[Congressional Record Volume 144, Number 114 (Wednesday, September 2, 1998)]
[Senate]
[Pages S9879-S9881]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

      By Mr. D'AMATO:
  S. 2433. A bill to protect consumers and financial institutions by 
preventing personal financial information

[[Page S9880]]

from being obtained from financial institutions under false pretenses; 
to the Committee on Banking, Housing, and Urban Affairs.


                   financial information privacy act

  Mr. D'AMATO. Mr. President, I rise today to introduce important pro-
consumer legislation to protect the privacy of confidential financial 
information for every American. The Financial Information Privacy Act 
will make it a federal crime to obtain or attempt to obtain private 
consumer information from our nation's financial institutions through 
the use of false, fictitious or fraudulent statements.
  Mr. President, the exploitation of personal information by 
unscrupulous ``information brokers'' and individuals attempting to pry 
into the private financial affairs of others is an issue of vital 
concern to every American.
  A flourishing industry of ``information brokers'' has emerged as 
detailed in hearings held just last month by the House Banking 
Committee. These individuals use deceptive practices, such as lying 
about their identity on the phone, in order to obtain personal customer 
information for resale. Armed with personal information such as bank 
account balances, account numbers and transaction activity, this 
information can be used to build a profile of a consumer which can be 
bought and sold in the marketplace. Advances in technology have enabled 
information brokers to inexpensively create enormous databases of 
individual profiles and use the Internet to market their information 
worldwide.
  Mr. President, these same techniques are used by criminals to obtain 
information to create fraudulent credit applications that can quickly 
destroy a victims credit worthiness and require months of effort to 
clear up. The problem is growing exponentially. One of the leading 
credit reporting services reports that since 1992, the number of 
financial fraud cases where individuals have pretended to be another 
person has risen from 32,000 to more than 500,000 in 1997. I believe 
the evidence is clear that inadequate financial privacy laws are a 
significant factor in this rise. Americans demand and rightfully expect 
the privacy of personal financial information.
  While existing laws do provide protection against unfair and 
deceptive practices, there is no federal law that expressly prohibits 
acquiring personal customer account information under false pretenses. 
Banking groups and federal regulatory agencies have all testified that 
this legislation would be an important tool to protect consumers from 
the invasive practices of information brokers. Passage of this measure 
will make it clear that Congress will not tolerate this invasion of 
privacy and will do whatever is necessary to insure that the private 
financial information of our citizens remains private.
  Mr. President, in closing I want to comment Chairman Leach for his 
quick action in the House to move this measure forward. Working 
together with our House colleagues, we have an opportunity to greatly 
strengthen the privacy laws that safeguard the personal financial 
information of every American. I urge my colleagues to vote in favor of 
this vital legislation.
  I ask unanimous consent that the full text of this bill be printed in 
the Record.
  There being no objection, the bill was ordered to be printed in the 
Record, as follows:

                                S. 2433

       Be it enacted by the Senate and House of Representatives of 
     the United States of America in Congress assembled,

     SECTION 1. FINANCIAL INFORMATION PRIVACY.

       (a) In General.--The Consumer Credit Protection Act (15 
     U.S.C. 1601 et seq.) is amended by adding at the end the 
     following:

          ``TITLE X--FINANCIAL INFORMATION PRIVACY PROTECTION

``Sec.
``1001. Short title.
``1002. Definitions.
``1003. Privacy protection for customer information of financial 
              institutions.
``1004. Administrative enforcement.
``1005. Civil liability.
``1006. Criminal penalty.
``1007. Relation to State laws.
``1008. Agency guidance.

     ``Sec. 1001. Short title

       ``This title may be cited as the `Financial Information 
     Privacy Act'.

     ``Sec. 1002. Definitions

       ``For purposes of this title, the following definitions 
     shall apply:
       ``(1) Customer.--The term `customer' means, with respect to 
     a financial institution, any person (or authorized 
     representative of a person) to whom the financial institution 
     provides a product or service, including that of acting as a 
     fiduciary.
       ``(2) Customer information of a financial institution.--The 
     term `customer information of a financial institution' means 
     any information maintained by a financial institution which 
     is derived from the relationship between the financial 
     institution and a customer of the financial institution and 
     is identified with the customer.
       ``(3) Document.--The term `document' means any information 
     in any form.
       ``(4) Financial institution.--
       ``(A) In general.--The term `financial institution' means 
     any institution engaged in the business of providing 
     financial services to customers who maintain a credit, 
     deposit, trust, or other financial account or relationship 
     with the institution.
       ``(B) Certain financial institutions specifically 
     included.--The term `financial institution' includes any 
     depository institution (as defined in section 19(b)(1)(A) of 
     the Federal Reserve Act), any loan or finance company, any 
     credit card issuer or operator of a credit card system, and 
     any consumer reporting agency that compiles and maintains 
     files on consumers on a nationwide basis (as defined in 
     section 603(p)).
       ``(C) Further definition by regulation.--The Board of 
     Governors of the Federal Reserve System may prescribe 
     regulations further defining the term `financial 
     institution', in accordance with subparagraph (A), for 
     purposes of this title.

