a reasonable risk of identity theft, fraud, or other 
unlawful conduct; 
(B) such a requirement would be effective in 
preventing identity theft, fraud, or other unlaw-
ful conduct; 
(C) the benefit in preventing identity theft, 
fraud, or other unlawful conduct would outweigh 
the cost to persons subject to such a requirement; 
and 
(D) compliance with such a requirement 
would be practicable. 
In enforcing any such regulations, the Commission 
may determine to be in compliance with such regula-
tions any person who is required under any other 
Federal law to dispose of obsolete paper documents 
and other non-electronic data containing personal in-
formation if such other Federal law provides equal or 
greater protection or personal information than the 
regulations promulgated under this subsection. 
(c) SPECIAL REQUIREMENTS FOR INFORMATION BRO-
KERS.— 
(1) SUBMISSION OF POLICIES TO THE FTC.—The 
regulations promulgated under subsection (a) shall re-
quire information brokers to submit their security 
policies to the Commission in conjunction with a no-
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
tification of a breach of security under section 3 or 
upon request of the Commission. 
(2) POST-BREACH AUDIT.—For any information 
broker required to provide notification under section 
3, the Commission shall conduct an audit of the infor-
mation security practices of such information broker, 
or require the information broker to conduct an inde-
pendent audit of such practices (by an independent 
auditor who has not audited such information bro-
ker’s security practices during the preceding 5 years). 
The Commission may conduct or require additional 
audits for a period of 5 years following the breach of 
security or until the Commission determines that the 
security practices of the information broker are in 
compliance with the requirements of this section and 
are adequate to prevent further breaches of security. 
(3) VERIFICATION OF AND INDIVIDUAL ACCESS 
TO PERSONAL INFORMATION.— 
(A) 
VERIFICATION.—Each 
information 
broker shall establish reasonable procedures to 
verify the accuracy of the personal information 
it collects, assembles, or maintains, and any 
other information it collects, assembles, or main-
tains that specifically identifies an individual, 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
other than information which merely identifies 
an individual’s name or address. 
(B) CONSUMER ACCESS TO INFORMATION.— 
(i) ACCESS.—Each information broker 
shall— 
(I) provide to each individual 
whose personal information it main-
tains, at the individual’s request at 
least 1 time per year and at no cost to 
the individual, and after verifying the 
identity of such individual, a means 
for the individual to review any per-
sonal information regarding such indi-
vidual maintained by the information 
broker and any other information 
maintained by the information broker 
that specifically identifies such indi-
vidual, other than information which 
merely identifies an individual’s name 
or address; and 
(II) place a conspicuous notice on 
its Internet website (if the information 
broker maintains such a website) in-
structing individuals how to request 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
access to the information required to be 
provided under subclause (I). 
(ii) DISPUTED
INFORMATION.—When-
ever an individual whose information the 
information broker maintains makes a 
written request disputing the accuracy of 
any such information, the information 
broker, after verifying the identity of the in-
dividual making such request and unless 
there are reasonable grounds to believe such 
request is frivolous or irrelevant, shall— 
(I) correct any inaccuracy; or 
(II)(aa) in the case of information 
that is public record information, in-
form the individual of the source of the 
information, and, if reasonably avail-
able, where a request for correction 
may be directed; or 
(bb) in the case of information 
that is non-public information, note 
the information that is disputed, in-
cluding the individual’s statement dis-
puting such information, and take rea-
sonable steps to independently verify 
such information under the procedures 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS