I 
108TH CONGRESS 
1ST SESSION H. R. 2617
To protect American consumers from identity theft and other forms of fraud. 
IN THE HOUSE OF REPRESENTATIVES 
JUNE 26, 2003
Mr. SHADEGG introduced the following bill; which was referred to the Com-
mittee on Financial Services, and in addition to the Committees on Ways 
and Means, and Energy and Commerce, for a period to be subsequently 
determined by the Speaker, in each case for consideration of such provi-
sions as fall within the jurisdiction of the committee concerned 
A BILL 
To protect American consumers from identity theft and other 
forms of fraud.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Consumer Identity and 
Information Security Act of 2003’’. 
SEC. 2. PROHIBITED ACTIONS WITH RESPECT TO SOCIAL 
SECURITY NUMBERS. 
(a) DEFINITIONS.—For purposes of this section, the 
following definitions shall apply:
(1) DISPLAY.—The term ‘‘display’’ means to in-
tentionally communicate or otherwise make available 
(on the Internet or in any other manner) to the gen-
eral public an individual’s social security number. 
(2) PERSON.—The term ‘‘person’’ means any 
individual, partnership, corporation, trust, estate, co-
operative, association, or any other entity. 
(3) STATE.—The term ‘‘State’’ means any 
State of the United States, the District of Columbia, 
Puerto Rico, the Northern Mariana Islands, the 
United States Virgin Islands, Guam, American 
Samoa, and any territory or possession of the 
United States. 
(b) PROHIBITED ACTIONS WITH RESPECT TO AN IN-
DIVIDUAL’S SOCIAL SECURITY NUMBER.—Subject to sub-
sections (c) and (d), no person may engage in any of the 
following: 
(1) Display in any manner an individual’s social 
security number. 
(2) Print or otherwise display an individual’s 
social security number on any card, or other means 
of access, required for the individual to access prod-
ucts or services provided by the person to the indi-
vidual.
(3) Require an individual to transmit the indi-
vidual’s social security number over the Internet, un-
less the connection is secure or the social security 
number is encrypted. 
(4) Require an individual to use the individual’s 
social security number to access an Internet Web 
site, unless a password, unique personal identifica-
tion number, or other authentication device is also 
required to access the Internet Web site. 
(5) Print or otherwise display an individual’s 
social security number on any communications by 
the person to the individual, unless Federal or State 
law, or any Federal agency or any contractor with 
the Federal Government (under color of Federal 
law), requires the individual’s social security number 
to be included on such documents. 
(c) EXCEPTION FOR CERTAIN COMMUNICATIONS.—
Subsection (b)(5) shall not apply with respect an individ-
ual’s social security number included on documents sent 
by mail—
(1) in connection with an application or enroll-
ment process initiated by the individual; or 
(2) to establish, amend, or terminate an ac-
count held by the individual with the person; or
(3) to verify the accuracy of the individual’s so-
cial security number. 
(d) EXCEPTION FOR PRIOR ON-GOING USE.—Sub-
section (b) shall not apply to the use by a person of an 
individual’s social security number in a manner that is in-
consistent with such subsection if—
(1) the use by such person of the individual’s 
social security number in such manner began before 
the date of the enactment of this Act; 
(2) the use by such person of the social security 
number in such manner is continuous; and 
(3) the person notifies the individual, in writ-
ing, before the end of the 30-day period beginning 
on the date of the enactment of this Act and annu-
ally thereafter, that the individual has the right to 
require such person to stop using the individual’s so-
cial security number in a manner inconsistent with 
subsection (b). 
(e) INDIVIDUAL’S REQUEST TO STOP INCONSISTENT 
USE.—
(1) IN GENERAL.—If a person receives a writ-
ten request from an individual to stop using the in-
dividual’s social security number in a manner that is
inconsistent with subsection (b), the person shall 
fully comply with such request before the end of the
30-day period beginning on the date of the receipt 
of the request. 
(2) DENIAL OF PRODUCTS OR SERVICES PRO-
HIBITED.—A person may not deny any product or 
service to an individual, or otherwise discriminate 
against such individual in the provision of any such 
product or service, solely on the basis that the indi-
vidual submitted a request described in paragraph 
(1). 
(f) COORDINATION WITH OTHER LAW.—
(1) IN GENERAL.—No provision of this section 
shall be construed as prohibiting or limiting the dis-
play or use of an individual’s social security number 
by any person—
(A) to the extent required or authorized 
under any Federal or State law, or by any Fed-
eral agency or any contractor with the Federal 
Government (under color of Federal law); 
(B) for internal verification or administra-
tive purposes of the person; 
(C) for a public health purpose, including 
the protection of the health or safety of an indi-
vidual in an emergency situation; 
(D) for a national security purpose; or
(E) for a law enforcement purpose, includ-
ing the investigation of fraud. 
