I
107TH CONGRESS
2D SESSION
H. R. 5474
To amend the Gramm-Leach-Bliley Act to further protect customers of finan-
cial institutions whose identities are stolen from the financial institution,
and for other purposes.
IN THE HOUSE OF REPRESENTATIVES
SEPTEMBER 26, 2002
Mr. KLECZKA (for himself and Mr. RYAN of Wisconsin) introduced the
following bill; which was referred to the Committee on Financial Services
A BILL
To amend the Gramm-Leach-Bliley Act to further protect
customers of financial institutions whose identities are
stolen from the financial institution, and for other pur-
poses.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ‘‘Identity Theft Con-
sumer Notification Act’’.
SEC. 
2. 
FINANCIAL 
INSTITUTION’S 
OBLIGATION 
TO
PROMPTLY NOTIFY AND ASSIST CUSTOMERS
WHOSE PERSONAL INFORMATION IS COM-
PROMISED.
(a) PROMPT NOTICE
AND ASSISTANCE.—Section
503(b) of the Gramm-Leach-Bliley Act (15 U.S.C.
6803(b)) is amended—
(1) by striking ‘‘and’’ at the end of paragraph
(3);
(2) by striking the period at the end of para-
graph (4) and inserting ‘‘; and’’; and
(3) by inserting after paragraph (4) the fol-
lowing new paragraph:
‘‘(5) a statement that, upon discovering that
the confidentiality or security of any nonpublic per-
sonal information maintained by the financial insti-
tution with respect to consumer has been com-
promised in any way by an employee of the financial
institution, or through any unauthorized entry into
the records of the financial institution, the financial
institution is obligated—
‘‘(A) to promptly notify the consumer of
the compromise of the security or confiden-
tiality of such information, and any misuse of
such information, that the financial institution
discovers or reasonably should discover has oc-
curred;
‘‘(B) to provide assistance to the consumer
to remedy any such compromise, including the
duty of the financial institution under the Fair
Credit Reporting Act to correct and update in-
formation contained in a consumer report relat-
ing to such consumer;
‘‘(C) to reimburse the consumer for any
losses the consumer incurred as a result of the
compromise of the security or confidentiality of
such information, and any misuse of such infor-
mation, including any fees for obtaining, inves-
tigating, and correcting a consumer report of
such consumer at any consumer reporting agen-
cy; and
‘‘(D) to provide information concerning the
manner in which the consumer can obtain such
assistance.’’.
(b) WAIVER OF DISCLOSURE AT REQUEST OF LAW
ENFORCEMENT AGENCY FOR LIMITED TIME.—Section
503 of the Gramm-Leach-Bliley Act (15 U.S.C. 6803) is
amended by adding at the end the following new sub-
section:
‘‘(c) WAIVER OF DISCLOSURE AT REQUEST OF LAW
ENFORCEMENT AGENCY FOR LIMITED TIME.—A finan-
cial institution may delay notifying a consumer that the
confidentiality or security of any nonpublic personal infor-
mation of the consumer maintained by the financial insti-
tution has been compromised at the request of a law en-
forcement agency investigating such violation for such lim-
ited period of time as the law enforcement agency deter-
mines is essential for carrying out the investigation.’’.
(c) PENALTIES FOR FAILURE
TO NOTIFY CUS-
TOMERS
OF IDENTITY THEFT.—Section 503 of the
Gramm-Leach-Bliley Act (15 U.S.C. 6803) is amended by
inserting after subsection (c) (as added by subsection (b)
of this section) the following new subsection:
‘‘(d) PENALTIES FOR FAILURE TO NOTIFY AND AS-
SIST CUSTOMERS AFTER IDENTITY THEFT.—The failure
of any financial institution to promptly notify any con-
sumer that the confidentiality or security of any nonpublic
personal information of the consumer maintained by the
financial institution has been compromised in any way by
an employee of the financial institution or through any
unauthorized entry into the records of the financial insti-
tution, to provide assistance to such consumer, or to reim-
burse the consumer for any loss or fee described sub-
section (b)(5)(C) shall be treated as a violation of—