nancial personal information that is subject to the 
breach of data security, including appropriate actions 
to— 
‘‘(A) assess the nature and scope of the po-
tential breach; 
‘‘(B) identify the sensitive financial per-
sonal information potentially involved; 
‘‘(C) determine whether such information is 
usable by the parties causing the breach; and 
‘‘(D) determine the likelihood that such in-
formation has been, or will be, misused in a 
manner that may cause harm or inconvenience 
to the related consumer. 
‘‘(3) ENCRYPTION AND OTHER SAFEGUARDS.— 
‘‘(A) SUGGESTED SAFEGUARDS.—The regu-
lators described in subsection (k)(1) shall jointly 
develop standards and guidelines to identify and 
regularly update appropriate technology safe-
guards for making consumer reporter’s sensitive 
financial personal information unusable in a 
manner commensurate with the nature and the 
amount of such information, including— 
‘‘(i) consideration of the encryption 
standards adopted by the National Institute 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
of Standards and Technology for use by the 
Federal Government; and 
‘‘(ii) appropriate management and 
protection of keys or codes necessary to pro-
tect the integrity of encrypted information. 
‘‘(B) 
SAFEGUARD
FACTORS.—In 
deter-
mining the likelihood of a data security breach, 
a consumer reporter may consider whether the 
information subject to the potential breach is un-
usable because it is encrypted, redacted, requires 
technology to use that is not generally commer-
cially available, or has otherwise similarly been 
rendered unreadable. 
‘‘(C) 
SAFE
HARBOR
FOR
PROTECTED 
DATA.—As set forth in the standards and guide-
lines issued pursuant to subparagraph (A), a 
consumer reporter may reasonably conclude that 
a data security breach is not likely to have oc-
curred where the sensitive personal financial in-
formation involved has been encrypted, redacted, 
requires technology to use that is not generally 
commercially available, or is otherwise unlikely 
to be usable 
‘‘(D) EXCEPTION.—Subparagraphs (B) and 
(C) shall not apply if the consumer reporter be-
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
comes aware of information that would reason-
ably indicate that the information that was the 
subject of the potential breach is usable by the 
entities causing the breach or potentially mis-
using the information, for example because— 
‘‘(i) an encryption code is potentially 
compromised, 
‘‘(ii) the entities are believed to have 
the technology to access the information; or 
‘‘(iii) there is an unusual pattern of 
misuse of such information indicative of fi-
nancial fraud. 
‘‘(c) BREACH NOTICES.—If a consumer reporter deter-
mines that a breach of data security has occurred, is likely 
to have occurred, or is unavoidable, the consumer reporter 
shall in the order listed— 
‘‘(1) promptly notify the United States Secret 
Service; 
‘‘(2) promptly notify the appropriate functional 
regulatory agency for the consumer reporter; 
‘‘(3) notify as appropriate and without unrea-
sonable delay— 
‘‘(A) any third party entity that owns or is 
obligated on an affected financial account as set 
forth in the standards or guidelines pursuant to 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
subsection (k)(1)(G), including in such notifica-
tion information reasonably identifying the na-
ture and scope of the breach and the sensitive fi-
nancial personal information involved; and 
‘‘(B) any other appropriate critical third 
parties whose involvement is necessary to inves-
tigate the breach; and 
‘‘(4) without unreasonable delay notify any af-
fected consumers to the extent required in subsection 
(f), as well as— 
‘‘(A) each nationwide consumer reporting 
agency, in the case of a breach involving sen-
sitive financial identity information relating to 
1,000 or more consumers; and 
‘‘(B) any other appropriate critical third 
parties who will be required to undertake further 
action with respect to such information to pro-
tect such consumers from resulting fraud or iden-
tity theft. 
‘‘(d) SYSTEM RESTORATION REQUIREMENTS.—If a 
consumer reporter determines that a breach of data security 
has occurred, is likely to have occurred, or is unavoidable, 
the consumer reporter shall take prompt and reasonable 
measures to— 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
‘‘(1) repair the breach and restore the security 
and confidentiality of the sensitive financial personal 
information involved to limit further unauthorized 
misuse of such information; and 
‘‘(2) restore the integrity of the consumer report-
er’s data security safeguards and make appropriate 
improvements to its data security policies and proce-
dures. 
