(13) The Cable Communications Policy Act of 
1984 (47 U.S.C. 521 et seq.). 
(14) The Communications Assistance for Law 
Enforcement Act (47 U.S.C. 1001 et seq.). 
(15) The Video Privacy Protection Act of 1988 
(Public Law 100–618). 
(16) The Telephone Consumer Protection Act 
of 1991 (Public Law 102–243). 
(17) The Health Insurance Portability and Ac-
countability Act of 1996 (Public Law 104–191), as 
it relates to an entity described in section 1172(a) 
of the Social Security Act (42 U.S.C. 1320d–1(a)) 
or to activities regulated under section 1173 of such 
Act (42 U.S.C. 1320d–2). 
(d) PREEMPTION OF STATE PRIVACY LAWS.—This 
title preempts any statutory law, common law, rule, or 
regulation of a State, or a political subdivision of a State, 
to the extent such law, rule, or regulation relates to or 
affects the collection, use, sale, disclosure, retention, or 
dissemination of personally identifiable information in 
commerce. No State, or political subdivision of a State, 
may take any action to enforce this title.
SEC. 110. EFFECTIVE DATE. 
This title shall apply with respect to personally identi-
fiable information collected on or after the date that is 
1 year after the date of enactment of this Act. 
TITLE II—IDENTITY THEFT 
PREVENTION AND REMEDIES 
SEC. 201. FACILITATING ELECTRONIC IDENTITY THEFT AF-
FIDAVITS. 
The Commission shall take such action as necessary 
to permit (including by electronic means) consumers that 
have a reasonable belief that they are a victim of identity 
theft— 
(1) to enter required consumer information in 
the commission-developed document entitled ‘‘Iden-
tity Theft Affidavit’’; and 
(2) to submit completed forms and other sup-
plemental information to the Commission and other 
entities. 
SEC. 202. PROMOTING USE OF COMMON IDENTITY THEFT 
AFFIDAVIT. 
The Commission shall take such action as necessary 
to solicit the acceptance and acknowledgement of stand-
ardized Identity Theft Affidavit by entities that receive 
disputes regarding the unauthorized use of accounts of 
such entities from consumers that have reason to believe 
that they are victims of identity theft.
SEC. 203. TIMELY RESOLUTION OF IDENTITY THEFT DIS-
PUTES. 
The Commission shall require entities that receive 
disputes regarding the unauthorized use of accounts of 
such entities from consumers that have reason to believe 
that they are victims of identity theft to conduct any nec-
essary investigation and decide an outcome of a claim 
within 90 days from the date on which all necessary infor-
mation to investigate the claim has been submitted to the 
entity. 
SEC. 
204. 
IMPROVEMENTS 
TO 
CONSUMER 
CLEARING-
HOUSE. 
The Commission shall utilize the Identity Theft 
Clearinghouse to permit consumers that have a reasonable 
belief that they are victims of identity theft to submit any 
information relevant to such identity theft to the Clearing-
house (including by means of an Identity Theft Affidavit), 
so that such information may be transmitted by the Clear-
inghouse to appropriate entities for necessary protective 
action and to mitigate losses resulting from such identity 
theft. 
SEC. 205. IMPROVED IDENTITY THEFT DATA. 
(a) IN GENERAL.—The Commission shall— 
(1) establish a process to contact, not less than 
annually, public and private entities that receive and 
process complaints from consumers that have a rea-
sonable belief that they are victims of identity theft; 
and 
(2) obtain accurate data on the incidences and 
nature of complaints from such entities. 
(b) INCLUSION
IN DATABASE.—Such information 
shall be made part of the Commission’s Identity Theft 
Clearinghouse database. 
SEC. 206. CHANGE OF ADDRESS PROTECTIONS. 
The Commission shall require appropriate entities to 
take reasonable steps to verify the accuracy of a con-
sumer’s address, including by confirming a consumer’s 
change of address by sending a confirmation of such 
change to the old and the new address of the consumer. 
SEC. 207. EFFECTIVE DATE. 
This title shall take effect 180 days after the date 
of enactment of this Act. 
TITLE III—INTERNATIONAL 
PROVISIONS 
SEC. 301. STUDY BY COMPTROLLER GENERAL. 
The Comptroller General of the United States shall 
conduct a study and issue a report analyzing the impact 
on the interstate and foreign commerce of the United 
States of information privacy laws, regulations, or agree-
ments enacted, promulgated, or adopted by other nations, 
including regional or international agreements between
nations, and whether the enforcement mechanisms or pro-
cedures of those laws, regulations, or agreements result 
in discriminatory treatment of United States entities. The 
first report under this section shall be issued not later 
than 120 days after the date of enactment of this Act and 
subsequent reports shall be issued every 3 years there-
after. 
SEC. 302. REMEDIATION OF DISCRIMINATORY IMPACT BY 
SECRETARY OF COMMERCE. 
If the Comptroller General of the United States finds, 
in the study and report under section 301, that such infor-
mation privacy laws, regulations, or agreements substan-
tially impede interstate and foreign commerce of the 
United States and that the enforcement mechanisms or 
procedures of the information privacy laws, regulations, 
or agreements described in such subsection result in dis-
criminatory treatment of United States entities, the Sec-
retary of Commerce shall, to the extent permitted by law 
take all steps necessary to mitigate against such discrimi-
natory impact within 180 days after the report making 
such findings is issued. 
SEC. 303. EFFECT OF NONREMEDIATION. 
(a) RECOMMENDATIONS.—If by the end of the 180- 
day period described in section 302, the Secretary of Com-
merce has not attained complete relief from the discrimi-
natory impact described in such subsection, the Secretary 
shall report to the Congress and the President rec-
ommendations on action to relieve any such remaining dis-
criminatory impact. 
(b) FEDERAL AGENCY ACTION AFTER CONSIDER-
ATION BY CONGRESS.—During the period after the Sec-
retary reports recommendations under subsection (a) for 
mitigation of discriminatory impact and before the Con-
gress acts with respect to such recommendations, no offi-
cer or employee of any Federal agency may take or con-
tinue any action to enjoin, or impose any penalty on, a 
United States entity, or a citizen or legal resident of the 
United States, for the purpose of fulfilling an international 
obligation of the United States under an international pri-
vacy agreement (other than such an obligation under a 
ratified treaty) that resulted in such discriminatory im-
pact. 
SEC. 304. HARMONIZATION OF INTERNATIONAL PRIVACY 
LAWS, REGULATIONS, AND AGREEMENTS. 
Beginning on the date of enactment of this Act, the 
Secretary of Commerce shall provide notice of the provi-
sions of this Act to other nations, individually, or as mem-
bers of international organizations or unions that have en-
acted, promulgated, or adopted information privacy laws, 
regulations, or agreements, and shall seek recognition of
this Act by such nations, organizations, or unions. The 
Secretary shall seek the harmonization of this Act with 
such information privacy laws, regulations, or agreements, 
to the extent such harmonization is necessary for the ad-
vancement of transnational commerce, including electronic 
commerce. 
Æ