[Congressional Bills 105th Congress]
[From the U.S. Government Publishing Office]
[H.R. 4321 Reported in House (RH)]





                                                 Union Calendar No. 430

105th CONGRESS

  2d Session

                               H. R. 4321

                  [Report No. 105-701, Parts I and II]

_______________________________________________________________________

                                 A BILL

To protect consumers and financial institutions by preventing personal 
 financial information from being obtained from financial institutions 
                         under false pretenses.

_______________________________________________________________________

                           September 25, 1998

       Reported from the Committee on Commerce with an amendment

                           September 25, 1998

 The Committee on the Judiciary discharged; committed to the Committee 
 of the Whole House on the State of the Union and ordered to be printed





                                                 Union Calendar No. 430
105th CONGRESS
  2d Session
                                H. R. 4321

                  [Report No. 105-701, Parts I and II]

To protect consumers and financial institutions by preventing personal 
 financial information from being obtained from financial institutions 
                         under false pretenses.


_______________________________________________________________________


                    IN THE HOUSE OF REPRESENTATIVES

                             July 23, 1998

Mr. Leach (for himself, Mr. Lazio of New York, Mr. Castle, Mr. LaFalce, 
 Mr. Hinchey, and Mr. Vento) introduced the following bill; which was 
      referred to the Committee on Banking and Financial Services

                            August 21, 1998

Reported with an amendment, referred to the Committee on the Judiciary 
      for a period ending not later than September 25, 1998, for 
  consideration of such provisions of the bill and amendment as fall 
within the jurisdiction of that committee pursuant to clause 1(j), rule 
                                   X
 [Strike out all after the enacting clause and insert the part printed 
                               in italic]

                           September 14, 1998

  Referred to the Committee on Commerce for a period ending not later 
 than September 25, 1998, for consideration of such provisions of the 
 bill and amendment as fall within the jurisdiction of that committee 
                    pursuant to clause 1(e), rule X

                           September 25, 1998

     Additional sponsors: Mrs. Kelly, Ms. Danner, and Mrs. Roukema

                           September 25, 1998

       Reported from the Committee on Commerce with an amendment
 [Strike out all after the enacting clause and insert the part printed 
                           in boldface roman]

                           September 25, 1998

 The Committee on the Judiciary discharged; committed to the Committee 
 of the Whole House on the State of the Union and ordered to be printed
 [For text of introduced bill, see copy of bill as introduced on July 
                               23, 1998]

_______________________________________________________________________

                                 A BILL


 
To protect consumers and financial institutions by preventing personal 
 financial information from being obtained from financial institutions 
                         under false pretenses.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Financial Information Privacy Act of 
1998''.

SEC. 2. FINANCIAL INFORMATION PRIVACY.

    (a) In General.--The Consumer Credit Protection Act (15 U.S.C. 1601 
et seq.) is amended by adding at the end the following:

          ``TITLE X--FINANCIAL INFORMATION PRIVACY PROTECTION

``Sec.
``1001. Short title.
``1002. Definitions.
``1003. Privacy protection for customer information of financial 
                            institutions.
``1004. Administrative enforcement.
``1005. Civil liability.
``1006. Criminal penalty.
``1007. Relation to State laws.
``1008. Agency guidance.
``Sec. 1001. Short title
    ``This title may be cited as the `Financial Information Privacy 
Act'.
``Sec. 1002. Definitions
    ``For purposes of this title, the following definitions shall 
apply:
            ``(1) Customer.--The term `customer' means, with respect to 
        a financial institution, any person (or authorized 
        representative of a person) to whom the financial institution 
        provides a product or service, including that of acting as a 
        fiduciary.
            ``(2) Customer information of a financial institution.--The 
        term `customer information of a financial institution' means 
        any information maintained by a financial institution which is 
        derived from the relationship between the financial institution 
        and a customer of the financial institution and is identified 
        with the customer.
            ``(3) Document.--The term `document' means any information 
        in any form.
            ``(4) Financial institution.--
                    ``(A) In general.--The term `financial institution' 
                means any institution engaged in the business of 
                providing financial services to customers who maintain 
                a credit, deposit, trust, or other financial account or 
                relationship with the institution.
                    ``(B) Certain financial institutions specifically 
                included.--The term `financial institution' includes 
any depository institution (as defined in section 19(b)(1)(A) of the 
Federal Reserve Act), any loan or finance company, any credit card 
issuer or operator of a credit card system, and any consumer reporting 
agency that compiles and maintains files on consumers on a nationwide 
basis (as defined in section 603(p)).
                    ``(C) Further definition by regulation.--The Board 
                of Governors of the Federal Reserve System may 
                prescribe regulations further defining the term 
                `financial institution', in accordance with 
                subparagraph (A), for purposes of this title.
``Sec. 1003. Privacy protection for customer information of financial 
              institutions
    ``(a) Prohibition on Obtaining Customer Information by False 
Pretenses.--It shall be a violation of this title for any person to 
obtain or attempt to obtain, or cause to be disclosed or attempt to 
cause to be disclosed to any person, customer information of a 
financial institution relating to another person--
            ``(1) by knowingly making a false, fictitious, or 
        fraudulent statement or representation to an officer, employee, 
        or agent of a financial institution with the intent to deceive 
        the officer, employee, or agent into relying on that statement 
        or representation for purposes of releasing the customer 
        information;
            ``(2) by knowingly making a false, fictitious, or 
        fraudulent statement or representation to a customer of a 
        financial institution with the intent to deceive the customer 
        into relying on that statement or representation for purposes 
        of releasing the customer information or authorizing the 
        release of such information; or
            ``(3) by knowingly providing any document to an officer, 
        employee, or agent of a financial institution, knowing that the 
        document is forged, counterfeit, lost, or stolen, was 
        fraudulently obtained, or contains a false, fictitious, or 
        fraudulent statement or representation, if the document is 
        provided with the intent to deceive the officer, employee, or 
        agent into relying on that document for purposes of releasing 
        the customer information.
    ``(b) Prohibition on Solicitation of a Person to Obtain Customer 
Information From Financial Institution Under False Pretenses.--It shall 
be a violation of this title to request a person to obtain customer 
information of a financial institution, knowing or consciously avoiding 
knowing that the person will obtain, or attempt to obtain, the 
information from the institution in any manner described in subsection 
(a).
    ``(c) Nonapplicability to Law Enforcement Agencies.--No provision 
of this section shall be construed so as to prevent any action by a law 
enforcement agency, or any officer, employee, or agent of such agency, 
to obtain customer information of a financial institution in connection 
with the performance of the official duties of the agency.
    ``(d) Nonapplicability to Financial Institutions in Certain 
Cases.--No provision of this section shall be construed so as to 
prevent any financial institution, or any officer, employee, or agent 
of a financial institution, from obtaining customer information of such 
financial institution in the course of--
            ``(1) testing the security procedures or systems of such 
        institution for maintaining the confidentiality of customer 
        information;
            ``(2) investigating allegations of misconduct or negligence 
        on the part of any officer, employee, or agent of the financial 
