To protect the privacy of the individual with respect to the Social Security number and other personal information, and for other purposes.

May 1, 2003

Mr. KLECZKA (for himself, Mr. FROST, Mr. STARK, Mr. KUCINICH, Mr. MCNULTY, Mr. FALEOMAVAEGA, and Mr. KINGSTON) introduced the following bill; which was referred to the Committee on Ways and Means, and in addition to the Committee on Financial Services, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned

To protect the privacy of the individual with respect to the Social Security number and other personal information, and for other purposes.

Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

This Act may be cited as the `Personal Information Privacy Act of 2003'.

SEC. 2. CONFIDENTIAL TREATMENT OF CREDIT HEADER INFORMATION.

Section 603(d)(1) of the Fair Credit Reporting Act (15 U.S.C. 1681a(d)(1)) is amended by inserting after subparagraph (C) the following new sentence:

`The term also includes any other identifying information of the consumer, except the name, address, and telephone number of the consumer if listed in a residential telephone directory available in the locality of the consumer.'.

SEC. 3. PROTECTING PRIVACY BY PROHIBITING USE OF THE SOCIAL SECURITY NUMBER FOR COMMERCIAL PURPOSES WITHOUT CONSENT.

(a) IN GENERAL- Part A of title XI of the Social Security Act (42 U.S.C. 1301 et seq.) is amended by adding at the end the following:

`PROHIBITION OF CERTAIN MISUSES OF THE SOCIAL SECURITY ACCOUNT NUMBER

`SEC. 1150A. (a) PROHIBITION OF COMMERCIAL ACQUISITION OR DISTRIBUTION- No person may buy, sell, offer for sale, take or give in exchange, or pledge or give in pledge any information for the purpose, in whole or in part, of conveying by means of such information any individual's social security account number, or any derivative of such number, without the written consent of such individual.

`(b) PROHIBITION OF USE AS PERSONAL IDENTIFICATION NUMBER- No person may utilize any individual's social security account number, or any derivative of such number, for purposes of identification of such individual without the written consent of such individual.

`(c) PREREQUISITES FOR CONSENT- In order for consent to exist under subsection (a) or (b), the person engaged in, or seeking to engage in, an activity described in such subsection shall--

`(1) inform the individual of all the purposes for which the number will be utilized and the persons to whom the number will be known; and

`(2) obtain affirmatively expressed consent in writing.

`(d) EXCEPTIONS- Nothing in this section shall be construed to prohibit any use of social security account numbers permitted or required under section 205(c)(2) of this Act, section 7(a)(2) of the Privacy Act of 1974 (5 U.S.C. 552a note; 88 Stat. 1909), or section 6109(d) of the Internal Revenue Code of 1986.

`(e) CIVIL ACTION IN UNITED STATES DISTRICT COURT; DAMAGES; ATTORNEYS FEES AND COSTS; NONEXCLUSIVE NATURE OF REMEDY-

`(1) IN GENERAL- Any individual aggrieved by any act of any person in violation of this section

may bring a civil action in a United States district court to recover--

`(A) such preliminary and equitable relief as the court determines to be appropriate; and

`(B) the greater of--

`(i) actual damages; and

`(ii) liquidated damages of $25,000 or, in the case of a violation that was willful and resulted in profit or monetary gain, $50,000.

`(2) ATTORNEY'S FEES AND COSTS- In the case of a civil action brought under paragraph (1) in which the aggrieved individual has substantially prevailed, the court may assess against the respondent a reasonable attorney's fee and other litigation costs and expenses (including expert fees) reasonably incurred.

`(3) STATUTE OF LIMITATIONS- No action may be commenced under this subsection more than 3 years after the date on which the violation was or should reasonably have been discovered by the aggrieved individual.

`(4) NONEXCLUSIVE REMEDY- The remedy provided under this subsection shall be in addition to any other lawful remedy available to the individual.

`(f) CIVIL MONEY PENALTIES-

`(1) IN GENERAL- Any person who the Commissioner of Social Security determines has violated this section shall be subject, in addition to any other penalties that may be prescribed by law, to--

`(A) a civil money penalty of not more than $25,000 for each such violation, and

`(B) a civil money penalty of not more than $500,000, if violations have occurred with such frequency as to constitute a general business practice.

`(2) DETERMINATION OF VIOLATIONS- Any violation committed contemporaneously with respect to the social security account numbers of 2 or more individuals by means of mail, telecommunication, or otherwise shall be treated as a separate violation with respect to each such individual.

`(3) ENFORCEMENT PROCEDURES- The provisions of section 1128A (other than subsections (a), (b), (f), (h), (i), (j), and (m), and the first sentence of subsection (c)) and the provisions of subsections (d) and (e) of section 205 shall apply to civil money penalties under this subsection in the same manner as such provisions apply to a penalty or proceeding under section 1128A(a), except that, for purposes of

this paragraph, any reference in section 1128A to the Secretary shall be deemed a reference to the Commissioner of Social Security.

`(4) COORDINATION WITH CRIMINAL ENFORCEMENT- The Commissioner of Social Security shall take such actions as are necessary and appropriate to assure proper coordination of the enforcement of the provisions of this section with criminal enforcement under section 1028 of title 18, United States Code (relating to fraud and related activity in connection with identification documents). The Commissioner shall enter into cooperative arrangements with the Federal Trade Commission under section 5 of the Identity Theft and Assumption Deterrence Act of 1998 for purposes of achieving such coordination.

`(g) REGULATION BY STATES- Nothing in this section shall be construed to prohibit any State authority from enacting or enforcing laws consistent with this section for the protection of privacy.'.

(b) EFFECTIVE DATE- The amendment made by subsection (a) applies with respect to violations occurring on and after the date which is 2 years after the date of enactment of this Act.

(c) UNFAIR OR DECEPTIVE ACT OR PRACTICE- Any person who refuses to do business with an individual because the individual will not consent to that person receiving the social security number of such individual shall be considered to have committed an unfair or deceptive act or practice in violation of section 5 of the Federal Trade Commission Act (15 U.S.C. 45). Action may be taken under such section 5 against such a person.

SEC. 4. REPEAL OF CERTAIN PROVISIONS RELATING TO DISTRIBUTION OF CONSUMER REPORTS IN CONNECTION WITH CERTAIN TRANSACTIONS NOT INITIATED BY THE CONSUMER.

(a) IN GENERAL- Paragraph (1) of section 604(c) of the Fair Credit Reporting Act (15 U.S.C. 1681b(c)) is amended by striking `any credit or insurance transaction that is not initiated by the consumer only if--' and all that follows through the end of such paragraph and inserting `any credit or insurance transaction that is not initiated by the consumer only if the consumer provides express written authorization, in accordance with paragraph (2), to the agency to provide such report in connection with any such transaction.'

(b) FULL DISCLOSURE REQUIRED- Paragraph (2) of section 604(c) of the Fair Credit Reporting Act (15 U.S.C. 1681b(c)) is amended to read as follows:

`(2) FULL DISCLOSURE REQUIRED-

`(A) IN GENERAL- No authorization referred to in paragraph (1) with respect to any consumer shall be effective unless the consumer receives a notice before such authorization is provided which fully and fairly discloses, in accordance with regulations which the Federal Trade Commission and the Board of Governors of the Federal Reserve System shall jointly prescribe, what specifically is being authorized by the consumer and the potential positive and negative effects the provision of such authorization will have on the consumer.

`(B) FORM OF NOTICE- The regulations prescribed pursuant to subparagraph (A) shall require that the notice required under such subparagraph--

`(i) be prominently displayed on a document which is separate from any other document; or

`(ii) if the notice appears on a document with other information, be placed in a clear and conspicuous location on such document and appear in type face which is more conspicuous than the type face used for any other information on such document.'.

(c) TECHNICAL AND CONFORMING AMENDMENT- Subsection (e) of section 604 of the Fair Credit Reporting Act (15 U.S.C. 1681b) is amended to read as follows:

`(e) [Repealed]'.

SEC. 5. SALE OR TRANSFER OF TRANSACTION OR EXPERIENCE INFORMATION PROHIBITED.

(a) IN GENERAL- The Fair Credit Reporting Act (15 U.S.C. 1681 et seq.) is amended by adding at the end the following new section:

`Sec. 627. Transaction or experience information

`(a) IN GENERAL- No person doing business with a consumer may sell, transfer, or otherwise provide to any other person, for the purpose of marketing such information to any other person, any transaction or experience information without the consumer's express written consent.

`(b) TRANSACTION OR EXPERIENCE INFORMATION DEFINED- For purposes of this section, the term `transaction or experience information' means any information identifying the content or subject of 1 or more transactions between the consumer and a person doing business with a consumer, including any component part of any transaction, any brand name involved, or any quantity or category of merchandise involved in any part of the transaction.

`(c) EXCEPTIONS- Subsection (a) shall not apply with respect to the following:

`(1) Communication of transaction or experience information solely among persons related by common ownership or affiliated by corporate control.

`(2) Information provided pursuant to the order of a court having jurisdiction to issue such order or pursuant to a subpoena issued in connection with proceedings before a Federal grand jury.

`(3) Information provided in connection with the licensing or registration by a government agency or department, or any transfer of such license or registration, of any personal property bought, sold, or transferred by the consumer.

`(4) Information required to be provided in connection with any transaction in real estate.

`(5) Information required to be provided in connection with perfecting a security interest in personal property.

`(6) Information relating to the amount of any transaction or any credit extended in connection with a transaction with a consumer.'.

(b) TECHNICAL AND CONFORMING AMENDMENT- Section 603(d)(2)(A) is amended by striking `(A) any--' and inserting `(A) subject to section 627, any--'.

(c) CLERICAL AMENDMENT- The table of sections for the Fair Credit Reporting Act is amended by adding at the end the following new item:

`627. Transaction or experience information.'.

END