1.Short title; table of
contents
(a)This Act may be cited as the Privacy Act of 2005
.
(b)The table of contents of this Act is as follows:
Sec. 1. Short title; table of
contents
Title I—Commercial sale and marketing of
personally identifiable information
Sec. 101. Collection and distribution of
personally identifiable information
Sec. 102. Enforcement
Sec. 103. Safe harbor
Sec. 104. Definitions
Sec. 105. Preemption
Sec. 106. Effective Date
Title II—Social security number misuse
prevention
Sec. 201. Findings
Sec. 202. Prohibition of the display,
sale, or purchase of social security numbers
Sec. 203. Application of prohibition of
the display, sale, or purchase of social security numbers to public
records
Sec. 204. Rulemaking authority of the
Attorney General
Sec. 205. Treatment of social security
numbers on government documents
Sec. 206. Limits on personal disclosure of
a social security number for consumer transactions
Sec. 207. Extension of civil monetary
penalties for misuse of a social security number
Sec. 208. Criminal penalties for the
misuse of a social security number
Sec. 209. Civil actions and civil
penalties
Sec. 210. Federal injunctive
authority
Title III—Limitations on sale and sharing of
nonpublic personal financial information
Sec. 301. Definition of sale
Sec. 302. Rules applicable to sale of
nonpublic personal information
Sec. 303. Exceptions to disclosure
prohibition
Sec. 304. Conforming
amendments
Sec. 305. Regulatory authority
Sec. 306. Effective date
Title IV—Limitations on the provision of
protected health information
Sec. 401. Definitions
Sec. 402. Prohibition against selling
protected health information
Sec. 403. Authorization for sale or
marketing of protected health information by noncovered entities
Sec. 404. Prohibition against
retaliation
Sec. 405. Rule of construction
Sec. 406. Regulations
Sec. 407. Enforcement
Title V—Driver’s license privacy
Sec. 501. Driver’s license
privacy
Title VI—Miscellaneous
Sec. 601. Enforcement by State Attorneys
General
Sec. 602. Federal injunctive
authority
<enum>I</enum><header>Commercial sale
and marketing of personally identifiable information</header>
<section id="ID507B511D10BC4BF38130AFC2C659F880"><enum>101.</enum><header>Collection and
distribution of personally identifiable information</header>
<subsection id="ID39086896A0C2417200BA2C9261A7862C"><enum>(a)</enum><header>Prohibition</header>
<paragraph id="IDA27B80B370ED4C7C9F07824C1100C764"><enum>(1)</enum><header>In
general</header><text>It is unlawful for a commercial entity to collect
personally identifiable information and disclose such information to any
nonaffiliated third party for marketing purposes or sell such information to
any nonaffiliated third party, unless the commercial entity provides—</text>
<subparagraph id="ID12202C85C3CF455495D6C3006CD7A21C"><enum>(A)</enum><text>notice to the
individual to whom the information relates in accordance with the requirements
of subsection (b); and</text>
</subparagraph><subparagraph id="IDEB1FBF44FD0D46E89914F553BDD99492"><enum>(B)</enum><text>an opportunity
for such individual to restrict the disclosure or sale of such
information.</text>
</subparagraph></paragraph><paragraph id="ID8D9ED6930D064C43B734EB50C870D640"><enum>(2)</enum><header>Exception</header><text>A
commercial entity may collect personally identifiable information and use such
information to market to potential customers such entity’s product.</text>
</paragraph></subsection><subsection id="IDA5269540F6FE4A7ABFCC928F1BFBBBE8"><enum>(b)</enum><header>Notice</header>
<paragraph id="IDCDE1FD34B909405E8C42FB12E3DA97AE"><enum>(1)</enum><header>In
general</header><text>A notice under subsection (a) shall contain statements
describing the following:</text>
<subparagraph id="ID8DA57CC410B04F6497F711C7495B1073"><enum>(A)</enum><text>The identity of
the commercial entity collecting the personally identifiable
information.</text>
</subparagraph><subparagraph id="ID0F46D5667F1540B2997BC377623F9BD2"><enum>(B)</enum><text>The types of
personally identifiable information that are being collected on the
individual.</text>
</subparagraph><subparagraph id="ID9EE33267B8784515A52C132EF5147243"><enum>(C)</enum><text>How the
commercial entity may use such information.</text>
</subparagraph><subparagraph id="ID73064FE64A1F417BBA28D241DDA7EE49"><enum>(D)</enum><text>A description of
the categories of potential recipients of such personally identifiable
information.</text>
</subparagraph><subparagraph id="ID4AACE61CC3904A32B83B4EC53DB7DF67"><enum>(E)</enum><text>Whether the
individual is required to provide personally identifiable information in order
to do business with the commercial entity.</text>
</subparagraph><subparagraph id="ID436736B37AC840DBAD5570FF5DA4A2EE"><enum>(F)</enum><text>How an individual
may decline to have such personally identifiable information used or sold as
described in subsection (a).</text>
</subparagraph></paragraph><paragraph id="ID59EB848DA50A4837B845B771001E887B"><enum>(2)</enum><header>Time of
notice</header><text>Notice shall be conveyed prior to the sale or use of the
personally identifiable information as described in subsection (a) in such a
manner as to allow the individual a reasonable period of time to consider the
notice and limit such sale or use.</text>
</paragraph><paragraph id="IDC8226DAD30EE451E9EF5ADFB39B100F2"><enum>(3)</enum><header>Medium of
notice</header><text>The medium for providing notice must be—</text>
<subparagraph id="IDE4C310B386634D01984699A423434F6B"><enum>(A)</enum><text>the same medium
in which the personally identifiable information is or will be collected, or a
medium approved by the individual; or</text>
</subparagraph><subparagraph id="ID9EEC6F9A449F424E9EDA3FA20592F403"><enum>(B)</enum><text>in the case of
oral communication, notice may be conveyed orally or in writing.</text>
</subparagraph></paragraph><paragraph id="ID2371A366F45A4F15890014497B96C57F"><enum>(4)</enum><header>Form of
notice</header><text>The notice shall be clear and conspicuous.</text>
</paragraph></subsection><subsection id="ID4D59B0A8BD764DB4A2901071F896B143"><enum>(c)</enum><header>Opt-Out</header>
<paragraph id="ID199C1CA131D04CA3A110FCE31C09E33C"><enum>(1)</enum><header>Opportunity to
opt-out of sale or marketing</header><text>The opportunity provided to limit
the sale of personally identifiable information to nonaffiliated third parties
or the disclosure of such information for marketing purposes, shall be easy to
use, accessible and available in the medium the information is collected, or in
a medium approved by the individual.</text>
</paragraph><paragraph id="ID13560754E8EE42BCA6354EF665B8F600"><enum>(2)</enum><header>Duration of
limitation</header><text>An individual’s limitation on the sale or marketing of
personally identifiable information shall be considered permanent, unless
otherwise specified by the individual.</text>
</paragraph><paragraph id="IDA2061B70FA6043FD9ED6601C84713C01"><enum>(3)</enum><header>Revocation of
consent</header><text>After an individual grants consent to the use of that
individual’s personally identifiable information, the individual may revoke the
consent at any time, except to the extent that the commercial entity has taken
action in reliance thereon. The commercial entity shall provide the individual
an opportunity to revoke consent that is easy to use, accessible, and available
in the medium the information was or is collected.</text>
</paragraph><paragraph id="IDBEA1D3DD4FD84DC4B93DC98B6412CA92"><enum>(4)</enum><header>Not
applicable</header><text>This section shall not apply to disclosure of
personally identifiable information—</text>
<subparagraph id="ID19ADA58EF7BB4EC89B80E542D680C245"><enum>(A)</enum><text>that is necessary
to facilitate a transaction specifically requested by the consumer;</text>
</subparagraph><subparagraph id="IDCCCC61FA3CAF4D5092826FFDB5D00090"><enum>(B)</enum><text>is used for the
sole purpose of facilitating this transaction; and</text>
</subparagraph><subparagraph id="IDBD57865E46F34C688F1700FCE1C29DA3"><enum>(C)</enum><text>in which the
entity receiving or obtaining such information is limited, by contract, to use
such formation for the purpose of completing the transaction.</text>
</subparagraph></paragraph></subsection></section><section id="ID0A5CB89D828346AD93D71D87DAAA97D9"><enum>102.</enum><header>Enforcement</header>
<subsection id="ID44996BA29C35416C9EB883515CEB6F4E"><enum>(a)</enum><header>In
general</header><text>In accordance with the provisions of this section, the
Federal Trade Commission shall have the authority to enforce any violation of
section 101 of this Act.</text>
</subsection><subsection id="ID9AE8C88268F7466980B1A831937B933E"><enum>(b)</enum><header>Violations</header><text>The
Federal Trade Commission shall treat a violation of section 101 as a violation
of a rule under
<external-xref legal-doc="act" parsable-cite="FTCA/18a(a)(1)(B)">section
18a(a)(1)(B)</external-xref> of the <act-name parsable-cite="FTCA">Federal
Trade Commission Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/15/57a(a)(1)(B)">15 U.S.C.
57a(a)(1)(B)</external-xref>).</text>
</subsection><subsection id="ID685702A2F7FE4D97847687CD00FCF3A2"><enum>(c)</enum><header>Transfer of
enforcement authority</header><text>The Federal Trade Commission shall
promulgate rules in accordance with section 553 of title 5, United States Code,
allowing for the transfer of enforcement authority from the Federal Trade
Commission to a Federal agency regarding section 101 of this Act. The Federal
Trade Commission may permit a Federal agency to enforce any violation of
section 101 if such agency submits a written request to the Commission to
enforce such violations and includes in such request—</text>
<paragraph id="IDF9135BACC5CB40AA81C5A39EF4821414"><enum>(1)</enum><text>a description of
the entities regulated by such agency that will be subject to the provisions of
section 101;</text>
</paragraph><paragraph id="IDE7F774D7C5984104A78D320626FF82D5"><enum>(2)</enum><text>an assurance that
such agency has sufficient authority over the entities to enforce violations of
section 101; and</text>
</paragraph><paragraph id="IDD036D642B95143C38CEC1BDE9DED44FB"><enum>(3)</enum><text>a list of
proposed rules that such agency shall use in regulating such entities and
enforcing section 101.</text>
</paragraph></subsection><subsection id="IDB4331C5FD1A645F98954D8ED3C48A898"><enum>(d)</enum><header>Actions by the
Commission</header><text>Absent transfer of enforcement authority to a Federal
agency under subsection (c), the Federal Trade Commission shall prevent any
person from violating section 101 in the same manner, by the same means, and
with the same jurisdiction, powers, and duties as provided to such Commission
under the <act-name parsable-cite="FTCA">Federal Trade Commission
Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/15/41">15
U.S.C. 41</external-xref> et seq.). Any entity that violates section 101 is
subject to the penalties and entitled to the privileges and immunities provided
in such Act in the same manner, by the same means, and with the same
jurisdiction, power, and duties under such Act.</text>
</subsection><subsection id="ID80798C471562444E84687086ACA532C6"><enum>(e)</enum><header>Relationship to
other laws</header>
<paragraph id="IDD3955918E8084A939F00814564A8FDFE"><enum>(1)</enum><header>Commission
authority</header><text>Nothing contained in this title shall be construed to
limit authority provided to the Commission under any other law.</text>
</paragraph><paragraph id="IDAD669BD3E8B54D8C92B97D6C9D193DDC"><enum>(2)</enum><header>Communications
Act</header><text>Nothing in section 101 requires an operator of a website to
take any action that is inconsistent with the requirements of
<external-xref legal-doc="act" parsable-cite="CA34/631">section 222 or
631</external-xref> of the <act-name parsable-cite="CA34">Communications Act of
1934</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/47/222">47
U.S.C. 222</external-xref> and 5551).</text>
</paragraph><paragraph id="IDAADE3212804D4A32947F2C6CD4002892"><enum>(3)</enum><header>Other
Acts</header><text>Nothing in this title is intended to affect the
applicability or the enforceability of any provision of, or any amendment made
by—</text>
<subparagraph id="ID0B2E4BD98D69412B803E8D2340ACF4B7"><enum>(A)</enum><text>the Children’s
Online Privacy Protection Act of 1998 (<external-xref legal-doc="usc" parsable-cite="usc/15/6501">15 U.S.C. 6501</external-xref> et seq.);</text>
</subparagraph><subparagraph id="ID83558F900BB44AB4BB455FDB26198028"><enum>(B)</enum><text>title V of the
Gramm-Leach-Bliley Act;</text>
</subparagraph><subparagraph id="ID1BC08BEC003B43368293D1367C65EBAF"><enum>(C)</enum><text>the
<act-name parsable-cite="HIPAA">Health Insurance Portability and Accountability
Act of 1996</act-name>; or</text>
</subparagraph><subparagraph id="ID2DD70F56D5DE4BA9BEE2BDF772EE4B00"><enum>(D)</enum><text>the
<act-name parsable-cite="FCRA">Fair Credit Reporting Act</act-name>.</text>
</subparagraph></paragraph></subsection><subsection id="ID6B7FDE5F777A4F69833083B29537BB4B"><enum>(f)</enum><header>Public
records</header><text>Nothing in this title shall be construed to restrict
commercial entities from obtaining or disclosing personally identifying
information from public records.</text>
</subsection><subsection id="IDFC68584523CD47E6A8A920B17CF1BC7F"><enum>(g)</enum><header>Civil
penalties</header><text>In addition to any other penalty applicable to a
violation of section 101(a), a penalty of up to $25,000 may be issued for each
violation.</text>
</subsection><subsection id="IDCE6F93E242DB4879AA87A733E227BCD3"><enum>(h)</enum><header>Enforcement
regarding programs</header>
<paragraph id="ID4860BA611A65400096D2E6EF71170000"><enum>(1)</enum><header>In
general</header><text>A Federal agency or department providing financial
assistance to any entity required to comply with section 101 of this Act shall
issue regulations requiring that such entity comply with such section or
forfeit some or all of such assistance. Such regulations shall prescribe
sanctions for noncompliance, require that such department or agency provide
notice of failure to comply with such section prior to any action being taken
against such recipient, and require that a determination be made prior to any
action being taken against such recipient that compliance cannot be secured by
voluntary means.</text>
</paragraph><paragraph id="ID7FD7B649E1C6435BB4625DAFC208DD74"><enum>(2)</enum><header>Federal
financial assistance</header><text>The term <term>Federal financial
assistance</term> means assistance through a grant, cooperative agreement,
loan, or contract other than a contract of insurance or guaranty.</text>
</paragraph></subsection></section><section id="ID05A961A6AD4042DBBDC86977EFFD7DA3"><enum>103.</enum><header>Safe
harbor</header><text display-inline="no-display-inline">A commercial entity may
not be held to have violated any provision of this title if such entity
complies with self-regulatory guidelines that—</text>
<paragraph id="ID9A836DB4C0E541F6B08C378E1029894C"><enum>(1)</enum><text>are issued by
seal programs or representatives of the marketing or online industries or by
any other person; and</text>
</paragraph><paragraph id="ID7F597F6D7D0D48F78900C5BC9532C66D"><enum>(2)</enum><text>are approved by
the Federal Trade Commission, after public comment has been received on such
guidelines by the Commission, as meeting the requirements of this title.</text>
</paragraph></section><section id="IDC9A8C74F36B14F81A42C9DBCD7FEC96F"><enum>104.</enum><header>Definitions</header><text display-inline="no-display-inline">In this title:</text>
<paragraph id="ID53EF5BA6CD9F4DBA8FD8671F7E9CF505"><enum>(1)</enum><header>Commercial
entity</header><text>The term <term>commercial entity</term>—</text>
<subparagraph id="IDFED92DE4CF9D4B1CB999FBD101A68DC9"><enum>(A)</enum><text>means any person
offering products or services involving commerce—</text>
<clause id="IDB444B72869114BD100E4E7283382DA7C"><enum>(i)</enum><text>among the several
States or with 1 or more foreign nations;</text>
</clause><clause id="IDDCAE6313CF2A427D9324E5E9FF6F5790"><enum>(ii)</enum><text>in
any territory of the United States or in the District of Columbia, or between
any such territory and—</text>
<subclause id="ID246ECFD48ACF4D73A344098027BE17D1"><enum>(I)</enum><text>another such
territory; or</text>
</subclause><subclause id="ID300B3375C9394ECC0054835FB0E9A65F"><enum>(II)</enum><text>any State or
foreign nation; or</text>
</subclause></clause><clause id="ID43648541028544ABA02E292F51710298"><enum>(iii)</enum><text>between the
District of Columbia and any State, territory, or foreign nation; and</text>
</clause></subparagraph><subparagraph id="ID773A573B6B8547BCA5FB99CEEEACE7CD"><enum>(B)</enum><text>does not
include—</text>
<clause id="ID17DEFA11F9014C8A96533EC1A74CD1FA"><enum>(i)</enum><text>any
nonprofit entity that would otherwise be exempt from coverage under
<external-xref legal-doc="act" parsable-cite="FTCA/5">section 5</external-xref>
of the <act-name parsable-cite="FTCA">Federal Trade Commission Act</act-name>
(<external-xref legal-doc="usc" parsable-cite="usc/15/45">15 U.S.C.
45</external-xref>);</text>
</clause><clause id="ID6207BE022E4348B69574B7D6CD2200FA"><enum>(ii)</enum><text>any financial
institution that is subject to title V of the Gramm-Leach-Bliley Act
(<external-xref legal-doc="usc" parsable-cite="usc/15/6801">15 U.S.C.
6801</external-xref> et seq.); or</text>
</clause><clause id="ID14CC3471798944D88595DB2ED203202D"><enum>(iii)</enum><text>any group
health plan, health insurance issuer, or other entity that is subject to the
<act-name parsable-cite="HIPAA">Health Insurance Portability and Accountability
Act of 1996</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/201 note">42 U.S.C. 201 note</external-xref>).</text>
</clause></subparagraph></paragraph><paragraph id="ID929BC52D7A364C13A3EF00EC67B3F773"><enum>(2)</enum><header>Commission</header><text>The
term <term>Commission</term> means the Federal Trade Commission.</text>
</paragraph><paragraph id="IDE542EB5CDC9E4115B19BFB1DA3F0B049"><enum>(3)</enum><header>Individual</header><text>The
term <term>individual</term> means a person whose personally identifying
information has been, is, or will be collected by a commercial entity.</text>
</paragraph><paragraph id="ID8AAE8CC4C7834869804F3D00289E47B2"><enum>(4)</enum><header>Marketing</header><text>The
term <term>marketing</term> means to make a communication about a product or
service a purpose of which is to encourage recipients of the communication to
purchase or use the product or service.</text>
</paragraph><paragraph id="ID6F07B6943DFC4EE9A3BF04EBD529BE53"><enum>(5)</enum><header>Medium</header><text>The
term <term>medium</term> means any channel or system of communication including
oral, written, and online communication.</text>
</paragraph><paragraph id="ID2D7625A283874A21ADB4A986ECC5A633"><enum>(6)</enum><header>Nonaffiliated
third party</header><text>The term <term>nonaffiliated third party</term> means
any entity that is not related by common ownership or affiliated by corporate
control with, the commercial entity, but does not include a joint employee of
such institution.</text>
</paragraph><paragraph id="ID6594225A518647E2A1A62DDA79F22CD5"><enum>(7)</enum><header>Personally
identifiable information</header><text>The term <term>personally identifiable
information</term> means individually identifiable information about the
individual that is collected including—</text>
<subparagraph id="ID56EF369CCFE145B1AA3835735B74BE6F"><enum>(A)</enum><text>a first, middle,
or last name, whether given at birth or adoption, assumed, or legally
changed;</text>
</subparagraph><subparagraph id="IDF146F758EA0F43B5903414EF146FFF7C"><enum>(B)</enum><text>a home or other
physical address, including the street name, zip code, and name of a city or
town;</text>
</subparagraph><subparagraph id="ID50A73976B4744ADE97E4EBE4DCCAEA22"><enum>(C)</enum><text>an e-mail
address;</text>
</subparagraph><subparagraph id="ID581486A335A047EDA2D9EB8E4878AD5F"><enum>(D)</enum><text>a telephone
number;</text>
</subparagraph><subparagraph id="IDC311F14FDA65408DBBB276BCD0FE3010"><enum>(E)</enum><text>a photograph or
other form of visual identification;</text>
</subparagraph><subparagraph id="IDB15BB66CD6314076807BF97FD563A9F1"><enum>(F)</enum><text>a birth date,
birth certificate number, or place of birth for that person; or</text>
</subparagraph><subparagraph id="ID482250CDD31842C0BE007BF58D4EDB6B"><enum>(G)</enum><text>information
concerning the individual that is combined with any other identifier in this
paragraph.</text>
</subparagraph></paragraph><paragraph id="IDF95FF367B0074822ADDA00431DA0D783"><enum>(8)</enum><header>Sale; sell;
sold</header><text>The terms <term>sale</term>, <term>sell</term>, and
<term>sold</term>, with respect to personally identifiable information, mean
the exchanging of such information for any thing of value, directly or
indirectly, including the licensing, bartering, or renting of such
information.</text>
</paragraph><paragraph id="ID552C1B3524B6457EAF440928F65DB300"><enum>(9)</enum><header>Writing</header><text>The
term <term>writing</term> means writing in either a paper-based or
computer-based form, including electronic and digital signatures.</text>
</paragraph></section><section id="ID72BE8F5AC22C4D68ABDC3464B5A4DF8E"><enum>105.</enum><header>Preemption</header><text display-inline="no-display-inline">The provisions of this title shall supersede
any statutory and common law of States and their political subdivisions insofar
as that law may now or hereafter relate to the—</text>
<paragraph id="IDF465A10486BD40BEABC9F8DB71726F3B"><enum>(1)</enum><text>collection and
disclosure of personally identifiable information for marketing purposes;
and</text>
</paragraph><paragraph id="IDD64BD44A333248C3A09F006DC7632B34"><enum>(2)</enum><text>collection and
sale of personally identifiable information.</text>
</paragraph></section><section id="ID71625ACA3DF147C8B57BE125EEDFF8B6"><enum>106.</enum><header>Effective
Date</header><text display-inline="no-display-inline">This title and the
amendments made by this title shall take effect 1 year after the date of
enactment of this Act.</text>
</section><enum>II</enum><header>Social security
number misuse prevention</header>
<section id="ID0238CD8D8B824749BB51D4009FDBD496"><enum>201.</enum><header>Findings</header><text display-inline="no-display-inline">Congress makes the following
findings:</text>
<paragraph id="ID377D08D42F6A40EC993052889173F217"><enum>(1)</enum><text>The inappropriate
display, sale, or purchase of social security numbers has contributed to a
growing range of illegal activities, including fraud, identity theft, and, in
some cases, stalking and other violent crimes.</text>
</paragraph><paragraph id="ID06FA503998CC403886674430B42D009F"><enum>(2)</enum><text>While financial
institutions, health care providers, and other entities have often used social
security numbers to confirm the identity of an individual, the general display
to the public, sale, or purchase of these numbers has been used to commit
crimes, and also can result in serious invasions of individual privacy.</text>
</paragraph><paragraph id="ID85B01CEA85F44FBC9EAAC61CFDEEF6CA"><enum>(3)</enum><text>The Federal
Government requires virtually every individual in the United States to obtain
and maintain a social security number in order to pay taxes, to qualify for
social security benefits, or to seek employment. An unintended consequence of
these requirements is that social security numbers have become one of the tools
that can be used to facilitate crime, fraud, and invasions of the privacy of
the individuals to whom the numbers are assigned. Because the Federal
Government created and maintains this system, and because the Federal
Government does not permit individuals to exempt themselves from those
requirements, it is appropriate for the Federal Government to take steps to
stem the abuse of social security numbers.</text>
</paragraph><paragraph id="ID56190817C5474B5293FAA1B8516B1BB4"><enum>(4)</enum><text>The display,
sale, or purchase of social security numbers in no way facilitates uninhibited,
robust, and wide-open public debate, and restrictions on such display, sale, or
purchase would not affect public debate.</text>
</paragraph><paragraph id="IDC5E2B99AE050474994AEFA65E124D2A5"><enum>(5)</enum><text>No one should
seek to profit from the display, sale, or purchase of social security numbers
in circumstances that create a substantial risk of physical, emotional, or
financial harm to the individuals to whom those numbers are assigned.</text>
</paragraph><paragraph id="ID056AA84DA8AE4626A7CA61BB667D10BB"><enum>(6)</enum><text>Consequently,
this title provides each individual that has been assigned a social security
number some degree of protection from the display, sale, and purchase of that
number in any circumstance that might facilitate unlawful conduct.</text>
</paragraph></section><section id="ID2C3FD95399CC448B82D58873047D8475"><enum>202.</enum><header>Prohibition of
the display, sale, or purchase of social security numbers</header>
<subsection id="ID5F92E0744E0B4EF9B944DC6D7CD7C9A9"><enum>(a)</enum><header>Prohibition</header>
<paragraph id="IDAE522F3F5D084E8B996300E097A5B960"><enum>(1)</enum><header>In
general</header><text>Chapter 47 of title 18, United States Code, is amended by
inserting after section 1028 the following:</text>
<quoted-block id="IDA8C533CC335C4A17B4F0002C4ED3642B" style="USC">
<section id="ID7A26919545CB4C488F6386367827B62C"><enum>1028A.</enum><header>Prohibition
of the display, sale, or purchase of social security numbers</header>
<subsection id="ID067CC295A5E24933945E6F3847CC9CE0"><enum>(a)</enum><header>Definitions</header><text>In
this section:</text>
<paragraph id="ID68F91FE1F3F6470FA6B2FED5F2F6F758"><enum>(1)</enum><header>Display</header><text>The
term <term>display</term> means to intentionally communicate or otherwise make
available (on the Internet or in any other manner) to the general public an
individual’s social security number.</text>
</paragraph><paragraph id="IDB9659AEADF6F4E30A06C7536629224D1"><enum>(2)</enum><header>Person</header><text>The
term <term>person</term> means any individual, partnership, corporation, trust,
estate, cooperative, association, or any other entity.</text>
</paragraph><paragraph id="IDE0817AE6C87F479CAE00B6C0535832BD"><enum>(3)</enum><header>Purchase</header><text>The
term <term>purchase</term> means providing directly or indirectly, anything of
value in exchange for a social security number.</text>
</paragraph><paragraph id="ID10F3F431E698457981FCC835864890AF"><enum>(4)</enum><header>Sale</header><text>The
term <term>sale</term> means obtaining, directly or indirectly, anything of
value in exchange for a social security number.</text>
</paragraph><paragraph id="ID432CEE96CF4642938C00F995C96019CA"><enum>(5)</enum><header>State</header><text>The
term <term>State</term> means any State of the United States, the District of
Columbia, Puerto Rico, the Northern Mariana Islands, the United States Virgin
Islands, Guam, American Samoa, and any territory or possession of the United
States.</text>
</paragraph></subsection><subsection id="IDE336F0CFECD64C278CB7A09834E461BE"><enum>(b)</enum><header>Limitation on
display</header><text>Except as provided in section 1028B, no person may
display any individual’s social security number to the general public without
the affirmatively expressed consent of the individual.</text>
</subsection><subsection id="ID4D812ECCE7F04735BE2033BE5900557E"><enum>(c)</enum><header>Limitation on
sale or purchase</header><text>Except as otherwise provided in this section, no
person may sell or purchase any individual’s social security number without the
affirmatively expressed consent of the individual.</text>
</subsection><subsection id="IDA291977E05D84A81ADCA61212C1B0082"><enum>(d)</enum><header>Prerequisites
for consent</header><text>In order for consent to exist under subsection (b) or
(c), the person displaying or seeking to display, selling or attempting to
sell, or purchasing or attempting to purchase, an individual’s social security
number shall—</text>
<paragraph id="IDAA05DC94691447D8AC7ED37CFBA65BA9"><enum>(1)</enum><text>inform the
individual of the general purpose for which the number will be used, the types
of persons to whom the number may be available, and the scope of transactions
permitted by the consent; and</text>
</paragraph><paragraph id="IDF6430D53CE164CC1BD56AD1519766E69"><enum>(2)</enum><text>obtain the
affirmatively expressed consent (electronically or in writing) of the
individual.</text>
</paragraph></subsection><subsection id="ID3E642E05F0A3425692CCA1509961BB56"><enum>(e)</enum><header>Exceptions</header><text>Nothing
in this section shall be construed to prohibit or limit the display, sale, or
purchase of a social security number—</text>
<paragraph id="IDF4FEDC6C80AB4845AFBCA17841F647EA"><enum>(1)</enum><text>required,
authorized, or excepted under any Federal law;</text>
</paragraph><paragraph id="ID57A4FA32AD62490A8BD5E14C6394F569"><enum>(2)</enum><text>for a public
health purpose, including the protection of the health or safety of an
individual in an emergency situation;</text>
</paragraph><paragraph id="ID09D65909B4FB4ABA81B7DA685C81FD50"><enum>(3)</enum><text>for a national
security purpose;</text>
</paragraph><paragraph id="IDED0176AAB2E14C4E81E03DB1D7003E79"><enum>(4)</enum><text>for a law
enforcement purpose, including the investigation of fraud and the enforcement
of a child support obligation;</text>
</paragraph><paragraph id="ID9A63FAF0CE2C47019C20E9F69E18CE10"><enum>(5)</enum><text>if the display,
sale, or purchase of the number is for a use occurring as a result of an
interaction between businesses, governments, or business and government
(regardless of which entity initiates the interaction), including, but not
limited to—</text>
<subparagraph id="ID0ABC5A3C55384A269C7ED37221F28C8F"><enum>(A)</enum><text>the prevention of
fraud (including fraud in protecting an employee’s right to employment
benefits);</text>
</subparagraph><subparagraph id="ID111070F136AE4975BF38D42B43A16C06"><enum>(B)</enum><text>the facilitation
of credit checks or the facilitation of background checks of employees,
prospective employees, or volunteers;</text>
</subparagraph><subparagraph id="ID71FFC3CEF72349C3AF50C0B491ADEC96"><enum>(C)</enum><text>the retrieval of
other information from other businesses, commercial enterprises, government
entities, or private nonprofit organizations; or</text>
</subparagraph><subparagraph id="ID2BAC318628AF4D7300CC032D5E9B48EC"><enum>(D)</enum><text>when the
transmission of the number is incidental to, and in the course of, the sale,
lease, franchising, or merger of all, or a portion of, a business;</text>
</subparagraph></paragraph><paragraph id="ID467F744A781449BFAF2115D5625EC51D"><enum>(6)</enum><text>if the transfer
of such a number is part of a data matching program involving a Federal, State,
or local agency; or</text>
</paragraph><paragraph id="ID201C3E6604924C268839DFC6B6C5CB72"><enum>(7)</enum><text>if such number is
required to be submitted as part of the process for applying for any type of
Federal, State, or local government benefit or program;</text>
</paragraph><continuation-text continuation-text-level="subsection">except
that, nothing in this subsection shall be construed as permitting a
professional or commercial user to display or sell a social security number to
the general public.</continuation-text></subsection><subsection id="ID73B2F40036EC4ED8B73C92E8260026CB"><enum>(f)</enum><header>Limitation</header><text>Nothing
in this section shall prohibit or limit the display, sale, or purchase of
social security numbers as permitted under title V of the Gramm-Leach-Bliley
Act, or for the purpose of affiliate sharing as permitted under the
<act-name parsable-cite="FCRA">Fair Credit Reporting Act</act-name>, except
that no entity regulated under such Acts may make social security numbers
available to the general public, as may be determined by the appropriate
regulators under such Acts. For purposes of this subsection, the general public
shall not include affiliates or unaffiliated third-party business entities as
may be defined by the appropriate regulators.</text>
</subsection></section><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph><paragraph id="IDFCF1302147054A6B9609643E5D00643B"><enum>(2)</enum><header>Conforming
amendment</header><text>The chapter analysis for chapter 47 of title 18, United
States Code, is amended by inserting after the item relating to section 1028
the following:</text>
<quoted-block id="ID72F2C171FACA4EE1BAA5AD5349A40021" style="USC">
<toc regeneration="no-regeneration">
<toc-entry level="section">1028A. Prohibition of the display, sale,
or purchase of social security
numbers.</toc-entry>
</toc>
<after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></subsection><subsection id="ID7184457E8DDA47368CBBF700AAE49202"><enum>(b)</enum><header>Study;
report</header>
<paragraph id="ID7952B6EBA5934F4181AF6BB6002E2D8B"><enum>(1)</enum><header>In
general</header><text>The Attorney General shall conduct a study and prepare a
report on all of the uses of social security numbers permitted, required,
authorized, or excepted under any Federal law. The report shall include a
detailed description of the uses allowed as of the date of enactment of this
Act and shall evaluate whether such uses should be continued or discontinued by
appropriate legislative action.</text>
</paragraph><paragraph id="ID2E0808A261484C63A9403549A025F891"><enum>(2)</enum><header>Report</header><text>Not
later than 1 year after the date of enactment of this Act, the Attorney General
shall report to Congress findings under this subsection. The report shall
include such recommendations for legislation based on criteria the Attorney
General determines to be appropriate.</text>
</paragraph></subsection><subsection id="ID1ABC1F53C912435E80C03734B100B0A3"><enum>(c)</enum><header>Effective
Date</header><text>The amendments made by this section shall take effect on the
date that is 30 days after the date on which the final regulations promulgated
under section 5 are published in the Federal Register.</text>
</subsection></section><section id="ID8F4FE5A777AD4361A160390891CFD374"><enum>203.</enum><header>Application of
Prohibition of the display, sale, or purchase of social security numbers to
public records</header>
<subsection id="IDD3096A1136C6456A919B97536B70AF57"><enum>(a)</enum><header>Public records
exception</header>
<paragraph id="ID6A5FE5F36A6B4205AA19A7E7EA611D38"><enum>(1)</enum><header>In
general</header><text>Chapter 47 of title 18, United States Code (as amended by
section 3(a)(1)), is amended by inserting after section 1028A the
following:</text>
<quoted-block id="IDCCE15DE1C780448998F9EE06D7001788" style="USC">
<section id="ID904DE4786F9E4897AC7001A6DAC14BC6"><enum>1028B.</enum><header>Display,
sale, or purchase of public records containing social security numbers</header>
<subsection id="ID80CB774C3CF2471B9B00568E37C19405"><enum>(a)</enum><header>Definition</header><text>In
this section, the term <term>public record</term> means any governmental record
that is made available to the general public.</text>
</subsection><subsection id="ID260679AC2AC44D4ABC2C03233F507FEE"><enum>(b)</enum><header>In
general</header><text>Except as provided in subsections (c), (d), and (e),
section 1028A shall not apply to a public record.</text>
</subsection><subsection id="ID3500016C27EF4165B77DFE00EEA2EA22"><enum>(c)</enum><header>Public records
on the Internet or in an electronic medium</header>
<paragraph id="ID08F797EE31894F23BE2CED6C14ED5EBA"><enum>(1)</enum><header>In
general</header><text>Section 1028A shall apply to any public record first
posted onto the Internet or provided in an electronic medium by, or on behalf
of a government entity after the date of enactment of this section, except as
limited by the Attorney General in accordance with paragraph (2).</text>
</paragraph><paragraph id="ID1849BBCB047C4ED4B23DCF76FCC41B61"><enum>(2)</enum><header>Exception for
government entities already placing public records on the Internet or in
electronic form</header><text>Not later than 60 days after the date of
enactment of this section, the Attorney General shall issue regulations
regarding the applicability of section 1028A to any record of a category of
public records first posted onto the Internet or provided in an electronic
medium by, or on behalf of a government entity prior to the date of enactment
of this section. The regulations will determine which individual records within
categories of records of these government entities, if any, may continue to be
posted on the Internet or in electronic form after the effective date of this
section. In promulgating these regulations, the Attorney General may include in
the regulations a set of procedures for implementing the regulations and shall
consider the following:</text>
<subparagraph id="ID2AA70296F3524D399627AEE3BE204900"><enum>(A)</enum><text>The cost and
availability of technology available to a governmental entity to redact social
security numbers from public records first provided in electronic form after
the effective date of this section.</text>
</subparagraph><subparagraph id="IDA4356D0DB56F4388A27D683B5DD8BEEF"><enum>(B)</enum><text>The cost or
burden to the general public, businesses, commercial enterprises, non-profit
organizations, and to Federal, State, and local governments of complying with
section 1028A with respect to such records.</text>
</subparagraph><subparagraph id="ID2C5E7D688DD1468CAB4C37CBE0605B06"><enum>(C)</enum><text>The benefit to
the general public, businesses, commercial enterprises, non-profit
organizations, and to Federal, State, and local governments if the Attorney
General were to determine that section 1028A should apply to such
records.</text>
</subparagraph><continuation-text continuation-text-level="paragraph">Nothing in
the regulation shall permit a public entity to post a category of public
records on the Internet or in electronic form after the effective date of this
section if such category had not been placed on the Internet or in electronic
form prior to such effective date.</continuation-text></paragraph></subsection><subsection id="ID71CDCE78E63F46CFBDFEBDC83161523B"><enum>(d)</enum><header>Harvested
social security numbers</header><text>Section 1028A shall apply to any public
record of a government entity which contains social security numbers extracted
from other public records for the purpose of displaying or selling such numbers
to the general public.</text>
</subsection><subsection id="ID2EA70656B41949FB8B00F9BE8DDC9C8B"><enum>(e)</enum><header>Attorney
General rulemaking on paper records</header>
<paragraph id="ID3FE568EAB65F48389C744B21AAD2B9C4"><enum>(1)</enum><header>In
general</header><text>Not later than 60 days after the date of enactment of
this section, the Attorney General shall determine the feasibility and
advisability of applying section 1028A to the records listed in paragraph (2)
when they appear on paper or on another nonelectronic medium. If the Attorney
General deems it appropriate, the Attorney General may issue regulations
applying section 1028A to such records.</text>
</paragraph><paragraph id="IDA372765E8C914AF19BDBED29E8995876"><enum>(2)</enum><header>List of paper
and other nonelectronic records</header><text>The records listed in this
paragraph are as follows:</text>
<subparagraph id="ID926C442E63A04F76A4875421A13E4551"><enum>(A)</enum><text>Professional or
occupational licenses.</text>
</subparagraph><subparagraph id="ID5B08CD082D5148D6BE5F418E59127FDB"><enum>(B)</enum><text>Marriage
licenses.</text>
</subparagraph><subparagraph id="IDDDE7BB3AF6B4438CB9B8B008954D001D"><enum>(C)</enum><text>Birth
certificates.</text>
</subparagraph><subparagraph id="IDD6274BC4260C4F32A2403215DDEE16F5"><enum>(D)</enum><text>Death
certificates.</text>
</subparagraph><subparagraph id="IDBDAE7C4B835C43ABB7E14BC8EED6391F"><enum>(E)</enum><text>Other short
public documents that display a social security number in a routine and
consistent manner on the face of the document.</text>
</subparagraph></paragraph><paragraph id="ID7379E7F4908B46CE9B4B917B9874ADA0"><enum>(3)</enum><header>Criteria for
Attorney General review</header><text>In determining whether section 1028A
should apply to the records listed in paragraph (2), the Attorney General shall
consider the following:</text>
<subparagraph id="ID518338071E7741CC8544C680F2BB56B7"><enum>(A)</enum><text>The cost or
burden to the general public, businesses, commercial enterprises, non-profit
organizations, and to Federal, State, and local governments of complying with
section 1028A.</text>
</subparagraph><subparagraph id="ID02C79148C78D4CD8805E34B411432DDC"><enum>(B)</enum><text>The benefit to
the general public, businesses, commercial enterprises, non-profit
organizations, and to Federal, State, and local governments if the Attorney
General were to determine that section 1028A should apply to such
records.</text>
</subparagraph></paragraph></subsection></section><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph><paragraph id="IDD9D16F97B87846BEA18188354E2C821B"><enum>(2)</enum><header>Conforming
amendment</header><text>The chapter analysis for chapter 47 of title 18, United
States Code (as amended by section 202(a)(2)), is amended by inserting after
the item relating to section 1028A the following:</text>
<quoted-block id="ID4A94C271E18F4969A801EB3775EA7D20" style="USC">
<toc regeneration="no-regeneration">
<toc-entry level="section">1028B. Display, sale, or purchase of
public records containing social security
numbers.</toc-entry>
</toc>
<after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></subsection><subsection id="ID98BA8B5CE1B54883975222F5D7E57F3C"><enum>(b)</enum><header>Study and
report on social security numbers in public records</header>
<paragraph id="ID4EDAE9C681FF4292BFC4028F92A73952"><enum>(1)</enum><header>Study</header><text>The
Comptroller General of the United States shall conduct a study and prepare a
report on social security numbers in public records. In developing the report,
the Comptroller General shall consult with the Administrative Office of the
United States Courts, State and local governments that store, maintain, or
disseminate public records, and other stakeholders, including members of the
private sector who routinely use public records that contain social security
numbers.</text>
</paragraph><paragraph id="IDA32A70B9A5824595BA5600BEAD622F31"><enum>(2)</enum><header>Report</header><text>Not
later than 1 year after the date of enactment of this Act, the Comptroller
General of the United States shall submit to Congress a report on the study
conducted under paragraph (1). The report shall include a detailed description
of the activities and results of the study and recommendations for such
legislative action as the Comptroller General considers appropriate. The
report, at a minimum, shall include—</text>
<subparagraph id="ID19F5729AE8D841418EACD2F6DBF075FA"><enum>(A)</enum><text>a review of the
uses of social security numbers in non-federal public records;</text>
</subparagraph><subparagraph id="ID41ED8AB837CA471B99C597883F9E95D3"><enum>(B)</enum><text>a review of the
manner in which public records are stored (with separate reviews for both paper
records and electronic records);</text>
</subparagraph><subparagraph id="ID09CEA053ECAF4334B1A08B3CA6E0CB33"><enum>(C)</enum><text>a review of the
advantages or utility of public records that contain social security numbers,
including the utility for law enforcement, and for the promotion of homeland
security;</text>
</subparagraph><subparagraph id="IDCD3BBD37E7FE450A874C6C43862CED7B"><enum>(D)</enum><text>a review of the
disadvantages or drawbacks of public records that contain social security
numbers, including criminal activity, compromised personal privacy, or threats
to homeland security;</text>
</subparagraph><subparagraph id="ID3C41D5A8386E4219AF4390896F39CEA9"><enum>(E)</enum><text>the costs and
benefits for State and local governments of removing social security numbers
from public records, including a review of current technologies and procedures
for removing social security numbers from public records; and</text>
</subparagraph><subparagraph id="IDB6AD35C157D042EBAB6082BFED9DA0C2"><enum>(F)</enum><text>an assessment of
the benefits and costs to businesses, their customers, and the general public
of prohibiting the display of social security numbers on public records (with
separate assessments for both paper records and electronic records).</text>
</subparagraph></paragraph></subsection><subsection id="ID25A27F2875A747D58F5700616933A231"><enum>(c)</enum><header>Effective
Date</header><text>The prohibition with respect to electronic versions of new
classes of public records under section 1028B(b) of title 18, United States
Code (as added by subsection (a)(1)) shall not take effect until the date that
is 60 days after the date of enactment of this Act.</text>
</subsection></section><section id="IDCEC31DE95E824C0AA1467B97FFDBE33F"><enum>204.</enum><header>Rulemaking
authority of the Attorney General</header>
<subsection id="ID0E48E1D5F4244BC0A15ED31E88EE00FF"><enum>(a)</enum><header>In
general</header><text>Except as provided in subsection (b), the Attorney
General may prescribe such rules and regulations as the Attorney General deems
necessary to carry out the provisions of section 1028A(e)(5) of title 18,
United States Code (as added by section 202(a)(1)).</text>
</subsection><subsection id="ID1F6525BA11AD4B9DA85037D1ACC31FAF"><enum>(b)</enum><header>Display, sale,
or purchase rulemaking with respect to interactions between businesses,
governments, or business and government</header>
<paragraph id="IDDC03C14BA3124F6A9EDAEDB05E9CBC36"><enum>(1)</enum><header>In
general</header><text>Not later than 1 year after the date of enactment of this
Act, the Attorney General, in consultation with the Commissioner of Social
Security, the Chairman of the Federal Trade Commission, and such other heads of
Federal agencies as the Attorney General determines appropriate, shall conduct
such rulemaking procedures in accordance with subchapter II of chapter 5 of
title 5, United States Code, as are necessary to promulgate regulations to
implement and clarify the uses occurring as a result of an interaction between
businesses, governments, or business and government (regardless of which entity
initiates the interaction) permitted under section 1028A(e)(5) of title 18,
United States Code (as added by section 202(a)(1)).</text>
</paragraph><paragraph id="IDC1E8AFAE9D914F0C907DC8EC4852C8F9"><enum>(2)</enum><header>Factors to be
considered</header><text>In promulgating the regulations required under
paragraph (1), the Attorney General shall, at a minimum, consider the
following:</text>
<subparagraph id="ID5BE58E3C129341F184D7C91F60014F02"><enum>(A)</enum><text>The benefit to a
particular business, to customers of the business, and to the general public of
the display, sale, or purchase of an individual’s social security
number.</text>
</subparagraph><subparagraph id="IDC138B0553DAE4831BA88F5892E277763"><enum>(B)</enum><text>The costs that
businesses, customers of businesses, and the general public may incur as a
result of prohibitions on the display, sale, or purchase of social security
numbers.</text>
</subparagraph><subparagraph id="ID0596E28FF2AD425E9DDDA23270F5CC89"><enum>(C)</enum><text>The risk that a
particular business practice will promote the use of a social security number
to commit fraud, deception, or crime.</text>
</subparagraph><subparagraph id="IDB24E214E4E6848ED94FAC91F312EAA67"><enum>(D)</enum><text>The presence of
adequate safeguards and procedures to prevent—</text>
<clause id="ID0DBB863145574081B449DCCEDAABF64B"><enum>(i)</enum><text>misuse of social
security numbers by employees within a business; and</text>
</clause><clause id="ID7A3C194BAC3B46E50034C4B0E5BA5909"><enum>(ii)</enum><text>misappropriation
of social security numbers by the general public, while permitting internal
business uses of such numbers.</text>
</clause></subparagraph><subparagraph id="ID689847AB67384EFEAD7C71F339E556E4"><enum>(E)</enum><text>The presence of
procedures to prevent identity thieves, stalkers, and other individuals with
ill intent from posing as legitimate businesses to obtain social security
numbers.</text>
</subparagraph></paragraph></subsection></section><section id="IDFE18C81E06CD4FFEA8000947189EBCCA"><enum>205.</enum><header>Treatment of
social security numbers on government documents</header>
<subsection id="ID258A7997E4384FCF00006EF069914CAC"><enum>(a)</enum><header>Prohibition of
use of social security account numbers on checks issued for payment by
governmental agencies</header>
<paragraph id="IDF9E7319F7A794E999D00312B1938AF7E"><enum>(1)</enum><header>In
general</header><text><external-xref legal-doc="act" parsable-cite="SSA/205(c)(2)(C)">Section 205(c)(2)(C)</external-xref> of the
<act-name parsable-cite="SSA">Social Security Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/405(c)(2)(C)">42 U.S.C.
405(c)(2)(C)</external-xref>) is amended by adding at the end the
following:</text>
<quoted-block act-name="Social Security Act" id="ID54BFB6A424624360BF758C502039CA00">
<subsection id="IDF54144FAC3C0483E9C5D37B8C9D4DDC3"><enum>(x)</enum><text>No Federal,
State, or local agency may display the social security account number of any
individual, or any derivative of such number, on any check issued for any
payment by the Federal, State, or local agency.</text>
</subsection><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph><paragraph id="ID4FA7EC67DD054D1B875F98DA58C16842"><enum>(2)</enum><header>Effective
Date</header><text>The amendment made by this subsection shall apply with
respect to violations of
<external-xref legal-doc="act" parsable-cite="SSA/205(c)(2)(C)(x)">section
205(c)(2)(C)(x)</external-xref> of the <act-name parsable-cite="SSA">Social
Security Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/405(c)(2)(C)(x)">42 U.S.C.
405(c)(2)(C)(x)</external-xref>), as added by paragraph (1), occurring after
the date that is 3 years after the date of enactment of this Act.</text>
</paragraph></subsection><subsection id="ID3468536FCE304B019140D8C12D2377EE"><enum>(b)</enum><header>Prohibition of
appearance of social security account numbers on Driver’s licenses or motor
vehicle registration</header>
<paragraph id="ID1E3146CC5FEF43A1B73EB6BFFAD9C82F"><enum>(1)</enum><header>In
general</header><text><external-xref legal-doc="act" parsable-cite="SSA/205(c)(2)(C)(vi)">Section 205(c)(2)(C)(vi)</external-xref>
of the <act-name parsable-cite="SSA">Social Security Act</act-name>
(<external-xref legal-doc="usc" parsable-cite="usc/42/405(c)(2)(C)(vi)">42
U.S.C. 405(c)(2)(C)(vi)</external-xref>) is amended—</text>
<subparagraph id="IDDB765C0FA9A44357B8E44B24C02B5ED1"><enum>(A)</enum><text>by inserting
<quote>(I)</quote> after <quote>(vi)</quote>; and</text>
</subparagraph><subparagraph id="IDF5D2695D22FC4E849F3646FBEBB37504"><enum>(B)</enum><text>by adding at the
end the following:</text>
<quoted-block id="ID4135B7C0067242C400F2C91DF7A502BB">
<subclause id="ID5490DEF4793D4FA8A06BC0CFBD4E002E" indent="up4"><enum>(II)</enum><item commented="no" display-inline="yes-display-inline" id="IDF4ACBF8FBC954EAA90CD001DF015645C"><enum>(aa)</enum><text>An agency of a State
(or political subdivision thereof), in the administration of any driver’s
license or motor vehicle registration law within its jurisdiction, may not
display the social security account numbers issued by the Commissioner of
Social Security, or any derivative of such numbers, on the face of any driver’s
license or motor vehicle registration or any other document issued by such
State (or political subdivision thereof) to an individual for purposes of
identification of such individual.</text>
</item><item id="IDBFBC888964814B2A9E14FB99844B989D" indent="up1"><enum>(bb)</enum><text>Nothing in this subclause shall be
construed as precluding an agency of a State (or political subdivision
thereof), in the administration of any driver’s license or motor vehicle
registration law within its jurisdiction, from using a social security account
number for an internal use or to link with the database of an agency of another
State that is responsible for the administration of any driver’s license or
motor vehicle registration law.</text>
</item></subclause><after-quoted-block>.</after-quoted-block></quoted-block>
</subparagraph></paragraph><paragraph id="IDEA30F9B165D34D93BE63F6DB95B65B9E"><enum>(2)</enum><header>Effective
Date</header><text>The amendments made by this subsection shall apply with
respect to licenses, registrations, and other documents issued or reissued
after the date that is 1 year after the date of enactment of this Act.</text>
</paragraph></subsection><subsection id="ID9FAD3B0224CE45CAACD3864DD4E2F6AE"><enum>(c)</enum><header>Prohibition of
inmate access to social security account numbers</header>
<paragraph id="IDC017D0A636DD42389E05DF1D18AD00C6"><enum>(1)</enum><header>In
general</header><text><external-xref legal-doc="act" parsable-cite="SSA/205(c)(2)(C)">Section 205(c)(2)(C)</external-xref> of the
<act-name parsable-cite="SSA">Social Security Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/405(c)(2)(C)">42 U.S.C.
