I 
109TH CONGRESS 
1ST SESSION H. R. 3997 
To amend the Fair Credit Reporting Act to provide for secure financial 
data, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
OCTOBER 6, 2005 
Mr. LATOURETTE (for himself, Ms. HOOLEY, Mr. CASTLE, Ms. PRYCE of 
Ohio, and Mr. MOORE of Kansas) introduced the following bill; which was 
referred to the Committee on Financial Services 
A BILL 
To amend the Fair Credit Reporting Act to provide for 
secure financial data, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Financial Data Protec-
tion Act of 2005’’. 
SEC. 2. DATA SECURITY SAFEGUARDS. 
(a) IN GENERAL.—The Fair Credit Reporting Act 
(15 U.S.C. 1681) is amended by adding at the end the 
following new section:
‘‘§ 630. Data security safeguards 
‘‘(a) SECURITY POLICIES AND PROCEDURES.—Each 
consumer reporter shall have an affirmative obligation to 
implement, and a continuing obligation to maintain, rea-
sonable policies and procedures to protect the security and 
confidentiality of sensitive financial personal information 
relating to any consumer that is maintained, serviced, or 
communicated by or on behalf of such consumer reporter 
against any unauthorized use that is reasonably likely to 
result in substantial harm or inconvenience to such con-
sumer. 
‘‘(b) INVESTIGATION REQUIREMENTS.— 
‘‘(1) 
INVESTIGATION
REQUIRED.—Whenever 
any consumer reporter determines or becomes aware 
of information that would reasonably indicate that a 
breach of data security has or may have occurred or 
is reasonably likely to be about to occur, or receives 
notice under subsection (d), the consumer reporter 
shall immediately conduct a reasonable investigation 
to— 
‘‘(A) assess the nature and scope of the 
potential breach; 
‘‘(B) identify the sensitive financial per-
sonal information involved; and 
‘‘(C) determine if the potential breach is 
reasonably likely to result in substantial harm
or inconvenience to any consumer to whom the 
information relates. 
‘‘(2) SCOPE OF INVESTIGATION.—An investiga-
tion conducted under paragraph (1) shall be com-
mensurate with the nature and the amount of the 
sensitive financial personal information that is sub-
ject to the breach of data security. 
‘‘(3) FACTORS TO BE CONSIDERED.—In deter-
mining the likelihood under this section that sen-
sitive financial personal information that was the 
subject of a breach of data security has been or will 
be misused, the consumer reporter shall consider all 
available relevant facts, including whether the infor-
mation that was subject to the breach was 
encrypted, redacted, required technology to use that 
is not generally commercially available, or is other-
wise unreadable or unusable. 
‘‘(c) INVESTIGATION NOTICES
AND SYSTEM RES-
TORATION REQUIREMENTS.—If a consumer reporter de-
termines after commencing an investigation under sub-
section (b) that a potential breach of data security may 
result in substantial harm or inconvenience to any con-
sumer to whom the sensitive financial personal informa-
tion involved in such potential breach relates, the con-
sumer reporter shall—
‘‘(1) promptly notify the United States Secret 
Service; 
‘‘(2) promptly notify the appropriate functional 
regulatory agency for the consumer reporter; 
‘‘(3) notify as appropriate and without unrea-
sonable delay— 
‘‘(A) any entity that owns or is obligated 
on a financial account that may be subject to 
unauthorized transactions as a result of the 
breach, to the extent the breach involves related 
sensitive financial account information, includ-
ing in such notification information reasonably 
identifying the nature and scope of the breach 
and the sensitive financial personal information 
involved; 
‘‘(B) each nationwide consumer reporting 
agency, in the case of a breach involving sen-
sitive financial identity information relating to 
1,000 or more consumers; and 
‘‘(C) any other appropriate critical third 
parties— 
‘‘(i) whose involvement is necessary to 
investigate the breach; or 
‘‘(ii) who will be required to undertake 
further action with respect to such infor-
mation to protect such consumers from re-
sulting fraud or identity theft; 
‘‘(4) to the extent possible and practicable, take 
reasonable measures to repair the breach and restore 
the security and confidentiality of the sensitive fi-
nancial personal information involved to limit fur-
ther unauthorized use of such information; and 
‘‘(5) take reasonable measures to restore the in-
tegrity of the affected data security safeguards and 
make appropriate improvements to data security 
policies and procedures. 
‘‘(d) THIRD PARTY DUTIES.— 
‘‘(1) COORDINATED
INVESTIGATION.—When-
ever any consumer reporter that maintains or re-
ceives sensitive financial personal information for or 
on behalf of another party determines, or has reason 
to believe, that a breach of data security has oc-
curred with respect to such information, the con-
sumer reporter shall— 
‘‘(A) promptly notify the other party of the 
breach; 
‘‘(B) conduct a coordinated investigation 
with the other party as described in subsection 
(b); and
‘‘(C) ensure that the appropriate notices 
are provided as required under subsection (e). 
‘‘(2) CONTRACTUAL OBLIGATION REQUIRED.— 
No consumer reporter may provide sensitive finan-
cial personal information to a third party to main-
tain, receive, or communicate on behalf of the con-
sumer reporter, unless such third party agrees that 
whenever the third party becomes aware that a 
breach of data security has occurred or is reasonably 
likely to have occurred with respect to such informa-
tion maintained, received, or communicated by such 
third party, the third party shall be obligated— 
‘‘(A) to provide notice of the breach to the 
consumer reporter; 
‘‘(B) to conduct a coordinated investigation 
with the consumer reporter to determine the 
likelihood that such information will be misused 
against the consumers to whom the information 
relates in a manner that would cause substan-
tial harm or inconvenience to any such con-
sumers; and 
‘‘(C) provide any consumer notices re-
quired under subsection (e), except to the ex-
tent that such notices are provided by the con-