Financial Data Protection Act of 2006

Bill: 109-hr-4127
Sponsor: Rep. Stearns, Cliff [R-FL-6]
Introduced: 2005-10-25 in the House
Policy area: Science, Technology, Communications
Subjects: Administrative procedure
Bank accounts
Bank records
Business records
Cable television
Civil Rights and Liberties, Minority Issues
Civil actions and liability
Commerce
Computer security measures
Computer software
Congress
Consumer credit
Consumer education
Consumer protection
Crime and Law Enforcement
Data banks
Electronic data interchange
Encryption
Federal Trade Commission
Federal preemption
Finance and Financial Sector
Financial statements
Fines (Penalties)
Fraud
Government Operations and Politics
Government paperwork
Government publicity
Governmental investigations
Health
Health information systems
Identification devices
Identity theft
Independent regulatory commissions
Information services
Internet
Law
Local laws
Medical records
Restrictive trade practices
Right of privacy
Risk
Social Welfare
Social security numbers
State laws
Sunset legislation
Telecommunication industry
Telephone
Web sites

Summary:
action_date: 2005-10-25
text: 
Data Accountability and Trust Act (DATA) - Instructs the Federal Trade Commission ( FTC) to promulgate regulations that require each person engaged in interstate commerce that owns or possesses data in electronic form containing personal information to establish and implement policies and procedures regarding information security practices for the treatment and protection of personal information.
 
Sets forth special requirements for information brokers. 
 
Prescribes notification procedures for breaches of information security.
 
Grants the FTC enforcement powers.
 
Preempts state information security laws.
 


action_date: 2006-05-04
text: 
Data Accountability and Trust Act (DATA) - (Sec. 2) Requires the Federal Trade Commission ( FTC) to promulgate regulations that require each person engaged in interstate commerce that owns or possesses data in electronic form containing personal information to establish and implement policies and procedures regarding security practices for the treatment and protection of such information.
 
Authorizes the FTC to require standard methods for the destruction of obsolete paper documents and other non-electronic data containing personal information by persons engaged in interstate commerce.
 
Requires information brokers to submit their security policies to the FTC in conjunction with a notification of a breach of security or upon the FTC's request. Requires the FTC to conduct or require an audit of security practices when information brokers are required to provide notification of such a breach. Authorizes additional audits for five years following such breach. Requires information brokers to: (1) verify the accuracy of the certain information they collect or maintain that identifies individuals, other than merely by name or address; (2) provide to individuals whose personal information they maintain a means to review such information; (3) place notice on the Internet instructing individuals how to request access to such information; and (4) correct inaccurate information. Directs the FTC to require that information brokers establish measures to facilitate the auditing or retracing of access to, or transmissions of, electronic data containing personal information. Prohibits information brokers from obtaining or causing the disclosure of personal information by false pretenses. 
 
(Sec. 3) Prescribes notification procedures for breaches of information security. Sets forth special notification requirements for breaches of information security of: (1) third party entities that have been contracted to maintain or process data in electronic form containing personal information; (2) telecommunication carriers, cable operators, information services, and interactive computer services; and (3) health information. Directs any person required to provide such notification to provide each individual whose personal information was affected by the breach, upon request and at no cost, consumer credit reports from at least one major credit reporting agency for two years. Provides an exemption from such notification requirements when it is determined that there is no reasonable risk from the breach of identity theft, fraud, or other unlawful conduct. 
 
(Sec 4) Grants the FTC enforcement powers. Authorizes enforcement by a state attorney general if there is reason to believe that interests of the state's residents have been or are threatened or adversely affected by violators of this Act. Sets forth civil penalties.
 
(Sec. 6) Preempts state information security laws.

action_date: 2006-05-26
text: 
Data Accountability and Trust Act (DATA) - (Sec. 2) Requires the Federal Trade Commission ( FTC) to promulgate regulations that require each person engaged in interstate commerce that owns or possesses data in electronic form containing personal information to establish and implement policies and procedures regarding security practices for the treatment and protection of such information.
 
Authorizes the FTC to require standard methods for the destruction of obsolete paper documents and other non-electronic data containing personal information by persons engaged in interstate commerce.
 
Requires information brokers to submit their security policies to the FTC in conjunction with a notification of a breach of security or upon the FTC's request. Requires the FTC to conduct or require an audit of security practices when information brokers are required to provide notification of such a breach. Authorizes additional audits for five years following such breach. Requires information brokers to: (1) verify the accuracy of the certain information they collect or maintain that identifies individuals, other than merely by name or address; (2) provide to individuals whose personal information they maintain a means to review such information; (3) place notice on the Internet instructing individuals how to request access to such information; and (4) correct inaccurate information. Directs the FTC to require that information brokers establish measures to facilitate the auditing or retracing of access to, or transmissions of, electronic data containing personal information. Prohibits information brokers from obtaining or causing the disclosure of personal information by false pretenses. 
 
(Sec. 3) Prescribes notification procedures for breaches of information security. Sets forth special notification requirements for breaches of information security of: (1) third party entities that have been contracted to maintain or process data in electronic form containing personal information; (2) telecommunication carriers, cable operators, information services, and interactive computer services; (3) health information; and (4) federal agencies that own or possess data in electronic form containing personal information.. Directs any person required to provide such notification (excluding federal agencies) to provide each individual whose personal information was affected by the breach, upon request and at no cost, consumer credit reports from at least one major credit reporting agency for two years. Provides an exemption from such notification requirements when it is determined that there is no reasonable risk from the breach of identity theft, fraud, or other unlawful conduct. 
 
(Sec 4) Grants the FTC enforcement powers. Authorizes enforcement by a state attorney general if there is reason to believe that interests of the state's residents have been or are threatened or adversely affected by violators of this Act. Sets forth civil penalties.
 
(Sec. 6) Preempts state information security laws.

action_date: 2006-06-02
text: 
Financial Data Protection Act of 2006 - (Sec. 2) Amends the Fair Credit Reporting Act to prescribe guidelines for data security safeguards that require a consumer reporter who becomes aware of information suggesting a breach of data security immediately to investigate and notify authorities and consumers. Defines &quot;consumer reporter&quot; as any entity which regularly engages in assembling or evaluating consumer financial file and consumer reports to furnish consumer reports to third parties or to provide payment for products and services, or for employment purposes.
 
Declares the policy of Congress concerning the obligations of each consumer reporter to protect the security and confidentiality of sensitive financial personal information.
 
Prescribes investigation and consumer notification requirements.
 
Directs the Federal Trade Commission (FTC) to coordinate with specified government entities to create a publicly available list of data security breaches that have triggered a notice to consumers within the last 12 months.
 
Prohibits charging the related consumers for the cost of the notices and file monitoring regarding data security breaches. 
 
Requires a consumer reporter, upon the request of a consumer who is the focus of a security breach, to make available a free service that: (1) monitors nationwide credit activity about the consumer from a consumer reporting agency; and (2) provides nationwide identity-monitoring.
 
Prescribes implementation guidelines for imposition of a security freeze, upon the request of a consumer who is a victim of identity theft, that places a notice in the consumer's credit report prohibiting the consumer reporting agency from releasing all or any part of the report without the consumer's express authorization.
 
Prohibits a consumer reporting agency from imposing a fee for placing or removing a security freeze.
 
Directs the Secretary of the Treasury, the Board of Governors of the Federal Reserve System, and the FTC to promulgate jointly: (1) uniform data security safeguard regulations; and (2) model notice forms.
 
Prescribes implementation and administrative enforcement procedures.
 
Preempts state laws governing consumer reporter data security responsibilities, except any laws governing professional confidentiality or limiting the purposes for which information may be disclosed.
 
