I 
108TH CONGRESS 
1ST SESSION H. R. 3233
To require financial institutions and financial service providers to notify 
customers of the unauthorized use of personal information, to amend 
the Fair Credit Reporting Act to require fraud alerts to be included 
in consumer credit files in such cases, and to provide customers with 
enhanced access to credit reports in such cases. 
IN THE HOUSE OF REPRESENTATIVES 
OCTOBER 2, 2003
Mr. GUTIERREZ introduced the following bill; which was referred to the 
Committee on Financial Services 
A BILL 
To require financial institutions and financial service pro-
viders to notify customers of the unauthorized use of 
personal information, to amend the Fair Credit Report-
ing Act to require fraud alerts to be included in con-
sumer credit files in such cases, and to provide customers 
with enhanced access to credit reports in such cases.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Identity Theft Notifi-
cation and Credit Restoration Act of 2003’’.
SEC. 2. FINDINGS. 
The Congress finds as follows: 
(1) The privacy and financial security of indi-
viduals is increasingly at risk due to the ever more 
widespread collection of personal information by 
both the private and public sector. 
(2) Credit card transactions, real estate 
records, consumer surveys, credit reports, and Inter-
net websites are all sources of personal information 
and form the source material for identity thieves. 
(3) Identity theft is one of the fastest growing 
crimes committed in the United States, and identity 
theft has become one of the major law enforcement 
challenges of the new economy, as vast quantities of 
sensitive personal information are now vulnerable to 
criminal interception and misuse. 
(4) Criminals who steal personal information 
use the information to open fraudulent credit card 
accounts, write bad checks, buy products, and com-
mit other financial crimes with assumed financial 
identities. 
(5) In September of 2003, the Federal Trade 
Commission 
released 
a 
survey 
showing 
that 
27,300,000 Americans have been victims of identity 
theft in the last 5 years, including 9,900,000 people 
in the last year alone.
(6) According to the survey, last year’s identity 
theft losses to businesses and financial institutions 
totaled nearly $48,000,000,000 and consumer vic-
tims reported $5,000,000,000 in out-of-pocket ex-
penses. 
(7) Identity theft is costly to consumers and to 
the United States marketplace. 
(8) Victims of identity theft are often required 
to contact numerous Federal, State, and local law 
enforcement agencies, consumer credit reporting 
agencies, and creditors over many years, as each 
event of fraud arises. 
(9) The Federal Government, financial institu-
tions, financial service providers, and credit report-
ing agencies that handle sensitive personal informa-
tion of consumers have a shared responsibility to 
protect the information from identity thieves, to as-
sist identity theft victims, and to mitigate the harm 
that results from fraud perpetrated in the name of 
the victim. 
(10) The private sector can better protect con-
sumers by improving customer notification, imple-
menting effective fraud alerts, affording greater con-
sumer access to credit reports, and establishing 
other financial identity theft prevention measures.
SEC. 3. TIMELY NOTIFICATION OF UNAUTHORIZED ACCESS 
TO PERSONAL INFORMATION. 
Subtitle B of title V of the Gramm-Leach-Bliley Act 
(15 U.S.C. 6821 et seq.) is amended—
(1) by redesignating sections 526 and 527 as 
sections 528 and 529, respectively; and 
(2) by inserting after section 525 the following: 
‘‘SEC. 526. NOTIFICATION TO CUSTOMERS OF UNAUTHOR-
IZED ACCESS TO PERSONAL INFORMATION. 
‘‘(a) DEFINITIONS.—For purposes of this section, the 
following definitions shall apply: 
‘‘(1) BREACH.—The term ‘breach’—
‘‘(A) means unauthorized acquisition of 
computerized data or paper records which com-
promises the security, confidentiality, or integ-
rity of personal information maintained by or 
on behalf of a financial institution; and 
‘‘(B) does not include a good faith acquisi-
tion of personal information by an employee or 
agent of a financial institution for a business 
purpose of the institution, if the personal infor-
mation is not subject to further unauthorized 
disclosure; and 
‘‘(2) PERSONAL
INFORMATION.—With respect 
to a customer of a financial institution, the term 
‘personal information’ means the first name or first
initial and last name of the customer, in combina-
tion with any 1 or more of the following data ele-
ments, when either the name or the data element is 
not encrypted: 
‘‘(A) A social security number. 
‘‘(B) A driver’s license number or other of-
ficially recognized form of identification. 
‘‘(C) A credit card number, debit card 
number, or any required security code, access 
code, or password that would permit access to 
financial account information relating to that 
customer. 
‘‘(b) NOTIFICATION RELATING TO BREACH OF PER-
SONAL INFORMATION.—
‘‘(1) FINANCIAL INSTITUTION REQUIREMENT.—
In any case in which there has been a breach of per-
sonal information at a financial institution, or such 
a breach is reasonably believed to have occurred, the 
financial institution shall promptly notify—
‘‘(A) each customer affected by the viola-
tion or suspected violation; 
‘‘(B) each consumer reporting agency de-
scribed in section 603(p) of the Fair Credit Re-
porting Act; and
‘‘(C) appropriate law enforcement agencies, 
in any case in which the financial institution 
has reason to believe that the breach or sus-
pected breach affects a large number of cus-
tomers, including as described in subsection 
(e)(1)(C), subject to regulations of the Federal 
Trade Commission. 
‘‘(2) OTHER ENTITIES.—For purposes of para-
graph (1), any person that maintains personal infor-
mation for or on behalf of a financial institution
shall promptly notify the financial institution of any 
case in which such customer information has been, 
or is reasonably believed to have been, breached. 
‘‘(c) TIMING.—Any notification required by this sec-
tion shall be made—
‘‘(1) promptly and without unreasonable delay, 
upon discovery of the breach or suspected breach; 
and 
‘‘(2) consistent with—
‘‘(A) the legitimate needs of law enforce-
ment, as provided in subsection (d); and 
‘‘(B) any measures necessary to determine 
the scope of the breach or restore the reason-
able integrity of the information security system 
of the financial institution.
‘‘(d) DELAYS FOR LAW ENFORCEMENT PURPOSES.—
Any notification required by this section may be delayed 
if a law enforcement agency determines that the notifica-
tion would impede a criminal investigation, and in any 
such case, notification shall be made promptly after the 
law enforcement agency determines that it would not com-
promise the investigation. 
‘‘(e) FORM OF NOTICE.—Any notification required by 
this section may be provided—
‘‘(1) to a customer—
‘‘(A) in writing; 
‘‘(B) in electronic form, if the notice pro-
vided is consistent with the provisions regarding 
electronic records and signatures set forth in 
section 101 of the Electronic Signatures in 
Global and National Commerce Act; 
‘‘(C) if the Federal Trade Commission de-
termines that the number of all customers af-
fected by, or the cost of providing notifications 
relating to, a single breach or suspected breach 
would make other forms of notification prohibi-
tive, or in any case in which the financial insti-
tution certifies in writing to the Federal Trade 
Commission that it does not have sufficient cus-
‘‘(A) credit reporting agencies have been 
notified of the relevant breach or suspected 
breach; and 
‘‘(B) the credit report and file of the cus-
tomer will contain a fraud alert to make credi-
tors aware of the breach or suspected breach, 
and to inform creditors that the express author-
ization of the customer is required for any new 
issuance or extension of credit (in accordance 
with section 605(g) of the Fair Credit Report-
ing Act); and 
‘‘(2) such other information as the Federal 
Trade Commission determines is appropriate. 
‘‘(g) COMPLIANCE.—Notwithstanding subsection (e), 
a financial institution shall be deemed to be in compliance 
with this section if— 
‘‘(1) the financial institution has established a 
comprehensive information security program that is 
consistent with the standards prescribed by the ap-
propriate regulatory body under section 501(b); 
‘‘(2) the financial institution notifies affected 
customers and consumer reporting agencies in ac-
cordance with its own internal information security 
policies in the event of a breach or suspected breach 
of personal information; and
‘‘(3) such internal security policies incorporate 
notification procedures that are consistent with the 
requirements of this section and the rules of the 
Federal Trade Commission under this section. 
‘‘(h) CIVIL PENALTIES.—
‘‘(1) DAMAGES.—Any customer injured by a 
violation of this section may institute a civil action 
to recover damages arising from that violation. 
‘‘(2) INJUNCTIONS.—Actions of a financial in-
stitution in violation or potential violation of this 
section may be enjoined. 
‘‘(3) CUMULATIVE
EFFECT.—The rights and 
remedies available under this section are in addition 
to any other rights and remedies available under ap-
plicable law. 
‘‘(i) RULES OF CONSTRUCTION.—
‘‘(1) IN GENERAL.—Compliance with this sec-
tion by a financial institution shall not be construed 
to be a violation of any provision of subtitle A, or 
any other provision of Federal or State law prohib-
iting the disclosure of financial information to third 
parties. 
‘‘(2) LIMITATION.—Except as specifically pro-
vided in this section, nothing in this section requires 
or authorizes a financial institution to disclose infor-
mation that it is otherwise prohibited from disclosing 
under subtitle A or any other provision of Federal 
or State law. 
‘‘(3) NO NEW RECORDKEEPING OBLIGATION.—
No provision of this section shall be construed as 
creating an obligation on the part of a financial in-
stitution to obtain, retain, or maintain information 
or records that are not otherwise required to be ob-
tained, retained, or maintained in the ordinary 
course of business of the financial institution or 
under other applicable law.’’. 
SEC. 4. INCLUSION OF FRAUD ALERTS IN CONSUMER 
CREDIT REPORTS. 
Section 605 of the Fair Credit Reporting Act (15 
U.S.C. 1681c) is amended by adding at the end the fol-
lowing: 
‘‘(g) FRAUD ALERTS.—
‘‘(1) DEFINED
TERM.—For purposes of this 
subsection, the term ‘fraud alert’ means a clear and 
conspicuous statement in the file of a consumer that
notifies all prospective users of the consumer credit 
report (or any portion thereof) relating to the con-
sumer, that—
‘‘(A) the identity of the consumer may 
have been used, without the consent of the con-
sumer, to fraudulently obtain goods or services 
in the name of the consumer; and 
‘‘(B) the consumer does not authorize the 
issuance or extension of credit in the name of 
the consumer, unless the issuer of such credit, 
upon receiving appropriate evidence of the true 
identity of the consumer—
‘‘(i) obtains express preauthorization 
from the consumer at a telephone number 
designated by the consumer; or 
‘‘(ii) utilizes another reasonable means 
of communication to obtain the express 
preauthorization of the consumer. 
‘‘(2) INCLUSION
OF
FRAUD
ALERT
IN
CON-
SUMER FILE.—
‘‘(A) UPON NOTIFICATION BY FINANCIAL 
INSTITUTION.—A consumer reporting agency 
shall include a fraud alert meeting the require-
ments of this subsection in the file of a con-
sumer promptly upon receipt of a notice from 
a 
financial 
institution 
under 
section 
526(b)(1)(B) of the Gramm-Leach-Bliley Act 
relating to the consumer. 
‘‘(B) UPON REQUEST OF CONSUMER.—A 
consumer reporting agency shall include a fraud
alert meeting the requirements of this sub-
section in the file of a consumer promptly upon 
receipt of—
‘‘(i) a request by the consumer; and 
‘‘(ii) appropriate evidence of—
‘‘(I) the true identity of the per-
son making the request; and 
‘‘(II) the claim of identity theft 
forming the basis for the request. 
‘‘(3) CONSUMER REPORTING AGENCY RESPON-
SIBILITIES.—A consumer reporting agency shall en-
sure that each person procuring consumer credit in-
formation with respect to a consumer is made aware 
of the existence of a fraud alert in the file of that 
consumer, regardless of whether a full credit report, 
credit score, or summary report is requested. 
‘‘(4) REMOVAL OF FRAUD ALERTS.—The Fed-
eral Trade Commission shall issue appropriate regu-
lations to establish—
‘‘(A) the duration of fraud alerts required 
by this subsection, which standard shall be ap-
plied consistently to all consumer reporting 
agencies, to the extent possible; and
‘‘(B) procedures for the removal of fraud 
alerts included in the files of consumers under 
this subsection. 
‘‘(5) VIOLATIONS.—
‘‘(A) CONSUMER REPORTING AGENCY.—A 
consumer reporting agency that fails to notify 
any user of a consumer credit report of the ex-
istence of a fraud alert in that report shall be 
in violation of this section. 
‘‘(B) USER OF A CONSUMER REPORT.—A 
user of a consumer report that fails to comply 
with preauthorization procedures contained in a 
fraud alert in the file of a consumer and issues 
or extends credit in the name of the consumer 
to a person other than the consumer shall be in 
violation of this subsection. 
‘‘(C) NO ADVERSE ACTION BASED SOLELY 
ON FRAUD ALERT.—It shall be a violation of 
this title for the user of a consumer report to 
take adverse action with respect to a consumer 
based solely on the inclusion of a fraud alert in 
the file of that consumer, as required by this 
subsection.’’.
SEC. 5. ACCESS TO CREDIT REPORTS AND SCORES. 
(a) NO FEE IN CERTAIN CASES.—Section 612(c) of 
the Fair Credit Reporting Act (15 U.S.C. 1681j(c)) is 
amended to read as follows: 
‘‘(c) NO-COST ACCESS TO CREDIT REPORTS AND 
SCORES.—
‘‘(1) IN
GENERAL.—Upon request of a con-
sumer, and without charge to the consumer, a con-
sumer reporting agency shall make all of the disclo-
sures listed under section 609 to the consumer—
‘‘(A) once during each calendar year; and 
‘‘(B) once every 3 months during the 1-
year period beginning on the date on which a 
fraud alert is included in the file of a consumer 
under section 605(g). 
‘‘(2) FEE
AUTHORIZED.—A credit reporting 
agency may charge a reasonable fee for the costs of 
disclosures under paragraph (1)(B) to the financial 
institution providing the notification that is the basis 
for the subject fraud alert, as required by section 
526(b)(1)(B) of the Gramm-Leach-Bliley Act.’’. 
(b) 
INCLUSION
OF
CREDIT
SCORES.—Section 
609(a)(1) of the Fair Credit Reporting Act (15 U.S.C. 
1681g(a)(1)) is amended by striking ‘‘except that’’ and 
all that follows through ‘‘predictors’’ and inserting ‘‘in-
cluding any credit score’’.
SEC. 6. REGULATIONS. 
Not later than 180 days after the date of enactment 
of this Act, the Federal Trade Commission, after consulta-
tion with Federal banking agencies, the Securities and Ex-
change Commission, and other appropriate financial serv-
ices regulatory agencies, shall issue final regulations to 
carry out the amendments made by this Act.
Æ