I 
109TH CONGRESS 
1ST SESSION H. R. 3140
To expand the protections for sensitive personal information in Federal law 
to cover the information collection and sharing practices of unregulated 
information brokers, to enhance information security requirements for 
consumer reporting agencies and information brokers, and to require 
consumer reporting agencies, financial institutions, and other entities 
to notify consumers of data security breaches involving sensitive con-
sumer information, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JUNE 30, 2005
Ms. BEAN (for herself, Mr. DAVIS of Alabama, Mr. FRANK of Massachusetts, 
Mrs. MALONEY, Mr. GUTIERREZ, Mr. WATT, Mr. ACKERMAN, Mr. FORD, 
Mr. CROWLEY, Mr. CLAY, Mrs. MCCARTHY, Mr. LYNCH, Ms. 
WASSERMAN SCHULTZ, and Ms. MOORE of Wisconsin) introduced the fol-
lowing bill; which was referred to the Committee on Financial Services 
A BILL 
To expand the protections for sensitive personal information 
in Federal law to cover the information collection and 
sharing practices of unregulated information brokers, to 
enhance information security requirements for consumer 
reporting agencies and information brokers, and to re-
quire consumer reporting agencies, financial institutions, 
and other entities to notify consumers of data security 
breaches involving sensitive consumer information, and 
for other purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Consumer Data Secu-
rity and Notification Act of 2005’’. 
SEC. 2. AMENDMENTS TO THE FAIR CREDIT REPORTING 
ACT. 
(a) FCRA COVERAGE OF DATA BROKERS.—Section 
603(d) of the Fair Credit Reporting Act (15 U.S.C. 
1681a(d)) is amended by adding at the end the following 
new paragraph: 
‘‘(4) COMMUNICATION OF PERSONALLY IDENTI-
FIABLE
INFORMATION
BY
CERTAIN
PERSONS
IN-
CLUDED.—The term ‘consumer report’ shall also in-
clude any written, oral, electronic, or other commu-
nication of any information by any person which, for 
monetary fees, dues or other compensation, regularly 
engages in whole or in part in the practice of assem-
bling or evaluating personally identifiable informa-
tion for the purpose of furnishing reports to third 
parties that includes the name of any consumer and 
any of the following information relating to such 
consumer: 
‘‘(A) Any Social Security account number. 
‘‘(B) Any driver’s license number.
‘‘(C) Any other identification number 
issued by a State or the Federal Government. 
‘‘(D) Any bank, savings association, credit 
union, or investment account number. 
‘‘(E) Any credit card, or debit card ac-
count number. 
‘‘(F) Any password, access code, or secu-
rity code relating to a bank, savings association, 
credit union, or investment account number or 
credit or debit card account number.’’. 
(b) VERIFICATION STANDARDS FOR USERS OF CON-
SUMER REPORTS.—Section 604(f) of the Fair Credit Re-
porting Act (15 U.S.C. 1681b(f)) is amended—
(1) by striking ‘‘and’’ at the end of paragraph 
(1); 
(2) by redesignating paragraph (2) as para-
graph (3); and 
(3) by inserting after paragraph (1) the fol-
lowing new paragraph: 
‘‘(2) the identity of the person requesting the 
consumer report has been verified, pursuant to sec-
tion 607(a), in accordance with procedures which the 
Commission shall prescribe in regulation; and’’. 
(c) DATA SECURITY STANDARDS AND NOTIFICATION 
OF SECURITY BREACHES.—
(1) IN GENERAL.—The Fair Credit Reporting 
Act (15 U.S.C. 1681 et seq.) is amended by adding 
at the end the following new section: 
‘‘SEC. 630. PROTECTION OF NONPUBLIC CONSUMER INFOR-
MATION. 
‘‘(a) IN GENERAL.—Notwithstanding any other pro-
vision of this title, each consumer reporting agency shall 
have an affirmative and continuing obligation to respect 
the privacy of consumers and to protect the security and 
confidentiality of consumers nonpublic personal informa-
tion. 
