(8) PUBLIC RECORD INFORMATION.—The 
term ‘‘public record information’’ means 
information about an individual which 
has 
been 
obtained 
originally 
from 
records of a Federal, State, or local gov-
ernment entity that are available for pub-
lic inspection. 
(9) 
NON-PUBLIC
INFORMATION.—The 
term ‘‘non-public information’’ means in-
formation about an individual that is of a 
private nature and neither available to 
the general public nor obtained from a 
public record. 
SEC. 6. EFFECT ON OTHER LAWS. 
(a) PREEMPTION OF STATE INFORMATION SE-
CURITY LAWS.—This Act supersedes any provi-
sion of a statute, regulation, or rule of a State 
or political subdivision of a State, with re-
spect to those entities covered by the regula-
tions issued pursuant to this Act, that ex-
pressly— 
(1) 
requires 
information 
security 
practices and treatment of data in elec-
tronic form containing personal informa-
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00070
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
tion similar to any of those required 
under section 2; and 
(2) requires notification to individ-
uals of a breach of security resulting in 
unauthorized acquisition of data in elec-
tronic form containing personal informa-
tion. 
(b) ADDITIONAL PREEMPTION.— 
(1) IN GENERAL.—No person other than 
the Attorney General of a State may 
bring a civil action under the laws of any 
State if such action is premised in whole 
or in part upon the defendant violating 
any provision of this Act. 
(2) PROTECTION OF CONSUMER PROTEC-
TION LAWS.—This subsection shall not be 
construed to limit the enforcement of any 
State consumer protection law by an At-
torney General of a State. 
(c) PROTECTION OF CERTAIN STATE LAWS.— 
This Act shall not be construed to preempt the 
applicability of— 
(1) State trespass, contract, or tort 
law; or 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00071
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
(2) other State laws to the extent that 
those laws relate to acts of fraud. 
(d) PRESERVATION
OF FTC AUTHORITY.— 
Nothing in this Act may be construed in any 
way to limit or affect the Commission’s au-
thority under any other provision of law, in-
cluding the authority to issue advisory opin-
ions (under part 1 of volume 16 of the Code 
of Federal Regulations), policy statements, or 
guidance regarding this Act. 
SEC. 7. EFFECTIVE DATE AND SUNSET. 
(a) EFFECTIVE DATE.—This Act shall take 
effect 1 year after the date of enactment of 
this Act. 
(b) SUNSET.—This Act shall cease to be in 
effect on the date that is 10 years from the 
date of enactment of this Act. 
SEC. 8. AUTHORIZATION OF APPROPRIATIONS. 
There is authorized to be appropriated to 
the Commission $1,000,000 for each of fiscal 
years 2006 through 2010 to carry out this Act. 
SECTION 1. SHORT TITLE; FINDINGS. 
(a) SHORT TITLE.—This Act may be cited as 
the ‘‘Financial Data Protection Act of 2006’’. 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00072
Fmt 6652
Sfmt 6204
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
(b) FINDINGS.—The Congress finds as fol-
lows: 
(1) Protecting the security of sensitive 
information relating to consumers is im-
portant to limiting account fraud and 
identity theft. 
(2) While the Gramm-Leach-Bliley Act 
requires financial institutions to protect 
the security and confidentiality of the 
nonpublic personal information of the 
customers of financial institutions, the 
scope of covered entities and type of infor-
mation needs to be broadened to fully pro-
tect consumers. 
(3) Some Federal agencies have issued 
model guidance under the Gramm-Leach- 
Bliley Act requiring banks to investigate 
and 
provide 
notice 
to 
customers 
of 
breaches of data security involving cus-
tomer information that could lead to ac-
count fraud or identity theft, but these 
standards need to broadened to apply to 
other entities acting as consumer report-
ers, in order to create a single, uniform 
data security standard that applies to all 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00073
Fmt 6652
Sfmt 6204
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
parties to transactions involving such fi-
nancial information. 
(4) Requiring all consumer reporters 
handling sensitive financial personal in-
formation to provide notice to consumers 
of data security breaches that are likely to 
result in harm or inconvenience will help 
consumers protect themselves and miti-
gate against the risk of identity theft or 
account fraud. 
(5) Therefore, all consumer reporters 
should— 
(A) protect sensitive financial per-
sonal information; 
(B) investigate potential data se-
curity breaches; 
(C) provide breach notices as ap-
propriate to the United States Secret 
Service, 
functional 
regulators, 
in-
volved third parties, and consumers; 
(D) restore the security of the in-
formation and improve safeguards 
after a breach; and 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00074
Fmt 6652
Sfmt 6204
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS