[Congressional Bills 107th Congress]
[From the U.S. Government Publishing Office]
[S. 1742 Reported in Senate (RS)]






                                                       Calendar No. 382
107th CONGRESS
  2d Session
                                S. 1742

     To prevent the crime of identity theft, mitigate the harm to 
   individuals victimized by identity theft, and for other purposes.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                           November 29, 2001

   Ms. Cantwell (for herself, Mr. Schumer, Mr. Enzi, and Mr. Leahy) 
introduced the following bill; which was read twice and referred to the 
                       Committee on the Judiciary

                              May 21, 2002

                Reported by Mr. Leahy, with an amendment

_______________________________________________________________________

 [Strike out all after the enacting clause and insert the part printed 
                               in italic]

                                 A BILL


 
     To prevent the crime of identity theft, mitigate the harm to 
   individuals victimized by identity theft, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

<DELETED>SECTION 1. SHORT TITLE.</DELETED>

<DELETED>    This Act may be cited as the ``Restore Your Identity Act 
of 2001''.</DELETED>

<DELETED>SEC. 2. FINDINGS.</DELETED>

<DELETED>    Congress finds that--</DELETED>
        <DELETED>    (1) the crime of identity theft is the fastest 
        growing crime in the United States;</DELETED>
        <DELETED>    (2) the Federal Trade Commission reports that 
        between March and June of 2001, the total number of identity 
        theft victims in the Commission's Complaint Clearinghouse 
        System, tallied from November 1999, increased from 45,593 to 
        69,370;</DELETED>
        <DELETED>    (3) consumer inquiries and complaints to the 
        Federal Trade Commission Identity Theft Hotline increased from 
        68,000 to over 97,000 over the same 3-month period, and 
        consumer calls into the Hotline increased in the same period 
        from 1,800 calls per week to over 2,000;</DELETED>
        <DELETED>    (4) the Federal Trade Commission estimates that 
        the call volume to the Identity Theft Hotline represents only 5 
        to 10 percent of the actual number of victims of identity 
        theft;</DELETED>
        <DELETED>    (5) victims of identity theft often have 
        extraordinary difficulty restoring their credit and regaining 
        control of their identity because of the viral nature of 
        identity theft;</DELETED>
        <DELETED>    (6) identity theft may be ruinous to the good name 
        and credit of consumers whose identities are misappropriated, 
        and victims of identity theft may be denied otherwise well-
        deserved credit, may have to spend enormous time, effort, and 
        sums of money to remedy their circumstances, and may suffer 
        extreme emotional distress including deep depression founded in 
        profound frustration as they address the array of problems that 
        may arise as a result of identity theft;</DELETED>
        <DELETED>    (7) victims are often required to contact numerous 
        Federal, State, and local law enforcement agencies, consumer 
        credit reporting agencies, and creditors over many years, as 
        each event of fraud arises;</DELETED>
        <DELETED>    (8) the Government, business entities, and credit 
        reporting agencies have a shared responsibility to assist 
        identity theft victims, to mitigate the harm that results from 
        fraud perpetrated in the victim's name;</DELETED>
        <DELETED>    (9) victims of identity theft need a nationally 
        standardized means of--</DELETED>
                <DELETED>    (A) reporting identity theft to law 
                enforcement, consumer credit reporting agencies, and 
                business entities; and</DELETED>
                <DELETED>    (B) evidencing their true identity to 
                business entities and credit reporting 
                agencies;</DELETED>
        <DELETED>    (10) one of the greatest law enforcement 
        challenges posed by identity theft is that stolen identities 
        are often used to perpetrate crimes in many different 
        localities in different States, and although identity theft is 
        a Federal crime, most often, State and local law enforcement 
        agencies are responsible for investigating and prosecuting the 
        crimes; and</DELETED>
        <DELETED>    (11) the Federal Government should assist State 
        and local law enforcement agencies to effectively combat 
        identity theft and the associated fraud.</DELETED>

