I 
108TH CONGRESS 
1ST SESSION H. R. 1636
To protect and enhance consumer privacy, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 3, 2003
Mr. STEARNS (for himself, Mr. BOUCHER, Mr. TAUZIN, Mr. TERRY, Mr. 
BASS, Ms. ESHOO, Mr. WHITFIELD, Mr. GORDON, Mrs. BONO, Mr. 
MORAN of Virginia, Mr. GILLMOR, Mr. BILIRAKIS, Mr. TOWNS, Mr. 
DEAL of Georgia, Mr. WELLER, Mr. SHIMKUS, Mr. GREENWOOD, Mr. 
UPTON, Ms. DEGETTE, Mr. WALDEN of Oregon, Ms. HARMAN, Mr. 
WELDON of Florida, and Mr. SHADEGG) introduced the following bill; 
which was referred to the Committee on Energy and Commerce, and in 
addition to the Committee on International Relations, for a period to be 
subsequently determined by the Speaker, in each case for consideration 
of such provisions as fall within the jurisdiction of the committee con-
cerned 
A BILL 
To protect and enhance consumer privacy, and for other 
purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Consumer Privacy Pro-
tection Act of 2003’’.
SEC. 2. TABLE OF CONTENTS. 
The table of contents for this Act is as follows:
Sec. 1. Short title. 
Sec. 2. Table of contents. 
Sec. 3. Definitions. 
TITLE I—PROTECTION OF INDIVIDUAL PRIVACY IN INTERSTATE 
COMMERCE 
Sec. 101. Privacy notices to consumers. 
Sec. 102. Privacy policy statements. 
Sec. 103. Consumer opportunity to limit sale or disclosure of information. 
Sec. 104. Consumer opportunity to limit other information practices. 
Sec. 105. Information security obligations. 
Sec. 106. Self-regulatory programs. 
Sec. 107. Enforcement. 
Sec. 108. No private right of action. 
Sec. 109. Effect on other laws. 
Sec. 110. Effective date. 
TITLE II—IDENTITY THEFT PREVENTION AND REMEDIES 
Sec. 201. Facilitating electronic identity theft affidavits. 
Sec. 202. Promoting use of common identity theft affidavit. 
Sec. 203. Timely resolution of identity theft disputes. 
Sec. 204. Improvements to consumer clearinghouse. 
Sec. 205. Improved identity theft data. 
Sec. 206. Change of address protections. 
Sec. 207. Effective date. 
TITLE III—INTERNATIONAL PROVISIONS 
Sec. 301. Study by Comptroller General. 
Sec. 302. Remediation of discriminatory impact by Secretary of Commerce. 
Sec. 303. Effect of nonremediation. 
Sec. 304. Harmonization of international privacy laws, regulations, and agree-
ments.
SEC. 3. DEFINITIONS. 
In this Act: 
(1) The term ‘‘Commission’’ means the Federal 
Trade Commission. 
(2) The term ‘‘consumer’’ means an individual 
acting in the individual’s personal, family, or house-
hold capacity.
(3)(A) The term ‘‘data collection organization’’ 
means an entity (or an agent or affiliate of the enti-
ty) that collects (by any means, through any me-
dium), sells, discloses for consideration, or uses per-
sonally identifiable information of the consumer. 
(B) Such term does not include—
(i) a governmental agency; 
(ii) a not-for-profit entity, to the ex-
tent that personally identifiable informa-
tion is not used for a commercial purpose; 
(iii) an entity that—
(I) has annual gross revenue 
under $1,000,000 (based on the value 
of such amount in fiscal year 2000, 
adjusted for current dollars); 
(II) has fewer than 25 employees; 
(III) collects or uses personally 
identifiable information from fewer 
than 1,000 consumers for a purpose 
unrelated to a transaction with the 
consumer; 
(IV) does not process personally 
identifiable information of consumers; 
and
(V) does not sell or disclose for 
consideration such information to an-
other person; 
(iv) a provider of professional services, 
or any affiliate thereof, to the extent that 
such provider is obligated by rules of pro-
fessional ethics, or by applicable law or 
regulation, not to voluntarily disclose con-
fidential client information without the 
consent of the client; or 
(v) a data processing outsourcing enti-
ty. 
(4)(A) The term ‘‘personally identifiable infor-
mation’’, with respect to a data collection organiza-
tion means individually identifiable information re-
lating to a living individual who can be identified 
from that information. 
(B) Such term includes—
(i) first and last name, whether given 
at birth or adoption, assumed, or legally 
changed; 
(ii) home or other physical address in-
cluding street name and name of a city or 
town; 
(iii) electronic mail address;
(iv) telephone number; 
(v) social security number; or 
(vi) any other unique identifying in-
formation that a data collector and proc-
essor collects and combines with any infor-
mation described in the preceding subpara-
graphs of this paragraph. 
(C) Such term does not include—
(i) anonymous or aggregate data, or 
any other information that does not iden-
tify a unique living individual; 
(ii) information about a consumer in-
ferred from data maintained about a con-
sumer; or 
(iii) information about a consumer ob-
tained from a public record. 
(5) The term ‘‘affiliate’’ means any company 
that controls, is controlled by, or is under common 
control with another company. 
(6) The term ‘‘information-sharing affiliate’’ 
means any affiliate that is under common control 
with a data collection organization, and is contrac-
tually obligated to comply with the practices enu-
merated under the privacy policy statement of the 
organization required under section 102.
(7) The term ‘‘data processing outsourcing enti-
ty’’ means, with respect to a data collection organi-
zation, a non-affiliated entity that—
(A) provides information technology proc-
essing, Web hosting, or telecommunications 
services to the data collection organization; 
(B) is contractually obligated to comply 
with security controls specified by the data col-
lection organization; and 
(C) has no right to use the data collection 
organization’s personally identifiable informa-
tion other than for performing data processing 
outsourcing services for the data collection or-
ganization or as required by law. 
(8) The term ‘‘process’’, with respect to person-
ally identifiable information, means any value-added 
activity performed on data by automated means. 
(9) The term ‘‘transaction’’ means an inter-
action between a consumer and a data collection or-
ganization resulting in—
(A) any use of information that is nec-
essary to complete the interaction in the course 
of which information is collected, or to maintain 
the provisioning of a good or service requested 
by the consumer, including use—
(i) to approve, guarantee, process, ad-
minister, complete, enforce, provide, or 
market a product, service, account, benefit, 
transaction, or payment method that is re-
quested or approved by the consumer; or 
(ii) to deliver goods, services, funds, 
or other consideration to, or on behalf of, 
the consumer; 
(B) any disclosure of information that is 
necessary for the consumer to enforce any right 
of the consumer; 
(C) any disclosure of information that is 
required by law or by a court order; and 
(D) any use of information to verify per-
sonally identifiable information by the con-
sumer, evaluate, detect, or reduce the risk of 
fraud or other criminal activity, or other risk-
management activities. 
(10) The term ‘‘display’’ means intentionally 
communicating or otherwise making available (on 
the Internet or in any other manner) to another per-
son. 
(11) The term ‘‘public record’’ means any item, 
collection, or grouping of information about an indi-
vidual that is maintained by a Federal, State, or
local government entity and that is made available 
to the public. 
(12) The term ‘‘purchase’’ means providing, di-
rectly or indirectly, anything of value in exchange 
for a good or service. 
(13) The term ‘‘State’’ includes the several 
States, the District of Columbia, the Commonwealth 
of Puerto Rico, the Commonwealth of the Northern 
Mariana Islands, American Samoa, Guam, the Vir-
gin Islands, the Freely Associated States, and any 
other territory or possession of the United States. 
TITLE I—PROTECTION OF INDI-
VIDUAL PRIVACY IN INTER-
STATE COMMERCE 
SEC. 101. PRIVACY NOTICES TO CONSUMERS. 
(a) NOTICE REQUIRED.—A data collection organiza-
tion shall provide to a consumer a notice containing the 
information required under subsection (b) as follows: 
(1) Upon the first instance of collection from 
the consumer of personally identifiable information, 
that may be used for a purpose unrelated to the 
transaction, by a data collection organization, the or-
ganization shall provide the notice at the time per-
sonally identifiable information is collected.
(2) Upon a material change in the organiza-
tion’s privacy policy under section 102(a), the orga-
nization shall provide the notice, not later than the 
first time after such change in policy that the orga-
nization seeks to collect, sell, disclose for consider-
ation, or use personally identifiable information to 
the extent practicable, to each consumer from whom 
the organization has collected such information. 
(b) FORM AND CONTENTS OF NOTICE.—A notice re-
quired under subsection (a) shall be provided in a clear 
and conspicuous manner, be prominently displayed or ex-
plicitly stated to the consumer, and contain the following 
information: 
(1) A statement that the personal information 
collected by the data collection organization may be 
used or disclosed for purposes or transactions unre-
lated to that for which it was collected, as described 
in the organization’s privacy statement. 
(2) A description of the manner in which the 
consumer may obtain a privacy policy statement that 
meets the requirements of section 102, which may 
include providing the consumer with an Internet 
website, a hyperlink to such a website, or a toll-free 
telephone number from which such a statement may 
be obtained. If the notice required under subsection
(a) is provided to the consumer by means of an 
Internet website, one manner in which the consumer 
may obtain the privacy policy statement must be by 
means of an Internet website. 
(3) If the notice is required under subsection 
(a)(2), a statement that there has been a material 
change in the organization’s privacy policy. 
SEC. 102. PRIVACY POLICY STATEMENTS. 
(a) PRIVACY POLICY.—A data collection organization 
shall establish a privacy policy with respect to the collec-
tion, sale, disclosure for consideration, dissemination, use, 
and security of the personally identifiable information of 
consumers, the principal elements of which shall be em-
bodied in a privacy policy statement (or statements) that 
meets the requirements of subsection (b). 
(b) STATEMENT.—The statement (or statements) re-
quired under subsection (a) shall meet the following re-
quirements: 
(1) The statement must be brief, concise, clear, 
and conspicuous and written in plain language. 
(2) The statement must be accessible to all con-
sumers of the data collection organization (regard-
less of the means by which a consumer conducts a 
transaction with the organization)—
(A) at no charge to the consumer; and
(B) at the time the data collection organi-
zation first collects personally identifiable infor-
mation about the consumer that may be used 
for a purpose unrelated to a transaction with 
the consumer and subsequently. 
(3) The statement must disclose only the fol-
lowing: 
(A) The identity of each data collection or-
ganization, or a description of each class or 
type of data collection organization, that may 
collect or use the information. 
(B) The types of information that may be 
collected or used. 
(C) How the information may be used. 
(D) Whether the consumer is required to 
provide the information in order to do business 
with the data collection organization. 
(E) The extent to which the information is 
subject to sale or disclosure for consideration to 
a data collection organization that is not an in-
formation-sharing affiliate of the data collection 
organization providing the statement, includ-
ing—
(i) a clear and prominent statement of 
the fact that the information is subject to 
such sale or disclosure for consideration; 
(ii) a description of each class or type 
of data collection organization to which the 
information may be sold or disclosed for 
consideration; 
(iii) to the extent practicable, the pur-
pose for which the information may be 
used; and 
(iv) the types of information that may 
be sold or disclosed for consideration. 
(F) Whether the information security prac-
tices of the data collection organization meet 
the security requirements of section 105 in 
order to prevent unauthorized disclosure or re-
lease of personally identifiable information. 
(c) COMMISSION FACILITATION.—The Commission 
shall take actions (including conducting industry-wide 
workshops) to facilitate the development of harmonized, 
universal wording or logo-based graphics in order to con-
vey the contents of privacy policy statements required 
under this section.
SEC. 103. CONSUMER OPPORTUNITY TO LIMIT SALE OR DIS-
CLOSURE OF INFORMATION. 
(a) PRECLUSION OF SALE OR DISCLOSURE.—
(1) REQUIREMENT.—A data collection organi-
zation shall provide to the consumer, without charge, 
the opportunity to preclude any sale or disclosure for 
consideration of the consumer’s personally identifi-
able information, provided in a particular data col-
lection, that may be used for a purpose other than 
a transaction with the consumer, to any data collec-
tion organization that is not an information-sharing 
affiliate of the data collection organization providing 
such opportunity 
(2) DURATION.—A preclusion on sale or disclo-
sure for consideration of information established by 
a consumer under this subsection shall remain in ef-
fect for 5 years or until the consumer indicates oth-
erwise, whichever occurs sooner. A data collection 
organization may not seek reconsideration of a con-
sumer’s preclusion of such sale or disclosure until at 
least 1 year after such preclusion has been imposed 
by the consumer. 
(b) PERMISSION FOR SALE OR DISCLOSURE.—A data 
collection organization may provide the consumer an op-
portunity to permit the sale or disclosure described in sub-
section (a)(1) in exchange for a benefit to the consumer.
