IB 
Union Calendar No. 269 
109TH CONGRESS 
2D SESSION 
H. R. 3997 
[Report No. 109–454, Parts I and II] 
To amend the Fair Credit Reporting Act to provide for secure financial 
data, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
OCTOBER 6, 2005 
Mr. LATOURETTE (for himself, Ms. HOOLEY, Mr. CASTLE, Ms. PRYCE of 
Ohio, and Mr. MOORE of Kansas) introduced the following bill; which was 
referred to the Committee on Financial Services 
MAY 4, 2006 
Reported with an amendment and referred to the Committee on Energy and 
Commerce for a period ending not later than June 2, 2006, for consider-
ation of such provisions of the bill and amendment as fall within the ju-
risdiction of that committee pursuant to clause 1(f), rule X 
[Strike out all after the enacting clause and insert the part printed in italic] 
JUNE 2, 2006 
Additional sponsors: Mr. KENNEDY of Minnesota, Ms. HARRIS, Mr. JONES of 
North Carolina, Mr. GILLMOR, Mr. TIBERI, Mr. RENZI, Mrs. BIGGERT, 
Mr. PEARCE, Mr. NEY, Mr. SHAYS, Mr. PRICE of Georgia, Mr. SCOTT 
of Georgia, Ms. BEAN, Mr. MCHUGH, Mr. CLEAVER, Mr. WOLF, Mr. 
MCCOTTER, Mr. FOLEY, Mr. HINOJOSA, and Mr. HOLDEN 
JUNE 2, 2006 
Reported from the Committee on Energy and Commerce with amendments; 
committed to the Committee of the Whole House on the State of the 
Union and ordered to be printed 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
[Strike out all after the enacting clause and insert the part printed in boldface roman] 
[For text of introduced bill, see copy of bill as introduced on October 6, 2005] 
A BILL 
To amend the Fair Credit Reporting Act to provide for 
secure financial data, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; FINDINGS. 
(a) SHORT TITLE.—This Act may be cited as the ‘‘Fi-
nancial Data Protection Act of 2006’’. 
(b) FINDINGS.—The Congress finds as follows: 
(1) Protecting the security of sensitive informa-
tion relating to consumers is important to limiting 
account fraud and identity theft. 
(2) While the Gramm-Leach-Bliley Act requires 
financial institutions to protect the security and con-
fidentiality of the nonpublic personal information of 
the customers of financial institutions, the scope of 
covered entities and type of information needs to be 
broadened to fully protect consumers. 
(3) Some Federal agencies have issued model 
guidance under the Gramm-Leach-Bliley Act requir-
ing banks to investigate and provide notice to cus-
tomers of breaches of data security involving customer 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
information that could lead to account fraud or iden-
tity theft, but these standards need to broadened to 
apply to other entities acting as consumer reporters, 
in order to create a single, uniform data security 
standard that applies to all parties to transactions 
involving such financial information. 
(4) Requiring all consumer reporters handling 
sensitive financial personal information to provide 
notice to consumers of data security breaches that are 
likely to result in harm or inconvenience will help 
consumers protect themselves and mitigate against the 
risk of identity theft or account fraud. 
(5) Therefore, all consumer reporters should— 
(A) protect sensitive financial personal in-
formation; 
(B) investigate potential data security 
breaches; 
(C) provide breach notices as appropriate to 
the United States Secret Service, functional reg-
ulators, involved third parties, and consumers; 
(D) restore the security of the information 
and improve safeguards after a breach; and 
(E) provide consumers free file monitoring 
where appropriate to reduce the risk of identity 
theft. 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
SEC. 2. DATA SECURITY SAFEGUARDS. 
(a) IN GENERAL.—As set forth in section 630 of the 
Fair Credit Reporting Act, as amended by the Act, in the 
event a consumer reporter becomes aware of information 
suggesting a breach of data security, such consumer reporter 
shall immediately conduct an investigation, and notify au-
thorities and consumers as appropriate. 
(b) FCRA DATA SECURITY AMENDMENT.—The Fair 
Credit Reporting Act (15 U.S.C. 1681) is amended by add-
ing at the end the following new section: 
‘‘SEC. 630. DATA SECURITY SAFEGUARDS. 
‘‘(a) PROTECTION
OF SENSITIVE FINANCIAL PER-
SONAL INFORMATION.— 
‘‘(1) DATA SECURITY OBLIGATION POLICY.—It is 
the policy of the Congress that each consumer reporter 
has an affirmative and continuing obligation to pro-
tect the security and confidentiality of sensitive fi-
nancial personal information. 
‘‘(2) SECURITY POLICIES AND PROCEDURES.— 
Each consumer reporter shall have an affirmative ob-
ligation to implement, and a continuing obligation to 
maintain, reasonable policies and procedures to pro-
tect the security and confidentiality of sensitive fi-
nancial personal information relating to any con-
sumer that is handled by such consumer reporter 
against any loss, unauthorized access, or misuse that 
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS
is reasonably likely to result in harm or inconven-
ience to such consumer. 
‘‘(3) DATA DESTRUCTION AND DATA DISPOSAL 
POLICIES AND PROCEDURES.—The policies and proce-
dures described in paragraph (2) shall include pro-
viding for the proper disposal of sensitive financial 
personal information in accordance with the stand-
ards, guidelines, or regulations issued pursuant to 
this title. 
‘‘(b) INVESTIGATION REQUIREMENTS.— 
‘‘(1) INVESTIGATION TRIGGER.—A consumer re-
porter shall immediately conduct a data security 
breach investigation if it— 
‘‘(A) becomes aware of any information in-
dicating a reasonable likelihood that a data secu-
rity breach has occurred or is unavoidable; 
‘‘(B) becomes aware of information indi-
cating an unusual pattern of misuse of sensitive 
financial personal information handled by a 
consumer reporter indicative of financial fraud; 
or 
‘‘(C) receives a notice under subsection (e). 
‘‘(2) SCOPE OF INVESTIGATION.—Such investiga-
tion shall be conducted in a manner commensurate 
with the nature and the amount of the sensitive fi-
VerDate Aug 31 2005 
00:24 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H3997.RH
H3997
ycherry on PROD1PC64 with BILLS