S.Amdt. 2123

SA 2123. Mr. MENENDEZ submitted an amendment intended to be proposed
by him to the bill S. 2155, to promote economic growth, provide
tailored regulatory relief, and enhance consumer protections, and for
other purposes; which was ordered to lie on the table; as follows:

At the appropriate place, insert the following:

SEC. ___. DATA SECURITY.

(a) In General.--The Fair Credit Reporting Act (15 U.S.C.
1681 et seq.) is amended by inserting after section 605B (15
U.S.C. 1681c-2) the following:

``SEC. 605C. DATA SECURITY AT CONSUMER REPORTING AGENCIES.

``(a) Definitions.--In this section--
``(1) the term `affected individual' means a consumer, the
sensitive personal information of whom is lost, stolen, or
accessed without authorization because of a data breach;
``(2) the term `appropriate committees of Congress' means--
``(A) the Committee on the Judiciary of the Senate;
``(B) the Committee on Banking, Housing, and Urban Affairs
of the Senate;
``(C) the Committee on the Judiciary of the House of
Representatives; and
``(D) the Committee on Financial Services of the House of
Representatives;
``(3) the term `data breach' means the loss, theft, or
other unauthorized access, other than access that is
incidental to the scope of employment, of data containing
sensitive personal information, in electronic or printed
form, that results in the potential compromise of the
confidentiality or integrity of the data; and
``(4) the term `sensitive personal information' means, with
respect to a consumer, information--
``(A) about the consumer relating to the education,
financial transactions, medical history, criminal history, or
employment history of the consumer; and
``(B) that can be used to distinguish or trace the identity
of the consumer, including the name, social security number,
date and place of birth, mother's maiden name, and biometric
records of the consumer.
``(b) Data Breaches at Consumer Reporting Agencies.--With
respect to a data breach at a consumer reporting agency, the
consumer reporting agency--
``(1) shall notify--
``(A) not later than 2 days after the date on which the
consumer reporting agency discovers the data breach--
``(i) the Federal Trade Commission;
``(ii) the Bureau; and
``(iii) appropriate law enforcement and intelligence
agencies, as identified by the Secretary of Homeland
Security; and

[[Page S1489]]

``(B) subject to paragraph (2), not later than 3 days after
the date on which the consumer reporting agency discovers the
data breach, and as quickly and efficiently as is
practicable, each affected individual with respect to the
data breach; and
``(2) may receive an extension of the deadline described in
paragraph (1)(B) if the Federal Trade Commission and the
intelligence agencies identified under paragraph (1)(A)(iii)
determine that there is a national security concern that
requires granting such an extension.
``(c) Annual Study and Report.--
``(1) In general.--Beginning in the first full year after
the date of enactment of this section, and annually
thereafter, the Bureau and the Federal Trade Commission, in
consultation with the Attorney General, shall conduct a study
regarding the costs to affected individuals from data
breaches at consumer reporting agencies, including--
``(A) the economic costs to those affected individuals;
``(B) the effects on--
``(i) the ability of those affected individuals to obtain
credit and housing; and
``(ii) the reputations of those affected individuals; and
``(C) the costs relating to the emotional and psychological
stress of those affected individuals from having the
sensitive personal information of those affected individuals
lost, stolen, or accessed without authorization.
``(2) Submission to congress.--Not later than 30 days after
the date on which each study conducted under paragraph (1) is
completed, the Bureau and the Federal Trade Commission shall
submit to the appropriate committees of Congress a report
that contains the results of the study.
``(3) Contents.--Each study conducted under paragraph (1)
and each report submitted under paragraph (2) shall contain a
survey of affected individuals who were contacted for the
purposes of conducting the study.
``(4) Authority.--In conducting any study under paragraph
(1), the Bureau, the Federal Trade Commission, and the
Attorney General may compel a consumer reporting agency to
disclose nonproprietary information.
``(d) Rule of Construction.--Nothing in this section may be
construed as modifying, limiting, or superseding any
provision of State law if the protection that the provision
of State law provides to consumers is greater than the
protection provided to consumers under this section.''.
(b) Technical and Conforming Amendment.--The table of
contents for the Fair Credit Reporting Act (15 U.S.C. 1681 et
seq.) is amended by inserting after the item relating to
section 605B the following:

``605C. Data security at consumer reporting agencies.''.
______