405(c)(2)(C)</external-xref>) (as amended by subsection (b)) is amended by
adding at the end the following:</text>
<quoted-block act-name="Social Security Act" id="ID9DF613E746B34C50AACA7E33B19901C6">
<clause id="IDA6C0403D190A4514BBAF697600B7FF00" indent="up3"><enum>(xi)</enum><text>No Federal, State, or local agency
may employ, or enter into a contract for the use or employment of, prisoners in
any capacity that would allow such prisoners access to the social security
account numbers of other individuals. For purposes of this clause, the term
<term>prisoner</term> means an individual confined in a jail, prison, or other
penal institution or correctional facility pursuant to such individual’s
conviction of a criminal offense.</text>
</clause><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph><paragraph id="ID135E13654BC54A24B37358927459F602"><enum>(2)</enum><header>Effective
Date</header><text>The amendment made by this subsection shall apply with
respect to employment of prisoners, or entry into contract with prisoners,
after the date that is 1 year after the date of enactment of this Act.</text>
</paragraph></subsection></section><section id="IDA1EBDFF4E09447F8B04F13B2AF47C2B2"><enum>206.</enum><header>Limits on
personal disclosure of a social security number for consumer
transactions</header>
<subsection id="ID9A8B48CB58F94A9892EFBAF39812D7C3"><enum>(a)</enum><header>In
general</header><text>Part A of title XI of the <act-name parsable-cite="SSA">Social Security Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/1301">42 U.S.C. 1301</external-xref> et
seq.) is amended by adding at the end the following:</text>
<quoted-block act-name="Social Security Act" id="ID3E9D988F2FC349508BF3C8AD97E26CBA">
<section id="IDAF12DD6787AA4FED859396252946099E"><enum>1150A.</enum><header>Limits on
personal disclosure of a social security number for consumer
transactions</header>
<subsection id="ID007A1D429E4B44DB814B720024ED202F"><enum>(a)</enum><header>In
general</header><text>A commercial entity may not require an individual to
provide the individual’s social security number when purchasing a commercial
good or service or deny an individual the good or service for refusing to
provide that number except—</text>
<paragraph id="IDF8DD75CAED8044429C6744C70000F965"><enum>(1)</enum><text>for any purpose
relating to—</text>
<subparagraph id="ID6CDF1773158D4E83BAC4B2D569F70051"><enum>(A)</enum><text>obtaining a
consumer report for any purpose permitted under the
<act-name parsable-cite="FCRA">Fair Credit Reporting Act</act-name>;</text>
</subparagraph><subparagraph id="IDA07BA091835641418FB8DD94951D36F1"><enum>(B)</enum><text>a background
check of the individual conducted by a landlord, lessor, employer, voluntary
service agency, or other entity as determined by the Attorney General;</text>
</subparagraph><subparagraph id="ID85FB845626AF4C27B931BECB90566E15"><enum>(C)</enum><text>law enforcement;
or</text>
</subparagraph><subparagraph id="ID2B9EEBECFBA14E1E80315D6E6B193300"><enum>(D)</enum><text>a Federal, State,
or local law requirement; or</text>
</subparagraph></paragraph><paragraph id="ID338EBC2997B34A299708A7F5A5A70575"><enum>(2)</enum><text>if the social
security number is necessary to verify the identity of the consumer to effect,
administer, or enforce the specific transaction requested or authorized by the
consumer, or to prevent fraud.</text>
</paragraph></subsection><subsection id="IDD9F59DF5708744DDBFACD9F619AC1FD5"><enum>(b)</enum><header>Application of
civil money penalties</header><text>A violation of this section shall be deemed
to be a violation of section 1129(a)(3)(F).</text>
</subsection><subsection id="ID7C520E84DE7E45F7BC807FEF12008086"><enum>(c)</enum><header>Application of
criminal penalties</header><text>A violation of this section shall be deemed to
be a violation of section 208(a)(8).</text>
</subsection><subsection id="IDFD0C04017DE54C71AC7763FDDFA1B7EF"><enum>(d)</enum><header>Limitation on
class actions</header><text>No class action alleging a violation of this
section shall be maintained under this section by an individual or any private
party in Federal or State court.</text>
</subsection><subsection id="IDF2ED52D41FBE478B93FFD94FA4645FEF"><enum>(e)</enum><header>State Attorney
General enforcement</header>
<paragraph id="ID448087ED90FD438AB7497F1425F93B4B"><enum>(1)</enum><header>In
general</header>
<subparagraph id="ID4097C8204B48421FB6D5AE96FDB81BFB"><enum>(A)</enum><header>Civil
actions</header><text>In any case in which the attorney general of a State has
reason to believe that an interest of the residents of that State has been or
is threatened or adversely affected by the engagement of any person in a
practice that is prohibited under this section, the State, as parens patriae,
may bring a civil action on behalf of the residents of the State in a district
court of the United States of appropriate jurisdiction to—</text>
<clause id="ID4E9AD5BDA54A4B0DAE00967745388339"><enum>(i)</enum><text>enjoin that
practice;</text>
</clause><clause id="ID43F6B46397C2495588F728B8AB3173F9"><enum>(ii)</enum><text>enforce
compliance with such section;</text>
</clause><clause id="ID37DAF005716149D3BFEC723719D068FB"><enum>(iii)</enum><text>obtain damages,
restitution, or other compensation on behalf of residents of the State;
or</text>
</clause><clause id="ID7932A78398CE45AF96E5777BF6875B84"><enum>(iv)</enum><text>obtain such
other relief as the court may consider appropriate.</text>
</clause></subparagraph><subparagraph id="ID72EB9B74AD154149934B14A67CA39E6D"><enum>(B)</enum><header>Notice</header>
<clause id="ID7758E887C9EB4274B1F302807C4C128B"><enum>(i)</enum><header>In
general</header><text>Before filing an action under subparagraph (A), the
attorney general of the State involved shall provide to the Attorney
General—</text>
<subclause id="ID72565A585C4D4391A1B43D1F9F6815E5"><enum>(I)</enum><text>written notice of
the action; and</text>
</subclause><subclause id="ID88D0B1C087C84655A76F04E668FC2855"><enum>(II)</enum><text>a copy of the
complaint for the action.</text>
</subclause></clause><clause id="IDF0990519749840F3933BE286AB55C876"><enum>(ii)</enum><header>Exemption</header>
<subclause id="ID09FA3F22B86241C9A388C0BE870560E0"><enum>(I)</enum><header>In
general</header><text>Clause (i) shall not apply with respect to the filing of
an action by an attorney general of a State under this subsection, if the State
attorney general determines that it is not feasible to provide the notice
described in such subparagraph before the filing of the action.</text>
</subclause><subclause id="ID607C977F43BD4B0D9E236F7F8D1B01B9"><enum>(II)</enum><header>Notification</header><text>With
respect to an action described in subclause (I), the attorney general of a
State shall provide notice and a copy of the complaint to the Attorney General
at the same time as the State attorney general files the action.</text>
</subclause></clause></subparagraph></paragraph><paragraph id="ID71612E570D1B431B9B2F885719FA7D5F"><enum>(2)</enum><header>Intervention</header>
<subparagraph id="IDAD4F564C194D4930AFF9141699B2ACE1"><enum>(A)</enum><header>In
general</header><text>On receiving notice under paragraph (1)(B), the Attorney
General shall have the right to intervene in the action that is the subject of
the notice.</text>
</subparagraph><subparagraph id="ID5480148538EE4819A059562DD21086B0"><enum>(B)</enum><header>Effect of
intervention</header><text>If the Attorney General intervenes in the action
under paragraph (1), the Attorney General shall have the right to be heard with
respect to any matter that arises in that action.</text>
</subparagraph></paragraph><paragraph id="ID381E61EAFF4A4500AE06DE7EB0096771"><enum>(3)</enum><header>Construction</header><text>For
purposes of bringing any civil action under paragraph (1), nothing in this
section shall be construed to prevent an attorney general of a State from
exercising the powers conferred on such attorney general by the laws of that
State to—</text>
<subparagraph id="ID6DCCF750FBAE42DEB2C830946E52C081"><enum>(A)</enum><text>conduct
investigations;</text>
</subparagraph><subparagraph id="ID5C07D3863C704CB9965E709C17FE61DD"><enum>(B)</enum><text>administer oaths
or affirmations; or</text>
</subparagraph><subparagraph id="IDEE701E39EF6C48FE801FD6807EC20040"><enum>(C)</enum><text>compel the
attendance of witnesses or the production of documentary and other
evidence.</text>
</subparagraph></paragraph><paragraph id="ID9C0B3D91C1C54100B263C66C8456B9A3"><enum>(4)</enum><header>Actions by the
Attorney General of the United States</header><text>In any case in which an
action is instituted by or on behalf of the Attorney General for violation of a
practice that is prohibited under this section, no State may, during the
pendency of that action, institute an action under paragraph (1) against any
defendant named in the complaint in that action for violation of that
practice.</text>
</paragraph><paragraph id="ID004B6F5323454118A683962417742B42"><enum>(5)</enum><header>Venue; service
of process</header>
<subparagraph id="IDA91790487CA44D7F86BE1CB1EB475ED5"><enum>(A)</enum><header>Venue</header><text>Any
action brought under paragraph (1) may be brought in the district court of the
United States that meets applicable requirements relating to venue under
section 1391 of title 28, United States Code.</text>
</subparagraph><subparagraph id="ID33B8596F15494534878F4925AFBBA71E"><enum>(B)</enum><header>Service of
process</header><text>In an action brought under paragraph (1), process may be
served in any district in which the defendant—</text>
<clause id="IDB54B1C2AF0FC4E92981B54A8691CCA66"><enum>(i)</enum><text>is an inhabitant;
or</text>
</clause><clause id="ID01195A0357DD435883FE47C630859CEA"><enum>(ii)</enum><text>may be
found.</text>
</clause></subparagraph></paragraph></subsection><subsection id="ID77C210C1AC3E4F599FBE4C5B09106153"><enum>(f)</enum><header>Sunset</header><text>This
section shall not apply on or after the date that is 6 years after the
effective date of this section.</text>
</subsection></section><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="ID28DB50CA432B4152A9BAFD3D7B322D9E"><enum>(b)</enum><header>Evaluation and
report</header><text>Not later than the date that is 6 years and 6 months after
the date of enactment of this Act, the Attorney General, in consultation with
the chairman of the Federal Trade Commission, shall issue a report evaluating
the effectiveness and efficiency of
<external-xref legal-doc="act" parsable-cite="SSA/1150A">section
1150A</external-xref> of the <act-name parsable-cite="SSA">Social Security
Act</act-name> (as added by subsection (a)) and shall make recommendations to
Congress as to any legislative action determined to be necessary or advisable
with respect to such section, including a recommendation regarding whether to
reauthorize such section.</text>
</subsection><subsection id="ID0ECDBCB3E5BA48E2A253BB492C3108E5"><enum>(c)</enum><header>Effective
Date</header><text>The amendment made by subsection (a) shall apply to requests
to provide a social security number occurring after the date that is 1 year
after the date of enactment of this Act.</text>
</subsection></section><section id="ID80BD741FC761401C8C22AD8525FBE1A8"><enum>207.</enum><header>Extension of
civil monetary penalties for misuse of a social security number</header>
<subsection id="ID078B9A7A3F2B4F7692568D918BFA1C47"><enum>(a)</enum><header>Treatment of
withholding of material facts</header>
<paragraph id="IDE8946436E44E4413B98906857D8492E0"><enum>(1)</enum><header>Civil
penalties</header><text>The first sentence of
<external-xref legal-doc="act" parsable-cite="SSA/1129(a)(1)">section
1129(a)(1)</external-xref> of the <act-name parsable-cite="SSA">Social Security
Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/1320a-8(a)(1)">42 U.S.C. 1320a–8(a)(1)</external-xref>)
is amended—</text>
<subparagraph id="ID25E7158EAC614F60831B97EC9DF7746D"><enum>(A)</enum><text>by striking
<quote>who</quote> and inserting <quote>who—</quote>;</text>
</subparagraph><subparagraph id="ID4821587FF4DE46749E07F9A40211A89C"><enum>(B)</enum><text>by striking
<quote>makes</quote> and all that follows through <quote>shall be subject
to</quote> and inserting the following:</text>
<quoted-block id="ID73F3592E68A74F66BF002082F7DDE8EF">
<subparagraph id="IDBFF5B05661FB4033A4DAF6009C78A2DB" indent="up1"><enum>(A)</enum><text>makes, or causes to be made, a
statement or representation of a material fact, for use in determining any
initial or continuing right to or the amount of monthly insurance benefits
under title II or benefits or payments under title VIII or XVI, that the person
knows or should know is false or misleading;</text>
</subparagraph><subparagraph id="ID733598F4ED8E483D96C4FF57DA0016B1" indent="up1"><enum>(B)</enum><text>makes such a statement or
representation for such use with knowing disregard for the truth; or</text>
</subparagraph><subparagraph id="ID704067B56CCE4BFFA986B6C944B88819" indent="up1"><enum>(C)</enum><text>omits from a statement or
representation for such use, or otherwise withholds disclosure of, a fact which
the individual knows or should know is material to the determination of any
initial or continuing right to or the amount of monthly insurance benefits
under title II or benefits or payments under title VIII or XVI and the
individual knows, or should know, that the statement or representation with
such omission is false or misleading or that the withholding of such disclosure
is misleading, shall be subject to</text>
</subparagraph><after-quoted-block>;</after-quoted-block></quoted-block>
</subparagraph><subparagraph id="ID4F8282F3A0D848F9A2F317A1D0698C51"><enum>(C)</enum><text>by inserting
<quote>or each receipt of such benefits while withholding disclosure of such
fact</quote> after <quote>each such statement or representation</quote>;</text>
</subparagraph><subparagraph id="ID9E25FF568BF345D3895F9D1399E2A590"><enum>(D)</enum><text>by inserting
<quote>or because of such withholding of disclosure of a material fact</quote>
after <quote>because of such statement or representation</quote>; and</text>
</subparagraph><subparagraph id="ID3B6B755DA75C468CB8D6BBBD1F93E634"><enum>(E)</enum><text>by inserting
<quote>or such a withholding of disclosure</quote> after <quote>such a
statement or representation</quote>.</text>
</subparagraph></paragraph><paragraph id="IDE3E157822A8A402DA4D0BA9019141D43"><enum>(2)</enum><header>Administrative
procedure for imposing penalties</header><text>The first sentence of
<external-xref legal-doc="act" parsable-cite="SSA/1129A(a)">section
1129A(a)</external-xref> of the <act-name parsable-cite="SSA">Social Security
Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/1320a-8a(a)">42 U.S.C. 1320a–8a(a)</external-xref>) is
amended—</text>
<subparagraph id="ID67D0321943244194B3E4E575EC9E817C"><enum>(A)</enum><text>by striking
<quote>who</quote> and inserting <quote>who—</quote>; and</text>
</subparagraph><subparagraph id="IDF889A0DB9D6043A88F06F48E82CB73B7"><enum>(B)</enum><text>by striking
<quote>makes</quote> and all that follows through <quote>shall be subject
to</quote> and inserting the following:</text>
<quoted-block id="ID181EBA5A45D245E3AC2482FE431F08EC">
<paragraph id="IDB6202568AD6E464200D4D5B9F700F6B2"><enum>(1)</enum><text>makes, or causes
to be made, a statement or representation of a material fact, for use in
determining any initial or continuing right to or the amount of monthly
insurance benefits under title II or benefits or payments under title VIII or
XVI, that the person knows or should know is false or misleading;</text>
</paragraph><paragraph id="ID0C1E23F56B2F4179A2C0CD56748819EF"><enum>(2)</enum><text>makes such a
statement or representation for such use with knowing disregard for the truth;
or</text>
</paragraph><paragraph id="ID29A992B5D442460D88E6F3E900856861"><enum>(3)</enum><text>omits from a
statement or representation for such use, or otherwise withholds disclosure of,
a fact which the individual knows or should know is material to the
determination of any initial or continuing right to or the amount of monthly
insurance benefits under title II or benefits or payments under title VIII or
XVI and the individual knows, or should know, that the statement or
representation with such omission is false or misleading or that the
withholding of such disclosure is misleading, shall be subject to</text>
</paragraph><after-quoted-block>.</after-quoted-block></quoted-block>
</subparagraph></paragraph></subsection><subsection id="IDAF27DBF3E87B4525B7D217854FFD5764"><enum>(b)</enum><header>Application of
civil money penalties to elements of criminal
violations</header><text><external-xref legal-doc="act" parsable-cite="SSA/1129(a)">Section 1129(a)</external-xref> of the
<act-name parsable-cite="SSA">Social Security Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/1320a-8(a)">42 U.S.C.
1320a–8(a)</external-xref>), as amended by subsection (a)(1), is
amended—</text>
<paragraph id="ID4B4E8A75D2DA462AAC2FC8DE88980941"><enum>(1)</enum><text>by redesignating
paragraph (2) as paragraph (4);</text>
</paragraph><paragraph id="IDDA0B09C86B7143CDA37536E9004FFBFA"><enum>(2)</enum><text>by redesignating
the last sentence of paragraph (1) as paragraph (2) and inserting such
paragraph after paragraph (1); and</text>
</paragraph><paragraph id="IDB238B592B44D4A2FA9E14327D38B4124"><enum>(3)</enum><text>by inserting
after paragraph (2) (as so redesignated) the following:</text>
<quoted-block id="ID3C863186BCDA43BF886D250369A18558">
<paragraph id="IDF4B3D1AE5403472F9591083BC600ACB0" indent="up1"><enum>(3)</enum><text>Any person (including an
organization, agency, or other entity) who—</text>
<subparagraph id="IDF504C3588A404A52B675ADF851B6EB94"><enum>(A)</enum><text>uses a social security account number
that such person knows or should know has been assigned by the Commissioner of
Social Security (in an exercise of authority under section 205(c)(2) to
establish and maintain records) on the basis of false information furnished to
the Commissioner by any person;</text>
</subparagraph><subparagraph id="ID0FCB09BDC38A4387AC9E0085AF5480FE"><enum>(B)</enum><text>falsely represents a number to be the
social security account number assigned by the Commissioner of Social Security
to any individual, when such person knows or should know that such number is
not the social security account number assigned by the Commissioner to such
individual;</text>
</subparagraph><subparagraph id="IDAD7C7E734E514E21A71D001C04972DCB"><enum>(C)</enum><text>knowingly alters a social security
card issued by the Commissioner of Social Security, or possesses such a card
with intent to alter it;</text>
</subparagraph><subparagraph id="ID18FBA2991B5847DD876782BC7ECAD270"><enum>(D)</enum><text>knowingly displays, sells, or
purchases a card that is, or purports to be, a card issued by the Commissioner
of Social Security, or possesses such a card with intent to display, purchase,
or sell it;</text>
</subparagraph><subparagraph id="ID4C0F23E058FF42F285ECC392B8009E93"><enum>(E)</enum><text>counterfeits a social security card,
or possesses a counterfeit social security card with intent to display, sell,
or purchase it;</text>
</subparagraph><subparagraph id="IDDDD6E053F62F4E91ABE712DA69C8F9B7"><enum>(F)</enum><text>discloses, uses, compels the
disclosure of, or knowingly displays, sells, or purchases the social security
account number of any person in violation of the laws of the United
States;</text>
</subparagraph><subparagraph id="ID2DEBA91D1C604042A1C2B1E9AD13A875"><enum>(G)</enum><text>with intent to deceive the
Commissioner of Social Security as to such person’s true identity (or the true
identity of any other person) furnishes or causes to be furnished false
information to the Commissioner with respect to any information required by the
Commissioner in connection with the establishment and maintenance of the
records provided for in section 205(c)(2);</text>
</subparagraph><subparagraph id="ID6C221E75BBD345B78B4E00BF5E11B69C"><enum>(H)</enum><text>offers, for a fee, to acquire for any
individual, or to assist in acquiring for any individual, an additional social
security account number or a number which purports to be a social security
account number; or</text>
</subparagraph><subparagraph id="ID9DFDC8DD89A747AC847C78D1C9DF4D5F"><enum>(I)</enum><text>being an officer or employee of a
Federal, State, or local agency in possession of any individual’s social
security account number, willfully acts or fails to act so as to cause a
violation by such agency of clause (vi)(II) or (x) of section 205(c)(2)(C),
shall be subject to, in addition to any other penalties that may be prescribed
by law, a civil money penalty of not more than $5,000 for each violation. Such
person shall also be subject to an assessment, in lieu of damages sustained by
the United States resulting from such violation, of not more than twice the
amount of any benefits or payments paid as a result of such violation.</text>
</subparagraph></paragraph><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></subsection><subsection id="ID04497592952E4671935FBD1526431C7C"><enum>(c)</enum><header>Clarification
of treatment of recovered amounts</header><text><external-xref legal-doc="act" parsable-cite="SSA/1129(e)(2)(B)">Section 1129(e)(2)(B)</external-xref> of the
<act-name parsable-cite="SSA">Social Security Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/1320a-8(e)(2)(B)">42 U.S.C.
1320a–8(e)(2)(B)</external-xref>) is amended by striking <quote>In the case of
amounts recovered arising out of a determination relating to title VIII or
XVI,</quote> and inserting <quote>In the case of any other amounts recovered
under this section,</quote>.</text>
</subsection><subsection id="IDD7BEF4AB2922402AA79E5E6764A4FA69"><enum>(d)</enum><header>Conforming
amendments</header>
<paragraph id="ID5708BD9097144969BB7000AD2243A3A1"><enum>(1)</enum><text><external-xref legal-doc="act" parsable-cite="SSA/1129(b)(3)(A)">Section
1129(b)(3)(A)</external-xref> of the <act-name parsable-cite="SSA">Social
Security Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/1320a-8(b)(3)(A)">42 U.S.C.
1320a–8(b)(3)(A)</external-xref>) is amended by striking <quote>charging fraud
or false statements</quote>.</text>
</paragraph><paragraph id="ID211DEE2E419E4B678EDFBE716145E776"><enum>(2)</enum><text><external-xref legal-doc="act" parsable-cite="SSA/1129(c)(1)">Section
1129(c)(1)</external-xref> of the <act-name parsable-cite="SSA">Social Security
Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/1320a-8(c)(1)">42 U.S.C. 1320a–8(c)(1)</external-xref>)
is amended by striking <quote>and representations</quote> and inserting
<quote>, representations, or actions</quote>.</text>
</paragraph><paragraph id="IDC0D3DF0569A64019B25289D89E7F712D"><enum>(3)</enum><text><external-xref legal-doc="act" parsable-cite="SSA/1129(e)(1)(A)">Section
1129(e)(1)(A)</external-xref> of the <act-name parsable-cite="SSA">Social
Security Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/1320a-8(e)(1)(A)">42 U.S.C.
1320a–8(e)(1)(A)</external-xref>) is amended by striking <quote>statement or
representation referred to in subsection (a) was made</quote> and inserting
<quote>violation occurred</quote>.</text>
</paragraph></subsection><subsection id="IDB7E0C86395824ED9A26E54D8BE5CA7B8"><enum>(e)</enum><header>Effective
dates</header>
<paragraph id="ID5CD1E124BB7142A881294E4D51F2241D"><enum>(1)</enum><header>In
general</header><text>Except as provided in paragraph (2), the amendments made
by this section shall apply with respect to violations of sections 1129 and
1129A of the <act-name parsable-cite="SSA">Social Security Act</act-name>
(<external-xref legal-doc="usc" parsable-cite="usc/42/1320-8">42 U.S.C.
1320–8</external-xref> and 1320a–8a), as amended by this section, committed
after the date of enactment of this Act.</text>
</paragraph><paragraph id="ID4B2112A1807F46759C87311EC4EF1604"><enum>(2)</enum><header>Violations by
government agents in possession of social security
numbers</header><text><external-xref legal-doc="act" parsable-cite="SSA/1129(a)(3)(I)">Section 1129(a)(3)(I)</external-xref> of the
<act-name parsable-cite="SSA">Social Security Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/1320a-8(a)(3)(I)">42 U.S.C.
1320a–8(a)(3)(I)</external-xref>), as added by subsection (b), shall apply with
respect to violations of that section occurring on or after the effective date
described in section 202(c).</text>
</paragraph></subsection></section><section id="ID254DDF6ECED34FB4BB2C490067193F03"><enum>208.</enum><header>Criminal
penalties for the misuse of a social security number</header>
<subsection id="IDF64666E5B87C463DAEA4F6C21FEC4D71"><enum>(a)</enum><header>Prohibition of
wrongful use as personal identification number</header><text>No person may
obtain any individual’s social security number for purposes of locating or
identifying an individual with the intent to physically injure, harm, or use
the identity of the individual for any illegal purpose.</text>
</subsection><subsection id="ID4416C4458602498793146FCC1B5358B2"><enum>(b)</enum><header>Criminal
sanctions</header><text><external-xref legal-doc="act" parsable-cite="SSA/208(a)">Section 208(a)</external-xref> of the
<act-name parsable-cite="SSA">Social Security Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/408(a)">42 U.S.C. 408(a)</external-xref>)
is amended—</text>
<paragraph id="ID93B67C74119C4B1685EDD15C0633F6FC"><enum>(1)</enum><text>in paragraph (8),
by inserting <quote>or</quote> after the semicolon; and</text>
</paragraph><paragraph id="IDE32C8885F502483FA7CD9FC03BA69370"><enum>(2)</enum><text>by inserting
after paragraph (8) the following:</text>
<quoted-block id="IDC55BD20758884D6AB0A2438F6D6D8991">
<paragraph id="ID32741606F61745CEB2D34C4E6094F7C5"><enum>(9)</enum><text>except as
provided in subsections (e) and (f) of section 1028A of title 18, United States
Code, knowingly and willfully displays, sells, or purchases (as those terms are
defined in section 1028A(a) of title 18, United States Code) any individual’s
social security account number without having met the prerequisites for consent
under section 1028A(d) of title 18, United States Code; or</text>
</paragraph><paragraph id="IDAF10F89903674DF4003CEDB3E8EDB242"><enum>(10)</enum><text>obtains any
individual’s social security number for the purpose of locating or identifying
the individual with the intent to injure or to harm that individual, or to use
the identity of that individual for an illegal purpose;</text>
</paragraph><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></subsection></section><section id="ID5DB12E33B0E642F487A9226964001168"><enum>209.</enum><header>Civil actions
and civil penalties</header>
<subsection id="ID1AB4FA35D28B445A84357CF573009051"><enum>(a)</enum><header>Civil action in
State courts</header>
<paragraph id="IDDF8B3FFB106A4D7380992492086D2379"><enum>(1)</enum><header>In
general</header><text>Any individual aggrieved by an act of any person in
violation of this title or any amendments made by this title may, if otherwise
permitted by the laws or rules of the court of a State, bring in an appropriate
court of that State—</text>
<subparagraph id="ID1C7B104916A04EBF8F13227D020000F3"><enum>(A)</enum><text>an action to
enjoin such violation;</text>
</subparagraph><subparagraph id="IDF58FFD637CC141CEB9DCA38CB7BBA156"><enum>(B)</enum><text>an action to
recover for actual monetary loss from such a violation, or to receive up to
$500 in damages for each such violation, whichever is greater; or</text>
</subparagraph><subparagraph id="IDECB7696489C24FE3B0643134BFCBB2C7"><enum>(C)</enum><text>both such
actions.</text>
</subparagraph><continuation-text continuation-text-level="paragraph">It shall be
an affirmative defense in any action brought under this paragraph that the
defendant has established and implemented, with due care, reasonable practices
and procedures to effectively prevent violations of the regulations prescribed
under this title. If the court finds that the defendant willfully or knowingly
violated the regulations prescribed under this subsection, the court may, in
its discretion, increase the amount of the award to an amount equal to not more
than 3 times the amount available under subparagraph (B).</continuation-text></paragraph><paragraph id="ID1ED19375E8DC4F409C4D2FAB03031EB0"><enum>(2)</enum><header>Statute of
limitations</header><text>An action may be commenced under this subsection not
later than the earlier of—</text>
<subparagraph id="ID4EE7EDE4C3BC4E7AADCC28B060006B5E"><enum>(A)</enum><text>5 years after the
date on which the alleged violation occurred; or</text>
</subparagraph><subparagraph id="IDCF01A369556648B70036233210B2EDF1"><enum>(B)</enum><text>3 years after the
date on which the alleged violation was or should have been reasonably
discovered by the aggrieved individual.</text>
</subparagraph></paragraph><paragraph id="ID6A123CE59A214552ADA74891C1926DA2"><enum>(3)</enum><header>Nonexclusive
remedy</header><text>The remedy provided under this subsection shall be in
addition to any other remedies available to the individual.</text>
</paragraph></subsection><subsection id="IDB754C7DCC043436C9FBB3B7D7493F240"><enum>(b)</enum><header>Civil
penalties</header>
<paragraph id="ID303A68414E2B45A781B01D8CDCC6E37F"><enum>(1)</enum><header>In
general</header><text>Any person who the Attorney General determines has
violated any section of this title or of any amendments made by this title
shall be subject, in addition to any other penalties that may be prescribed by
law—</text>
<subparagraph id="IDB5AD4FF357F541759E7C04D6BFCC02BC"><enum>(A)</enum><text>to a civil
penalty of not more than $5,000 for each such violation; and</text>
</subparagraph><subparagraph id="ID984A54AFBA73432EAC6C13746CEB9415"><enum>(B)</enum><text>to a civil
penalty of not more than $50,000, if the violations have occurred with such
frequency as to constitute a general business practice.</text>
</subparagraph></paragraph><paragraph id="IDCB0A20B27453455D932C6F7C51831239"><enum>(2)</enum><header>Determination
of violations</header><text>Any willful violation committed contemporaneously
with respect to the social security numbers of 2 or more individuals by means
of mail, telecommunication, or otherwise, shall be treated as a separate
violation with respect to each such individual.</text>
</paragraph><paragraph id="ID06B4AA18045D476DBB41F3A26D3253FC"><enum>(3)</enum><header>Enforcement
procedures</header><text>The provisions of
<external-xref legal-doc="act" parsable-cite="SSA/1128A">section
1128A</external-xref> of the <act-name parsable-cite="SSA">Social Security
Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/1320a-7a">42 U.S.C. 1320a–7a</external-xref>), other than
subsections (a), (b), (f), (h), (i), (j), (m), and (n) and the first sentence
of subsection (c) of such section, and the provisions of subsections (d) and
(e) of section 205 of such Act (<external-xref legal-doc="usc" parsable-cite="usc/42/405">42 U.S.C. 405</external-xref>) shall apply to a
civil penalty action under this subsection in the same manner as such
provisions apply to a penalty or proceeding under section 1128A(a) of such Act
(<external-xref legal-doc="usc" parsable-cite="usc/42/1320a-7a(a)">42 U.S.C.
1320a–7a(a)</external-xref>), except that, for purposes of this paragraph, any
reference in section 1128A of such Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1320a-7a">42 U.S.C. 1320a–7a</external-xref>) to the
Secretary shall be deemed to be a reference to the Attorney General.</text>
</paragraph></subsection></section><section id="IDA17DBC70E64C4228A96B5349E0289900"><enum>210.</enum><header>Federal
injunctive authority</header><text display-inline="no-display-inline">In
addition to any other enforcement authority conferred under this title or the
amendments made by this title, the Federal Government shall have injunctive
authority with respect to any violation by a public entity of any provision of
this title or of any amendments made by this title.</text>
</section><enum>III</enum><header>Limitations on
sale and sharing of nonpublic personal financial information</header>
<section id="IDCFA4FF6EA6154F298D9C3F0061BEB799"><enum>301.</enum><header>Definition of
sale</header><text display-inline="no-display-inline">Section 509 of the
Gramm-Leach-Bliley Act (<external-xref legal-doc="usc" parsable-cite="usc/15/6809">15 U.S.C. 6809</external-xref>) is amended by
adding at the end the following:</text>
<quoted-block id="ID0D61757D3D404DFB9229085CC4C269CD">
<paragraph id="ID7A80C385610E4D01905368F65E295C72"><enum>(12)</enum><header>Sale</header><text>The
terms <term>sale</term>, <term>sell</term>, and <term>sold</term>, with respect
to nonpublic personal information, mean the exchange of such information for
any thing of value, directly or indirectly, including the licensing, bartering,
or renting of such information.</text>
</paragraph><after-quoted-block>.</after-quoted-block></quoted-block>
</section><section id="ID0DAD702FA58F4C36B3B53BE9EF83FEC0"><enum>302.</enum><header>Rules
applicable to sale of nonpublic personal information</header><text display-inline="no-display-inline">Section 502 of the Gramm-Leach-Bliley Act
(<external-xref legal-doc="usc" parsable-cite="usc/15/6802">15 U.S.C.
6802</external-xref>) is amended—</text>
<paragraph id="ID6F2A1EA332104196995E3050DDAFD284"><enum>(1)</enum><text>in the section
heading, by inserting <quote><header-in-text>sales, and other
sharing</header-in-text></quote> after
<quote><header-in-text>disclosures</header-in-text></quote>;</text>
</paragraph><paragraph id="ID695520EB5F5349AD87CD987D18E0E017"><enum>(2)</enum><text>in subsection
(a), by striking <quote>disclose to</quote> and inserting <quote>sell or
otherwise disclose to an affiliate or</quote>;</text>
</paragraph><paragraph id="ID669075CAA074496294491C5C6F07F268"><enum>(3)</enum><text>in subsection
(b)—</text>
<subparagraph id="ID503468942300429EAB66FB6C5D965887"><enum>(A)</enum><text>in the subsection
heading, by inserting <quote><header-in-text>for Disclosures to
Affiliates</header-in-text></quote> before the period;</text>
</subparagraph><subparagraph id="ID3C9847B627AF4BB8B4A90030D5D5BBA2"><enum>(B)</enum><text>by striking
<quote>a nonaffiliated third party</quote> each place that term appears and
inserting <quote>an affiliate</quote>;</text>
</subparagraph><subparagraph id="ID0149523A48DF4938A7D14DCDACE60064"><enum>(C)</enum><text>by striking
<quote>such third party</quote> each place that term appears and inserting
<quote>such affiliate</quote>;</text>
</subparagraph><subparagraph id="ID5F4DE02F39F64AAEAD7146E133F54462"><enum>(D)</enum><text>by striking
<quote>may not disclose</quote> and inserting <quote>may not sell or otherwise
disclose</quote>; and</text>
</subparagraph><subparagraph id="IDF9E70ADE846547708B04271BD921EE8E"><enum>(E)</enum><text>by striking
paragraph (2) and inserting the following:</text>
<quoted-block id="ID14D2212B4FB74D549439869DBC89B6BC">
<paragraph id="IDE683D4246CB94FF2A5768E265043693E"><enum>(2)</enum><header>Exception</header><text>This
subsection shall not prevent a financial institution from providing nonpublic
personal information to an affiliated third party to perform services for or
functions on behalf of the financial institution, including marketing of the
financial institution’s own products or services, if the financial institution
fully discloses the provision of such information and requires the affiliate to
maintain the confidentiality of such information.</text>
</paragraph><after-quoted-block>;</after-quoted-block></quoted-block>
</subparagraph></paragraph><paragraph id="ID526E7D0497B24792A2CE1239A386726D"><enum>(4)</enum><text>in subsection
(d), by striking <quote>disclose</quote> and inserting <quote>sell or otherwise
disclose</quote>;</text>
</paragraph><paragraph id="IDFDE09431F95C4107B3F2B30012901C44"><enum>(5)</enum><text>by striking
subsection (e);</text>
</paragraph><paragraph id="ID285BE6C2A85045BBA89433738C5183C7"><enum>(6)</enum><text>by redesignating
subsections (c) and (d) as subsections (e) and (f), respectively; and</text>
</paragraph><paragraph id="IDCC8707A462924C2392B86332C7144EC2"><enum>(7)</enum><text>by inserting
after subsection (b) the following:</text>
<quoted-block id="ID513B3C9DFDD54598AF167637A1F4109C">
<subsection id="ID032EC5811EFF4111AB834D39AD644542"><enum>(c)</enum><header>Opt in for
disclosures to nonaffiliated third parties</header>
<paragraph id="IDC99C5412D8E64EFD9476C6F21F67EF89"><enum>(1)</enum><header>Affirmative
consent required</header><text>A financial institution may not sell or
otherwise disclose nonpublic personal information to any nonaffiliated third
party, unless the consumer to whom the information pertains—</text>
<subparagraph id="ID8613201FAE6B4C75971839BDACED591C"><enum>(A)</enum><text>has affirmatively
consented to the sale or disclosure of such information; and</text>
</subparagraph><subparagraph id="ID49E596FE4DD84BBFA2BB2B5450964F3E"><enum>(B)</enum><text>has not withdrawn
the consent.</text>
</subparagraph></paragraph><paragraph id="IDF1B26AFC25F749E194F9CA0021EC8990"><enum>(2)</enum><header>Exception</header><text>This
subsection shall not prevent a financial institution from providing nonpublic
personal information to a nonaffiliated third party to perform services for or
functions on behalf of the financial institution, including marketing of the
financial institution’s own products or services (subject to subsection (d)
with respect to joint agreements between 2 or more financial institutions), if
the financial institution fully discloses the provision of such information and
enters into a contractual agreement with the nonaffiliated third party that
requires that third party to maintain the confidentiality of such
information.</text>
</paragraph></subsection><subsection id="ID92086523CE1245E7A9D3DCCA0087EDB8"><enum>(d)</enum><header>Opt out for
joint agreements</header><text>A financial institution may not sell or
otherwise disclose nonpublic personal information to a nonaffiliated third
party for the purpose of offering financial products or services pursuant to a
joint agreement between 2 or more financial institutions, unless—</text>
<paragraph id="ID0278F2488A3E4CFAB1AC971286675223"><enum>(1)</enum><text>the financial
institution clearly and conspicuously discloses to the consumer to whom the
information pertains, in writing or in electronic form or other form permitted
by the regulations prescribed under section 504, that such information may be
disclosed to such nonaffiliated third party;</text>
</paragraph><paragraph id="ID4577B10E15764BE6869D34ECF3EC534F"><enum>(2)</enum><text>the consumer is
given the opportunity, before the time that such information is initially
disclosed, to direct that such information not be disclosed to such
nonaffiliated third party;</text>
</paragraph><paragraph id="ID1D7F3AB405834ED4B58BA22E92BA3CEB"><enum>(3)</enum><text>the consumer is
given an explanation of how the consumer can exercise that nondisclosure
option; and</text>
</paragraph><paragraph id="ID61C838FE252C48DCAB6801A61DBD06F2"><enum>(4)</enum><text>the financial
institution receiving the nonpublic personal information signs a written
agreement obliging it—</text>
<subparagraph id="IDCCCA3C9703CB4AC6909E0784B0D63FE4"><enum>(A)</enum><text>to maintain the
confidentiality of the information; and</text>
</subparagraph><subparagraph id="ID03B8CF37ED214B58A53B02D5DE50CD19"><enum>(B)</enum><text>to refrain from
using, selling, or otherwise disclosing the information other than to carry out
the joint offering or servicing of the financial product or financial service
that is the subject of the written agreement.</text>
</subparagraph></paragraph></subsection><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></section><section id="IDB2F9AE9973D34D23896DD0704F9F48B5"><enum>303.</enum><header>Exceptions to
disclosure prohibition</header>
<subsection id="ID19BC2810E0704980A9808BA8C3154E1E"><enum>(a)</enum><header>In
general</header><text>Section 502 of the Gramm-Leach-Bliley Act (<external-xref legal-doc="usc" parsable-cite="usc/15/6802">15 U.S.C. 6802</external-xref>), as
amended by this title, is amended by adding at the end the following:</text>
<quoted-block id="IDF3412FD2E13448E2B97C89A436768714">
<subsection id="IDF1C300D397AD412783897E1DE7E56504"><enum>(g)</enum><header>General
exceptions</header><text>Notwithstanding any other provision of this section,
this section does not prohibit—</text>
<paragraph id="ID7BAF017C47BA476CB54DFCC9005710C6"><enum>(1)</enum><text>the sale or other
disclosure of nonpublic personal information to an affiliate or a nonaffiliated
third party—</text>
<subparagraph id="IDF3B07B4596C24591B3E95259540503AA"><enum>(A)</enum><text>as necessary to
effect, administer, or enforce a transaction requested or authorized by the
consumer to whom the information pertains, or in connection with—</text>
<clause id="ID6461D09AC0584B08ADBABD128BAA78D6"><enum>(i)</enum><text>servicing or
processing a financial product or service requested or authorized by the
consumer;</text>
</clause><clause id="IDEE10D30D253E4D3BAB3D62217CAFA6D7"><enum>(ii)</enum><text>maintaining or
servicing the account of the consumer with the financial institution, or with
another entity as part of a private label credit card program or other
extension of credit on behalf of such entity; or</text>
</clause><clause id="IDA915E94C1F614BF58026780038AA2366"><enum>(iii)</enum><text>a proposed or
actual securitization, secondary market sale (including sales of servicing
rights), or similar transaction related to a transaction of the
consumer;</text>
</clause></subparagraph><subparagraph id="ID86A7F01A9E3C44388F1265F919FA15F7"><enum>(B)</enum><text>with the consent
or at the direction of the consumer, in accordance with applicable rules
prescribed under this subtitle;</text>
</subparagraph><subparagraph id="ID926378456EC14AEEADB25D42F4E2DAAD"><enum>(C)</enum><text>to the extent
specifically permitted or required under other provisions of law and in
accordance with the <act-name parsable-cite="RFPA78">Right to Financial Privacy
Act of 1978</act-name>; or</text>
</subparagraph><subparagraph id="ID14D59C646E254C73B8D8AA00EAB0F970"><enum>(D)</enum><text>to law
enforcement agencies (including a Federal functional regulator, the Secretary
of the Treasury, with respect to subchapter II of chapter 53 of title 31,
United States Code, and chapter 2 of title I of
<external-xref legal-doc="public-law" parsable-cite="pl/91/508">Public Law
91–508</external-xref> (<external-xref legal-doc="usc" parsable-cite="usc/12/1951-1959">12 U.S.C. 1951–1959</external-xref>), a State
insurance authority, or the Federal Trade Commission), self-regulatory
organizations, or for an investigation on a matter related to public
safety;</text>
</subparagraph></paragraph><paragraph id="ID62617A410DB946B297165844D006E344"><enum>(2)</enum><text>the disclosure,
other than the sale, of nonpublic personal information to identify or locate
missing and abducted children, witnesses, criminals, and fugitives, parties to
lawsuits, parents, delinquents in child support payments, organ and bone marrow
donors, pension fund beneficiaries, and missing heirs; or</text>
</paragraph><paragraph id="ID5FFC754DAED94C0DB2703FF60044EE6D"><enum>(3)</enum><text>the disclosure,
other than the sale, of nonpublic personal information—</text>
<subparagraph id="ID13FB111CA886444681C45D79F3D9C197"><enum>(A)</enum><text>to protect the
confidentiality or security of the records of the financial institution
pertaining to the consumer, the service or product, or the transaction
therein;</text>
</subparagraph><subparagraph id="ID86AD3D0E7F114447B771000826BE7EA3"><enum>(B)</enum><text>to protect
