Sets forth special requirements for information brokers.

Prescribes notification procedures for breaches of information security.

Grants the FTC enforcement powers.

Preempts state information security laws.

Authorizes the FTC to require standard methods for the destruction of obsolete paper documents and other non-electronic data containing personal information by persons engaged in interstate commerce.

Requires information brokers to submit their security policies to the FTC in conjunction with a notification of a breach of security or upon the FTC's request. Requires the FTC to conduct or require an audit of security practices when information brokers are required to provide notification of such a breach. Authorizes additional audits for five years following such breach. Requires information brokers to: (1) verify the accuracy of the certain information they collect or maintain that identifies individuals, other than merely by name or address; (2) provide to individuals whose personal information they maintain a means to review such information; (3) place notice on the Internet instructing individuals how to request access to such information; and (4) correct inaccurate information. Directs the FTC to require that information brokers establish measures to facilitate the auditing or retracing of access to, or transmissions of, electronic data containing personal information. Prohibits information brokers from obtaining or causing the disclosure of personal information by false pretenses.

(Sec. 3) Prescribes notification procedures for breaches of information security. Sets forth special notification requirements for breaches of information security of: (1) third party entities that have been contracted to maintain or process data in electronic form containing personal information; (2) telecommunication carriers, cable operators, information services, and interactive computer services; and (3) health information. Directs any person required to provide such notification to provide each individual whose personal information was affected by the breach, upon request and at no cost, consumer credit reports from at least one major credit reporting agency for two years. Provides an exemption from such notification requirements when it is determined that there is no reasonable risk from the breach of identity theft, fraud, or other unlawful conduct.

(Sec 4) Grants the FTC enforcement powers. Authorizes enforcement by a state attorney general if there is reason to believe that interests of the state's residents have been or are threatened or adversely affected by violators of this Act. Sets forth civil penalties.

(Sec. 6) Preempts state information security laws.

Authorizes the FTC to require standard methods for the destruction of obsolete paper documents and other non-electronic data containing personal information by persons engaged in interstate commerce.

Requires information brokers to submit their security policies to the FTC in conjunction with a notification of a breach of security or upon the FTC's request. Requires the FTC to conduct or require an audit of security practices when information brokers are required to provide notification of such a breach. Authorizes additional audits for five years following such breach. Requires information brokers to: (1) verify the accuracy of the certain information they collect or maintain that identifies individuals, other than merely by name or address; (2) provide to individuals whose personal information they maintain a means to review such information; (3) place notice on the Internet instructing individuals how to request access to such information; and (4) correct inaccurate information. Directs the FTC to require that information brokers establish measures to facilitate the auditing or retracing of access to, or transmissions of, electronic data containing personal information. Prohibits information brokers from obtaining or causing the disclosure of personal information by false pretenses.

(Sec. 3) Prescribes notification procedures for breaches of information security. Sets forth special notification requirements for breaches of information security of: (1) third party entities that have been contracted to maintain or process data in electronic form containing personal information; (2) telecommunication carriers, cable operators, information services, and interactive computer services; (3) health information; and (4) federal agencies that own or possess data in electronic form containing personal information.. Directs any person required to provide such notification (excluding federal agencies) to provide each individual whose personal information was affected by the breach, upon request and at no cost, consumer credit reports from at least one major credit reporting agency for two years. Provides an exemption from such notification requirements when it is determined that there is no reasonable risk from the breach of identity theft, fraud, or other unlawful conduct.

(Sec 4) Grants the FTC enforcement powers. Authorizes enforcement by a state attorney general if there is reason to believe that interests of the state's residents have been or are threatened or adversely affected by violators of this Act. Sets forth civil penalties.

(Sec. 6) Preempts state information security laws.

Declares the policy of Congress concerning the obligations of each consumer reporter to protect the security and confidentiality of sensitive financial personal information.

Prescribes investigation and consumer notification requirements.

Directs the Federal Trade Commission (FTC) to coordinate with specified government entities to create a publicly available list of data security breaches that have triggered a notice to consumers within the last 12 months.

Prohibits charging the related consumers for the cost of the notices and file monitoring regarding data security breaches.

Requires a consumer reporter, upon the request of a consumer who is the focus of a security breach, to make available a free service that: (1) monitors nationwide credit activity about the consumer from a consumer reporting agency; and (2) provides nationwide identity-monitoring.

Prescribes implementation guidelines for imposition of a security freeze, upon the request of a consumer who is a victim of identity theft, that places a notice in the consumer's credit report prohibiting the consumer reporting agency from releasing all or any part of the report without the consumer's express authorization.

Prohibits a consumer reporting agency from imposing a fee for placing or removing a security freeze.

Directs the Secretary of the Treasury, the Board of Governors of the Federal Reserve System, and the FTC to promulgate jointly: (1) uniform data security safeguard regulations; and (2) model notice forms.

Prescribes implementation and administrative enforcement procedures.

Preempts state laws governing consumer reporter data security responsibilities, except any laws governing professional confidentiality or limiting the purposes for which information may be disclosed.

(Sec. 3) Directs: (1) the President to convene a National Summit on Data Security Safeguards for Sensitive Personal Financial Information in the District of Columbia; and (2) the Comptroller General to study and report to Congress on a system that would provide notices of data breaches to consumers in languages other than English, and identify what barriers exist to its implementation.

(Sec. 5) Directs the FTC to compile voluntary information on the race and ethnicity of consumers who are victims of identity theft, account fraud, and other types of financial fraud, in order to improve law enforcement efforts relating to data security breaches and fighting identity theft and account fraud.

(Sec. 6) Amends the Credit Repair Organizations Act (CROA) to exempt from its coverage certain credit monitoring activities, including provision to a consumer of: (1) credit reports, credit monitoring notifications, credit scores and scoring algorithms, and other specified credit score-related tools; (2) any analysis, evaluation, and explanation of such actual or hypothetical credit scores or similar projections, forecasts, analyses, evaluations or explanations; or (3) materials or services to assist a consumer who is a victim of identity theft.

Specifies conditions for application of such exemption. Requires the credit monitoring service to refrain from offering to alter or remove, or assist in the alteration or removal of, accurate, non-obsolete adverse information in a credit report. Requires the service also to present the sonsumer with a specified notice and statement of rights.