Financial Information Privacy Act of 1999

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Financial Information Privacy Act of 
1999''.

SEC. 2. FINANCIAL INFORMATION PRIVACY.

    The Consumer Credit Protection Act (15 U.S.C. 1601 et seq.) is 
amended by adding at the end the following:

          ``TITLE X--FINANCIAL INFORMATION PRIVACY PROTECTION

``SEC. 1001. SHORT TITLE; TABLE OF CONTENTS.

    ``(a) Short Title.--This title may be cited as the `Financial 
Information Privacy Act of 1999'.
    ``(b) Table of Contents.--The table of contents for this title is 
as follows:

          ``TITLE X--FINANCIAL INFORMATION PRIVACY PROTECTION

``Sec. 1001. Short title; table of contents.
``Sec. 1002. Definitions.
``Sec. 1003. Privacy protection for customer information of financial 
                            institutions.
``Sec. 1004. Administrative enforcement.
``Sec. 1005. Civil liability.
``Sec. 1006. Criminal penalty.
``Sec. 1007. Relation to State laws.
``Sec. 1008. Agency guidance.

``SEC. 1002. DEFINITIONS.

    ``For purposes of this title, the following definitions shall 
apply:
            ``(1) Customer.--The term `customer' means, with respect to 
        a financial institution, any person (or authorized 
        representative of a person) to whom the financial institution 
        provides a product or service, including that of acting as a 
        fiduciary.
            ``(2) Customer information of a financial institution.--The 
        term `customer information of a financial institution' means 
        any information maintained by a financial institution which is 
        derived from the relationship between the financial institution 
        and a customer of the financial institution and is identified 
        with the customer.
            ``(3) Document.--The term `document' means any information 
        in any form.
            ``(4) Financial institution.--
                    ``(A) In general.--The term `financial institution' 
                means any institution engaged in the business of 
                providing financial services to customers who maintain 
a credit, deposit, trust, or other financial account or relationship 
with the institution.
                    ``(B) Certain financial institutions specifically 
                included.--The term `financial institution' includes 
                any depository institution (as defined in section 
                19(b)(1)(A) of the Federal Reserve Act), any loan or 
                finance company, any credit card issuer or operator of 
                a credit card system, and any consumer reporting agency 
                that compiles and maintains files on consumers on a 
                nationwide basis (as defined in section 603(p)).
                    ``(C) Further definition by regulation.--The Board 
                of Governors of the Federal Reserve System may 
                prescribe regulations further defining the term 
                `financial institution', in accordance with 
                subparagraph (A), for purposes of this title.

``SEC. 1003. PRIVACY PROTECTION FOR CUSTOMER INFORMATION OF FINANCIAL 
              INSTITUTIONS.

    ``(a) Prohibition on Obtaining Customer Information by False 
Pretenses.--It shall be a violation of this title for any person to 
obtain or attempt to obtain, or cause to be disclosed or attempt to 
cause to be disclosed to any person, customer information of a 
financial institution relating to another person--
            ``(1) by knowingly making a false, fictitious, or 
        fraudulent statement or representation to an officer, employee, 
        or agent of a financial institution with the intent to deceive 
        the officer, employee, or agent into relying on that statement 
        or representation for purposes of releasing the customer 
        information;
            ``(2) by knowingly making a false, fictitious, or 
        fraudulent statement or representation to a customer of a 
        financial institution with the intent to deceive the customer 
        into relying on that statement or representation for purposes 
        of releasing the customer information or authorizing the 
        release of such information; or
            ``(3) by knowingly providing any document to an officer, 
        employee, or agent of a financial institution, knowing that the 
        document is forged, counterfeit, lost, or stolen, was 
        fraudulently obtained, or contains a false, fictitious, or 
        fraudulent statement or representation, if the document is 
        provided with the intent to deceive the officer, employee, or 
        agent into relying on that document for purposes of releasing 
        the customer information.
    ``(b) Prohibition on Solicitation of a Person To Obtain Customer 
Information From a Financial Institution Under False Pretenses.--It 
shall be a violation of this title to request a person to obtain 
customer information of a financial institution, knowing or consciously 
avoiding knowing that the person will obtain, or attempt to obtain, the 
information from the institution in any manner described in subsection 
(a).
    ``(c) Nonapplicability to Law Enforcement Agencies.--No provision 
of this section shall be construed so as to prevent any action by a law 
enforcement agency, or any officer, employee, or agent of such 
agency, to obtain customer information of a financial institution in 
connection with the performance of the official duties of the agency.
    ``(d) Nonapplicability to Financial Institutions in Certain 
Cases.--No provision of this section shall be construed to prevent any 
financial institution, or any officer, employee, or agent of a 
financial institution, from obtaining customer information of such 
financial institution in the course of--
            ``(1) testing the security procedures or systems of such 
        institution for maintaining the confidentiality of customer 
        information;
            ``(2) investigating allegations of misconduct or negligence 
        on the part of any officer, employee, or agent of the financial 
        institution; or
            ``(3) recovering customer information of the financial 
        institution which was obtained or received by another person in 
        any manner described in subsection (a) or (b).
    ``(e) Nonapplicability to Certain Types of Customer Information of 
Financial Institutions.--No provision of this section shall be 
construed to prevent any person from obtaining customer information of 
a financial institution that otherwise is available as a public record 
filed pursuant to the securities laws (as defined in section 3(a)(47) 
of the Securities Exchange Act of 1934).

