211 
803(6) of the Fair Debt Collection Practices Act) 
may not use the information described in paragraph 
(1). 
‘‘(5) RELATION
TO
STATE
LAW.—Notwith-
standing section 625, this subsection shall not pre-
empt any law of a State with respect to furnishing 
to a consumer reporting agency information relating 
to the performance of a consumer in making pay-
ments pursuant to a lease agreement with respect to 
a dwelling or a contract for a utility or telecommuni-
cations service. For purposes of this paragraph, the 
term ‘law of a State’ shall include all laws, decisions, 
rules, regulations, or other State action having the 
effect of law, as issued by a State, any political sub-
divisions thereof, or any agency or instrumentality of 
either the State or a political subdivision thereof. 
‘‘(6) UTILITY
OR
TELECOMMUNICATION
FIRM 
DEFINED.—In this subsection, the term ‘utility or 
telecommunication firm’— 
‘‘(A) means an entity that provides utility 
services to the public through pipe, wire, 
landline, wireless, cable, or other connected fa-
cilities, or radio, electronic, or similar trans-
mission (including the extension of such facili-
ties); and 
VerDate Sep 11 2014 
18:18 Aug 27, 2021
Jkt 019200
PO 00000
Frm 00211
Fmt 6652
Sfmt 6201
E:\BILLS\H4120.IH
H4120
pamtmann on DSKBC07HB2PROD with BILLS
212 
‘‘(B) includes an entity that provides nat-
ural gas or electric service to consumers.’’. 
(b) GAO STUDY AND REPORT.—Not later than 2 
years after the date of enactment of this Act, the Comp-
troller General of the United States shall submit to Con-
gress a report on the impact on consumers of furnishing 
information pursuant to subsection (g) of section 623 of 
the Fair Credit Reporting Act (15 U.S.C. 1681s–2), as 
added by subsection (a). 
SEC. 909. SENSE OF CONGRESS. 
It is the sense of Congress that efforts to enhance 
cybersecurity and implement routine security updates of 
databases maintained by the nationwide consumer report-
ing agencies that contain sensitive consumer data, includ-
ing the credit history and personal information of millions 
of Americans, is critical to the national interest of the 
United States. 
SEC. 910. CYBERSECURITY SUPERVISION AND EXAMINA-
TION 
OF 
LARGE 
CONSUMER 
REPORTING 
AGENCIES. 
(a) IN GENERAL.—The Fair Credit Reporting Act 
(15 U.S.C. 1681 et seq.), as amended by section 706, is 
further amended by adding at the end the following: 
VerDate Sep 11 2014 
18:18 Aug 27, 2021
Jkt 019200
PO 00000
Frm 00212
Fmt 6652
Sfmt 6201
E:\BILLS\H4120.IH
H4120
pamtmann on DSKBC07HB2PROD with BILLS
213 
‘‘SEC. 638. CYBERSECURITY SUPERVISION AND EXAMINA-
TION 
OF 
LARGE 
CONSUMER 
REPORTING 
AGENCIES. 
‘‘(a) IN GENERAL.—Consumer reporting agencies de-
scribed under section 603(p) shall be subject to cybersecu-
rity supervision and examination by the Bureau. 
‘‘(b) MINIMUM TRAINING REQUIREMENTS.—Con-
sumer reporting agencies described under section 603(p) 
shall meet minimum training and ongoing certification re-
quirements with respect to cybersecurity at regular inter-
vals, as established by the Director of the Bureau.’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
of the Fair Credit Reporting Act, as amended by section 
706, is further amended by adding at the end the fol-
lowing: 
‘‘638. Cybersecurity supervision and examination of large consumer reporting 
agencies.’’. 
Æ 
VerDate Sep 11 2014 
18:18 Aug 27, 2021
Jkt 019200
PO 00000
Frm 00213
Fmt 6652
Sfmt 6301
E:\BILLS\H4120.IH
H4120
pamtmann on DSKBC07HB2PROD with BILLS