        institution; or
            ``(3) recovering customer information of the financial 
        institution which was obtained or received by another person in 
        any manner described in subsection (a) or (b).
    ``(e) Nonapplicability to Certain Types of Customer Information of 
Financial Institutions.--No provision of this section shall be 
construed so as to prevent any person from obtaining customer 
information of a financial institution that otherwise is available as a 
public record filed pursuant to the securities laws (as defined in 
section 3(a)(47) of the Securities Exchange Act of 1934).
``Sec. 1004. Administrative enforcement
    ``(a) Enforcement by Federal Trade Commission.--Except as provided 
in subsection (b), compliance with this title shall be enforced by the 
Federal Trade Commission in the same manner and with the same power and 
authority as the Commission has under the title VIII, the Fair Debt 
Collection Practices Act, to enforce compliance with such title.
    ``(b) Enforcement by Other Agencies in Certain Cases.--
            ``(1) In general.--Compliance with this title shall be 
        enforced under--
                    ``(A) section 8 of the Federal Deposit Insurance 
                Act, in the case of--
                            ``(i) national banks, and Federal branches 
                        and Federal agencies of foreign banks, by the 
                        Office of the Comptroller of the Currency;
                            ``(ii) member banks of the Federal Reserve 
                        System (other than national banks), branches 
                        and agencies of foreign banks (other than 
                        Federal branches, Federal agencies, and insured 
                        State branches of foreign banks), commercial 
                        lending companies owned or controlled by 
                        foreign banks, and organizations operating 
                        under section 25 or 25A of the Federal Reserve 
                        Act, by the Board;
                            ``(iii) banks insured by the Federal 
                        Deposit Insurance Corporation (other than 
                        members of the Federal Reserve System and 
                        national nonmember banks) and insured State 
                        branches of foreign banks, by the Board of 
                        Directors of the Federal Deposit Insurance 
                        Corporation; and
                            ``(iv) savings associations the deposits of 
                        which are insured by the Federal Deposit 
                        Insurance Corporation, by the Director of the 
                        Office of Thrift Supervision; and
                    ``(B) the Federal Credit Union Act, by the 
                Administrator of the National Credit Union 
                Administration with respect to any Federal credit 
                union.
            ``(2) Violations of this title treated as violations of 
        other laws.--For the purpose of the exercise by any agency 
        referred to in paragraph (1) of its powers under any Act 
        referred to in that paragraph, a violation of this title shall 
        be deemed to be a violation of a requirement imposed under that 
        Act. In addition to its powers under any provision of law 
        specifically referred to in paragraph (1), each of the agencies 
        referred to in that paragraph may exercise, for the purpose of 
        enforcing compliance with this title, any other authority 
        conferred on such agency by law.
    ``(c) State Action for Violations.--
            ``(1) Authority of states.--In addition to such other 
        remedies as are provided under State law, if the chief law 
        enforcement officer of a State, or an official or agency 
        designated by a State, has reason to believe that any person 
        has violated or is violating this title, the State--
                    ``(A) may bring an action to enjoin such violation 
                in any appropriate United States district court or in 
                any other court of competent jurisdiction;
                    ``(B) may bring an action on behalf of the 
                residents of the State to recover damages of not more 
                than $1,000 for each violation; and
                    ``(C) in the case of any successful action under 
                subparagraph (A) or (B), shall be awarded the costs of 
                the action and reasonable attorney fees as determined 
                by the court.
            ``(2) Rights of federal regulators.--
                    ``(A) Prior notice.--The State shall serve prior 
                written notice of any action under paragraph (1) upon 
                the Federal Trade Commission and, in the case of an 
                action which involves a financial institution described 
                in section 1004(b)(1), the agency referred to in such 
                section with respect to such institution and provide 
                the Federal Trade Commission and any such agency with a 
                copy of its complaint, except in any case in which such 
                prior notice is not feasible, in which case the State 
                shall serve such notice immediately upon instituting 
                such action.
                    ``(B) Right to intervene.--The Federal Trade 
                Commission or an agency described in subsection (b) 
                shall have the right--
                            ``(i) to intervene in an action under 
                        paragraph (1);
                            ``(ii) upon so intervening, to be heard on 
                        all matters arising therein;
                            ``(iii) to remove the action to the 
                        appropriate United States district court; and
                            ``(iv) to file petitions for appeal.
            ``(3) Investigatory powers.--For purposes of bringing any 
        action under this subsection, no provision of this subsection 
        shall be construed as preventing the chief law enforcement 
        officer, or an official or agency designated by a State, from 
        exercising the powers conferred on the chief law enforcement 
        officer or such official by the laws of such State to conduct 
        investigations or to administer oaths or affirmations or to 
        compel the attendance of witnesses or the production of 
        documentary and other evidence.
            ``(4) Limitation on state action while federal action 
        pending.--If the Federal Trade Commission or any agency 
        described in subsection (b) has instituted a civil action for a 
        violation of this title, no State may, during the pendency of 
        such action, bring an action under this section against any 
        defendant named in the complaint of the Federal Trade 
        Commission or such agency for any violation of this title that 
        is alleged in that complaint.
``Sec. 1005. Civil liability
    ``Any person, other than a financial institution, who fails to 
comply with any provision of this title with respect to any financial 
institution or any customer information of a financial institution 
shall be liable to such financial institution or the customer to whom 
such information relates in an amount equal to the sum of the amounts 
determined under each of the following paragraphs:
            ``(1) Actual damages.--The greater of--
                    ``(A) the amount of any actual damage sustained by 
                the financial institution or customer as a result of 
                such failure; or
                    ``(B) any amount received by the person who failed 
                to comply with this title, including an amount equal to 
                the value of any nonmonetary consideration, as a result 
                of the action which constitutes such failure.
            ``(2) Additional damages.--Such additional amount as the 
        court may allow.
            ``(3) Attorneys' fees.--In the case of any successful 
        action to enforce any liability under paragraph (1) or (2), the 
        costs of the action, together with reasonable attorneys' fees.
``Sec. 1006. Criminal penalty
    ``(a) In General.--Whoever violates, or attempts to violate, 
section 1003 shall be fined in accordance with title 18, United States 
Code, or imprisoned for not more than 5 years, or both.
    ``(b) Enhanced Penalty for Aggravated Cases.--Whoever violates, or 
attempts to violate, section 1003 while violating another law of the 
United States or as part of a pattern of any illegal activity involving 
more than $100,000 in a 12-month period shall be fined twice the amount 
provided in subsection (b)(3) or (c)(3) (as the case may be) of section 
3571 of title 18, United States Code, imprisoned for not more than 10 
years, or both.
``Sec. 1007. Relation to State laws
    ``(a) In General.--This title shall not be construed as 
superseding, altering, or affecting the statutes, regulations, orders, 
or interpretations in effect in any State, except to the extent that 
such statutes, regulations, orders, or interpretations are inconsistent 
with the provisions of this title, and then only to the extent of the 
inconsistency.
    ``(b) Greater Protection Under State Law.--For purposes of this 
section, a State statute, regulation, order, or interpretation is not 
inconsistent with the provisions of this title if the protection such 
statute, regulation, order, or interpretation affords any person is 
greater than the protection provided under this title.
``Sec. 1008. Agency guidance
    ``In furtherance of the objectives of this title, each Federal 
banking agency (as defined in section 3(z) of the Federal Deposit 
Insurance Act) shall issue advisories to depository institutions under 
the jurisdiction of the agency, in order to assist such depository 
institutions in deterring and detecting activities proscribed under 
section 1003.''.
    (b) Report to the Congress.--Before the end of the 18-month period 
beginning on the date of the enactment of this Act, the Comptroller 
General, in consultation with the Federal Trade Commission, Federal 
banking agencies, and appropriate Federal law enforcement agencies, 
shall submit to the Congress a report on the following:
            (1) The efficacy and adequacy of the remedies provided in 
        the amendments made by subsection (a) in addressing attempts to 
        obtain financial information by fraudulent means or by false 
        pretenses.
            (2) Any recommendations for additional legislative or 
        regulatory action to address threats to the privacy of 
        financial information created by attempts to obtain information 
        by fraudulent means or false pretenses.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Financial Information Privacy Act of 
1998''.

SEC. 2. FINANCIAL INFORMATION PRIVACY.

    (a) In General.--The Consumer Credit Protection Act (15 U.S.C. 1601 
et seq.) is amended by adding at the end the following:

          ``TITLE X--FINANCIAL INFORMATION PRIVACY PROTECTION

``Sec.
``1001. Short title.
``1002. Definitions.
``1003. Privacy protection for customer information of financial 
                            institutions.
``1004. Administrative enforcement.
``1005. Civil liability.
``1006. Criminal penalty.
``1007. Relation to State laws.
``1008. Agency guidance.
``Sec. 1001. Short title
    ``This title may be cited as the `Financial Information Privacy 
Act'.
``Sec. 1002. Definitions
    ``For purposes of this title, the following definitions shall 
apply:
            ``(1) Customer.--The term `customer' means, with respect to 
        a financial institution, any person (or authorized 
        representative of a person) to whom the financial institution 
        provides a product or service, including that of acting as a 
        fiduciary.
            ``(2) Customer information of a financial institution.--The 
        term `customer information of a financial institution' means 
        any information maintained by or for a financial institution 
        which is derived from the relationship between the financial 
        institution and a customer of the financial institution and is 
        identified with the customer.
            ``(3) Document.--The term `document' means any information 
        in any form.
            ``(4) Financial institution.--
                    ``(A) In general.--The term `financial institution' 
                means any institution engaged in the business of 
                providing financial services to customers who maintain 
                a credit, deposit, trust, or other financial account or 
                relationship with the institution.
                    ``(B) Certain financial institutions specifically 
                included.--The term `financial institution' includes 
                any depository institution (as defined in section 
                19(b)(1)(A) of the Federal Reserve Act), any broker or 
                dealer, any investment adviser or investment company, 
                any insurance company, any loan or finance company, any 
                credit card issuer or operator of a credit card system, 
                and any consumer reporting agency that compiles and 
maintains files on consumers on a nationwide basis (as defined in 
section 603(p)).
                    ``(C) Securities institutions.--For purposes of 
                subparagraph (B)--
                            ``(i) the terms `broker' and `dealer' have 
                        the meanings provided in section 3 of the 
                        Securities Exchange Act of 1934 (15 U.S.C. 
                        78c);
                            ``(ii) the term `investment adviser' has 
                        the meaning provided in section 202(a)(11) of 
                        the Investment Advisers Act of 1940 (15 U.S.C. 
                        80b-2(a)); and
                            ``(iii) the term `investment company' has 
                        the meaning provided in section 3 of the 
                        Investment Company Act of 1940 (15 U.S.C. 80a-
                        3).
                    ``(D) Further definition by regulation.--The 
                Federal Trade Commission, after consultation with 
                Federal banking agencies and the Securities and 
                Exchange Commission, may prescribe regulations 
                clarifying or describing the types of institutions 
                which shall be treated as financial institutions for 
                purposes of this title.
``Sec. 1003. Privacy protection for customer information of financial 
              institutions
    ``(a) Prohibition on Obtaining Customer Information by False 
Pretenses.--It shall be a violation of this title for any person to 
obtain or attempt to obtain, or cause to be disclosed or attempt to 
cause to be disclosed to any person, customer information of a 
financial institution relating to another person--
            ``(1) by making a false, fictitious, or fraudulent 
        statement or representation to an officer, employee, or agent 
        of a financial institution;
            ``(2) by making a false, fictitious, or fraudulent 
        statement or representation to a customer of a financial 
        institution; or
            ``(3) by providing any document to an officer, employee, or 
        agent of a financial institution, knowing that the document is 
        forged, counterfeit, lost, or stolen, was fraudulently 
        obtained, or contains a false, fictitious, or fraudulent 
        statement or representation.
    ``(b) Prohibition on Solicitation of a Person To Obtain Customer 
Information From Financial Institution Under False Pretenses.--It shall 
be a violation of this title to request a person to obtain customer 
information of a financial institution, knowing that the person will 
obtain, or attempt to obtain, the information from the institution in 
any manner described in subsection (a).
    ``(c) Nonapplicability to Law Enforcement Agencies.--No provision 
of this section shall be construed so as to prevent any action by a law 
enforcement agency, or any officer, employee, or agent of such agency, 
to obtain customer information of a financial institution in connection 
with the performance of the official duties of the agency.
    ``(d) Nonapplicability to Financial Institutions in Certain 
Cases.--No provision of this section shall be construed so as to 
prevent any financial institution, or any officer, employee, or agent 
of a financial institution, from obtaining customer information of such 
financial institution in the course of--
            ``(1) testing the security procedures or systems of such 
        institution for maintaining the confidentiality of customer 
        information;
            ``(2) investigating allegations of misconduct or negligence 
        on the part of any officer, employee, or agent of the financial 
        institution; or
            ``(3) recovering customer information of the financial 
        institution which was obtained or received by another person in 
        any manner described in subsection (a) or (b).
    ``(e) Nonapplicability to Insurance Institutions for Investigation 
of Insurance Fraud.--No provision of this section shall be construed so 
as to prevent any insurance institution, or any officer, employee, or 
agency of an insurance institution, from obtaining information as part 
of an insurance investigation into criminal activity, fraud, material 
misrepresentation, or material nondisclosure that is authorized for 
such institution under State law, regulation, interpretation, or order.
    ``(f) Nonapplicability to Certain Types of Customer Information of 
Financial Institutions.--No provision of this section shall be 
construed so as to prevent any person from obtaining customer 
information of a financial institution that otherwise is available as a 
public record filed pursuant to the securities laws (as defined in 
section 3(a)(47) of the Securities Exchange Act of 1934).
``Sec. 1004. Administrative enforcement
    ``(a) Enforcement by Federal Trade Commission.--Except as provided 
in subsection (b), compliance with this title shall be enforced by the 
Federal Trade Commission in the same manner and with the same power and 
authority as the Commission has under the title VIII, the Fair Debt 
Collection Practices Act, to enforce compliance with such title.
    ``(b) Enforcement by Other Agencies in Certain Cases.--
            ``(1) In general.--Compliance with this title shall be 
        enforced under--
                    ``(A) section 8 of the Federal Deposit Insurance 
                Act, in the case of--
                            ``(i) national banks, and Federal branches 
                        and Federal agencies of foreign banks, by the 
                        Office of the Comptroller of the Currency;
                            ``(ii) member banks of the Federal Reserve 
                        System (other than national banks), branches 
                        and agencies of foreign banks (other than 
                        Federal branches, Federal agencies, and insured 
                        State branches of foreign banks), commercial 
                        lending companies owned or controlled by 
                        foreign banks, and organizations operating 
                        under section 25 or 25A of the Federal Reserve 
                        Act, by the Board;
                            ``(iii) banks insured by the Federal 
                        Deposit Insurance Corporation (other than 
                        members of the Federal Reserve System and 
                        national nonmember banks) and insured State 
                        branches of foreign banks, by the Board of 
                        Directors of the Federal Deposit Insurance 
                        Corporation; and
                            ``(iv) savings associations the deposits of 
                        which are insured by the Federal Deposit 
                        Insurance Corporation, by the Director of the 
                        Office of Thrift Supervision; and
                    ``(B) the Federal Credit Union Act, by the 
                Administrator of the National Credit Union 
                Administration with respect to any Federal credit 
                union.
            ``(2) Violations of this title treated as violations of 
        other laws.--For the purpose of the exercise by any agency 
        referred to in paragraph (1) of its powers under any Act 
        referred to in that paragraph, a violation of this title shall 
        be deemed to be a violation of a requirement imposed under that 
        Act. In addition to its powers under any provision of law 
        specifically referred to in paragraph (1), each of the agencies 
        referred to in that paragraph may exercise, for the purpose of 
        enforcing compliance with this title, any other authority 
        conferred on such agency by law.
            ``(3) Restitution.--In the case of any failure by an entity 
        referred to in paragraph (1) to comply with the requirements of 
        this title, an agency referred to in such paragraph may require 
        such entity to make restitution to any person harmed by such 
        failure in the manner provided under section 8(b)(6)(A) of the 
        Federal Deposit Insurance Act or section 206(e)(3)(A) of the 
        Federal Credit Union Act, as the case may be, without regard to 
        clauses (i) and (ii) of such sections, and in an amount equal 
        to the sum of the amounts determined under each of the 
        following subparagraphs:
                    ``(A) Actual damages.--The greater of--
                            ``(i) the amount of any actual damage 
                        sustained by the person as a result of such 
                        failure; or
                            ``(ii) any amount received by the entity 
                        which failed to comply with this title, 
                        including an amount equal to the value of any 
                        nonmonetary consideration, as a result of the 
                        action which constitutes such failure.
                    ``(B) Additional damages.--Such additional amount 
                as the agency may determine to be appropriate under the 
                circumstances.
    ``(c) State Action for Violations.--
            ``(1) Authority of states.--In addition to such other 
        remedies as are provided under State law, if the chief law 
        enforcement officer of a State, or an official or agency 
        designated by a State, has reason to believe that any person 
        has violated or is violating this title, the State--
                    ``(A) may bring an action to enjoin such violation 
                in any appropriate United States district court or in 
                any other court of competent jurisdiction;
                    ``(B) may bring an action on behalf of the 
                residents of the State to recover damages of not more 
than $1,000 for each violation; and
                    ``(C) in the case of any successful action under 
                subparagraph (A) or (B), shall be awarded the costs of 
                the action and reasonable attorney fees as determined 
                by the court.
            ``(2) Rights of federal regulators.--
                    ``(A) Prior notice.--The State shall serve prior 
                written notice of any action under paragraph (1) upon 
                the Federal Trade Commission and--
                            ``(i) in the case of an action which 
                        involves a financial institution described in 
                        section 1004(b)(1), the agency referred to in 
                        such section with respect to such institution; 
                        or
                            ``(ii) in the case of an action which 
                        involves a financial institution subject to 
                        regulation by the Securities and Exchange 
                        Commission, such Commission.
                The State shall provide the Federal Trade Commission 
                and any such agency with a copy of its complaint, 
                except in any case in which such prior notice is not 
                feasible, in which case the State shall serve such 
                notice immediately upon instituting such action.
                    ``(B) Right to intervene.--The Federal Trade 
                Commission or an agency described in subsection (b) 
                shall have the right--
                            ``(i) to intervene in an action under 
                        paragraph (1);
                            ``(ii) upon so intervening, to be heard on 
                        all matters arising therein;
                            ``(iii) to remove the action to the 
                        appropriate United States district court; and
                            ``(iv) to file petitions for appeal.
            ``(3) Investigatory powers.--For purposes of bringing any 
        action under this subsection, no provision of this subsection 
        shall be construed as preventing the chief law enforcement 
        officer, or an official or agency designated by a State, from 
        exercising the powers conferred on the chief law enforcement 
        officer or such official by the laws of such State to conduct 
        investigations or to administer oaths or affirmations or to 
        compel the attendance of witnesses or the production of 
        documentary and other evidence.
            ``(4) Limitation on state action while federal action 
        pending.--If the Federal Trade Commission or any agency 
        described in subsection (b) has instituted a civil action for a 
        violation of this title, no State may, during the pendency of 
        such action, bring an action under this section against any 
        defendant named in the complaint of the Federal Trade 
        Commission or such agency for any violation of this title that 
        is alleged in that complaint.
    ``(d) Notice to SEC of Actions.--The Federal Trade Commission shall 
notify the Securities and Exchange Commission whenever the Federal 
Trade Commission initiates an investigation with respect to a financial 
institution subject to regulation by the Securities and Exchange 
Commission.
``Sec. 1005. Civil liability
    ``Any person, other than a financial institution, who fails to 
comply with any provision of this title with respect to any financial 
institution or any customer information of a financial institution 
shall be liable to such financial institution or the customer to whom 
such information relates in an amount equal to the sum of the amounts 
determined under each of the following paragraphs:
            ``(1) Actual damages.--The greater of--
                    ``(A) the amount of any actual damage sustained by 
                the financial institution or customer as a result of 
                such failure; or
                    ``(B) any amount received by the person who failed 
                to comply with this title, including an amount equal to 
                the value of any nonmonetary consideration, as a result 
                of the action which constitutes such failure.
            ``(2) Additional damages.--Such additional amount as the 
        court may allow.
            ``(3) Attorneys' fees.--In the case of any successful 
        action to enforce any liability under paragraph (1) or (2), the 
        costs of the action, together with reasonable attorneys' fees.
``Sec. 1006. Criminal penalty
    ``(a) In General.--Whoever knowingly and intentionally violates, or 
knowingly and intentionally attempts to violate, section 1003 shall be 
fined in accordance with title 18, United States Code, or imprisoned 
for not more than 5 years, or both.
    ``(b) Enhanced Penalty for Aggravated Cases.--Whoever violates, or 
attempts to violate, section 1003 while violating another law of the 
United States or as part of a pattern of any illegal activity involving 
more than $100,000 in a 12-month period shall be fined twice the amount 
provided in subsection (b)(3) or (c)(3) (as the case may be) of section 
3571 of title 18, United States Code, imprisoned for not more than 10 
years, or both.
``Sec. 1007. Relation to State laws
    ``(a) In General.--This title shall not be construed as 
superseding, altering, or affecting the statutes, regulations, orders, 
or interpretations in effect in any State, except to the extent that 
such statutes, regulations, orders, or interpretations are inconsistent 
with the provisions of this title, and then only to the extent of the 
inconsistency.
    ``(b) Greater Protection Under State Law.--For purposes of this 
section, a State statute, regulation, order, or interpretation is not 
inconsistent with the provisions of this title if the protection such 
statute, regulation, order, or interpretation affords any person is 
greater than the protection provided under this title.
``Sec. 1008. Agency guidance
    ``In furtherance of the objectives of this title, each Federal 
banking agency (as defined in section 3(z) of the Federal Deposit 
Insurance Act) and the Securities and Exchange Commission or self-
regulatory organizations, as appropriate, shall review regulations and 
guidelines applicable to financial institutions under their respective 
jurisdictions and shall prescribe such revisions to such regulations 
and guidelines as may be necessary to ensure that such financial 
institutions have policies, procedures, and controls in place to 
prevent the unauthorized disclosure of customer financial information 
and to deter and detect activities proscribed under section 1003.''.
    (b) Report to the Congress.--Before the end of the 18-month period 
beginning on the date of the enactment of this Act, the Comptroller 
General, in consultation with the Federal Trade Commission, Federal 
banking agencies, the Securities and Exchange Commission, and 
appropriate Federal law enforcement agencies, shall submit to the 
Congress a report on the following:
            (1) The efficacy and adequacy of the remedies provided in 
        the amendments made by subsection (a) in addressing attempts to 
        obtain financial information by fraudulent means or by false 
        pretenses.
            (2) Any recommendations for additional legislative or 
        regulatory action to address threats to the privacy of 
        financial information created by attempts to obtain information 
        by fraudulent means or false pretenses.
    (c) Annual Report by Administering Agencies.--The Federal Trade 
Commission, the Attorney General, and each of the agencies referred to 
in section 1004(b)(1) of Financial Information Privacy Act (as added by 
this Act) shall submit to Congress an annual report on number and 
disposition of all enforcement actions taken pursuant to such Act.