‘‘(B) the appropriate functional regulatory 
agency for the consumer reporter; 
‘‘(C) if the information relates to a finan-
cial account provided to, maintained for, or 
serviced for any consumer by a person other 
than the consumer reporter, the person that 
provides, maintains, or services the financial ac-
count for the consumer; 
‘‘(D) if the consumer reporter determines 
that it is likely to be providing notice under this 
paragraph to 1,000 or more consumers for any 
breach of data security— 
‘‘(i) each nationwide consumer report-
ing agency; and 
‘‘(ii) any other consumer reporting 
agency that the consumer reporter identi-
fies, or expects to identify, in the notice 
provided to the consumer under subpara-
graph (E); 
‘‘(E) any consumer to whom the sensitive 
financial identity information relates; and 
‘‘(F) if the sensitive financial identity in-
formation concerning any consumer is provided 
to, maintained by, or serviced by a person other 
than the consumer reporter, that person.
‘‘(2) NOTICE
OF
POTENTIAL
FRAUDULENT 
TRANSACTION RISK.—In the case of any actual or 
reasonably likely breach of data security with respect 
to sensitive financial account information for which 
an investigation is required under subsection 
(b)(2)(A), unless the consumer reporter determines 
(after conducting a reasonable investigation that 
meets the requirements of such subparagraph) that 
it is not reasonably likely that such information will 
be misused against the consumers to whom such 
sensitive financial account information relates to 
make 1 or more fraudulent transactions on a finan-
cial account to which such information relates in a 
manner that would cause substantial inconvenience 
or substantial harm to any such consumer, the con-
sumer reporter shall provide notice, in the manner 
provided in subsection (e), to— 
‘‘(A) an appropriate law enforcement agen-
cy; 
‘‘(B) the appropriate functional regulatory 
agency for the consumer reporter; 
‘‘(C) if the information relates to a finan-
cial account provided to, maintained for, or 
serviced for any consumer by a person other 
than the consumer reporter, the person that
provides, maintains, or services the financial ac-
count for the consumer; and 
‘‘(D) subject to subsections (d)(2) and (e), 
any consumer to whom the sensitive financial 
account information relates. 
‘‘(d) INVESTIGATION AND NOTICE REQUIREMENTS 
FOR THIRD PARTY AGREEMENTS.— 
‘‘(1) CONTRACTUAL OBLIGATION REQUIRED.— 
No consumer reporter may provide sensitive finan-
cial identity information or sensitive financial ac-
count information to a third party to receive, main-
tain, or service on behalf of the consumer reporter, 
unless such third party agrees that whenever the 
third party becomes aware that a breach of data se-
curity has occurred or is reasonably likely to have 
occurred with respect to such information received, 
maintained, or serviced by such third party, the 
third party shall be obligated— 
‘‘(A) to provide notice of the breach to the 
consumer reporter; 
‘‘(B) to conduct a joint investigation with 
the consumer reporter to determine the likeli-
hood that such information will be misused 
against the consumers to whom the information 
relates in a manner that would cause substan-
tial inconvenience or substantial harm to any 
such consumers; and 
‘‘(C) unless the consumer reporter and 
third party determine, after conducting a rea-
sonable investigation, that it is not reasonably 
likely that such information will be misused to 
commit financial fraud against any consumer to 
whom any of such sensitive personal informa-
tion relates in a manner that would cause sub-
stantial inconvenience or substantial harm to 
such consumer, to provide joint notice with the 
consumer reporter under paragraph (2). 
‘‘(2) JOINT NOTICE REQUIREMENT UNDER CER-
TAIN CIRCUMSTANCES.—In the case of any breach of 
data security involving a third party referred to in 
paragraph (1) for which a notice is required to be 
provided by a consumer reporter to a consumer 
under subsection (c)— 
‘‘(A) both the consumer reporter and any 
person that provides or maintains the financial 
account for the consumer shall be responsible 
for providing the notice under such subsection 
to the consumer jointly; 
‘‘(B) the notice shall—
‘‘(i) clearly indicate on its face (such 
as the envelope for mailed notices) the 
identity of a person or consumer reporter 
that has the direct relationship with the 
consumer; and 
‘‘(ii) clearly identify the consumer re-
porter that directly suffered the breach of 
data security and indicate the notice is 
being provided to the consumer on account 
of such breach; and 
‘‘(C) the consumer reporter shall be re-
sponsible for the reasonable actual costs of such 
notice, except as otherwise established by agree-
ment. 
‘‘(e) TIME AND MANNER OF NOTICES.— 
‘‘(1) PROMPT
NOTICE
REQUIRED.—Except as 
provided in paragraph (2), any notice required under 
subsection (c), including any joint notice in accord-
ance with subsection (d)(2)(A), shall be made 
promptly following completion of reasonable meas-
ures undertaken to determine the scope of the 
breach of data security. 
‘‘(2) DELAY OF NOTICE FOR LAW ENFORCE-
MENT PURPOSES.—If a consumer reporter receives a 
written request from an appropriate law enforcement
agency that is approved by a court of competent ju-
risdiction indicating that providing a particular no-
tice to any consumer under this section would im-
pede a criminal or civil investigation by that law en-
forcement agency, or an oral request from an appro-
priate law enforcement agency indicating that such 
a written request will be provided, the consumer re-
porter shall delay, or in the case of a foreign law en-
forcement agency may delay, providing such notice 
until— 
‘‘(A) the law enforcement agency informs 
the consumer reporter that such notice will no 
longer impede the investigation; or 
‘‘(B) the law enforcement agency fails to— 
‘‘(i) confirm that a continued delay is 
necessary to avoid impeding such investiga-
tion; or 
‘‘(ii) provide a written request within 
a reasonable time following an oral request 
for such delay. 
‘‘(3) ORDER OF NOTICE.—The notices required 
under subsection (c), including any joint notice in 
accordance with subsection (d)(2)(A), shall be made 
in the order of the subparagraphs in paragraph (1) 
or (2) of subsection (c), as the case may be.
‘‘(4) CONTENT
OF
CONSUMER
NOTICE.—Any 
notice required to be provided to a consumer under 
paragraph (1) or (2) of subsection (c), including any 
joint notice in accordance with subsection (d)(2)(A), 
shall include— 
‘‘(A) a clear and conspicuous heading or 
notice title on the envelope or transmission title 
indicating the nature of the notice, such as 
‘LEGAL NOTICE OF DATA SECURITY 
BREACH’; 
‘‘(B) a brief description of the breach of 
data security, including a statement of the 
types of sensitive financial account and sensitive 
financial identity information involved in such 
breach; 
‘‘(C) appropriate instructions to the con-
sumer to mitigate against financial fraud; and 
‘‘(D) appropriate contact information that 
the consumer may use to obtain additional in-
formation. 
‘‘(5) NO DUPLICATIVE NOTICES REQUIRED.—A 
consumer reporter, whether acting directly or jointly 
with a third party under subsection (d), shall not be 
required to provide more than 1 notice with respect 
to any breach of data security to any affected con-
sumer, so long as such notice meets all the applica-
ble requirements of this section. 
‘‘(f) FINANCIAL FRAUD MITIGATION.— 
‘‘(1) FREE FILE MONITORING.—Any consumer 
reporter that is required to provide notice to a con-
sumer under subsection (c)(1), or that is deemed to 
be in compliance with such requirement by operation 
of subsection (g), shall offer and make available to 
the consumer, free of charge, a service that monitors 
nationwide credit activity regarding a consumer from 
a consumer reporting agency described in section 
603(p). 
‘‘(2) JOINT RULEMAKING FOR SAFE HARBOR.— 
The Secretary of the Treasury, the Board of Gov-
ernors of the Federal Reserve System, and the Com-
mission shall jointly develop regulations, which shall 
be prescribed by all functional regulatory agencies, 
that, in any case in which— 
‘‘(A) free file monitoring is offered under 
paragraph (1) to a consumer; 
‘‘(B) subsequent to the offer, another 
party misuses sensitive financial identity infor-
mation on the consumer obtained through the 
breach of data security (that gave rise to such
offer) to commit identity theft against the con-
sumer; and 
‘‘(C) at the time of such breach the con-
sumer reporter maintained reasonable policies 
and procedures to comply with subsection (a), 
exempts the consumer reporter from any liability 
under State common law for any loss or harm to the 
consumer occurring after the date of such offer, 
other than any direct pecuniary loss provided under 
such law, resulting from such misuse. 
‘‘(g) COMPLIANCE WITH GLBA.— 
‘‘(1) IN GENERAL.—For the purposes of this 
section, any person subject to section 501(b) of title 
V of the Gramm-Leach-Bliley Act shall be deemed to 
be in compliance with— 
‘‘(A) subsection (a) of this section, if the 
person is required to implement appropriate 
safeguards pursuant to regulations, guidelines, 
or guidance prescribed by or issued by an agen-
cy or authority in accordance with such sub-
section of the Gramm-Leach-Bliley Act; 
‘‘(B) subsection (b) of this section, if the 
person is required to conduct investigations of 
breaches of information security pursuant to 
regulations, guidelines, or guidance prescribed
by or issued by an agency or authority in ac-
cordance with such subsection of the Gramm- 
Leach-Bliley Act; and 
‘‘(C) subsection (c) of this section, if the 
person is required to implement a consumer no-
tification program after breaches of such data 
safeguards pursuant to regulations, guidelines, 
or guidance prescribed by or issued by an agen-
cy or authority in accordance with section 501 
of the Gramm-Leach-Bliley Act. 
‘‘(2) 
RECIPROCAL
COMPLIANCE
ARRANGE-
MENTS.—If, with respect to any person, or any 
agent of a person, who is subject to section 501(b) 
of the Gramm-Leach-Bliley Act, the regulations, 
guidelines, or guidance prescribed or issued pursu-
ant to such section by the agencies or authorities de-
scribed in section 509 of the Gramm-Leach-Bliley 
Act, allow— 
‘‘(A) any requirement that such person 
comply with such section to be satisfied by the 
person’s agent; or 
‘‘(B) any requirement that a person’s 
agent comply with such section to be satisfied 
by the person,
such reciprocal compliance treatment for such per-
son and agent shall also apply under subsections (a), 
(b), and (c) of this section in the same manner and 
to the same extent such treatment applies for pur-
poses of such section 501(b), except as otherwise 
provided by any such agency or authority. 
‘‘(h) UNIFORM SECURITY REGULATIONS.— 
‘‘(1) UNIFORM STANDARDS.—The Secretary of 
the Treasury, the Board of Governors of the Federal 
Reserve System, and the Commission shall jointly— 
‘‘(A) develop appropriate standards and 
guidelines in furtherance of the policy of this 
section; and 
‘‘(B) prescribe regulations requiring each 
consumer reporter to establish reasonable poli-
cies and procedures implementing such stand-
ards and guidelines, consistent, as appropriate, 
with section 501(b) of title V of the Gramm- 
Leach-Bliley Act. 
‘‘(2) ENFORCEMENT
REGULATIONS.—Each of 
the functional regulatory agencies shall prescribe 
such regulations as may be necessary, consistent 
with the standards in paragraph (1), to carry out 
the purposes of this section with respect to the per-