I 
115TH CONGRESS 
1ST SESSION H. R. 4544 
To amend the Fair Credit Reporting Act to provide protections for consumers 
after a data breach at a consumer reporting agency, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
DECEMBER 4, 2017 
Mr. SIRES introduced the following bill; which was referred to the Committee 
on Financial Services 
A BILL 
To amend the Fair Credit Reporting Act to provide protec-
tions for consumers after a data breach at a consumer 
reporting agency, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Consumer Data Pro-
tection Act’’. 
SEC. 2. DATA SECURITY. 
(a) IN GENERAL.—The Fair Credit Reporting Act 
(15 U.S.C. 1681 et seq.) is amended by inserting after 
section 605B (15 U.S.C. 1681c–2) the following: 
VerDate Sep 11 2014 
02:07 Dec 09, 2017
Jkt 079200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H4544.IH
H4544
dlhill on DSK3GLQ082PROD with BILLS
‘‘SEC. 605C. DATA SECURITY AT CONSUMER REPORTING 
AGENCIES. 
‘‘(a) DEFINITIONS.—In this section— 
‘‘(1) the term ‘affected individual’ means an in-
dividual, the sensitive personal information of whom 
is lost, stolen, or accessed without authorization be-
cause of a data breach; 
‘‘(2) the term ‘appropriate committees of Con-
gress’ means— 
‘‘(A) the Committee on the Judiciary of 
the Senate; 
‘‘(B) the Committee on Banking, Housing, 
and Urban Affairs of the Senate; 
‘‘(C) the Committee on the Judiciary of 
the House of Representatives; and 
‘‘(D) the Committee on Financial Services 
of the House of Representatives; 
‘‘(3) the term ‘covered action’ means an action 
that restricts the legal rights available to a con-
sumer, including— 
‘‘(A) requiring the consumer to— 
‘‘(i) waive the right of the consumer 
to— 
‘‘(I) file a civil action in an ap-
propriate court; or 
VerDate Sep 11 2014 
02:07 Dec 09, 2017
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H4544.IH
H4544
dlhill on DSK3GLQ082PROD with BILLS
‘‘(II) bring, or participate in, a 
class action; or 
‘‘(ii) engage in settlement negotiations 
before bringing an action under subsection 
(c)(3); and 
‘‘(B) offering a financial inducement in ex-
change for the consumer waiving any right of 
the consumer; 
‘‘(4) the term ‘credit freeze’— 
‘‘(A) except as provided in subparagraph 
(B), means a restriction placed on the consumer 
report of a consumer at the request of the con-
sumer, or a personal representative of the con-
sumer, that prohibits a consumer reporting 
agency from releasing the consumer report for 
any purpose; and 
‘‘(B) with respect to the consumer report 
of a consumer, shall not apply to the use of the 
consumer report by— 
‘‘(i) a person, or a subsidiary, affil-
iate, agent, subcontractor, or assignee of 
the person, with which the consumer has, 
or before assignment had, an account, con-
tract, or debtor-creditor relationship for 
the purposes of— 
VerDate Sep 11 2014 
02:07 Dec 09, 2017
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4544.IH
H4544
dlhill on DSK3GLQ082PROD with BILLS
‘‘(I) reviewing the active account; 
or 
‘‘(II) collecting the financial obli-
gation owed on the account, contract, 
or debt; 
‘‘(ii) any person acting under a court 
order, warrant, or subpoena; 
‘‘(iii) a Federal, State, or local gov-
ernment or an agent or assignee of a Fed-
eral, State, or local government; 
‘‘(iv) any person for the sole purpose 
of providing a credit monitoring or identity 
theft protection service to which the con-
sumer has subscribed; 
‘‘(v) any person for the purpose of 
providing a consumer with a copy of the 
consumer report, credit score, or edu-
cational credit score of the consumer upon 
request by the consumer; 
‘‘(vi) any person or entity for insur-
ance purposes, including use in setting or 
adjusting a rate, adjusting a claim, or un-
derwriting; and 
‘‘(vii) any person acting under an au-
thorization from a consumer to use the 
VerDate Sep 11 2014 
02:07 Dec 09, 2017
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4544.IH
H4544
dlhill on DSK3GLQ082PROD with BILLS
consumer report of the consumer for em-
ployment purposes; 
‘‘(5) the term ‘data breach’ means the loss, 
theft, or other unauthorized access, other than ac-
cess that is incidental to the scope of employment, 
of data containing sensitive personal information, in 
electronic or printed form, that results in the poten-
tial compromise of the confidentiality or integrity of 
the data; and 
‘‘(6) the term ‘sensitive personal information’ 
means, with respect to an individual, information— 
‘‘(A) about the individual relating to the 
education, financial transactions, medical his-
tory, criminal history, or employment history of 
the individual; and 
‘‘(B) that can be used to distinguish or 
trace the identity of the individual, including 
the name, social security number, date and 
place of birth, mother’s maiden name, and bio-
metric records of the individual. 
‘‘(b) DATA BREACHES AT CONSUMER REPORTING 
AGENCIES.—With respect to a data breach at a consumer 
reporting agency, the consumer reporting agency— 
‘‘(1) subject to paragraph (2), shall notify— 
VerDate Sep 11 2014 
02:07 Dec 09, 2017
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4544.IH
H4544
dlhill on DSK3GLQ082PROD with BILLS
‘‘(A) not later than 2 days after the date 
on which the consumer reporting agency dis-
covers the data breach— 
‘‘(i) the Federal Trade Commission; 
‘‘(ii) the Bureau; and 
‘‘(iii) appropriate law enforcement and 
intelligence agencies, as identified by the 
Secretary of Homeland Security; and 
‘‘(B) not later than 3 days after the date 
on which the consumer reporting agency dis-
covers the data breach, and as quickly and effi-
ciently as is practicable, each affected individual 
with respect to the data breach; 
‘‘(2) may receive an extension of the 2-day 
deadline described in paragraph (1)(A) or the 3-day 
deadline described in paragraph (1)(B) if the Fed-
eral Trade Commission and the intelligence agencies 
identified under paragraph (1)(A)(iii) determine that 
there is a national security concern that requires 
granting such an extension; 
‘‘(3) shall, upon request by any affected indi-
vidual with respect to the data breach, provide, with-
out charge to the affected individual and during the 
lifetime of the affected individual— 
VerDate Sep 11 2014 
02:07 Dec 09, 2017
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4544.IH
H4544
dlhill on DSK3GLQ082PROD with BILLS
‘‘(A) a credit freeze, including the cost re-
lating to imposing, lifting, or permanently re-
moving a credit freeze, with respect to the con-
sumer report of the affected individual at any 
consumer reporting agency described in section 
603(p); and 
‘‘(B) credit monitoring services for the af-
fected individual at any consumer reporting 
agency described in section 603(p); and 
‘‘(4) shall, in consultation with the Bureau, es-
tablish a consumer assistance unit— 
‘‘(A) that shall— 
‘‘(i) be carried out, and paid for, by 
the consumer reporting agency; and 
‘‘(ii) provide assistance, free of charge 
and for a period of 10 years beginning on 
the date on which the consumer reporting 
agency submits the notifications required 
under paragraph (1)(A), to any affected 
individual who wants to dispute an item in 
the file of the affected individual that was 
entered into that file after the date on 
which the data breach occurred; and 
‘‘(B) with respect to which the consumer 
reporting agency shall, as soon as practicable 
VerDate Sep 11 2014 
02:07 Dec 09, 2017
Jkt 079200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4544.IH
H4544
dlhill on DSK3GLQ082PROD with BILLS