I 
117TH CONGRESS 
1ST SESSION 
H. R. 474 
To direct the Federal Trade Commission to review and potentially revise 
its standards for safeguarding customer information to ensure that such 
standards require certain consumer reporting agencies and service pro-
viders of such agencies to maintain sufficient safeguards against cyber 
attacks and related threats, to provide for additional authority to enforce 
such standards with respect to such agencies and providers, and for 
other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JANUARY 25, 2021 
Mr. LIEU introduced the following bill; which was referred to the Committee 
on Financial Services, and in addition to the Committee on Energy and 
Commerce, for a period to be subsequently determined by the Speaker, 
in each case for consideration of such provisions as fall within the juris-
diction of the committee concerned 
A BILL 
To direct the Federal Trade Commission to review and po-
tentially revise its standards for safeguarding customer 
information to ensure that such standards require certain 
consumer reporting agencies and service providers of 
such agencies to maintain sufficient safeguards against 
cyber attacks and related threats, to provide for addi-
tional authority to enforce such standards with respect 
to such agencies and providers, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Sep 11 2014 
15:38 Feb 14, 2021
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H474.IH
H474
pamtmann on DSKBC07HB2PROD with BILLS
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Protecting Consumer 
Information Act of 2021’’. 
SEC. 2. STANDARDS FOR CYBERSECURITY SAFEGUARDS 
FOR CERTAIN CONSUMER REPORTING AGEN-
CIES AND SERVICE PROVIDERS. 
(a) REVIEW
OF STANDARDS; POTENTIAL REVI-
SION.— 
(1) REVIEW.—Not later than 90 days after the 
date of the enactment of this Act, the Commission 
shall complete a review of the standards contained in 
the regulations issued by the Commission under sec-
tion 501 of the Gramm-Leach-Bliley Act (15 U.S.C. 
6801) to determine whether such standards require 
covered consumer reporting agencies and covered 
service providers to maintain sufficient safeguards to 
protect customer records and information against 
cyber attacks and related threats. 
(2) REVISION.—If the Commission determines 
in the review completed under paragraph (1) that 
the standards contained in the regulations issued by 
the Commission under section 501 of the Gramm- 
Leach-Bliley Act (15 U.S.C. 6801) do not require 
covered consumer reporting agencies and covered 
service providers to maintain sufficient safeguards to 
protect customer records and information against 
VerDate Sep 11 2014 
15:38 Feb 14, 2021
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H474.IH
H474
pamtmann on DSKBC07HB2PROD with BILLS
cyber attacks and related threats, not later than 180 
days after the date of the completion of the review, 
the Commission shall, pursuant to section 553 of 
title 5, United States Code, revise such regulations 
so as to provide for standards applicable to covered 
consumer reporting agencies and covered service 
providers that require such agencies and providers to 
maintain sufficient safeguards to protect customer 
records and information against cyber attacks and 
related threats. 
(b) INVESTIGATIONS.— 
(1) INITIAL INVESTIGATION.— 
(A) IN
GENERAL.—Not later than 18 
months after the date described in subpara-
graph (B), the Commission shall complete an 
investigation of each person or entity that, as of 
the date described in such subparagraph, is a 
covered consumer reporting agency or covered 
service provider, to determine whether such 
agency or provider is in compliance with the 
regulations issued by the Commission under 
section 501 of the Gramm-Leach-Bliley Act (15 
U.S.C. 6801). 
(B) DATE
DESCRIBED.—The date de-
scribed in this subparagraph is— 
VerDate Sep 11 2014 
15:38 Feb 14, 2021
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H474.IH
H474
pamtmann on DSKBC07HB2PROD with BILLS
Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding un-
fair or deceptive acts or practices. 
(b) POWERS
OF COMMISSION.—The Commission 
shall enforce, with respect to covered consumer reporting 
agencies and covered service providers, the regulations 
issued by the Commission under section 501 of the 
Gramm-Leach-Bliley Act (15 U.S.C. 6801) in the same 
manner, by the same means, and with the same jurisdic-
tion, powers, and duties as though all applicable terms and 
provisions of the Federal Trade Commission Act (15 
U.S.C. 41 et seq.) were incorporated into and made a part 
of such section. Any covered consumer reporting agency 
or covered service provider that violates such a regulation 
shall be subject to the penalties and entitled to the privi-
leges and immunities provided in the Federal Trade Com-
mission Act. 
SEC. 4. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 
(a) IN GENERAL.—In any case in which the attorney 
general of a State, or an official or agency of a State, 
has reason to believe that an interest of the residents of 
such State has been or is threatened or adversely affected 
by an act or practice by a covered consumer reporting 
agency or covered service provider in violation of a regula-
tion issued by the Commission under section 501 of the 
Gramm-Leach-Bliley Act (15 U.S.C. 6801), the State, as 
VerDate Sep 11 2014 
15:38 Feb 14, 2021
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H474.IH
H474
pamtmann on DSKBC07HB2PROD with BILLS
parens patriae, may bring a civil action on behalf of the 
residents of the State in an appropriate district court of 
the United States to— 
(1) enjoin such act or practice; 
(2) enforce compliance with such regulation; 
(3) obtain damages, restitution, or other com-
pensation on behalf of residents of the State; or 
(4) obtain such other legal and equitable relief 
as the court may consider to be appropriate. 
(b) NOTICE.—Before filing an action under this sec-
tion, the attorney general, official, or agency of the State 
involved shall provide to the Commission a written notice 
of such action and a copy of the complaint for such action. 
If the attorney general, official, or agency determines that 
it is not feasible to provide the notice described in this 
subsection before the filing of the action, the attorney gen-
eral, official, or agency shall provide written notice of the 
action and a copy of the complaint to the Commission im-
mediately upon the filing of the action. 
(c) AUTHORITY OF COMMISSION.— 
(1) IN GENERAL.—On receiving notice under 
subsection (b) of an action under this section, the 
Commission shall have the right— 
(A) to intervene in the action; 
VerDate Sep 11 2014 
15:38 Feb 14, 2021
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H474.IH
H474
pamtmann on DSKBC07HB2PROD with BILLS
(B) upon so intervening, to be heard on all 
matters arising therein; and 
(C) to file petitions for appeal. 
(2) LIMITATION ON STATE ACTION WHILE FED-
ERAL ACTION IS PENDING.—If the Commission or 
the Attorney General of the United States has insti-
tuted a civil action for violation of a regulation 
issued by the Commission under section 501 of the 
Gramm-Leach-Bliley Act (15 U.S.C. 6801) by a cov-
ered consumer reporting agency or covered service 
provider (referred to in this paragraph as the ‘‘Fed-
eral action’’), no State attorney general, official, or 
agency may bring an action under this section dur-
ing the pendency of the Federal action against any 
defendant named in the complaint in the Federal ac-
tion for any violation of such regulation alleged in 
such complaint. 
(d) RULE
OF CONSTRUCTION.—For purposes of 
bringing a civil action under this section, nothing in this 
Act shall be construed to prevent an attorney general, offi-
cial, or agency of a State from exercising the powers con-
ferred on the attorney general, official, or agency by the 
laws of such State to conduct investigations, administer 
oaths and affirmations, or compel the attendance of wit-
VerDate Sep 11 2014 
15:38 Feb 14, 2021
Jkt 019200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H474.IH
H474
pamtmann on DSKBC07HB2PROD with BILLS
nesses or the production of documentary and other evi-
dence. 
SEC. 5. DEFINITIONS. 
In this Act: 
(1) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(2) COVERED
CONSUMER
REPORTING
AGEN-
CY.—The term ‘‘covered consumer reporting agency’’ 
means a consumer reporting agency that compiles 
and maintains files on consumers on a nationwide 
basis (as defined in section 603(p) of the Fair Cred-
it Reporting Act (15 U.S.C. 1681a(p))). 
(3) COVERED SERVICE PROVIDER.—The term 
‘‘covered service provider’’ means any person or enti-
ty that is a service provider (as defined in section 
314.2 of title 16, Code of Federal Regulations) 
through provision of services to a covered consumer 
reporting agency. 
Æ 
VerDate Sep 11 2014 
15:38 Feb 14, 2021
Jkt 019200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6301
E:\BILLS\H474.IH
H474
pamtmann on DSKBC07HB2PROD with BILLS