‘‘(b) SAFEGUARDS REQUIRED.—In furtherance of 
subsection (a), the Commission shall establish appropriate 
standards, by regulation, for consumer reporting agencies 
relating to administrative, technical, and physical safe-
guards—
‘‘(1) to insure the security and confidentiality of 
consumer records and information; 
‘‘(2) to protect against any anticipated threats 
or hazards to the security of such records; and 
‘‘(3) to protect against unauthorized access to 
or use of such records or information which could 
result in substantial harm or inconvenience to any 
customer.
‘‘(c) 
NOTIFICATION
OF
DATA
SECURITY 
BREACHES.—
‘‘(1) IN GENERAL.—The regulations prescribed 
under subsection (b) shall include requirements for 
the notification of consumers following the discovery 
of a breach of security of any data system main-
tained by the consumer reporting agency in which 
sensitive consumer information was, or is reasonably 
believed to have been, acquired by an unauthorized 
person. 
‘‘(2) CONTENT OF REGULATIONS.—The regula-
tions prescribed under paragraph (1) shall include 
the following requirements or provisions: 
‘‘(A) A requirement that a consumer re-
porting agency provide written notice to a con-
sumer whenever such agency becomes aware 
that sensitive personal information relating to 
the consumer has been, or is reasonably be-
lieved to have been, acquired by an unauthor-
ized person, unless the consumer reporting 
agency, after appropriate investigation—
‘‘(i) reasonably concludes that misuse 
of the information is unlikely to occur;
‘‘(ii) notifies the appropriate law en-
forcement agency of the data security 
breach; and 
‘‘(iii) takes appropriate steps to rem-
edy the security breach and safeguard the 
interests of affected consumers. 
‘‘(B) A requirement that the notices re-
quired under paragraph (1) be provided by a 
consumer reporting agency without unreason-
able delay following—
‘‘(i) the discovery by such agency of a 
breach of security in the data system; and 
‘‘(ii) reasonable actions which the con-
sumer reporting agency shall take to inves-
tigate the nature and intent of the breach, 
prevent further unauthorized access or dis-
closure, and restore the reasonable integ-
rity of the data system. 
‘‘(C) A provision that allows for reasonable 
delay of such notification to the consumer 
under paragraph (1) upon the written request 
of a law enforcement agency which has deter-
mined that the notification required under 
paragraph (1) would seriously impede a crimi-
nal investigation.
‘‘(D) A provision that the written notice 
required under paragraph (1) may be made by 
an electronic transmission only if—
‘‘(i) the consumer has provided prior 
consent to receive any such notice by elec-
tronic transmission; and 
‘‘(ii) the notice is consistent with the 
provisions 
permitting 
electronic 
trans-
mission of notices under section 101 of the 
Electronic Signatures in Global and Na-
tional Commerce Act. 
‘‘(E) A requirement that the notification 
provided to consumers include—
‘‘(i) the date on which the consumers 
nonpublic personal information was, or is 
reasonably believed to have been, acquired 
by an unauthorized person; 
‘‘(ii) the specific information that was, 
or is reasonably believed to have been, ac-
quired by an unauthorized person, includ-
ing Social Security account numbers, bank 
or investment account numbers, credit or 
debit card account numbers, or any pass-
word or code relating to such accounts;
‘‘(iii) the actions taken by the con-
sumer reporting agency to address or rem-
edy the security breach and prevent unau-
thorized use of nonpublic personal informa-
tion; 
‘‘(iv) the summary of rights of con-
sumer victims of fraud or identity theft 
prepared by the Federal Trade Commis-
sion under section 609(d) and information 
on how to contact the Commission for 
more detailed information; and 
‘‘(v) the toll-free telephone number 
where consumers may obtain additional in-
formation about the security breach and an 
explanation of available options to protect 
their consumer file from unauthorized ac-
cess. 