‘‘(e) THIRD PARTY DUTIES.— 
‘‘(1) COORDINATED
INVESTIGATION.—Whenever 
any consumer reporter that handles sensitive finan-
cial personal information for or on behalf of another 
party becomes aware that an investigation is required 
under subsection (b) with respect to such information, 
the consumer reporter shall— 
‘‘(A) promptly notify the other party of the 
breach; 
‘‘(B) conduct a coordinated investigation 
with the other party as described in subsection 
(b); and 
‘‘(C) ensure that the appropriate notices are 
provided as required under subsection (f). 
‘‘(2) CONTRACTUAL OBLIGATION REQUIRED.—No 
consumer reporter may provide sensitive financial 
personal information to a third party, unless such 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
third party agrees to fulfill the obligations imposed by 
subsections (a), (d), and (h), as well as that whenever 
the third party becomes aware that a breach of data 
security has occurred, is reasonably likely to have oc-
curred, or is unavoidable, with respect to such infor-
mation, the third party shall be obligated— 
‘‘(A) to provide notice of the potential 
breach to the consumer reporter; 
‘‘(B) to conduct a coordinated investigation 
with the consumer reporter to identify the sen-
sitive financial personal information involved 
and determine if the potential breach is reason-
ably likely to result in harm or inconvenience to 
any consumer to whom the information relates; 
and 
‘‘(C) provide any notices required under 
this section, except to the extent that such notices 
are provided by the consumer reporter in a man-
ner meeting the requirements of this section. 
‘‘(f) CONSUMER NOTICE.— 
‘‘(1) POTENTIAL
IDENTITY
THEFT
RISK
AND 
FRAUDULENT
TRANSACTION
RISK.—A consumer re-
porter shall provide a consumer notice if, at any 
point the consumer reporter becomes aware— 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
‘‘(A) that a breach of data security is rea-
sonably likely to have occurred or be unavoid-
able, with respect to sensitive financial personal 
information handled by the consumer reporter; 
‘‘(B) of information reasonably identifying 
the nature and scope of the breach; and 
‘‘(C) that such information is reasonably 
likely to have been or to be misused in a manner 
causing harm or inconvenience against the con-
sumers to whom such information relates to— 
‘‘(i) commit identity theft if the infor-
mation is sensitive financial identity infor-
mation, or 
‘‘(ii) make fraudulent transactions on 
such consumers’ financial accounts if the 
information is sensitive financial account 
information. 
‘‘(2) SECURITY PROGRAM SAFEGUARDS AND REG-
ULATIONS.— 
‘‘(A) STANDARDS
FOR
SAFEGUARDS.—The 
regulators described in subsection (k)(1) shall 
issue guidelines relating to the types of sophisti-
cated neural networks and security programs 
that are likely to detect fraudulent account activ-
ity and at what point detection of such activity 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
is sufficient to avoid consumer notice under this 
subsection. 
‘‘(B) ALTERNATIVE
SAFEGUARDS.—In de-
termining the likelihood of misuse of sensitive fi-
nancial account information and whether a no-
tice is required under paragraph (1), the con-
sumer reporter may additionally consider— 
‘‘(i) consistent with any standards pro-
mulgated under subparagraph (A), whether 
any neural networks or security programs 
used by, or on behalf of, the consumer re-
porter have detected, or are likely to detect 
on an ongoing basis over a reasonable pe-
riod of time, fraudulent transactions result-
ing from the breach of data security; or 
‘‘(ii) whether no harm or inconven-
ience is reasonably likely to have occurred, 
because for example the related consumer 
account has been closed or its number has 
been changed. 
