‘‘(iii) to remove the action to the ap-
propriate United States district court; and
‘‘(iv) to file petitions for appeal.
‘‘(3) INVESTIGATORY
POWERS.—For purposes
of bringing any action under this subsection, no pro-
vision of this subsection shall be construed as pre-
venting the chief law enforcement officer, or an offi-
cial or agency designated by a State, from exercising
the powers conferred on the chief law enforcement
officer or such official by the laws of such State to
conduct investigations or to administer oaths or af-
firmations or to compel the attendance of witnesses
or the production of documentary and other evi-
dence.
‘‘(4) LIMITATION
ON
STATE
ACTION
WHILE
FEDERAL ACTION PENDING.—If a Federal agency or
authority has instituted a civil action for a violation
of this subtitle, no State may, during the pendency
of such action, bring an action under this section
against any defendant named in the complaint of the
Federal agency or authority or such agency for any
violation of this subtitle that is alleged in that com-
plaint.
‘‘(d) DEFINITIONS.—The terms used in subsection
(a)(1) that are not defined in this subtitle or otherwise
defined in section 3(s) of the Federal Deposit Insurance
Act shall have the meaning given to them in section 1(b)
of the International Banking Act of 1978.
‘‘SEC. 505. FAIR CREDIT REPORTING ACT AMENDMENT.
‘‘(a) AMENDMENT.—Section 621 of the Fair Credit
Reporting Act (15 U.S.C. 1681s) is amended—
‘‘(1) in subsection (d), by striking everything
following the end of the second sentence; and
‘‘(2) by striking subsection (e) and inserting in
lieu thereof the following:
‘‘ ‘(e) REGULATORY AUTHORITY.—
‘‘ ‘(1) The Federal banking agencies referred to
in paragraphs (1) and (2) of subsection (b) shall
jointly prescribe such regulations as necessary to
carry out the purposes of this Act with respect to
any persons identified under paragraphs (1) and (2)
of subsection (b).
‘‘ ‘(2) The Administrator of the National Credit
Union Administration shall prescribe such regula-
tions as necessary to carry out the purposes of this
Act with respect to any persons identified under
paragraph (3) of subsection (b).
‘‘ ‘(3) The Federal Trade Commission shall pre-
scribe such regulations as necessary to carry out the
purposes of this Act with respect to any persons
identified under subsection (a).’.
‘‘(b) RELATION TO OTHER PROVISIONS.—Except for
the amendment made by this section, nothing in this title
shall be construed to modify, limit, or supersede the oper-
ation of the Fair Credit Reporting Act, and no inference
shall be drawn on the basis of the provisions of this title
regarding whether information is transaction or experience
information under section 603 of such Act.
‘‘SEC. 506. STATE ELECTION TO PARTICIPATE.
‘‘(a) REGULATIONS.—The Secretary of the Treasury
may promulgate such regulations as may be necessary to
establish the procedures governing whether the election re-
quired under section 504(a)(7) has been made.
‘‘(b) DEADLINE.—The deadline for a State to elect
to become a participating state is the first day of the first
calendar quarter beginning after the close of the first leg-
islative session of the State legislature that begins on or
after the date the regulations required by section 504(a)
are issued in final form. For purposes of the previous sen-
tence, in the case of a State that has a 2-year legislative
session, each year of such session shall be deemed to be
a separate regular session of the State legislature.
‘‘SEC. 507. RELATION TO STATE LAWS.
‘‘(a) IN GENERAL.—This subtitle shall not be con-
strued as superseding, altering, or affecting the statutes,
regulations, orders, or interpretations in effect in any
State, except to the extent that such statutes, regulations,
orders, or interpretations are inconsistent with the provi-
sions of this subtitle, and then only to the extent of the
inconsistency.
‘‘(b) GREATER PROTECTION UNDER STATE LAW.—
For purposes of this section, a State statute, regulation,
order, or interpretation is not inconsistent with the provi-
sions of this subtitle if the protection such statute, regula-
tion, order, or interpretation affords any person is greater
than the protection provided under this subtitle as deter-
mined by the Commission or a Federal functional regu-
lator, on its own motion or upon the petition of any inter-
ested party.
‘‘SEC. 508. DEFINITIONS.
‘‘As used in this subtitle:
‘‘(1) COMMISSION.—The term ‘Commission’
means the Federal Trade Commission.