(2) STUDY AND REPORT.—
(A) 
IN
GENERAL.—The 
Secretary 
of 
Health and Human Services shall conduct a 
study and prepare a report on all of the uses 
of social security numbers permitted, required, 
authorized, or excepted under any Federal law 
and State and local uses of social security num-
bers. 
(B) REPORT.—Not later than 1 year after 
the date of enactment of this Act, the Secretary 
of Health and Human Services shall submit a 
report to Congress on the study conducted 
under this paragraph. 
(C) CONTENTS OF REPORT.—The report 
shall include—
(i) a detailed description of the uses 
of an individual’s social security number 
that are allowed as of the date of enact-
ment of this Act; 
(ii) an evaluation of whether such 
uses should be continued or discontinued 
by appropriate legislative action; and
(iii) such other recommendations for 
legislative or administrative action as the 
Secretary determines to be appropriate. 
(g) CIVIL PENALTIES.—
(1) IN GENERAL.—Any person who the Attor-
ney General determines has violated this section 
shall be subject, in addition to any other penalties 
that may be prescribed by law—
(A) to a civil penalty of not less than 
$5,000 for each such violation; and 
(B) to a civil penalty of not less than 
$50,000, if the violations have occurred with 
such frequency as to constitute a general busi-
ness practice. 
(2) DETERMINATION
OF
VIOLATIONS.—Any 
knowing violation committed contemporaneously 
with respect to the social security numbers of 2 or 
more individuals by means of mail, telecommuni-
cation, or otherwise, shall be treated as a separate 
violation with respect to each such individual. 
(3) ENFORCEMENT PROCEDURES.—The provi-
sions of section 1128A of the Social Security Act 
(42 U.S.C. 1320a–7a), other than subsections (a), 
(b), (f), (h), (i), (j), (m), and (n) and the first sen-
tence of subsection (c) of such section, and the pro-
visions of subsections (d) and (e) of section 205 of 
such Act (42 U.S.C. 405) shall apply to a civil pen-
alty action under this subsection in the same man-
ner as such provisions apply to a penalty or pro-
ceeding under section 1128A(a) of such Act (42 
U.S.C. 1320a–7a(a)), except that, for purposes of 
this paragraph, any reference in section 1128A of 
such Act (42 U.S.C. 1320a–7a) to the Secretary 
shall be deemed to be a reference to the Attorney 
General. 
(h) EFFECTIVE DATE.—This section shall apply after 
the end of the 180-day period beginning on the date of 
the enactment of this Act. 
SEC. 3. IMPROPER USE OF CREDIT CARD, DEBIT CARD, AND 
OTHER PAYMENT DEVICE NUMBERS. 
(a) IN GENERAL.—Except as provided in subsection 
(b), no person that accepts, in connection with the trans-
action of business, credit cards, debit cards, or other 
means of access to a consumer’s account for the purpose 
of initiating electronic fund transfers shall print, on any 
receipt provided to the cardholder or accountholder at the 
point of the business transaction—
(1) more than the last 5 digits of the account 
number of any such credit card, debit card, or con-
sumer account; or
(2) the expiration date of any such credit card, 
debit card, or other means of access to a consumer’s 
account. 
(b) SCOPE OF APPLICATION.—This section applies 
only to receipts that are electronically printed, and shall 
not apply to transactions in which the sole means of re-
cording the credit card or debit card account number, or 
the account number of a consumer’s account, is by hand-
writing or by an imprint or copy of the credit card, debit 
card, or other means of access. 
(c) DEFINITIONS.—For purposes of this section, the 
following definitions shall apply: 
(1) CONSUMER’S
ACCOUNT.—The term ‘‘con-
sumer’s account’ means an account (as defined in 
paragraph (2) of section 903 of the Electronic Fund 
Transfer Act) of a consumer (as defined in para-
graph (5) of such section). 
(2) CREDIT CARD.—The term ‘‘credit card’’ has 
the same meaning as in section 103(k) of the Truth 
in Lending Act. 
(3) DEBIT
CARD.—The term ‘‘debit card’’ 
means any card issued by a financial institution to 
a consumer for use in initiating electronic fund 
transfers from the account of the consumer at such 
financial institution for the purpose of transferring
money between accounts or obtaining money, prop-
erty, labor, or services. 
(4) ELECTRONIC FUND TRANSFER.—The term 
‘‘electronic fund transfer’’ has the same meaning as 
in section 903(6) of the Electronic Fund Transfer 
Act. 
(d) EFFECTIVE DATE.—This section shall take effect 
on January 1, 2005, with respect to any cash register or 
other machine or device that electronically prints receipts 
for credit card transactions. 
