I 
116TH CONGRESS 
1ST SESSION H. R. 4480 
To amend the Small Business Act to require that credit reporting companies 
provide certain protections to small businesses, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 24, 2019 
Mr. STEUBE (for himself and Mr. HAGEDORN) introduced the following bill; 
which was referred to the Committee on Small Business 
A BILL 
To amend the Small Business Act to require that credit 
reporting companies provide certain protections to small 
businesses, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Small Business Credit 
Protection Act of 2019’’. 
SEC. 2. DATA BREACHES. 
(a) IN GENERAL.—The Small Business Act (15 
U.S.C. 631 et seq.) is amended— 
(1) by redesignating section 49 (15 U.S.C. 631 
note) as section 50; and 
VerDate Sep 11 2014 
01:40 Sep 28, 2019
Jkt 089200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H4480.IH
H4480
pamtmann on DSKBC07HB2PROD with BILLS
(2) by inserting after section 48 (15 U.S.C. 
657u) the following new section: 
‘‘SEC. 49. DATA BREACHES. 
‘‘(a) DEFINITION.—In this section— 
‘‘(1) the term ‘consumer report’ has the mean-
ing given the term in section 603 of the Fair Credit 
Reporting Act (15 U.S.C. 1681a); and 
‘‘(2) the term ‘credit reporting company’— 
‘‘(A) has the meaning given the term ‘con-
sumer reporting agency’ in section 603 of the 
Fair Credit Reporting Act (15 U.S.C. 1681a); 
and 
‘‘(B) includes an entity that collects com-
mercial credit data. 
‘‘(b) REQUIREMENTS FOR REPORTING BREACHES.— 
‘‘(1) APPLICABLE STATE LAW.— 
‘‘(A) IN GENERAL.—Except as provided in 
paragraph (2), if nonpublic data of a small 
business concern that is collected or stored by 
a credit reporting company has been breached, 
the credit reporting company shall report the 
breach promptly and not later than as required 
under the law of the State in which the small 
business concern is located. 
VerDate Sep 11 2014 
01:40 Sep 28, 2019
Jkt 089200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H4480.IH
H4480
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(B) LOCATIONS IN MULTIPLE STATES.— 
If a small business concern that is affected by 
a breach described in subparagraph (A) has lo-
cations in more than 1 State, for the purposes 
of that subparagraph, the law of the State that 
imposes the shortest period for the reporting of 
the breach shall apply. 
‘‘(2) EXCEPTION.— 
‘‘(A) IN
GENERAL.—If a small business 
concern that is affected by a breach described 
in paragraph (1)(A) is located in a State that 
does not have a law that imposes a set period 
for the reporting of the breach, the credit re-
porting company to which the requirement 
under that paragraph applies shall report the 
breach in the most expeditious manner prac-
ticable and without unreasonable delay. 
‘‘(B) RULE OF CONSTRUCTION REGARDING 
A LAW ENFORCEMENT REQUEST.—For the pur-
poses of subparagraph (A), a delay with respect 
to the reporting of a breach described in that 
subparagraph that is caused by a requirement 
to respond to a request submitted by a law en-
forcement agency shall be construed to be a 
reasonable delay. 
VerDate Sep 11 2014 
01:40 Sep 28, 2019
Jkt 089200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4480.IH
H4480
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(c) PROHIBITION.—During the 180-day period be-
ginning on the date on which a breach described in sub-
section (b)(1)(A) occurs, a credit reporting company may 
not charge a small business concern that is affected by 
that breach for providing the small business concern with 
the consumer report of the small business concern. 
‘‘(d) NO PREEMPTION.—Nothing in this section shall 
preempt any State law with respect to credit reporting 
companies.’’. 
(b) GAO REPORT.— 
(1) DEFINITIONS.—In this subsection, the term 
‘‘credit reporting company’’— 
(A) has the meaning given the term ‘‘con-
sumer reporting agency’’ in section 603 of the 
Fair Credit Reporting Act (15 U.S.C. 1681a); 
and 
(B) includes an entity that collects com-
mercial credit data. 
(2) REPORT.—Not later than 1 year after the 
date of enactment of this Act, the Comptroller Gen-
eral of the United States shall submit to Congress 
a report regarding the economic harm incurred by 
small business concerns as a result of data breaches 
at credit reporting companies. 
Æ 
VerDate Sep 11 2014 
01:40 Sep 28, 2019
Jkt 089200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6301
E:\BILLS\H4480.IH
H4480
pamtmann on DSKBC07HB2PROD with BILLS