Identity Theft Prevention Act

Bill: 110-s-1178
Sponsor: Sen. Inouye, Daniel K. [D-HI]
Introduced: 2007-04-20 in the Senate
Policy area: Commerce
Subjects: Administrative procedure
Bank accounts
Charities
Consumer credit
Credit cards
Crime and Law Enforcement
Debit cards
Driver licenses
Drug abuse
Federal Trade Commission
Federal advisory bodies
Federal preemption
Finance and Financial Sector
Government Operations and Politics
Government paperwork
Government publicity
Identification devices
Identity theft
Independent regulatory commissions
Labor and Employment
Law
Methamphetamine
Nonprofit organizations
Prison labor
Restrictive trade practices
Science, Technology, Communications
Social Welfare
Social security numbers
State laws
Telephone
Transportation and Public Works

Summary:
action_date: 2007-04-20
text: 
Identity Theft Prevention Act - Requires any commercial entity or charitable, educational, or nonprofit organization that acquires, maintains, or uses sensitive personal information (covered entity) to develop, implement, maintain, and enforce a written program, containing administrative, technical, and physical safeguards, for the security of sensitive personal information it collects, maintains, sells, transfers, or disposes of. Defines &quot;sensitive personal information&quot; as an individual's name, address, or telephone number combined with at least one of the following relating to that individual: (1) the social security number or numbers derived from that number; (2) financial account or credit or debit card numbers combined with codes or passwords that permit account access, subject to exception; or (3) a state driver's license or resident identification number.
 
Requires a covered entity: (1) to report a security breach to the Federal Trade Commission (FTC); (2) if the entity determines that the breach creates a reasonable risk of identity theft, to notify each affected individual; and (3) if the breach involves at least 1,000 individuals, to notify all consumer reporting agencies specified in the Fair Credit Reporting Act.
 
Authorizes a consumer to place a security freeze on his or her credit report by making a request to a consumer credit reporting agency. Prohibits a reporting agency, when a freeze is in effect, from releasing the consumer's report for credit review purposes without the consumer's prior express authorization. Sets forth other security freeze requirements.
 
Requires: (1) the establishment of the Information Security and Consumer Privacy Advisory Committee; (2) a related crime study, including the correlation between methamphetamine use and identity theft crimes.
 
Treats any violation of this Act as an unfair or deceptive act or practice under the Federal Trade Commission Act. Requires enforcement under other specified laws. Allows enforcement by state attorneys general. Preempts state laws requiring notification of affected individuals of security breaches. 

action_date: 2007-12-05
text: 
Identity Theft Prevention Act - (Sec. 2) Requires any commercial entity or charitable, educational, or nonprofit organization that acquires, maintains, or uses sensitive personal information (covered entity) to develop, implement, maintain, and enforce a written program, containing administrative, technical, and physical safeguards, for the security of sensitive personal information it collects, maintains, sells, transfers, or disposes of. Defines &quot;sensitive personal information&quot; as an individual's name, address, or telephone number combined with at least one of the following relating to that individual: (1) the social security number or numbers derived from that number; (2) financial account or credit or debit card numbers combined with codes or passwords that permit account access, subject to exception; or (3) a state driver's license or resident identification number.
 
(Sec. 3) Requires a covered entity: (1) to report a security breach to the Federal Trade Commission (FTC); (2) if the entity determines that the breach creates a reasonable risk of identity theft, to notify each affected individual; and (3) if the breach involves 1,000 or more individuals, to notify all consumer reporting agencies specified in the Fair Credit Reporting Act.

(Sec. 4) Authorizes a consumer to place a security freeze on his or her credit report by making a request to a consumer credit reporting agency. Prohibits a reporting agency, when a freeze is in effect, from releasing the consumer's report for credit review purposes without the consumer's prior express authorization. Provides for freeze removal and suspension, limits related fees, and sets forth other security freeze requirements. Exempts from certain provisions of this Act: (1) a consumer credit reporting agency that acts only as a reseller of credit information and does not maintain a permanent database of credit information; (2) check services or fraud prevention services companies; and (3) deposit account information service companies.

(Sec. 5) Requires: (1) the establishment of the Information Security and Consumer Privacy Advisory Committee; and (2) a related crime study and report, including regarding the correlation between methamphetamine use and identity theft crimes.

(Sec. 8) Treats any violation of this Act as an unfair or deceptive act or practice under the Federal Trade Commission Act. Requires enforcement under other specified laws. Allows enforcement by state attorneys general. Preempts state laws requiring notification of affected individuals of security breaches. Preempts state laws relating to the use of social security numbers. 

(Sec. 11) Prohibits, subject to exception, a covered entity from soliciting a social security number from an individual unless there is a specific use of that number for which no other identifier can reasonably be used. 

Prohibits the display of social security numbers on identification cards commonly provided to employees, faculty, staff, or students and on state driver's licenses. 

Amends title II (Old Age, Survivors and Disability Insurance) (OASDI) of the Social Security Act to prohibit federal, state, and political subdivision governmental entities and their agents from using prisoners in a way that would allow the prisoners access to other individuals' social security numbers.
 
Makes it unlawful to sell, purchase, provide, or display a social security number to the general public or to obtain or use any individual's social security number for the purpose of locating or identifying the individual with the intent to physically injure or harm the individual or for the purpose of using the individual's identity for any illegal purpose, subject to exceptions, including sales or displays of such numbers for the purposes of national security, public health or safety, and locating abducted children.
 
 (Sec. 12) Requires each U.S. agency to: (1) develop, implement, maintain, and enforce a written program for the security of sensitive personal information the agency collects, maintains, sells, transfers, or disposes of; (2) use due diligence to investigate any suspected breach of security affecting sensitive personal information; and (3) notify each affected individual after a breach.

(Sec. 14) Authorizes appropriations.


Legislative actions:
action_date: 2007-12-05
text: Placed on Senate Legislative Calendar under General Orders. Calendar No. 520.
action_date: 2007-12-05
text: Committee on Commerce, Science, and Transportation. Reported by Senator Inouye with amendments. With written report No. 110-235.
action_date: 2007-12-05
text: Committee on Commerce, Science, and Transportation. Reported by Senator Inouye with amendments. With written report No. 110-235.
action_date: 2007-04-25
text: Committee on Commerce, Science, and Transportation. Ordered to be reported with amendments favorably.
action_date: 2007-04-20
text: Read twice and referred to the Committee on Commerce, Science, and Transportation.
action_date: 2007-04-20
text: Sponsor introductory remarks on measure. (CR S4812-4813)
action_date: 2007-04-20
text: Introduced in Senate