<DELETED>SEC. 3. DEFINITIONS.</DELETED>

<DELETED>    In this Act, the following definitions shall 
apply:</DELETED>
        <DELETED>    (1) Business entity.--The term ``business entity'' 
        means--</DELETED>
                <DELETED>    (A) a creditor, as that term is defined in 
                section 103 of the Truth in Lending Act (15 U.S.C. 
                1602);</DELETED>
                <DELETED>    (B) any financial information 
                repository;</DELETED>
                <DELETED>    (C) any financial service provider; 
                and</DELETED>
                <DELETED>    (D) any corporation, trust, partnership, 
                sole proprietorship, or unincorporated association 
                (including telecommunications, utilities, and other 
                service providers).</DELETED>
        <DELETED>    (2) Consumer.--The term ``consumer'' means an 
        individual.</DELETED>
        <DELETED>    (3) Financial information.--The term ``financial 
        information'' means information identifiable as relating to an 
        individual consumer that concerns the amount and conditions of 
        the assets, liabilities, or credit of the consumer, including--
        </DELETED>
                <DELETED>    (A) account numbers and 
                balances;</DELETED>
                <DELETED>    (B) nonpublic personal information, as 
                that term is defined in section 509 of the Gramm-Leach-
                Bliley Act (15 U.S.C. 6809); and</DELETED>
                <DELETED>    (C) codes, passwords, social security 
                numbers, tax identification numbers, State identifier 
                numbers issued by a State department of licensing, and 
                other information used for the purpose of account 
                access or transaction initiation.</DELETED>
        <DELETED>    (4) Financial information repository.--The term 
        ``financial information repository'' means a person engaged in 
        the business of providing services to consumers who have a 
        credit, deposit, trust, stock, or other financial services 
        account or relationship with that person.</DELETED>
        <DELETED>    (5) Identity theft.--The term ``identity theft'' 
        means an actual or potential violation of section 1028 of title 
        28, United States Code, or any other similar provision of 
        Federal or State law.</DELETED>
        <DELETED>    (6) Means of identification.--The term ``means of 
        identification'' has the meanings given the terms 
        ``identification document'' and ``means of identification'' in 
        section 1028 of title 18, United States Code.</DELETED>
        <DELETED>    (7) Victim.--The term ``victim'' means a consumer 
        whose means of identification or financial information has been 
        used or transferred (or has been alleged to have been used or 
        transferred) without the authority of that consumer with the 
        intent to commit, or to aid or abet, identity theft or any 
        other violation of law.</DELETED>

<DELETED>SEC. 4. IDENTITY THEFT TREATED AS RACKETEERING 
              ACTIVITY.</DELETED>

<DELETED>    Section 1961(1)(B) of title 18, United States Code, is 
amended by inserting ``, or any similar offense chargeable under State 
law'' after ``identification documents)''.</DELETED>

<DELETED>SEC. 5. TREATMENT OF IDENTITY THEFT MITIGATION.</DELETED>

<DELETED>    (a) Information Available to Victims.--</DELETED>
        <DELETED>    (1) In general.--A business entity possessing 
        information relating to an identity theft, or who may have 
        entered into a transaction, provided credit, products, goods, 
        or services, accepted payment, or otherwise done business with 
        a person that has made unauthorized use of the means of 
        identification of the victim, shall, not later than 10 days 
        after receipt of a written request by the victim, provide, 
        without charge, to the victim or to any Federal, State, or 
        local governing law enforcement agency or officer specified by 
        the victim copies of all related application and transaction 
        information and any information required pursuant to subsection 
        (b).</DELETED>
        <DELETED>    (2) Rule of construction.--Nothing in this section 
        requires a business entity to disclose information that the 
        business entity is otherwise prohibited from disclosing under 
        any other provision of Federal or State law, except that any 
        such provision of law that prohibits the disclosure of 
        financial information to third parties shall not be used to 
        deny disclosure of information to the victim under this 
        section.</DELETED>
<DELETED>    (b) Verification of Identity.--</DELETED>
        <DELETED>    (1) In general.--Unless a business entity is 
        otherwise able to verify the identity of a victim making a 
        request under subsection (a)(1), the victim shall provide to 
        the business entity as proof of positive identification, at the 
        election of the business entity--</DELETED>
                <DELETED>    (A) a copy of a police report evidencing 
                the claim of the victim of identity theft;</DELETED>
                <DELETED>    (B) a copy of a standardized affidavit of 
                identity theft developed and made available by the 
                Federal Trade Commission; or</DELETED>
                <DELETED>    (C) any affidavit of fact that is 
                acceptable to the business entity for that 
                purpose.</DELETED>
<DELETED>    (c) Limitation on Liability.--No business entity may be 
held liable for an action taken in good faith to provide information 
under this section with respect to an individual in connection with an 
identity theft to other financial information repositories, financial 
service providers, merchants, law enforcement authorities, victims, or 
any person alleging to be a victim, if--</DELETED>
        <DELETED>    (1) the business entity complies with subsection 
        (b); and</DELETED>
        <DELETED>    (2) such action was taken--</DELETED>
                <DELETED>    (A) for the purpose of identification and 
                prosecution of identity theft; or</DELETED>
                <DELETED>    (B) to assist a victim in recovery of 
                fines, restitution, rehabilitation of the credit of the 
                victim, or such other relief as may be 
                appropriate.</DELETED>
<DELETED>    (d) Authority To Decline To Provide Information.--A 
business entity may decline to provide information pursuant to 
subsection (a) if, in the exercise of good faith and reasonable 
judgment, the business entity believes that--</DELETED>
        <DELETED>    (1) this section does not require disclosure of 
        the information; or</DELETED>
        <DELETED>    (2) the request for the information is based on a 
        misrepresentation of fact by the victim relevant to the request 
        for information.</DELETED>
<DELETED>    (e) No New Recordkeeping Obligation.--Nothing in this 
section creates an obligation on the part of a business entity to 
retain or maintain information or records that are not otherwise 
required to be retained or maintained in the ordinary course of its 
business or under other applicable law.</DELETED>