‘‘(3) TREATMENT
OF
ENCRYPTED
INFORMA-
TION.—For purposes of the regulations prescribed 
under paragraph (1), the Commission shall—
‘‘(A) permit a consumer reporting agency, 
in connection with any determination pursuant 
to paragraph (2)(A)(i), to reasonably conclude 
that misuse of information is unlikely to occur 
where the sensitive consumer information ac-
quired, or believed to have been acquired, by an 
unauthorized person consists of information 
that has been encrypted in a manner consistent 
with standards set forth under subparagraph 
(B); 
‘‘(B) identify appropriate standards for 
encryption of personal and financial information 
for purposes of subparagraph (A), taking into 
consideration the Advanced Encryption Stand-
ard adopted by the National Institute of Stand-
ards and Technology for use by the Federal 
Government; and 
‘‘(C) establish appropriate criteria for de-
termining whether information that has been 
encrypted has been accessed by an unauthorized 
person, and whether misuse of such information 
is likely to occur and notification is required 
pursuant to this section.’’. 
(2) CLERICAL AMENDMENT.—The table of con-
tents for the Fair Credit Reporting Act is amended 
by inserting after the item relating to section 129 
the following new item:
‘‘630. Protection of nonpublic consumer information.’’.
(d) USE OF CONSUMER REPORTS FOR PRIVATE IN-
VESTIGATIONS.—
(1) IN
GENERAL.—Section 604(a)(3) of the 
Fair Credit Reporting Act (15 U.S.C.1681b(a)(3)) is 
amended—
(A) by striking ‘‘or’’ at the end of subpara-
graph (E); 
(B) by redesignating subparagraph (F) as 
subparagraph (G); and 
(C) by inserting after subparagraph (E) 
the following new paragraph:. 
‘‘(F) is a duly licensed private investigator 
who intends to use the consumer report only in 
connection with a lawful investigation within 
the scope of the investigator’s license and for no 
other purpose; or’’. 
(2) TECHNICAL
AND
CONFORMING
AMEND-
MENT.—Section 603(k)(1)(B)(iv)(I) of the Fair 
Credit 
Reporting 
Act 
(15 
U.S.C. 
1681a(k)(1)(B)(iv)(I)) 
is 
amended 
by 
striking 
‘‘604(a)(3)(F)(ii)’’ and inserting ‘‘604(a)(3)(G)(ii)’’. 
(e) REGULATIONS.—The Federal Trade Commission 
shall prescribe such regulations as the Commission deter-
mines to be necessary to implement the amendments made 
by this section and such regulations shall be published in 
final form before the end of the 6-month period beginning 
on the date of the enactment of this Act.
SEC. 3. AMENDMENTS TO TITLE V OF THE GRAMM-LEACH-
BLILEY ACT. 
(a) NOTIFICATION OF SECURITY BREACHES.—Sec-
tion 501 of the Gramm-Leach-Bliley Act (15 U.S.C. 6801) 
is amended by adding at the end the following new sub-
section: 
‘‘(c) 
NOTIFICATION
OF
DATA
SECURITY 
BREACHES.—
‘‘(1) IN GENERAL.—In establishing standards 
pursuant to subsection (b), each agency or authority 
described in section 505(a) shall require, in regula-
tion, that a financial institution notify customers fol-
lowing the discovery of a breach of security of any 
data system maintained by the financial institution 
in which nonpublic personal information was, or is 
reasonably believed to have been, acquired by an un-
authorized person. 
‘‘(2) CONTENT OF REGULATIONS.—The regula-
tions prescribed under paragraph (1) shall include 
the following requirements or provisions: 
‘‘(A) A requirement that a financial insti-
tution provide written notice to a customer 
whenever the institution becomes aware that 
sensitive personal information relating to the 
customer has been, or is reasonably believed to 
have been, acquired by an unauthorized person,
unless the financial institution, after appro-
priate investigation, reasonably concludes that 
misuse of the information is unlikely to occur, 
and—
‘‘(i) promptly notifies its primary Fed-
eral financial regulatory agency of the data 
security breach; 
‘‘(ii) notifies the appropriate law en-
forcement agency of the data security 
breach; and 
‘‘(iii) takes appropriate steps to rem-
edy the security breach and safeguard the 
interests of affected customers, including 
monitoring the affected customers accounts 
for unusual or suspicious activity. 
