To prevent the crime of identity theft, mitigate the harm to individuals throughout the Nation who have been victimized by identity theft, and for other purposes.

July 31 (legislative day, JULY 21), 2003

Ms. CANTWELL (for herself and Mr. ENZI) introduced the following bill; which was read twice and referred to the Committee on the Judiciary

To prevent the crime of identity theft, mitigate the harm to individuals throughout the Nation who have been victimized by identity theft, and for other purposes.

Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

This Act may be cited as the `Identity Theft Victims Assistance Act of 2003'.

SEC. 2. FINDINGS.

Congress finds the following:

(1) The crime of identity theft is the fastest growing crime in the United States. According to a recent estimate, 7,000,000 Americans were victims of identity theft in the past year, a 79 percent increase over previous estimates.

(2) Stolen identities are often used to perpetrate crimes in many cities and States, making it more difficult for consumers to restore their respective identities.

(3) Identity theft cost consumers more than $745,000,000 in 1998 and has increased dramatically in the last few years. The credit card industry alone lost an estimated $144.3 million in 2000.

(4) Identity theft is ruinous to the good name and credit of consumers whose identities are misappropriated, and consumers may be denied otherwise deserved credit and may have to spend enormous time, effort, and money to restore their respective identities.

(5) Victims are often required to contact numerous Federal, State, and local law enforcement agencies and creditors over many years as each event of fraud arises.

(6) As of the date of enactment of this Act, a national mechanism does not exist to assist identity theft victims to obtain evidence of identity theft, restore their credit, and regain control of their respective identities.

(7) Victims of identity theft need a nationally standardized means of--

(A) establishing their true identities and claims of identity theft to all business entities, credit reporting agencies, and Federal and State law enforcement agencies;

(B) obtaining information documenting fraudulent transactions from business entities;

(C) reporting identity theft to consumer credit reporting agencies.

(8) One of the greatest law enforcement challenges posed by identity theft is that stolen identities are often used to perpetrate crimes in many different localities in different States, and although identity theft is a Federal crime, most often, State and local law enforcement agencies are responsible for investigating and prosecuting the crimes.

(9) Law enforcement, business entities, credit reporting agencies, and government agencies have a shared responsibility to assist victims of identity theft to mitigate the harm caused by any fraud perpetrated in the name of the victims.

SEC. 3. TREATMENT OF IDENTITY THEFT MITIGATION.

(a) IN GENERAL- Chapter 47 of title 18, United States Code, is amended by adding after section 1028 the following:

`Sec. 1028A. Treatment of identity theft mitigation

`(a) DEFINITIONS- As used in this section--

`(1) the term `business entity' means any corporation, trust, partnership, sole proprietorship, or unincorporated association, including any financial service provider, financial information repository, creditor (as that term is defined in section 103 of the Truth in Lending Act (15 U.S.C. 1602)), telecommunications, utilities, or other service provider;

`(2) the term `consumer' means an individual;

`(3) the term `financial information' means information identifiable as relating to an individual consumer that concerns the amount and conditions of the assets, liabilities, or credit of the consumer, including--

`(A) account numbers and balances;

`(B) nonpublic personal information, as that term is defined in section 509 of the Gramm-Leach-Bliley Act (15 U.S.C. 6809); and

`(C) codes, passwords, social security numbers, tax identification numbers, State identifier numbers issued by a State department of licensing, and other information used for the purpose of account access or transaction initiation;

`(4) the term `financial information repository' means a person engaged in the business of providing services to consumers who have a credit, deposit, trust, stock, or other financial services account or relationship with that person;

`(5) the term `identity theft' means a violation of section 1028 or any other similar provision of applicable Federal or State law;

`(6) the term `means of identification' has the same meaning given the term in section 1028;

`(7) the term `victim' means a consumer whose means of identification or financial information has been used or transferred (or has been alleged to have been used or transferred) without the authority of that consumer with the intent to commit, or with the intent to aid or abet, an identity theft; and

`(8) the terms not defined in this section or otherwise defined in section 3(s) of the Federal Deposit Insurance Act (12 U.S.C. 1813(s)) shall have the meaning given to them in section 1(b) of the International Banking Act of 1978 (12 U.S.C. 3101).

`(b) INFORMATION AVAILABLE TO VICTIMS-

`(1) IN GENERAL- A business entity that possesses information relating to an alleged identity theft, or that has entered into a transaction, provided credit, provided, for consideration, products, goods, or services, accepted payment, otherwise entered into a commercial transaction for consideration with a person that has made unauthorized use of the means of identification of the victim, or possesses information relating to such transaction, shall, not later than 20 days after the receipt of a written request by the victim, meeting the requirements of subsection (c), provide, without charge, a copy of all application and business transaction information related to the transaction being alleged as an identity theft to--

`(A) the victim;

`(B) any Federal, State, or local governing law enforcement agency or officer specified by the victim in such a request; or

`(C) any law enforcement agency investigating the identity theft and authorized by the victim to take receipt of records provided under this section.

`(2) RULE OF CONSTRUCTION-

`(A) IN GENERAL- No provision of Federal or State law prohibiting the disclosure of financial information by a business entity to third parties shall be used to deny disclosure of information to the victim under this section.

`(B) LIMITATION- Except as provided in subparagraph (A), nothing in this section permits a business entity to disclose information that the business entity is otherwise prohibited from disclosing under any other applicable provision of Federal or State law.

`(c) VERIFICATION OF IDENTITY AND CLAIM- Unless a business entity, at its discretion, is otherwise able to verify the identity of a victim making a request under subsection (b)(1), the victim shall provide to the business entity--

`(1) as proof of positive identification, at the election of the business entity--

`(A) the presentation of a government-issued identification card;

`(B) if providing proof by mail, a copy of a government-issued identification card; or

`(C) upon the request of the person seeking business records, the business entity may inform the requesting person of the categories of identifying information that the unauthorized person provided the business entity as personally identifying information, and may require the requesting person to provide identifying information in those categories; and

`(2) as proof of a claim of identity theft, at the election of the business entity--

`(A) a copy of a police report evidencing the claim of the victim of identity theft;

`(B) a properly completed copy of a standardized affidavit of identity theft developed and made available by the Federal Trade Commission; or

`(C) any properly completed affidavit of fact that is acceptable to the business entity for that purpose.

`(d) LIMITATION ON LIABILITY- No business entity may be held liable for a disclosure, made in good faith and reasonable judgment, to provide information under this section with respect to an individual in connection with an identity theft to other business entities, law enforcement authorities, victims, or any person alleging to be a victim, if--

`(1) the business entity complies with subsection (c); and

`(2) such disclosure was made--

`(A) for the purpose of detection, investigation, or prosecution of identity theft; or

`(B) to assist a victim in recovery of fines, restitution, rehabilitation of the credit of the victim, or such other relief as may be appropriate.

`(e) AUTHORITY TO DECLINE TO PROVIDE INFORMATION- A business entity may decline to provide information under subsection (b) if, in the exercise of good faith and reasonable judgment, the business entity determines that--

`(1) this section does not require disclosure of the information;

`(2) the request for the information is based on a misrepresentation of fact by the victim relevant to the request for information; or

`(3) the information requested is Internet navigational data or similar information about a person's visit to a website or online service.

`(f) NO NEW RECORDKEEPING OBLIGATION- Nothing in this section creates an obligation on the part of a business entity to obtain, retain, or maintain information or records that are not otherwise required to be obtained, retained, or maintained in the ordinary course of its business or under other applicable law.

`(g) AFFIRMATIVE DEFENSE- In any civil action brought to enforce this section, it is an affirmative defense (which the defendant must establish by a preponderance of the evidence) for a business entity to file an affidavit or answer stating that--

`(1) the business entity has made a reasonable diligent search of its available business records; and

`(2) the records requested under this section do not exist or are not available.

`(h) NO PRIVATE RIGHT OF ACTION- Nothing in this section shall be construed to provide a private right of action or claim for relief.

`(i) ENFORCEMENT-

`(1) INJUNCTIVE ACTIONS BY THE ATTORNEY GENERAL-

`(A) IN GENERAL- Whenever it appears that a business entity to which this section applies has engaged, is engaged, or is about to engage, in any act or practice constituting a violation of this section, the Attorney General of the United States may bring a civil action in an appropriate district court of the United States to--

`(i) enjoin such act or practice;

`(ii) enforce compliance with this section; and

`(iii) obtain such other equitable relief as the court determines to be appropriate.

`(B) OTHER INJUNCTIVE RELIEF- Upon a proper showing in the action under subparagraph (A), the court shall grant a permanent injunction or a temporary restraining order without bond.

`(2) ADMINISTRATIVE ENFORCEMENT-

`(A) FEDERAL TRADE COMMISSION-

`(i) IN GENERAL- Except to the extent that administrative enforcement is specifically committed to another agency under subparagraph (B), a violation of this section shall be deemed an unfair or deceptive act or practice in violation of the Federal Trade Commission Act (15 U.S.C. 41 et seq.), for purposes of the exercise by the Federal Trade Commission of its functions and powers under that Act.

`(ii) AVAILABLE FUNCTIONS AND POWERS- All of the functions and powers of the Federal Trade Commission under the Federal Trade Commission Act are available to the Commission to enforce compliance by any person with this section.

`(B) OTHER FEDERAL AGENCIES- Compliance with any requirements under this section may be enforced--

`(i) under section 8 of the Federal Deposit Insurance Act (12 U.S.C. 1818)--

`(I) by the Office of the Comptroller of the Currency, with respect to national banks, and Federal branches and Federal agencies of foreign banks (except brokers, dealers, persons providing insurance, investment companies, and investment advisers);

`(II) by the Board of Governors of the Federal Reserve System, with respect to member banks of the Federal Reserve System (other than national banks), branches and agencies of foreign banks (other than Federal branches, Federal agencies, and insured State branches of foreign banks), commercial lending companies owned or controlled by foreign banks, and organizations operating under section 25 or 25A of the Federal Reserve Act (12 U.S.C. 601 et seq. and 611 et seq.);

`(III) by the Board of Directors of the Federal Deposit Insurance Corporation, with respect to banks insured by the Federal Deposit Insurance Corporation (other than members of the Federal Reserve System), insured State branches of foreign banks, and any subsidiaries of such entities (except brokers, dealers, persons providing insurance, investment companies, and investment advisers); and

`(IV) by the Director of the Office of Thrift Supervision, with respect to savings associations, the deposits of which are insured by the Federal Deposit Insurance Corporation, and any subsidiaries of such savings associations (except brokers, dealers, persons providing insurance, investment companies, and investment advisers);

`(ii) by the Board of the National Credit Union Administration, under the Federal Credit Union Act (12 U.S.C. 1751 et seq.), with respect to any federally insured credit union, and any subsidiaries of such credit union;

`(iii) by the Securities and Exchange Commission, under the Securities Exchange Act of 1934 (15 U.S.C. 78a et seq.), with respect to any broker or dealer;

`(iv) by the Securities and Exchange Commission, under the Investment Company Act of 1940 (15 U.S.C. 80a-1 et seq.), with respect to investment companies;

`(v) by the Securities and Exchange Commission, under the Investment Advisers Act of 1940 (15 U.S.C. 80b-1 et seq.), with respect to investment advisers registered with the Commission under such Act;

`(vi) by the Secretary of Transportation, under subtitle IV of title 49, with respect to all carriers subject to the jurisdiction of the Surface Transportation Board;

`(vii) by the Secretary of Transportation, under part A of subtitle VII of title 49, with respect to any air carrier or any foreign air carrier subject to that part; and

`(viii) by the Secretary of Agriculture, under the Packers and Stockyards Act, 1921 (7 U.S.C. 181 et seq.), except as provided in section 406 of that Act (7 U.S.C. 226, 2271), with respect to any activities subject to that Act.

`(C) AGENCY POWERS-

`(i) IN GENERAL- A violation of any requirement imposed under this section shall be deemed to be a violation of a requirement imposed under any Act referred to under subparagraph (B), for the purpose of the exercise by any agency referred to under subparagraph (B) of its powers under any such Act.

`(ii) RULE OF CONSTRUCTION- Nothing in this section shall be construed to prevent a Federal agency from exercising the powers conferred upon such agency by Federal law to--

`(I) conduct investigations;

`(II) administer oaths or affirmations; or

`(III) compel the attendance of witnesses or the production of documentary or other evidence.

`(3) PARENS PATRIAE AUTHORITY-

`(A) CIVIL ACTIONS- In any case in which the attorney general of a State has reason to believe that an interest of the residents of that State has been, or is threatened to be, adversely affected by a violation of this section by any business entity, the State, as parens patriae, may bring a civil action on behalf of the residents of the State in a district court of the United States of appropriate jurisdiction to--

`(i) enjoin that practice;

`(ii) enforce compliance with this section;

`(iii) obtain damages--

`(I) in the sum of actual damages, restitution, and other compensation on behalf of the affected residents of the State; and

`(II) punitive damages, if the violation is willful or intentional; and

`(iv) obtain such other equitable relief as the court may consider to be appropriate.

`(B) NOTICE- Before filing an action under subparagraph (A), the attorney general of the State involved shall, if practicable, provide to the Attorney General of the United States, and where applicable, to the appropriate Federal agency with the authority to enforce this section under paragraph (2)--

`(i) a written notice of the action; and

`(ii) a copy of the complaint for the action.

`(4) INTERVENTION-

`(A) IN GENERAL- On receiving notice of an action under paragraph (3), the Attorney General of the United States, and any Federal agency with authority to enforce this section under paragraph (2), shall have the right to intervene in that action.

`(B) EFFECT OF INTERVENTION- Any person or agency under subparagraph (A) that intervenes in an action under paragraph (2) shall have the right to be heard on all relevant matters arising therein.

`(C) SERVICE OF PROCESS- Upon the request of the Attorney General of the United States or any Federal agency with the authority to enforce this section under paragraph (2), the attorney general of a State that has filed an action under this section shall, pursuant to rule 4(d)(4) of the Federal Rules of Civil Procedure, serve the Attorney General of the United States or the head of such Federal agency, with a copy of the complaint.

`(5) CONSTRUCTION- For purposes of bringing any civil action under this subsection, nothing in this section shall be construed to prevent an attorney general of a State from exercising the powers conferred on such attorney general by the laws of that State to--

`(A) conduct investigations;

`(B) administer oaths or affirmations; or

`(C) compel the attendance of witnesses or the production of documentary and other evidence.

`(6) LIMITATION ON STATE ACTION WHILE FEDERAL ACTION IS PENDING- In any case in which an action is instituted by or on behalf of the Attorney General of the United States, or appropriate Federal regulator authorized under paragraph (2), for a violation of this section, no State may, during the pendency of that action, institute an action under this section against any defendant named in the complaint in that action for such violation.

`(7) VENUE; SERVICE OF PROCESS-

`(A) VENUE- Any action brought under this subsection may be brought in the district court of the United States--

`(i) where the defendant resides;

`(ii) where the defendant is doing business; or

`(iii) that meets applicable requirements relating to venue under section 1391 of title 28.

`(B) SERVICE OF PROCESS- In an action brought under this subsection, process may be served in any district in which the defendant--

`(i) resides;

`(ii) is doing business; or

`(iii) may be found.'.

(b) CLERICAL AMENDMENT- The table of sections at the beginning of chapter 47 of title 18, United States Code, is amended by inserting after the item relating to section 1028 the following new item:

`1028A. Treatment of identity theft mitigation.'.

SEC. 4. AMENDMENTS TO THE FAIR CREDIT REPORTING ACT.

(a) CONSUMER REPORTING AGENCY BLOCKING OF INFORMATION RESULTING FROM IDENTITY THEFT- Section 611 of the Fair Credit Reporting Act (15 U.S.C. 1681i) is amended by adding at the end the following:

`(e) BLOCK OF INFORMATION RESULTING FROM IDENTITY THEFT-

`(1) BLOCK- Except as provided in paragraphs (4) and (5) and not later than 30 days after the date of receipt of--

`(A) proof of the identity of a consumer; and

`(B) an official copy of a police report evidencing the claim of the consumer of identity theft,

a consumer reporting agency shall block the reporting of any information identified by the consumer in the file of the consumer resulting from the identity theft, so that the information cannot be reported.

`(2) REINVESTIGATION- A consumer reporting agency shall reinvestigate any information that a consumer has requested to be blocked under paragraph (1) in accordance with the requirements of subsections (a) through (d).

`(3) NOTIFICATION- A consumer reporting agency shall, within the time period specified in subsection (a)(2)(A)--

`(A) provide the furnisher of the information identified by the consumer under paragraph (1) with the information described in subsection (a)(2); and

`(B) notify the furnisher--

`(i) that the information may be a result of identity theft;

`(ii) that a police report has been filed;

`(iii) that a block has been requested under this subsection; and

`(iv) of the effective date of the block.

`(4) AUTHORITY TO DECLINE OR RESCIND-

`(A) IN GENERAL- A consumer reporting agency may at any time decline to block, or may rescind any block, of consumer information under this subsection if--

`(i) in the exercise of good faith and reasonable judgment, the consumer reporting agency finds that--

`(I) the block was issued, or the request for a block was made, based on a misrepresentation of fact by the consumer relevant to the request to block; or

`(II) the consumer knowingly obtained possession of goods, services, or money as a result of a transaction for which a block has been requested, or the consumer should have known that the consumer obtained possession of goods, services, or money as a result of a transaction for which a block has been requested; or

`(ii) the consumer agrees that the blocked information or portions of the blocked information were blocked in error.

`(B) NOTIFICATION TO CONSUMER- If the block of information is declined or rescinded under this paragraph, the affected consumer shall be notified, in the same manner and within the same time period as consumers are notified of the reinsertion of information under subsection (a)(5)(B).

`(C) SIGNIFICANCE OF BLOCK- For purposes of this paragraph, if a consumer reporting agency rescinds a block, the presence of information in the file of a consumer prior to the blocking of such information is not evidence of whether the consumer knew or should have known that the consumer obtained possession of any goods, services, or monies as a result of the transaction that was blocked.

`(5) EXCEPTION- A consumer reporting agency shall not be required to comply with this subsection when such agency is issuing information for authorizations, for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payment, based solely on negative information, including--

`(A) dishonored checks;

`(B) accounts closed for cause;

`(C) substantial overdrafts;

`(D) abuse of automated teller machines; or

`(E) other information which indicates a risk of fraud occurring.'.

(b) FALSE CLAIMS- Section 1028 of title 18, United States Code, is amended by adding at the end the following:

`(j) Any person who knowingly falsely claims to be a victim of identity theft for the purpose of obtaining the blocking of information by a consumer reporting agency under section 611(e)(1) of the Fair Credit Reporting Act (15 U.S.C. 1681i(e)(1)) shall be fined under this title, imprisoned not more than 3 years, or both.'.

(c) STATUTE OF LIMITATIONS-

(1) IN GENERAL- Section 618 of the Fair Credit Reporting Act (15 U.S.C. 1681p) is amended to read as follows:

`SEC. 618. JURISDICTION OF COURTS; LIMITATION ON ACTIONS.

`(a) IN GENERAL- Except as provided in subsections (b) and (c), an action to enforce any liability created under this title may be brought in any appropriate United States district court without regard to the amount in controversy, or in any other court of competent jurisdiction, not later than 2 years from the date of the defendant's violation of any requirement under this title.

`(b) WILLFUL MISREPRESENTATION- In any case in which the defendant has materially and willfully misrepresented any information required to be disclosed to an individual under this title, and the information misrepresented is material to the establishment of the liability of the defendant to that individual under this title, an action to enforce a liability created under this title may be brought at any time within 2 years after the date of discovery by the individual of the misrepresentation.

`(c) IDENTITY THEFT- An action to enforce a liability created under this title may be brought not later than 5 years from the date of the defendant's violation if--

`(1) the plaintiff is the victim of an identity theft; or

`(2) the plaintiff--

`(A) has reasonable grounds to believe that the plaintiff is the victim of an identity theft; and

`(B) has not materially and willfully misrepresented such a claim.'.

(2) EFFECTIVE DATE- The amendments made by this subsection shall take effect 2 years from the date of enactment of this Act.

SEC. 5. COORDINATING COMMITTEE STUDY OF COORDINATION BETWEEN FEDERAL, STATE, AND LOCAL AUTHORITIES IN ENFORCING IDENTITY THEFT LAWS.

(a) MEMBERSHIP; TERM- Section 2 of the Internet False Identification Prevention Act of 2000 (18 U.S.C. 1028 note) is amended--

(1) in subsection (b), by striking `and the Commissioner of Immigration and Naturalization' and inserting `the Commissioner of Immigration and Naturalization, the Chairman of the Federal Trade Commission, the Postmaster General, and the Commissioner of the United States Customs Service,'; and

(2) in subsection (c), by striking `2 years after the effective date of this Act.' and inserting `on December 28, 2005.'.

(b) CONSULTATION- Section 2 of the Internet False Identification Prevention Act of 2000 (18 U.S.C. 1028 note) is amended--

(1) by redesignating subsection (d) as subsection (e); and

(2) by inserting after subsection (c) the following:

`(d) CONSULTATION- In discharging its duties, the coordinating committee shall consult with interested parties, including State and local law enforcement agencies, State attorneys general, representatives of business entities (as that term is defined in section 4 of the Identity Theft Victims Assistance Act of 2003), including telecommunications and utility companies, and organizations representing consumers.'.

(c) REPORT DISTRIBUTION AND CONTENTS- Section 2(e) of the Internet False Identification Prevention Act of 2000 (18 U.S.C. 1028 note) (as redesignated by subsection (b)) is amended--

(1) by striking paragraph (1) and inserting the following:

`(1) IN GENERAL- The Attorney General and the Secretary of the Treasury, at the end of each year of the existence of the coordinating committee, shall report on the activities of the coordinating committee to--

`(A) the Committee on the Judiciary of the Senate;

`(B) the Committee on the Judiciary of the House of Representatives;

`(C) the Committee on Banking, Housing, and Urban Affairs of the Senate; and

`(D) the Committee on Financial Services of the House of Representatives.';

(2) in subparagraph (E), by striking `and' at the end; and

(3) by striking subparagraph (F) and inserting the following:

`(F) a comprehensive description of Federal assistance provided to State and local law enforcement agencies to address identity theft;

`(G) a comprehensive description of coordination activities between Federal, State, and local law enforcement agencies that address identity theft; and

`(H) recommendations in the discretion of the President, if any, for legislative or administrative changes that would--

`(i) facilitate more effective investigation and prosecution of cases involving--

`(I) identity theft; and

`(II) the creation and distribution of false identification documents;

`(ii) improve the effectiveness of Federal assistance to State and local law enforcement agencies and coordination between Federal, State, and local law enforcement agencies; and

`(iii) simplify efforts by a person necessary to rectify the harm that results from the theft of the identity of such person.'.

END