<DELETED>SEC. 6. AMENDMENTS TO THE FAIR CREDIT REPORTING ACT.</DELETED>

<DELETED>    (a) Consumer Reporting Agency Blocking of Information 
Resulting From Identity Theft.--Section 611 of the Fair Credit 
Reporting Act (15 U.S.C. 1681i) is amended by adding at the end the 
following:</DELETED>
<DELETED>    ``(e) Block of Information Resulting From Identity 
Theft.--</DELETED>
        <DELETED>    ``(1) Block.--Not later than 30 days after the 
        date of receipt of proof of the identity of a consumer and an 
        official copy of a police report evidencing the claim of the 
        consumer of identity theft, a consumer reporting agency shall 
        permanently block the reporting of any information identified 
        by the consumer in the file of the consumer resulting from the 
        identity theft, so that the information cannot be reported, 
except as provided in paragraph (3).</DELETED>
        <DELETED>    ``(2) Notification.--A consumer reporting agency 
        shall promptly notify the furnisher of information identified 
        by the consumer under paragraph (1) that the information may be 
        a result of identity theft, that a police report has been 
        filed, that a block has been requested under this subsection, 
        and the effective date of the block.</DELETED>
        <DELETED>    ``(3) Authority to decline or rescind.--</DELETED>
                <DELETED>    ``(A) In general.--A consumer reporting 
                agency may decline to block, or may rescind any block, 
                of consumer information under this subsection if--
                </DELETED>
                        <DELETED>    ``(i) in the exercise of good 
                        faith and reasonable judgment, the consumer 
                        reporting agency believes that--</DELETED>
                                <DELETED>    ``(I) the information was 
                                blocked due to a misrepresentation of 
                                fact by the consumer relevant to the 
                                request to block; or</DELETED>
                                <DELETED>    ``(II) the consumer 
                                knowingly obtained possession of goods, 
                                services, or moneys as a result of the 
                                blocked transaction or transactions, or 
                                the consumer should have known that the 
                                consumer obtained possession of goods, 
                                services, or moneys as a result of the 
                                blocked transaction or transactions; 
                                or</DELETED>
                        <DELETED>    ``(ii) the consumer agrees that 
                        the blocked information or portions of the 
                        blocked information were blocked in 
                        error.</DELETED>
                <DELETED>    ``(B) Notification to consumer.--If the 
                block of information is declined or rescinded under 
                this paragraph, the affected consumer shall be notified 
                promptly, in the same manner as consumers are notified 
                of the reinsertion of information pursuant to 
                subsection (a)(5)(B).</DELETED>
                <DELETED>    ``(C) Significance of block.--For purposes 
                of this paragraph, the prior presence of blocked 
                information in the file of a consumer is not evidence 
                of whether the consumer knew or should have known that 
                the consumer obtained possession of any goods, 
                services, or monies as a result of the 
                block.''.</DELETED>
<DELETED>    (b) Statute of Limitations.--Section 618 of the Fair 
Credit Reporting Act (15 U.S.C. 1681p) is amended by striking 
``jurisdiction'' and all that follows through ``years after'' and 
inserting ``jurisdiction, not later than 2 years after''.</DELETED>

<DELETED>SEC. 7. COMMISSION STUDY OF COORDINATION BETWEEN FEDERAL, 
              STATE, AND LOCAL AUTHORITIES IN ENFORCING IDENTITY THEFT 
              LAWS.</DELETED>

<DELETED>    (a) Membership.--Section 2(b) of the Internet False 
Identification Prevention Act of 2000 (18 U.S.C. 1028 note) is amended 
by inserting ``the Postmaster General, the Commissioner of the United 
States Customs Service,'' after ``Trade Commissioner''.</DELETED>
<DELETED>    (b) Consultation.--Section 2 of the Internet False 
Identification Prevention Act of 2000 (18 U.S.C. 1028 note) is 
amended--</DELETED>
        <DELETED>    (1) by redesignating subsection (d) as subsection 
        (e); and</DELETED>
        <DELETED>    (2) by inserting after subsection (c) the 
        following:</DELETED>
<DELETED>    ``(d) Consultation.--The coordinating committee shall 
consult with interested parties, including State and local law 
enforcement agencies, State attorneys general, representatives of 
business entities (as that term is defined in section 4 of the Restore 
Your Identity Act of 2001), including telecommunications and utility 
companies, and organizations representing consumers.''.</DELETED>
<DELETED>    (c) Report Contents.--Section 2(e) of the Internet False 
Identification Prevention Act of 2000 (18 U.S.C. 1028 note) (as 
redesignated by this section) is amended--</DELETED>
        <DELETED>    (1) in subparagraph (E), by striking ``and'' at 
        the end; and</DELETED>
        <DELETED>    (2) by striking subparagraph (F) and inserting the 
        following:</DELETED>
                <DELETED>    ``(F) a comprehensive description of 
                Federal assistance to address identity theft provided 
                to State and local law enforcement agencies;</DELETED>
                <DELETED>    ``(G) a comprehensive description of 
                coordination activities between Federal, State, and 
                local law enforcement agencies in regard to addressing 
                identity theft and recommendations, if any, for 
                legislative changes that could facilitate more 
                effective investigation and prosecution of the creation 
                and distribution of false identification 
                documents;</DELETED>
                <DELETED>    ``(H) a comprehensive description of how 
                the Federal Government can best provide to State and 
                local law enforcement agencies timely and current 
                information regarding terrorists or terrorist activity 
                where such information specifically relates to identity 
                theft; and</DELETED>
                <DELETED>    ``(I) recommendations, if any, for 
                legislative or administrative changes that would--
                </DELETED>
                        <DELETED>    ``(i) facilitate more effective 
                        investigation and prosecution of cases 
                        involving identity theft;</DELETED>
                        <DELETED>    ``(ii) improve the effectiveness 
                        of Federal assistance to State and local law 
                        enforcement agencies and coordination between 
                        Federal, State, and local law enforcement 
                        agencies;</DELETED>
                        <DELETED>    ``(iii) simplify efforts by a 
                        person necessary to rectify the harm that 
                        results from the theft of the identity of the 
                        person; and</DELETED>
                        <DELETED>    ``(iv) if deemed appropriate, 
                        provide for the establishment of a Federal 
                        identity theft and false identification office 
                        or agency.''.</DELETED>

<DELETED>SEC. 8. ENFORCEMENT BY STATE ATTORNEYS GENERAL.</DELETED>

<DELETED>    (a) In General.--</DELETED>
        <DELETED>    (1) Civil actions.--In any case in which the 
        attorney general of a State has reason to believe that an 
        interest of the residents of that State has been or is 
        threatened or adversely affected by the engagement of any 
        person in a practice that is prohibited under this Act or under 
        any amendment made by this Act, the State, as parens patriae, 
        may bring a civil action on behalf of the residents of the 
        State in a district court of the United States of appropriate 
        jurisdiction to--</DELETED>
                <DELETED>    (A) enjoin that practice;</DELETED>
                <DELETED>    (B) enforce compliance with this Act or 
                the amendments made by this Act;</DELETED>
                <DELETED>    (C) obtain damage, restitution, or other 
                compensation on behalf of residents of the State; 
                or</DELETED>
                <DELETED>    (D) obtain such other relief as the court 
                may consider to be appropriate.</DELETED>
        <DELETED>    (2) Notice.--</DELETED>
                <DELETED>    (A) In general.--Before filing an action 
                under paragraph (1), the attorney general of the State 
                involved shall provide to the Attorney General of the 
                United States--</DELETED>
                        <DELETED>    (i) written notice of the action; 
                        and</DELETED>
                        <DELETED>    (ii) a copy of the complaint for 
                        the action.</DELETED>
                <DELETED>    (B) Exemption.--</DELETED>
                        <DELETED>    (i) In general.--Subparagraph (A) 
                        shall not apply with respect to the filing of 
                        an action by an attorney general of a State 
                        under this subsection, if that attorney general 
                        determines that it is not feasible to provide 
                        the notice described in subparagraph (A) before 
                        the filing of the action.</DELETED>
                        <DELETED>    (ii) Notification.--In an action 
                        described in clause (i), the attorney general 
                        of a State shall provide notice and a copy of 
                        the complaint to the Attorney General of the 
                        United States at the same time as the action is 
                        filed.</DELETED>
<DELETED>    (b) Intervention.--</DELETED>
        <DELETED>    (1) In general.--On receiving notice of an action 
        under subsection (a)(2), the Attorney General of the United 
        States shall have the right to intervene in that 
        action.</DELETED>
        <DELETED>    (2) Effect of intervention.--If the Attorney 
        General of the United States intervenes in an action under 
        subsection (a), the Attorney General shall have the right to be 
        heard with respect to any matter that arises in that 
        action.</DELETED>
<DELETED>    (c) Construction.--For purposes of bringing any civil 
action under subsection (a), nothing in this Act or the amendments made 
by this Act shall be construed to prevent an attorney general of a 
State from exercising the powers conferred on such attorney general by 
the laws of that State--</DELETED>
        <DELETED>    (1) to conduct investigations;</DELETED>
        <DELETED>    (2) to administer oaths or affirmations; 
        or</DELETED>
        <DELETED>    (3) to compel the attendance of witnesses or the 
        production of documentary and other evidence.</DELETED>
<DELETED>    (d) Actions by the Attorney General of the United 
States.--In any case in which an action is instituted by or on behalf 
of the Attorney General of the United States for violation of a 
practice that is prohibited under this Act or under any amendment made 
by this Act, no State may, during the pendency of that action, 
institute an action under subsection (a) against any defendant named in 
the complaint in that action for violation of that practice.</DELETED>
<DELETED>    (e) Venue; Service of Process.--</DELETED>
        <DELETED>    (1) Venue.--Any action brought under subsection 
        (a) may be brought in the district court of the United States 
        that meets applicable requirements relating to venue under 
        section 1391 of title 28, United States Code.</DELETED>
        <DELETED>    (2) Service of process.--In an action brought 
        under subsection (a), process may be served in any district in 
        which the defendant--</DELETED>
                <DELETED>    (A) is an inhabitant; or</DELETED>
                <DELETED>    (B) may be found.</DELETED>

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Identity Theft Victims Assistance 
Act of 2002''.