‘‘(2) FEDERAL FUNCTIONAL REGULATOR.—The
term ‘Federal functional regulator’ means—
‘‘(A) the Board of Governors of the Fed-
eral Reserve System;
‘‘(B) the Office of the Comptroller of the
Currency;
‘‘(C) the Board of Directors of the Federal
Deposit Insurance Corporation;
‘‘(D) the Director of the Office of Thrift
Supervision;
‘‘(E) the National Credit Union Adminis-
tration Board; and
‘‘(F) the Securities and Exchange Commis-
sion.
‘‘(3) FINANCIAL INSTITUTION.—The term ‘fi-
nancial institution’ means any institution the busi-
ness of which is engaging in financial activities or
activities that are incidental or complementary to fi-
nancial activities, as determined under section 4(k)
of the Bank Holding Company Act of 1956.
‘‘(4) NONPUBLIC PERSONAL INFORMATION.—
‘‘(A) The term ‘nonpublic personal infor-
mation’ means personally identifiable financial
information—
‘‘(i) provided by a consumer to a fi-
nancial institution;
‘‘(ii) resulting from any transaction
with the consumer or the service performed
for the consumer; or
‘‘(iii) otherwise obtained by the finan-
cial institution.
‘‘(B) Such term does not include publicly
available information, as such term is defined
by the regulations prescribed under section 504.
‘‘(C) Notwithstanding subparagraph (B),
such term—
(i) shall include any list, description,
or other grouping of consumers (and pub-
licly available information pertaining to
them) that is derived using any personally
identifiable information other than publicly
available information; but
‘‘(ii) shall not include any list, de-
scription, or other grouping of consumers
(and publicly available information per-
taining to them) that is derived without
using any nonpublic personal information.
‘‘(5) DIRECTORY
INFORMATION.—The term
‘publicly available directory information’ means sub-
scriber list information required to be made available
for publication pursuant to section 222(e) of the
Communications Act of 1934 (47 U.S.C. 222(3)).
‘‘(6) UNRELATED
USE.—The term ‘unrelated
use’, when used with respect to information collected
by the financial institution in connection with any
transaction with a consumer in any financial product
or any financial service, means any use other than
a use that is necessary to effect, administer, or en-
force such transaction.
‘‘(7) AFFILIATE.—The term ‘affiliate’ means
any company that controls, is controlled by, or is
under common control with another company.
‘‘(8) NONAFFILIATED THIRD PARTY.—The term
‘nonaffiliated third party’ means any entity that is
not an affiliate of, or related by common ownership
or affiliated by corporate control with, the financial
institution, but does not include a joint employee of
such institution.
‘‘(9) NECESSARY TO EFFECT, ADMINISTER, OR
ENFORCE.—The disclosing or use of nonpublic per-
sonal information shall be treated as necessary to ef-
fect or administer a transaction with a consumer if
the disclosing or use—
‘‘(A) is required, or is a usual, appropriate,
or acceptable method, to carry out the trans-
action or the product or service business of
which the transaction is a part, and record or
service or maintain the consumer’s account in
the ordinary course of providing the financial
service or financial product, or to administer or
service benefits or claims relating to the trans-
action or the product or service business of
which it is a part, and includes—
‘‘(i) providing the consumer or the
consumer’s agent or broker with a con-
firmation, statement, or other record of the
transaction, or information on the status
or value of the financial service or financial
product; and
‘‘(ii) the accrual or recognition of in-
centives or bonuses associated with the
transaction that are provided by the finan-
cial institution or any other party;
‘‘(B) is required, or is one of the lawful or
appropriate methods, to enforce the rights of
the financial institution or of other persons en-
gaged in carrying out the financial transaction,
or providing the product or service;
‘‘(C) is required, or is a usual, appropriate,
or acceptable method, for insurance under-
writing at the consumer’s request or for rein-
surance purposes, or for any of the following
purposes as they relate to a consumer’s insur-
ance: account administration, reporting, inves-
tigating, or preventing fraud or material mis-
representation, processing premium payments,
processing insurance claims, administering in-
surance benefits (including utilization review ac-
tivities), participating in research projects, or as
otherwise required or specifically permitted by
Federal or State law; or
‘‘(D) the disclosure is required, or is a
usual, appropriate or acceptable method, in con-
nection with—
‘‘(i) the authorization, settlement, bill-
ing, processing, clearing, transferring, rec-
onciling, or collection of amounts charged,
debited, or otherwise paid using a debit,
credit or other payment card, check, or ac-
count number, or by other payment means;
‘‘(ii) the transfer of receivables, ac-
counts or interests therein; or
‘‘(iii) the audit of debit, credit or
other payment information.
Each agency or authority described in section 504(a)
shall, consistent with the purposes of this subtitle,
prescribe by rule actions that shall, in a variety of
financial services, and with respect to a variety of fi-
nancial products, be treated as necessary to effect,
administer, or enforce a financial transaction.
‘‘(10) FINANCIAL SERVICES; FINANCIAL PROD-
UCTS; 
TRANSACTION; 
RELATED
TRANSACTION.—
Each agency or authority described in section 504(a)
shall, consistent with the purposes of this subtitle,
prescribe by rule definitions of the terms ‘financial
services’, ‘financial products’, ‘transaction’, ‘related
transaction’, and ‘unrelated third party’ for purposes
of this subtitle.
‘‘(11) STATE
INSURANCE
AUTHORITY.—The
term ‘State insurance authority’ means, in the case
of any person engaged in providing insurance, the
State insurance authority of the State in which the
person is domiciled.
‘‘(12) 
CONSUMER.—The 
term 
‘consumer’
means an individual who obtains, from a financial
institution, financial products or services which are
to be used primarily for personal, family, or house-
hold purposes, and also means the legal representa-
tive of such an individual.
‘‘(13) CUSTOMER
RELATIONSHIP.—The term
‘time of establishing a customer relationship’ shall
be defined by the regulations prescribed under sec-
tion 504.
‘‘SEC. 509. EFFECTIVE DATE.
‘‘This subtitle shall take effect 6 months after the
date on which rules are required to be prescribed under
section 504(a)(3), except—
‘‘(1) to the extent that a later date is specified
in the rules prescribed under section 504; and
‘‘(2) that sections 504 and 506 shall be effec-
tive upon enactment.
‘‘Subtitle B—Fraudulent Access to
Financial Information
‘‘SEC. 521. PRIVACY PROTECTION FOR CUSTOMER INFOR-
MATION OF FINANCIAL INSTITUTIONS.
‘‘(a) PROHIBITION ON OBTAINING CUSTOMER INFOR-
MATION BY FALSE PRETENSES.—It shall be a violation
of this subtitle for any person to obtain or attempt to ob-
tain, or cause to be disclosed or attempt to cause to be
disclosed to any person, customer information of a finan-
cial institution relating to another person—
‘‘(1) by making a false, fictitious, or fraudulent
statement or representation to an officer, employee,
or agent of a financial institution;
‘‘(2) by making a false, fictitious, or fraudulent
statement or representation to a customer of a fi-
nancial institution; or
‘‘(3) by providing any document to an officer,
employee, or agent of a financial institution, know-
ing that the document is forged, counterfeit, lost, or
stolen, was fraudulently obtained, or contains a
false, fictitious, or fraudulent statement or represen-
tation.
‘‘(b) PROHIBITION ON SOLICITATION OF A PERSON
TO OBTAIN CUSTOMER INFORMATION FROM FINANCIAL
INSTITUTION UNDER FALSE PRETENSES.—It shall be a
violation of this subtitle to request a person to obtain cus-
tomer information of a financial institution, knowing that
the person will obtain, or attempt to obtain, the informa-
tion from the institution in any manner described in sub-
section (a).
‘‘(c) NONAPPLICABILITY
TO LAW ENFORCEMENT
AGENCIES.—No provision of this section shall be con-
strued so as to prevent any action by a law enforcement
agency, or any officer, employee, or agent of such agency,
to obtain customer information of a financial institution
in connection with the performance of the official duties
of the agency.
‘‘(d) NONAPPLICABILITY
TO FINANCIAL INSTITU-
TIONS IN CERTAIN CASES.—No provision of this section
shall be construed so as to prevent any financial institu-
tion, or any officer, employee, or agent of a financial insti-
tution, from obtaining customer information of such finan-
cial institution in the course of—
‘‘(1) testing the security procedures or systems
of such institution for maintaining the confiden-
tiality of customer information;
‘‘(2) investigating allegations of misconduct or
negligence on the part of any officer, employee, or
agent of the financial institution; or
‘‘(3) recovering customer information of the fi-
nancial institution which was obtained or received by
another person in any manner described in sub-
section (a) or (b).
‘‘(e) NONAPPLICABILITY
TO INSURANCE INSTITU-
TIONS FOR INVESTIGATION OF INSURANCE FRAUD.—No
provision of this section shall be construed so as to prevent
any insurance institution, or any officer, employee, or
agency of an insurance institution, from obtaining infor-
mation as part of an insurance investigation into criminal
activity, fraud, material misrepresentation, or material
nondisclosure that is authorized for such institution under
State law, regulation, interpretation, or order.
‘‘(f) NONAPPLICABILITY TO CERTAIN TYPES OF CUS-
TOMER INFORMATION OF FINANCIAL INSTITUTIONS.—No
provision of this section shall be construed so as to prevent
any person from obtaining customer information of a fi-
nancial institution that otherwise is available as a public
tigation with respect to a financial institution sub-
ject to regulation by such regulator.
‘‘(c) STATE ACTION FOR VIOLATIONS.—
‘‘(1) AUTHORITY OF STATES.—In addition to
such other remedies as are provided under State
law, if the chief law enforcement officer of a State,
or an official or agency designated by a State, has
reason to believe that any person has violated or is
violating this subtitle, the State—
‘‘(A) may bring an action to enjoin such
violation in any appropriate United States dis-
trict court or in any other court of competent
jurisdiction;
‘‘(B) may bring an action on behalf of the
residents of the State to recover damages of not
more than $1,000 for each violation; and
‘‘(C) in the case of any successful action
under subparagraph (A) or (B), shall be award-
ed the costs of the action and reasonable attor-
ney fees as determined by the court.
‘‘(2) RIGHTS OF FEDERAL REGULATORS.—
‘‘(A) PRIOR
NOTICE.—The State shall
serve prior written notice of any action under
paragraph (1) upon the Federal Trade Commis-
sion and provide the Federal Trade Commission
with a copy of its complaint, except in any case
in which such prior notice is not feasible, in
which case the State shall serve such notice im-
mediately upon instituting such action.
‘‘(B) RIGHT TO INTERVENE.—The Federal
Trade Commission shall have the right—
‘‘(i) to intervene in an action under
paragraph (1);
‘‘(ii) upon so intervening, to be heard
on all matters arising therein;
‘‘(iii) to remove the action to the ap-
propriate United States district court; and
‘‘(iv) to file petitions for appeal.
‘‘(3) INVESTIGATORY
POWERS.—For purposes
of bringing any action under this subsection, no pro-
vision of this subsection shall be construed as pre-
venting the chief law enforcement officer, or an offi-
cial or agency designated by a State, from exercising
the powers conferred on the chief law enforcement
officer or such official by the laws of such State to
conduct investigations or to administer oaths or af-
firmations or to compel the attendance of witnesses
or the production of documentary and other evi-
dence.
‘‘(4) LIMITATION
ON
STATE
ACTION
WHILE
FEDERAL ACTION PENDING.—If the Federal Trade
Commission has instituted a civil action for a viola-
tion of this subtitle, no State may, during the pend-
ency of such action, bring an action under this sec-
tion against any defendant named in the complaint
of the Federal Trade Commission or such agency for
any violation of this subtitle that is alleged in that
complaint.
‘‘SEC. 523. CRIMINAL PENALTY.
‘‘(a) IN GENERAL.—Whoever knowingly and inten-
tionally violates, or knowingly and intentionally attempts
to violate, section 521 shall be fined in accordance with
title 18, United States Code, or imprisoned for not more
than 5 years, or both.
‘‘(b) 
ENHANCED
PENALTY
FOR
AGGRAVATED
CASES.—Whoever violates, or attempts to violate, section
521 while violating another law of the United States or
as part of a pattern of any illegal activity involving more
than $100,000 in a 12-month period shall be fined twice
the amount provided in subsection (b)(3) or (c)(3) (as the
case may be) of section 3571 of title 18, United States
Code, imprisoned for not more than 10 years, or both.
‘‘SEC. 524. RELATION TO STATE LAWS.
‘‘(a) IN GENERAL.—This subtitle shall not be con-
strued as superseding, altering, or affecting the statutes,
regulations, orders, or interpretations in effect in any
State, except to the extent that such statutes, regulations,
orders, or interpretations are inconsistent with the provi-
sions of this subtitle, and then only to the extent of the
inconsistency.
‘‘(b) GREATER PROTECTION UNDER STATE LAW.—
For purposes of this section, a State statute, regulation,
order, or interpretation is not inconsistent with the provi-
sions of this subtitle if the protection such statute, regula-
tion, order, or interpretation affords any person is greater
than the protection provided under this subtitle as deter-
mined by the Commission, on its own motion or upon the
petition of any interested party.
‘‘SEC. 525. AGENCY GUIDANCE.
‘‘In furtherance of the objectives of this subtitle, each
Federal banking agency (as defined in section 3(z) of the
Federal Deposit Insurance Act) and the Securities and
Exchange Commission or self-regulatory organizations, as
appropriate, shall review regulations and guidelines appli-
cable to financial institutions under their respective juris-
dictions and shall prescribe such revisions to such regula-
tions and guidelines as may be necessary to ensure that
such financial institutions have policies, procedures, and
controls in place to prevent the unauthorized disclosure
of customer financial information and to deter and detect
activities proscribed under section 521.
‘‘SEC. 526. REPORTS.
‘‘(a) REPORT TO THE CONGRESS.—Before the end of
the 18-month period beginning on the date of the enact-
ment of this Act, the Comptroller General, in consultation
with the Federal Trade Commission, Federal banking
agencies, the Securities and Exchange Commission, appro-
priate Federal law enforcement agencies, and appropriate
State insurance regulators, shall submit to the Congress
a report on the following:
‘‘(1) The efficacy and adequacy of the remedies
provided in this subtitle in addressing attempts to
obtain financial information by fraudulent means or
by false pretenses.
‘‘(2) Any recommendations for additional legis-
lative or regulatory action to address threats to the
privacy of financial information created by attempts
to obtain information by fraudulent means or false
pretenses.
‘‘(b) ANNUAL REPORT BY ADMINISTERING AGEN-
CIES.—The Federal Trade Commission and the Attorney
General shall submit to Congress an annual report on
number and disposition of all enforcement actions taken
pursuant to this subtitle.
‘‘SEC. 527. DEFINITIONS.
‘‘For purposes of this subtitle, the following defini-
tions shall apply:
‘‘(1) CUSTOMER.—The term ‘customer’ means,
with respect to a financial institution, any person (or
authorized representative of a person) to whom the
financial institution provides a product or service,
including that of acting as a fiduciary.
‘‘(2) CUSTOMER INFORMATION OF A FINANCIAL
INSTITUTION.—The term ‘customer information of a
financial institution’ means any information main-
tained by or for a financial institution which is de-
rived from the relationship between the financial in-
stitution and a customer of the financial institution
and is identified with the customer.
‘‘(3) DOCUMENT.—The term ‘document’ means
any information in any form.
‘‘(4) FINANCIAL INSTITUTION.—
‘‘(A) IN
GENERAL.—The term ‘financial
institution’ means any institution engaged in
the business of providing financial services to
customers who maintain a credit, deposit, trust,
or other financial account or relationship with
the institution.
‘‘(B) CERTAIN
FINANCIAL
INSTITUTIONS
SPECIFICALLY INCLUDED.—The term ‘financial
institution’ includes any depository institution
(as defined in section 19(b)(1)(A) of the Fed-
eral Reserve Act), any broker or dealer, any in-
vestment adviser or investment company, any
insurance company, any loan or finance com-
pany, any credit card issuer or operator of a
credit card system, and any consumer reporting
agency that compiles and maintains files on
consumers on a nationwide basis (as defined in
section 603(p)).
‘‘(C) 
SECURITIES
INSTITUTIONS.—For
purposes of subparagraph (B)—
‘‘(i) the terms ‘broker’ and ‘dealer’
have the meanings provided in section 3 of
the Securities Exchange Act of 1934 (15
U.S.C. 78c);
‘‘(ii) the term ‘investment adviser’ has
the meaning provided in section 202(a)(11)
of the Investment Advisers Act of 1940
(15 U.S.C. 80b–2(a)); and
‘‘(iii) the term ‘investment company’
has the meaning provided in section 3 of
the Investment Company Act of 1940 (15
U.S.C. 80a–3).
‘‘(D) FURTHER DEFINITION BY REGULA-
TION.—The Federal Trade Commission, after
consultation with Federal banking agencies and
the Securities and Exchange Commission, may
prescribe regulations clarifying or describing
the types of institutions which shall be treated
as financial institutions for purposes of this
subtitle.
Æ