against or prevent actual or potential fraud, unauthorized transactions,
claims, or other liability;</text>
</subparagraph><subparagraph id="ID49977E51DE6B4DC0857ED0448C942B1C"><enum>(C)</enum><text>for required
institutional risk control, or for resolving customer disputes or
inquiries;</text>
</subparagraph><subparagraph id="ID81A34ECAA0E5436FB8DE89CF9900E9CB"><enum>(D)</enum><text>to persons
holding a legal or beneficial interest relating to the consumer;</text>
</subparagraph><subparagraph id="ID59D9FC98D87F4270AEC01835A9742588"><enum>(E)</enum><text>to persons acting
in a fiduciary or representative capacity on behalf of the consumer;</text>
</subparagraph><subparagraph id="ID5B66647AF91C4FC3874ED991F46DD002"><enum>(F)</enum><text>to provide
information to insurance rate advisory organizations, guaranty funds or
agencies, applicable rating agencies of the financial institution, persons
assessing the compliance of the institution with industry standards, or the
attorneys, accountants, or auditors of the institution;</text>
</subparagraph><subparagraph id="IDC5E2F79AF7C3442E845CBCFDEBA635E1"><enum>(G)</enum><text>to a consumer
reporting agency, in accordance with the <act-name parsable-cite="FCRA">Fair
Credit Reporting Act</act-name> or from a consumer report reported by a
consumer reporting agency, as those terms are defined in that Act;</text>
</subparagraph><subparagraph id="ID3A6890BE5C024C78B0B3F318E2C7D5E9"><enum>(H)</enum><text>in connection
with a proposed or actual sale, merger, transfer, or exchange of all or a
portion of a business or operating unit if the disclosure of nonpublic personal
information concerns solely consumers of such business or unit;</text>
</subparagraph><subparagraph id="ID7608D41837EC4929939F506524B4C366"><enum>(I)</enum><text>to comply with
Federal, State, or local laws, rules, or other applicable legal requirements,
or with a properly authorized civil, criminal, or regulatory investigation or
subpoena or summons by Federal, State, or local authorities; or</text>
</subparagraph><subparagraph id="IDD88B8623B58645DBAFE781E374749FB5"><enum>(J)</enum><text>to respond to
judicial process or government regulatory authorities having jurisdiction over
the financial institution for examination, compliance, or other purposes, as
authorized by law.</text>
</subparagraph></paragraph></subsection><subsection id="ID203BD5C2820E41C0A798B0CAE6ADA8F6"><enum>(h)</enum><header>Denial of
service prohibited</header><text>A financial institution may not deny any
consumer a financial product or a financial service as a result of the refusal
by the consumer to grant consent to disclosure under this section or the
exercise by the consumer of a nondisclosure option under this section, except
that nothing in this subsection may be construed to prohibit a financial
institution from offering incentives to elicit consumer consent to the use of
his or her nonpublic personal information.</text>
</subsection><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="ID50F1D8739E984A87B1645CFA712D59C9"><enum>(b)</enum><header>Repeal of
regulatory exemption authority</header><text>Section 504 of the
Gramm-Leach-Bliley Act (<external-xref legal-doc="usc" parsable-cite="usc/15/6804">15 U.S.C. 6804</external-xref>) is amended—</text>
<paragraph id="IDB9DB7E542CC143109C9D77C184B0F08B"><enum>(1)</enum><text>by striking
subsection (b);</text>
</paragraph><paragraph id="IDEA80EF0995414C85871372AF85B7EB8D"><enum>(2)</enum><text>by striking
<quote>(a) <header-in-text>Regulatory
Authority</header-in-text>.—</quote>;</text>
</paragraph><paragraph id="IDB8F38B7A60454F9A8EB6654965E4D321"><enum>(3)</enum><text>by redesignating
paragraphs (1), (2), and (3) as subsections (a), (b), and (c), respectively,
and moving the margins 2 ems to the left; and</text>
</paragraph><paragraph id="IDD5DDFD5A29FD4401BAC92D3222E0FC96"><enum>(4)</enum><text>by striking
<quote>paragraph (1)</quote> and inserting <quote>subsection
(a)</quote>.</text>
</paragraph></subsection></section><section id="ID696CD6BA25F549268FCC020575CAEA79"><enum>304.</enum><header>Conforming
amendments</header><text display-inline="no-display-inline">Title V of the
Gramm-Leach-Bliley Act (<external-xref legal-doc="usc" parsable-cite="usc/15/6801">15 U.S.C. 6801</external-xref> et seq.) is
amended—</text>
<paragraph id="ID526F414C4F0B48BDB3CD259F8D2BB363"><enum>(1)</enum><text>in section
503(b)(1) (<external-xref legal-doc="usc" parsable-cite="usc/15/6803(b)(1)">15
U.S.C. 6803(b)(1)</external-xref>)—</text>
<subparagraph id="IDEDB68E10CD43492AB22E2783C1612E49"><enum>(A)</enum><text>by inserting
<quote>affiliates and</quote> before <quote>nonaffiliated</quote>; and</text>
</subparagraph><subparagraph id="IDB3A28B90B4ED444697E339038B15CC9C"><enum>(B)</enum><text>in subparagraph
(A), by striking <quote>502(e)</quote> and inserting <quote>502(g)</quote>;
and</text>
</subparagraph></paragraph><paragraph id="ID07670ECBE5D64EB7B56C84C02B24F7EF"><enum>(2)</enum><text>in section
509(3)(D) (<external-xref legal-doc="usc" parsable-cite="usc/15/6809(3)(D)">15
U.S.C. 6809(3)(D)</external-xref>), by striking <quote>502(e)(1)(C)</quote> and
inserting <quote>502(g)(1)(A)(iii)</quote>.</text>
</paragraph></section><section id="ID33AA2375369247DFB8F4F2CEDE2814E9"><enum>305.</enum><header>Regulatory
authority</header><text display-inline="no-display-inline">Not later than 6
months after the date of enactment of this Act, the agencies referred to in
section 504(a)(1) of the Gramm-Leach-Bliley Act (<external-xref legal-doc="usc" parsable-cite="usc/15/6804(a)(1)">15 U.S.C. 6804(a)(1)</external-xref>) shall
promulgate final regulations in accordance with that section 504 to carry out
the amendments made by this Act.</text>
</section><section id="IDEFF65D4198814194BA9652E3AC5BAC43"><enum>306.</enum><header>Effective
Date</header><text display-inline="no-display-inline">This title and the
amendments made by this title shall take effect 6 months after the date of
enactment of this Act.</text>
</section><enum>IV</enum><header>Limitations on
the provision of protected health information</header>
<section id="IDD4709D38AE9A42E8BAD13728E76648E5"><enum>401.</enum><header>Definitions</header><text display-inline="no-display-inline">In this title:</text>
<paragraph id="ID8DBDEE7AC60B41C5A988D266E4AD661D"><enum>(1)</enum><header>Business
associate</header>
<subparagraph id="ID6D80B956AE71463DB71C88A622B8B813"><enum>(A)</enum><header>In
general</header><text>Except as provided in subparagraph (B), the term
<term>business associate</term> means, with respect to a covered entity, a
person who—</text>
<clause id="IDD4EFE35A345D4E2DAF2903001F61C6F0"><enum>(i)</enum><text>on
behalf of such covered entity or of an organized health care arrangement in
which the covered entity participates, but other than in the capacity of a
member of the workforce of such covered entity or arrangement, performs, or
assists in the performance of—</text>
<subclause id="IDBD804A4764C14DFC8176F8474CAD1B09"><enum>(I)</enum><text>a function or
activity involving the use or disclosure of individually identifiable health
information, including claims processing or administration, data analysis,
processing or administration, utilization review, quality assurance, billing,
benefit management, practice management, and repricing; or</text>
</subclause><subclause id="ID2457F0258A824A9499B703DED12B9817"><enum>(II)</enum><text>any other
function or activity regulated under subchapter C of title 45, Code of Federal
Regulations; or</text>
</subclause></clause><clause id="ID071511389E1646F2BEEC9375E7BD3516"><enum>(ii)</enum><text>provides, other
than in the capacity of a member of the workforce of such covered entity,
legal, actuarial, accounting, consulting, data aggregation (as defined in
section 164.501 of title 45, Code of Federal Regulations), management,
administrative, accreditation, or financial services to or for such covered
entity, or to or for an organized health care arrangement in which the covered
entity participates, where the provision of the service involves the disclosure
of individually identifiable health information from such covered entity or
arrangement, or from another business associate of such covered entity or
arrangement, to the person.</text>
</clause></subparagraph><subparagraph id="ID35B5557578F04086BF6121C9CD5C9456"><enum>(B)</enum><header>Limitations</header>
<clause id="IDA6832E6229194838B2E00213B78491FD"><enum>(i)</enum><header>In
general</header><text>A covered entity participating in an organized health
care arrangement that performs a function or activity as described by
subparagraph (A)(i) for or on behalf of such organized health care arrangement,
or that provides a service as described in subparagraph (A)(ii) to or for such
organized health care arrangement, does not, simply through the performance of
such function or activity or the provision of such service, become a business
associate of other covered entities participating in such organized health care
arrangement.</text>
</clause><clause id="ID149BC6701B4040899DE965A842A696C3"><enum>(ii)</enum><header>Limitation</header><text>A
covered entity may be a business associate of another covered entity.</text>
</clause></subparagraph></paragraph><paragraph id="ID342D5070EDD54B489DA6F86D42000531"><enum>(2)</enum><header>Covered
entity</header><text>The term <term>covered entity</term> means—</text>
<subparagraph id="ID2039A7D7533048B8A500067671C89278"><enum>(A)</enum><text>a health
plan;</text>
</subparagraph><subparagraph id="IDC4BEEACFA3E2418900F1BDCFC26963B4"><enum>(B)</enum><text>a health care
clearinghouse; and</text>
</subparagraph><subparagraph id="ID69384CD273924F5DBBC22C6D98264470"><enum>(C)</enum><text>a health care
provider who transmits any health information in electronic form in connection
with a transaction covered by parts 160 through 164 of title 45, Code of
Federal Regulations.</text>
</subparagraph></paragraph><paragraph id="ID394300119392494800E7BCA83C31EC89"><enum>(3)</enum><header>Disclosure</header><text>The
term <term>disclosure</term> means the release, transfer, provision of access
to, or divulging in any other manner of information outside the entity holding
the information.</text>
</paragraph><paragraph id="ID1B3405D823B744AE9300D7AC04870013"><enum>(4)</enum><header>Employer</header><text>The
term <term>employer</term> has the meaning given that term in section 3401(d)
of the Internal Revenue Code of 1986.</text>
</paragraph><paragraph id="ID5897BCF932E5466892A1A86BEAA73415"><enum>(5)</enum><header>Group health
plan</header><text>The term <term>group health plan</term> means an employee
welfare benefit plan (as defined in section 3(1) of the Employee Retirement
Income and Security Act of 1974 (<external-xref legal-doc="usc" parsable-cite="usc/29/1002(1)">29 U.S.C. 1002(1)</external-xref>), including
insured and self-insured plans, to the extent that the plan provides medical
care (as defined in
<external-xref legal-doc="act" parsable-cite="PHSA/2791(a)(2)">section
2791(a)(2)</external-xref> of the <act-name parsable-cite="PHSA">Public Health
Service Act</act-name>,
<external-xref legal-doc="usc" parsable-cite="usc/42/300gg-91(a)(2)">42 U.S.C.
300gg–91(a)(2)</external-xref>), including items and services paid for as
medical care, to employees or their dependents directly or through insurance,
reimbursement, or otherwise, that—</text>
<subparagraph id="ID6CF63D7E2D78413D8483C47CB3052350"><enum>(A)</enum><text>has 50 or more
participants (as defined in section 3(7) of Employee Retirement Income and
Security Act of 1974,
<external-xref legal-doc="usc" parsable-cite="usc/29/1002(7)">29 U.S.C.
1002(7)</external-xref>); or</text>
</subparagraph><subparagraph id="IDF87BF5333F2E453D8FA68DF87E133B29"><enum>(B)</enum><text>is administered
by an entity other than the employer that established and maintains the
plan.</text>
</subparagraph></paragraph><paragraph id="IDB5562CE1D1D54E77AC882BA2096E14CC"><enum>(6)</enum><header>Health
care</header><text>The term <term>health care</term> includes, but is not
limited to, the following:</text>
<subparagraph id="ID138FEF2B404743AD8628CCFC1F130826"><enum>(A)</enum><text>Preventive,
diagnostic, therapeutic, rehabilitative, maintenance, or palliative care and
counseling, service, assessment, or procedure with respect to the physical or
mental condition, or functional status, of an individual or that affects the
structure or function of the body.</text>
</subparagraph><subparagraph id="IDC0084C812AD24D4DACB98D46F9D21BCC"><enum>(B)</enum><text>The sale or
dispensing of a drug, device, equipment, or other item in accordance with a
prescription.</text>
</subparagraph></paragraph><paragraph id="ID67EAA4C93E0E4094B501A7FBDFCCDE8D"><enum>(7)</enum><header>Health care
clearinghouse</header><text>The term <term>health care clearinghouse</term>
means a public or private entity, including a billing service, repricing
company, community health management information system or community health
information system, and value-added networks and switches, that—</text>
<subparagraph id="IDFE7FD145458C4056BCD100FE68F420E5"><enum>(A)</enum><text>processes or
facilitates the processing of health information received from another entity
in a nonstandard format or containing nonstandard data content into standard
data elements or a standard transaction; or</text>
</subparagraph><subparagraph id="IDBAFC29B31EBD4A8B8F7F1712B6EF82CF"><enum>(B)</enum><text>receives a
standard transaction from another entity and processes or facilitates the
processing of health information into nonstandard format or nonstandard data
content for the receiving entity.</text>
</subparagraph></paragraph><paragraph id="IDCCE43442C07F497D965390BCA92160BA"><enum>(8)</enum><header>Health care
provider</header><text>The term <term>health care provider</term> has the
meaning given the terms <term>provider of services</term> and <term>provider of
medical or health services</term> in subsections (u) and (s) of section 1861 of
the <act-name parsable-cite="SSA">Social Security Act</act-name>
(<external-xref legal-doc="usc" parsable-cite="usc/42/1395x">42 U.S.C.
1395x</external-xref>), respectively, and includes any other person or
organization who furnishes, bills, or is paid for health care in the normal
course of business.</text>
</paragraph><paragraph id="IDB528DD99885B42D092688E37429785BC"><enum>(9)</enum><header>Health
information</header><text>The term <term>health information</term> means any
information, whether oral or recorded in any form or medium, that—</text>
<subparagraph id="IDCAD063016D2E400094A2D9C299238CED"><enum>(A)</enum><text>is created or
received by a health care provider, health plan, public health authority,
employer, life insurer, school or university, or health care clearinghouse;
and</text>
</subparagraph><subparagraph id="IDE1FFA5A8F67C4A3CBF398B19470008AD"><enum>(B)</enum><text>relates to the
past, present, or future physical or mental health or condition of an
individual; the provision of health care to an individual; or the past,
present, or future payment for the provision of health care to an
individual.</text>
</subparagraph></paragraph><paragraph id="ID9B4491CE9E6544459457717247961F81"><enum>(10)</enum><header>Health
insurance issuer</header><text>The term <term>health insurance issuer</term>
means a health insurance issuer (as defined in
<external-xref legal-doc="act" parsable-cite="PHSA/2791(b)(2)">section
2791(b)(2)</external-xref> of the <act-name parsable-cite="PHSA">Public Health
Service Act</act-name>,
<external-xref legal-doc="usc" parsable-cite="usc/42/300gg-91(b)(2)">42 U.S.C.
300gg–91(b)(2)</external-xref>) and used in the definition of health plan in
this section and includes an insurance company, insurance service, or insurance
organization (including an HMO) that is licensed to engage in the business of
insurance in a State and is subject to State law that regulates insurance. Such
term does not include a group health plan.</text>
</paragraph><paragraph id="IDC254B7FE7B954553B152D9AEA8A8429C"><enum>(11)</enum><header>Health
maintenance organization</header><text>The term <term>health maintenance
organization</term> (HMO) (as defined in
<external-xref legal-doc="act" parsable-cite="PHSA/2791(b)(3)">section
2791(b)(3)</external-xref> of the <act-name parsable-cite="PHSA">Public Health
Service Act</act-name>,
<external-xref legal-doc="usc" parsable-cite="usc/42/300gg-91">42 U.S.C.
300gg–91</external-xref> (b)(3)) and used in the definition of health plan in
this section, means a federally qualified HMO, an organization recognized as an
HMO under State law, or a similar organization regulated for solvency under
State law in the same manner and to the same extent as such an HMO.</text>
</paragraph><paragraph id="IDE4F29446B43C4C37B03D5C3C94BD10A3"><enum>(12)</enum><header>Health
oversight agency</header><text>The term <term>health oversight agency</term>
means an agency or authority of the United States, a State, a territory, a
political subdivision of a State or territory, or an Indian tribe, or a person
or entity acting under a grant of authority from or contract with such public
agency, including the employees or agents of such public agency or its
contractors or persons or entities to whom it has granted authority, that is
authorized by law to oversee the health care system (whether public or private)
or government programs in which health information is necessary to determine
eligibility or compliance, or to enforce civil rights laws for which health
information is relevant.</text>
</paragraph><paragraph id="IDF3A1C98C011047AA9700695E0070BA4E"><enum>(13)</enum><header>Health
plan</header><text>The term <term>health plan</term> means an individual or
group plan that provides, or pays the cost of, medical care, as defined in
<external-xref legal-doc="act" parsable-cite="PHSA/2791(a)(2)">section
2791(a)(2)</external-xref> of the <act-name parsable-cite="PHSA">Public Health
Service Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/300gg">42 U.S.C. 300gg</external-xref>–91(a)(2))—</text>
<subparagraph id="IDCE4A1AF2A91640C0B86D659365429BDB"><enum>(A)</enum><text>including, singly
or in combination—</text>
<clause id="IDA8752991C1544DADA5C0195682203E05"><enum>(i)</enum><text>a
group health plan;</text>
</clause><clause id="ID2A52AAF2FF71479FA12978CB481BF95B"><enum>(ii)</enum><text>a
health insurance issuer;</text>
</clause><clause id="IDECCE4EEFF6824BC7AF5FA7F07C0028FF"><enum>(iii)</enum><text>an HMO;</text>
</clause><clause id="ID4F1915811DC84C818C462600CF40EBB5"><enum>(iv)</enum><text>part A or B of
the medicare program under title XVIII of the <act-name parsable-cite="SSA">Social Security Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/1395">42 U.S.C. 1395</external-xref> et
seq.);</text>
</clause><clause id="ID36B1111185B7454A9D532BA725C9022E"><enum>(v)</enum><text>the
medicaid program under title XIX of the <act-name parsable-cite="SSA">Social
Security Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/1396">42 U.S.C. 1396</external-xref> et seq.);</text>
</clause><clause id="ID65778E7E4CCF431993BDBABF2502C602"><enum>(vi)</enum><text>an
issuer of a medicare supplemental policy (as defined in
<external-xref legal-doc="act" parsable-cite="SSA/1882(g)(1)">section
1882(g)(1)</external-xref> of the <act-name parsable-cite="SSA">Social Security
Act</act-name>,
<external-xref legal-doc="usc" parsable-cite="usc/42/1395ss(g)(1)">42 U.S.C.