(e) CIVIL LIABILITY.—Any person who violates this 
section with regard to any credit card, debit card, or other 
means of access to a consumer’s account shall be liable 
for any damages or expenses, including reasonable attor-
ney’s fees, that the card holder or consumer incurs as a 
result of such violation, including losses incurred from the 
unauthorized use of the account number of any such credit 
card, debit card, or consumer’s account as a result of such 
violation. 
SEC. 4. IDENTITY THEFT PREVENTION. 
(a) DUTY
OF ISSUERS
OF CREDIT
AND DEBIT 
CARDS.—
(1) CREDIT CARDS.—Section 132 of the Truth 
in Lending Act (15 U.S.C. 1642) is amended—
(A) by inserting ‘‘(a) IN GENERAL.—’’ be-
fore ‘‘No credit’’; and 
(B) by adding at the end the following: 
‘‘(b) VERIFICATION OF CONSUMER IDENTITY UPON 
RECEIVING
A REQUEST
FOR
AN ADDITIONAL CARD 
AFTER A CHANGE OF ADDRESS.—Each card issuer shall 
establish procedures for verifying the identification of a 
consumer whenever the card issuer receives a request from 
a consumer for an additional credit card with respect to 
an existing credit account not later than 30 days after 
receiving notification of a change of address for that ac-
count.’’. 
(2) DEBIT CARDS.—Section 911 of the Elec-
tronic Fund Transfer Act (15 U.S.C. 1693i) is 
amended by adding at the end the following new 
subsection: 
‘‘(d) VERIFICATION OF CONSUMER IDENTITY UPON 
RECEIVING
A REQUEST AFTER
A CHANGE
OF AD-
DRESS.—Each person who issues to a consumer any code, 
card, or other means of access to such consumer’s account 
shall establish procedures for verifying the identification 
of the consumer whenever such person receives a request 
from a consumer for an additional card, code, or other 
means of access to the consumer’s account not later than
30 days after receiving notification of a change of address 
for that account.’’. 
(b) CENTRALIZED REPORTING SYSTEM.—The Fed-
eral Trade Commission shall coordinate the establishment 
of a centralized reporting system in which all consumer 
reporting agencies (as defined in section 603 of the Fair 
Credit Reporting Act) shall participate that will—
(1) allow any consumer or business to report, 
through the use of an nationwide free telephone 
number and an Internet Web site address, any sus-
pected violation of section 1028 of title 18, United 
States Code; and 
(2) allow such information to be immediately 
shared among all such consumer reporting agencies. 
SEC. 5. FRAUD ALERTS. 
Section 605 of the Fair Credit Reporting Act (15 
U.S.C. 1681c) is amended by adding at the end the fol-
lowing new subsection: 
‘‘(g) FRAUD ALERTS.—
‘‘(1) FRAUD ALERT DEFINED.—For purposes of 
this subsection, the term ‘fraud alert’ means a state-
ment in the file of a consumer that notifies all pro-
spective users of a consumer report made with re-
spect to that consumer that—
‘‘(A) the consumer’s identity may have 
been used, without the consumer’s consent, to 
fraudulently obtain goods or services in the con-
sumer’s name; and 
‘‘(B) the consumer does not authorize the 
issuance or extension of credit in the name of 
the consumer unless the issuer of such credit 
utilizes reasonable procedures established by the 
issuer to verify the consumer’s identity and ob-
tain the consumer’s authorization whenever the 
card issuer receives a request for credit. 
‘‘(2) INCLUSION
OF
FRAUD
ALERT
IN
CON-
SUMER FILE.—Upon the request of a consumer, or 
another third party who has the consumer’s consent 
to request a fraud alert on the consumer’s behalf, 
and upon receiving proper identification, a consumer 
reporting agency shall include a fraud alert in the 
file of that consumer and shall maintain the fraud 
alert for not less than 1 year, unless the consumer 
requests a shorter time period. 
‘‘(3) NOTICE SENT BY CONSUMER REPORTING 
AGENCIES TO USERS.—A consumer reporting agency 
shall notify each person procuring consumer credit 
information with respect to a consumer of the exist-
ence of a fraud alert in the file of that consumer,
regardless of whether a full credit report, credit 
score, or summary report is requested. 
‘‘(4) NOTICE TO NATIONWIDE CONSUMER RE-
PORTING AGENCIES.—Whenever a consumer report-
ing agency that compiles and maintains files on con-
sumers on a nationwide basis receives a request 
from a consumer, directly or through another con-
sumer reporting agency, to include a fraud alert in 
the consumer’s file, the consumer reporting agency 
shall promptly notify every other consumer reporting 
agency that compiles and maintains files on con-
sumers on a nationwide basis that such request has 
been received and each such other agency shall com-
ply with paragraph (2) in the same manner as if the 
agency had received the request directly from the 
consumer. 