(Sec. 3) Directs: (1) the President to convene a National Summit on Data Security Safeguards for Sensitive Personal Financial Information in the District of Columbia; and (2) the Comptroller General to study and report to Congress on a system that would provide notices of data breaches to consumers in languages other than English, and identify what barriers exist to its implementation.
 
(Sec. 5) Directs the FTC to compile voluntary information on the race and ethnicity of consumers who are victims of identity theft, account fraud, and other types of financial fraud, in order to improve law enforcement efforts relating to data security breaches and fighting identity theft and account fraud.
 
(Sec. 6) Amends the Credit Repair Organizations Act (CROA) to exempt from its coverage certain credit monitoring activities, including provision to a consumer of: (1) credit reports, credit monitoring notifications, credit scores and scoring algorithms, and other specified credit score-related tools; (2) any analysis, evaluation, and explanation of such actual or hypothetical credit scores or similar projections, forecasts, analyses, evaluations or explanations; or (3) materials or services to assist a consumer who is a victim of identity theft.
 
Specifies conditions for application of such exemption. Requires the credit monitoring service to refrain from offering to alter or remove, or assist in the alteration or removal of, accurate, non-obsolete adverse information in a credit report. Requires the service also to present the sonsumer with a specified notice and statement of rights.


Legislative actions:
action_date: 2006-06-08
text: Sponsor introductory remarks on measure. (CR H3502)
action_date: 2006-06-02
text: Placed on the Union Calendar, Calendar No. 270.
action_date: 2006-06-02
text: Reported (Amended) by the Committee on Financial Services. H. Rept. 109-453, Part III.
action_date: 2006-06-02
text: Reported (Amended) by the Committee on Financial Services. H. Rept. 109-453, Part III.
action_date: 2006-05-26
text: Reported (Amended) by the Committee on Judiciary. H. Rept. 109-453, Part II.
action_date: 2006-05-26
text: Reported (Amended) by the Committee on Judiciary. H. Rept. 109-453, Part II.
action_date: 2006-05-25
text: Ordered to be Reported (Amended) by Voice Vote.
action_date: 2006-05-25
text: Committee Consideration and Mark-up Session Held.
action_date: 2006-05-24
text: Ordered to be Reported (Amended) by Voice Vote.
action_date: 2006-05-24
text: Committee Consideration and Mark-up Session Held.
action_date: 2006-05-04
text: Referred jointly and sequentially to the House Committee on the Judiciary for a period ending not later than June 2, 2006 for consideration of such provisions of the bill and amendment as fall within the jurisdiction of that committee pursuant to clause 1(1), rule X.
action_date: 2006-05-04
text: Referred jointly and sequentially to the House Committee on Financial Services for a period ending not later than June 2, 2006 for consideration of such provisions of the bill and amendment as fall within the jurisdiction of that committee pursuant to clause 1(g), rule X.
action_date: 2006-05-04
text: Reported (Amended) by the Committee on Energy and Commerce. H. Rept. 109-453, Part I.
action_date: 2006-05-04
text: Reported (Amended) by the Committee on Energy and Commerce. H. Rept. 109-453, Part I.
action_date: 2006-03-29
text: Ordered to be Reported (Amended) by the Yeas and Nays: 41 - 0.
action_date: 2006-03-29
text: Committee Consideration and Mark-up Session Held.
action_date: 2005-11-03
text: Forwarded by Subcommittee to Full Committee (Amended) by the Yeas and Nays: 13 - 8.
action_date: 2005-11-03
text: Subcommittee Consideration and Mark-up Session Held.
action_date: 2005-11-01
text: Referred to the Subcommittee on Commerce, Trade and Consumer Protection.
action_date: 2005-10-25
text: Referred to the House Committee on Energy and Commerce.
action_date: 2005-10-25
text: Introduced in House
action_date: 2005-10-25
text: Introduced in House