I 
115TH CONGRESS 
2D SESSION 
H. R. 5166 
To direct the Federal Trade Commission to review and potentially revise 
its standards for safeguarding customer information to ensure that such 
standards require certain consumer reporting agencies and service pro-
viders of such agencies to maintain sufficient safeguards against cyber 
attacks and related threats, to provide for additional authority to enforce 
such standards with respect to such agencies and providers, and for 
other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MARCH 5, 2018 
Mr. TED LIEU of California introduced the following bill; which was referred 
to the Committee on Financial Services, and in addition to the Committee 
on Energy and Commerce, for a period to be subsequently determined by 
the Speaker, in each case for consideration of such provisions as fall with-
in the jurisdiction of the committee concerned 
A BILL 
To direct the Federal Trade Commission to review and po-
tentially revise its standards for safeguarding customer 
information to ensure that such standards require certain 
consumer reporting agencies and service providers of 
such agencies to maintain sufficient safeguards against 
cyber attacks and related threats, to provide for addi-
tional authority to enforce such standards with respect 
to such agencies and providers, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Sep 11 2014 
21:46 Mar 09, 2018
Jkt 079200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5166.IH
H5166
amozie on DSK30RV082PROD with BILLS
cyber attacks and related threats, not later than 180 
days after the date of the completion of the review, 
the Commission shall, pursuant to section 553 of 
title 5, United States Code, revise such regulations 
so as to provide for standards applicable to covered 
consumer reporting agencies and covered service 
providers that require such agencies and providers to 
maintain sufficient safeguards to protect customer 
records and information against cyber attacks and 
related threats. 
(b) INVESTIGATIONS.— 
(1) INITIAL INVESTIGATION.— 
(A) IN
GENERAL.—Not later than 18 
months after the date described in subpara-
graph (B), the Commission shall complete an 
investigation of each person or entity that, as of 
the date described in such subparagraph, is a 
covered consumer reporting agency or covered 
service provider, to determine whether such 
agency or provider is in compliance with the 
regulations issued by the Commission under 
section 501 of the Gramm-Leach-Bliley Act (15 
U.S.C. 6801). 
(B) DATE
DESCRIBED.—The date de-
scribed in this subparagraph is— 
VerDate Sep 11 2014 
21:46 Mar 09, 2018
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5166.IH
H5166
amozie on DSK30RV082PROD with BILLS
(i) if no revision of such regulations is 
required by paragraph (2) of subsection 
(a), the date of the completion of the re-
view required by paragraph (1) of such 
subsection; or 
(ii) if revision of such regulations is 
required by paragraph (2) of such sub-
section, the date on which the Commission 
issues the revised regulations. 
(2) SUBSEQUENT INVESTIGATIONS.—From time 
to time after the date that is 18 months after the 
date described in paragraph (1)(B), the Commission 
shall complete an investigation of each covered con-
sumer reporting agency and each covered service 
provider to determine whether such agency or pro-
vider is in compliance with the regulations issued by 
the Commission under section 501 of the Gramm- 
Leach-Bliley Act (15 U.S.C. 6801). 
SEC. 3. ENFORCEMENT BY FEDERAL TRADE COMMISSION. 
(a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 
A violation of a regulation issued by the Commission 
under section 501 of the Gramm-Leach-Bliley Act (15 
U.S.C. 6801) by a covered consumer reporting agency or 
a covered service provider shall be treated as a violation 
of a rule under section 18(a)(1)(B) of the Federal Trade 
VerDate Sep 11 2014 
21:46 Mar 09, 2018
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5166.IH
H5166
amozie on DSK30RV082PROD with BILLS
Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding un-
fair or deceptive acts or practices. 
(b) POWERS
OF COMMISSION.—The Commission 
shall enforce, with respect to covered consumer reporting 
agencies and covered service providers, the regulations 
issued by the Commission under section 501 of the 
Gramm-Leach-Bliley Act (15 U.S.C. 6801) in the same 
manner, by the same means, and with the same jurisdic-
tion, powers, and duties as though all applicable terms and 
provisions of the Federal Trade Commission Act (15 
U.S.C. 41 et seq.) were incorporated into and made a part 
of such section. Any covered consumer reporting agency 
or covered service provider that violates such a regulation 
shall be subject to the penalties and entitled to the privi-
leges and immunities provided in the Federal Trade Com-
mission Act. 
SEC. 4. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 
(a) IN GENERAL.—In any case in which the attorney 
general of a State, or an official or agency of a State, 
has reason to believe that an interest of the residents of 
such State has been or is threatened or adversely affected 
by an act or practice by a covered consumer reporting 
agency or covered service provider in violation of a regula-
tion issued by the Commission under section 501 of the 
Gramm-Leach-Bliley Act (15 U.S.C. 6801), the State, as 
VerDate Sep 11 2014 
21:46 Mar 09, 2018
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5166.IH
H5166
amozie on DSK30RV082PROD with BILLS
parens patriae, may bring a civil action on behalf of the 
residents of the State in an appropriate district court of 
the United States to— 
(1) enjoin such act or practice; 
(2) enforce compliance with such regulation; 
(3) obtain damages, restitution, or other com-
pensation on behalf of residents of the State; or 
(4) obtain such other legal and equitable relief 
as the court may consider to be appropriate. 
(b) NOTICE.—Before filing an action under this sec-
tion, the attorney general, official, or agency of the State 
involved shall provide to the Commission a written notice 
of such action and a copy of the complaint for such action. 
If the attorney general, official, or agency determines that 
it is not feasible to provide the notice described in this 
subsection before the filing of the action, the attorney gen-
eral, official, or agency shall provide written notice of the 
action and a copy of the complaint to the Commission im-
mediately upon the filing of the action. 
(c) AUTHORITY OF COMMISSION.— 
(1) IN GENERAL.—On receiving notice under 
subsection (b) of an action under this section, the 
Commission shall have the right— 
(A) to intervene in the action; 
VerDate Sep 11 2014 
21:46 Mar 09, 2018
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5166.IH
H5166
amozie on DSK30RV082PROD with BILLS
(B) upon so intervening, to be heard on all 
matters arising therein; and 
(C) to file petitions for appeal. 
(2) LIMITATION ON STATE ACTION WHILE FED-
ERAL ACTION IS PENDING.—If the Commission or 
the Attorney General of the United States has insti-
tuted a civil action for violation of a regulation 
issued by the Commission under section 501 of the 
Gramm-Leach-Bliley Act (15 U.S.C. 6801) by a cov-
ered consumer reporting agency or covered service 
provider (referred to in this paragraph as the ‘‘Fed-
eral action’’), no State attorney general, official, or 
agency may bring an action under this section dur-
ing the pendency of the Federal action against any 
defendant named in the complaint in the Federal ac-
tion for any violation of such regulation alleged in 
such complaint. 
(d) RULE
OF CONSTRUCTION.—For purposes of 
bringing a civil action under this section, nothing in this 
Act shall be construed to prevent an attorney general, offi-
cial, or agency of a State from exercising the powers con-
ferred on the attorney general, official, or agency by the 
laws of such State to conduct investigations, administer 
oaths and affirmations, or compel the attendance of wit-
VerDate Sep 11 2014 
21:46 Mar 09, 2018
Jkt 079200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5166.IH
H5166
amozie on DSK30RV082PROD with BILLS
nesses or the production of documentary and other evi-
dence. 
SEC. 5. DEFINITIONS. 
In this Act: 
(1) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(2) COVERED
CONSUMER
REPORTING
AGEN-
CY.—The term ‘‘covered consumer reporting agency’’ 
means a consumer reporting agency that compiles 
and maintains files on consumers on a nationwide 
basis (as defined in section 603(p) of the Fair Cred-
it Reporting Act (15 U.S.C. 1681a(p))). 
(3) COVERED SERVICE PROVIDER.—The term 
‘‘covered service provider’’ means any person or enti-
ty that is a service provider (as defined in section 
314.2 of title 16, Code of Federal Regulations) 
through provision of services to a covered consumer 
reporting agency. 
Æ 
VerDate Sep 11 2014 
21:46 Mar 09, 2018
Jkt 079200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6301
E:\BILLS\H5166.IH
H5166
amozie on DSK30RV082PROD with BILLS