I 
109TH CONGRESS 
2D SESSION 
H. R. 5588 
To require the Secretary of Veterans Affairs to protect sensitive personal 
information of veterans, to ensure that veterans are appropriately notified 
of any breach of data security with respect to such information, to 
provide free credit monitoring and credit reports for veterans and others 
affected by any such breach of data security, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JUNE 12, 2006 
Mr. SALAZAR (for himself and Mr. EVANS) introduced the following bill; which 
was referred to the Committee on Veterans’ Affairs 
A BILL 
To require the Secretary of Veterans Affairs to protect sen-
sitive personal information of veterans, to ensure that 
veterans are appropriately notified of any breach of data 
security with respect to such information, to provide 
free credit monitoring and credit reports for veterans 
and others affected by any such breach of data security, 
and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Aug 31 2005 
04:10 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5588.IH
H5588
hmoore on PROD1PC68 with HMBILLS
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Comprehensive Vet-
erans’ Data Protection and Identity Theft Prevention Act 
of 2006’’. 
SEC. 2. DEFINITIONS. 
For purposes of this Act, the following definitions 
shall apply: 
(1) DATA BREACH.—The term ‘‘data breach’’ 
means the unauthorized acquisition or use of data in 
electronic or printed form containing sensitive per-
sonal 
information, 
including 
information 
com-
promised with respect to the theft of data first pub-
licly reported on May 22, 2006. 
(2) DATA
IN
ELECTRONIC
FORM.—The term 
‘‘data in electronic form’’ means any data stored 
electronically or digitally on any computer system or 
database and includes recordable tapes and other 
mass storage devices. 
(3) DEPARTMENT.—The term ‘‘Department’’ 
means the Department of Veterans Affairs. 
(4) 
ENCRYPTION.—The 
term 
‘‘encryption’’ 
means the protection of data in electronic form in 
storage or transit using an encryption technology 
that has been adopted by an established standards 
setting body which renders such data indecipherable 
in the absence of associated cryptographic keys nec-
VerDate Aug 31 2005 
06:22 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5588.IH
H5588
hmoore on PROD1PC68 with HMBILLS
essary to enable decryption of such data, together 
with appropriate management and safeguards of 
such keys to protect the integrity of the encryption. 
(5) NATIONWIDE CONSUMER REPORTING AGEN-
CY.—The term ‘‘nationwide consumer reporting 
agency’’ means a consumer reporting agency de-
scribed in section 603(p) of the Fair Credit Report-
ing Act. 
(6) SECRETARY.—The term ‘‘Secretary’’ means 
the Secretary of Veterans Affairs. 
(7) SENSITIVE PERSONAL INFORMATION.—The 
term ‘‘sensitive personal information’’ means the 
name, address, or telephone number of a veteran or 
other individual, in combination with any of the fol-
lowing: 
(A) Social Security number. 
(B) Any information not available as part 
of the public record regarding the veteran or 
other individual’s military service or health. 
(C) Any financial account or other finan-
cial information relating to the veteran or other 
person. 
VerDate Aug 31 2005 
04:10 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5588.IH
H5588
hmoore on PROD1PC68 with HMBILLS
SEC. 3. PROTECTION OF SENSITIVE PERSONAL INFORMA-
TION OF VETERANS. 
(a) AFFIRMATIVE OBLIGATION.—The Secretary shall 
have an affirmative obligation to protect from any data 
breach the sensitive personal information of veterans and 
any other individuals that the Department (or any third- 
party entity acting on behalf of the Department) pos-
sesses, creates, or maintains as well as any information 
or tools, including passwords or cryptographic keys used 
to protect the integrity of encrypted data, used to access 
sensitive personal information maintained independently 
by others. 
(b) SECURITY POLICIES
AND PROCEDURES.—The 
Secretary shall implement and maintain reasonable poli-
cies and procedures to protect the security and confiden-
tiality of sensitive personal information relating to any vet-
eran or other individual that is maintained, serviced, or 
communicated by or on behalf of the Department against 
any unauthorized access. 
(c) POLICIES AND PROCEDURES REGARDING ACCESS 
AND USE.—The Secretary, by regulation, shall prescribe 
policies and procedures regarding employee and third 
party access to, and use of, sensitive personal information 
as well as the protection of such sensitive personal infor-
mation, which the Department receives, maintains, or 
transmits. Such policies and procedures shall be issued be-
VerDate Aug 31 2005 
04:10 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5588.IH
H5588
hmoore on PROD1PC68 with HMBILLS
fore the end of the 90-day period beginning on the date 
of the enactment of this Act. 
(d) SYSTEM RESTORATION REQUIREMENTS.—If the 
Secretary determines that a data breach has occurred, is 
likely to have occurred, or is unavoidable, the Secretary 
shall take prompt and reasonable measures to— 
(1) repair the breach and restore the security 
and confidentiality of the sensitive personal informa-
tion involved to limit further unauthorized misuse of 
such information; and 
(2) restore the integrity of the data security 
safeguards of the Department and make appropriate 
improvements to the data security, and the access 
and use, policies and procedures issued under sub-
sections (b) and (c). 
(e) THIRD PARTY DUTIES.— 
(1) COORDINATED INVESTIGATION.—Whenever 
any third party handling sensitive personal informa-
tion for or on behalf of the Department determines 
that a data breach has occurred, is likely to have oc-
curred, or is unavoidable, with respect to such infor-
mation, the third party shall— 
(A) promptly notify the Department of 
such determination; 
VerDate Aug 31 2005 
04:10 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5588.IH
H5588
hmoore on PROD1PC68 with HMBILLS
(B) conduct a coordinated investigation 
with the Department to determine the full scope 
of any such data breach; and 
(C) ensure that the appropriate notices are 
provided as required under section 4 of this 
Act. 
(2) CONTRACTUAL
OBLIGATION
REQUIRED.— 
The Secretary shall not provide sensitive personal in-
formation to a third party unless such third party 
agrees to fulfill the obligations imposed by sections 
4, 5, and 6 of this Act. 
(3) LIABILITY FOR COSTS.—Except as other-
wise established by written agreements between the 
Department and any third party, a third party that 
suffers a data breach shall be responsible for all 
costs associated with complying with this Act, as 
well as other costs related to such a breach, includ-
ing any damages relating to such a breach. 
SEC. 4. NOTIFICATION OF DATA BREACH. 
(a) NOTIFICATION.—Upon discovery of a data 
breach, the Secretary shall— 
(1) notify the United States Secret Service, the 
Inspector General for the Department of Veterans 
Affairs, the Committees on Veterans’ Affairs of the 
Senate and the House of Representatives, and the 
VerDate Aug 31 2005 
04:10 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5588.IH
H5588
hmoore on PROD1PC68 with HMBILLS
Federal Trade Commission that a data breach has 
occurred and the extent of such a breach; 
(2) notify each individual whose personal infor-
mation was acquired or accessed by an unauthorized 
person as a result of such a data breach; and 
(3) place a conspicuous notice on the Depart-
ment’s Internet website, which shall include a tele-
phone number that the individual may use, at no 
cost to such individual, to contact the Department to 
inquire about the data breach or the information the 
Department maintained about that individual. 
(b) TIMELINESS
OF NOTIFICATION.—All notifica-
tions required under subsection (a) shall be made as 
promptly as possible and without unreasonable delay fol-
lowing the discovery of a data breach and the implementa-
tion of any measures necessary to determine the scope of 
the breach, prevent any further breach or unauthorized 
disclosures, and reasonably restore the integrity of the 
data system. 
(c) METHOD AND CONTENT OF NOTIFICATION.— 
(1) METHOD OF NOTIFICATION.—The Secretary 
shall provide written notification to individuals 
under subsection (a)(2). 
VerDate Aug 31 2005 
04:10 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5588.IH
H5588
hmoore on PROD1PC68 with HMBILLS
(2) CONTENT OF NOTIFICATION.—Such written 
notification provided to an individual under para-
graph (1) shall include— 
(A) a description of the personal informa-
tion that was acquired by an unauthorized per-
son; 
(B) a telephone number that the individual 
may use, at no cost to such individual, to con-
tact the Ombudsman for Data Security in the 
Department to inquire about the security 
breach or the information about that individual 
that the person acquired or accessed, as well as 
to obtain assistance in addressing identity theft 
issues; 
(C) the toll-free contact telephone numbers 
and addresses for the major credit reporting 
agencies; 
(D) a toll-free telephone number and Inter-
net website address for the Federal Trade Com-
mission whereby the individual may obtain in-
formation regarding identity theft; and 
(E) information regarding the right of an 
individual, at no cost to that individual, to place 
a fraud alert, obtain a security freeze, and re-
ceive credit monitoring where applicable, includ-
VerDate Aug 31 2005 
04:10 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H5588.IH
H5588
hmoore on PROD1PC68 with HMBILLS
ing information clearly describing the advan-
tages and disadvantages of these actions. 
(d) WEBSITE NOTICE OF FEDERAL TRADE COMMIS-
SION.—The Federal Trade Commission shall place, in a 
clear and conspicuous location on its Internet website, a 
notice of any breach of security that is reported to the 
Commission under subsection (a)(1). 
SEC. 5. FRAUD ALERTS. 
(a) INCLUSION IN CONSUMER FILES.—The Secretary 
shall arrange, upon the request of a veteran or other indi-
vidual affected by a data breach and at no cost to the 
veteran or other individual, to include a fraud alert in the 
file of that veteran or other individual with each nation-
wide consumer reporting agencies in the manner provided 
under section 605A(a) for a period of not less than 1 year, 
beginning on the date of such request, unless the veteran 
or other individual requests that such fraud alert be re-
moved before the end of such period, and the agency has 
received appropriate proof of the identity of the requestor 
for such purpose. 
(b) DISTRIBUTION.—Each nationwide consumer re-
porting agency referred to in subsection (a) shall also pro-
vide the alert required under such subsection in the file 
of a veteran or other individual along with any credit score 
generated in using that file, for a period of not less than 
VerDate Aug 31 2005 
04:10 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H5588.IH
H5588
hmoore on PROD1PC68 with HMBILLS
1 year, beginning on the date of such request, unless the 
veteran or other individual requests that such fraud alert 
be removed before the end of such period, and the agency 
has received appropriate proof of the identity of the re-
questor for such purpose. 
SEC. 6. CREDIT SECURITY FREEZE. 
(a) IN GENERAL.—The Secretary shall arrange, upon 
the request of a veteran or other individual affected by 
a data breach and at no cost to the veteran or other indi-
vidual, to apply a security freeze to the file of that veteran 
or other individual with each nationwide consumer report-
ing agency for a period of not less than 1 year, beginning 
on the date of such request, unless the veteran or other 
individual requests that such security freeze be removed 
before the end of such period, and the agency has received 
appropriate proof of the identity of the requestor for such 
purpose. 
(b) CONFIRMATION AND PIN NUMBERS.—The agen-
cy shall send a written confirmation of the security freeze 
to the veteran or other individual within 5 business days 
of placing the freeze. The agency shall refer the informa-
tion regarding the security freeze to other consumer re-
porting agencies. The agency shall provide the veteran or 
other individual with a unique personal identification num-
ber or password to be used by the veteran or other indi-
VerDate Aug 31 2005 
04:10 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H5588.IH
H5588
hmoore on PROD1PC68 with HMBILLS
vidual when providing authorization for the release of his 
or her credit for a specific party or period of time. 
(c) TEMPORARY LIFT OF FREEZE.—The agency that 
receives a request from a veteran or other individual to 
temporarily lift a freeze on a consumer report shall comply 
with the request no later than 3 business days after receiv-
ing the request. Such request shall be specific as to the 
period to which the temporary lift of a freeze shall apply. 
(d) NEGOTIATING AUTHORITY.—The Secretary shall 
have broad authority to negotiate and secure the best pos-
sible price for services provided under this section. All rea-
sonable costs shall be borne by the Secretary. 
SEC. 7. AUTHORITY TO PROVIDE MITIGATION SERVICES TO 
VICTIMS OF DATA SECURITY BREACHES. 
(a) IN GENERAL.—The Secretary shall provide, free 
of charge, to each individual whose personal information 
is (or was before the date of enactment of this Act) com-
promised by a data breach at the Department of Veterans 
Affairs— 
(1) credit monitoring services, during a 1-year 
period beginning on the date of enactment of this 
Act; and 
(2) a copy of the consumer report (as defined 
in section 603 of the Fair Credit Reporting Act) of 
the affected individual once annually during the 2- 
VerDate Aug 31 2005 
04:10 Jun 13, 2006
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H5588.IH
H5588
hmoore on PROD1PC68 with HMBILLS