I 
109TH CONGRESS 
1ST SESSION H. R. 1263 
To protect and enhance consumer privacy, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MARCH 10, 2005 
Mr. STEARNS introduced the following bill; which was referred to the Com-
mittee on Energy and Commerce, and in addition to the Committee on 
International Relations, for a period to be subsequently determined by the 
Speaker, in each case for consideration of such provisions as fall within 
the jurisdiction of the committee concerned 
A BILL 
To protect and enhance consumer privacy, and for other 
purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Consumer Privacy Pro-
tection Act of 2005’’. 
SEC. 2. TABLE OF CONTENTS. 
The table of contents for this Act is as follows: 
Sec. 1. Short title. 
Sec. 2. Table of contents. 
Sec. 3. Definitions.
TITLE I—PROTECTION OF INDIVIDUAL PRIVACY IN INTERSTATE 
COMMERCE 
Sec. 101. Privacy notices to consumers. 
Sec. 102. Privacy policy statements. 
Sec. 103. Consumer opportunity to limit sale or disclosure of information. 
Sec. 104. Consumer opportunity to limit other information practices. 
Sec. 105. Information security obligations. 
Sec. 106. Self-regulatory programs. 
Sec. 107. Enforcement. 
Sec. 108. No private right of action. 
Sec. 109. Effect on other laws. 
Sec. 110. Effective date. 
TITLE II—IDENTITY THEFT PREVENTION AND REMEDIES 
Sec. 201. Facilitating electronic identity theft affidavits. 
Sec. 202. Promoting use of common identity theft affidavit. 
Sec. 203. Timely resolution of identity theft disputes. 
Sec. 204. Improvements to consumer clearinghouse. 
Sec. 205. Improved identity theft data. 
Sec. 206. Change of address protections. 
Sec. 207. Effective date. 
TITLE III—INTERNATIONAL PROVISIONS 
Sec. 301. Study by Comptroller General. 
Sec. 302. Remediation of discriminatory impact by Secretary of Commerce. 
Sec. 303. Effect of nonremediation. 
Sec. 304. Harmonization of international privacy laws, regulations, and agree-
ments. 
SEC. 3. DEFINITIONS. 
In this Act: 
(1) The term ‘‘Commission’’ means the Federal 
Trade Commission. 
(2) The term ‘‘consumer’’ means an individual 
acting in the individual’s personal, family, or house-
hold capacity. 
(3)(A) The term ‘‘data collection organization’’ 
means an entity (or an agent or affiliate of the enti-
ty) that collects (by any means, through any me-
dium), sells, discloses for consideration, or uses per-
sonally identifiable information of the consumer. 
(B) Such term does not include— 
(i) a governmental agency; 
(ii) a not-for-profit entity, to the extent 
that personally identifiable information is not 
used for a commercial purpose; 
(iii) an entity that— 
(I) has annual gross revenue under 
$1,000,000 (based on the value of such 
amount in fiscal year 2000, adjusted for 
current dollars); 
(II) has fewer than 25 employees; 
(III) collects or uses personally identi-
fiable information from fewer than 1,000 
consumers for a purpose unrelated to a 
transaction with the consumer; 
(IV) does not process personally iden-
tifiable information of consumers; and 
(V) does not sell or disclose for con-
sideration such information to another per-
son; 
(iv) a provider of professional services, or 
any affiliate thereof, to the extent that such 
provider is obligated by rules of professional
ethics, or by applicable law or regulation, not to 
voluntarily disclose confidential client informa-
tion without the consent of the client; or 
(v) a data processing outsourcing entity. 
(4)(A) The term ‘‘personally identifiable infor-
mation’’, with respect to a data collection organiza-
tion means individually identifiable information re-
lating to a living individual who can be identified 
from that information. 
(B) Such term includes— 
(i) first and last name, whether given at 
birth or adoption, assumed, or legally changed; 
(ii) home or other physical address includ-
ing street name and name of a city or town; 
(iii) electronic mail address; 
(iv) telephone number; 
(v) social security number; or 
(vi) any other unique identifying informa-
tion that a data collector and processor collects 
and combines with any information described in 
the preceding subparagraphs of this paragraph. 
(C) Such term does not include— 
(i) anonymous or aggregate data, or any 
other information that does not identify a 
unique living individual;
(ii) information about a consumer inferred 
from data maintained about a consumer; or 
(iii) information about a consumer ob-
tained from a public record. 
(5) The term ‘‘affiliate’’ means any company 
that controls, is controlled by, or is under common 
control with another company. 
(6) The term ‘‘information-sharing affiliate’’ 
means any affiliate that is under common control 
with a data collection organization, and is contrac-
tually obligated to comply with the practices enu-
merated under the privacy policy statement of the 
organization required under section 102. 
(7) The term ‘‘data processing outsourcing enti-
ty’’ means, with respect to a data collection organi-
zation, a non-affiliated entity that— 
(A) provides information technology proc-
essing, Web hosting, or telecommunications 
services to the data collection organization; 
(B) is contractually obligated to comply 
with security controls specified by the data col-
lection organization; and 
(C) has no right to use the data collection 
organization’s personally identifiable informa-
tion other than for performing data processing
outsourcing services for the data collection or-
ganization or as required by law. 
(8) The term ‘‘process’’, with respect to person-
ally identifiable information, means any value-added 
activity performed on data by automated means. 
(9) The term ‘‘transaction’’ means an inter-
action between a consumer and a data collection or-
ganization resulting in— 
(A) any use of information that is nec-
essary to complete the interaction in the course 
of which information is collected, or to maintain 
the provisioning of a good or service requested 
by the consumer, including use— 
(i) to approve, guarantee, process, ad-
minister, complete, enforce, provide, or 
market a product, service, account, benefit, 
transaction, or payment method that is re-
quested or approved by the consumer; or 
(ii) to deliver goods, services, funds, 
or other consideration to, or on behalf of, 
the consumer; 
(B) any disclosure of information that is 
necessary for the consumer to enforce any right 
of the consumer;
(C) any disclosure of information that is 
required by law or by a court order; and 
(D) any use of information to verify per-
sonally identifiable information by the con-
sumer, evaluate, detect, or reduce the risk of 
fraud or other criminal activity, or other risk- 
management activities. 
(10) The term ‘‘display’’ means intentionally 
communicating or otherwise making available (on 
the Internet or in any other manner) to another per-
son. 
(11) The term ‘‘public record’’ means any item, 
collection, or grouping of information about an indi-
vidual that is maintained by a Federal, State, or 
local government entity and that is made available 
to the public. 
(12) The term ‘‘purchase’’ means providing, di-
rectly or indirectly, anything of value in exchange 
for a good or service. 
(13) The term ‘‘State’’ includes the several 
States, the District of Columbia, the Commonwealth 
of Puerto Rico, the Commonwealth of the Northern 
Mariana Islands, American Samoa, Guam, the Vir-
gin Islands, the Freely Associated States, and any 
other territory or possession of the United States.
TITLE I—PROTECTION OF INDI-
VIDUAL PRIVACY IN INTER-
STATE COMMERCE 
SEC. 101. PRIVACY NOTICES TO CONSUMERS. 
(a) NOTICE REQUIRED.—A data collection organiza-
tion shall provide to a consumer a notice containing the 
information required under subsection (b) as follows: 
(1) Upon the first instance of collection from 
the consumer of personally identifiable information, 
that may be used for a purpose unrelated to the 
transaction, by a data collection organization, the or-
ganization shall provide the notice at the time per-
sonally identifiable information is collected. 
(2) Upon a material change in the organiza-
tion’s privacy policy under section 102(a), the orga-
nization shall provide the notice, not later than the 
first time after such change in policy that the orga-
nization seeks to collect, sell, disclose for consider-
ation, or use personally identifiable information to 
the extent practicable, to each consumer from whom 
the organization has collected such information. 
(b) FORM AND CONTENTS OF NOTICE.—A notice re-
quired under subsection (a) shall be provided in a clear 
and conspicuous manner, be prominently displayed or ex-
plicitly stated to the consumer, and contain the following 
information: 
(1) A statement that the personal information 
collected by the data collection organization may be 
used or disclosed for purposes or transactions unre-
lated to that for which it was collected, as described 
in the organization’s privacy statement. 
(2) A description of the manner in which the 
consumer may obtain a privacy policy statement that 
meets the requirements of section 102, which may 
include providing the consumer with an Internet 
website, a hyperlink to such a website, or a toll-free 
telephone number from which such a statement may 
be obtained. If the notice required under subsection 
(a) is provided to the consumer by means of an 
Internet website, one manner in which the consumer 
may obtain the privacy policy statement must be by 
means of an Internet website. 
(3) If the notice is required under subsection 
(a)(2), a statement that there has been a material 
change in the organization’s privacy policy. 
SEC. 102. PRIVACY POLICY STATEMENTS. 
(a) PRIVACY POLICY.—A data collection organization 
shall establish a privacy policy with respect to the collec-
tion, sale, disclosure for consideration, dissemination, use,
and security of the personally identifiable information of 
consumers, the principal elements of which shall be em-
bodied in a privacy policy statement (or statements) that 
meets the requirements of subsection (b). 
(b) STATEMENT.—The statement (or statements) re-
quired under subsection (a) shall meet the following re-
quirements: 
(1) The statement must be brief, concise, clear, 
and conspicuous and written in plain language. 
(2) The statement must be accessible to all con-
sumers of the data collection organization (regard-
less of the means by which a consumer conducts a 
transaction with the organization)— 
(A) at no charge to the consumer; and 
(B) at the time the data collection organi-
zation first collects personally identifiable infor-
mation about the consumer that may be used 
for a purpose unrelated to a transaction with 
the consumer and subsequently. 
(3) The statement must disclose only the fol-
lowing: 
(A) The identity of each data collection or-
ganization, or a description of each class or 
type of data collection organization, that may 
collect or use the information.
(B) The types of information that may be 
collected or used. 
(C) How the information may be used. 
(D) Whether the consumer is required to 
provide the information in order to do business 
with the data collection organization. 
(E) The extent to which the information is 
subject to sale or disclosure for consideration to 
a data collection organization that is not an in-
formation-sharing affiliate of the data collection 
organization providing the statement, includ-
ing— 
(i) a clear and prominent statement of 
the fact that the information is subject to 
such sale or disclosure for consideration; 
(ii) a description of each class or type 
of data collection organization to which the 
information may be sold or disclosed for 
consideration; 
(iii) to the extent practicable, the pur-
pose for which the information may be 
used; and 
(iv) the types of information that may 
be sold or disclosed for consideration.