[Congressional Bills 107th Congress]
[From the U.S. Government Publishing Office]
[S. 1742 Referred in House (RFH)]

  2d Session
                                S. 1742


_______________________________________________________________________


                    IN THE HOUSE OF REPRESENTATIVES

                           November 14, 2002

  Referred to the Committee on the Judiciary, and in addition to the 
   Committee on Financial Services, for a period to be subsequently 
   determined by the Speaker, in each case for consideration of such 
 provisions as fall within the jurisdiction of the committee concerned

_______________________________________________________________________

                                 AN ACT


 
     To prevent the crime of identity theft, mitigate the harm to 
   individuals victimized by identity theft, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Identity Theft Victims Assistance 
Act of 2002''.

SEC. 2. FINDINGS.

    Congress finds that--
            (1) the crime of identity theft is the fastest growing 
        crime in the United States;
            (2) victims of identity theft often have extraordinary 
        difficulty restoring their credit and regaining control of 
        their identity because of the viral nature of identity theft;
            (3) identity theft may be ruinous to the good name and 
        credit of consumers whose identities are misappropriated, and 
        victims of identity theft may be denied otherwise well-deserved 
        credit, may have to spend enormous time, effort, and sums of 
        money to remedy their circumstances, and may suffer extreme 
        emotional distress including deep depression founded in 
        profound frustration as they address the array of problems that 
        may arise as a result of identity theft;
            (4) victims are often required to contact numerous Federal, 
        State, and local law enforcement agencies, consumer credit 
        reporting agencies, and creditors over many years, as each 
        event of fraud arises;
            (5) the Government, business entities, and credit reporting 
        agencies have a shared responsibility to assist identity theft 
        victims, to mitigate the harm that results from fraud 
        perpetrated in the victim's name;
            (6) victims of identity theft need a nationally 
        standardized means of--
                    (A) reporting identity theft to consumer credit 
                reporting agencies and business entities; and
                    (B) evidencing their true identity and claim of 
                identity theft to consumer credit reporting agencies 
                and business entities;
            (7) one of the greatest law enforcement challenges posed by 
        identity theft is that stolen identities are often used to 
        perpetrate crimes in many different localities in different 
        States, and although identity theft is a Federal crime, most 
        often, State and local law enforcement agencies are responsible 
        for investigating and prosecuting the crimes; and
            (8) the Federal Government should assist State and local 
        law enforcement agencies to effectively combat identity theft 
        and the associated fraud.

SEC. 3. TREATMENT OF IDENTITY THEFT MITIGATION.

    (a) In General.--Chapter 47 title 18, United States Code, is 
amended by adding after section 1028 the following:
``Sec. 1028A. Treatment of identity theft mitigation
    ``(a) Definitions.--As used in this section--
            ``(1) the term `business entity' means any corporation, 
        trust, partnership, sole proprietorship, or unincorporated 
        association, including any financial service provider, 
        financial information repository, creditor (as that term is 
        defined in section 103 of the Truth in Lending Act (15 U.S.C. 
        1602)), telecommunications, utilities, or other service 
        provider;
            ``(2) the term `consumer' means an individual;
            ``(3) the term `financial information' means information 
        identifiable as relating to an individual consumer that 
        concerns the amount and conditions of the assets, liabilities, 
        or credit of the consumer, including--
                    ``(A) account numbers and balances;
                    ``(B) nonpublic personal information, as that term 
                is defined in section 509 of the Gramm-Leach-Bliley Act 
                (15 U.S.C. 6809); and
                    ``(C) codes, passwords, social security numbers, 
                tax identification numbers, State identifier numbers 
                issued by a State department of licensing, and other 
                information used for the purpose of account access or 
                transaction initiation;
            ``(4) the term `financial information repository' means a 
        person engaged in the business of providing services to 
        consumers who have a credit, deposit, trust, stock, or other 
        financial services account or relationship with that person;
            ``(5) the term `identity theft' means an actual or 
        potential violation of section 1028 or any other similar 
        provision of Federal or State law;
            ``(6) the term `means of identification' has the same 
        meaning given the term in section 1028; and
            ``(7) the term `victim' means a consumer whose means of 
        identification or financial information has been used or 
        transferred (or has been alleged to have been used or 
        transferred) without the authority of that consumer with the 
        intent to commit, or to aid or abet, identity theft or any 
        other violation of law.
    ``(b) Information Available to Victims.--
            ``(1) In general.--A business entity that possesses 
        information relating to an alleged identity theft, or that has 
        entered into a transaction, provided credit, products, goods, 
        or services, accepted payment, or otherwise done business with 
        a person that has made unauthorized use of the means of 
        identification of the victim, shall, not later than 20 days 
        after the receipt of a written request by the victim, meeting 
        the requirements of subsection (c), provide, without charge, a 
        copy of all application and transaction information related to 
        the transaction being alleged as an identity theft to--
                    ``(A) the victim;
                    ``(B) any Federal, State, or local governing law 
                enforcement agency or officer specified by the victim; 
                or
                    ``(C) any law enforcement agency investigating the 
                identity theft and authorized by the victim to take 
                receipt of records provided under this section.
            ``(2) Rule of construction.--
                    ``(A) In general.--No provision of Federal or State 
                law prohibiting the disclosure of financial information 
                by a business entity to third parties shall be used to 
                deny disclosure of information to the victim under this 
                section.
                    ``(B) Limitation.--Except as provided in 
                subparagraph (A), nothing in this section requires a 
                business entity to disclose information that the 
                business entity is otherwise prohibited from disclosing 
                under any other provision of Federal or State law.
    ``(c) Verification of Identity and Claim.--Unless a business 
entity, at its discretion, is otherwise able to verify the identity of 
a victim making a request under subsection (b)(1), the victim shall 
provide to the business entity--
            ``(1) as proof of positive identification--
                    ``(A) the presentation of a government-issued 
                identification card;
                    ``(B) if providing proof by mail, a copy of a 
                government-issued identification card; or
                    ``(C) upon the request of the person seeking 
                business records, the business entity may inform the 
                requesting person of the categories of identifying 
                information that the unauthorized person provided the 
                business entity as personally identifying information, 
                and may require the requesting person to provide 
                identifying information in those categories; and
            ``(2) as proof of a claim of identity theft, at the 
        election of the business entity--
                    ``(A) a copy of a police report evidencing the 
                claim of the victim of identity theft;
                    ``(B) a copy of a standardized affidavit of 
                identity theft developed and made available by the 
                Federal Trade Commission; or
                    ``(C) any affidavit of fact that is acceptable to 
                the business entity for that purpose.
    ``(d) Limitation on Liability.--No business entity may be held 
liable for a disclosure, made in good faith and reasonable judgment, to 
provide information under this section with respect to an individual in 
connection with an identity theft to other business entities, law 
enforcement authorities, victims, or any person alleging to be a 
victim, if--
            ``(1) the business entity complies with subsection (c); and
            ``(2) such disclosure was made--
                    ``(A) for the purpose of detection, investigation, 
                or prosecution of identity theft; or
                    ``(B) to assist a victim in recovery of fines, 
                restitution, rehabilitation of the credit of the 
                victim, or such other relief as may be appropriate.
    ``(e) Authority to Decline to Provide Information.--A business 
entity may decline to provide information under subsection (b) if, in 
the exercise of good faith and reasonable judgment, the business entity 
believes that--
            ``(1) this section does not require disclosure of the 
        information; or
            ``(2) the request for the information is based on a 
        misrepresentation of fact by the victim relevant to the request 
        for information.
    ``(f) No New Recordkeeping Obligation.--Nothing in this section 
creates an obligation on the part of a business entity to obtain, 
retain, or maintain information or records that are not otherwise 
required to be obtained, retained, or maintained in the ordinary course 
of its business or under other applicable law.
    ``(g) Affirmative Defense.--In any civil action brought to enforce 
this section, it is an affirmative defense (which the defendant must 
establish by a preponderance of the evidence) for a business entity to 
file an affidavit or answer stating that--
            ``(1) the business entity has made a reasonably diligent 
        search of its available business records; and
            ``(2) the records requested under this section do not exist 
        or are not available.
    ``(h) No private right of action.--Nothing in this section shall be 
construed to provide a private right of action or claim for relief.
    ``(i) Enforcement.--
            ``(1) Civil actions.--
                    ``(A) In general.--In any case in which the 
                attorney general of a State has reason to believe that 
                an interest of the residents of that State has been, or 
                is threatened to be, adversely affected by a violation 
                of this section by any business entity, the State, as 
                parens patriae, may bring a civil action on behalf of 
                the residents of the State in a district court of the 
                United States of appropriate jurisdiction to--
                            ``(i) enjoin that practice;
                            ``(ii) enforce compliance of this section;
                            ``(iii) obtain damages--
                                    ``(I) in the sum of actual damages, 
                                restitution, and other compensation on 
                                behalf of the residents of the State; 
                                and
                                    ``(II) punitive damages, if the 
                                violation is willful or intentional; 
                                and
                            ``(iv) obtain such other equitable relief 
                        as the court may consider to be appropriate.
                    ``(B) Notice.--Before bringing an action under 
                subparagraph (A), the attorney general of the State 
                involved shall provide to the Attorney General of the 
                United States--
                            ``(i) written notice of the action; and
                            ``(ii) a copy of the complaint for the 
                        action.
            ``(2) Intervention.--
                    ``(A) In general.--On receiving notice of an action 
                under paragraph (1)(B), the Attorney General of the 
                United States shall have the right to intervene in that 
                action.
                    ``(B) Effect of intervention.--If the Attorney 
                General of the United States intervenes in an action 
                under this subsection, the Attorney General shall have 
                the right to be heard with respect to any matter that 
                arises in that action.
                    ``(C) Service of process.--Upon request of the 
                Attorney General of the United States, the attorney 
                general of a State that has filed an action under this 
                subsection shall, pursuant to Rule 4(d)(4) of the 
                Federal Rules of Civil Procedure, serve the Government 
                with--
                            ``(i) a copy of the complaint; and
                            ``(ii) written disclosure of substantially 
                        all material evidence and information in the 
                        possession of the attorney general of the 
                        State.
            ``(3) Construction.--For purposes of bringing any civil 
        action under this subsection, nothing in this section shall be 
        construed to prevent an attorney general of a State from 
        exercising the powers conferred on such attorney general by the 
        laws of that State--
                    ``(A) to conduct investigations;
                    ``(B) to administer oaths or affirmations; or
                    ``(C) to compel the attendance of witnesses or the 
                production of documentary and other evidence.
            ``(4) Actions by the attorney general of the united 
        states.--In any case in which an action is instituted by or on 
        behalf of the Attorney General of the United States for a 
        violation of this section, no State may, during the pendency of 
        that action, institute an action under this subsection against 
        any defendant named in the complaint in that action for 
        violation of that practice.
            ``(5) Venue; service of process.--
                    ``(A) Venue.--Any action brought under this 
                subsection may be brought in the district court of the 
                United States--
                            ``(i) where the defendant resides;
                            ``(ii) where the defendant is doing 
                        business; or
                            ``(iii) that meets applicable requirements 
                        relating to venue under section 1391 of title 
                        28.
                    ``(B) Service of process.--In an action brought 
                under this subsection, process may be served in any 
                district in which the defendant--
                            ``(i) resides;
                            ``(ii) is doing business; or
                            ``(iii) may be found.''.
    (b) Clerical Amendment.--The table of sections at the beginning of 
chapter 47 of title 18, United States Code, is amended by inserting 
after the item relating to section 1028 the following new item:

``1028A. Treatment of identity theft mitigation.''.

SEC. 4. AMENDMENTS TO THE FAIR CREDIT REPORTING ACT.

    (a) Consumer Reporting Agency Blocking of Information Resulting 
From Identity Theft.--Section 611 of the Fair Credit Reporting Act (15 
U.S.C. 1681i) is amended by adding at the end the following:
    ``(e) Block of Information Resulting From Identity Theft.--
            ``(1) Block.--Except as provided in paragraph (3) and not 
        later than 30 days after the date of receipt of proof of the 
        identity of a consumer and an official copy of a police report 
        evidencing the claim of the consumer of identity theft, a 
        consumer reporting agency shall block the reporting of any 
        information identified by the consumer in the file of the 
        consumer resulting from the identity theft, so that the 
        information cannot be reported.
            ``(2) Notification.--A consumer reporting agency shall 
        promptly notify the furnisher of information identified by the 
        consumer under paragraph (1)--
                    ``(A) that the information may be a result of 
                identity theft;
                    ``(B) that a police report has been filed;
                    ``(C) that a block has been requested under this 
                subsection; and
                    ``(D) of the effective date of the block.
            ``(3) Authority to decline or rescind.--
                    ``(A) In general.--A consumer reporting agency may 
                decline to block, or may rescind any block, of consumer 
                information under this subsection if--
                            ``(i) in the exercise of good faith and 
                        reasonable judgment, the consumer reporting 
                        agency finds that--
                                    ``(I) the information was blocked 
                                due to a misrepresentation of fact by 
                                the consumer relevant to the request to 
                                block; or
                                    ``(II) the consumer knowingly 
                                obtained possession of goods, services, 
                                or moneys as a result of the blocked 
                                transaction or transactions, or the 
                                consumer should have known that the 
                                consumer obtained possession of goods, 
                                services, or moneys as a result of the 
                                blocked transaction or transactions; or
                            ``(ii) the consumer agrees that the blocked 
                        information or portions of the blocked 
                        information were blocked in error.
                    ``(B) Notification to consumer.--If the block of 
                information is declined or rescinded under this 
                paragraph, the affected consumer shall be notified 
                promptly, in the same manner as consumers are notified 
                of the reinsertion of information under subsection 
                (a)(5)(B).
                    ``(C) Significance of block.--For purposes of this 
                paragraph, if a consumer reporting agency rescinds a 
                block, the presence of information in the file of a 
                consumer prior to the blocking of such information is 
                not evidence of whether the consumer knew or should 
                have known that the consumer obtained possession of any 
                goods, services, or monies as a result of the block.
            ``(4) Exceptions.--
                    ``(A) Negative information data.--A consumer 
                reporting agency shall not be required to comply with 
                this subsection when such agency is issuing information 
                for authorizations, for the purpose of approving or 
                processing negotiable instruments, electronic funds 
                transfers, or similar methods of payment, based solely 
                on negative information, including--
                            ``(i) dishonored checks;
                            ``(ii) accounts closed for cause;
                            ``(iii) substantial overdrafts;
                            ``(iv) abuse of automated teller machines; 
                        or
                            ``(v) other information which indicates a 
                        risk of fraud occurring.
                    ``(B) Resellers.--
                            ``(i) No reseller file.--The provisions of 
                        this subsection do not apply to a consumer 
                        reporting agency if the consumer reporting 
                        agency--
                                    ``(I) does not maintain a file on 
                                the consumer from which consumer 
                                reports are produced;
                                    ``(II) is not, at the time of the 
                                request of the consumer under paragraph 
                                (1), otherwise furnishing or reselling 
                                a consumer report concerning the 
                                information identified by the consumer; 
                                and
                                    ``(III) informs the consumer, by 
                                any means, that the consumer may report 
                                the identity theft to the Federal Trade 
                                Commission to obtain consumer 
                                information regarding identity theft.
                            ``(ii) Reseller with file.--The sole 
                        obligation of the consumer reporting agency 
                        under this subsection, with regard to any 
                        request of a consumer under this subsection, 
                        shall be to block the consumer report 
                        maintained by the consumer reporting agency 
                        from any subsequent use if--
                                    ``(I) the consumer, in accordance 
                                with the provisions of paragraph (1), 
                                identifies, to a consumer reporting 
                                agency, information in the file of the 
                                consumer that resulted from identity 
                                theft;
                                    ``(II) the consumer reporting 
                                agency is acting as a reseller of the 
                                identified information by assembling or 
                                merging information about that consumer 
                                which is contained in the database of 
                                not less than 1 other consumer 
                                reporting agency; and
                                    ``(III) the consumer reporting 
                                agency does not store or maintain a 
                                database of information obtained for 
                                resale from which new consumer reports 
                                are produced.
                            ``(iii) Notice.--In carrying out its 
                        obligation under clause (ii), the consumer 
                        reporting agency shall provide a notice to the 
                        consumer of the decision to block the file. 
                        Such notice shall contain the name, address, 
                        and telephone number of each consumer reporting 
                        agency from which the consumer information was 
                        obtained for resale.''.
    (b) False Claims.--Section 1028 of title 18, United States Code, is 
amended by adding at the end the following:
    ``(j) Any person who knowingly falsely claims to be a victim of 
identity theft for the purpose of obtaining the blocking of information 
by a consumer reporting agency under section 611(e)(1) of the Fair 
Credit Reporting Act (15 U.S.C. 1681i(e)(1)) shall be fined under this 
title, imprisoned not more than 3 years, or both.''.
    (c) Statute of Limitations.--Section 618 of the Fair Credit 
Reporting Act (15 U.S.C. 1681p) is amended to read as follows:

``SEC. 618. JURISDICTION OF COURTS; LIMITATION ON ACTIONS.

    ``(a) In General.--Except as provided in subsections (b) and (c), 
an action to enforce any liability created under this title may be 
brought in any appropriate United States district court without regard 
to the amount in controversy, or in any other court of competent 
jurisdiction, not later than 2 years from the date of the defendant's 
violation of any requirement under this title.
    ``(b) Willful Misrepresentation.--In any case in which the 
defendant has materially and willfully misrepresented any information 
required to be disclosed to an individual under this title, and the 
information misrepresented is material to the establishment of the 
liability of the defendant to that individual under this title, an 
action to enforce a liability created under this title may be brought 
at any time within 2 years after the date of discovery by the 
individual of the misrepresentation.
    ``(c) Identity Theft.--An action to enforce a liability created 
under this title may be brought not later than 4 years from the date of 
the defendant's violation if--
            ``(1) the plaintiff is the victim of an identity theft; or
            ``(2) the plaintiff--
                    ``(A) has reasonable grounds to believe that the 
                plaintiff is the victim of an identity theft; and
                    ``(B) has not materially and willfully 
                misrepresented such a claim.''.

SEC. 5. COORDINATING COMMITTEE STUDY OF COORDINATION BETWEEN FEDERAL, 
              STATE, AND LOCAL AUTHORITIES IN ENFORCING IDENTITY THEFT 
              LAWS.

    (a) Membership; Term.--Section 2 of the Internet False 
Identification Prevention Act of 2000 (18 U.S.C. 1028 note) is 
amended--
            (1) in subsection (b), by striking ``and the Commissioner 
        of Immigration and Naturalization'' and inserting ``the 
        Commissioner of Immigration and Naturalization, the Chairman of 
        the Federal Trade Commission, the Postmaster General, and the 
        Commissioner of the United States Customs Service,''; and
            (2) in subsection (c), by striking ``2 years after the 
        effective date of this Act.'' and inserting ``on December 28, 
        2004.''.
    (b) Consultation.--Section 2 of the Internet False Identification 
Prevention Act of 2000 (18 U.S.C. 1028 note) is amended--
            (1) by redesignating subsection (d) as subsection (e); and
            (2) by inserting after subsection (c) the following:
    ``(d) Consultation.--In discharging its duties, the coordinating 
committee shall consult with interested parties, including State and 
local law enforcement agencies, State attorneys general, 
representatives of business entities (as that term is defined in 
section 4 of the Identity Theft Victims Assistance Act of 2002), 
including telecommunications and utility companies, and organizations 
representing consumers.''.
    (c) Report Distribution and Contents.--Section 2(e) of the Internet 
False Identification Prevention Act of 2000 (18 U.S.C. 1028 note) (as 
redesignated by subsection (b)) is amended--
            (1) by striking paragraph (1) and inserting the following:
            ``(1) In general.--The Attorney General and the Secretary 
        of the Treasury, at the end of each year of the existence of 
        the coordinating committee, shall report on the activities of 
        the coordinating committee to--
                    ``(A) the Committee on the Judiciary of the Senate;
                    ``(B) the Committee on the Judiciary of the House 
                of Representatives;
                    ``(C) the Committee on Banking, Housing, and Urban 
                Affairs of the Senate; and
                    ``(D) the Committee on Financial Services of the 
                House of Representatives.'';
            (2) in subparagraph (E), by striking ``and'' at the end; 
        and
            (3) by striking subparagraph (F) and inserting the 
        following:
                    ``(F) a comprehensive description of Federal 
                assistance provided to State and local law enforcement 
                agencies to address identity theft;
                    ``(G) a comprehensive description of coordination 
                activities between Federal, State, and local law 
                enforcement agencies that address identity theft; and
                    ``(H) recommendations in the discretion of the 
                President, if any, for legislative or administrative 
                changes that would--
                            ``(i) facilitate more effective 
                        investigation and prosecution of cases 
                        involving--
                                    ``(I) identity theft; and
                                    ``(II) the creation and 
                                distribution of false identification 
                                documents;
                            ``(ii) improve the effectiveness of Federal 
                        assistance to State and local law enforcement 
                        agencies and coordination between Federal, 
                        State, and local law enforcement agencies; and
                            ``(iii) simplify efforts by a person 
                        necessary to rectify the harm that results

                        from the theft of the identity of such 
                        person.''.

            Passed the Senate November 14, 2002.

            Attest:

                                                  JERI THOMSON,

                                                             Secretary.