,,ii #aaeth ,,congress #ast ,session ,s4 #bahh ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,december #d1 #bjag ,mr4 ,menendez introduced the following bill2 which was read twice and referred to the ,committee on ,banking1 ,housing1 and ,urban ,affairs ,a ,,bill ,to amend the ,fair ,credit ,reporting ,act to provide protections for consumers after a data breach at a consumer reporting agency1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,consumer ,data ,protection ,act4 #b4 ,data security 7a7 ,in general ,the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha et seq47 is amended by inserting after section #fje;,b 7#ae ,u4,s4,c4 #afha;c-#b7 the following3 #fje;,c4 ,data security at consumer reporting agencies 7a7 ,definitions ,in this section-- 7#a7 the term affected individual means an individual1 the sensitive personal information of whom is lost1 stolen1 or accessed without authorization because of a data breach2 7#b7 the term appropriate committees of ,congress means-- 7,a7 the ,committee on the ,judiciary of the ,senate2 7,b7 the ,committee on ,banking1 ,housing1 and ,urban ,affairs of the ,senate2 7,c7 the ,committee on the ,judiciary of the ,house of ,representatives2 and 7,d7 the ,committee on ,financial ,services of the ,house of ,representatives2 7#c7 the term covered action means an action that restricts the legal rights available to a consumer1 including-- 7,a7 requiring the consumer to-- 7i7 waive the right of the consumer to-- 7,i7 file a civil action in an appropriate court2 or 7,,ii7 bring1 or participate in1 a class action2 or 7ii7 engage in settlement negotiations before bringing an action under subsection 7c77#c72 and 7,b7 offering a financial inducement in exchange for the consumer waiving any right of the consumer2 7#d7 the term credit freeze-- 7,a7 except as provided in subparagraph 7,b71 means a restriction placed on the consumer report of a consumer at the request of the consumer1 or a personal representative of the consumer1 that prohibits a consumer reporting agency from releasing the consumer report for any purpose2 and 7,b7 with respect to the consumer report of a consumer1 shall not apply to the use of the consumer report by-- 7i7 a person1 or a subsidiary1 affiliate1 agent1 subcontractor1 or assignee of the person1 with which the consumer has1 or before assignment had1 an account1 contract1 or debtor-creditor relationship for the purposes of-- 7,i7 reviewing the active account2 or 7,,ii7 collecting the financial obligation owed on the account1 contract1 or debt2 7ii7 any person acting under a court order1 warrant1 or subpoena2 7iii7 a ,federal1 ,state1 or local government or an agent or assignee of a ,federal1 ,state1 or local government2 7iv7 any person for the sole purpose of providing a credit monitoring or identity theft protection service to which the consumer has subscribed2 7v7 any person for the purpose of providing a consumer with a copy of the consumer report1 credit score1 or educational credit score of the consumer upon request by the consumer2 7vi7 any person or entity for insurance purposes1 including use in setting or adjusting a rate1 adjusting a claim1 or underwriting2 and 7vii7 any person acting under an authorization from a consumer to use the consumer report of the consumer for employment purposes2 7#e7 the term data breach means the loss1 theft1 or other unauthorized access1 other than access that is incidental to the scope of employment1 of data containing sensitive personal information1 in electronic or printed form1 that results in the potential compromise of the confidentiality or integrity of the data2 and 7#f7 the term sensitive personal information means1 with respect to an individual1 information-- 7,a7 about the individual relating to the education1 financial transactions1 medical history1 criminal history1 or employment history of the individual2 and 7,b7 that can be used to distinguish or trace the identity of the individual1 including the name1 social security number1 date and place of birth1 mother's maiden name1 and biometric records of the individual4 7b7 ,data breaches at consumer reporting agencies ,with respect to a data breach at a consumer reporting agency1 the consumer reporting agency-- 7#a7 shall notify-- 7,a7 not later than #b days after the date on which the consumer reporting agency discovers the data breach-- 7i7 the ,federal ,trade ,commission2 7ii7 the ,bureau2 and 7iii7 appropriate law enforcement and intelligence agencies1 as identified by the ,secretary of ,homeland ,security2 and 7,b7 subject to paragraph 7#b71 not later than #c days after the date on which the consumer reporting agency discovers the data breach1 and as quickly and efficiently as is practicable1 each affected individual with respect to the data breach2 7#b7 may receive an extension of the deadline described in paragraph 7#a77;,b7 if the ,federal ,trade ,commission and the intelligence agencies identified under paragraph 7#a77;,a77iii7 determine that there is a national security concern that requires granting such an extension2 7#c7 shall1 upon request by any affected individual with respect to the data breach1 provide1 without charge to the affected individual and during the lifetime of the affected individual-- 7,a7 a credit freeze1 including the cost relating to imposing1 lifting1 or permanently removing a credit freeze1 with respect to the consumer report of the affected individual at any consumer reporting agency described in section #fjc7p72 and 7,b7 credit monitoring services for the affected individual at any consumer reporting agency described in section #fjc7p72 and 7#d7 shall1 in consultation with the ,bureau1 establish a consumer assistance unit-- 7,a7 that shall-- 7i7 be carried out1 and paid for1 by the consumer reporting agency2 and 7ii7 provide assistance1 free of charge and for a period of #aj years beginning on the date on which the consumer reporting agency submits the notifications required under paragraph 7#a77;,a71 to any affected individual who wants to dispute an item in the file of the affected individual that was entered into that file after the date on which the data breach occurred2 and 7,b7 