data security of the consumer reporter, and how 
to determine whether the information is likely to 
be usable under subsection (b)(3); 
‘‘(D) providing for a reasonable and fair 
manner of providing required consumer notices 
where the entity that directly suffered the breach 
is unavailable to pay for such notices, because 
for example the entity is bankrupt, outside of the 
jurisdiction of the United States, or otherwise 
can not be compelled to provide such notice; 
‘‘(E) providing for periodic instead of indi-
vidual notices to regulators and law enforcement 
under subsection (c)(1) and (2) where the con-
sumer reporter determines that only a de mini-
mus number of consumers are reasonably likely 
to be affected; 
‘‘(F) providing, to the extent appropriate, 
notice to the United States Secret Service, a con-
sumer reporter’s functional regulator, and the 
entities described in paragraphs (1) through (3) 
of subsection (c), whenever the consumer report-
er’s sensitive financial personal information has 
been lost or illegally obtained but such loss or ac-
quisition does not result in a breach, for example 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
because 
the 
information 
was 
sufficiently 
encrypted or otherwise unusable; and 
‘‘(G) establishing what types of accounts 
might be subject to unauthorized transactions 
after a breach involving sensitive financial ac-
count information, for example because such ac-
counts are open-end credit plans or are described 
in section 903(2) of the Electronic Fund Trans-
fer Act. 
‘‘(2) MODEL NOTICE FORMS.— 
‘‘(A) IN
GENERAL.—The Secretary of the 
Treasury, Board of Governors of the Federal Re-
serve System, and the Commission shall jointly 
establish and publish model forms and disclosure 
statements to facilitate compliance with the no-
tice requirements of subsection (g) and to aid the 
consumer in understanding the information re-
quired to be disclosed relating to a breach of data 
security and the options and services available to 
the consumer for obtaining additional informa-
tion, consumer reports, and credit monitoring 
services. 
‘‘(B) USE OPTIONAL.—A consumer reporter 
may utilize a model notice or any model state-
ment established under this paragraph for pur-
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
poses of compliance with this section, at the dis-
cretion of the consumer reporter. 
‘‘(C) EFFECT
OF
USE.—A consumer re-
porter that uses a model notice form or disclo-
sure statement established under this paragraph 
shall be deemed to be in compliance with the re-
quirement to provide the required disclosure to 
consumers to which the form or statement relates. 
‘‘(3) ENFORCEMENT.— 
‘‘(A) REGULATIONS.—Each of the func-
tional regulatory agencies shall prescribe such 
regulations as may be necessary, consistent with 
the standards in paragraph (1), to ensure com-
pliance with this section with respect to the per-
sons subject to the jurisdiction of such agency 
under subsection (l). 
‘‘(B) MISUSE OF UNIQUE COLOR AND TI-
TLES OF NOTICES.—Any person who uses the 
unique color and titling adopted under para-
graph (1)(A) for notices under subsection (f)(1) 
in a way that is likely to create a false belief in 
a consumer that a communication is such a no-
tice shall be liable in the same manner and to 
the same extent as a debt collector is liable under 
section 813 for any failure to comply with any 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
provision of the Fair Debt Collection Practices 
Act. 
‘‘(4) PROCEDURES AND DEADLINE.— 
‘‘(A) PROCEDURES.—Standards and guide-
lines issued under this subsection shall be issued 
in accordance with applicable requirements of 
title 5, United States Code. 
‘‘(B) DEADLINE
FOR
INITIAL
STANDARDS 
AND GUIDELINES.—The standards and guidelines 
required to be issued under paragraph (1) shall 
be published in final form before the end of the 
9-month period beginning on the date of the en-
actment of the Financial Data Protection Act of 
2006. 
‘‘(C) DEADLINE FOR ENFORCEMENT REGU-
LATIONS.—The standards and guidelines re-
quired to be issued under paragraph (2) shall be 
published in final form before the end of the 6- 
month period beginning on the date standards 
and guidelines described in subparagraph (B) 
are published in final form. 
‘‘(D) AUTHORITY TO GRANT EXCEPTIONS.— 
The regulations prescribed under paragraph (2) 
may include such additional exceptions to this 
section as are deemed jointly by the functional 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
regulatory agencies to be consistent with the pur-
poses of this section if such exceptions are nec-
essary because of some unique aspect of the enti-
ties regulated or laws governing such entities; 
and such exemptions are narrowly tailored to 
protect the purposes of this Act. 
‘‘(E) CONSULTATION AND COORDINATION.— 
The Secretary of the Treasury, the Board of Gov-
ernors of the Federal Reserve System, and the 
Commission shall consult and coordinate with 
the other functional regulatory agencies to the ex-
tent appropriate in prescribing regulations 
under this subsection. 
‘‘(F) FAILURE TO MEET DEADLINE.—Any 
agency or authority required to publish stand-
ards and guidelines or regulations under this 
subsection that fails to meet the deadline for such 
publishing shall submit a report to the Congress 
within 30 days of such deadline describing— 
‘‘(i) the reasons for the failure to meet 
such deadline; 
‘‘(ii) when the agency or authority ex-
pects to complete the publication required; 
and 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS