101 
tained in the data in electronic form that was 
acquired as a result of a breach of security of 
the defendant is public record information 
that is lawfully made available to the general 
public from Federal, State, or local govern-
ment records and was acquired by the defend-
ant from such records. 
SEC. 5. DEFINITIONS. 
In this Act the following definitions apply: 
(1) BREACH
OF
SECURITY.—The term 
‘‘breach of security’’ means the unauthor-
ized acquisition of data in electronic 
form containing personal information. 
(2) COMMISSION.—The term ‘‘Commis-
sion’’ means the Federal Trade Commis-
sion. 
(3) DATA
IN
ELECTRONIC
FORM.—The 
term ‘‘data in electronic form’’ means any 
data stored electronically or digitally on 
any computer system or other database 
and includes recordable tapes and other 
mass storage devices. 
(4) 
ENCRYPTION.—The 
term 
‘‘encryption’’ means the protection of 
data in electronic form in storage or in 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00101
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
102 
transit using an encryption technology 
that has been adopted by an established 
standards setting body which renders 
such data indecipherable in the absence 
of associated cryptographic keys nec-
essary to enable decryption of such data. 
Such encryption must include appro-
priate management and safeguards of 
such keys to protect the integrity of the 
encryption. 
(5) IDENTITY THEFT.—The term ‘‘iden-
tity theft’’ means the unauthorized use of 
another person’s personal information 
for the purpose of engaging in commer-
cial transactions under the name of such 
other person. 
(6) INFORMATION
BROKER.—The term 
‘‘information broker’’ means a commer-
cial entity whose business is to collect, 
assemble, or maintain personal informa-
tion concerning individuals who are not 
current or former customers of such enti-
ty in order to sell such information or 
provide access to such information to any 
nonaffiliated third party in exchange for 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00102
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
103 
consideration, whether such collection, 
assembly, or maintenance of personal in-
formation is performed by the informa-
tion broker directly, or by contract or 
subcontract with any other entity. 
(7) PERSONAL INFORMATION.— 
(A) DEFINITION.—The term ‘‘per-
sonal information’’ means an individ-
ual’s first name or initial and last 
name, or address, or phone number, 
in combination with any 1 or more of 
the following data elements for that 
individual: 
(i) Social Security number. 
(ii) Driver’s license number or 
other State identification number. 
(iii) Financial account num-
ber, or credit or debit card num-
ber, and any required security 
code, access code, or password 
that is necessary to permit access 
to an individual’s financial ac-
count. 
(B) MODIFIED DEFINITION BY RULE-
MAKING.—The Commission may, by 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00103
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
104 
rule, modify the definition of ‘‘per-
sonal information’’ under subpara-
graph (A) to the extent that such 
modification is necessary to accom-
modate changes in technology or 
practices, will not unreasonably im-
pede interstate commerce, and will 
accomplish the purposes of this Act. 
(8) PUBLIC RECORD INFORMATION.—The 
term ‘‘public record information’’ means 
information about an individual which 
has 
been 
obtained 
originally 
from 
records of a Federal, State, or local gov-
ernment entity that are available for pub-
lic inspection. 
(9) 
NON-PUBLIC
INFORMATION.—The 
term ‘‘non-public information’’ means in-
formation about an individual that is of a 
private nature and neither available to 
the general public nor obtained from a 
public record. 
SEC. 6. EFFECT ON OTHER LAWS. 
(a) PREEMPTION OF STATE INFORMATION SE-
CURITY LAWS.—This Act supersedes any provi-
sion of a statute, regulation, or rule of a State 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00104
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
105 
or political subdivision of a State, with re-
spect to those entities covered by the regula-
tions issued pursuant to this Act, that ex-
pressly— 
(1) 
requires 
information 
security 
practices and treatment of data in elec-
tronic form containing personal informa-
tion similar to any of those required 
under section 2; and 
(2) requires notification to individ-
uals of a breach of security resulting in 
unauthorized acquisition of data in elec-
tronic form containing personal informa-
tion. 
(b) ADDITIONAL PREEMPTION.— 
(1) IN GENERAL.—No person other than 
the Attorney General of a State may 
bring a civil action under the laws of any 
State if such action is premised in whole 
or in part upon the defendant violating 
any provision of this Act. 
(2) PROTECTION OF CONSUMER PROTEC-
TION LAWS.—This subsection shall not be 
construed to limit the enforcement of any 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00105
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
106 
State consumer protection law by an At-
torney General of a State. 
(c) PROTECTION OF CERTAIN STATE LAWS.— 
This Act shall not be construed to preempt the 
applicability of— 
(1) State trespass, contract, or tort 
law; or 
(2) other State laws to the extent that 
those laws relate to acts of fraud. 
(d) PRESERVATION
OF FTC AUTHORITY.— 
Nothing in this Act may be construed in any 
way to limit or affect the Commission’s au-
thority under any other provision of law, in-
cluding the authority to issue advisory opin-
ions (under part 1 of volume 16 of the Code 
of Federal Regulations), policy statements, or 
guidance regarding this Act. 
SEC. 7. EFFECTIVE DATE AND SUNSET. 
(a) EFFECTIVE DATE.—This Act shall take 
effect 1 year after the date of enactment of 
this Act. 
(b) SUNSET.—This Act shall cease to be in 
effect on the date that is 10 years from the 
date of enactment of this Act. 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00106
Fmt 6652
Sfmt 6202
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
107 
SEC. 8. AUTHORIZATION OF APPROPRIATIONS. 
There is authorized to be appropriated to 
the Commission $1,000,000 for each of fiscal 
years 2006 through 2010 to carry out this Act. 
Amend the title so as to read: ‘‘A bill to protect con-
sumers by requiring reasonable security policies and pro-
cedures to protect computerized data containing personal 
information, and to provide for nationwide notice in the 
event of a security breach.’’. 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00107
Fmt 6652
Sfmt 6201
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
Union Calendar No. 269 
109TH CONGRESS 
2D SESSION 
H. R. 3997 
[Report No. 109–454, Parts I and II] 
A BILL 
To amend the Fair Credit Reporting Act to provide 
for secure financial data, and for other purposes. 
JUNE 2, 2006 
Reported from the Committee on Energy and Commerce 
with amendments; committed to the Committee of the 
Whole House on the State of the Union and ordered 
to be printed 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00108
Fmt 6651
Sfmt 6651
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS