To protect the privacy of the individual with respect to the Social Security number and other personal information, and for other purposes.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Personal Information Privacy Act of 
2003''.

SEC. 2. CONFIDENTIAL TREATMENT OF CREDIT HEADER INFORMATION.

    Section 603(d)(1) of the Fair Credit Reporting Act (15 U.S.C. 
1681a(d)(1)) is amended by inserting after subparagraph (C) the 
following new sentence:
            ``The term also includes any other identifying information 
        of the consumer, except the name, address, and telephone number 
        of the consumer if listed in a residential telephone directory 
        available in the locality of the consumer.''.

SEC. 3. PROTECTING PRIVACY BY PROHIBITING USE OF THE SOCIAL SECURITY 
              NUMBER FOR COMMERCIAL PURPOSES WITHOUT CONSENT.

    (a) In General.--Part A of title XI of the Social Security Act (42 
U.S.C. 1301 et seq.) is amended by adding at the end the following:

 ``prohibition of certain misuses of the social security account number

    ``Sec. 1150A. (a) Prohibition of Commercial Acquisition or 
Distribution.--No person may buy, sell, offer for sale, take or give in 
exchange, or pledge or give in pledge any information for the purpose, 
in whole or in part, of conveying by means of such information any 
individual's social security account number, or any derivative of such 
number, without the written consent of such individual.
    ``(b) Prohibition of Use as Personal Identification Number.--No 
person may utilize any individual's social security account number, or 
any derivative of such number, for purposes of identification of such 
individual without the written consent of such individual.
    ``(c) Prerequisites for Consent.--In order for consent to exist 
under subsection (a) or (b), the person engaged in, or seeking to 
engage in, an activity described in such subsection shall--
            ``(1) inform the individual of all the purposes for which 
        the number will be utilized and the persons to whom the number 
        will be known; and
            ``(2) obtain affirmatively expressed consent in writing.
    ``(d) Exceptions.--Nothing in this section shall be construed to 
prohibit any use of social security account numbers permitted or 
required under section 205(c)(2) of this Act, section 7(a)(2) of the 
Privacy Act of 1974 (5 U.S.C. 552a note; 88 Stat. 1909), or section 
6109(d) of the Internal Revenue Code of 1986.
    ``(e) Civil Action in United States District Court; Damages; 
Attorneys Fees and Costs; Nonexclusive Nature of Remedy.--
            ``(1) In general.--Any individual aggrieved by any act of 
        any person in violation of this section may bring a civil 
action in a United States district court to recover--
                    ``(A) such preliminary and equitable relief as the 
                court determines to be appropriate; and
                    ``(B) the greater of--
                            ``(i) actual damages; and
                            ``(ii) liquidated damages of $25,000 or, in 
                        the case of a violation that was willful and 
                        resulted in profit or monetary gain, $50,000.
            ``(2) Attorney's fees and costs.--In the case of a civil 
        action brought under paragraph (1) in which the aggrieved 
        individual has substantially prevailed, the court may assess 
        against the respondent a reasonable attorney's fee and other 
        litigation costs and expenses (including expert fees) 
        reasonably incurred.
            ``(3) Statute of limitations.--No action may be commenced 
        under this subsection more than 3 years after the date on which 
        the violation was or should reasonably have been discovered by 
        the aggrieved individual.
            ``(4) Nonexclusive remedy.--The remedy provided under this 
        subsection shall be in addition to any other lawful remedy 
        available to the individual.
    ``(f) Civil Money Penalties.--
            ``(1) In general.--Any person who the Commissioner of 
        Social Security determines has violated this section shall be 
        subject, in addition to any other penalties that may be 
        prescribed by law, to--
                    ``(A) a civil money penalty of not more than 
                $25,000 for each such violation, and
                    ``(B) a civil money penalty of not more than 
                $500,000, if violations have occurred with such 
                frequency as to constitute a general business practice.
            ``(2) Determination of violations.--Any violation committed 
        contemporaneously with respect to the social security account 
        numbers of 2 or more individuals by means of mail, 
        telecommunication, or otherwise shall be treated as a separate 
        violation with respect to each such individual.
            ``(3) Enforcement procedures.--The provisions of section 
        1128A (other than subsections (a), (b), (f), (h), (i), (j), and 
        (m), and the first sentence of subsection (c)) and the 
        provisions of subsections (d) and (e) of section 205 shall 
        apply to civil money penalties under this subsection in the 
        same manner as such provisions apply to a penalty or proceeding 
        under section 1128A(a), except that, for purposes of this 
paragraph, any reference in section 1128A to the Secretary shall be 
deemed a reference to the Commissioner of Social Security.
            ``(4) Coordination with criminal enforcement.--The 
        Commissioner of Social Security shall take such actions as are 
        necessary and appropriate to assure proper coordination of the 
        enforcement of the provisions of this section with criminal 
        enforcement under section 1028 of title 18, United States Code 
        (relating to fraud and related activity in connection with 
        identification documents). The Commissioner shall enter into 
        cooperative arrangements with the Federal Trade Commission 
        under section 5 of the Identity Theft and Assumption Deterrence 
        Act of 1998 for purposes of achieving such coordination.
    ``(g) Regulation by States.--Nothing in this section shall be 
construed to prohibit any State authority from enacting or enforcing 
laws consistent with this section for the protection of privacy.''.
    (b) Effective Date.--The amendment made by subsection (a) applies 
with respect to violations occurring on and after the date which is 2 
years after the date of enactment of this Act.
    (c) Unfair or Deceptive Act or Practice.--Any person who refuses to 
do business with an individual because the individual will not consent 
to that person receiving the social security number of such individual 
shall be considered to have committed an unfair or deceptive act or 
practice in violation of section 5 of the Federal Trade Commission Act 
(15 U.S.C. 45). Action may be taken under such section 5 against such a 
person.

SEC. 4. REPEAL OF CERTAIN PROVISIONS RELATING TO DISTRIBUTION OF 
              CONSUMER REPORTS IN CONNECTION WITH CERTAIN TRANSACTIONS 
              NOT INITIATED BY THE CONSUMER.

    (a) In General.--Paragraph (1) of section 604(c) of the Fair Credit 
Reporting Act (15 U.S.C. 1681b(c)) is amended by striking ``any credit 
or insurance transaction that is not initiated by the consumer only 
if--'' and all that follows through the end of such paragraph and 
inserting ``any credit or insurance transaction that is not initiated 
by the consumer only if the consumer provides express written 
authorization, in accordance with paragraph (2), to the agency to 
provide such report in connection with any such transaction.''
    (b) Full Disclosure Required.--Paragraph (2) of section 604(c) of 
the Fair Credit Reporting Act (15 U.S.C. 1681b(c)) is amended to read 
as follows:
            ``(2) Full disclosure required.--
                    ``(A) In general.--No authorization referred to in 
                paragraph (1) with respect to any consumer shall be 
                effective unless the consumer receives a notice before 
                such authorization is provided which fully and fairly 
                discloses, in accordance with regulations which the 
                Federal Trade Commission and the Board of Governors of 
                the Federal Reserve System shall jointly prescribe, 
                what specifically is being authorized by the consumer 
                and the potential positive and negative effects the 
                provision of such authorization will have on the 
                consumer.
                    ``(B) Form of notice.--The regulations prescribed 
                pursuant to subparagraph (A) shall require that the 
                notice required under such subparagraph--
                            ``(i) be prominently displayed on a 
                        document which is separate from any other 
                        document; or
                            ``(ii) if the notice appears on a document 
                        with other information, be placed in a clear 
                        and conspicuous location on such document and 
                        appear in type face which is more conspicuous 
                        than the type face used for any other 
                        information on such document.''.
    (c) Technical and Conforming Amendment.--Subsection (e) of section 
604 of the Fair Credit Reporting Act (15 U.S.C. 1681b) is amended to 
read as follows:
    ``(e) [Repealed]''.

SEC. 5. SALE OR TRANSFER OF TRANSACTION OR EXPERIENCE INFORMATION 
              PROHIBITED.

    (a) In General.--The Fair Credit Reporting Act (15 U.S.C. 1681 et 
seq.) is amended by adding at the end the following new section:
``Sec. 627. Transaction or experience information
    ``(a) In General.--No person doing business with a consumer may 
sell, transfer, or otherwise provide to any other person, for the 
purpose of marketing such information to any other person, any 
transaction or experience information without the consumer's express 
written consent.
    ``(b) Transaction or Experience Information Defined.--For purposes 
of this section, the term `transaction or experience information' means 
any information identifying the content or subject of 1 or more 
transactions between the consumer and a person doing business with a 
consumer, including any component part of any transaction, any brand 
name involved, or any quantity or category of merchandise involved in 
any part of the transaction.
    ``(c) Exceptions.--Subsection (a) shall not apply with respect to 
the following:
            ``(1) Communication of transaction or experience 
        information solely among persons related by common ownership or 
        affiliated by corporate control.
            ``(2) Information provided pursuant to the order of a court 
        having jurisdiction to issue such order or pursuant to a 
        subpoena issued in connection with proceedings before a Federal 
        grand jury.
            ``(3) Information provided in connection with the licensing 
        or registration by a government agency or department, or any 
        transfer of such license or registration, of any personal 
        property bought, sold, or transferred by the consumer.
            ``(4) Information required to be provided in connection 
        with any transaction in real estate.
            ``(5) Information required to be provided in connection 
        with perfecting a security interest in personal property.
            ``(6) Information relating to the amount of any transaction 
        or any credit extended in connection with a transaction with a 
        consumer.''.
    (b) Technical and Conforming Amendment.--Section 603(d)(2)(A) is 
amended by striking ``(A)
any--'' and inserting ``(A) subject to section 627,
any--''.
    (c) Clerical Amendment.--The table of sections for the Fair Credit 
Reporting Act is amended by adding at the end the following new item:

``627. Transaction or experience information.''.

Summary: Personal Information Privacy Act of 2003 - Amends the Fair Credit Reporting Act to redefine the term "consumer report" to exclude identifying information listed in a local telephone directory (thereby ensuring that the personal identification information in the credit headers accompanying credit reports of unlisted individuals remains confidential).Amends part A (General Provisions) of title XI of the Social Security Act to prohibit the commercial acquisition or distribution of an individual's social security number (or any derivative of it), as well as its use as a personal identification number, without the individual's written consent. Provides for: (1) civil money penalties and civil action in U.S. District Court by an aggrieved individual; and (2) coordination with criminal enforcement of identification document fraud.Amends the Fair Credit Reporting Act to prohibit a consumer reporting agency from providing a report in connection with a credit or insurance transaction not initiated by the consumer without the consumer's written consent. Requires full consumer disclosure before such consent shall be effective.Prohibits, with specified exceptions, a person doing business with a consumer from selling or transferring for marketing purposes any transaction or experience information (as defined by this Act) without the consumer's written consent.