I 
109TH CONGRESS 
1ST SESSION H. R. 3374 
To provide for the uniform and timely notification of consumers whose sen-
sitive financial personal information has been placed at risk by a breach 
of data security, to enhance data security safeguards, to provide appro-
priate consumer mitigation services, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 21, 2005 
Mr. LATOURETTE (for himself and Ms. HOOLEY) introduced the following bill; 
which was referred to the Committee on Financial Services 
A BILL 
To provide for the uniform and timely notification of con-
sumers whose sensitive financial personal information has 
been placed at risk by a breach of data security, to 
enhance data security safeguards, to provide appropriate 
consumer mitigation services, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Consumer Notification 
and Financial Data Protection Act of 2005’’.
SEC. 2. DATA SECURITY SAFEGUARDS. 
Each financial institution shall have an affirmative 
and continuing obligation to maintain reasonable policies 
and procedures to protect the security and confidentiality 
of sensitive financial personal information of any con-
sumer that is maintained or received by or on behalf of 
such financial institution against any unauthorized use 
that is reasonably likely to result in harm or substantial 
inconvenience to such consumer. 
SEC. 3. INVESTIGATION AND NOTICE TO REGULATORS AND 
LAW ENFORCEMENT IN CASE OF BREACH OF 
DATA SECURITY. 
(a) DUTY TO INVESTIGATE.— 
(1) IN GENERAL.—Whenever any financial in-
stitution determines or becomes aware of informa-
tion that would reasonably indicate that a breach of 
data security may have occurred or is reasonably 
likely to occur, or receives notice under subsection 
(c), the financial institution shall immediately con-
duct a reasonable investigation to— 
(A) assess the nature and scope of the 
breach; 
(B) identify the sensitive financial personal 
information involved; and 
(C) determine if the breach is reasonably 
likely to result in harm or substantial inconven-
ience to any consumer to whom the information 
relates. 
(2) FACTORS TO BE CONSIDERED.—In deter-
mining, under paragraph (1), the likelihood that 
harm or substantial inconvenience may be caused to 
consumers, the financial institution shall consider all 
available relevant facts, including whether the infor-
mation that was subject to the breach was 
unencrypted, or unredacted, or required technology 
to use that is not generally commercially available. 
(b) INVESTIGATION NOTICES.—If a financial institu-
tion determines after commencing an investigation under 
subsection (a) that a potential breach of data security may 
result in harm or substantial inconvenience to any con-
sumer whose sensitive financial personal information was 
involved in such potential breach, the financial institution 
shall— 
(1) promptly notify the appropriate law enforce-
ment agencies of the breach; 
(2) promptly notify the institution’s functional 
regulator; 
(3) take reasonable measures to ensure and re-
store the security and confidentiality of the sensitive 
financial personal information involved in the 
breach;
(4) take reasonable measures to prevent further 
unauthorized access to or disclosure of any sensitive 
financial personal information and to restore the in-
tegrity of the data system; and 
(5) notify as appropriate and without unreason-
able delay all critical third parties— 
(A) whose involvement is necessary to in-
vestigate the breach of data security; or 
(B) who will be required to undertake fur-
ther action with respect to such information to 
protect such consumers from fraud or identity 
theft. 
(c) DUTY OF FINANCIAL CONTRACTORS.—Whenever 
any financial institution that maintains or receives sen-
sitive personal financial information for or on behalf of 
another party determines, or has reason to believe, that 
a breach of data security has occurred with respect to such 
information, the financial institution shall— 
(1) promptly notify the other party of the 
breach; 
(2) conduct a joint investigation with the other 
party to determine the likelihood that such informa-
tion will be misused against the consumers to whom 
the information relates in a manner that would
cause harm or substantial inconvenience to such con-
sumer; and 
(3) unless the financial institution and third 
party determine, after conducting a reasonable in-
vestigation, that it is not reasonably likely that such 
information will be misused to commit financial 
fraud against any consumer to whom any of such 
sensitive financial personal information relates in a 
manner that would cause harm or substantial incon-
venience to such consumer, provide joint notice 
under section 4 to such consumers. 
