SEC. 2. SECURITY FREEZES ON CONSUMER REPORTS. 
Section 605A of the Fair Credit Reporting Act (15 
U.S.C. 1681c–1) is amended by adding at the end the fol-
lowing: 
‘‘(i) SECURITY FREEZES.— 
‘‘(1) IN
GENERAL.—A consumer reporting 
agency described in section 603(p) shall provide to 
a consumer, upon request, a security freeze on the 
consumer report of such consumer after a breach of 
data security at such a consumer reporting agency. 
‘‘(2) TYPES OF SECURITY FREEZES.—A con-
sumer reporting agency shall— 
‘‘(A) place a security freeze on a consumer 
report without a fee to any consumer; and 
‘‘(B) with respect to a consumer that has 
been specifically notified by the consumer re-
porting agency that the consumer was affected 
by the breach of data security, place or remove 
an unlimited amount of security freezes, upon 
request, without a fee. 
‘‘(3) DEFINITIONS.—In this subsection: 
‘‘(A) BREACH OF DATA SECURITY.— 
‘‘(i) IN GENERAL.—The term ‘breach 
of data security’ means the unauthorized 
acquisition of sensitive financial account 
VerDate Sep 11 2014 
04:40 Sep 19, 2017
Jkt 069200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3766.IH
H3766
SSpencer on DSKBBV9HB2PROD with BILLS
information or sensitive personal informa-
tion. 
‘‘(ii) EXCEPTION FOR DATA THAT IS 
NOT IN USABLE FORM.—The term ‘breach 
of data security’ does not include the un-
authorized acquisition of sensitive financial 
account information or sensitive personal 
information that is encrypted, redacted, or 
otherwise protected by another method 
that renders the information unreadable 
and unusable if the encryption, redaction, 
or protection process or key is not also ac-
quired without authorization. 
‘‘(B) SECURITY FREEZE.—The term ‘secu-
rity freeze’ means a notice placed in a consumer 
report, at the request of a consumer, that pro-
hibits the credit reporting agency from releas-
ing the consumer report or any information in 
the consumer report without the express au-
thorization of the consumer. 
‘‘(C) SENSITIVE FINANCIAL ACCOUNT IN-
FORMATION.—The term ‘sensitive financial ac-
count information’ means a financial account 
number relating to a consumer, including a 
credit card number or debit card number, in 
VerDate Sep 11 2014 
04:40 Sep 19, 2017
Jkt 069200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3766.IH
H3766
SSpencer on DSKBBV9HB2PROD with BILLS
combination with any security code, access 
code, password, or other personal identification 
information required to access the financial ac-
count. 
‘‘(D) 
SENSITIVE
PERSONAL
INFORMA-
TION.— 
‘‘(i) IN
GENERAL.—The term ‘sen-
sitive personal information’ includes— 
‘‘(I) a Social Security number; 
and 
‘‘(II) the first and last name of a 
consumer in combination with— 
‘‘(aa) the consumer’s driv-
er’s license number, passport 
number, military identification 
number, or other similar number 
issued on a government docu-
ment used to verify identity; 
‘‘(bb) information that could 
be used to access a consumer’s 
account, such as a user name 
and password or e-mail and pass-
word; or 
‘‘(cc) biometric data of the 
consumer used to gain access to 
VerDate Sep 11 2014 
04:40 Sep 19, 2017
Jkt 069200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3766.IH
H3766
SSpencer on DSKBBV9HB2PROD with BILLS
financial accounts of the con-
sumer. 
‘‘(ii) EXCEPTION.—The term ‘sen-
sitive personal information’ does not in-
clude publicly available information that is 
lawfully made available to the general pub-
lic and obtained from— 
‘‘(I) Federal, State, or local gov-
ernment records; or 
‘‘(II) widely distributed media.’’. 
Æ 
VerDate Sep 11 2014 
04:40 Sep 19, 2017
Jkt 069200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6301
E:\BILLS\H3766.IH
H3766
SSpencer on DSKBBV9HB2PROD with BILLS