sumer reporter in a manner meeting the re-
quirements of such subsection. 
‘‘(e) CONSUMER NOTICE.— 
‘‘(1) POTENTIAL
IDENTITY
THEFT
RISK.—A 
consumer reporter shall provide a consumer notice in 
accordance with subsection (f) if, after being re-
quired to commence an investigation pursuant to 
this section, the consumer reporter becomes aware— 
‘‘(A) that a breach of data security is rea-
sonably likely to have occurred, with respect to 
sensitive financial identity information main-
tained, received, or communicated by or on be-
half of the consumer reporter; 
‘‘(B) of information reasonably identi-
fying— 
‘‘(i) the nature and scope of the 
breach, and 
‘‘(ii) the sensitive financial identity in-
formation involved; and 
‘‘(C) that such information has been or is 
reasonably likely to be misused in a manner 
causing substantial harm or inconvenience 
against the consumers to whom such informa-
tion relates to commit identity theft.
‘‘(2) POTENTIAL
FRAUDULENT
TRANSACTION 
RISK.— 
‘‘(A) IN GENERAL.—A consumer reporter 
shall provide a consumer notice in accordance 
with subsection (f) if, after being required to 
commence an investigation pursuant to this sec-
tion, the consumer reporter becomes aware— 
‘‘(i) that a breach of data security is 
reasonably likely to have occurred, with re-
spect to sensitive financial account infor-
mation maintained, serviced, or commu-
nicated by or on behalf of the consumer re-
porter; 
‘‘(ii) of information reasonably identi-
fying— 
‘‘(I) the nature and scope of the 
breach, and 
‘‘(II) the sensitive financial ac-
count information involved; and 
‘‘(iii) that such information has been 
or is reasonably likely to be misused in a 
manner causing substantial harm or incon-
venience against consumers to whom such 
information relates to make fraudulent
transactions on such consumers’ financial 
accounts. 
‘‘(B) POTENTIAL
DELAYED
DETERMINA-
TION
FOR
INFORMATION
SECURITY
PRO-
GRAMS.—In determining the likelihood of mis-
use of sensitive financial account information 
under subparagraph (A), the consumer reporter 
may additionally consider whether any neural 
networks or security programs used by, or on 
behalf of, the consumer reporter have detected, 
or are likely to detect on an ongoing basis over 
a reasonable period of time, fraudulent trans-
actions resulting from the breach of data secu-
rity. 
‘‘(f) TIMING, CONTENT, AND MANNER
OF NO-
TICES.— 
‘‘(1) ORDER OF NOTICE.—The notices required 
under this section shall be made promptly to the en-
tities described in paragraphs (1) and (2) of sub-
section (c), then promptly to any appropriate third 
parties, and then without unreasonable delay to any 
consumers described in subsection (e)(1)(C) or 
(e)(2)(A)(iii), in accordance with such subsections. 
‘‘(2) DELAY OF NOTICE FOR LAW ENFORCE-
MENT PURPOSES.—If a consumer reporter receives a
written request from an appropriate law enforcement 
agency indicating that providing a notice under sub-
section (c)(3) or (e) would impede a criminal or civil 
investigation by that law enforcement agency, or an 
oral request from an appropriate law enforcement 
agency indicating that such a written request will be 
provided within 2 business days— 
‘‘(A) the consumer reporter shall delay, or 
in the case of a foreign law enforcement agency 
may delay, providing such notice until— 
‘‘(i) the law enforcement agency in-
forms the consumer reporter that such no-
tice will no longer impede the investigation; 
or 
‘‘(ii) the law enforcement agency fails 
to— 
‘‘(I) provide a written request 
within 2 business days following an 
oral request for a delay; or 
‘‘(II) provide within 10 days a 
written request to continue such delay 
for a specific time that is approved by 
a court of competent jurisdiction; 
‘‘(B) the consumer reporter shall not be 
liable for any losses that would not have oc-
curred but for the delay provided for under this 
paragraph or but for the communication of any 
information provided to any law enforcement 
agency pursuant to this section, except that 
nothing in this subparagraph shall be construed 
as creating any inference with respect to the es-
tablishment or existence of any such liability; 
and 
‘‘(C) the consumer reporter may— 
‘‘(i) 
conduct 
appropriate 
security 
measures that are not inconsistent with 
such request; and 
‘‘(ii) contact any law enforcement 
agency to determine whether any such in-
consistency would be created by such 
measures. 
‘‘(3) CONTENT
OF
CONSUMER
NOTICE.—Any 
notice required to be provided by a consumer re-
porter to a consumer under paragraph (1) or (2) of 
subsection (e), and any notice required in accord-
ance with subsection (d)(2)(A), shall be provided in 
a standardized envelope or transmission, and shall 
include the following in a clear and conspicuous 
manner:
‘‘(A) An appropriate heading or notice 
title. 
‘‘(B) A description of the nature and type 
of information that was, or is reasonably be-
lieved to have been, subject to the breach of 
data security. 
‘‘(C) The identity and relationship to the 
consumer of any entity that suffered the 
breach. 
‘‘(D) If known, the date, or a reasonable 
approximation of the period of time, on or with-
in which sensitive financial personal information 
related to the consumer was, or is reasonably 
believed to have been, subject to a breach. 
‘‘(E) A general description of the actions 
taken by the consumer reporter to restore the 
security and confidentiality of the breached in-
formation. 
‘‘(F) A telephone number by which a con-
sumer to whom the breached information re-
lates may call free of charge to obtain addi-
tional information about how to respond to the 
breach. 
‘‘(G) With respect to notices involving sen-
sitive financial identity information, a summary
of rights of consumer victims of fraud or iden-
tity theft, such as that prepared by the Com-
mission under section 609(d), including any ad-
ditional appropriate information on how the 
consumer may— 
‘‘(i) obtain a copy of a consumer re-
port free of charge in accordance with sec-
tion 612; 
‘‘(ii) place a fraud alert in any file re-
lating to the consumer at a consumer re-
porting agency under section 605A to dis-
courage unauthorized use; and 
‘‘(iii) contact the Commission for 
more detailed information. 
‘‘(H) With respect to notices involving sen-
sitive financial identity information, appropriate 
instructions to the consumer for obtaining file 
monitoring mitigation under subsection (g), 
which shall include a mailing address for the 
consumer to make a request for such mitiga-
tion, and may also include additional contact in-
formation, such as an e-mail or website address 
or a telephone number. 
‘‘(I) The approximate date the notice is 
being issued.
‘‘(4) OTHER TRANSMISSION OF NOTICE.—The 
notice described in paragraph (3) may be made by 
other means of transmission (such as electronic or 
oral) to a consumer only if— 
‘‘(A) the consumer has previously and ex-
pressly agreed to receive notice by such means; 
and 
‘‘(B) all of the relevant information in 
paragraph (3) is communicated to such con-
sumer in such transmission. 
‘‘(5) DUPLICATIVE NOTICES.— 
‘‘(A) IN GENERAL.—A consumer reporter, 
whether acting directly or in coordination with 
another entity— 
‘‘(i) shall not be required to provide 
more than 1 notice with respect to any 
breach of data security to any affected 
consumer, so long as such notice meets all 
the applicable requirements of this section, 
and 
‘‘(ii) shall not be required to provide 
a notice with respect to any consumer if a 
notice meeting the applicable requirements 
of this section has already been provided 
by another entity.
‘‘(B) UPDATING NOTICES.—If a consumer 
notice is provided to consumers pursuant only 
to subsection (e)(2) (relating to sensitive finan-
cial account information), and the consumer re-
porter subsequently becomes aware of a reason-
able likelihood that sensitive financial personal 
information involved in the breach is being mis-
used in a manner causing substantial harm or 
inconvenience against such consumer to commit 
identity theft, then an additional notice must be 
provided to such consumers as well any other 
appropriate parties under this section, including 
the summary of rights and file monitoring miti-
gation instructions under subparagraphs (G) 
and (H) of subsection (e)(3). 
‘‘(6) RESPONSIBILITY AND COSTS.—Except as 
otherwise established by agreement, the entity that 
suffered a breach of data security shall be— 
‘‘(A) primarily responsible for providing 
any consumer notices required under this sec-
tion with respect to such breach; and 
‘‘(B) responsible for the reasonable actual 
costs of any notices provided under this section, 
except as otherwise established by agreement. 
‘‘(g) FINANCIAL FRAUD MITIGATION.—
‘‘(1) FREE FILE MONITORING.—Any consumer 
reporter that is required to provide notice to a con-
sumer under paragraph (1) of subsection (e), or that 
is deemed to be in compliance with such requirement 
by operation of subsection (h), if requested by the 
consumer before the end of the 90-day period begin-
ning on the date of such notice, shall make available 
to the consumer, free of charge and for at least a 
6-month period, a service that monitors nationwide 
credit activity regarding a consumer from a con-
sumer reporting agency described in section 603(p). 
‘‘(2) JOINT RULEMAKING FOR SAFE HARBOR.— 
In accordance with subsection (i), the Secretary of 
the Treasury, the Board of Governors of the Federal 
Reserve System, and the Commission shall jointly 
develop standards and guidelines, which shall be 
issued by all functional regulatory agencies, that, in 
any case in which— 
‘‘(A) free file monitoring is offered under 
paragraph (1) to a consumer; 
‘‘(B) subsequent to the offer, another 
party misuses sensitive financial identity infor-
mation on the consumer obtained through the 
breach of data security (that gave rise to such
offer) to commit identity theft against the con-
sumer; and 
‘‘(C) at the time of such breach the con-
sumer reporter met the requirements of sub-
section (a), 
exempts the consumer reporter from any liability for 
any harm to the consumer resulting from such mis-
use, other than any direct pecuniary loss or loss pur-
suant to agreement by the consumer reporter, except 
that nothing in this paragraph shall be construed as 
creating any inference with respect to the establish-
ment or existence of any such liability. 
‘‘(h) COMPLIANCE WITH GLBA.— 
‘‘(1) IN GENERAL.—For the purposes of this 
section, any person subject to section 501(b) of title 
V of the Gramm-Leach-Bliley Act shall be deemed to 
be in compliance with— 
‘‘(A) subsection (a), if— 
‘‘(i) the person is obliged to imple-
ment appropriate safeguards, with respect 
to customer records and information, pur-
suant to regulations, guidelines, or guid-
ance prescribed by or issued by an agency 
or authority in accordance with such sub-
section of the Gramm-Leach-Bliley Act;
‘‘(ii) the person is substantially in 
compliance with such obligation; and 
‘‘(iii) the safeguards are being applied 
by the person with respect to sensitive fi-
nancial personal information in the same 
manner as with respect to customer 
records and information; 
‘‘(B) subsection (b), if— 
‘‘(i) the person is obliged to conduct 
investigations of breaches of information 
security pursuant to regulations, guide-
lines, or guidance prescribed by or issued 
by an agency or authority in accordance 
with such subsection of the Gramm-Leach- 
Bliley Act; 
‘‘(ii) the person is substantially in 
compliance with such obligation; and 
‘‘(iii) the person conducts such inves-
tigations with respect to sensitive financial 
personal information in the same manner 
as with other information subject to such 
regulation, guideline, or guidance; and 
‘‘(C) subsections (c), (d), (e), and (f) 
(other than subsection (f)(3)), if—
‘‘(i) the person is obliged to imple-
ment a consumer notification program 
after breaches of such data safeguards 
pursuant to regulations, guidelines, or 
guidance prescribed by or issued by an 
agency or authority in accordance with sec-
tion 501 of the Gramm-Leach-Bliley Act; 
‘‘(ii) the person is substantially in 
compliance with such obligation; and 
‘‘(iii) the person implements such con-
sumer notification program with respect to 
sensitive financial personal information in 
the same manner as with other informa-
tion subject to such regulations, guidelines, 
or guidance. 
‘‘(2) COORDINATION WITH REQUIREMENTS FOR 
GSES.—For purposes of paragraph (1), if— 
‘‘(A) with respect to any requirement de-
scribed in subparagraph (A)(i), (B)(i), or (C)(i) 
of paragraph (1) relating to sensitive financial 
personal information— 
‘‘(i) an enterprise (as defined in title 
XIII of the Housing and Community De-
velopment Act of 1992) is required to com-
ply with orders, guidance, or regulations
issued by the functional regulatory agency 
set forth in subsection (j)(1)(F); and 
‘‘(ii) such orders, guidance, or regula-
tions of such functional regulatory agency 
are substantially consistent with regula-
tions, guidelines, or guidance prescribed by 
or issued by an agency or authority in ac-
cordance with section 501(b) of the 
Gramm-Leach-Bliley Act (without regard 
to whether such enterprise or functional 
regulatory agency is subject to such section 
501(b)) that relate to any requirement de-
scribed in subparagraph (A)(i), (B)(i), or 
(C)(i) of paragraph (1); 
‘‘(B) the enterprise is substantially in com-
pliance with such requirement relating to sen-
sitive financial personal information; and 
‘‘(C) the enterprise implements any such 
requirement with respect to sensitive financial 
personal information in the same manner as 
with other information subject to the regula-
tions, guidelines, or guidance prescribed or 
issued by the functional regulatory agency set 
forth in subsection (j)(1)(F),
the enterprise shall be treated as a person subjection 
to section 501(b) of the Gramm-Leach-Bliley Act. 
‘‘(3) HARMONIZATION OF GLBA.— 
‘‘(A) IN
GENERAL.—To the extent that 
compliance by any consumer reporter with the 
requirements of title V of the Gramm-Leach- 
Bliley Act shall be deemed, pursuant to this 
subsection, to be compliance with this section, 
and the requirements of such title, and any reg-
ulations, guidelines, or orders issued or pre-
scribed under such title, differ in any way from 
this section, it is the sense of the Congress that 
the applicable regulators shall make every ap-
propriate effort as any relevant regulations are 
prescribed, reviewed, or updated to reconcile 
such differences to harmonize the corresponding 
requirements. 
‘‘(B) AGENCIES THAT HAVE NOT FULLY 
IMPLEMENTED TITLE V OF THE GLBA.—Any 
agency described in subsection (j) that has not 
issued or prescribed regulations, guidelines, or 
orders that are required or permitted under 
title V of the Gramm-Leach-Bliley Act and that 
set forth the requirements for compliance with 
such title, including with respect to providing
notice of a breach of data security, shall pre-
scribe such regulations, guidelines, or orders, as 
appropriate, before the end of the 12-month pe-
riod beginning on the date of the enactment of 
the Financial Data Protection Act of 2005, in 
a manner that— 
‘‘(i) is consistent with this section; 
and 
‘‘(ii) allows, to the extent practical, 
consistent standards across holding compa-
nies with respect to compliance with this 
section and section 501(b) of the Gramm- 
Leach-Bliley Act that is deemed compli-
ance under this subsection. 
‘‘(C) AGENCIES THAT HAVE IMPLEMENTED 
TITLE V OF THE GLBA.—Any agency described 
in subsection (j) that has issued or prescribed 
regulations, guidelines, or orders that are re-
quired or permitted under title V of the 
Gramm-Leach-Bliley Act and that set forth the 
requirements for compliance with such title 
shall modify such regulations, guidelines, or or-
ders, as appropriate, before the end of the 12- 
month period beginning on the date of the en-
actment of the Financial Data Protection Act 
of 2005, in a manner that— 
‘‘(i) is consistent with this section; 
and 
‘‘(ii) allows, to the extent practical, 
consistent standards across holding compa-
nies with respect to compliance with this 
section and section 501(b) of the Gramm- 
Leach-Bliley Act that is deemed compli-
ance under this subsection. 
‘‘(D) COORDINATION
UNDER
THIS
SEC-
TION.—To the extent practical, any regulations, 
guidelines, standards, or orders issued or pre-
scribed under this section shall be issued or 
prescribed in a manner that— 
‘‘(i) is consistent with this section; 
and 
‘‘(ii) allows, to the extent practical, 
consistent standards across holding compa-
nies with respect to compliance with this 
section and section 501(b) of the Gramm- 
Leach-Bliley Act that is deemed compli-
ance under this subsection. 
‘‘(i) UNIFORM SECURITY REGULATIONS.—
‘‘(1) UNIFORM STANDARDS.—The Secretary of 
the Treasury, the Board of Governors of the Federal 
Reserve System, and the Commission shall jointly 
develop appropriate standards and guidelines to im-
plement this section (other than subsection (h), in-
cluding— 
‘‘(A) prescribing regulations requiring each 
consumer reporter to establish reasonable poli-
cies and procedures implementing such stand-
ards and guidelines, consistent, as appropriate, 
with subsection (h) and section 501(b) of title 
V of the Gramm-Leach-Bliley Act, and any reg-
ulations, guidelines, or orders issued or pre-
scribed under such section; 
‘‘(B) prescribing specific regulations with 
respect to subsection (f)(3) setting forth a rea-
sonably unique and, pursuant to paragraph 
(2)(B), exclusive color and titling of the notice, 
and standardized formatting of the notice con-
tents described under such subsection to stand-
ardize such communications and make them 
more likely to be reviewed and understood by 
consumers;
‘‘(C) providing in such standards and 
guidelines that the responsibility of a consumer 
reporter to provide notice under this section— 
‘‘(i) has been satisfied with respect to 
any particular consumer, even if the con-
sumer reporter is unable to contact the 
consumer, so long as the consumer re-
porter has made reasonable efforts to ob-
tain a current address or other current 
contact information with respect to such 
consumer; 
‘‘(ii) may be made by public notice in 
appropriate cases where such reasonable 
efforts have failed; and 
‘‘(iii) with respect to paragraph (3) of 
subsection (c), may be communicated to 
entities in addition to those specifically re-
quired under such paragraph through any 
reasonable means, such as through an elec-
tronic transmission normally received by 
all of the consumer reporter’s business cus-
tomers; and 
‘‘(D) providing in such standards and 
guidelines elaboration on how to determine 
whether a technology is generally commercially
available for the purposes of subsection (b), fo-
cusing on the availability of such technology to 
persons who potentially could seek to breach the 
data security of the consumer reporter. 
‘‘(2) ENFORCEMENT.— 
‘‘(A) REGULATIONS.—Each of the func-
tional regulatory agencies shall prescribe such 
regulations as may be necessary, consistent 
with the standards in paragraph (1), to ensure 
compliance with this section with respect to the 
persons subject to the jurisdiction of such agen-
cy under subsection (i). 
‘‘(B) MISUSE OF UNIQUE COLOR AND TI-
TLES OF NOTICES.—Any person who uses the 
unique color and titling adopted under para-
graph (1)(B) for notices under subsection (f)(3) 
in a way that is likely to create a false belief 
in a consumer that a communication is such a 
notice shall be liable in the same manner and 
to the same extent as a debt collector is liable 
under section 813 for any failure to comply 
with any provision of the Fair Debt Collection 
Practices Act. 
‘‘(3) PROCEDURES AND DEADLINE.—
‘‘(A) PROCEDURES.—Standards and guide-
lines issued under this subsection shall be 
issued in accordance with applicable require-
ments of title 5, United States Code. 
‘‘(B) DEADLINE FOR INITIAL STANDARDS 
AND GUIDELINES.—The standards and guide-
lines required to be issued under paragraph (1) 
shall be published in final form before the end 
of the 12-month period beginning on the date 
of the enactment of the Financial Data Protec-
tion Act of 2005. 
‘‘(C) DEADLINE FOR ENFORCEMENT REG-
ULATIONS.—The standards and guidelines re-
quired to be issued under paragraph (2) shall 
be published in final form before the end of the 
6-month period beginning on the date standards 
and guidelines described in subparagraph (B) 
are published in final form. 
‘‘(D) 
AUTHORITY
TO
GRANT
EXCEP-
TIONS.—The regulations prescribed under para-
graph (2) may include such additional excep-
tions to this section as are deemed by the func-
tional regulatory agencies to be consistent with 
the purposes of this section.
‘‘(E) 
CONSULTATION
AND
COORDINA-
TION.—The Secretary of the Treasury, the 
Board of Governors of the Federal Reserve Sys-
tem, and the Commission shall consult and co-
ordinate with the other functional regulatory 
agencies to the extent appropriate in pre-
scribing regulations under this subsection. 
‘‘(F) FAILURE TO MEET DEADLINE.—Any 
agency or authority required to publish stand-
ards and guidelines or regulations under this 
subsection that fails to meet the deadline for 
such publishing shall submit a report to the 
Congress within 30 days of such deadline de-
scribing— 
‘‘(i) the reasons for the failure to 
meet such deadline; 
‘‘(ii) when the agency or authority ex-
pects to complete the publication required; 
and 
‘‘(iii) the detriment such failure to 
publish by the required deadline will have 
on consumers and other affected parties. 
‘‘(G) UNIFORM IMPLEMENTATION AND IN-
TERPRETATION.—It is the intention of the Con-
gress that the agencies and authorities de-
scribed in subsection (j)(1)(G) will implement 
and interpret their enforcement regulations, in-
cluding any exceptions provided under subpara-
graph (D), in a uniform manner. 
‘‘(4) APPROPRIATE EXEMPTIONS OR MODIFICA-
TIONS.—The Secretary of the Treasury, the Board 
of Governors of the Federal Reserve System, and the 
Commission, in consultation with the Administrator 
of the Small Business Administration and other 
functional regulatory agencies, shall provide appro-
priate exemptions or modifications from require-
ments of this section relating to sensitive financial 
personal information for consumer reporters that do 
not maintain, service, or communicate a large quan-
tity of sensitive financial account information or sen-
sitive financial identity information. 
‘‘(j) ADMINISTRATIVE ENFORCEMENT.— 
‘‘(1) IN
GENERAL.—Notwithstanding section 
616, 617, or 621, compliance with this section and 
the regulations prescribed under this section shall be 
enforced exclusively by the functional regulatory 
agencies with respect to financial institutions and 
other persons subject to the jurisdiction of each such 
agency under applicable law, as follows:
‘‘(A) Under section 8 of the Federal De-
posit Insurance Act, in the case of— 
‘‘(i) national banks, Federal branches 
and Federal agencies of foreign banks, and 
any subsidiaries of such entities (except 
brokers, dealers, persons providing insur-
ance, investment companies, and invest-
ment advisers), by the Comptroller of the 
Currency; 
‘‘(ii) member banks of the Federal 
Reserve System (other than national 
banks), branches and agencies of foreign 
banks (other than Federal branches, Fed-
eral agencies, and insured State branches 
of foreign banks), commercial lending com-
panies owned or controlled by foreign 
banks, organizations operating under sec-
tion 25 or 25A of the Federal Reserve Act, 
and bank holding companies and their 
nonbank subsidiaries or affiliates (except 
brokers, dealers, persons providing insur-
ance, investment companies, and invest-
ment advisers), by the Board of Governors 
of the Federal Reserve System;
‘‘(iii) banks insured by the Federal 
Deposit Insurance Corporation (other than 
members of the Federal Reserve System), 
insured State branches of foreign banks, 
and any subsidiaries of such entities (ex-
cept brokers, dealers, persons providing in-
surance, investment companies, and invest-
ment advisers), by the Board of Directors 
of the Federal Deposit Insurance Corpora-
tion; and 
‘‘(iv) savings associations the deposits 
of which are insured by the Federal De-
posit Insurance Corporation, and any sub-
sidiaries of such savings associations (ex-
cept brokers, dealers, persons providing in-
surance, investment companies, and invest-
ment advisers), by the Director of the Of-
fice of Thrift Supervision. 
‘‘(B) Under the Federal Credit Union Act, 
by the Board of the National Credit Union Ad-
ministration with respect to any federally in-
sured credit union, and any subsidiaries of such 
an entity. 
‘‘(C) Under the Securities Exchange Act of 
1934, by the Securities and Exchange Commis-
sion with respect to any broker, dealer, or 
nonbank transfer agent. 
‘‘(D) Under the Investment Company Act 
of 1940, by the Securities and Exchange Com-
mission with respect to investment companies. 
‘‘(E) Under the Investment Advisers Act 
of 1940, by the Securities and Exchange Com-
mission with respect to investment advisers reg-
istered with the Commission under such Act. 
‘‘(F) Under the provisions of title XIII of 
the Housing and Community Development Act 
of 1992, by the Director of Federal Housing 
Enterprise Oversight (and any successor to 
such functional regulatory agency) with respect 
to the Federal National Mortgage Association, 
the Federal Home Loan Mortgage Corporation, 
and any other entity or enterprise (as defined 
in such title XIII) subject to the jurisdiction of 
such functional regulatory agency under such 
title, including any affiliate of any such enter-
prise. 
‘‘(G) Under State insurance law, in the 
case of any person engaged in the business of 
insurance, by the applicable State insurance au-
thority of the State in which the person is dom-
iciled. 
‘‘(H) Under the Federal Trade Commis-
sion Act, by the Commission for any other per-
son that is not subject to the jurisdiction of any 
agency or authority under paragraphs (1) 
through (7) of this subsection. 
‘‘(2) EXERCISE OF CERTAIN POWERS.—For the 
purpose of the exercise by any agency referred to in 
paragraph (1) of its powers under any Act referred 
to in that subsection, a violation of any requirement 
imposed under this subchapter shall be deemed to be 
a violation of a requirement imposed under that Act. 
In addition to its powers under any provision of law 
specifically referred to in paragraph (1), each of the 
agencies referred to in that paragraph may exercise, 
for the purpose of enforcing compliance with any re-
quirement imposed under this section, any other au-
thority conferred on it by law. 
‘‘(k) DEFINITIONS.—For purposes of this section, the 
following definitions shall apply: 
‘‘(1) BREACH OF DATA SECURITY.—The term 
‘breach of data security’ means, with respect to sen-
sitive financial personal information that is main-
tained, serviced, or communicated by or on behalf of 
any consumer reporter— 
‘‘(A) an unauthorized acquisition of such 
information that could be used to commit finan-
cial fraud (such as identity theft or fraudulent 
transactions made on financial accounts); or 
‘‘(B) an unusual pattern of use of such in-
formation indicative of financial fraud. 
‘‘(2) CONSUMER.—The term ‘consumer’ means 
an individual. 
‘‘(3) CONSUMER
REPORTER
AND
RELATED 
TERMS.— 
‘‘(A) CONSUMER REPORT.—The term ‘con-
sumer report’ includes any written, oral, or 
other communication of any information by a 
consumer reporter bearing on a consumer’s 
credit worthiness, credit standing, credit capac-
ity, character, general reputation, personal 
characteristics, personal identifiers, financial 
account information, or mode of living. 
‘‘(B) CONSUMER
REPORTER.—The term 
‘consumer reporter’ means any consumer re-
porting agency or financial institution, or any 
person which, for monetary fees, dues, on a co-
operative nonprofit basis, or otherwise regularly
engages in whole or in part in the practice of 
assembling or evaluating consumer reports, con-
sumer credit information, or other information 
on consumers, for the purpose of furnishing 
consumer reports to third parties or to provide 
or collect payment for or market products and 
services, or for employment purposes, and 
which uses any means or facility of interstate 
commerce for such purposes. 
‘‘(4) FINANCIAL INSTITUTION.—The term ‘fi-
nancial institution’ means— 
‘‘(A) any person the business of which is 
engaging in activities that are financial in na-
ture as described in or determined under sec-
tion 4(k) of the Bank Holding Company Act; 
‘‘(B) any entity that is primarily engaged 
in activities that are subject to the Fair Credit 
Reporting Act; and 
‘‘(C) any person that is maintaining, re-
ceiving, or communicating sensitive financial 
personal information on an ongoing basis for 
the purposes of engaging in interstate com-
merce. 
‘‘(5) FUNCTIONAL REGULATORY AGENCY.—The 
term ‘functional regulatory agency’ means any agen-
cy described in subsection (j) with respect to the fi-
nancial institutions and other persons subject to the 
jurisdiction of such agency. 
‘‘(6) 
NATIONWIDE
CONSUMER
REPORTING 
AGENCY.—The term ‘nationwide consumer reporting 
agency’ means— 
‘‘(A) a consumer reporting agency de-
scribed in section 603(p); 
‘‘(B) any person who notifies the Commis-
sion that the person reasonably expects to be-
come a consumer reporting agency described in 
section 603(p) within a reasonable time; and 
‘‘(C) a consumer reporting agency de-
scribed in section 603(w) that notifies the Com-
mission that the person wishes to receive breach 
of data security notices under this section that 
involve information of the type maintained by 
such agency. 
‘‘(7) NEURAL
NETWORK.—The term ‘neural 
network’ means an information security program 
that monitors financial account transactions for po-
tential fraud, using historical patterns to analyze 
and identify suspicious financial account trans-
actions.
‘‘(8) SENSITIVE FINANCIAL ACCOUNT INFORMA-
TION.—The term ‘sensitive financial account infor-
mation’ means a financial account number of a con-
sumer, such as a credit card number or debit card 
number, in combination with any security code, ac-
cess code, biometric code, password, or other per-
sonal identification information that would allow ac-
cess to the financial account. 
‘‘(9) SENSITIVE FINANCIAL IDENTITY INFORMA-
TION.—The term ‘sensitive financial identity infor-
mation’ means the first and last name, the address, 
or the telephone number of a consumer, in combina-
tion with any of the following of the consumer: 
‘‘(A) Social Security number. 
‘‘(B) Driver’s license number or equivalent 
State identification number. 
‘‘(C) Taxpayer identification number. 
‘‘(10) SENSITIVE FINANCIAL PERSONAL INFOR-
MATION.—The term ‘sensitive financial personal in-
formation’ means any information that is sensitive 
financial account information, sensitive financial 
identity information, or both. 
‘‘(11) SUBSTANTIAL
HARM
OR
INCONVEN-
IENCE.—The term ‘substantial harm or inconven-
ience’ with respect to a consumer means material fi-
nancial loss to or civil or criminal penalties imposed 
on the consumer or the need for the consumer to ex-
pend significant time and effort to correct erroneous 
information relating to the consumer, including in-
formation maintained by consumer reporting agen-
cies, financial institutions, or government entities, in 
order to avoid material financial loss or increased 
costs or civil or criminal penalties, due to unauthor-
ized use of sensitive financial personal information 
relating to such consumer, but does not include 
other harm or inconvenience that is not substantial, 
including changing a financial account number or 
closing a financial account. 
‘‘(l) RELATION TO STATE LAWS.—No requirement or 
prohibition may be imposed under the laws of any State 
with respect to the responsibilities of any person— 
‘‘(1) to protect the security or confidentiality of 
information on consumers maintained by or on be-
half of the person; 
‘‘(2) to safeguard such information from poten-
tial misuse; 
‘‘(3) to investigate or provide notices of any un-
authorized access to information concerning the con-
sumer, or the potential misuse of such information, 
for fraudulent purposes; or
‘‘(4) to mitigate any loss or harm resulting 
from such unauthorized access or misuse.’’. 
(b) CLERICAL AMENDMENT.—The table of sections 
for the Fair Credit Reporting Act is amended by inserting 
after the item relating to section 629 the following new 
item: 
‘‘630. Data security safeguards.’’. 
(c) EFFECTIVE DATE.—The provisions of section 630 
of the Fair Credit Reporting Act (as added by this sec-
tion), other than subsection (h) of such section, shall take 
effect on the date of publication of the regulations re-
quired under paragraph (3) of such subsection, with re-
spect to any person under the jurisdiction of each regu-
latory agency publishing such regulations. 
Æ