I 
107TH CONGRESS 
2D SESSION 
H. R. 5424
To prevent the crime of identity theft, mitigate the harm to individuals 
victimized by identity theft, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 19, 2002
Mr. SMITH of Washington (for himself, Mr. GEKAS, Mr. CONYERS, and Ms. 
HARMAN) introduced the following bill; which was referred to the Com-
mittee on the Judiciary, and in addition to the Committee on Financial 
Services, for a period to be subsequently determined by the Speaker, in 
each case for consideration of such provisions as fall within the jurisdic-
tion of the committee concerned 
A BILL 
To prevent the crime of identity theft, mitigate the harm 
to individuals victimized by identity theft, and for other 
purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Identity Theft Victims 
Assistance Act of 2002’’. 
SEC. 2. FINDINGS. 
The Congress finds the following:
(1) The crime of identity theft is the fastest 
growing crime in the United States. 
(2) Victims of identity theft often have extraor-
dinary difficulty restoring their credit and regaining 
control of their identity because of the viral nature 
of identity theft. 
(3) Identity theft may be ruinous to the good 
name and credit of consumers whose identities are 
misappropriated, and victims of identity theft may 
be denied otherwise well-deserved credit, may have 
to spend enormous time, effort, and sums of money 
to remedy their circumstances, and may suffer ex-
treme emotional distress including deep depression 
founded in profound frustration as they address the 
array of problems that may arise as a result of iden-
tity theft. 
(4) Victims are often required to contact nu-
merous Federal, State, and local law enforcement 
agencies, consumer credit reporting agencies, and 
creditors over many years, as each event of fraud 
arises. 
(5) The Federal Government, business entities, 
and credit reporting agencies have a shared respon-
sibility to assist identity theft victims, to mitigate
the harm that results from fraud perpetrated in the 
victim’s name. 
(6) Victims of identity theft need a nationally 
standardized means of—
(A) reporting identity theft to consumer 
credit reporting agencies and business entities; 
and 
(B) evidencing their true identity and 
claim of identity theft to consumer credit re-
porting agencies and business entities. 
(7) One of the greatest law enforcement chal-
lenges posed by identity theft is that stolen identities 
are often used to perpetrate crimes in many dif-
ferent localities in different States, and although 
identity theft is a Federal crime, most often, State 
and local law enforcement agencies are responsible 
for investigating and prosecuting the crimes. 
(8) The Federal Government should assist 
State and local law enforcement agencies to effec-
tively combat identity theft and the associated fraud. 
SEC. 3. TREATMENT OF IDENTITY THEFT MITIGATION. 
(a) IN GENERAL.—Chapter 47 of title 18, United 
States Code, is amended by adding after section 1028 the 
following new section:
‘‘§ 1028A. Treatment of identity theft mitigation 
‘‘(a) DEFINITIONS.—In this section: 
‘‘(1) The term ‘business entity’ means any cor-
poration, trust, partnership, sole proprietorship, or 
unincorporated association, including any financial 
service provider, financial information repository, 
creditor (as that term is defined in section 103 of 
the Truth in Lending Act (15 U.S.C. 1602)), tele-
communications, utilities, or other service provider. 
‘‘(2) The term ‘consumer’ means an individual. 
‘‘(3) The term ‘financial information’ means in-
formation identifiable as relating to an individual 
consumer that concerns the amount and conditions 
of the assets, liabilities, or credit of the consumer, 
including—
‘‘(A) account numbers and balances; 
‘‘(B) nonpublic personal information, as 
that term is defined in section 509 of the 
Gramm-Leach-Bliley Act (15 U.S.C. 6809); and 
‘‘(C) codes, passwords, social security 
numbers, tax identification numbers, State 
identifier numbers issued by a State depart-
ment of licensing, and other information used 
for the purpose of account access or transaction 
initiation.
‘‘(4) The term ‘financial information repository’ 
means a person engaged in the business of providing 
services to consumers who have a credit, deposit, 
trust, stock, or other financial services account or 
relationship with that person. 
‘‘(5) The term ‘identity theft’ means an actual 
or potential violation of section 1028 or any other 
similar provision of Federal or State law. 
‘‘(6) The term ‘means of identification’ has the 
same meaning given the term in section 1028. 
‘‘(7) The term ‘victim’ means a consumer whose 
means of identification or financial information has 
been used or transferred (or has been alleged to 
have been used or transferred) without the authority 
of that consumer with the intent to commit, or to 
aid or abet, identity theft or any other violation of 
law. 
‘‘(b) INFORMATION AVAILABLE TO VICTIMS.—
‘‘(1) IN GENERAL.—A business entity that pos-
sesses information relating to an alleged identity 
theft, or that has entered into a commercial trans-
action, provided credit, provided products, goods, or 
services for consideration, accepted payment, or oth-
erwise done business for consideration with a person 
that has made unauthorized use of the means of
identification of the victim, shall, not later than 20 
days after the receipt of a written request by the vic-
tim, meeting the requirements of subsection (c), pro-
vide, without charge, a copy of all application and 
business transaction information related to the 
transaction being alleged as an identity theft to—
‘‘(A) the victim; 
‘‘(B) any Federal, State, or local governing 
law enforcement agency or officer specified by 
the victim; or 
‘‘(C) any law enforcement agency inves-
tigating the identity theft and authorized by the 
victim to take receipt of records provided under 
this section. 
‘‘(2) RULE OF CONSTRUCTION.—
‘‘(A) IN GENERAL.—If the social security 
number of the victim receiving information pur-
suant to this section is identical to the social se-
curity number associated with the account or 
business transaction about which the victim is 
requesting information, no provision of Federal 
or State law prohibiting the disclosure of finan-
cial information by a business entity to third 
parties shall be used to deny disclosure of infor-
mation to the victim under this section.
‘‘(B) LIMITATION.—Except as provided in 
subparagraph (A), nothing in this section re-
quires a business entity to disclose information 
that the business entity is otherwise prohibited 
from disclosing under any other provision of 
Federal or State law. 
‘‘(c) VERIFICATION OF IDENTITY AND CLAIM.—Un-
less a business entity, at its discretion, is otherwise able 
to verify the identity of a victim making a request under 
subsection (b)(1), the victim shall provide to the business 
entity—
‘‘(1) as proof of positive identification, at the 
election of the business entity—
‘‘(A) the presentation of a government-
issued identification card; 
‘‘(B) if providing proof by mail, a copy of 
a government-issued identification card; or 
‘‘(C) upon the request of the person seek-
ing business records, the business entity may 
inform the requesting person of the categories 
of identifying information that the unauthorized 
person provided the business entity as person-
ally identifying information, and may require 
the requesting person to provide identifying in-
formation in those categories; and
‘‘(e) AUTHORITY TO DECLINE TO PROVIDE INFOR-
MATION.—A business entity may decline to provide infor-
mation under subsection (b) if, in the exercise of good 
faith and reasonable judgment, the business entity believes 
that—
‘‘(1) this section does not require disclosure of 
the information; 
‘‘(2) the request for the information is based on 
a misrepresentation of fact by the victim relevant to 
the request for information; or 
‘‘(3) the information requested is Internet navi-
gational data or similar information about a person’s 
visit to a website or online service. 
‘‘(f) NO NEW RECORDKEEPING OBLIGATION.—Noth-
ing in this section creates an obligation on the part of a 
business entity to obtain, retain, or maintain information 
or records that are not otherwise required to be obtained, 
retained, or maintained in the ordinary course of its busi-
ness or under other applicable law. 
‘‘(g) NOTIFICATION SYSTEM.—
‘‘(1) IN GENERAL.—A business entity may es-
tablish and maintain a notification system for the 
business entity to comply with this subsection, in-
cluding a toll-free telephone number and a mailing 
address.
‘‘(2) REQUIREMENTS.—A notification system 
under paragraph (1) shall permit any person to 
make a request to, or to correspond with, the busi-
ness entity under this subsection if—
‘‘(A) the business entity informs the per-
son—
‘‘(i) that any person may request in-
formation under this subsection; and 
‘‘(ii) of the address and toll-free tele-
phone number established and maintained 
for this purpose; and 
‘‘(B) a person representing the business 
entity—
‘‘(i) responds to an information re-
quest through the toll-free number within 
3 business days after receiving the request; 
and 
‘‘(ii) facilitates the provision of such 
information to the person who initiated the 
request. 
‘‘(h) ENFORCEMENT.—
‘‘(1) ACTIONS BY STATES.—
‘‘(A) IN GENERAL.—In any case in which 
the attorney general of a State has reason to 
believe that an interest of the residents of that
State has been, or is threatened to be, adversely 
affected by a violation of this section by any 
business entity, the State, as parens patriae, 
may bring a civil action on behalf of the resi-
dents of the State in a district court of the 
United States of appropriate jurisdiction—
‘‘(i) to enjoin that practice; 
‘‘(ii) to enforce compliance of this sec-
tion; 
‘‘(iii) to obtain damages—
‘‘(I) in the sum of actual dam-
ages, restitution, and other compensa-
tion on behalf of the residents of the 
State; and 
‘‘(II) punitive damages, if the 
violation is willful or intentional; and 
‘‘(iv) to obtain such other equitable 
relief as the court may consider to be ap-
propriate. 
‘‘(B) NOTICE.—Before bringing an action 
under subparagraph (A), the attorney general 
of the State involved shall provide to the Attor-
ney General of the United States—
‘‘(i) written notice of the action; and
‘‘(ii) a copy of the complaint for the 
action. 
‘‘(C) AFFIRMATIVE
DEFENSE.—In any 
civil action brought to enforce this section, it is 
an affirmative defense (which the defendant 
must establish by a preponderance of the evi-
dence) for a business entity to file an affidavit 
or answer stating that—
‘‘(i) the business entity has made a 
reasonably diligent search of its available 
business records; and 
‘‘(ii) the records requested under this 
section do not exist or are not available. 
‘‘(2) NO PRIVATE RIGHT OF ACTION.—Nothing 
in this section shall be construed to provide a private 
right of action or claim for relief. 
‘‘(3) INTERVENTION.—
‘‘(A) IN GENERAL.—On receiving notice of 
an action under paragraph (1)(B), the Attorney 
General of the United States shall have the 
right to intervene in that action. 
‘‘(B) EFFECT OF INTERVENTION.—If the 
Attorney General of the United States inter-
venes in an action under this subsection, the 
Attorney General shall have the right to be
heard with respect to any matter that arises in 
that action. 
‘‘(C) SERVICE OF PROCESS.—Upon request 
of the Attorney General of the United States, 
the attorney general of a State that has filed an 
action under this subsection shall, pursuant to 
Rule 4(d)(4) of the Federal Rules of Civil Pro-
cedure, serve the Government with—
‘‘(i) a copy of the complaint; and 
‘‘(ii) written disclosure of substan-
tially all material evidence and information 
in the possession of the attorney general of 
the State. 
‘‘(D) RULE OF CONSTRUCTION.—For pur-
poses of bringing any civil action under this 
subsection, nothing in this section shall be con-
strued to prevent an attorney general of a State 
from exercising the powers conferred on such 
attorney general by the laws of that State—
‘‘(i) to conduct investigations; 
‘‘(ii) to administer oaths or affirma-
tions; or 
‘‘(iii) to compel the attendance of wit-
nesses or the production of documentary 
and other evidence.
‘‘(4) ACTIONS BY THE ATTORNEY GENERAL OF 
THE UNITED STATES.—In any case in which an ac-
tion is instituted by or on behalf of the Attorney 
General of the United States for a violation of this 
section, no State may, during the pendency of that 
action, institute an action under this subsection 
against any defendant named in the complaint in 
that action for violation of that practice.’’. 
(b) CLERICAL AMENDMENT.—The table of sections 
at the beginning of chapter 47 of title 18, United States 
Code, is amended by inserting after the item relating to 
section 1028 the following new item:
‘‘1028A. Treatment of identity theft mitigation.’’.
SEC. 4. AMENDMENTS TO THE FAIR CREDIT REPORTING 
ACT. 
(a) CONSUMER REPORTING AGENCY BLOCKING OF 
INFORMATION RESULTING FROM IDENTITY THEFT.—
Section 611 of the Fair Credit Reporting Act (15 U.S.C. 