‘‘(3) COORDINATION WITH THE FAIR DEBT COL-
LECTION PRACTICES ACT.—The provision of a notice 
to the extent such notice and its contents are required 
under this section shall not be considered a commu-
nication under the Fair Debt Collection Practices Act. 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
‘‘(4) COORDINATION OF CONSUMER NOTICE DATA-
BASE.— 
‘‘(A) IN GENERAL.—The Commission shall 
coordinate with the other government entities 
identified in this section to create a publicly 
available list of data security breaches that have 
triggered a notice to consumers under this sub-
section within the last 12 months. 
‘‘(B) LISTED INFORMATION.—The publicly 
available list described in subparagraph (A) 
shall include the following: 
‘‘(i) The identity of the party respon-
sible that suffered the breach. 
‘‘(ii) A general description of the na-
ture and scope of the breach. 
‘‘(iii) Any financial fraud mitigation 
or other services provided by such party to 
the affected consumers, including the tele-
phone number and other appropriate con-
tact information for accessing such services. 
‘‘(g) TIMING, CONTENT, AND MANNER OF NOTICES.— 
‘‘(1) DELAY OF NOTICE FOR LAW ENFORCEMENT 
PURPOSES.—If a consumer reporter receives a written 
request from an appropriate law enforcement agency 
indicating that the provision of a notice under sub-
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
section (c)(3) or (f) would impede a criminal or civil 
investigation by that law enforcement agency, or an 
oral request from an appropriate law enforcement 
agency indicating that such a written request will be 
provided within 2 business days— 
‘‘(A) the consumer reporter shall delay, or 
in the case of a foreign law enforcement agency 
may delay, providing such notice until— 
‘‘(i) the law enforcement agency in-
forms the consumer reporter that such no-
tice will no longer impede the investigation; 
or 
‘‘(ii) the law enforcement agency fails 
to— 
‘‘(I) provide within 10 days a 
written request to continue such delay 
for a specific time that is approved by 
a court of competent jurisdiction; or 
‘‘(II) in the case of an oral request 
for a delay, provide a written request 
within 2 business days, and if such 
delay is requested for more than 10 ad-
ditional days, such request must be ap-
proved by a court of competent juris-
diction; and 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
‘‘(B) the consumer reporter may— 
‘‘(i) 
conduct 
appropriate 
security 
measures that are not inconsistent with 
such request; and 
‘‘(ii) contact such law enforcement 
agency to determine whether any such in-
consistency would be created by such meas-
ures. 
‘‘(2) HOLD HARMLESS PROVISION.—A consumer 
reporter shall not be liable for any fraud mitigation 
costs or for any losses that would not have occurred 
but for notice to or the provision of sensitive financial 
personal information to law enforcement, or the delay 
provided for under this subsection, except that— 
‘‘(A) nothing in this subparagraph shall be 
construed as creating any inference with respect 
to the establishment or existence of any such li-
ability; and 
‘‘(B) this subparagraph shall not apply if 
the costs or losses would not have occurred had 
the consumer reporter undertaken reasonable sys-
tem restoration requirements to the extent re-
quired under subsection (d), or other similar 
provision of law, except to the extent that such 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
system restoration was delayed at the request of 
law enforcement. 
‘‘(3) CONTENT OF CONSUMER NOTICE.—Any no-
tice required to be provided by a consumer reporter 
to a consumer under subsection (f)(1), and any notice 
required in accordance with subsection (e)(2)(A), shall 
be provided in a standardized transmission or exclu-
sively colored envelope, and shall include the following 
in a clear and conspicuous manner: 
‘‘(A) An appropriate heading or notice title. 
‘‘(B) A description of the nature and types 
of information and accounts as appropriate that 
were, or are reasonably believed to have been, 
subject to the breach of data security. 
‘‘(C) A statement identifying the party re-
sponsible, if known, that suffered the breach, in-
cluding an explanation of the relationship of 
such party to the consumer. 
‘‘(D) If known, the date, or the best reason-
able approximation of the period of time, on or 
within which sensitive financial personal infor-
mation related to the consumer was, or is rea-
sonably believed to have been, subject to a breach. 
‘‘(E) A general description of the actions 
taken by the consumer reporter to restore the se-
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
curity and confidentiality of the breached infor-
mation. 