SEC. 4. NOTICE TO CONSUMERS OF DATA SECURITY 
BREACH. 
(a) NOTICE REQUIRED.—If, after completing a rea-
sonable investigation pursuant to section 3, a financial in-
stitution or a financial contractor pursuant to section 3(c) 
becomes aware that a breach of data security is reasonably 
likely to have occurred, with respect to sensitive financial 
personal information maintained or received by or on be-
half of the institution, that creates a risk of harm or sub-
stantial inconvenience to consumers to whom the informa-
tion relates, the financial institution shall, without unrea-
sonable delay— 
(1) provide written notice, in accordance with 
this section, to each consumer whose sensitive finan-
cial personal information was involved in the breach 
of data security; and 
(2) if the financial institution determines that it 
is likely to be providing notice under paragraph (1) 
to 1,000 or more consumers for any breach of data 
security, provide written notice to— 
(A) each consumer reporting agency de-
scribed in section 603(p) of the Fair Credit Re-
porting Act; and 
(B) any other consumer reporting agency 
that the financial institution identifies, or ex-
pects to identify, in the notice provided to the 
consumer under paragraph (1). 
(b) CONTENT OF NOTICE.—The notice provided to 
any consumer under subsection (a)(1) shall include the 
following information in a clear and conspicuous manner: 
(1) A description of the nature and type of in-
formation that was, or is reasonably believed to have 
been, subject to the breach of data security. 
(2) If known, the date, or a reasonable approxi-
mation of the period of time, on or within which sen-
sitive financial personal information of the consumer 
was, or is reasonably believed to have been, acquired 
by an unauthorized person.
(3) A description of the actions taken by the fi-
nancial institution to restore the security and con-
fidentiality of the data. 
(4) A toll-free telephone number where a con-
sumer whose information was subject of the breach 
of data security may obtain additional information 
the breach of data security. 
(5) A summary of rights of consumer victims of 
fraud or identity theft, such as that prepared by the 
Federal Trade Commission under section 609(d) of 
the Fair Credit Reporting Act, including any addi-
tional appropriate information on how the consumer 
may— 
(A) obtain a copy of a consumer report 
free of charge in accordance with section 612 of 
the Fair Credit Reporting Act; 
(B) place a fraud alert in any file relating 
to the consumer at a consumer reporting agen-
cy under section 605A of such Act to discour-
age unauthorized use; and 
(C) contact the Federal Trade Commission 
for more detailed information. 
(c) NOTICE OF IDENTITY THEFT.—If a financial in-
stitution is required to provide a notice under subsection 
(a)(1) with respect to a breach of data security involving
sensitive financial personal information relating to a con-
sumer (other than financial account information described 
in section 9(5)(A)(v)), the notice required in this section 
with respect to such consumer shall include information 
on how the consumer may obtain mitigation services free 
of charge in accordance with section 5. 
(d) DELAY OF NOTICE FOR LAW ENFORCEMENT 
PURPOSES.—If a financial institution receives a written 
request, or an oral request indicating that a written re-
quest will be provided, from an appropriate law enforce-
ment agency indicating that providing a particular notice 
to any consumer under this section would impede a crimi-
nal or civil investigation by that law enforcement agency, 
the financial institution shall delay, or in the case of a 
foreign law enforcement agency may delay, providing such 
notice until the law enforcement agency informs the finan-
cial institution that such notice will no longer impede the 
investigation or the law enforcement agency fails to con-
firm that a continued delay is necessary to avoid impeding 
such investigation. 
(e) ELECTRONIC TRANSMISSION OF NOTICE.—The 
written notice required under this section to any consumer 
may be made by an electronic transmission only if—
(1) the consumer has provided prior consent to 
receive any such notice by electronic transmission; 
and 
(2) the notice is consistent with the provisions 
permitting electronic transmission of notices under 
section 101 of the Electronic Signatures in Global 
and National Commerce Act. 
SEC. 5. MITIGATION PROCEDURES. 