(c) ACCESSIBILITY.—The opportunity to preclude (or 
if offered, to permit) the sale or disclosure for consider-
ation of information under this section must be both easy 
to access and use, and the notice of the opportunity to 
preclude must be clear and conspicuous.. 
SEC. 104. CONSUMER OPPORTUNITY TO LIMIT OTHER IN-
FORMATION PRACTICES. 
If a data collection organization provides to a con-
sumer the opportunity to limit other practices of the data 
collection organization with respect to a particular collec-
tion or use of personally identifiable information regarding 
the consumer, other than that required by section 103—
(1) a notice and description of such opportunity 
must appear in the privacy statement; 
(2) such opportunity must be easy to access 
and to use; and 
(3) any limitation exercised by the consumer 
pursuant to such opportunity shall remain in effect, 
unless—
(A) the limitation is withdrawn by the con-
sumer; or 
(B) the data collection organization pro-
vides the consumer at least 30 days notice be-
fore materially changing the limitation or termi-
nating its compliance with the limitation.
SEC. 105. INFORMATION SECURITY OBLIGATIONS. 
(a) INFORMATION SECURITY POLICY.—
(1) IMPLEMENTATION.—A data collection orga-
nization shall prepare, revise as necessary, and im-
plement an information security policy that is appli-
cable to the information security practices and treat-
ment of personally identifiable information main-
tained by the data collection organization, that is de-
signed to prevent the unauthorized disclosure or re-
lease of such information. 
(2) MANAGEMENT APPROVAL.—An information 
security policy created pursuant to paragraph (1) 
shall be considered and approved by the senior man-
agement officials of the data collection organization. 
(3) CONTENTS.—An information security policy 
required under paragraph (1) shall include—
(A) a process for taking corrective action 
pursuant to subsection (b); and 
(B) identifying an officer of the data col-
lection organization as the point of contact with 
responsibility for information security issues for 
the organization. 
(b) CORRECTIVE ACTIONS.—
(1) INFORMATION SECURITY ADVISORIES AND 
ACTION.—Except as provided in paragraph (2), upon 
the issuance of an information security advisory (as
such term is defined in subsection (d)), a data col-
lection organization shall, within a reasonable period 
of time after the issuance of such advisory and pur-
suant to its information security policy, take appro-
priate action reasonably necessary to mitigate 
against any vulnerability identified in such advisory, 
including implementing any changes to its security 
practices and the architecture, installation, or imple-
mentation of its network or operating software (in-
cluding corrective patches) in response to such advi-
sory. 
(2) EXCEPTIONS.—A data collection organiza-
tion shall not be required to take the action specified 
in an information security advisory under paragraph 
(1) if such organization can, in good faith, show 
that—
(A) the corrective action required would 
cause harm to, or weaken, the organization’s 
existing information security for personally 
identifiable information or the procedures or 
systems of the organization; 
(B) the organization takes, or has taken, 
other appropriate steps or corrective action to 
mitigate the vulnerabilities and exposure risks
identified in the information security advisory; 
or 
(C) the specified corrective action is not 
necessary. 
(c) EFFECT OF RELEASE OF PERSONALLY IDENTIFI-
ABLE INFORMATION.—If the security of a data collection 
organization has been compromised, resulting in the unau-
thorized release of a consumer’s personally identifiable in-
formation, the data collection organization shall be pre-
sumed to be in violation of this section if such organization 
has failed to respond to an information security advisory 
in accordance with subsection (b)(1). 
(d) DEFINITION.—As used in this section, the term 
‘‘information security advisory’’ means an information se-
curity advisory issued by the Federal Computer Incident 
Response Center of the Department of Homeland Secu-
rity, or its successor agency. 
SEC. 106. SELF-REGULATORY PROGRAMS. 
(a) SELF-REGULATORY PROGRAM.—
(1) PRESUMPTION OF COMPLIANCE.—The Com-
mission shall presume that a data collection organi-
zation is in compliance with the provisions of sec-
tions 101 through 105 if that organization—
(A) participates in a self-regulatory pro-
gram approved under subsection (b); and
(B) has been determined by a self-regu-
latory program to be in compliance with the 
guidelines, procedures, requirements, and re-
strictions of the program (including a remedial 
process under subsection (c)(7)). 
