privi7 leges and immunities provided in that Act. Nothing 

8 in this Act shall be construed to limit the authority 

9 of the Commission under any other provision of law. 

10 (b) ACTIONS BY STATES.— 

11 (1) CIVIL ACTIONS.—In any case in which the 

12 attorney general of a State has reason to believe 

13 that an interest of the residents of that State has 

14 been or is threatened or adversely affected by an act 

15 or practice that violates any regulation of the Com16 mission promulgated under section 2, the State may 

17 bring a civil action on behalf of the residents of the 

18 State in a district court of the United States of ap19 propriate jurisdiction, or any other court of com20 petent jurisdiction, to— 

21 (A) enjoin that act or practice; 

22 (B) enforce compliance with the regulation; 

23 (C) obtain damages, restitution, or other 

24 compensation on behalf of residents of the 

25 State; or 
10 

•S 500 IS

1 (D) obtain such other legal and equitable 

2 relief as the court may consider to be appro3 priate. 

4 (2) NOTICE.—Before filing an action under this 

5 subsection, the attorney general of the State involved 

6 shall provide to the Commission and to the Attorney 

7 General a written notice of that action and a copy 

8 of the complaint for that action. If the State attor9 ney general determines that it is not feasible to pro10 vide the notice described in this subparagraph before 

11 the filing of the action, the State attorney general 

12 shall provide the written notice and the copy of the 

13 complaint to the Commission and to the Attorney 

14 General as soon after the filing of the complaint as 

15 practicable. 

16 (3) COMMISSION AND ATTORNEY GENERAL AU17 THORITY.—On receiving notice under paragraph (2), 

18 the Commission and the Attorney General each shall 

19 have the right— 

20 (A) to move to stay the action, pending the 

21 final disposition of a pending Federal matter as 

22 described in paragraph (4); 

23 (B) to intervene in an action under para24 graph (1); and 

25 (C) to file petitions for appeal. 
11 

•S 500 IS

1 (4) PENDING CRIMINAL PROCEEDINGS.—If the 

2 Attorney General has instituted a criminal pro3 ceeding or the Commission has instituted a civil ac4 tion for a violation of this Act or any regulations 

5 thereunder, no State may, during the pendency of 

6 such proceeding or action, bring an action under this 

7 subsection against any defendant named in the 

8 criminal proceeding or civil action for any violation 

9 that is alleged in that proceeding or action. 

10 (5) RULE OF CONSTRUCTION.—For purposes of 

11 bringing any civil action under paragraph (1), noth12 ing in this Act shall be construed to prevent an at13 torney general of a State from exercising the powers 

14 conferred on the attorney general by the laws of that 

15 State to conduct investigations, administer oaths 

16 and affirmations, or compel the attendance of wit17 nesses or the production of documentary and other 

18 evidence. 

19 (c) PRIVATE RIGHT OF ACTION.— 

20 (1) IN GENERAL.—Any individual injured by an 

21 act in violation of the regulations promulgated under 

22 section 2, if otherwise permitted by the laws or rules 

23 of the court of a State, bring in an appropriate court 

24 of that State— 

25 (A) an action to enjoin such violation; 
12 

•S 500 IS

1 (B) an action to recover for actual mone2 tary loss from such a violation, or to receive up 

3 to $1000 in damages for each such violation, 

4 whichever is greater; or 

5 (C) both such actions. 

6 (2) LIMITATION.—An action may be com7 menced under this subsection within 2 years after 

8 the date on which the alleged violation occurred, ex9 cept that where a defendant has materially and will10 fully misrepresented or disclosed any information 

11 under this Act or the regulations promulgated pur12 suant to this Act and the information so misrepre13 sented or disclosed is material to the establishment 

14 of the defendant’s liability under this Act or such 

15 regulations, the action may be brought by the indi16 vidual under paragraph (1) at any time within 3 

17 years after discovery by the individual of the mis18 representation or disclosure. 

19 (3) NONEXCLUSIVE REMEDY.—The remedy pro20 vided under this subsection shall be in addition to 

21 any other remedies available to the individual. 

22 SEC. 5. RELATION TO OTHER LAWS. 

23 (a) FAIR CREDIT REPORTING ACT.—Nothing in this 

24 Act or the regulations promulgated under this Act shall 

25 be construed to modify, limit or supersede the operation 
13 

•S 500 IS

1 of the Fair Credit Reporting Act. A person or entity sub2 ject to the Fair Credit Reporting Act shall comply with 

3 that Act as well as with this Act and the regulations pro4 mulgated under this Act. To the extent that there is any 

5 conflict between the Fair Credit Reporting Act and this 

6 Act or such regulations, the Act that affords an individual 

7 greater protection shall apply. Multiple requirements with 

8 respect to the same information, transaction, or individual 

9 shall not be considered a conflict. 

10 (b) STATE LAWS.—This Act and the regulations pro11 mulgated under this Act shall not be construed as super12 seding, altering, or affecting any statute, regulation, 

13 order, or interpretation in effect in any State, except to 

14 the extent that such statute, regulation, order, or interpre15 tation is inconsistent with the provisions of this Act or 

16 the regulations promulgated under this Act, and then only 

17 to the extent of the inconsistency. For purposes of this 

18 section, a State statute, regulation, order, or interpreta19 tion shall not be considered inconsistent with the provi20 sions of this Act or the regulations promulgated under this 

21 Act if the protection such statute, regulation, order, or in22 terpretation affords any person is greater than the protec23 tion under this Act or the regulations promulgated under 

24 this Act. 
14 

•S 500 IS

1 SEC. 6. REPORT. 

2 Not later than 12 months after the issuance of the 

3 regulations required by section 2, the Commission shall 

4 transmit to Congress a report on the information broker5 age industry and its impact on the privacy of personally 

6 identifiable information. Such report shall describe the 

7 regulations promulgated pursuant to this Act, compliance 

8 with such regulations by the information brokerage indus9 try, and any recommendations by the Commission for ad10 ditional measures (including any necessary legislation) to 

11 ensure the privacy of personally identifiable information. 

Æ