sons subject to the jurisdiction of such agency under 
subsection (i). 
‘‘(3) PROCEDURES AND DEADLINE.— 
‘‘(A) 
PROCEDURES.—Regulations 
pre-
scribed under this subsection shall be prescribed 
in accordance with applicable requirements of 
title 5, United States Code. 
‘‘(B) DEADLINE
FOR
INITIAL
REGULA-
TIONS.—The regulations required to be pre-
scribed under paragraph (1) shall be published 
in final form before the end of the 12-month 
period beginning on the date of the enactment 
of the Financial Data Security Act of 2005. 
‘‘(C) DEADLINE FOR ENFORCEMENT REG-
ULATIONS.—The regulations required to be pre-
scribed under paragraph (2) shall be published 
in final form before the end of the 6-month pe-
riod beginning on the date regulations described 
in subparagraph (B) are published in final 
form. 
‘‘(D) 
AUTHORITY
TO
GRANT
EXCEP-
TIONS.—The regulations prescribed under para-
graph (2) may include such additional excep-
tions to this section as are deemed by the func-
tional regulatory agencies to be consistent with 
the purposes of this section. 
‘‘(E) 
CONSULTATION
AND
COORDINA-
TION.—The Secretary of the Treasury, the 
Board of Governors of the Federal Reserve Sys-
tem, and the Commission shall consult and co-
ordinate with the other functional regulatory 
agencies to the extent appropriate in pre-
scribing regulations under this subsection. 
‘‘(4) APPROPRIATE
EXEMPTIONS.—The Sec-
retary of the Treasury, the Board, and the Commis-
sion, in consultation with the Administrator of the 
Small Business Administration, shall provide appro-
priate exemptions from requirements of this section 
relating to sensitive financial identity information 
for consumer reporter collectors that are small busi-
nesses. 
‘‘(i) 
ADMINISTRATIVE
ENFORCEMENT.—Notwith-
standing section 616, 617, or 621, this section and the 
regulations prescribed under this section shall be enforced 
exclusively by the functional regulatory agencies with re-
spect to financial institutions and other persons subject 
to jurisdiction of each such agency under applicable law, 
as follows:
‘‘(1) Under section 8 of the Federal Deposit In-
surance Act, in the case of— 
‘‘(A) national banks, Federal branches and 
Federal agencies of foreign banks, and any sub-
sidiaries of such entities (except brokers, deal-
ers, persons providing insurance, investment 
companies, and investment advisers), by the 
Comptroller of the Currency; 
‘‘(B) member banks of the Federal Reserve 
System (other than national banks), branches 
and agencies of foreign banks (other than Fed-
eral branches, Federal agencies, and insured 
State branches of foreign banks), commercial 
lending companies owned or controlled by for-
eign banks, organizations operating under sec-
tion 25 or 25A of the Federal Reserve Act, and 
bank holding companies and their nonbank sub-
sidiaries or affiliates (except brokers, dealers, 
persons providing insurance, investment compa-
nies, and investment advisers), by the Board of 
Governors of the Federal Reserve System; 
‘‘(C) banks insured by the Federal Deposit 
Insurance Corporation (other than members of 
the Federal Reserve System), insured State 
branches of foreign banks, and any subsidiaries
of such entities (except brokers, dealers, per-
sons providing insurance, investment compa-
nies, and investment advisers), by the Board of 
Directors of the Federal Deposit Insurance Cor-
poration; and 
‘‘(D) savings associations the deposits of 
which are insured by the Federal Deposit In-
surance Corporation, and any subsidiaries of 
such savings associations (except brokers, deal-
ers, persons providing insurance, investment 
companies, and investment advisers), by the Di-
rector of the Office of Thrift Supervision. 
‘‘(2) Under the Federal Credit Union Act, by 
the Board of the National Credit Union Administra-
tion with respect to any federally insured credit 
union, and any subsidiaries of such an entity. 
‘‘(3) Under the Securities Exchange Act of 
1934, by the Securities and Exchange Commission 
with respect to any broker or dealer. 
‘‘(4) Under the Investment Company Act of 
1940, by the Securities and Exchange Commission 
with respect to investment companies. 
‘‘(5) Under the Investment Advisers Act of 
1940, by the Securities and Exchange Commission
with respect to investment advisers registered with 
the Commission under such Act. 
‘‘(6) Under State insurance law, in the case of 
any person engaged in the business of insurance, by 
the applicable State insurance authority of the State 
in which the person is domiciled. 
‘‘(7) Under the Federal Trade Commission Act, 
by the Federal Trade Commission for any other per-
son that is not subject to the jurisdiction of any 
agency or authority under paragraphs (1) through 
(6) of this subsection. 
‘‘(j) DEFINITIONS.—For purposes of this section, the 
following definitions shall apply: 
‘‘(1) BREACH OF DATA SECURITY.—The term 
‘breach of data security’ means, with respect to sen-
sitive financial account information or sensitive fi-
nancial identity information that is maintained, re-
ceived, serviced, or communicated by or on behalf of 
any financial institution— 
‘‘(A) an unauthorized acquisition of such 
information that could be used to commit finan-
cial fraud (such as identity theft or fraudulent 
transactions made on financial accounts); or 
‘‘(B) an unusual pattern of misuse of such 
information to commit financial fraud.
‘‘(2) CONSUMER
REPORTER
AND
RELATED 
TERMS.— 
‘‘(A) CONSUMER REPORT.—The term ‘con-
sumer report’ includes any written, oral, or 
other communication of any information by a 
consumer reporter bearing on a consumer’s 
credit worthiness, credit standing, credit capac-
ity, character, general reputation, personal 
characteristics, personal identifiers, financial 
account information, or mode of living. 
‘‘(B) CONSUMER
REPORTING
BROKER.— 
The term ‘consumer reporting broker’ means 
any person which, for monetary fees, dues, or 
on a cooperative nonprofit basis, regularly en-
gages in whole or in part in the practice of as-
sembling or evaluating consumer credit infor-
mation or other information on consumers for 
the purpose of furnishing consumer reports to 
third parties, and which uses any means or fa-
cility of interstate commerce for the purpose of 
preparing or furnishing consumer reports. 
‘‘(C) 
CONSUMER
REPORTING
COL-
LECTOR.—The term ‘consumer reporting col-
lector’ means any person (other than a con-
sumer reporting agency or a consumer report-
ing broker) which, for monetary fees, dues, or 
on a cooperative nonprofit basis, or otherwise, 
regularly engages in whole or in part in the 
practice of assembling or evaluating consumer 
reports or other information on consumers to 
provide or market or collect payment for prod-
ucts or services, and which uses any means or 
facility of interstate commerce for the purpose 
of preparing or using consumer reports. 
‘‘(D) CONSUMER
REPORTER.—The term 
‘consumer reporter’ means any consumer re-
porting agency, consumer reporting broker, or 
consumer reporting collector. 
‘‘(3) FINANCIAL INSTITUTION.—The term ‘fi-
nancial institution’ means any consumer reporter 
who maintains, receives, services, or communicates 
sensitive financial account information or sensitive 
financial identity information on an ongoing basis 
for the purposes of engaging in interstate commerce. 
‘‘(4) FUNCTIONAL REGULATORY AGENCY.—The 
term ‘functional regulatory agency’ means any agen-
cy described in subsection (i) with respect to the fi-
nancial institutions and other persons subject to the 
jurisdiction of such agency.
‘‘(5) 
NATIONWIDE
CONSUMER
REPORTING 
AGENCY.—The term ‘nationwide consumer reporting 
agency’ means— 
‘‘(A) a consumer reporting agency de-
scribed in section 603(p); 
‘‘(B) any person who notifies the Commis-
sion that the person reasonably expects to be-
come a consumer reporting agency described in 
subsection (p) of section 603 within a reason-
able time; and 
‘‘(C) a consumer reporting agency de-
scribed in section 603(w) that notifies the Com-
mission that the person wishes to receive breach 
of data security notices under this section that 
involve information of the type maintained by 
such agency. 
‘‘(6) SENSITIVE FINANCIAL ACCOUNT INFORMA-
TION.—The term ‘sensitive financial account infor-
mation’ means a financial account number of a con-
sumer, such as credit card number or debit card 
number, in combination with any security code, ac-
cess code, password, or other personal identification 
information that would allow access to the con-
sumer’s financial account.
‘‘(7) SENSITIVE FINANCIAL IDENTITY INFORMA-
TION.—The term ‘sensitive financial identity infor-
mation’ means the first and last name, the address, 
or the telephone number of a consumer, in combina-
tion with any of the following of the consumer: 
‘‘(A) Social Security number. 
‘‘(B) Driver’s license number or equivalent 
State identification number. 
‘‘(C) Taxpayer identification number.’’. 
(b) CLERICAL AMENDMENT.—The table of sections 
for the Fair Credit Reporting Act is amended by inserting 
after the item relating to section 629 the following new 
item: 
‘‘630. Data security safeguards.’’. 
(c) EFFECTIVE DATE.—The provisions of section 630 
of the Fair Credit Reporting Act (as added by this sec-
tion), other than subsection (h) of such section, shall take 
effect on the earlier of— 
(1) the date of publication of the regulations re-
quired under paragraph (3) of such subsection, with 
respect to any person under the jurisdiction of each 
regulatory agency publishing such regulations; or 
(2) the end of the 24-month period beginning 
on the date of the enactment of this Act.
SEC. 3. RELATION TO STATE LAWS. 
Subsection (b) of section 625 of the Fair Credit Re-
porting Act (15 U.S.C. 1681t) is amended— 
(1) by redesignating paragraphs (3), (4), and 
(5) as paragraphs (4), (5), and (6), respectively; and 
(2) by inserting after paragraph (2) the fol-
lowing new paragraph: 
‘‘(3) with respect to the responsibilities of any 
person— 
‘‘(A) to protect the security or confiden-
tiality of information on consumers maintained 
by or on behalf of the person; 
‘‘(B) to safeguard such information from 
potential misuse; 
‘‘(C) to investigate and provide notices to 
consumers of any unauthorized access to infor-
mation concerning the consumer, or the poten-
tial misuse of such information, for fraudulent 
purposes; and 
‘‘(D) to mitigate any loss or harm result-
ing from such unauthorized access or misuse.’’. 
Æ