Declares that each consumer reporter shall have an affirmative obligation to implement policies and procedures to protect the security and confidentiality of any consumer's sensitive financial personal information maintained, serviced, or communicated by or on the reporter's behalf against any unauthorized use reasonably likely to result in substantial harm or inconvenience to the consumer.

Defines "consumer reporter" as any consumer reporting agency, financial institution, or person: (1) which, for monetary fees, dues, on a cooperative nonprofit basis, or otherwise regularly engages in the practice of assembling or evaluating consumer information for the purpose of furnishing consumer reports to third parties, of providing or collecting payment for or marketing products and services, or for employment purposes; and (2) which uses any means or facility of interstate commerce for such purposes.

Prescribes implementation guidelines that include: (1) investigation requirements; (2) investigation notices and system restoration requirements; (3) third party duties; (4) consumer notice; (5) financial fraud mitigation; and (6) free file monitoring.

Directs the Secretary of the Treasury, the Board of Governors of the Federal Reserve System, and the Federal Trade Commission jointly to develop implementing standards and guidelines.

Declares the policy of Congress concerning the obligations of each consumer reporter to protect the security and confidentiality of sensitive financial personal information.

Prescribes investigation and consumer notification requirements.

Directs the Federal Trade Commission (FTC) to coordinate with specified government entities to create a publicly available list of data security breaches that have triggered a notice to consumers within the last 12 months.

Prohibits charging the related consumers for the cost of the notices and file monitoring regarding data security breaches.

Requires a consumer reporter, upon the request of a consumer who is the focus of a security breach, to make available a free service that: (1) monitors nationwide credit activity about the consumer from a consumer reporting agency; and (2) provides nationwide identity-monitoring.

Prescribes implementation guidelines for imposition of a security freeze, upon the request of a consumer who is a victim of identity theft, that places a notice in the consumer's credit report prohibiting the consumer reporting agency from releasing all or any part of the report without the consumer's express authorization.

Prohibits a consumer reporting agency from imposing a fee for placing or removing a security freeze.

Directs the Secretary of the Treasury, the Board of Governors of the Federal Reserve System, and the FTC to promulgate jointly: (1) uniform data security safeguard regulations; and (2) model notice forms.

Prescribes implementation and administrative enforcement procedures.

Preempts state laws governing consumer reporter data security responsibilities, except any laws governing professional confidentiality or limiting the purposes for which information may be disclosed.

(Sec. 3) Directs: (1) the President to convene a National Summit on Data Security Safeguards for Sensitive Personal Financial Information in the District of Columbia; and (2) the Comptroller General to study and report to Congress on a system that would provide notices of data breaches to consumers in languages other than English, and identify what barriers exist to its implementation.

(Sec. 5) Directs the FTC to compile voluntary information on the race and ethnicity of consumers who are victims of identity theft, account fraud, and other types of financial fraud, in order to improve law enforcement efforts relating to data security breaches and fighting identity theft and account fraud.

(Sec. 6) Amends the Credit Repair Organizations Act (CROA) to exempt from its coverage certain credit monitoring activities, including provision to a consumer of: (1) credit reports, credit monitoring notifications, credit scores and scoring algorithms, and other specified credit score-related tools; (2) any analysis, evaluation, and explanation of such actual or hypothetical credit scores or similar projections, forecasts, analyses, evaluations or explanations; or (3) materials or services to assist a consumer who is a victim of identity theft.

Specifies conditions for application of such exemption. Requires the credit monitoring service to refrain from offering to alter or remove, or assist in the alteration or removal of, accurate, non-obsolete adverse information in a credit report. Requires the service also to present the sonsumer with a specified notice and statement of rights.

Directs the FTC to study the practicality of requiring a standard method or methods for destroying obsolete paper documents and other nonelectronic data containing personal information. Authorizes the FTC to require such a standard method or methods if the study makes certain findings.

Requires information brokers to submit their security policies to the FTC in conjunction with a notification of a breach of security or upon FTC request. Requires the FTC to conduct or require an audit of security practices when information brokers are required to provide notification of such a breach. Authorizes additional audits for five years following such breach.

Requires each information broker to: (1) establish procedures to verify the accuracy of the certain information it collects or maintains that identifies individuals, other than merely by name or address; (2) provide to individuals whose personal information it maintains a means to review it; (3) place notice on the Internet instructing individuals how to request access to such information; and (4) correct inaccurate information.

Directs the FTC to require information brokers to establish measures which facilitate the auditing or retracing of access to, or transmissions of, electronic data containing personal information.

Prohibits information brokers from obtaining or disclosing personal information by false pretenses (pretexting).

(Sec. 3) Prescribes procedures for notification to the FTC and affected individuals of breaches of information security. Sets forth special notification requirements for breaches: (1) by third party entities that have been contracted to maintain or process data in electronic form containing personal information; (2) by telecommunications carriers, cable operators, information services, and interactive computer services; and (3) of health information.

Directs the FTC to: (1) establish criteria for determining circumstances under which substitute notification may be provided; and (2) study the practicality and cost-effectiveness of requiring notification in a language in addition to English for those who speak only such other language.

(Sec. 4) Grants the FTC enforcement powers equivalent to those it exercises with respect to unfair and deceptive acts or practices. Authorizes enforcement by a state attorney general if there is reason to believe that interests of the state's residents have been or are threatened or adversely affected by violators of this Act. Sets forth civil penalties.

(Sec. 6) Preempts state information security laws.

(Sec. 7) Authorizes appropriations for FY2006-FY2011.