``SEC. 1004. ADMINISTRATIVE ENFORCEMENT.

    ``(a) Enforcement by Federal Trade Commission.--Except as provided 
in subsection (b), compliance with this title shall be enforced by the 
Federal Trade Commission in the same manner and with the same power and 
authority as the Commission has under the Fair Debt Collection 
Practices Act to enforce compliance with that title.
    ``(b) Enforcement by Other Agencies in Certain Cases.--
            ``(1) In general.--Compliance with this title shall be 
        enforced under--
                    ``(A) section 8 of the Federal Deposit Insurance 
                Act, in the case of--
                            ``(i) national banks, and Federal branches 
                        and Federal agencies of foreign banks, by the 
                        Office of the Comptroller of the Currency;
                            ``(ii) member banks of the Federal Reserve 
                        System (other than national banks), branches 
                        and agencies of foreign banks (other than 
                        Federal branches, Federal agencies, and insured 
                        State branches of foreign banks), commercial 
                        lending companies owned or controlled by 
                        foreign banks, and organizations operating 
                        under section 25 or 25A of the Federal Reserve 
                        Act, by the Board;
                            ``(iii) banks insured by the Federal 
                        Deposit Insurance Corporation (other than 
                        members of the Federal Reserve System and 
                        national nonmember banks) and insured State 
                        branches of foreign banks, by the Board of 
                        Directors of the Federal Deposit Insurance 
                        Corporation; and
                            ``(iv) savings associations the deposits of 
                        which are insured by the Federal Deposit 
                        Insurance Corporation, by the Director of the 
                        Office of Thrift Supervision; and
                    ``(B) the Federal Credit Union Act, by the 
                Administrator of the National Credit Union 
                Administration with respect to any Federal credit 
                union.
            ``(2) Violations of this title treated as violations of 
        other laws.--For the purpose of the exercise by any agency 
        referred to in paragraph (1) of its powers under any Act 
        referred to in that paragraph, a violation of this title shall 
        be deemed to be a violation of a requirement imposed under that 
        Act. In addition to its powers under any provision of law 
        specifically referred to in paragraph (1), each of the agencies 
        referred to in that paragraph may exercise, for the purpose of 
        enforcing compliance with this title, any other authority 
        conferred on such agency by law.
    ``(c) State Action for Violations.--
            ``(1) Authority of states.--In addition to such other 
        remedies as are provided under State law, if the chief law 
        enforcement officer of a State, or an official or agency 
        designated by a State, has reason to believe that any person 
        has violated or is violating this title, the State--
                    ``(A) may bring an action to enjoin such violation 
                in any appropriate United States district court or in 
                any other court of competent jurisdiction;
                    ``(B) may bring an action on behalf of the 
                residents of the State to recover damages of not more 
                than $1,000 for each violation; and
                    ``(C) in the case of any successful action under 
                subparagraph (A) or (B), shall be awarded the costs of 
                the action and reasonable attorney fees as determined 
                by the court.
            ``(2) Rights of federal regulators.--
                    ``(A) Prior notice.--The State shall serve prior 
                written notice of any action under paragraph (1) upon 
                the Federal Trade Commission and, in the case of an 
                action which involves a financial institution described 
                in section 1004(b)(1), the agency referred to in such 
                section with respect to such institution and provide 
                the Federal Trade Commission and any such agency with a 
                copy of its complaint, except in any case in which such 
                prior notice is not feasible, in which case the State 
                shall serve such notice immediately upon instituting 
                such action.
                    ``(B) Right to intervene.--The Federal Trade 
                Commission or an agency described in subsection (b) 
                shall have the right--
                            ``(i) to intervene in an action under 
                        paragraph (1);
                            ``(ii) upon so intervening, to be heard on 
                        all matters arising therein;
                            ``(iii) to remove the action to the 
                        appropriate United States district court; and
                            ``(iv) to file petitions for appeal.
            ``(3) Investigatory powers.--For purposes of bringing any 
        action under this subsection, no provision of this subsection 
        shall be construed as preventing the chief law enforcement 
        officer, or an official or agency designated by a State, from 
        exercising the powers conferred on the chief law enforcement 
        officer or such official by the laws of such State to conduct 
        investigations or to administer oaths or affirmations or to 
        compel the attendance of witnesses or the production of 
        documentary and other evidence.
            ``(4) Limitation on state action while federal action 
        pending.--If the Federal Trade Commission or any agency 
        described in subsection (b) has instituted a civil action for a 
        violation of this title, no State may, during the pendency of 
        such action, bring an action under this section against any 
        defendant named in the complaint of the Federal Trade 
        Commission or such agency for any violation of this title that 
        is alleged in that complaint.

