(E) provide consumers free file 
monitoring where appropriate to re-
duce the risk of identity theft. 
SEC. 2. DATA SECURITY SAFEGUARDS. 
(a) IN GENERAL.—As set forth in section 630 
of the Fair Credit Reporting Act, as amended 
by the Act, in the event a consumer reporter be-
comes aware of information suggesting a 
breach of data security, such consumer re-
porter shall immediately conduct an inves-
tigation, and notify authorities and consumers 
as appropriate. 
(b) FCRA DATA SECURITY AMENDMENT.— 
The Fair Credit Reporting Act (15 U.S.C. 1681) 
is amended by adding at the end the following 
new section: 
‘‘SEC. 630. DATA SECURITY SAFEGUARDS. 
‘‘(a) PROTECTION
OF SENSITIVE FINANCIAL 
PERSONAL INFORMATION.— 
‘‘(1) DATA
SECURITY
OBLIGATION
POL-
ICY.—It is the policy of the Congress that 
each consumer reporter has an affirma-
tive and continuing obligation to protect 
the security and confidentiality of sen-
sitive financial personal information. 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00075
Fmt 6652
Sfmt 6204
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
‘‘(2) SECURITY
POLICIES
AND
PROCE-
DURES.—Each consumer reporter shall 
have an affirmative obligation to imple-
ment, and a continuing obligation to 
maintain, reasonable policies and proce-
dures to protect the security and confiden-
tiality of sensitive financial personal in-
formation relating to any consumer that 
is handled by such consumer reporter 
against any loss, unauthorized access, or 
misuse that is reasonably likely to result 
in harm or inconvenience to such con-
sumer. 
‘‘(3) DATA DESTRUCTION AND DATA DIS-
POSAL
POLICIES
AND
PROCEDURES.—The 
policies 
and 
procedures 
described 
in 
paragraph (2) shall include providing for 
the proper disposal of sensitive financial 
personal information in accordance with 
the standards, guidelines, or regulations 
issued pursuant to this title. 
‘‘(b) INVESTIGATION REQUIREMENTS.— 
‘‘(1) INVESTIGATION
TRIGGER.—A con-
sumer reporter shall immediately conduct 
a data security breach investigation if it— 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00076
Fmt 6652
Sfmt 6204
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
‘‘(A) becomes aware of any infor-
mation indicating a reasonable likeli-
hood that a data security breach has 
occurred or is unavoidable; 
‘‘(B) becomes aware of information 
indicating an unusual pattern of mis-
use of sensitive financial personal in-
formation handled by a consumer re-
porter indicative of financial fraud; 
or 
‘‘(C) receives a notice under sub-
section (e). 
‘‘(2) SCOPE
OF
INVESTIGATION.—Such 
investigation shall be conducted in a 
manner commensurate with the nature 
and the amount of the sensitive financial 
personal information that is subject to the 
breach of data security, including appro-
priate actions to— 
‘‘(A) assess the nature and scope of 
the potential breach; 
‘‘(B) identify the sensitive finan-
cial personal information potentially 
involved; 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00077
Fmt 6652
Sfmt 6204
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
‘‘(C) determine whether such in-
formation is usable by the parties 
causing the breach; and 
‘‘(D) determine the likelihood that 
such information has been, or will be, 
misused in a manner that may cause 
harm or inconvenience to the related 
consumer. 
‘‘(3) ENCRYPTION
AND
OTHER
SAFE-
GUARDS.— 
‘‘(A) SUGGESTED SAFEGUARDS.—The 
regulators 
described 
in 
subsection 
(k)(1) shall jointly develop standards 
and guidelines to identify and regu-
larly update appropriate technology 
safeguards for making consumer re-
porter’s sensitive financial personal 
information unusable in a manner 
commensurate with the nature and 
the amount of such information, in-
cluding— 
‘‘(i) 
consideration 
of 
the 
encryption standards adopted by 
the National Institute of Stand-
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00078
Fmt 6652
Sfmt 6204
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
ards and Technology for use by 
the Federal Government; and 
‘‘(ii) appropriate management 
and protection of keys or codes 
necessary to protect the integrity 
of encrypted information. 
‘‘(B) SAFEGUARD
FACTORS.—In de-
termining the likelihood of a data se-
curity breach, a consumer reporter 
may consider whether the information 
subject to the potential breach is un-
usable because it is encrypted, re-
dacted, requires technology to use that 
is not generally commercially avail-
able, or has otherwise similarly been 
rendered unreadable. 
‘‘(C) SAFE HARBOR FOR PROTECTED 
DATA.—As set forth in the standards 
and guidelines issued pursuant to 
subparagraph (A), a consumer re-
porter may reasonably conclude that 
a data security breach is not likely to 
have occurred where the sensitive per-
sonal financial information involved 
has been encrypted, redacted, requires 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00079
Fmt 6652
Sfmt 6204
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS