I 

108TH CONGRESS 

1ST SESSION H. R. 818

To amend the Gramm-Leach-Bliley Act to further protect customers of financial institutions whose identities are stolen from the financial institution, 

and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

FEBRUARY 13, 2003

Mr. KLECZKA (for himself and Mr. RYAN of Wisconsin) introduced the 

following bill; which was referred to the Committee on Financial Services 

A BILL

To amend the Gramm-Leach-Bliley Act to further protect 

customers of financial institutions whose identities are 

stolen from the financial institution, and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Identity Theft Con5 sumer Notification Act’’. 
2

•HR 818 IH 

1 SEC. 2. FINANCIAL INSTITUTION’S OBLIGATION TO 

2 PROMPTLY NOTIFY AND ASSIST CUSTOMERS 

3 WHOSE PERSONAL INFORMATION IS COM4 PROMISED. 

5 (a) PROMPT NOTICE AND ASSISTANCE.—Section 

6 503(b) of the Gramm-Leach-Bliley Act (15 U.S.C. 

7 6803(b)) is amended—

8 (1) by striking ‘‘and’’ at the end of paragraph 

9 (3); 

10 (2) by striking the period at the end of para11 graph (4) and inserting ‘‘; and’’; and 

12 (3) by inserting after paragraph (4) the fol13 lowing new paragraph: 

14 ‘‘(5) a statement that, upon discovering that 

15 the confidentiality or security of any nonpublic per16 sonal information maintained by the financial insti17 tution with respect to consumer has been com18 promised in any way by an employee of the financial 

19 institution, or through any unauthorized entry into 

20 the records of the financial institution, the financial 

21 institution is obligated—

22 ‘‘(A) to promptly notify the consumer of 

23 the compromise of the security or confiden24 tiality of such information, and any misuse of 

25 such information, that the financial institution 
3

•HR 818 IH 

1 discovers or reasonably should discover has oc2 curred; 

3 ‘‘(B) to provide assistance to the consumer 

4 to remedy any such compromise, including the 

5 duty of the financial institution under the Fair 

6 Credit Reporting Act to correct and update in7 formation contained in a consumer report relat8 ing to such consumer; 

9 ‘‘(C) to reimburse the consumer for any 

10 losses the consumer incurred as a result of the 

11 compromise of the security or confidentiality of 

12 such information, and any misuse of such infor13 mation, including any fees for obtaining, inves14 tigating, and correcting a consumer report of 

15 such consumer at any consumer reporting agen16 cy; and 

17 ‘‘(D) to provide information concerning the 

18 manner in which the consumer can obtain such 

19 assistance.’’. 

20 (b) WAIVER OF DISCLOSURE AT REQUEST OF LAW

21 ENFORCEMENT AGENCY FOR LIMITED TIME.—Section 

22 503 of the Gramm-Leach-Bliley Act (15 U.S.C. 6803) is 

23 amended by adding at the end the following new sub24 section: 
4

•HR 818 IH 

1 ‘‘(c) WAIVER OF DISCLOSURE AT REQUEST OF LAW

2 ENFORCEMENT AGENCY FOR LIMITED TIME.—A finan3 cial institution may delay notifying a consumer that the 

4 confidentiality or security of any nonpublic personal infor5 mation of the consumer maintained by the financial insti6 tution has been compromised at the request of a law en7 forcement agency investigating such violation for such lim8 ited period of time as the law enforcement agency deter9 mines is essential for carrying out the investigation.’’. 

10 (c) PENALTIES FOR FAILURE TO NOTIFY CUS11 TOMERS OF IDENTITY THEFT.—Section 503 of the 

12 Gramm-Leach-Bliley Act (15 U.S.C. 6803) is amended by 

13 inserting after subsection (c) (as added by subsection (b) 

14 of this section) the following new subsection: 

15 ‘‘(d) PENALTIES FOR FAILURE TO NOTIFY AND AS16 SIST CUSTOMERS AFTER IDENTITY THEFT.—The failure 

17 of any financial institution to promptly notify any con18 sumer that the confidentiality or security of any nonpublic 

19 personal information of the consumer maintained by the 

20 financial institution has been compromised in any way by 

21 an employee of the financial institution or through any 

22 unauthorized entry into the records of the financial insti23 tution, to provide assistance to such consumer, or to reim24 burse the consumer for any loss or fee described sub25 section (b)(5)(C) shall be treated as a violation of—
5

•HR 818 IH 

1 ‘‘(1) this title for purposes of enforcement ac2 tions required under section 505; and 

3 ‘‘(2) the requirements of section 623(a)(2) of 

4 the Fair Credit Reporting Act to correct and update 

5 information concerning the consumer in a consumer 

6 report at a consumer reporting agency.’’. 

7 SEC. 3. ADDITIONAL PROTECTION FOR VICTIMS OF IDEN8 TITY THEFT. 

9 Section 618 of the Fair Credit Reporting Act (15 

10 U.S.C. 1681p) is amended to read as follows: 

11 ‘‘SEC. 618. JURISDICTION OF COURTS; LIMITATIONS OF AC12 TIONS. 

13 ‘‘(a) IN GENERAL.—An action to enforce any liability 

14 created under this title may be brought in any appropriate 

15 United States district court, without regard to the amount 

16 in controversy, or in any other court of competent jurisdic17 tion, not later than 2 years after the date on which the 

18 violation is discovered or should have been discovered by 

19 the exercise of reasonable diligence. 

20 ‘‘(b) WILLFUL MISREPRESENTATION.—The limita21 tions period prescribed in subsection (a) shall be tolled 

22 during any period during which a defendant has materially 

23 and willfully misrepresented any information required 

24 under this title to be disclosed to an individual, and the 

25 information so misrepresented is material to the establish-
6

•HR 818 IH 

1 ment of the liability of the defendant to that individual 

2 under this title.’’.

Æ