(2) EFFECT OF WILLFUL NONCOMPLIANCE.—A 
data collection organization that participates in a 
self-regulatory program under this section shall not 
be liable for a civil penalty arising out of a violation 
of any provision of sections 101 through 105 unless 
such violation results from willful noncompliance 
with the guidelines, procedures, requirements, or re-
strictions of the program. 
(b) APPROVAL BY COMMISSION.—
(1) APPROVAL.—The Commission shall, within 
90 days after submission of an application for ap-
proval of a self-regulatory program under this sec-
tion (or of a material change in a program pre-
viously approved by the Commission), approve such 
program (or change) if the Commission finds that 
the program (or change) complies with the require-
ments of subsection (c). 
(2) FORM OF APPLICATION.—The Commission 
shall accept an application for approval under para-
graph (1) in any reasonable form the applicant may 
submit. 
(3) DURATION UNTIL RENEWAL.—A self-regu-
latory program approved by the Commission under 
paragraph (1) shall be approved for a period of 5 
years. 
(4) REVOCATION OF APPROVAL.—The Commis-
sion may, after notice and opportunity for a hearing, 
revoke approval granted under paragraph (1), if the 
Commission finds that a self-regulatory program 
fails to meet the requirements of subsection (c). 
(5) JUDICIAL REVIEW.—Any order by the Com-
mission denying approval of a self-regulatory pro-
gram shall be subject to judicial review, as provided 
in section 706 of title 5, United States Code. 
(c) REQUIREMENTS
OF SELF-REGULATORY PRO-
GRAM.—A self-regulatory program complies with the re-
quirements of this subsection if the program provides each 
of the following: 
(1) Guidelines and procedures requiring a pro-
gram participant to provide substantially equivalent 
or greater protections for consumers and their per-
sonally identifiable information as are provided 
under sections 101 through 105.
pliance issues, if the self-regulatory program 
conducts—
(i) a random compliance test with re-
spect to each participant not less fre-
quently than every 3 years; 
(ii) a full compliance test in any case 
where non-compliance with any of the se-
lected compliance issues is identified; and 
(iii) full compliance tests of partici-
pants with a high number of complaints 
against them. 
(3) Procedures and requirements that ensure 
that a program participant provides a process for re-
solving disputes with consumers relating to the pri-
vacy policy and practices of the participant. Such 
dispute resolution process—
(A) must be available without charge to a 
consumer; 
(B) must be available at a cost to the par-
ticipant that is reasonable and does not discour-
age participation by the participant in such 
process; 
(C) must ensure that consumers are in-
formed of how to utilize the process;
(D) may include, as one choice among oth-
ers, binding arbitration; and 
(E)(i) must be completed within 60 days 
after submission of the dispute by the con-
sumer; or 
(ii) must be completed within 90 days after 
submission of the dispute by the consumer, if 
the participant—
(I) determines that additional 
time is required to obtain information 
to make an informed decision with re-
spect to the dispute; and 
(II) notifies the consumer and 
the self-regulatory program that such 
additional time is required. 
(4) Provisions for the use by participants in the 
program of a means (including the use of a seal) to 
represent the participant’s participation in the pro-
gram. 
(5) With respect to any nonvoluntary suspen-
sion or termination of participation in the program 
because of the participant’s failure to comply with 
the program, procedures or requirements to provide 
for the following:
(A) Publication of notice and the reasons 
for any such suspension or termination, except 
that no personally identifiable information re-
lated to such suspension or termination may be 
published. 
(B) Notice to the Commission of any such 
termination. 
(6) Requirements and restrictions that assure 
independence with respect to program eligibility, 
compliance, and dispute resolution mechanisms and 
decisions from improper interference by management 
or ownership of the self-regulatory program partici-
pant. 
(7) A process for a noncompliant participant to 
take timely remedial action in order to come back 
into compliance with the program before suspension 
or termination of participation in the program. 
(d) CONSUMER DISPUTE RESOLUTION.—
(1) SELF-REGULATORY DISPUTE PROCESS.—If 
a consumer has a dispute with a participant in a 
self-regulatory program under this section or under 
section 5 of the Federal Trade Commission Act (15 
U.S.C. 45) to the extent that such dispute pertains 
to the entity’s privacy policy or practices required 
for participation in the self-regulatory program, the
consumer shall initially seek resolution through the 
participant’s dispute resolution process (established 
in accordance with subsection (c)(3)). The Commis-
sion shall promptly refer to the participant involved 
any dispute submitted to the Commission for which 
resolution has not been initially sought through such 
process. 