‘‘(B) A requirement that the notice re-
quired under paragraph (1) be provided by a fi-
nancial institution without unreasonable delay 
following—
‘‘(i) the discovery by the financial in-
stitution of a breach of security in the data 
system; 
‘‘(ii) reasonable investigation of the 
nature and scope of the security breach, 
including identification of the customer in-
formation systems and specific customer 
information or accounts that may have 
been accessed; 
‘‘(iii) notification of the primary Fed-
eral financial regulatory agency for the fi-
nancial institution; 
‘‘(iv) notification of appropriate law 
enforcement agencies; and 
‘‘(v) reasonable measures to prevent 
further unauthorized access or disclosure 
and to restore the reasonable integrity of 
the data system. 
‘‘(C) A provision establishing minimum 
standards for investigations of the nature and 
scope of security breaches, including any limita-
tion on the duration of such investigations that 
the agency or authority may consider appro-
priate to prevent substantial harm or inconven-
ience to any customer; 
‘‘(D) A provision that allows for reasonable 
delay of such notification upon the written re-
quest of a law enforcement agency which has 
determined that the notification required under 
paragraph (1) would seriously impede a crimi-
nal investigation;
‘‘(E) A provision that the written notice 
required under paragraph (1) may be made by 
an electronic transmission only if—
‘‘(i) the customer has provided prior 
consent to receive any such notice by elec-
tronic transmission; and 
‘‘(ii) the notice is consistent with the 
provisions 
permitting 
electronic 
trans-
mission of notices under section 101 of the 
Electronic Signatures in Global and Na-
tional Commerce Act. 
‘‘(F) A requirement that the notification 
provided to consumers include—
‘‘(i) the date on which the customers 
nonpublic personal information was, or is 
reasonably believed to have been, acquired 
by an unauthorized person; 
‘‘(ii) the specific information that was, 
or is reasonably believed to have been, ac-
quired by an unauthorized person, includ-
ing Social Security account numbers, bank 
or investment account numbers, credit or 
debit card account numbers, or any pass-
word or code relating to such accounts;
‘‘(iii) the actions taken by the finan-
cial institution to address or remedy the 
security breach and prevent unauthorized 
use of nonpublic customer information; 
‘‘(iv) the summary of rights of con-
sumer victims of fraud or identity theft 
prepared by the Federal Trade Commis-
sion under section 609(d) of the Fair 
Credit Reporting Act and information on 
how to contact the Commission for more 
detailed information; and 
‘‘(v) the toll-free telephone number 
where customers may obtain additional in-
formation about the security breach and 
explanations of available options to protect 
their consumer file from unauthorized ac-
cess. 
‘‘(G) A requirement concerning any other 
action or disclosure that the agency or author-
ity determines necessary or appropriate to carry 
out the intent of this subsection. 
‘‘(3) CERTAIN
PERSONS
TREATED
AS
FINAN-
CIAL INSTITUTIONS FOR THIS SUBSECTION.—
‘‘(A) IN GENERAL.—For purposes of this 
subsection (and sections 504, 505, and 507 to
the extent applicable with respect to this sub-
section), the term ‘financial institution’ includes 
any person or organization that, in the regular 
course of business, collects and maintains writ-
ten or electronic files containing individually 
identifiable information on customer trans-
actions, including any bank, savings association, 
or credit union account number, credit card or 
debt card number, and any other payment ac-
count number, or any password, access code, or 
security code pertaining to any such account or 
any credit card or debit card. 