SEC. 2. FINDINGS.

    Congress finds that--
            (1) the crime of identity theft is the fastest growing 
        crime in the United States;
            (2) victims of identity theft often have extraordinary 
        difficulty restoring their credit and regaining control of 
        their identity because of the viral nature of identity theft;
            (3) identity theft may be ruinous to the good name and 
        credit of consumers whose identities are misappropriated, and 
        victims of identity theft may be denied otherwise well-deserved 
        credit, may have to spend enormous time, effort, and sums of 
        money to remedy their circumstances, and may suffer extreme 
        emotional distress including deep depression founded in 
        profound frustration as they address the array of problems that 
        may arise as a result of identity theft;
            (4) victims are often required to contact numerous Federal, 
        State, and local law enforcement agencies, consumer credit 
        reporting agencies, and creditors over many years, as each 
        event of fraud arises;
            (5) the Government, business entities, and credit reporting 
        agencies have a shared responsibility to assist identity theft 
        victims, to mitigate the harm that results from fraud 
        perpetrated in the victim's name;
            (6) victims of identity theft need a nationally 
        standardized means of--
                    (A) reporting identity theft to consumer credit 
                reporting agencies and business entities; and
                    (B) evidencing their true identity and claim of 
                identity theft to consumer credit reporting agencies 
                and business entities;
            (7) one of the greatest law enforcement challenges posed by 
        identity theft is that stolen identities are often used to 
        perpetrate crimes in many different localities in different 
        States, and although identity theft is a Federal crime, most 
        often, State and local law enforcement agencies are responsible 
        for investigating and prosecuting the crimes; and
            (8) the Federal Government should assist State and local 
        law enforcement agencies to effectively combat identity theft 
        and the associated fraud.

SEC. 3. DEFINITIONS.

    In this Act, the following definitions shall apply:
            (1) Business entity.--The term ``business entity'' means--
                    (A) a creditor, as that term is defined in section 
                103 of the Truth in Lending Act (15 U.S.C. 1602);
                    (B) any financial information repository;
                    (C) any financial service provider; and
                    (D) any corporation, trust, partnership, sole 
                proprietorship, or unincorporated association 
                (including telecommunications, utilities, and other 
                service providers).
            (2) Consumer.--The term ``consumer'' means an individual.
            (3) Financial information.--The term ``financial 
        information'' means information identifiable as relating to an 
        individual consumer that concerns the amount and conditions of 
        the assets, liabilities, or credit of the consumer, including--
                    (A) account numbers and balances;
                    (B) nonpublic personal information, as that term is 
                defined in section 509 of the Gramm-Leach-Bliley Act 
                (15 U.S.C. 6809); and
                    (C) codes, passwords, social security numbers, tax 
                identification numbers, State identifier numbers issued 
                by a State department of licensing, and other 
                information used for the purpose of account access or 
                transaction initiation.
            (4) Financial information repository.--The term ``financial 
        information repository'' means a person engaged in the business 
        of providing services to consumers who have a credit, deposit, 
        trust, stock, or other financial services account or 
        relationship with that person.
            (5) Identity theft.--The term ``identity theft'' means an 
        actual or potential violation of section 1028 of title 18, 
        United States Code, or any other similar provision of Federal 
        or State law.
            (6) Means of identification.--The term ``means of 
        identification'' has the meanings given the terms 
        ``identification document'' and ``means of identification'' in 
        section 1028 of title 18, United States Code.
            (7) Victim.--The term ``victim'' means a consumer whose 
        means of identification or financial information has been used 
        or transferred (or has been alleged to have been used or 
        transferred) without the authority of that consumer with the 
        intent to commit, or to aid or abet, identity theft or any 
        other violation of law.

SEC. 4. TREATMENT OF IDENTITY THEFT MITIGATION.

    Section 1028 of title 18, United States Code, is amended by adding 
at the end the following:
    ``(i) Treatment of Identity Theft Mitigation.--
            ``(1) Information available to victims.--
                    ``(A) In general.--A business entity that possesses 
                information relating to an alleged identity theft, or 
                that has entered into a transaction, provided credit, 
                products, goods, or services, accepted payment, or 
                otherwise done business with a person that has made 
                unauthorized use of the means of identification of the 
                victim, shall, not later than 20 days after the receipt 
                of a written request by the victim under paragraph (2), 
                provide, without charge, a copy of all application and 
                transaction information related to the transaction 
                being alleged as a potential or actual identity theft 
                to--
                            ``(i) the victim;
                            ``(ii) any Federal, State, or local 
                        governing law enforcement agency or officer 
                        specified by the victim; or
                            ``(iii) any law enforcement agency 
                        investigating the identity theft and authorized 
                        by the victim to take receipt of records 
                        provided under this subsection.
                    ``(B) Rule of construction.--
                            ``(i) In general.--No provision of Federal 
                        or State law prohibiting the disclosure of 
                        financial information to third parties shall be 
                        used to deny disclosure of information to the 
                        victim under this subsection.
                            ``(ii) Limitation.--Except as provided in 
                        clause (i), nothing in this subsection requires 
                        a business entity to disclose information that 
                        the business entity is otherwise prohibited 
                        from disclosing under any other provision of 
                        Federal or State law.
            ``(2) Verification of identity and claim.--Unless a 
        business entity, at its discretion, is otherwise able to verify 
        the identity of a victim making a request under subsection 
        (a)(1), the victim shall provide to the business entity--
                    ``(A) as proof of positive identification--
                            ``(i) the presentation of a government-
                        issued identification card;
                            ``(ii) if providing proof by mail, a copy 
                        of a government-issued identification card; or
                            ``(iii) upon the request of the person 
                        seeking business records, the business entity 
                        may inform the requesting person of the 
                        categories of identifying information that the 
                        unauthorized person provided the business 
                        entity as personally identifying information, 
                        and may require the requesting person to 
                        provide identifying information in those 
                        categories; and
                    ``(B) as proof of a claim of identity theft, at the 
                election of the business entity--
                            ``(i) a copy of a police report evidencing 
                        the claim of the victim of identity theft;
                            ``(ii) a copy of a standardized affidavit 
                        of identity theft developed and made available 
                        by the Federal Trade Commission; or
                            ``(iii) any affidavit of fact that is 
                        acceptable to the business entity for that 
                        purpose.
            ``(3) Limitation on liability.--No business entity may be 
        held liable for a disclosure, made in good faith and reasonable 
        judgment, to provide information under this section with 
        respect to an individual in connection with an identity theft 
        to other financial information repositories, financial service 
        providers, merchants, law enforcement authorities, victims, or 
        any person alleging to be a victim, if--
                    ``(A) the business entity complies with paragraph 
                (2); and
                    ``(B) such disclosure was made--
                            ``(i) for the purpose of detection, 
                        investigation, or prosecution of identity 
                        theft; or
                            ``(ii) to assist a victim in recovery of 
                        fines, restitution, rehabilitation of the 
                        credit of the victim, or such other relief as 
                        may be appropriate.
            ``(4) Authority to decline to provide information.--A 
        business entity may decline to provide information pursuant to 
        paragraph (1) if, in the exercise of good faith and reasonable 
        judgment, the business entity believes that--
                    ``(A) this subsection does not require disclosure 
                of the information; or
                    ``(B) the request for the information is based on a 
                misrepresentation of fact by the victim relevant to the 
                request for information.
            ``(5) No new recordkeeping obligation.--Nothing in this 
        subsection creates an obligation on the part of a business 
        entity to obtain, retain, or maintain information or records 
        that are not otherwise required to be retained or maintained in 
        the ordinary course of its business or under other applicable 
        law.
            ``(6) Notification system.--
                    ``(A) In general.--A business entity may establish 
                and maintain a notification system for the business 
                entity to comply with this subsection, including a 
                toll-free telephone number and a mailing address.
                    ``(B) Requirements.--A notification system under 
                subparagraph (A) shall permit any person to make a 
                request to, or to correspond with, the business entity 
                under this subsection, provided that--
                            ``(i) the business entity informs the 
                        person--
                                    ``(I) that any person may request 
                                information under this subsection; and
                                    ``(II) of the address and toll-free 
                                telephone number established and 
                                maintained for this purpose; and
                            ``(ii) a person representing the business 
                        entity--
                                    ``(I) responds to an information 
                                request through the toll-free 
number within 3 business days of receiving the request; and
                                    ``(II) facilitates the provision of 
                                such information to the person who 
                                initiated the request.''.

SEC. 5. AMENDMENTS TO THE FAIR CREDIT REPORTING ACT.

    (a) Consumer Reporting Agency Blocking of Information Resulting 
From Identity Theft.--Section 611 of the Fair Credit Reporting Act (15 
U.S.C. 1681i) is amended by adding at the end the following:
    ``(e) Block of Information Resulting From Identity Theft.--
            ``(1) Block.--Except as provided in paragraph (3) and not 
        later than 30 days after the date of receipt of proof of the 
        identity of a consumer and an official copy of a police report 
        evidencing the claim of the consumer of identity theft, a 
        consumer reporting agency shall permanently block the reporting 
        of any information identified by the consumer in the file of 
        the consumer resulting from the identity theft, so that the 
        information cannot be reported, except as provided in paragraph 
        (3).
            ``(2) Notification.--A consumer reporting agency shall 
        promptly notify the furnisher of information identified by the 
        consumer under paragraph (1)--
                    ``(A) that the information may be a result of 
                identity theft;
                    ``(B) that a police report has been filed;
                    ``(C) that a block has been requested under this 
                subsection; and
                    ``(D) of the effective date of the block.
            ``(3) Authority to decline or rescind.--
                    ``(A) In general.--A consumer reporting agency may 
                decline to block, or may rescind any block, of consumer 
                information under this subsection if--
                            ``(i) in the exercise of good faith and 
                        reasonable judgment, the consumer reporting 
                        agency believes that--
                                    ``(I) the information was blocked 
                                due to a misrepresentation of fact by 
                                the consumer relevant to the request to 
                                block; or
                                    ``(II) the consumer knowingly 
                                obtained possession of goods, services, 
                                or moneys as a result of the blocked 
                                transaction or transactions, or the 
                                consumer should have known that the 
                                consumer obtained possession of goods, 
                                services, or moneys as a result of the 
                                blocked transaction or transactions; or
                            ``(ii) the consumer agrees that the blocked 
                        information or portions of the blocked 
                        information were blocked in error.
                    ``(B) Notification to consumer.--If the block of 
                information is declined or rescinded under this 
                paragraph, the affected consumer shall be notified 
                promptly, in the same manner as consumers are notified 
                of the reinsertion of information under subsection 
                (a)(5)(B).
                    ``(C) Significance of block.--For purposes of this 
                paragraph, the prior presence of blocked information in 
                the file of a consumer is not evidence of whether the 
                consumer knew or should have known that the consumer 
                obtained possession of any goods, services, or monies 
                as a result of the block.
            ``(4) Exception.--A consumer reporting agency shall not be 
        required to comply with this subsection when the agency is 
        issuing information for authorizations, for the purpose of 
        approving or processing negotiable instruments, electronic 
        funds transfers, or similar methods of payment, based solely on 
        negative information, including--
                    ``(A) dishonored checks;
                    ``(B) accounts closed for cause;
                    ``(C) substantial overdrafts;
                    ``(D) abuse of automated teller machines; or
                    ``(E) other information which indicates a risk of 
                fraud occurring.''.
    (b) False Claims.--Section 1028 of title 18, United States Code, is 
amended by adding at the end the following:
    ``(j) Whoever knowingly falsely claims to be a victim of identity 
theft for the purpose of obtaining the blocking of information by a 
consumer reporting agency under section 611(e)(1) of the Fair Credit 
Reporting Act (15 U.S.C. 1681i(e)(1)) shall be fined under this title, 
imprisoned not more than 3 years, or both.''.
    (c) Statute of Limitations.--Section 618 of the Fair Credit 
Reporting Act (15 U.S.C. 1681p) is amended to read as follows:

``SEC. 618. JURISDICTION OF COURTS; LIMITATION ON ACTIONS.

    ``(a) In General.--Except as provided in subsections (b) and (c), 
an action to enforce any liability created under this title may be 
brought in any appropriate United States district court without regard 
to the amount in controversy, or in any other court of competent 
jurisdiction, not later than 2 years from the date of the defendant's 
violation of any requirement under this title.
    ``(b) Willful Misrepresentation.--In any case in which the 
defendant has materially and willfully misrepresented any information 
required to be disclosed to an individual under this title, and the 
information misrepresented is material to the establishment of the 
liability of the defendant to that individual under this title, an 
action to enforce a liability created under this title may be brought 
at any time within 2 years after the date of discovery by the 
individual of the misrepresentation.
    ``(c) Identity Theft.--An action to enforce a liability created 
under this title may be brought not later than 5 years from the date of 
the defendant's violation if--
            ``(1) the plaintiff is the victim of an identity theft; or
            ``(2) the plaintiff--
                    ``(A) has reasonable grounds to believe that the 
                plaintiff is the victim of an identity theft; and
                    ``(B) has not materially and willfully 
                misrepresented such a claim.''.

SEC. 6. COMMISSION STUDY OF COORDINATION BETWEEN FEDERAL, STATE, AND 
              LOCAL AUTHORITIES IN ENFORCING IDENTITY THEFT LAWS.

    (a) Membership; Term.--Section 2 of the Internet False 
Identification Prevention Act of 2000 (18 U.S.C. 1028 note) is 
amended--
            (1) in subsection (b), by striking ``and the Commissioner 
        of Immigration and Naturalization'' and inserting ``the 
        Commissioner of Immigration and Naturalization, the Chairman of 
        the Federal Trade Commission, the Postmaster General, and the 
        Commissioner of the United States Customs Service,''; and
            (2) in subsection (c), by striking ``2 years'' and 
        inserting ``6 years''.
    (b) Consultation.--Section 2 of the Internet False Identification 
Prevention Act of 2000 (18 U.S.C. 1028 note) is amended--
            (1) by redesignating subsection (d) as subsection (e); and
            (2) by inserting after subsection (c) the following:
    ``(d) Consultation.--The coordinating committee shall consult with 
interested parties, including State and local law enforcement agencies, 
State attorneys general, representatives of business entities (as that 
term is defined in section 4 of the Identity Theft Victims Assistance 
Act of 2002), including telecommunications and utility companies, and 
organizations representing consumers.''.
    (c) Report Contents.--Section 2(e) of the Internet False 
Identification Prevention Act of 2000 (18 U.S.C. 1028 note) (as 
redesignated by this section) is amended--
            (1) in subparagraph (E), by striking ``and'' at the end; 
        and
            (2) by striking subparagraph (F) and inserting the 
        following:
                    ``(F) a comprehensive description of Federal 
                assistance provided to State and local law enforcement 
                agencies to address identity theft;
                    ``(G) a comprehensive description of coordination 
                activities between Federal, State, and local law 
                enforcement agencies that address identity theft;
                    ``(H) a comprehensive description of how the 
                Federal Government can best provide State and local law 
                enforcement agencies with timely and current 
                information regarding terrorists or terrorist activity 
                where such information specifically relates to identity 
                theft; and
                    ``(I) recommendations in the discretion of the 
                President, if any, for legislative or administrative 
                changes that would--
                            ``(i) facilitate more effective 
                        investigation and prosecution of--
                                    ``(I) cases involving identity 
                                theft; and
                                    ``(II) the creation and 
                                distribution of false identification 
                                documents;
                            ``(ii) improve the effectiveness of Federal 
                        assistance to State and local law enforcement 
                        agencies and coordination between Federal, 
                        State, and local law enforcement agencies;
                            ``(iii) simplify efforts by a person 
                        necessary to rectify the harm that results from 
                        the theft of the identity of such person; and
                            ``(iv) if deemed appropriate, provide for 
                        the establishment of a Federal identity theft 
                        and false identification office or agency.''.

SEC. 7. ENFORCEMENT.

    (a) In General.--
            (1) Civil actions.--In any case in which the attorney 
        general of a State has reason to believe that an interest of 
        the residents of that State has been, or is threatened to be, 
        adversely affected by a violation of section 4 of this Act by 
        any business entity, the State, as parens patriae, may bring a 
        civil action on behalf of the residents of the State in a 
        district court of the United States of appropriate jurisdiction 
        to--
                    (A) enjoin that practice;
                    (B) enforce compliance with this Act or the 
                amendments made by this Act;
                    (C) obtain damages--
                            (i) in the sum of actual damages, 
                        restitution, and other compensation on behalf 
                        of the residents of the State; and
                            (ii) punitive damages, if the violation is 
                        willful or intentional; and
                    (D) obtain such other equitable relief as the court 
                may consider to be appropriate.
            (2) Notice.--Before filing an action under paragraph (1), 
        the attorney general of the State involved shall provide to the 
        Attorney General of the United States--
                    (A) written notice of the action; and
                    (B) a copy of the complaint for the action.
    (b) Intervention.--
            (1) In general.--On receiving notice of an action under 
        subsection (a)(2), the Attorney General of the United States 
        shall have the right to intervene in that action.
            (2) Effect of intervention.--If the Attorney General of the 
        United States intervenes in an action under subsection (a), the 
        Attorney General shall have the right to be heard with respect 
        to any matter that arises in that action.
            (3) Service of process.--Upon request of the Attorney 
        General of the United States, the attorney general of a State 
        that has filed an action under subsection (a) shall, pursuant 
        to Rule 4(d)(4) of the Federal Rules of Civil Procedure, serve 
        the Government with--
                    (A) a copy of the complaint; and
                    (B) written disclosure of substantially all 
                material evidence and information in the possession of 
                the attorney general of the state.
    (c) Construction.--For purposes of bringing any civil action under 
subsection (a), nothing in this Act or the amendments made by this Act 
shall be construed to prevent an attorney general of a State from 
exercising the powers conferred on such attorney general by the laws of 
that State--
            (1) to conduct investigations;
            (2) to administer oaths or affirmations; or
            (3) to compel the attendance of witnesses or the production 
        of documentary and other evidence.
    (d) Actions by the Attorney General of the United States.--In any 
case in which an action is instituted by or on behalf of the Attorney 
General of the United States for a violation of section 4, no State 
may, during the pendency of that action, institute an action under 
subsection (a) against any defendant named in the complaint in that 
action for violation of that practice.
    (e) Venue; Service of Process.--
            (1) Venue.--Any action brought under subsection (a) may be 
        brought in the district court of the United States--
                    (A) where the defendant resides;
                    (B) where the defendant is doing business; or
                    (C) that meets applicable requirements relating to 
                venue under section 1391 of title 28, United States 
                Code.
            (2) Service of process.--In an action brought under 
        subsection (a), process may be served in any district in which 
        the defendant--
                    (A) resides;
                    (B) is doing business; or
                    (B) may be found.




                                                       Calendar No. 382

107th CONGRESS

  2d Session

                                S. 1742

_______________________________________________________________________

                                 A BILL

     To prevent the crime of identity theft, mitigate the harm to 
   individuals victimized by identity theft, and for other purposes.

_______________________________________________________________________

                              May 21, 2002

                       Reported with an amendment