,i  #aafth ,,congress  #ast ,session    
,h4 ,r4 #ddhj  ,,in ,,the ,,house ,,of  
,,representatives  ,september #bd1      
#bjai,mr4 ,steube 7for himself and ,mr4 
,hagedorn7 introduced the following     
bill2 which was referred to the         
,committee on ,small ,business  ,a      
,,bill  ,to amend the ,small ,business  
,act to require that credit reporting   
companies provide certain protections to
 small businesses1 and for other        
purposes4  #a4 ,short title ,this ,act  
may be cited as the ,small ,business    
,credit ,protection ,act of #bjai4  #b4 
,data breaches  7a7 ,in general ,the    
,small ,business ,act 7#ae ,u4,s4,c4    
#fca et seq47 is amended--  7#a7 by     
redesignating section #di 7#ae ,u4,s4,c4
 #fca note7 as section #ej2 and  7#b7 by
 inserting after section #dh 7#ae       
,u4,s4,c4 #fegu7 the following new      
section3  #di4 ,data breaches  7a7      
,definition ,in this section-- 7#a7 the 
term consumer report has the meaning    
given the term in section #fjc of the   

,fair ,credit ,reporting ,act 7#ae      
,u4,s4,c4 #afha;a72 and  7#b7 the term  
credit reporting company-- 7,a7 has the 
meaning given the term consumer         
reporting agency in section #fjc of the 
,fair ,credit ,reporting ,act 7#ae      
,u4,s4,c4 #afha;a72 and  7,b7 includes  
an entity that collects commercial      
credit data4  7b7 ,requirements for     
reporting breaches  7#a7 ,applicable    
state law  7,a7 ,in general ,except as  
provided in paragraph 7#b71 if nonpublic
 data of a small business concern that  
is collected or stored by a credit      
reporting company has been breached1 the
 credit reporting company shall report  
the breach promptly and not later than  
as required under the law of the ,state 
in which the small business concern is  
located4  7,b7 ,locations in multiple   
states ,if a small business concern that
 is affected by a breach described in   
subparagraph 7,a7 has locations in more 
than #a ,state1 for the purposes of that
 subparagraph1 the law of the ,state    

that imposes the shortest period for the
 reporting of the breach shall apply4   
7#b7 ,exception  7,a7 ,in general ,if a 
small business concern that is affected 
by a breach described in paragraph      
7#a77;,a7 is located in a ,state that   
does not have a law that imposes a set  
period for the reporting of the breach1 
the credit reporting company to which   
the requirement under that paragraph    
applies shall report the breach in the  
most expeditious manner practicable and 
without unreasonable delay4  7,b7 ,rule 
of construction regarding a law         
enforcement request ,for the purposes of
 subparagraph 7,a71 a delay with respect
 to the reporting of a breach described 
in that subparagraph that is caused by a
 requirement to respond to a request    
submitted by a law enforcement agency   
shall be construed to be a reasonable   
delay4  7c7 ,prohibition ,during the    
#ahj-;day period beginning on the date  
on which a breach described in          
subsection 7b77#a77;,a7 occurs1 a credit

 reporting company may not charge a     
small business concern that is affected 
by that breach for providing the small  
business concern with the consumer      
report of the small business concern4   
7d7 ,no preemption ,nothing in this     
section shall preempt any ,state law    
with respect to credit reporting        
companies4  4  7b7 ,,gao report  7#a7   
,definitions ,in this subsection1 the   
term credit reporting company--  7,a7   
has the meaning given the term consumer 
reporting agency in section #fjc of the 
,fair ,credit ,reporting ,act 7#ae      
,u4,s4,c4 #afha;a72 and  7,b7 includes  
an entity that collects commercial      
credit data4  7#b7 ,report ,not later   
than #a year after the date of enactment
 of this ,act1 the ,comptroller ,general
 of the ,united ,states shall submit to 
,congress a report regarding the        
economic harm incurred by small business
 concerns as a result of data breaches  
at credit reporting companies4