(a) FREE FILE MONITORING.—Any financial institu-
tion that is required to provide notice to a consumer under 
section 4(a)(1) with respect to a breach of data security 
described in section 4(c) shall, if requested by the con-
sumer before the end of the 90-day period beginning on 
the date of such notice, make available to the consumer, 
free of charge and for a 12-month period, a service that 
monitors nationwide credit activity regarding the con-
sumer from a consumer reporting agency described in sec-
tion 603(p) of the Fair Credit Reporting Act. 
(b) JOINT RULEMAKING FOR SAFE HARBOR.—The 
Federal Trade Commission, in consultation with the regu-
latory agencies described in section 8, shall develop regula-
tions, which shall be prescribed by all functional regu-
latory agencies, that, in any case in which— 
(1) free file monitoring is offered under sub-
section (a) to a consumer;
(2) subsequent to the offer, another party mis-
uses sensitive financial identity information on the 
consumer obtained through the breach of data secu-
rity (that gave rise to such offer) to commit identity 
theft against the consumer; and 
(3) at the time of such breach the financial in-
stitution maintained reasonable policies and proce-
dures to comply with subsection (a), 
exempts the financial institution from any liability under 
State common law for any loss or harm to the consumer 
occurring after the end of a reasonable period beginning 
on the date of such offer, other than any direct pecuniary 
loss provided under such law, resulting from such misuse. 
SEC. 6. PROPER DISPOSAL OF PERSONAL INFORMATION. 
(a) IN GENERAL.—Before the end of the 6-month pe-
riod beginning on the date of the enactment of this Act, 
the Federal Trade Commission shall prescribe regulations 
in final form requiring any financial institution which 
maintains or otherwise possesses sensitive financial per-
sonal information, or any compilation of such information, 
for a business purpose to properly dispose of any such in-
formation or compilation so that such information or com-
pilation cannot practicably be read or reconstructed. 
(b) RULE OF CONSTRUCTION.—No provision of this 
section shall be construed—
(1) as requiring, or authorizing the Federal 
Trade Commission to require, any person to main-
tain or destroy any sensitive financial personal infor-
mation that is not required to be maintained or de-
stroyed under any other provision of Federal or 
State law; or 
(2) as altering or affecting any requirement im-
posed under any other provision of Federal or State 
law to maintain or destroy sensitive financial per-
sonal information. 
SEC. 7. RELATION TO STATE LAW. 
The provisions of this Act shall supersede any law, 
rule, or regulation of any State or political subdivision of 
any State that relates in any way to— 
(1) information security standards of financial 
institutions; or 
(2) the notification of consumers by financial 
institutions with respect to any breach of the con-
fidentiality or security of information maintained or 
received by or on behalf of the financial institutions. 
SEC. 8. ADMINISTRATIVE ENFORCEMENT. 
This Act and any regulation prescribed under this 
Act shall be enforced with respect to financial institutions 
and other persons to which this Act applies exclusively by 
the functional financial regulators, and by the chief law
enforcement officer of a State, or an official or agency des-
ignated by a State (with respect to persons within the ju-
risdiction of such officer, official, or agency), as follows: 
(1) Under section 8 of the Federal Deposit In-
surance Act, in the case of— 
(A) national banks, Federal branches and 
Federal agencies of foreign banks, and any sub-
sidiaries of such entities (except brokers, deal-
ers, persons providing insurance, investment 
companies, and investment advisers), by the 
Comptroller of the Currency; 
(B) member banks of the Federal Reserve 
System (other than national banks), branches 
and agencies of foreign banks (other than Fed-
eral branches, Federal agencies, and insured 
State branches of foreign banks), commercial 
lending companies owned or controlled by for-
eign banks, organizations operating under sec-
tion 25 or 25A of the Federal Reserve Act, and 
bank holding companies and their nonbank sub-
sidiaries or affiliates (except brokers, dealers, 
persons providing insurance, investment compa-
nies, and investment advisers), by the Board of 
Governors of the Federal Reserve System;
(C) banks insured by the Federal Deposit 
Insurance Corporation (other than members of 
the Federal Reserve System), insured State 
branches of foreign banks, and any subsidiaries 
of such entities (except brokers, dealers, per-
sons providing insurance, investment compa-
nies, and investment advisers), by the Board of 
Directors of the Federal Deposit Insurance Cor-
poration; and 
(D) savings associations the deposits of 
which are insured by the Federal Deposit In-
surance Corporation, and any subsidiaries of 
such savings associations (except brokers, deal-
ers, persons providing insurance, investment 
companies, and investment advisers), by the Di-
rector of the Office of Thrift Supervision. 