1681i) is amended by adding at the end the following new 
subsection: 
‘‘(e) BLOCK
OF INFORMATION RESULTING FROM 
IDENTITY THEFT.—
‘‘(1) BLOCK.—Except as provided in paragraph 
(3) and not later than 30 days after the date of re-
ceipt of proof of the identity of a consumer and an 
official copy of a police report evidencing the claim
of the consumer of identity theft, a consumer report-
ing agency shall block the reporting of any informa-
tion identified by the consumer in the file of the con-
sumer resulting from the identity theft, so that the 
information cannot be reported. 
‘‘(2) NOTIFICATION.—A consumer reporting 
agency shall promptly notify the furnisher of infor-
mation identified by the consumer under paragraph 
(1)—
‘‘(A) that the information may be a result 
of identity theft; 
‘‘(B) that a police report has been filed; 
‘‘(C) that a block has been requested under 
this subsection; and 
‘‘(D) of the effective date of the block. 
‘‘(3) AUTHORITY TO DECLINE OR RESCIND.—
‘‘(A) IN GENERAL.—a consumer reporting 
agency may decline to block, or may rescind 
any block, of consumer information under this 
subsection if 
‘‘(i) in the exercise of good faith and 
reasonable judgment, the consumer report-
ing agency finds that 
‘‘(I) the information was blocked 
due to a misrepresentation of fact by
the consumer relevant to the request 
to block; or 
‘‘(II) the consumer knowingly ob-
tained possession of goods, services, or 
moneys as a result of the blocked 
transaction or transactions, or the 
consumer should have known that the 
consumer 
obtained 
possession 
of 
goods, services, or moneys as a result 
of the blocked transaction or trans-
actions; or 
‘‘(ii) the consumer agrees that the 
blocked information or portions of the 
blocked information were blocked in error. 
‘‘(B) NOTIFICATION
TO
CONSUMER.—If 
the block of information is declined or rescinded 
under this paragraph, the affected consumer 
shall be notified promptly, in the same manner 
as consumers are notified of the reinsertion of 
information under subsection (a)(5)(B). 
‘‘(C) SIGNIFICANCE OF BLOCK.—For pur-
poses of this paragraph, if a consumer report-
ing agency rescinds a block, the presence of in-
formation in the file of a consumer prior to the 
blocking of such information is not evidence of
whether the consumer knew or should have 
known that the consumer obtained possession of 
any goods, services, or monies as a result of the 
block. 
‘‘(4) 
EXCEPTIONS.—A 
consumer 
reporting 
agency shall not be required to comply with this sub-
section when such agency is issuing information for 
authorizations, for the purpose of approving or proc-
essing negotiable instruments, electronic funds 
transfers, or similar methods of payment, based sole-
ly on negative information, including—
‘‘(A) dishonored checks; 
‘‘(B) accounts closed for cause; 
‘‘(C) substantial overdrafts; 
‘‘(D) abuse of automated teller machines; 
or 
‘‘(E) other information which indicates a 
risk of fraud occurring. ’’. 
(b) FALSE CLAIMS.—Section 1028 of title 18, United 
States Code, is amended by adding at the end the fol-
lowing: 
‘‘(j) Any person who knowingly claims falsely to be 
a victim of identity theft for the purpose of obtaining the 
blocking of information by a consumer reporting agency 
under section 611(e)(1) of the Fair Credit Reporting Act
(15 U.S.C. 1681i(e)(1)) shall be fined under this title, im-
prisoned not more than 3 years, or both.’’. 
(c) STATUTE OF LIMITATIONS.—Section 618 of the 
Fair Credit Reporting Act (15 U.S.C. 1681p) is amended 
to read as follows: 
‘‘SEC. 618. JURISDICTION OF COURTS AND LIMITATION OF 
ACTIONS. 
‘‘(a) IN GENERAL.—Except as provided in sub-
sections (b) and (c), an action to enforce any liability cre-
ated under this title may be brought in any appropriate 
United States district court without regard to the amount 
in controversy, or in any other court of competent jurisdic-
tion, not later than 2 years from the date of a violation 
of any requirement under this title. 
‘‘(b) WILLFUL MISREPRESENTATION.—In any case 
in which the defendant has materially and willfully mis-
represented any information required to be disclosed to an 
individual under this title, and the information misrepre-
sented is material to the establishment of the liability of 
the defendant to that individual under this title, an action 
to enforce a liability created under this title may be 
brought at any time within 2 years after the date of dis-
covery by the individual of the misrepresentation.
‘‘(c) IDENTITY THEFT.—An action to enforce a liabil-
ity created under this title may be brought not later than 
5 years after the date of a violation if—
‘‘(1) the plaintiff is the victim of an identity 
theft; or 
‘‘(2) the plaintiff—
‘‘(A) has reasonable grounds to believe 
that the plaintiff is the victim of an identity 
theft; and 
‘‘(B) has not materially and willfully mis-
represented such a claim.’’. 
SEC. 5. COORDINATING COMMITTEE STUDY OF COORDINA-
TION BETWEEN FEDERAL, STATE, AND LOCAL 
AUTHORITIES 
IN 
ENFORCING 
IDENTITY 
THEFT LAWS. 
(a) MEMBERSHIP
AND TERM.—Section 2 of the 
Internet False Identification Prevention Act of 2000 (18 
U.S.C. 1028 note) is amended—
(1) in subsection (b), by striking ‘‘and the Com-
missioner of Immigration and Naturalization’’ and 
inserting ‘‘the Commissioner of Immigration and 
Naturalization, the Chairman of the Federal Trade 
Commission, the Postmaster General, and the Com-
missioner of the United States Customs Service,’’; 
and
(2) in subsection (c), by striking ‘‘2 years’’ and 
inserting ‘‘6 years’’. 
(b) CONSULTATION.—Section 2 of the Internet False 
Identification Prevention Act of 2000 (18 U.S.C. 1028 
note) is amended—
(1) by redesignating subsection (d) as sub-
section (e); and 
(2) by inserting after subsection (c) the fol-
lowing new subsection: 
‘‘(d) CONSULTATION.—In discharging its duties, the 
coordinating committee shall consult with interested par-
ties, including State and local law enforcement agencies, 
State attorneys general, representatives of business enti-
ties (as that term is defined in section 4 of the Identity 
Theft Victims Assistance Act of 2002), including tele-
communications and utility companies, and organizations 
representing consumers.’’. 
(c) REPORT DISTRIBUTION AND CONTENTS.—Sec-
tion 2(e) of the Internet False Identification Prevention 
Act of 2000 (18 U.S.C. 1028 note) (as redesignated by 
subsection (b) of this section) is amended—
(1) by amending paragraph (1) to read as fol-
lows: 
‘‘(1) IN GENERAL.—The Attorney General and 
the Secretary of the Treasury, at the end of each
year of the existence of the coordinating committee, 
shall report on the activities of the coordinating 
committee to the Congress.’’; 
(2) in subparagraph (E), by striking ‘‘and’’ at 
the end; and 
(3) by striking subparagraph (F) and inserting 
the following: 
‘‘(F) a comprehensive description of Fed-
eral assistance provided to State and local law 
enforcement agencies to address identity theft; 
‘‘(G) a comprehensive description of co-
ordination activities between Federal, State, 
and local law enforcement agencies that address 
identity theft; 
‘‘(H) a comprehensive description of how 
the Federal Government can best provide State 
and local law enforcement agencies with timely 
and current information regarding terrorists or 
terrorist activity where such information specifi-
cally relates to identity theft; and 
‘‘(I) recommendations in the discretion of 
the president, if any, for legislative or adminis-
trative changes that would—
‘‘(i) facilitate more effective investiga-
tion and prosecution of cases involving—
‘‘(I) identity theft; and 
‘‘(II) the creation and distribu-
tion of false identification documents; 
‘‘(i) improve the effectiveness of Fed-
eral assistance to State and local law en-
forcement agencies and coordination be-
tween Federal, State, and local law en-
forcement agencies; and 
‘‘(ii) simplify efforts by a person nec-
essary to rectify the harm that results 
from the theft of the identity of such per-
son.’’.
Æ