‘‘(5) TOLL-FREE TELEPHONE NUMBER.—Each 
consumer reporting agency referred to in paragraph 
(4) shall establish and maintain a toll-free telephone 
number for consumers to request fraud alerts. 
‘‘(6) 
PROCEDURES
TO
RECEIVE
FRAUD 
ALERTS.—Any person who uses a consumer credit 
report in connection with a credit transaction shall 
establish reasonable procedures to receive fraud 
alerts transmitted by consumer reporting agencies.
‘‘(7) VIOLATIONS.—
‘‘(A) CONSUMER
REPORTING
AGENCY.—
Any consumer reporting agency that fails to no-
tify any user of a consumer credit report of the 
existence of a fraud alert in that report shall be 
in violation of this section. 
‘‘(B) USER
OF
A
CONSUMER
REPORT.—
Any user of a consumer report that fails to 
comply with preauthorization procedures con-
tained in a fraud alert and issues or extends 
credit in the name of the consumer to a person 
other than the consumer shall be in violation of 
this section. 
‘‘(8) EXEMPT INSTITUTIONS.—The requirement 
under this subsection to place a fraud alert in a con-
sumer file shall not apply to—
‘‘(A) check services company or a fraud 
prevention company, which issues authoriza-
tions for the purpose of approving or processing 
negotiable instruments, electronic funds trans-
fers or similar methods of payments; or 
‘‘(B) deposit account information service 
company, which issues reports regarding ac-
count closures due to fraud, substantial over-
drafts, automated teller machine abuse, or simi-
lar negative information regarding a consumer, 
to inquiring banks or other financial institu-
tions for use only in reviewing a consumer re-
quest for a deposit account at the inquiring 
bank or financial institution. 
‘‘(9) POLICY REVIEW AND REGULATION.—
‘‘(A) REVIEW.—Any agency referred to in 
subsection (a) or (c) of section 621 shall, upon 
the request of any person under the jurisdiction 
of such agency pursuant to this title—
‘‘(i) review any policy or procedure es-
tablished by such person to carry out the 
purposes of this subsection to determine 
the effectiveness and reasonableness of the 
policy or procedure for such purposes; and 
‘‘(ii) make such recommendations to 
such person for improvement in such policy 
or procedure as the agency may determine 
to be appropriate. 
‘‘(B) REGULATION.—Each agency referred 
to in subparagraph (A) shall establish proce-
dures for conducting reviews under such sub-
paragraph.’’.
SEC. 6. BUSINESS GUIDELINES. 
(a) IN GENERAL.—Not later than the end of the 1-
year period beginning on the date of the enactment of this 
Act, the Federal Trade Commission, after consultation 
with the Federal functional regulators (as defined in sec-
tion 509(2) of the Gramm-Leach-Bliley Act), shall estab-
lish procedures to—
(1) log and acknowledge the receipt of com-
plaints of any person who has a reasonable belief 
that information maintained in a database of such 
person relating to any other person has likely been 
stolen or compromised; 
(2) provide informational materials and guide-
lines for a business to follow when customer or other 
information in the business’ database has likely been 
stolen or compromised; 
(3) provide guidelines for a business to follow in 
notifying customers of the likelihood that informa-
tion concerning such customers has been stolen or 
compromised; and 
(4) refer complaints described in paragraph (1) 
to—
(A) each consumer reporting agency that 
compiles and maintains files on consumers on a 
nationwide basis (as defined in section 603 of 
the Fair Credit Reporting Act), together with
any recommendation for the implementation for 
such fraud alert as the Commission may deter-
mine to be appropriate; 
(B) appropriate law enforcement agencies. 
(b) POLICY REVIEW AND REGULATION.—
(1) REVIEW.—The Federal Trade Commission 
and any Federal functional regulator (as defined in 
section 509(2) of the Gramm-Leach-Bliley Act) 
shall, upon the request of any person under the ju-
risdiction of such agency—
(A) review any policy or procedure estab-
lished by such person to follow in the event that 
information maintained in a database of such 
person has likely been stolen or compromised to 
determine the effectiveness and reasonableness 
of the policy or procedure for such purposes; 
and 
(B) make such recommendations to such 
person for improvement in such policy or proce-
dure as the agency may determine to be appro-
priate. 
(2) REGULATION.—Each agency referred to in 
subparagraph (A) shall establish procedures for con-
ducting reviews under such subparagraph.’’.
SEC. 7. SPECIFICATION OF CONSTITUTIONAL AUTHORITY 
FOR ENACTMENT OF LAW. 
This Act is enacted pursuant to the power granted 
Congress under section 8 of article I of the United States 
Constitution.
Æ