(2) RESOLUTION BY COMMISSION.—A consumer 
may submit to the Commission for resolution a dis-
pute with a participant in a self-regulatory program 
under this section, if the following requirements are 
met: 
(A) The dispute was initially submitted 
under paragraph (1) for resolution through the 
participant’s dispute resolution process. 
(B) The dispute submitted under para-
graph (1) is not resolved—
(i) within 60 days after submission of 
the dispute by the consumer; or 
(ii) to the satisfaction of the con-
sumer. 
(C) Notice of the facts of the dispute is 
submitted to the Commission not later than 30 
days after the date on which the consumer is
notified of the resolution through the partici-
pant’s dispute resolution process. 
(D) The consumer has not voluntarily ac-
cepted a resolution of the dispute under para-
graph (1). 
(E) The dispute was not resolved through 
binding arbitration. 
(3) LIMITATION.—Nothing in this Act shall 
prevent the Commission from investigating compli-
ance with this Act by a participant in a self-regu-
latory organization based upon a complaint from an 
individual or organization other than a consumer 
with a dispute with such participant, or on its own 
initiative, except that prior to instituting any such 
investigation the Commission shall afford the self-
regulatory organization a reasonable opportunity to 
invoke its own remedial procedures and assure com-
pliance by the participant. 
(4) CLEAR AND CONVINCING EVIDENCE.—The 
presumption established by paragraph (1) of sub-
section (a) may be overcome by clear and convincing 
evidence of non-compliance. 
(e) NONRELEASE OF CERTAIN INFORMATION.—The 
Commission may not compel a participant in a self-regu-
latory program approved under subsection (b) (or an ad-
ministrator of such a program) to provide proprietary in-
formation or personally identifiable information of con-
sumers to the Commission unless the Commission provides 
assurances that such information will not be released to 
the public. 
(f) MISREPRESENTATION
OF
SELF-REGULATORY 
PROGRAM PARTICIPATION.—It is unlawful for a data col-
lection organization to misrepresent that it is a participant 
in a self-regulatory program (including through any mech-
anism provided under subsection (c)(4)) when such orga-
nization is not, in fact, such a participant. 
(g) EXEMPTED ENTITY PARTICIPATION.—An entity 
that is not a data collection organization and that volun-
tarily participates in a self-regulatory program under this 
section shall enjoy the rights and benefits provided under 
this section in any action or investigation under section 
5 of the Federal Trade Commission Act (15 U.S.C. 45) 
to the extent that such action or investigation pertains to 
the entity’s privacy policy or practices required for partici-
pation in the self-regulatory program. 
SEC. 107. ENFORCEMENT. 
(a) UNFAIR OR DECEPTIVE ACT OR PRACTICE.—A 
violation of any provision of this title by a data collection 
organization is an unfair or deceptive act or practice un-
lawful under section 5(a)(1) of the Federal Trade Com-
mission Act (15 U.S.C. 45(a)(1)), except that the amount 
of any civil penalty under such Act shall be doubled for 
a violation of this title, but may not exceed $500,000 for 
all related violations by a single violator (without respect 
to the number of consumers affected or the duration of 
the related violations). 
(b) GUIDELINES AND OPINIONS.—In order to assist 
in compliance with this title, the Federal Trade Commis-
sion may promulgate regulations and interpretive rules 
under section 18 of the Federal Trade Commission Act 
(15 U.S.C. 57a), with respect to specific types of acts or 
practices that would, or would not, comply with this title. 
SEC. 108. NO PRIVATE RIGHT OF ACTION. 
This title may not be considered or construed to pro-
vide any private right of action. No private civil action 
relating to any act or practice governed under this title 
may be commenced or maintained in any State court or 
under State law (including a pendent State claim to an 
action under Federal law). 
SEC. 109. EFFECT ON OTHER LAWS. 
(a) QUALIFIED EXEMPTION FOR COMPLIANCE WITH 
OTHER FEDERAL PRIVACY LAWS.—To the extent that 
personally identifiable information protected under this 
title is also protected under a provision of Federal privacy 
law described in subsection (c), a data collection organiza-
tion that complies with the relevant provision of such other 
Federal privacy law shall be deemed to have complied with 
the corresponding provision of this title. 
(b) PROTECTION
OF OTHER FEDERAL PRIVACY 
LAWS.—Nothing in this title may be construed to modify, 
limit, or supersede the operation of the Federal privacy 
laws described in subsection (c) or the provision of infor-
mation permitted or required, expressly or by implication, 
by such laws, with respect to Federal rights and practices. 
(c) OTHER FEDERAL PRIVACY LAWS DESCRIBED.—
The provisions of law to which subsections (a) and (b) 
apply are the following: 
(1) Section 552a of title 5, United States Code 
(commonly known as the Privacy Act of 1974). 
(2) The Right to Financial Privacy Act of 1978 
(12 U.S.C. 3401 et seq.). 
(3) The Fair Credit Reporting Act (15 U.S.C. 
1681 et seq.). 
(4) The Fair Debt Collection Practices Act (15 
U.S.C. 1692 et seq.). 
(5) The Children’s Online Privacy Protection 
Act of 1998 (15 U.S.C. 6501 et seq.). 
(6) Title V of the Gramm-Leach-Bliley Act of 
1999 (15 U.S.C. 6801 et seq.).
(7) The Electronic Communications Privacy Act 
of 1986 (Public Law 99–508). 
(8) The Driver’s Privacy Protection Act of 
1994 (18 U.S.C. 2721 et seq.). 
(9) The Family Educational Rights and Privacy 
Act of 1974 (20 U.S.C. 1221 note, 1232g). 
(10) Section 445 of the General Education Pro-
visions Act (20 U.S.C. 1232h). 
(11) The Privacy Protection Act of 1980 (42 
U.S.C. 2000aa et seq.). 
(12) Section 222 of the Communications Act of 
1934 (47 U.S.C. 222) relating to the Customer Pro-
prietary Network Information. 
(13) The Cable Communications Policy Act of 
1984 (47 U.S.C. 521 et seq.). 
(14) The Communications Assistance for Law 
Enforcement Act (47 U.S.C. 1001 et seq.). 
(15) The Video Privacy Protection Act of 1988 
(Public Law 100–618). 
(16) The Telephone Consumer Protection Act 
of 1991 (Public Law 102–243). 
(17) The Health Insurance Portability and Ac-
countability Act of 1996 (Public Law 104–191), as 
it relates to an entity described in section 1172(a) 
of the Social Security Act (42 U.S.C. 1320d-1(a)) or
to activities regulated under section 1173 of such 
Act (42 U.S.C. 1320d-2). 
(d) PREEMPTION OF STATE PRIVACY LAWS.—This 
title preempts any statutory law, common law, rule, or 
regulation of a State, or a political subdivision of a State, 
to the extent such law, rule, or regulation relates to or 
affects the collection, use, sale, disclosure, retention, or 
dissemination of personally identifiable information in 
commerce. No State, or political subdivision of a State, 
may take any action to enforce this title. 
SEC. 110. EFFECTIVE DATE. 
This title shall apply with respect to personally identi-
fiable information collected on or after the date that is 
1 year after the date of enactment of this Act. 
TITLE II—IDENTITY THEFT 
PREVENTION AND REMEDIES 
SEC. 201. FACILITATING ELECTRONIC IDENTITY THEFT AF-
FIDAVITS. 
The Commission shall take such action as necessary 
to permit (including by electronic means) consumers that 
have a reasonable belief that they are a victim of identity 
theft—
(1) to enter required consumer information in 
the commission-developed document entitled ‘‘Iden-
tity Theft Affidavit’’; and
(2) to submit completed forms and other sup-
plemental information to the Commission and other 
entities. 
SEC. 202. PROMOTING USE OF COMMON IDENTITY THEFT 
AFFIDAVIT. 
The Commission shall take such action as necessary 
to solicit the acceptance and acknowledgement of stand-
ardized Identity Theft Affidavit by entities that receive 
disputes regarding the unauthorized use of accounts of 
such entities from consumers that have reason to believe 
that they are victims of identity theft. 
SEC. 203. TIMELY RESOLUTION OF IDENTITY THEFT DIS-
PUTES. 
The Commission shall require entities that receive 
disputes regarding the unauthorized use of accounts of 
such entities from consumers that have reason to believe 
that they are victims of identity theft to conduct any nec-
essary investigation and decide an outcome of a claim 
within 90 days from the date on which all necessary infor-
mation to investigate the claim has been submitted to the 
entity. 
SEC. 
204. 
IMPROVEMENTS 
TO 
CONSUMER 
CLEARING-
HOUSE. 
The Commission shall utilize the Identity Theft 
Clearinghouse to permit consumers that have a reasonable
belief that they are victims of identity theft to submit any 
information relevant to such identity theft to the Clearing-
house (including by means of an Identity Theft Affidavit), 
so that such information may be transmitted by the Clear-
inghouse to appropriate entities for necessary protective 
action and to mitigate losses resulting from such identity 
theft. 
SEC. 205. IMPROVED IDENTITY THEFT DATA. 
(a) IN GENERAL.—The Commission shall—
(1) establish a process to contact, not less than 
annually, public and private entities that receive and 
process complaints from consumers that have a rea-
sonable belief that they are victims of identity theft; 
and 
(2) obtain accurate data on the incidences and 
nature of complaints from such entities. 
(b) INCLUSION
IN DATABASE.—Such information 
shall be made part of the Commission’s Identity Theft 
Clearinghouse database. 
SEC. 206. CHANGE OF ADDRESS PROTECTIONS. 
The Commission shall require appropriate entities to 
take reasonable steps to verify the accuracy of a con-
sumer’s address, including by confirming a consumer’s 
change of address by sending a confirmation of such 
change to the old and the new address of the consumer.
SEC. 207. EFFECTIVE DATE. 
This title shall take effect 180 days after the date 
of enactment of this Act. 
TITLE III—INTERNATIONAL 
PROVISIONS 
SEC. 301. STUDY BY COMPTROLLER GENERAL. 
The Comptroller General of the United States shall 
conduct a study and issue a report analyzing the impact 
on the interstate and foreign commerce of the United 
States of information privacy laws, regulations, or agree-
ments enacted, promulgated, or adopted by other nations, 
including regional or international agreements between 
nations, and whether the enforcement mechanisms or pro-
cedures of those laws, regulations, or agreements result 
in discriminatory treatment of United States entities. The 
first report under this section shall be issued not later 
than 120 days after the date of enactment of this Act and 
subsequent reports shall be issued every 3 years there-
after. 
SEC. 302. REMEDIATION OF DISCRIMINATORY IMPACT BY 
SECRETARY OF COMMERCE. 
If the Comptroller General of the United States finds, 
in the study and report under section 301, that such infor-
mation privacy laws, regulations, or agreements substan-
tially impede interstate and foreign commerce of the 
United States and that the enforcement mechanisms or
procedures of the information privacy laws, regulations, 
or agreements described in such subsection result in dis-
criminatory treatment of United States entities, the Sec-
retary of Commerce shall, to the extent permitted by law 
take all steps necessary to mitigate against such discrimi-
natory impact within 180 days after the report making 
such findings is issued. 
SEC. 303. EFFECT OF NONREMEDIATION. 
(a) RECOMMENDATIONS.—If by the end of the 180-
day period described in section 302, the Secretary of Com-
merce has not attained complete relief from the discrimi-
natory impact described in such subsection, the Secretary 
shall report to the Congress and the President rec-
ommendations on action to relieve any such remaining dis-
criminatory impact. 
(b) FEDERAL AGENCY ACTION AFTER CONSIDER-
ATION BY CONGRESS.—During the period after the Sec-
retary reports recommendations under subsection (a) for 
mitigation of discriminatory impact and before the Con-
gress acts with respect to such recommendations, no offi-
cer or employee of any Federal agency may take or con-
tinue any action to enjoin, or impose any penalty on, a 
United States entity, or a citizen or legal resident of the 
United States, for the purpose of fulfilling an international 
obligation of the United States under an international pri-
vacy agreement (other than such an obligation under a 
ratified treaty) that resulted in such discriminatory im-
pact. 
SEC. 304. HARMONIZATION OF INTERNATIONAL PRIVACY 
LAWS, REGULATIONS, AND AGREEMENTS. 
Beginning on the date of enactment of this Act, the 
Secretary of Commerce shall provide notice of the provi-
sions of this Act to other nations, individually, or as mem-
bers of international organizations or unions that have en-
acted, promulgated, or adopted information privacy laws, 
regulations, or agreements, and shall seek recognition of 
this Act by such nations, organizations, or unions. The 
Secretary shall seek the harmonization of this Act with 
such information privacy laws, regulations, or agreements, 
to the extent such harmonization is necessary for the ad-
vancement of transnational commerce, including electronic 
commerce.
Æ