‘‘(F) A telephone number by which a con-
sumer to whom the breached information relates 
may call free of charge to obtain additional in-
formation about how to respond to the breach. 
‘‘(G) With respect to notices involving sen-
sitive financial identity information, a copy of 
the summary of rights of consumer victims of 
fraud or identity theft prepared by the Commis-
sion under section 609(d), as well as any addi-
tional appropriate information on how the con-
sumer may— 
‘‘(i) obtain a copy of a consumer re-
port free of charge in accordance with sec-
tion 612; 
‘‘(ii) place a fraud alert in any file re-
lating to the consumer at a consumer re-
porting agency under section 605A to dis-
courage unauthorized use; and 
‘‘(iii) contact the Commission for more 
detailed information. 
‘‘(H) With respect to notices involving sen-
sitive financial identity information, a promi-
nent statement in accordance with subsection (h) 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
that file monitoring will be made available to the 
consumer free of charge for a period of not less 
than six months, together with a telephone num-
ber for requesting such services, and may also in-
clude such additional contact information as a 
mailing address, e-mail, or Internet website ad-
dress. 
‘‘(I) The approximate date the notice is 
being issued. 
‘‘(4) OTHER TRANSMISSION OF NOTICE.—The no-
tice described in paragraph (3) may be made by other 
means of transmission (such as electronic or oral) to 
a consumer only if— 
‘‘(A) the consumer has affirmatively con-
sented to such use, has not withdrawn such con-
sent, and with respect to electronic transmissions 
is provided with the appropriate statements re-
lated to such consent as described in section 
101(c)(1) of the Electronic Signatures in Global 
and National Commerce Act; and 
‘‘(B) all of the relevant information in 
paragraph (3) is communicated to such con-
sumer in such transmission. 
‘‘(5) DUPLICATIVE NOTICES.— 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
‘‘(A) IN GENERAL.—A consumer reporter, 
whether acting directly or in coordination with 
another entity— 
‘‘(i) shall not be required to provide 
more than 1 notice with respect to any 
breach of data security to any affected con-
sumer, so long as such notice meets all the 
applicable requirements of this section, and 
‘‘(ii) shall not be required to provide a 
notice with respect to any consumer if a no-
tice meeting the applicable requirements of 
this section has already been provided to 
such consumer by another entity. 
‘‘(B) UPDATING NOTICES.—If a consumer 
notice is provided to consumers pursuant only to 
subsection (f)(1)(C)(ii) (relating to sensitive fi-
nancial account information), and the consumer 
reporter subsequently becomes aware of a reason-
able likelihood that sensitive financial personal 
information involved in the breach is being mis-
used in a manner causing harm or inconven-
ience against such consumer to commit identity 
theft, an additional notice shall be provided to 
such consumers as well any other appropriate 
parties under this section, including a copy of 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
the Commission’s summary of rights and file 
monitoring mitigation instructions under sub-
paragraphs (G) and (H) of paragraph (3). 
‘‘(6) RESPONSIBILITY AND COSTS.— 
‘‘(A) IN GENERAL.—Except as otherwise es-
tablished by written agreement between the con-
sumer reporter and its agents or third party 
servicers, the entity that suffered a breach of 
data security shall be— 
‘‘(i) primarily responsible for pro-
viding any consumer notices and file moni-
toring required under this section with re-
spect to such breach; and 
‘‘(ii) responsible for the reasonable ac-
tual costs of any notices provided under this 
section. 
‘‘(B) IDENTIFICATION TO CONSUMERS.—No 
such agreement shall restrict the ability of a con-
sumer reporter to identify the entity responsible 
for the breach to consumers 
‘‘(C) NO
CHARGE
TO
CONSUMERS.— The 
cost for the notices and file monitoring described 
in subparagraph (A) may not be charged to the 
related consumers. 