‘‘(B) NOTIFICATION.—A person or organi-
zation described in subparagraph (A) that is re-
quired to provide written notice pursuant to 
regulations prescribed under paragraph (1), 
shall, promptly notify the appropriate law en-
forcement agency of the data security breach, 
and provide notification, as appropriate—
‘‘(i) to the customer whose payment 
account information has been, or is reason-
ably believed to have been, acquired by an 
unauthorized person, and such notification 
includes all applicable disclosures required 
by paragraph (2)(F);
‘‘(ii) to the financial institution which 
is the holder of the customer’s bank, sav-
ings association, or credit union account, 
credit card or debit card account, or other 
payment account which has been, or is rea-
sonably believed to have been, acquired by 
an unauthorized person, which shall be in 
such form and include such information as 
required by regulation; or 
‘‘(iii) to the financial intermediary or 
network used to effect the credit trans-
action, electronic fund transfer, or other 
form of payment on behalf of the customer 
whose payment account information has 
been, or is reasonably believed to have 
been, acquired by an unauthorized person, 
which shall include the information re-
quired by subparagraph (C) and such 
other information as required by regula-
tion. 
‘‘(C) RESPONSE
OF
FINANCIAL
INTER-
MEDIARY OR NETWORK UPON RECEIVING NO-
TICE.— A financial intermediary or network 
that receives notice of a data security breach 
pursuant to subparagraph (B)(iii) shall prompt-
ly communicate to the financial institution 
which is the holder of the bank, savings associa-
tion, or credit union account, credit card or 
debit card account, or other payment account 
with respect to which such breach occurred, all 
necessary information pertaining to the data se-
curity breach, which shall include the date on 
which the breach is reasonably believed to have 
occurred and the name and location of the per-
son or organization responsible for maintaining 
the data system where the security breach oc-
curred. 
‘‘(D) RESPONSE OF FINANCIAL INSTITU-
TION THAT HOLDS CUSTOMER’S ACCOUNT UPON 
RECEIVING
NOTICE.—A financial institution 
that receives notice of a data security breach 
pursuant to subparagraphs (B)(ii) or (C) may 
communicate to any customer whose bank, sav-
ings association, or credit union account, credit 
card or debit card account, or other payment 
account is identified as having been, or is rea-
sonably believed to have been, acquired by an 
unauthorized person, any information it receives 
relating to the security breach, including the 
date on which the breach is reasonably believed
to have occurred and the name and location of 
the person or organization responsible for main-
taining the data system where the security 
breach occurred. 
‘‘(E) FINANCIAL INTERMEDIARY OR NET-
WORK DEFINED.—For purposes of this para-
graph, the term ‘financial intermediary or net-
work’ means a credit card association, elec-
tronic fund transfer network, or other system, 
clearinghouse, or network utilized by any cred-
itor, credit card issuer, financial institution, or 
money transmitting business, to effect a credit 
transaction, electronic fund transfer, or other 
money transmitting, check clearing, or payment 
service. 
‘‘(4) TREATMENT
OF
ENCRYPTED
INFORMA-
TION.—The regulations prescribed under paragraph 
(1) shall—
‘‘(A) permit a financial institution, in con-
nection with any determination pursuant to 
paragraph (2)(A), to reasonably conclude that 
misuse of information is unlikely to occur where 
the sensitive consumer information acquired, or 
believed to have been acquired, by an unauthor-
ized person consists of information that has
been encrypted in a manner consistent with 
standards set forth under subparagraph (B); 
‘‘(B) identify appropriate standards for 
encryption of personal and financial information 
for purposes of subparagraph (A), taking into 
consideration the Advanced Encryption Stand-
ard adopted by the National Institute of Stand-
ards and Technology for use by the Federal 
Government; and 
‘‘(C) establish appropriate criteria for de-
termining whether information that has been 
encrypted has been accessed by an unauthorized 
person, and whether misuse of such information 
is likely to occur and notification is required 
pursuant to this section.’’. 
(b) REGULATIONS.—The agencies and authorities de-
scribed in section 505(a) of the Gramm-Leach-Bliley Act 
shall, in the manner prescribed in section 504 of such Act, 
prescribe such regulations as the agencies and authorities 
determine to be necessary to implement the amendments 
made by this section and such regulations shall be pub-
lished in final form before the end of the 6-month period 
beginning on the date of the enactment of this Act.
Æ