1395ss(g)(1)</external-xref>);</text>
</clause><clause id="IDD13B7DFBC2814CBFBB49B0B5B400E8DA"><enum>(vii)</enum><text>an issuer of a
long-term care policy, excluding a nursing home fixed-indemnity policy;</text>
</clause><clause id="IDB369ABC725474B77A9B317A6F2203BE5"><enum>(viii)</enum><text>an employee
welfare benefit plan or any other arrangement that is established or maintained
for the purpose of offering or providing health benefits to the employees of 2
or more employers;</text>
</clause><clause id="ID296B917184F040EBA8CA1077FCA18EC4"><enum>(ix)</enum><text>the health care
program for active military personnel under title 10, United States
Code;</text>
</clause><clause id="ID0B310151F3704F2EAB48C354AEDF0100"><enum>(x)</enum><text>the
veterans health care program under chapter 17 of title 38, United States
Code;</text>
</clause><clause id="ID33503755C6B74393B96E5B825D8C00C1"><enum>(xi)</enum><text>the Civilian
Health and Medical Program of the Uniformed Services (CHAMPUS) (as defined in
section 1072(4) of title 10, United States Code);</text>
</clause><clause id="ID3C91C8C3D238453EA5AC00F49D48ECA2"><enum>(xii)</enum><text>the Indian
Health Service program under the <act-name parsable-cite="IHCIA">Indian Health
Care Improvement Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/25/1601">25 U.S.C. 1601</external-xref> et seq.);</text>
</clause><clause id="ID28160F8EF1204DD69018D08C4EFF4925"><enum>(xiii)</enum><text>the Federal
Employees Health Benefits Program under chapter 89 of title 5, United States
Code;</text>
</clause><clause id="IDC1C260DD80C94A6B87EED157758832C7"><enum>(xiv)</enum><text>an approved
State child health plan under title XXI of the <act-name parsable-cite="SSA">Social Security Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/1397aa">42 U.S.C. 1397aa</external-xref>
et seq.), providing benefits for child health assistance that meet the
requirements of section 2103 of such Act (<external-xref legal-doc="usc" parsable-cite="usc/42/1397cc">42 U.S.C. 1397cc</external-xref>);</text>
</clause><clause id="IDC79FCE1F771C4B7688C69D76404C8C22"><enum>(xv)</enum><text>the
Medicare+Choice program under part C of title XVIII of the
<act-name parsable-cite="SSA">Social Security Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/1395w-21">42 U.S.C.
1395w–21</external-xref> et seq.);</text>
</clause><clause id="ID364B7898C8DC429D9C4E3FBB86F647CF"><enum>(xvi)</enum><text>a
high risk pool that is a mechanism established under State law to provide
health insurance coverage or comparable coverage to eligible individuals;
and</text>
</clause><clause id="ID521036CD62E7417294FD78F363BEC893"><enum>(xvii)</enum><text>any other
individual or group plan, or combination of individual or group plans, that
provides or pays for the cost of medical care (as defined in
<external-xref legal-doc="act" parsable-cite="PHSA/2791(a)(2)">section
2791(a)(2)</external-xref> of the <act-name parsable-cite="PHSA">Public Health
Service Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/300gg-91(a)(2)">42 U.S.C.
300gg–91(a)(2)</external-xref>); and</text>
</clause></subparagraph><subparagraph id="ID838F6BE98CBA41D784BE11E527F6C681"><enum>(B)</enum><text>excluding—</text>
<clause id="ID9D5CEA72980142E59BBF95CF1B277359"><enum>(i)</enum><text>any
policy, plan, or program to the extent that it provides, or pays for the cost
of, excepted benefits that are listed in
<external-xref legal-doc="act" parsable-cite="PHSA/2791(c)(1)">section
2791(c)(1)</external-xref> of the <act-name parsable-cite="PHSA">Public Health
Service Act</act-name> (<external-xref legal-doc="usc" parsable-cite="usc/42/300gg-91(c)(1)">42 U.S.C.
300gg–91(c)(1)</external-xref>); and</text>
</clause><clause id="ID5145975C1DE84377B0F73CBB96B41CB5"><enum>(ii)</enum><text>a
government-funded program (other than 1 listed in clause (i) through (xvi) of
subparagraph (A)), whose principal purpose is other than providing, or paying
the cost of, health care, or whose principal activity is the direct provision
of health care to persons, or the making of grants to fund the direct provision
of health care to persons.</text>
</clause></subparagraph></paragraph><paragraph id="ID0968E665C9CF46BBAFCC66BA2FEA1000"><enum>(14)</enum><header>Individually
identifiable health information</header><text>The term <term>individually
identifiable health information</term> means information that is a subset of
health information, including demographic information collected from an
individual, that—</text>
<subparagraph id="IDA122C6A7D0944A78A3824858B665EA7C"><enum>(A)</enum><text>is created or
received by a covered entity or employer; and</text>
</subparagraph><subparagraph id="ID9180AA5726EA4F35BB14ECC693B73659"><enum>(B)</enum><clause commented="no" display-inline="yes-display-inline" id="ID01C3C2008055435FBA6659502FE1009F"><enum>(i)</enum><text>relates to the past,
present, or future physical or mental health or condition of an individual, the
provision of health care to an individual, or the past, present, or future
payment for the provision of health care to an individual; and</text>
</clause><clause id="ID1DD711EC38334B8DA51995678F3D7E14" indent="up1"><enum>(ii)</enum><subclause commented="no" display-inline="yes-display-inline" id="IDD9642A329997458E8692C057A98BBC29"><enum>(I)</enum><text>identifies an
individual; or</text>
</subclause><subclause id="ID0AA8EACF572A460EBAE190B8701EAB7E" indent="up1"><enum>(II)</enum><text>with respect to which there is a
reasonable basis to believe that the information can be used to identify an
individual.</text>
</subclause></clause></subparagraph></paragraph><paragraph id="ID63E41450DC9C46CFBDAED5F2AEF1D071"><enum>(15)</enum><header>Law
enforcement official</header><text>The term <term>law enforcement
official</term> means an officer or employee of any agency or authority of the
United States, a State, a territory, a political subdivision of a State or
territory, or an Indian tribe, who is empowered by law to—</text>
<subparagraph id="IDCE50825FEDDB46ECA7B1CCBA04B18FED"><enum>(A)</enum><text>investigate or
conduct an official inquiry into a potential violation of law; or</text>
</subparagraph><subparagraph id="ID2136516D89BA486294BABF78743F6389"><enum>(B)</enum><text>prosecute or
otherwise conduct a criminal, civil, or administrative proceeding arising from
an alleged violation of law.</text>
</subparagraph></paragraph><paragraph id="ID56314263C6114BAE82F589887DD833D9"><enum>(16)</enum><header>Life
insurer</header><text>The term <term>life insurer</term> means a life insurance
company (as defined in section 816 of the Internal Revenue Code of 1986),
including the employees and agents of such company.</text>
</paragraph><paragraph id="ID7E63F84EFAA84777BDDA83D73F980834"><enum>(17)</enum><header>Marketing</header><text>The
term <term>marketing</term> means to make a communication about a product or
service that encourages recipients of the communication to purchase or use the
product or service.</text>
</paragraph><paragraph id="ID0DFA22AA5F2F4148B823FCBAAFE18BBD"><enum>(18)</enum><header>Noncovered
entity</header><text>The term <term>noncovered entity</term> means any person
or public or private entity that is not a covered entity, including but not
limited to a business associate of a covered entity, a covered entity if such
covered entity is acting as a business associate, a health researcher, school
or university, life insurer, employer, public health authority, health
oversight agency, or law enforcement official, or any person acting as an agent
of such entities or persons.</text>
</paragraph><paragraph id="IDE68C61CD9B40465B878DF6BF57A53DCC"><enum>(19)</enum><header>Organized
health care arrangement</header><text>The term <term>organized health care
arrangement</term> means—</text>
<subparagraph id="ID005FEBF094D944FFB442C79EE7CE86FF"><enum>(A)</enum><text>a clinically
integrated care setting in which individuals typically receive health care from
more than 1 health care provider;</text>
</subparagraph><subparagraph id="ID121ED3D4AEA748979CEF129620FEC15F"><enum>(B)</enum><text>an organized
system of health care in which more than 1 covered entity participates, and in
which the participating covered entities—</text>
<clause id="ID2FF08D5A46C24AD293707999C51703A2"><enum>(i)</enum><text>hold themselves
out to the public as participating in a joint arrangement; and</text>
</clause><clause id="ID1FDFB64E6D6B4827A573E52FB9EE7313"><enum>(ii)</enum><text>participate in
joint activities including at least—</text>
<subclause id="IDBF1FFADEC7554DE2B966C11C12EA8D3B"><enum>(I)</enum><text>utilization
review, in which health care decisions by participating covered entities are
reviewed by other participating covered entities or by a third party on their
behalf;</text>
</subclause><subclause id="IDAA64318D084A473E80FB92D26B7C7BB6"><enum>(II)</enum><text>quality
assessment and improvement activities, in which treatment provided by
participating covered entities is assessed by other participating covered
entities or by a third party on their behalf; or</text>
</subclause><subclause id="IDEB8919B63F4A469784D9878404C6237F"><enum>(III)</enum><text>payment
activities, if the financial risk for delivering health care is shared, in part
or in whole, by participating covered entities through the joint arrangement
and if protected health information created or received by a covered entity is
reviewed by other participating covered entities or by a third party on their
behalf for the purpose of administering the sharing of financial risk;</text>
</subclause></clause></subparagraph><subparagraph id="ID3E69F8A20A1A4FF3983DC56D22FFE0C3"><enum>(C)</enum><text>a group health
plan and a health insurance issuer or HMO with respect to such group health
plan, but only with respect to protected health information created or received
by such health insurance issuer or HMO that relates to individuals who are or
who have been participants or beneficiaries in such group health plan;</text>
</subparagraph><subparagraph id="ID71D0CE500716430E9C8D3831B207106B"><enum>(D)</enum><text>a group health
plan and 1 or more other group health plans each of which are maintained by the
same plan sponsor; or</text>
</subparagraph><subparagraph id="IDF9B6F4345B324BABA8D294D5EF79D4B0"><enum>(E)</enum><text>the group health
plans described in subparagraph (D) and health insurance issuers or HMOs with
respect to such group health plans, but only with respect to protected health
information created or received by such health insurance issuers or HMOs that
relates to individuals who are or have been participants or beneficiaries in
any of such group health plans.</text>
</subparagraph></paragraph><paragraph id="ID63D0DF66B8764428AA0700D125658525"><enum>(20)</enum><header>Protected
health information</header>
<subparagraph id="IDC92BFA60DD2845C19B5BD99E9803684C"><enum>(A)</enum><header>In
general</header><text>The term <term>protected health information</term> means
individually identifiable health information that, except as provided in
subparagraph (B), is—</text>
<clause id="ID3CFDF67FB35F4C17A3B368C2F6541EF0"><enum>(i)</enum><text>transmitted by
electronic media;</text>
</clause><clause id="ID3C8263ADDCDF46DF84705FD4E02898DE"><enum>(ii)</enum><text>maintained in
any medium described in the definition of electronic media in section 162.103
of title 45, Code of Federal Regulations; or</text>
</clause><clause id="ID9645FDA1E5DC46E589249E5D493C86FD"><enum>(iii)</enum><text>transmitted or
maintained in any other form or medium.</text>
</clause></subparagraph><subparagraph id="ID5CD3FB97AE2E47A5A51229801EFE0059"><enum>(B)</enum><header>Exclusions</header><text>Such
term does not include individually identifiable health information in—</text>
<clause id="IDCDCEC38D6E434D199100299BAD208362"><enum>(i)</enum><text>education records
covered by the Family Educational Rights and Privacy Act of 1974 (section 444
of the General Education Provisions Act (<external-xref legal-doc="usc" parsable-cite="usc/20/1232g">20 U.S.C. 1232g</external-xref>));</text>
</clause><clause id="IDE95BE9CDEE1F482C9926BF13EADF60A8"><enum>(ii)</enum><text>records
described in subsection (a)(4)(B)(iv) of that Act; or</text>
</clause><clause id="IDE4AF173A3F40453E8384E17649846119"><enum>(iii)</enum><text>employment
records held by a covered entity in its role as an employer.</text>
</clause></subparagraph></paragraph><paragraph id="ID751A1EB0D26E4EA2A38618320046C725"><enum>(21)</enum><header>Public health
authority</header><text>The term <term>public health authority</term> means an
agency or authority of the United States, a State, a territory, a political
subdivision of a State or territory, or an Indian tribe, or a person or entity
acting under a grant of authority from or contract with such public agency,
including employees or agents of such public agency or its contractors or
persons or entities to whom it has granted authority, that is responsible for
public health matters as part of its official mandate.</text>
</paragraph><paragraph id="IDFECEDFF5E4B9424CBA8461F010F8CC3E"><enum>(22)</enum><header>School or
university</header><text>The term <term>school or university</term> means an
institution or place for instruction or education, including an elementary
school, secondary school, or institution of higher learning, a college, or an
assemblage of colleges united under 1 corporate organization or
government.</text>
</paragraph><paragraph id="ID387A6A597FD844FFAEE5E784FD004816"><enum>(23)</enum><header>Secretary</header><text>The
term <term>Secretary</term> means the Secretary of Health and Human
Services.</text>
</paragraph><paragraph id="ID38FD09446E1442FF8315F46850161398"><enum>(24)</enum><header>Sale; sell;
sold</header><text>The terms <term>sale</term>, <term>sell</term>, and
<term>sold</term>, with respect to protected health information, mean the
exchange of such information for anything of value, directly or indirectly,
including the licensing, bartering, or renting of such information.</text>
</paragraph><paragraph id="ID876A9005514842A5AEB2661286BF74E2"><enum>(25)</enum><header>Use</header><text>The
term <term>use</term> means, with respect to individually identifiable health
information, the sharing, employment, application, utilization, examination, or
analysis of such information within an entity that maintains such
information.</text>
</paragraph><paragraph id="ID35EE1D64C1B543CCB49E5CECBB3F82B4"><enum>(26)</enum><header>Writing</header><text>The
term <term>writing</term> means writing in either a paper-based or
computer-based form, including electronic and digital signatures.</text>
</paragraph></section><section id="IDEEEAA5AEB97A4824BF498969FB5CB878"><enum>402.</enum><header>Prohibition
against selling protected health information</header>
<subsection id="ID03FBC462F57C4E5EA770A2179B58D188"><enum>(a)</enum><header>Valid
authorization required</header>
<paragraph id="ID88809458C0E644B198B7A51E93071502"><enum>(1)</enum><header>In
general</header><text>A noncovered entity shall not sell the protected health
information of an individual or use such information for marketing purposes
without an authorization that is valid under section 403. When a noncovered
entity obtains or receives authorization to sell such information, such sale
must be consistent with such authorization.</text>
</paragraph><paragraph id="ID6204DA23F7F64E6686F94201929D366F"><enum>(2)</enum><header>No duplicate
authorization required</header><text>Nothing in paragraph (1) shall be
construed as requiring a noncovered entity that receives from a covered entity
an authorization that is valid under section 403 to obtain a separate
authorization from an individual before the sale or use of the individual’s
protected health information so long as the sale or use of the information is
consistent with the terms of the authorization.</text>
</paragraph></subsection><subsection id="ID781B454BBCF84688B0775C60FC6D081F"><enum>(b)</enum><header>Scope</header><text>A
sale of protected health information as described under subsection (a) shall be
limited to the minimum amount of information necessary to accomplish the
purpose for which the sale is made.</text>
</subsection><subsection id="IDA0203D2FD3944BF9AA272B4776F18E28"><enum>(c)</enum><header>Purpose</header><text>A
recipient of information sold pursuant to this title may use or disclose such
information solely to carry out the purpose for which the information was
sold.</text>
</subsection><subsection id="IDA3D070942A1F4670ABFB5EAD899ED7B5"><enum>(d)</enum><header>Not
required</header><text>Nothing in this title permitting the sale of protected
health information shall be construed to require such sale.</text>
</subsection><subsection id="ID50EB9934B6A64B99A35B5B5663B3E6E0"><enum>(e)</enum><header>Identification
of information as protected health information</header><text>Information sold
pursuant to this title shall be clearly identified as protected health
information.</text>
</subsection><subsection id="IDF65128F8FBC948D78D4172B6115F1524"><enum>(f)</enum><header>No
waiver</header><text>Except as provided in this title, an individual’s
authorization to sell protected health information shall not be construed as a
waiver of any rights that the individual has under other Federal or State laws,
the rules of evidence, or common law.</text>
</subsection></section><section id="ID8AF4C2ADD2564C58995225877FB6E799"><enum>403.</enum><header>Authorization
for sale or marketing of protected health information by noncovered
entities</header>
<subsection id="ID25948847512649E49947CDCD5D701588"><enum>(a)</enum><header>Valid
authorization</header><text>A valid authorization is a document that complies
with all requirements of this section. Such authorization may include
additional information not required under this section, provided that such
information is not inconsistent with the requirements of this section.</text>
</subsection><subsection id="IDA8B2247EE6284E08B05B1EB943676F05"><enum>(b)</enum><header>Defective
authorization</header><text>An authorization is not valid, if the document
submitted has any of the following defects:</text>
<paragraph id="IDBE05F46099E145BA933CBC36737DEF06"><enum>(1)</enum><text>The expiration
date has passed or the expiration event is known by the noncovered entity to
have occurred.</text>
</paragraph><paragraph id="IDEE3F77B2090B4F42B0479DA69E20BA19"><enum>(2)</enum><text>The authorization
has not been filled out completely, with respect to an element described in
subsections (e) and (f).</text>
</paragraph><paragraph id="ID39125578A3E74F5FB250BFF4A9030027"><enum>(3)</enum><text>The authorization
is known by the noncovered entity to have been revoked.</text>
</paragraph><paragraph id="ID49D624A659C04BB794C8F85319164B59"><enum>(4)</enum><text>The authorization
lacks an element required by subsections (e) and (f).</text>
</paragraph><paragraph id="IDE75ED64C2C1E4D60AF9B46EDB6DE36E3"><enum>(5)</enum><text>Any material
information in the authorization is known by the noncovered entity to be
false.</text>
</paragraph></subsection><subsection id="IDE5878CF45B694A608221E65C8444C5C0"><enum>(c)</enum><header>Revocation of
authorization</header><text>An individual may revoke an authorization provided
under this section at any time provided that the revocation is in writing,
except to the extent that the noncovered entity has taken action in reliance
thereon.</text>
</subsection><subsection id="ID3973A187CBE6413AB7136B154016278F"><enum>(d)</enum><header>Documentation</header>
<paragraph id="IDB7F7A1576FC54935B2F2DED5D6D000D5"><enum>(1)</enum><header>In
