(E) A process for disposing of ob-
solete data in electronic form con-
taining 
personal 
information 
by 
shredding, permanently erasing, or 
otherwise modifying the personal in-
formation contained in such data to 
make such personal information per-
manently 
unreadable 
or 
undecipherable. 
(3) TREATMENT OF ENTITIES GOVERNED 
BY OTHER LAW.—In promulgating the regu-
lations under this subsection, the Com-
mission may determine to be in compli-
ance with this subsection any person who 
is required under any other Federal law 
to maintain standards and safeguards for 
information security and protection of 
personal information that provide equal 
or greater protection than those required 
under this subsection. 
(b) DESTRUCTION
OF
OBSOLETE
PAPER 
RECORDS
CONTAINING
PERSONAL
INFORMA-
TION.— 
(1) STUDY.—Not later than 1 year after 
the date of enactment of this Act, the 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
Commission shall conduct a study on the 
practicality of requiring a standard meth-
od or methods for the destruction of ob-
solete paper documents and other non- 
electronic data containing personal infor-
mation by persons engaged in interstate 
commerce who own or possess such 
paper 
documents 
and 
non-electronic 
data. The study shall consider the cost, 
benefit, feasibility, and effect of a re-
quirement of shredding or other perma-
nent destruction of such paper docu-
ments and non-electronic data. 
(2) 
REGULATIONS.—The 
Commission 
may promulgate regulations under sec-
tion 553 of title 5, United States Code, re-
quiring a standard method or methods 
for the destruction of obsolete paper doc-
uments and other non-electronic data 
containing personal information by per-
sons engaged in interstate commerce who 
own or possess such paper documents 
and non-electronic data if the Commis-
sion finds that— 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
(A) the improper disposal of obso-
lete paper documents and other non- 
electronic data creates a reasonable 
risk of identity theft, fraud, or other 
unlawful conduct; 
(B) such a requirement would be 
effective in preventing identity theft, 
fraud, or other unlawful conduct; 
(C) the benefit in preventing iden-
tity theft, fraud, or other unlawful 
conduct would outweigh the cost to 
persons subject to such a require-
ment; and 
(D) compliance with such a re-
quirement would be practicable. 
In enforcing any such regulations, the 
Commission may determine to be in com-
pliance with such regulations any person 
who is required under any other Federal 
law to dispose of obsolete paper docu-
ments and other non-electronic data con-
taining personal information if such 
other Federal law provides equal or 
greater protection or personal informa-
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
tion than the regulations promulgated 
under this subsection. 
(c) SPECIAL REQUIREMENTS FOR INFORMA-
TION BROKERS.— 
(1) SUBMISSION
OF
POLICIES
TO
THE 
FTC.—The regulations promulgated under 
subsection (a) shall require information 
brokers to submit their security policies 
to the Commission in conjunction with a 
notification of a breach of security under 
section 3 or upon request of the Commis-
sion. 
(2) POST-BREACH
AUDIT.—For any in-
formation broker required to provide no-
tification under section 3, the Commis-
sion shall conduct an audit of the infor-
mation security practices of such infor-
mation broker, or require the informa-
tion broker to conduct an independent 
audit of such practices (by an inde-
pendent auditor who has not audited 
such information broker’s security prac-
tices during the preceding 5 years). The 
Commission may conduct or require ad-
ditional audits for a period of 5 years fol-
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
lowing the breach of security or until the 
Commission determines that the security 
practices of the information broker are in 
compliance with the requirements of this 
section and are adequate to prevent fur-
ther breaches of security. 
(3) VERIFICATION
OF
AND
INDIVIDUAL 
ACCESS TO PERSONAL INFORMATION.— 
(A) VERIFICATION.—Each informa-
tion broker shall establish reasonable 
procedures to verify the accuracy of 
the personal information it collects, 
assembles, or maintains, and any 
other information it collects, assem-
bles, or maintains that specifically 
identifies an individual, other than 
information which merely identifies 
an individual’s name or address. 
(B) CONSUMER ACCESS TO INFORMA-
TION.— 
(i) ACCESS.—Each information 
broker shall— 
(I) provide to each indi-
vidual whose personal infor-
mation it maintains, at the in-
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
dividual’s request at least 1 
time per year and at no cost 
to the individual, and after 
verifying the identity of such 
individual, a means for the in-
dividual to review any per-
sonal information regarding 
such 
individual 
maintained 
by 
the 
information 
broker 
and any other information 
maintained by the informa-
tion broker that specifically 
identifies 
such 
individual, 
other than information which 
merely identifies an individ-
ual’s name or address; and 
(II) place a conspicuous 
notice on its Internet website 
(if 
the 
information 
broker 
maintains such a website) in-
structing individuals how to 
request access to the informa-
tion required to be provided 
under subclause (I). 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6202
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS