after the date on which the consumer assistance 
unit is established, notify each affected indi-
vidual with respect to the data breach by mail 
and e-mail. 
‘‘(c) ENFORCEMENT.— 
‘‘(1) IN GENERAL.—Subject to subtitle B of the 
Consumer Financial Protection Act of 2010 (12 
U.S.C. 5511 et seq.), the Federal Trade Commission 
or the Bureau may bring a civil action to recover a 
civil penalty in an appropriate district court of the 
United States against any person that negligently, 
knowingly, or willingly causes a data breach at a 
consumer reporting agency. 
‘‘(2) PENALTY AMOUNT.— 
‘‘(A) IN GENERAL.—In a successful action 
brought under paragraph (1), the person 
against which the action is brought shall be lia-
ble for a civil penalty of not more than— 
‘‘(i) $2,500 for each affected indi-
vidual with respect to the data breach 
caused by the person; and 
‘‘(ii) $25,000,000 in total. 
‘‘(B) CONSIDERATIONS.—In determining 
the amount of a civil penalty in a successful ac-
tion brought under paragraph (1), the court 
VerDate Sep 11 2014 
02:07 Dec 09, 2017
Jkt 079200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H4544.IH
H4544
dlhill on DSK3GLQ082PROD with BILLS
shall consider, with respect to the person 
against which the action is brought— 
‘‘(i) the degree of culpability of the 
person; 
‘‘(ii) any history of similar prior con-
duct by the person; 
‘‘(iii) the ability of the person to pay; 
‘‘(iv) the effect of the penalty on the 
ability of the person to continue to do busi-
ness; and 
‘‘(v) any other factor as justice may 
require. 
‘‘(3) PRIVATE CAUSE OF ACTION.— 
‘‘(A) DEFINITION.—In this paragraph, the 
term ‘actual loss’ means the total cost to an af-
fected individual as a result of a data breach at 
a consumer reporting agency, including— 
‘‘(i) the costs incurred by the affected 
individual— 
‘‘(I) in responding to the data 
breach; and 
‘‘(II) as a result of— 
‘‘(aa) reviewing accounts of 
the affected individual for fraud-
ulent charges; 
VerDate Sep 11 2014 
02:07 Dec 09, 2017
Jkt 079200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H4544.IH
H4544
dlhill on DSK3GLQ082PROD with BILLS
‘‘(bb) closing accounts of the 
affected individual that may have 
been compromised by the data 
breach; and 
‘‘(cc) imposing credit freezes 
and obtaining credit monitoring 
services; and 
‘‘(ii) any revenue lost, or cost or con-
sequential damage incurred, by the af-
fected individual relating to the interrup-
tion of the ability of the affected individual 
to obtain credit. 
‘‘(B) CAUSE OF ACTION.— 
‘‘(i) IN GENERAL.—An affected indi-
vidual may bring an action in an appro-
priate district court of the United States 
against any person that negligently, know-
ingly, or willingly caused a data breach at 
a consumer reporting agency in which the 
sensitive personal information of the af-
fected individual was lost, stolen, or 
accessed without authorization. 
‘‘(ii) DAMAGES.—In a successful ac-
tion brought by an affected individual 
VerDate Sep 11 2014 
02:07 Dec 09, 2017
Jkt 079200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H4544.IH
H4544
dlhill on DSK3GLQ082PROD with BILLS
under clause (i), the affected individual 
may recover— 
‘‘(I) the greater of— 
‘‘(aa) the actual loss to the 
affected individual with respect 
to the data breach described in 
that clause; or 
‘‘(bb) $1,000 in liquidated 
damages; 
‘‘(II) punitive damages, as the 
court may allow; and 
‘‘(III) the costs of the action, to-
gether with reasonable attorney’s fees, 
as determined by the court. 
‘‘(d) REVIEW OF COMPLIANCE WITH STANDARDS 
FOR SAFEGUARDING CUSTOMER INFORMATION.— 
‘‘(1) DEFINITION.—In this subsection, the term 
‘covered person’ has the meaning given the term in 
section 1002 of the Consumer Financial Protection 
Act of 2010 (12 U.S.C. 5481). 
‘‘(2) EXAMINATION.—The Bureau may examine 
any consumer reporting agency that is a covered 
person subject to supervision under section 1024 of 
the Consumer Financial Protection Act of 2010 (12 
U.S.C. 5514) for compliance by that agency with the 
VerDate Sep 11 2014 
02:07 Dec 09, 2017
Jkt 079200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H4544.IH
H4544
dlhill on DSK3GLQ082PROD with BILLS
standards established by the Federal Trade Commis-
sion under section 501(b) of the Gramm-Leach-Bli-
ley Act (15 U.S.C. 6801(b)). 
‘‘(e) PROTECTION
OF LEGAL RIGHTS
OF CON-
SUMERS.—A consumer reporting agency may not take a 
covered action— 
‘‘(1) as a condition of providing any service or 
product to, or on behalf of, a consumer; and 
‘‘(2) that relates to the rights of a consumer 
after a data breach at the consumer reporting agen-
cy in which the sensitive personal information of the 
consumer is lost, stolen, or accessed without author-
ization. 
‘‘(f) ANNUAL STUDY AND REPORT.— 
‘‘(1) IN GENERAL.—Beginning in the first full 
year after the date of enactment of this section, and 
annually thereafter, the Bureau and the Federal 
Trade Commission, in consultation with the Attor-
ney General, shall conduct a study regarding the 
costs to affected individuals from data breaches at 
consumer reporting agencies, including— 
‘‘(A) the economic costs to those affected 
individuals; 
‘‘(B) the effects on— 
VerDate Sep 11 2014 
02:07 Dec 09, 2017
Jkt 079200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H4544.IH
H4544
dlhill on DSK3GLQ082PROD with BILLS
‘‘(i) the ability of those affected indi-
viduals to obtain credit and housing; and 
‘‘(ii) the reputations of those affected 
individuals; and 
‘‘(C) the costs relating to the emotional 
and psychological stress of those affected indi-
viduals from having the sensitive personal infor-
mation of those affected individuals lost, stolen, 
or accessed without authorization. 
‘‘(2) SUBMISSION
TO
CONGRESS.—Not later 
than 30 days after the date on which each study 
conducted under paragraph (1) is completed, the 
Bureau and the Federal Trade Commission shall 
submit to the appropriate committees of Congress a 
report that contains the results of the study. 
‘‘(3) CONTENTS.—Each study conducted under 
paragraph (1) and each report submitted under 
paragraph (2) shall contain a survey of affected indi-
viduals who were contacted for the purposes of con-
ducting the study. 
‘‘(4) AUTHORITY.—In conducting any study 
under paragraph (1), the Bureau, the Federal Trade 
Commission, and the Attorney General may compel 
a consumer reporting agency to disclose nonpropri-
etary information. 
VerDate Sep 11 2014 
02:07 Dec 09, 2017
Jkt 079200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H4544.IH
H4544
dlhill on DSK3GLQ082PROD with BILLS
‘‘(g) RULE OF CONSTRUCTION.—Nothing in this sec-
tion may be construed as modifying, limiting, or super-
seding any provision of State law if the protection that 
the provision of State law provides to consumers is greater 
than the protection provided to consumers under this sec-
tion.’’. 
(b) TECHNICAL AND CONFORMING AMENDMENT.— 
The table of contents for the Fair Credit Reporting Act 
(15 U.S.C. 1681 et seq.) is amended by inserting after 
the item relating to section 605B the following: 
‘‘605C. Data security at consumer reporting agencies.’’. 
Æ 
VerDate Sep 11 2014 
02:07 Dec 09, 2017
Jkt 079200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6301
E:\BILLS\H4544.IH
H4544
dlhill on DSK3GLQ082PROD with BILLS