have occurred, or is unavoidable, with re-
spect to such information, the third party 
shall be obligated— 
‘‘(A) to provide notice of the poten-
tial breach to the consumer reporter; 
‘‘(B) to conduct a coordinated in-
vestigation with the consumer re-
porter to identify the sensitive finan-
cial personal information involved 
and determine if the potential breach 
is reasonably likely to result in harm 
or inconvenience to any consumer to 
whom the information relates; and 
‘‘(C) provide any notices required 
under this section, except to the extent 
that such notices are provided by the 
consumer reporter in a manner meet-
ing the requirements of this section. 
‘‘(f) CONSUMER NOTICE.— 
‘‘(1) POTENTIAL
IDENTITY
THEFT
RISK 
AND
FRAUDULENT
TRANSACTION
RISK.—A 
consumer reporter shall provide a con-
sumer notice if, at any point the consumer 
reporter becomes aware— 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00084
Fmt 6652
Sfmt 6204
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
‘‘(A) that a breach of data security 
is reasonably likely to have occurred 
or be unavoidable, with respect to sen-
sitive financial personal information 
handled by the consumer reporter; 
‘‘(B) of information reasonably 
identifying the nature and scope of 
the breach; and 
‘‘(C) that such information is rea-
sonably likely to have been or to be 
misused in a manner causing harm or 
inconvenience against the consumers 
to whom such information relates to— 
‘‘(i) commit identity theft if the 
information is sensitive financial 
identity information, or 
‘‘(ii) make fraudulent trans-
actions on such consumers’ finan-
cial accounts if the information is 
sensitive financial account infor-
mation. 
‘‘(2) SECURITY
PROGRAM
SAFEGUARDS 
AND REGULATIONS.— 
‘‘(A) STANDARDS FOR SAFEGUARDS.— 
The regulators described in subsection 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00085
Fmt 6652
Sfmt 6204
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
(k)(1) shall issue guidelines relating 
to the types of sophisticated neural 
networks and security programs that 
are likely to detect fraudulent account 
activity and at what point detection of 
such activity is sufficient to avoid con-
sumer notice under this subsection. 
‘‘(B) ALTERNATIVE SAFEGUARDS.—In 
determining the likelihood of misuse 
of sensitive financial account infor-
mation and whether a notice is re-
quired under paragraph (1), the con-
sumer reporter may additionally con-
sider— 
‘‘(i) consistent with any stand-
ards promulgated under subpara-
graph (A), whether any neural 
networks or security programs 
used by, or on behalf of, the con-
sumer reporter have detected, or 
are likely to detect on an ongoing 
basis over a reasonable period of 
time, fraudulent transactions re-
sulting from the breach of data se-
curity; or 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00086
Fmt 6652
Sfmt 6204
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
‘‘(ii) whether no harm or in-
convenience is reasonably likely to 
have occurred, because for exam-
ple the related consumer account 
has been closed or its number has 
been changed. 
‘‘(3) COORDINATION WITH THE FAIR DEBT 
COLLECTION PRACTICES ACT.—The provision 
of a notice to the extent such notice and 
its contents are required under this sec-
tion shall not be considered a communica-
tion under the Fair Debt Collection Prac-
tices Act. 
‘‘(4) COORDINATION
OF
CONSUMER
NO-
TICE DATABASE.— 
‘‘(A) IN GENERAL.—The Commission 
shall coordinate with the other gov-
ernment entities identified in this sec-
tion to create a publicly available list 
of data security breaches that have 
triggered a notice to consumers under 
this subsection within the last 12 
months. 
‘‘(B) 
LISTED
INFORMATION.—The 
publicly available list described in 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00087
Fmt 6652
Sfmt 6204
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS
subparagraph (A) shall include the 
following: 
‘‘(i) The identity of the party 
responsible 
that 
suffered 
the 
breach. 
‘‘(ii) A general description of 
the 
nature 
and 
scope 
of 
the 
breach. 
‘‘(iii) Any financial fraud miti-
gation or other services provided 
by such party to the affected con-
sumers, including the telephone 
number and other appropriate 
contact information for accessing 
such services. 
‘‘(g) TIMING, CONTENT, AND MANNER OF NO-
TICES.— 
‘‘(1) DELAY
OF
NOTICE
FOR
LAW
EN-
FORCEMENT PURPOSES.—If a consumer re-
porter receives a written request from an 
appropriate law enforcement agency indi-
cating that the provision of a notice 
under subsection (c)(3) or (f) would im-
pede a criminal or civil investigation by 
that law enforcement agency, or an oral 
VerDate Aug 31 2005 
02:49 Jun 03, 2006
Jkt 049200
PO 00000
Frm 00088
Fmt 6652
Sfmt 6204
E:\BILLS\H4127.RH
H4127
bajohnson on PROD1PC72 with BILLS