(2) Under the Federal Credit Union Act, by the 
Board of the National Credit Union Administration 
with respect to any federally insured credit union, 
and any subsidiaries of such an entity. 
(3) Under the Securities Exchange Act of 1934, 
by the Securities and Exchange Commission with re-
spect to any broker or dealer.
(4) Under the Investment Company Act of 
1940, by the Securities and Exchange Commission 
with respect to investment companies. 
(5) Under the Investment Advisers Act of 1940, 
by the Securities and Exchange Commission with re-
spect to investment advisers registered with the 
Commission under such Act. 
(6) Under State insurance law, in the case of 
any person engaged in the business of insurance, by 
the applicable State insurance authority of the State 
in which the person is domiciled. 
(7) Under the Federal Trade Commission Act, 
by the Federal Trade Commission for any other per-
son that is not subject to the jurisdiction of any 
agency or authority under paragraphs (1) through 
(6) of this subsection. 
SEC. 9. DEFINITIONS. 
For purposes of this Act, the following definitions 
shall apply: 
(1) BREACH
OF
DATA
SECURITY.—The term 
‘‘breach of data security’’ means, with respect to 
sensitive financial personal information that is main-
tained, received, or communicated by or on behalf of 
any financial institution—
(A) an unauthorized acquisition of such in-
formation that could be used to commit finan-
cial fraud; or 
(B) an unusual pattern of misuse of such 
information to commit financial fraud. 
(2) CONSUMER.—The term ‘‘consumer’’ means 
an individual. 
(3) FINANCIAL
INSTITUTION.—The term ‘‘fi-
nancial institution’’ means— 
(A) any person the business of which is en-
gaging in activities that are financial in nature 
as described in or determined under section 
4(k) of the Bank Holding Company Act; 
(B) any entity that is primarily engaged in 
activities that are subject to the Fair Credit Re-
porting Act; and 
(C) any person that is maintaining, receiv-
ing, or communicating sensitive financial per-
sonal information on an ongoing basis for the 
purposes of engaging in interstate commerce. 
(4) FUNCTIONAL FINANCIAL REGULATOR.—The 
term ‘‘functional financial regulator’’— 
(A) has the same meaning as in section 
509(2) of the Gramm-Leach-Bliley Act; and
(B) in the case of any financial institution 
that is described in paragraph (3)(B) that is 
not subject to the Gramm-Leach-Bliley Act, in-
cludes the appropriate regulator for such finan-
cial institution under section 621 of the Fair 
Credit Reporting Act. 
(5) SENSITIVE FINANCIAL PERSONAL INFORMA-
TION.— 
(A) IN GENERAL.—The term ‘‘sensitive fi-
nancial personal information’’ means informa-
tion that is personal, sensitive, and nonpublic 
and contains an individual’s first and last name 
and either the individual’s address or telephone 
number and appears in combination with any of 
the following: 
(i) Social Security number. 
(ii) Driver’s license number or an 
equivalent State-issued identification num-
ber. 
(iii) Taxpayer identification number. 
(iv) Any credit card or debit card ac-
count number. 
(v) Any bank, savings association, 
credit union, or investment account num-
ber, other than an account number de-
scribed in clause (iv), in combination with 
any required security code, biometric code, 
password, or other means that would per-
mit access to a consumer’s financial ac-
count. 
(B) EXCLUSIONS.—The term ‘‘sensitive fi-
nancial personal information’’ shall not in-
clude— 
(i) any list, description or other 
grouping of individuals (and publicly avail-
able information pertaining to them) that 
is derived without using any sensitive per-
sonal information; or 
(ii) publicly available information that 
is lawfully made available to the general 
public from Federal, State or local govern-
ment records. 
Æ