Identity Theft Protection Act

Bill: 109-s-1408
Sponsor: Sen. Smith, Gordon H. [R-OR]
Introduced: 2005-07-14 in the Senate
Policy area: Commerce
Subjects: Administrative procedure
Bank records
Civil Rights and Liberties, Minority Issues
Civil actions and liability
Computer security measures
Congress
Congressional reporting requirements
Consumer credit
Consumer education
Credit cards
Crime and Law Enforcement
Criminal investigation
Debit cards
Driver licenses
Education
Encryption
Federal Trade Commission
Federal advisory bodies
Federal preemption
Fees
Finance and Financial Sector
Fines (Penalties)
Government Operations and Politics
Government publicity
Identification devices
Identity theft
Independent regulatory commissions
Labor and Employment
Law
Local laws
Parties to actions
Prison labor
Prisoners
Restrictive trade practices
Right of privacy
Science, Technology, Communications
Social Welfare
Social security numbers
State laws
Student records
Transportation and Public Works
Victims of crimes

Summary:
action_date: 2005-07-14
text: 
Identity Theft Protection Act - Requires: (1) a covered entity (i.e., any commercial entity or charitable, educational, or nonprofit organization that acquires, maintains, or utilizes sensitive personal information) to take reasonable steps to protect against security breaches and to prevent unauthorized access to sensitive personal information that the entity sells, maintains, collects, or transfers; and (2) the Federal Trade Commission (FTC) to promulgate regulations to implement that requirement.
 
Requires a covered entity, upon discovering a breach of security, to: (1) report the breach to the FTC or other appropriate federal regulator and notify all consumer reporting agencies specified in the Fair Credit Reporting Act if it determines that the breach affects the sensitive personal information of 1,000 or more individuals; and (2) notify individuals if it determines that the breach has resulted in, or poses a reasonable risk of, theft of their identity.
 
Authorizes a consumer to place a security freeze on his or her credit report by making a request to a consumer credit reporting agency in writing or by telephone, subject to specified requirements.
 
Directs that any violation of this Act be treated as an unfair or deceptive act or practice proscribed under a rule issued pursuant to the Federal Trade Commission Act. Sets civil penalties for violations. 
 
Places specified limits on the use of, and access to, social security numbers. 
 
Directs the Chairman of the FTC to establish an Information Security Working Group to develop best practices to protect sensitive personal information.

action_date: 2005-12-08
text: 
Identity Theft Protection Act - (Sec. 2) Requires any commercial entity or charitable, educational, or nonprofit organization that acquires, maintains, or utilizes sensitive personal information (covered entity) to develop and implement a program for the security of such information that includes administrative, technical, and physical safeguards.
 
Deems a covered entity that is in full compliance with the requirements of the Federal Trade Commission's (FTC) rules on Standards for Safeguarding Customer Information and Disposal of Consumer Report Information and Records to be in compliance with these requirements.
 
Directs the FTC to promulgate regulations that require procedures for authenticating the credentials of any third party to which sensitive personal information is to be transferred or sold by a covered entity.
 
(Sec. 3) Requires a covered entity to use due diligence to investigate any suspected breach affecting sensitive personal information maintained by that entity. Require any such entity: (1) if it discovers a breach that affects fewer than 1,000 individuals and that does not create a reasonable risk of identity theft, to report the breach to the FTC; (2) if it discovers a breach affects 1,000 or more individuals, to report the breach to the FTC, notify all consumer reporting agencies described in the Fair Credit Reporting Act (FCRA), and post a report of the breach on its website without disclosing any sensitive personal information pertaining to the individuals affected; and (3) if it discovers a breach that creates a reasonable risk of identity theft, to provide notice (as prescribed) to each affected individual.
 

 

 
Exempts electronic communication of a third party stored by a cable operator, information service, or telecommunications carrier in its network in the course of transferring or transmitting such communication.
 
(Sec. 4) Allows a consumer to place a security freeze on his or her credit report by making a request to a consumer credit reporting agency. Requires the agency, upon such a request, to: (1) disclose to the consumer the process and potential consequences of the freeze; and (2) not release the consumer's credit report to a third party without the consumer's authorization. 
 
Prohibits the placement of a freeze from being taken into account in determining the consumer's credit score. Authorizes an agency to remove a freeze only: (1) upon the consumer's request; or (2) if the agency determines that the report was frozen due to a material misrepresentation of fact by the consumer. Authorizes a consumer to have a freeze temporarily suspended by making a request.
 

 
Requires the agency, at the consumer's request, to notify all other consumer reporting agencies described in FCRA after placing, removing, or temporarily suspending a freeze. Requires such an agency to place, remove, or temporarily suspend a freeze after receiving proper identification.
 
Authorizes an agency to charge a reasonable freeze fee, except where the consumer: (1) is a victim of identity theft; (2) requests the freeze in writing; and (3) has filed and provided the agency a copy of an identity theft report.
 
Prohibits an agency from changing a consumer's name, date of birth, social security number, or address in a frozen credit report without sending confirmation of the change to the consumer.
 
Exempts certain data aggregators and check, fraud prevention, and deposit account information services companies from requirements of this Act.
 
(Sec. 5) Sets forth provisions regarding enforcement of this Act and preemption of state law. Requires violations to be treated as unfair or deceptive acts or practices. Prohibits any private right of action or class action from being brought under this Act. 
 

 

 

 

 
(Sec. 8) Prohibits a covered entity from soliciting a social security number from an individual unless there is a specific use of that number for which no other identifier reasonably can be used, with exceptions for: (1) obtaining a consumer report for any purpose permitted under FCRA; (2) agency solicitation for obtaining appropriate proof of a consumer's identity, as required under FCRA; (3) purposes permitted under the Gramm-Leach-Bliley Act; or (4) identifying or locating missing or abducted children, witnesses, criminals, and fugitives, parties to lawsuits, parents delinquent in child support payments, organ and bone marrow donors, pension fund beneficiaries, and missing heirs.
 
Prohibits: (1) a covered entity from displaying the social security number of an individual on any card or tag that is commonly provided to employees (or their family members), faculty, staff, or students for identification purposes; and (2) a state from displaying the social security number of an individual on driver's licenses.
 
Amends the Social Security Act to prohibit any federal, state, or local agency from employing prisoners in any capacity that would allow such prisoners access to the social security account numbers of other individuals.
 
Prohibits (with exceptions for national security, public health, and other specified purposes): (1) selling or purchasing a social security number or displaying such number to the general public; or (2) obtaining or using any social security number to locate or identify an individual to physically harm such individual or to use the individual's identity for any illegal purpose. Permits consensual sales of social security numbers under specified circumstances. 
 
(Sec. 9) Directs the Chairman of the FTC to establish an Information Security Working Group to advise covered entities on best practices to protect sensitive personal information. 
 
(Sec. 11) Authorizes appropriations to the FTC for FY2006-FY2010 to carry out this Act.
 
(Sec. 12) Directs the FTC, in conjunction with the Department of Justice and other federal agencies, to undertake a study of the correlation between methamphetamine use and identity theft crimes, the needs of law enforcement to address methamphetamine related identity theft crimes, and the government's role in addressing and deterring identity theft crimes
 

 



Legislative actions:
action_date: 2005-12-08
text: Placed on Senate Legislative Calendar under General Orders. Calendar No. 320.
action_date: 2005-12-08
text: Committee on Commerce, Science, and Transportation. Reported by Senator Stevens under authority of the order of the Senate of 11/18/2005 with an amendment in the nature of a substitute. With written report No. 109-203.
action_date: 2005-12-08
text: Committee on Commerce, Science, and Transportation. Reported by Senator Stevens under authority of the order of the Senate of 11/18/2005 with an amendment in the nature of a substitute. With written report No. 109-203.
action_date: 2005-07-28
text: Committee on Commerce, Science, and Transportation. Ordered to be reported with an amendment in the nature of a substitute favorably.
action_date: 2005-07-14
text: Read twice and referred to the Committee on Commerce, Science, and Transportation. (text of measure as introduced: CR S8323-8325)
action_date: 2005-07-14
text: Sponsor introductory remarks on measure. (CR S8322-8323)
action_date: 2005-07-14
text: Introduced in Senate