‘‘(h) FINANCIAL FRAUD MITIGATION.— 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
‘‘(1) FREE
FILE
MONITORING.—Any consumer 
reporter that is required to provide notice to a con-
sumer under subsection (f)(1)(C)(i), or that is deemed 
to be in compliance with such requirement by oper-
ation of subsection (j), if requested by the consumer 
before the end of the 90-day period beginning on the 
date of such notice, shall make available to the con-
sumer, free of charge and for at least a 6-month pe-
riod— 
‘‘(A) a service that monitors nationwide 
credit activity regarding a consumer from a con-
sumer reporting agency described in section 
603(p); or 
‘‘(B) a service that provides identity-moni-
toring to consumers on a nationwide basis that 
meets the guidelines described in paragraph (2). 
‘‘(2) IDENTITY
MONITORING
NETWORKS.—The 
regulators described in subsection (k)(1) shall issue 
guidelines on the type of identity monitoring net-
works that are likely to detect fraudulent identity ac-
tivity regarding a consumer on a nationwide basis 
and would satisfy the requirements of paragraph (1). 
‘‘(3) JOINT RULEMAKING FOR SAFE HARBOR.— 
In accordance with subsection (j), the Secretary of the 
Treasury, the Board of Governors of the Federal Re-
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
serve System, and the Commission shall jointly de-
velop standards and guidelines, which shall be issued 
by all functional regulatory agencies, that, in any 
case in which— 
‘‘(A) free file monitoring is offered under 
paragraph (1) to a consumer; 
‘‘(B) subsequent to the offer, another party 
misuses sensitive financial identity information 
on the consumer obtained through the breach of 
data security (that gave rise to such offer) to 
commit identity theft against the consumer; and 
‘‘(C) at the time of such breach the con-
sumer reporter met the requirements of sub-
sections (a) and (d), 
exempts the consumer reporter from any liability for 
any harm to the consumer resulting from such mis-
use, other than any direct pecuniary loss or loss pur-
suant to agreement by the consumer reporter, except 
that nothing in this paragraph shall be construed as 
creating any inference with respect to the establish-
ment or existence of any such liability. 
‘‘(i) CREDIT SECURITY FREEZE.— 
‘‘(1) DEFINITIONS.—For purposes of this sub-
section, the following definitions shall apply: 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
‘‘(A) SECURITY FREEZE.—The term ‘secu-
rity freeze’ means a notice placed in a credit re-
port on a consumer, at the request of the con-
sumer who is a victim of identity theft, that pro-
hibits the consumer reporting agency from re-
leasing all or any part of the credit report, with-
out the express authorization of the consumer, ex-
cept as otherwise provided in this section. 
‘‘(B) REVIEWING THE ACCOUNT; ACCOUNT 
REVIEW.—The terms ‘reviewing the account’ and 
‘account review’ include activities related to ac-
count maintenance, monitoring, credit line in-
creases, and account upgrades and enhance-
ments. 
‘‘(2) REQUEST FOR A SECURITY FREEZE.— 
‘‘(A) IN GENERAL.—A consumer who has 
been the victim of identity theft may place a se-
curity freeze on the file of such consumer at any 
consumer reporting agency by— 
‘‘(i) making a request in writing by 
certified mail to the consumer reporting 
agency; 
‘‘(ii) submitting an identity theft re-
port to the consumer reporting agency; and 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
‘‘(iii) providing such evidence of the 
identity of the consumer as such consumer 
reporting agency may require under para-
graph (5). 
‘‘(B) PROMPT IMPOSITION OF FREEZE.—A 
consumer reporting agency shall place a security 
freeze on a credit report on a consumer no later 
than 5 business days after receiving a written re-
quest from the consumer in accordance with sub-
paragraph (A). 
‘‘(C) EFFECT OF FREEZE.— 
‘‘(i) IN GENERAL.—Except as otherwise 
provided in this subsection, if a security 
freeze is in place with respect to any con-
sumer, information from the consumer’s 
credit report may not be released by the 
consumer reporting agency or reseller to 
any third party, including another con-
sumer reporting agency or reseller, without 
the prior express authorization from the 
consumer or as otherwise permitted in this 
section. 
‘‘(ii) ADVISING OF EXISTENCE OF SE-
CURITY FREEZE.—Clause (i) shall not be 
construed as preventing a consumer report-
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
ing agency or reseller from advising a third 
party that a security freeze is in effect with 
respect to the credit report on the consumer. 
‘‘(D) CONFIRMATION
OF
FREEZE; ACCESS 
CODE.—Any consumer reporting agency that re-
ceives a consumer request for a security freeze in 
accordance with subparagraph (A) shall— 
‘‘(i) send a written confirmation of the 
security freeze to the consumer within 10 
business days of placing the freeze; and 
‘‘(ii) at the same time, provide the con-
sumer with a unique personal identification 
number or password (other than the Social 
Security account number of any consumer) 
to be used by the consumer when providing 
authorization for the release of the credit re-
port of the consumer to a specific party or 
for a specific period of time. 
‘‘(3) ACCESS PURSUANT TO CONSUMER AUTHOR-
IZATION DURING SECURITY FREEZE.— 
‘‘(A) NOTICE BY CONSUMER.—If the con-
sumer wishes to allow the credit report on the 
consumer to be accessed by a specific party or for 
a specific period of time while a freeze is in 
place, the consumer shall— 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
‘‘(i) contact the consumer reporting 
agency in any manner the agency may pro-
vide; 
‘‘(ii) request that the security freeze be 
temporarily lifted; and 
‘‘(iii) provide— 
‘‘(I) proper identification; 
‘‘(II) the unique personal identi-
fication number or password provided 
by the consumer reporting agency pur-
suant to paragraph (2)(D)(ii); and 
‘‘(III) the proper information re-
garding the third party who is to re-
ceive the credit report or the time pe-
riod for which the report shall be avail-
able to users of the credit report. 
‘‘(B) TIMELY
RESPONSE
REQUIRED.—A 
consumer reporting agency that receives a re-
quest from a consumer to temporarily lift a secu-
rity freeze on a credit report in accordance with 
subparagraph (A) shall comply with the request 
no later than 3 business days after receiving the 
request. 
‘‘(C) PROCEDURES FOR REQUESTS.—A con-
sumer reporting agency may develop procedures 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
involving the use of telephone, fax, or, upon the 
consent of the consumer in the manner required 
by the Electronic Signatures in Global and Na-
tional Commerce Act for notices legally required 
to be in writing, by the Internet, e-mail, or other 
electronic medium to receive and process a re-
quest from a consumer to temporarily lift a secu-
rity freeze on a credit report pursuant to sub-
paragraph (A) in an expedited manner. 
‘‘(4) 
LIFTING
OR
REMOVING
SECURITY 
FREEZE.— 
‘‘(A) IN GENERAL.—A consumer reporting 
agency may remove or temporarily lift a secu-
rity freeze placed on a credit report on a con-
sumer only in the following cases: 
‘‘(i) Upon receiving a consumer request 
for a temporary lift of the security freeze in 
accordance with paragraph (3)(A). 
‘‘(ii) Upon receiving a consumer re-
quest for the removal of the security freeze 
in accordance with subparagraph (C). 
‘‘(iii) Upon a determination by the 
consumer reporting agency that the security 
freeze was imposed on the credit report due 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
to a material misrepresentation of fact by 
the consumer. 
‘‘(B) NOTICE TO CONSUMER OF DETERMINA-
TION.—If a consumer reporting agency makes a 
determination 
described 
in 
subparagraph 
(A)(iii) with a respect to a security freeze im-
posed on the credit report on any consumer, the 
consumer reporting agency shall notify the con-
sumer of such determination in writing prior to 
removing the security freeze on such credit re-
port. 
‘‘(C) REMOVING SECURITY FREEZE.— 
‘‘(i) IN GENERAL.—Except as provided 
in this subsection, a security freeze shall re-
main in place until the consumer requests 
that the security freeze be removed. 
‘‘(ii) PROCEDURE FOR REMOVING SE-
CURITY
FREEZE.—A consumer reporting 
agency shall remove a security freeze within 
3 business days of receiving a request for re-
moval from the consumer who provides— 
‘‘(I) proper identification; and 
‘‘(II) the unique personal identi-
fication number or password provided 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS