Mr. President, I am introducing the Information Security and Protection Act. It has to do with a subject matter about which we have had breaking news over the course of the last several days, and…
Mr. President, I am introducing the Information Security and Protection Act. It has to do with a subject matter about which we have had breaking news over the course of the last several days, and that is identity theft.
Two weeks ago we found out a company named ChoicePoint, a Georgia company, because of the conviction in a plea bargain with someone who had under false pretenses broken into the database of this information broker, had 400,000 individual records stolen and thus subject to the taking of the personal identity of those 400,000 people. Of those we know of, 10,000 of them are in my State, and I can tell you, having met with a group of Floridians we picked at random in the central Florida area I met with a week and a half ago, it has been a tale of extraordinarily horrific circumstances for these Americans when their identity was stolen to, No. 1, stop the theft, and then, No. 2, to reclaim their identity and to get back their identity, for example, with a credit card on which bills have been run up and therefore their credit becomes bad. Trying to get back their good name and their good credit has become a horrific process.
One of the central Floridians I met with is a truckdriver who has a special license to drive trucks with hazardous materials. This particular individual is so frustrated because whenever he goes to this Government agency or that Government agency, they always send him to another one, saying we can't help you. There is someone out there with his identity who keeps violating traffic rules and laws all over the country and he keeps getting summonses to courts in States all over the country, and he can't get back his identity.
That is just one example. Or take the example of the mom recently widowed, so her grown daughter takes over the paying of her bills, and because the mom has always been frugal, the daughter sees a charge on the credit card for $10,000 and thinks, well, my mom is suddenly going to start spending a little on herself. The daughter continues to pay these kinds of bills until she finally gets a call from a store in San Francisco and the clerk says, I want to see if you will approve this $26,000 charge for your mother. And she says, well, that is not my mother because my mother is not in San Francisco, she is here with me in Cocoa, FL right now. Fortunately, the game was up. They stopped that process, but that daughter had already paid $40,000 worth of bills thinking they were legitimate charges by her mother, and she will never get back that $40,000.
These are just a couple of examples of identity theft. But now the problem has gotten to be so much larger because these data collectors, which I call information brokers, with the advance of technology are able to gather billions and billions of records. This particular company that has come to light over the last couple of weeks with the theft of 400,000 records--ChoicePoint is the name of the company--has stored, now listen to this, 17 to 19 billion--that is with a B-- records. With that amount of data, they virtually have information on every American. It is not just credit reports that are protected by the Fair Credit Reporting Act. It is Social Security numbers and driver's licenses. It is job applications. It is DNA tests. It is medical records.
With this kind of information, centralized under the control of one company, if there is a penetration of the security of that company, then you see what the invasion of our privacy is about to cause.
Indeed, we are going to be in a situation where no American has any privacy, and we are going to continue to go through this process until we say, enough already, and the people stand up and say: You have to protect our privacy.
That is what the bill I am introducing, the Information Security and Protection Act, sets out to do. It is going to require legal safeguards, put some teeth in the law, that is going to require not just credit reports, which is covered by existing Federal law, but it is going to require these collectors of information who sell them for a profit-making business to have the safeguards to protect the consumers.
Additionally, it is going to have the safeguards for the consumers so they can have access to those records and see if, in fact, they are correct, and if they are not, correct them and have a list of the people who are seeking the information about them.
We had another case come to light a week ago, and that was the case of records that are missing. We do not know if they were destroyed, if they were lost, or if they were stolen, but they are the records of customers of the Bank of America. We are talking about 1.2 million customers. And, oh, by the way, some of those customers
are Federal employees who happen to have this particular card. It is the Federal travel card. This card is distributed additionally to the Members of the Senate.
On that stolen or missing information is the very personal and private information of 60 Senators in this Chamber. Let's hope we do not become the victims of identity theft and that we have to go through all of these horrific experiences I have heard in talking with some of my constituents. But, in fact, we may. Until we find out what happened to those records of 1.2 million individuals, Federal employees, then we are subject to these kinds of traumas that come from identity theft.
Today we have learned of a major breach at the Boca Raton based company called SizeNet. It is a part of Lexis-Nexis. Information that was accessed included names, addresses, Social Security and driver's license numbers; not the credit history, medical records, or financial information. This group said--and they put out a statement to the London Stock Exchange--that this was information on 32,000 U.S. citizens. It may have been accessed from one of the databases. The company said the breach, made on its legal and business information service, Lexis-Nexis, which had recently acquired this SizeNet unit, was being investigated by staff and U.S. law enforcement authorities. So here we have another 32,000 U.S. citizens who could possibly be the victims of identity theft.
Are we going to do anything about it? I sure hope so, and I am hopeful that we are going to have the Congress start to take action on a bill Congressman Markey in the House, a Member of the House Commerce Committee, and I, a Member of the Senate Commerce Committee, have introduced.
This bill requires the Federal Government to begin to regulate the products offered by information brokers. Under the legislation, the Federal Trade Commission would pass regulations that would empower consumers to have control over the personal information they have compiled in these databases. Consumers would be given, for the first time, the right to find out what files information brokers keep about them, and they would be given the right to make sure the information in the files is correct. They would be given the right to promptly correct the inaccurate information. They would be permitted to find out which people have asked for copies of their personal information.
What would be the responsibility of the information broker? It would require the Federal Trade Commission to come up with standards to ensure that those brokers know to whom they are selling that consumer information and the purposes for which it is being used. Those information brokers would be required to safeguard and protect the privacy of the billions of consumer records they hold.
Under present law, there is no protection unless you fall under a law such as the Fair Credit Reporting Act which protects consumer credit records. But all the amassing of this additional data is not protected under current law.
This bill I am filing also allows Government law enforcers and consumers to bring tough legal actions against the brokers if they violate the new regulations that the FTC would promulgate. Then it clearly gives a nod to the States to pass their own laws that they believe are necessary to effectively regulate information brokers.
This bill is not a catchall bill. This bill is meant to focus very narrowly on information brokers. It instructs the FTC to carve out appropriate regulatory exemptions that are in the public interest. So there is flexibility for the FTC to adjust to different circumstances.
After the FTC passes its new regulations, then the FTC, in our oversight capacity, would be reporting back to us and specifically would be reporting to our committees--the Commerce Committees in both the House and the Senate--and then Congress would determine whether further statutory changes were necessary, as is the prerogative to adjust and adapt as circumstances change.
I want to work with all the people who are involved in this situation. We do not want something that is overreaching, but were are getting to the point that with the advance of technology, something has to be done or virtually none of us will have any privacy.
By the way, there is another reason to pass this legislation. We are in a new kind of war, and that war is against terrorists. The terrorist deals by stealth, and one way is to assume the identity of someone else. If we do not have the protections of all our identities, there is another source for the terrorist.
What is it going to take to spur the Congress into action? I thank the time is here. We have three examples in the last 2 weeks-- ChoicePoint, Bank of America, and today Lexis-Nexis. I ask for the support of the Senate in passing the Information Protection and Security Act.
Mr. President, I ask unanimous consent that the text of the bill be printed in the Record.