general</header><text>A noncovered entity must document and retain any signed
authorization under this section as required under paragraph (2).</text>
</paragraph><paragraph id="ID7CE8E75ABC794776A7D1A0E228B73C59"><enum>(2)</enum><header>Standard</header><text>A
noncovered entity shall, if a communication is required by this title to be in
writing, maintain such writing, or an electronic copy, as documentation.</text>
</paragraph><paragraph id="IDC7E359EE0604442FAB4C01AC18422D99"><enum>(3)</enum><header>Retention
period</header><text>A noncovered entity shall retain the documentation
required by this section for 6 years from the date of its creation or the date
when it last was in effect, whichever is later.</text>
</paragraph></subsection><subsection id="IDA00D477601E1477F8300DDF6B5F0B2A5"><enum>(e)</enum><header>Content of
authorization</header>
<paragraph id="IDFC3D0D2B83E043818529DF8FAFF891DB"><enum>(1)</enum><header>Content</header><text>An
authorization described in subsection (a) shall—</text>
<subparagraph id="ID368ACF9A66454C21A2AED8EFAC03CAB9"><enum>(A)</enum><text>contain a
description of the information to be sold that identifies such information in a
specific and meaningful manner;</text>
</subparagraph><subparagraph id="IDD6055C065A254A0DA7BAD8336EA1E9D7"><enum>(B)</enum><text>contain the name
or other specific identification of the person, or class of persons, authorized
to sell the information;</text>
</subparagraph><subparagraph id="IDE956C8256C9845B483C4897F65BE17F4"><enum>(C)</enum><text>contain the name
or other specific identification of the person, or class of persons, to whom
the information is to be sold;</text>
</subparagraph><subparagraph id="ID7220DC30F9A749DBB4C9CA19EFA2AA00"><enum>(D)</enum><text>include an
expiration date or an expiration event relating to the selling of such
information that signifies that the authorization is valid until such date or
event;</text>
</subparagraph><subparagraph id="ID95FD15AE7837498689D743473FE7C63D"><enum>(E)</enum><text>include a
statement that the individual has a right to revoke the authorization in
writing and the exceptions to the right to revoke, and a description of the
procedure involved in such revocation;</text>
</subparagraph><subparagraph id="IDE8142FE1E91E4FC399BCEB46CBF28BDA"><enum>(F)</enum><text>be in writing and
include the signature of the individual and the date, or if the authorization
is signed by a personal representative of the individual, a description of such
representative’s authority to act for the individual; and</text>
</subparagraph><subparagraph id="IDE30BE634ED064B4587DB00EEECC40021"><enum>(G)</enum><text>include a
statement explaining the purpose for which such information is sold.</text>
</subparagraph></paragraph><paragraph id="ID3B53F7AE6040440FABBDE7ED310561AE"><enum>(2)</enum><header>Plain
language</header><text>The authorization shall be written in plain
language.</text>
</paragraph></subsection><subsection id="IDE7E0BC0B6D224B3F91AE92BAACF87691"><enum>(f)</enum><header>Notice</header>
<paragraph id="IDD50D793A6130454DB78363BD17BEDC61"><enum>(1)</enum><header>In
general</header><text>The authorization shall include a statement that the
individual may—</text>
<subparagraph id="IDE0D673F952014D3F892BB8ACADB0DC6E"><enum>(A)</enum><text>inspect or copy
the protected health information to be sold; and</text>
</subparagraph><subparagraph id="IDB761D09CD2904B60AEA87287DD001939"><enum>(B)</enum><text>refuse to sign
the authorization.</text>
</subparagraph></paragraph><paragraph id="IDED1439773A6B45D7A922A3C1C17D038B"><enum>(2)</enum><header>Copy to the
individual</header><text>A noncovered entity shall provide the individual with
a copy of the signed authorization.</text>
</paragraph></subsection><subsection id="ID446F0D2CD2D74051ACABBD39FF4B91BB"><enum>(g)</enum><header>Model
authorizations</header><text>The Secretary, after notice and opportunity for
public comment, shall develop and disseminate model written authorizations of
the type described in this section and model statements of the limitations on
such authorizations. Any authorization obtained on a model authorization form
developed by the Secretary pursuant to the preceding sentence shall be deemed
to satisfy the requirements of this section.</text>
</subsection><subsection id="IDBAFAD28797B7412796708FCC00B50475"><enum>(h)</enum><header>Noncoercion</header><text>A
covered entity or noncovered entity shall not condition the purchase of a
product or the provision of a service to an individual based on whether such
individual provides an authorization to such entity as described in this
section.</text>
</subsection></section><section id="ID3CD5702C81CD4C62BBEA3B18EB5D7C1D"><enum>404.</enum><header>Prohibition
against retaliation</header><text display-inline="no-display-inline">A
noncovered entity that collects protected health information, may not adversely
affect another person, directly or indirectly, because such person has
exercised a right under this title, disclosed information relating to a
possible violation of this title, or associated with, or assisted, a person in
the exercise of a right under this title.</text>
</section><section id="IDA9B18EE4B2BC45EFA57221C0916C0000"><enum>405.</enum><header>Rule of
construction</header><text display-inline="no-display-inline">The requirements
of this title shall not be construed to impose any additional requirements or
in any way alter the requirements imposed upon covered entities under parts 160
through 164 of title 45, Code of Federal Regulations.</text>
</section><section id="IDFB0ECF780BF14346B4D65CE2FBB6B073"><enum>406.</enum><header>Regulations</header>
<subsection id="IDB5135D93FADB49B5B3502CABFF48DB03"><enum>(a)</enum><header>In
general</header><text>The Secretary shall promulgate regulations implementing
the provisions of this title.</text>
</subsection><subsection id="IDB4BC137AE0DB499DA0A4506D105C6662"><enum>(b)</enum><header>Timeframe</header><text>Not
later than 1 year after the date of enactment of this Act, the Secretary shall
publish proposed regulations in the Federal Register. With regard to such
proposed regulations, the Secretary shall provide an opportunity for submission
of comments by interested persons during a period of not less than 90 days. Not
later than 2 years after the date of enactment of this Act, the Secretary shall
publish final regulations in the Federal Register.</text>
</subsection></section><section id="ID5887F594FB3F4FF6A576F2EB688EA670"><enum>407.</enum><header>Enforcement</header>
<subsection id="IDA12653D700CC485000C8967EAC38FD63"><enum>(a)</enum><header>In
general</header><text>A covered entity or noncovered entity that knowingly
violates section 402 shall be subject to a civil money penalty under this
section.</text>
</subsection><subsection id="IDF2F0CF87628D4441AB081913A3C26F89"><enum>(b)</enum><header>Amount</header><text>The
civil money penalty described in subsection (a) shall not exceed $100,000. In
determining the amount of any penalty to be assessed, the Secretary shall take
into account the previous record of compliance of the entity being assessed
with the applicable provisions of this title and the gravity of the
violation.</text>
</subsection><subsection id="IDE6F130BAD8F94A9183428FE2A2CAB242"><enum>(c)</enum><header>Administrative
review</header>
<paragraph id="IDCE8A2CBFC7B347888DFD894B707CA981"><enum>(1)</enum><header>Opportunity for
hearing</header><text>The entity assessed shall be afforded an opportunity for
a hearing by the Secretary upon request made within 30 days after the date of
the issuance of a notice of assessment. In such hearing the decision shall be
made on the record pursuant to section 554 of title 5, United States Code. If
no hearing is requested, the assessment shall constitute a final and
unappealable order.</text>
</paragraph><paragraph id="ID054A42DE90384FCEB9F29218115672A7"><enum>(2)</enum><header>Hearing
procedure</header><text>If a hearing is requested, the initial agency decision
shall be made by an administrative law judge, and such decision shall become
the final order unless the Secretary modifies or vacates the decision. Notice
of intent to modify or vacate the decision of the administrative law judge
shall be issued to the parties within 30 days after the date of the decision of
the judge. A final order which takes effect under this paragraph shall be
subject to review only as provided under subsection (d).</text>
</paragraph></subsection><subsection id="ID0523622B9FC54BAF998D556639008166"><enum>(d)</enum><header>Judicial
review</header>
<paragraph id="IDB2A9D197F83F4067BEDA58CDB594A290"><enum>(1)</enum><header>Filing of
action for review</header><text>Any entity against whom an order imposing a
civil money penalty has been entered after an agency hearing under this section
may obtain review by the United States district court for any district in which
such entity is located or the United States District Court for the District of
Columbia by filing a notice of appeal in such court within 30 days from the
date of such order, and simultaneously sending a copy of such notice by
registered mail to the Secretary.</text>
</paragraph><paragraph id="IDA7116AA8DBBF4424BE1B789B21D14217"><enum>(2)</enum><header>Certification
of administrative record</header><text>The Secretary shall promptly certify and
file in such court the record upon which the penalty was imposed.</text>
</paragraph><paragraph id="IDD4091F5748634F3B97D72200F663A3A9"><enum>(3)</enum><header>Standard for
review</header><text>The findings of the Secretary shall be set aside only if
found to be unsupported by substantial evidence as provided by section
706(2)(E) of title 5, United States Code.</text>
</paragraph><paragraph id="ID33B6D7CE4D9A4357A18526179F9F004F"><enum>(4)</enum><header>Appeal</header><text>Any
final decision, order, or judgment of the district court concerning such review
shall be subject to appeal as provided in chapter 83 of title 28 of such
Code.</text>
</paragraph></subsection><subsection id="ID94B5E688645241A4A62C5D60DA02D400"><enum>(e)</enum><header>Failure to pay
assessment; maintenance of action</header>
<paragraph id="IDA62C0BCF45D64371BE83F8A8E3B9F685"><enum>(1)</enum><header>Failure to pay
assessment</header><text>If any entity fails to pay an assessment after it has
become a final and unappealable order, or after the court has entered final
judgment in favor of the Secretary, the Secretary shall refer the matter to the
Attorney General who shall recover the amount assessed by action in the
appropriate United States district court.</text>
</paragraph><paragraph id="IDF5DE993F54E14A10A5E82475093CBB6D"><enum>(2)</enum><header>Nonreviewability</header><text>In
such action the validity and appropriateness of the final order imposing the
penalty shall not be subject to review.</text>
</paragraph></subsection><subsection id="ID0EF19C605BC4454F88E84F2B9C8E00B3"><enum>(f)</enum><header>Payment of
penalties</header><text>Except as otherwise provided, penalties collected under
this section shall be paid to the Secretary (or other officer) imposing the
penalty and shall be available without appropriation and until expended for the
purpose of enforcing the provisions with respect to which the penalty was
imposed.</text>
</subsection></section><enum>V</enum><header>Driver’s license
privacy</header>
<section id="ID83780817AFF14EA685FC794CE574E283"><enum>501.</enum><header>Driver’s
license privacy</header><text display-inline="no-display-inline">Section 2725
of title 18, United States Code, is amended by striking paragraphs (2) through
(4) and adding the following:</text>
<quoted-block id="ID2AD250BBB08B42319DACB9B173569FF2">
<paragraph id="IDF37E14E37D6243F7B604B5955B6191EF"><enum>(2)</enum><text><quote>person</quote>
means an individual, organization, or entity, but does not include a State or
agency thereof;</text>
</paragraph><paragraph id="ID91CF8422906243D48E762CBB9465A583"><enum>(3)</enum><text><quote>personal
information</quote> means information that identifies an individual, including
an individual’s photograph, social security number, driver identification
number, name, address (but not the 5-digit zip code), telephone number, medical
or disability information, any physical copy of a driver’s license, birth date,
information on physical characteristics, including height, weight, sex or eye
color, or any biometric identifiers on a license, including a finger print, but
not information on vehicular accidents, driving violations, and driver’s
status;</text>
</paragraph><paragraph id="ID9265C6E606554F45A632FA034FB438AF"><enum>(4)</enum><text><quote>highly
restricted personal information</quote> means an individual’s photograph or
image, social security number, medical or disability information, any physical
copy of a driver’s license, driver identification number, birth date,
information on physical characteristics, including height, weight, sex, or eye
color, or any biometric identifiers on a license, including a finger print;
and</text>
</paragraph><after-quoted-block>.</after-quoted-block></quoted-block>
</section><enum>VI</enum><header>Miscellaneous</header>
<section id="ID9CF07242AE2440F0971E9E63FB0672C3"><enum>601.</enum><header>Enforcement by
State Attorneys General</header>
<subsection id="ID36762692BDE1499880CD7B9C00C12811"><enum>(a)</enum><header>In
general</header>
<paragraph id="ID2BE7A3DA30174698919616509DAB6600"><enum>(1)</enum><header>Civil
actions</header><text>In any case in which the attorney general of a State has
reason to believe that an interest of the residents of that State has been or
is threatened or adversely affected by the engagement of any person in a
practice that is prohibited under title I, II, or IV of this Act or under any
amendment made by such a title, the State, as parens patriae, may bring a civil
action on behalf of the residents of the State in a district court of the
United States of appropriate jurisdiction to—</text>
<subparagraph id="IDBF164C04ADEE4C94A0E289187962EB65"><enum>(A)</enum><text>enjoin that
practice;</text>
</subparagraph><subparagraph id="ID72A419ED861F42FA87EB9037A5B9DAA9"><enum>(B)</enum><text>enforce
compliance with such titles or such amendments;</text>
</subparagraph><subparagraph id="IDD8921677B99C463A911BBD496E2EFB92"><enum>(C)</enum><text>obtain damage,
restitution, or other compensation on behalf of residents of the State;
or</text>
</subparagraph><subparagraph id="ID5704035819A94F86B86536184499B7E5"><enum>(D)</enum><text>obtain such other
relief as the court may consider to be appropriate.</text>
</subparagraph></paragraph><paragraph id="ID40E0FF536BFB4302AA1DC2083226E5AF"><enum>(2)</enum><header>Notice</header>
<subparagraph id="IDA38DA972C6F64F82BA2130B5F147C670"><enum>(A)</enum><header>In
general</header><text>Before filing an action under paragraph (1), the attorney
general of the State involved shall provide to the Attorney General—</text>
<clause id="ID7910C1EF46874EC0A6C5FD2F0936F4E4"><enum>(i)</enum><text>written notice of
the action; and</text>
</clause><clause id="IDAB9EF19184B74CB19F5BFAB4F8DFB21F"><enum>(ii)</enum><text>a
copy of the complaint for the action.</text>
</clause></subparagraph><subparagraph id="ID9B857F674766430186FF831B51F546FF"><enum>(B)</enum><header>Exemption</header>
<clause id="ID019413ACB47344769F4646827CA17E83"><enum>(i)</enum><header>In
general</header><text>Subparagraph (A) shall not apply with respect to the
filing of an action by an attorney general of a State under this subsection, if
the State attorney general determines that it is not feasible to provide the
notice described in such subparagraph before the filing of the action.</text>
</clause><clause id="IDE2870C20BCDF44CDA3FA000505717091"><enum>(ii)</enum><header>Notification</header><text>In
an action described in clause (i), the attorney general of a State shall
provide notice and a copy of the complaint to the Attorney General at the same
time as the State attorney general files the action.</text>
</clause></subparagraph></paragraph></subsection><subsection id="IDC8442F2EBCA54C468528EF00A6FEE8E2"><enum>(b)</enum><header>Intervention</header>
<paragraph id="ID4C3FFB06BCD1480D912FF7326FD9CA55"><enum>(1)</enum><header>In
general</header><text>On receiving notice under subsection (a)(2), the Attorney
General shall have the right to intervene in the action that is the subject of
the notice.</text>
</paragraph><paragraph id="IDD48AEF6B1AFE43BEB1E13669339D832E"><enum>(2)</enum><header>Effect of
intervention</header><text>If the Attorney General intervenes in an action
under subsection (a), the Attorney General shall have the right to be heard
with respect to any matter that arises in that action.</text>
</paragraph></subsection><subsection id="ID8004F62D9D42477BBAAFA747DACDAB2C"><enum>(c)</enum><header>Construction</header><text>For
purposes of bringing any civil action under subsection (a), nothing in this Act
shall be construed to prevent an attorney general of a State from exercising
the powers conferred on such attorney general by the laws of that State
to—</text>
<paragraph id="IDF8482C79D2284F23B3C095EAEF08C32E"><enum>(1)</enum><text>conduct
investigations;</text>
</paragraph><paragraph id="ID66FBCC1DB7EE44AF00AA31678DD162AB"><enum>(2)</enum><text>administer oaths
or affirmations; or</text>
</paragraph><paragraph id="IDA7DA9728C8DA4AFF941C0078CFB87863"><enum>(3)</enum><text>compel the
attendance of witnesses or the production of documentary and other
evidence.</text>
</paragraph></subsection><subsection id="ID46BA064263A94F9EB4045B89EEFF0726"><enum>(d)</enum><header>Actions by the
Attorney General of the United States</header><text>In any case in which an
action is instituted by or on behalf of the Attorney General for violation of a
practice that is prohibited under title I, II, IV, or V of this Act or under
any amendment made by such a title, no State may, during the pendency of that
action, institute an action under subsection (a) against any defendant named in
the complaint in that action for violation of that practice.</text>
</subsection><subsection id="ID107B6784C2FF464CA9295D20613000FE"><enum>(e)</enum><header>Venue; service
of process</header>
<paragraph id="ID2235410A86564E8EA28066C92314C561"><enum>(1)</enum><header>Venue</header><text>Any
action brought under subsection (a) may be brought in the district court of the
United States that meets applicable requirements relating to venue under
section 1391 of title 28, United States Code.</text>
</paragraph><paragraph id="ID17FFAFDD6C054956BE7773EEF8B6623B"><enum>(2)</enum><header>Service of
process</header><text>In an action brought under subsection (a), process may be
served in any district in which the defendant—</text>
<subparagraph id="ID3850BF31888540AB8E3584E11D1880FB"><enum>(A)</enum><text>is an inhabitant;
or</text>
</subparagraph><subparagraph id="IDEF2CDDB364AB4E56BA71CBE100EDF7F7"><enum>(B)</enum><text>may be
found.</text>
</subparagraph></paragraph></subsection></section><section id="ID7F2965FCD03540CCB224598EF052F142"><enum>602.</enum><header>Federal
injunctive authority</header><text display-inline="no-display-inline">In
addition to any other enforcement authority conferred under this Act or under
an amendment made by this Act, the Federal Government shall have injunctive
authority with respect to any violation of any provision of title I, II, or IV
of this Act or of any amendment made by such a title, without regard to whether
a public or private entity violates such provision.</text>
</section>