``SEC. 1005. CIVIL LIABILITY.

    ``Any person, other than a financial institution, who fails to 
comply with any provision of this title with respect to any financial 
institution or any customer information of a financial institution 
shall be liable to such financial institution or the customer to whom 
such information relates in an amount equal to the sum of the amounts 
determined under each of the following paragraphs:
            ``(1) Actual damages.--The greater of--
                    ``(A) the amount of any actual damage sustained by 
                the financial institution or customer as a result of 
                such failure; or
                    ``(B) any amount received by the person who failed 
                to comply with this title, including an amount equal to 
                the value of any nonmonetary consideration, as a result 
                of the action which constitutes such failure.
            ``(2) Additional damages.--Such additional amount as the 
        court may allow.
            ``(3) Attorneys' fees.--In the case of any successful 
        action to enforce any liability under paragraph (1) or (2), the 
        costs of the action, together with reasonable attorneys' fees.

``SEC. 1006. CRIMINAL PENALTY.

    ``(a) In General.--Whoever violates, or attempts to violate, 
section 1003 shall be fined in accordance with title 18, United States 
Code, or imprisoned for not more than 5 years, or both.
    ``(b) Enhanced Penalty for Aggravated Cases.--Whoever violates, or 
attempts to violate, section 1003 while violating another law of the 
United States or as part of a pattern of any illegal activity involving 
more than $100,000 in a 12-month period shall be fined twice the amount 
provided in subsection (b)(3) or (c)(3) (as the case may be) of section 
3571 of title 18, United States Code, imprisoned for not more than 10 
years, or both.

``SEC. 1007. RELATION TO STATE LAWS.

    ``(a) In General.--This title shall not be construed as 
superseding, altering, or affecting the statutes, regulations, orders, 
or interpretations in effect in any State, except to the extent that 
such statutes, regulations, orders, or interpretations are inconsistent 
with the provisions of this title, and then only to the extent of the 
inconsistency.
    ``(b) Greater Protection Under State Law.--For purposes of this 
section, a State statute, regulation, order, or interpretation is not 
inconsistent with the provisions of this title if the protection such 
statute, regulation, order, or interpretation affords any person is 
greater than the protection provided under this title.

``SEC. 1008. AGENCY GUIDANCE.

    ``In furtherance of the objectives of this title, each Federal 
banking agency (as defined in section 3(z) of the Federal Deposit 
Insurance Act) shall issue advisories to depository institutions under 
the jurisdiction of the agency, in order to assist such depository 
institutions in deterring and detecting activities proscribed under 
section 1003.''.

SEC. 3. REPORT TO CONGRESS ON FINANCIAL PRIVACY.

    Not later than 18 months after the date of enactment of this Act, 
the Comptroller General of the United States, in consultation with the 
Federal Trade Commission, the Federal banking agencies, and other 
appropriate Federal law enforcement agencies, shall submit to the 
Congress a report on--
            (1) the efficacy and adequacy of the remedies provided in 
        the amendments made by section 501 in addressing attempts to 
        obtain financial information by fraudulent means or by false 
        pretenses; and
            (2) any recommendations for additional legislative or 
        regulatory action to address threats to the privacy of 
        financial information created by attempts to obtain information 
        by fraudulent means or false pretenses.

Summary: Financial Information Privacy Act of 1999 - Amends the Consumer Credit Protection Act to: (1) specify the types of enterprises constituting a financial institution within its purview; and (2) authorize the Federal Trade Commission (FTC) to prescribe regulations clarifying or describing the types of institutions which shall be treated as financial institutions for purposes of this Act. 
Declares it a violation of this Act to obtain or solicit customer information of a financial institution relating to another person under false pretenses with intent to deceive.  Exempts from such proscription: (1) law enforcement agencies; (2) financial institutions engaged in testing security procedures, investigating misconduct or negligence, or recovering customer information obtained or received under false pretenses; as well as (3) customer information of financial institutions available as a public record under Federal securities laws. 
Grants the FTC, certain banking regulatory agencies, and the States enforcement powers under this Act. 
Subjects violations of this Act to Federal civil and criminal penalties. 
Requires each Federal banking agency to issue advisories to the depository institutions under its jurisdiction relating to the deterrence and detection of the activities proscribed by this Act. 
Requires the Comptroller General to report to the Congress on: (1) the efficacy and adequacy of the remedies provided in this Act; and (2) recommendations for additional action to address threats to the privacy of financial information.