with respect to which the consumer reporting agency shall1 as soon as practicable after the date on which the consumer assistance unit is established1 notify each affected individual with respect to the data breach by mail and e-mail4 7c7 ,enforcement 7#a7 ,in general ,subject to subtitle ,b of the ,consumer ,financial ,protection ,act of #bjaj 7#ab ,u4,s4,c4 #eeaa et seq471 the ,federal ,trade ,commission or the ,bureau may bring a civil action to recover a civil penalty in an appropriate district court of the ,united ,states against any person that negligently1 knowingly1 or willingly causes a data breach at a consumer reporting agency4 7#b7 ,penalty amount 7,a7 ,in general ,in a successful action brought under paragraph 7#a71 the person against which the action is brought shall be liable for a civil penalty of not more than-- 7i7 #b1ejj for each affected individual with respect to the data breach caused by the person2 and 7ii7 #be1jjj1jjj in total4 7,b7 ,considerations ,in determining the amount of a civil penalty in a successful action brought under paragraph 7#a71 the court shall consider1 with respect to the person against which the action is brought-- 7i7 the degree of culpability of the person2 7ii7 any history of similar prior conduct by the person2 7iii7 the ability of the person to pay2 7iv7 the effect of the penalty on the ability of the person to continue to do business2 and 7v7 any other factor as justice may require4 7#c7 ,private cause of action 7,a7 ,definition ,in this paragraph1 the term actual loss means the total cost to an affected individual as a result of a data breach at a consumer reporting agency1 including-- 7i7 the costs incurred by the affected individual-- 7,i7 in responding to the data breach2 and 7,,ii7 as a result of-- 7aa7 reviewing accounts of the affected individual for fraudulent charges2 7bb7 closing accounts of the affected individual that may have been compromised by the data breach2 and 7cc7 imposing credit freezes and obtaining credit monitoring services2 and 7ii7 any revenue lost1 or cost or consequential damage incurred1 by the affected individual relating to the interruption of the ability of the affected individual to obtain credit4 7,b7 ,cause of action 7i7 ,in general ,an affected individual may bring an action in an appropriate district court of the ,united ,states against any person that negligently1 knowingly1 or willingly caused a data breach at a consumer reporting agency in which the sensitive personal information of the affected individual was lost1 stolen1 or accessed without authorization4 7ii7 ,damages ,in a successful action brought by an affected individual under clause 7i71 the affected individual may recover-- 7,i7 the greater of-- 7aa7 the actual loss to the affected individual with respect to the data breach described in that clause2 or 7bb7 #a1jjj in liquidated damages2 7,,ii7 punitive damages1 as the court may allow2 and 7,,iii7 the costs of the action1 together with reasonable attorney's fees1 as determined by the court4 7d7 ,review of compliance with standards for safeguarding customer information 7#a7 ,definition ,in this subsection1 the term covered person has the meaning given the term in section #ajjb of the ,consumer ,financial ,protection ,act of #bjaj 7#ab ,u4,s4,c4 #edha74 7#b7 ,examination ,the ,bureau may examine any consumer reporting agency that is a covered person subject to supervision under section #ajbd of the ,consumer ,financial ,protection ,act of #bjaj 7#ab ,u4,s4,c4 #eead7 for compliance by that agency with the standards established by the ,federal ,trade ,commission under section #eja7;b7 of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja7;b774 7e7 ,protection of legal rights of consumers ,a consumer reporting agency may not take a covered action-- 7#a7 as a condition of providing any service or product to1 or on behalf of1 a consumer2 and 7#b7 that relates to the rights of a consumer after a data breach at the consumer reporting agency in which the sensitive personal information of the consumer is lost1 stolen1 or accessed without authorization4 7f7 ,annual study and report 7#a7 ,in general ,beginning in the first full year after the date of enactment of this section1 and annually thereafter1 the ,bureau and the ,federal ,trade ,commission1 in consultation with the ,attorney ,general1 shall conduct a study regarding the costs to affected individuals from data breaches at consumer reporting agencies1 including-- 7,a7 the economic costs to those affected individuals2 7,b7 the effects on-- 7i7 the ability of those affected individuals to obtain credit and housing2 and 7ii7 the reputations of those affected individuals2 and 7,c7 the costs relating to the emotional and psychological stress of those affected individuals from having the sensitive personal information of those affected individuals lost1 stolen1 or accessed without authorization4 7#b7 ,submission to ,congress ,not later than #cj days after the date on which each study conducted under paragraph 7#a7 is completed1 the ,bureau and the ,federal ,trade ,commission shall submit to the appropriate committees of ,congress a report that contains the results of the study4 7#c7 ,contents ,each study conducted under paragraph 7#a7 and each report submitted under paragraph 7#b7 shall contain a survey of affected individuals who were contacted for the purposes of conducting the study4 7#d7 ,authority ,in conducting any study under paragraph 7#a71 the ,bureau1 the ,federal ,trade ,commission1 and the ,attorney ,general may compel a consumer reporting agency to disclose nonproprietary information4 7g7 ,rule of construction ,nothing in this section may be construed as modifying1 limiting1 or superseding any provision of ,state law if the protection that the provision of ,state law provides to consumers is greater than the protection provided to consumers under this section4 4 7b7 ,technical and conforming amendment ,the table of contents for the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha et seq47 is amended by inserting after the item relating to section #fje;,b the following3 #fje;,c4 ,data security at consumer reporting agencies4 4