I 
109TH CONGRESS 
1ST SESSION H. R. 1069 
To require Federal agencies, and persons engaged in interstate commerce, 
in possession of electronic data containing personal information, to dis-
close any unauthorized acquisition of such information, to amend the 
Gramm-Leach-Bliley Act to require financial institutions to disclose to 
customers and consumer reporting agencies any unauthorized access to 
personal information, to amend the Fair Credit Reporting Act to require 
consumer reporting agencies to implement a fraud alert with respect 
to any consumer when the agency is notified of any such unauthorized 
access, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MARCH 3, 2005 
Ms. BEAN (for herself, Mr. EMANUEL, Mr. GUTIERREZ, Ms. SLAUGHTER, Mr. 
VAN
HOLLEN, Mr. TOWNS, Mrs. MALONEY, Mr. LIPINSKI, Mr. 
MCDERMOTT, Ms. SCHAKOWSKY, Mr. BRADY of Pennsylvania, and Mr. 
DEFAZIO) introduced the following bill; which was referred to the Com-
mittee on Energy and Commerce, and in addition to the Committees on 
Government Reform and Financial Services, for a period to be subse-
quently determined by the Speaker, in each case for consideration of such 
provisions as fall within the jurisdiction of the committee concerned 
A BILL 
To require Federal agencies, and persons engaged in inter-
state commerce, in possession of electronic data con-
taining personal information, to disclose any unauthor-
ized acquisition of such information, to amend the 
Gramm-Leach-Bliley Act to require financial institutions 
to disclose to customers and consumer reporting agencies 
any unauthorized access to personal information, to
amend the Fair Credit Reporting Act to require con-
sumer reporting agencies to implement a fraud alert 
with respect to any consumer when the agency is notified 
of any such unauthorized access, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Notification of Risk 
to Personal Data Act’’. 
SEC. 2. DEFINITIONS. 
In this Act, the following definitions shall apply: 
(1) AGENCY.—The term ‘‘agency’’ has the same 
meaning given such term in section 551(1) of title 
5, United States Code. 
(2) BREACH OF SECURITY OF THE SYSTEM.— 
The term ‘‘breach of security of the system’’— 
(A) means the compromise of the security, 
confidentiality, or integrity of computerized 
data that results in, or there is a reasonable 
basis to conclude has resulted in, the unauthor-
ized acquisition or loss of, and access to, per-
sonal information maintained by the person or 
business; and 
(B) does not include good faith acquisition 
of personal information by an employee or 
agent of the person or business for the purposes
of the person or business, if the personal infor-
mation is not used or subject to further unau-
thorized disclosure. 
(3) PERSON.—The term ‘‘person’’ has the same 
meaning given such term in section 551(2) of title 
5, United States Code. 
(4) PERSONAL INFORMATION.—The term ‘‘per-
sonal information’’ means an individual’s last name 
in combination with any 1 or more of the following 
data elements, when either the name or the data ele-
ments are not encrypted: 
(A) Social security number. 
(B) Driver’s license number or State iden-
tification number. 
(C) Account number, credit or debit card 
number, in combination with any required secu-
rity code, access code, or password that would 
permit access to an individual’s financial ac-
count. 
(5) SUBSTITUTE
NOTICE.—The term ‘‘sub-
stitute notice’’ means— 
(A) e-mail notice, if the agency or person 
has an e-mail address for the subject persons;
(B) conspicuous posting of the notice on 
the Internet site of the agency or person, if the 
agency or person maintains an Internet site; or 
(C) notification to major media. 
SEC. 3. DATABASE SECURITY FOR AGENCIES AND NON-
FINANCIAL INSTITUTIONS. 
(a) DISCLOSURE OF SECURITY BREACH.— 
(1) IN GENERAL.—Any agency, or person en-
gaged in interstate commerce, that owns or licenses 
electronic data containing personal information 
shall, following the discovery of a breach of security 
of the system containing such data, notify— 
(A) any resident of the United States 
whose unencrypted personal information was, or 
is reasonably believed to have been, lost or ac-
quired by an unauthorized person; and 
(B) each consumer reporting agency de-
scribed in section 603(p) of the Fair Credit Re-
porting Act of such loss or unauthorized acqui-
sition with respect to such consumer. 
(2) NOTIFICATION OF OWNER OR LICENSEE.— 
Any agency, or person engaged in interstate com-
merce, in possession of electronic data containing 
personal information that the agency does not own 
or license shall notify the owner or licensee of the in-