I 
109TH CONGRESS 
1ST SESSION H. R. 3375 
To amend the Fair Credit Reporting Act to provide for secure financial 
data, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 21, 2005 
Ms. PRYCE of Ohio (for herself, Mr. CASTLE, and Mr. MOORE of Kansas) in-
troduced the following bill; which was referred to the Committee on Fi-
nancial Services 
A BILL 
To amend the Fair Credit Reporting Act to provide for 
secure financial data, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Financial Data Secu-
rity Act of 2005’’. 
SEC. 2. DATA SECURITY SAFEGUARDS. 
(a) IN GENERAL.—The Fair Credit Reporting Act 
(15 U.S.C. 1681) is amended by adding at the end the 
following new section:
‘‘§ 630. Data security safeguards 
‘‘(a) SECURITY POLICIES AND PROCEDURES.—Each 
consumer reporter shall have an affirmative and con-
tinuing obligation to maintain reasonable policies and pro-
cedures to protect the security and confidentiality of sen-
sitive financial account information and sensitive financial 
identity information of any consumer that is maintained 
or received by or on behalf of such consumer reporter 
against any unauthorized use that is reasonably likely to 
result in substantial inconvenience or substantial harm to 
such consumer. 
‘‘(b) INVESTIGATION REQUIREMENTS.— 
‘‘(1) PROTECTING AGAINST IDENTITY THEFT.— 
‘‘(A) INVESTIGATION
REQUIRED.—If a 
consumer reporter is aware that a breach of 
data security has occurred, or is reasonably 
likely to have occurred, with respect to sensitive 
financial identity information maintained by or 
on behalf of the consumer reporter, the con-
sumer reporter shall conduct an investigation to 
determine the likelihood that such information 
will be misused against any consumer to whom 
any of such information relates in a manner 
that would cause substantial inconvenience or 
substantial harm to any such consumer.
‘‘(B) SCOPE OF INVESTIGATION.—An in-
vestigation conducted under subparagraph (A) 
shall be commensurate with the nature and the 
amount of the sensitive financial identity infor-
mation that is subject to the breach of data se-
curity. 
‘‘(C) FACTORS
TO
BE
CONSIDERED.—In 
determining the likelihood that sensitive finan-
cial identity information that was the subject of 
a breach of data security has been or will be 
misused, the consumer reporter shall consider 
all available relevant facts, including whether 
the information that was subject to the breach 
was unencrypted or unredacted, or required 
technology to use that is not generally commer-
cially available. 
‘‘(2) 
PROTECTING
AGAINST
FRAUDULENT 
TRANSACTIONS.— 
‘‘(A) INVESTIGATION
REQUIRED.—If a 
consumer reporter is aware that a breach of 
data security has occurred or is reasonably like-
ly to have occurred with respect to sensitive fi-
nancial account information, maintained by or 
on behalf of the consumer reporter, the con-
sumer reporter shall conduct an investigation to
determine the likelihood that such information 
will be misused against any consumer to whom 
any of such information relates to make 1 or 
more fraudulent transactions on a financial ac-
count to which the sensitive financial account 
information relates in a manner that would 
cause substantial inconvenience or substantial 
harm to such consumer. 
‘‘(B) SCOPE OF INVESTIGATION.—An in-
vestigation conducted under subparagraph (A) 
shall be commensurate with the nature and the 
amount of the sensitive financial account infor-
mation that is subject to the breach of data se-
curity. 
‘‘(C) FACTORS
TO
BE
CONSIDERED.—In 
determining the likelihood that the sensitive fi-
nancial account information that was the sub-
ject of a breach of data security has been or 
will be misused, the consumer reporter shall 
consider all available relevant facts, including 
whether— 
‘‘(i) the information that was subject 
to 
the 
breach 
was 
unencrypted, 
unredacted, or required technology to use
that is not generally commercially avail-
able; and 
‘‘(ii) on an ongoing basis, any security 
programs used by, or on behalf of, the con-
sumer reporter have detected, or are likely 
to detect, fraudulent transactions resulting 
from the breach of data security. 
‘‘(c) NOTICE REQUIREMENT.— 
‘‘(1) NOTICE OF POTENTIAL IDENTITY THEFT 
RISK.—In the case of any actual or reasonably likely 
breach of data security with respect to sensitive fi-
nancial identity information for which an investiga-
tion is required under subsection (b)(1)(A), unless 
the consumer reporter determines (after conducting 
a reasonable investigation that meets the require-
ments of such subsection) that it is not reasonably 
likely that such information will be misused to com-
mit financial fraud against any consumer to whom 
such sensitive financial identity information relates 
in a manner that would cause substantial inconven-
ience or substantial harm to such consumer, the con-
sumer reporter shall provide notice, in the manner 
provided in subsection (e), to— 
‘‘(A) any appropriate law enforcement 
agency;