     ``Sec. 1003. Privacy protection for customer information of 
       financial institutions

       ``(a) Prohibition on Obtaining Customer Information by 
     False Pretenses.--It shall be a violation of this title for 
     any person to obtain or attempt to obtain, or cause to be 
     disclosed or attempt to cause to be disclosed to any person, 
     customer information of a financial institution relating to 
     another person--
       ``(1) by knowingly making a false, fictitious, or 
     fraudulent statement or representation to an officer, 
     employee, or agent of a financial institution with the intent 
     to deceive the officer, employee, or agent into relying on 
     that statement or representation for purposes of releasing 
     the customer information;
       ``(2) by knowingly making a false, fictitious, or 
     fraudulent statement or representation to a customer of a 
     financial institution with the intent to deceive the customer 
     into relying on that statement or representation for purposes 
     of releasing the customer information or authorizing the 
     release of such information; or
       ``(3) by knowingly providing any document to an officer, 
     employee, or agent of a financial institution, knowing that 
     the document is forged, counterfeit, lost, or stolen, was 
     fraudulently obtained, or contains a false, fictitious, or 
     fraudulent statement or representation, if the document is 
     provided with the intent to deceive the officer, employee, or 
     agent into relying on that document for purposes of releasing 
     the customer information.
       ``(b) Prohibition on Solicitation of a Person to Obtain 
     Customer Information From Financial Institution Under False 
     Pretenses.--It shall be a violation of this title to request 
     a person to obtain customer information of a financial 
     institution, knowing or consciously avoiding knowing that the 
     person will obtain, or attempt to obtain, the information 
     from the institution in any manner described in subsection 
     (a).
       ``(c) Nonapplicability to Law Enforcement Agencies.--No 
     provision of this section shall be construed so as to prevent 
     any action by a law enforcement agency, or any officer, 
     employee, or agent of such agency, to obtain customer 
     information of a financial institution in connection with the 
     performance of the official duties of the agency.
       ``(d) Nonapplicability to Financial Institutions in Certain 
     Cases.--No provision of this section shall be construed so as 
     to prevent any financial institution, or any officer, 
     employee, or agent of a financial institution, from obtaining 
     customer information of such financial institution in the 
     course of--
       ``(1) testing the security procedures or systems of such 
     institution for maintaining the confidentiality of customer 
     information;
       ``(2) investigating allegations of misconduct or negligence 
     on the part of any officer, employee, or agent of the 
     financial institution; or
       ``(3) recovering customer information of the financial 
     institution which was obtained or received by another person 
     in any manner described in subsection (a) or (b).
       ``(e) Nonapplicability to Certain Types of Customer 
     Information of Financial Institutions.--No provision of this 
     section shall be construed so as to prevent any person from 
     obtaining customer information of a financial institution 
     that otherwise is available as a public record filed pursuant 
     to the securities laws (as defined in section 3(a)(47) of the 
     Securities Exchange Act of 1934).

     ``Sec. 1004. Administrative enforcement

       ``(a) Enforcement by Federal Trade Commission.--Except as 
     provided in subsection (b), compliance with this title shall 
     be enforced by the Federal Trade Commission in the same 
     manner and with the same power and authority as the 
     Commission has under

[[Page S9881]]

     the title VIII, the Fair Debt Collection Practices Act, to 
     enforce compliance with such title.
       ``(b) Enforcement by Other Agencies in Certain Cases.--
       ``(1) In general.--Compliance with this title shall be 
     enforced under--
       ``(A) section 8 of the Federal Deposit Insurance Act, in 
     the case of--
       ``(i) national banks, and Federal branches and Federal 
     agencies of foreign banks, by the Office of the Comptroller 
     of the Currency;
       ``(ii) member banks of the Federal Reserve System (other 
     than national banks), branches and agencies of foreign banks 
     (other than Federal branches, Federal agencies, and insured 
     State branches of foreign banks), commercial lending 
     companies owned or controlled by foreign banks, and 
     organizations operating under section 25 or 25A of the 
     Federal Reserve Act, by the Board;
       ``(iii) banks insured by the Federal Deposit Insurance 
     Corporation (other than members of the Federal Reserve System 
     and national nonmember banks) and insured State branches of 
     foreign banks, by the Board of Directors of the Federal 
     Deposit Insurance Corporation; and
       ``(iv) savings associations the deposits of which are 
     insured by the Federal Deposit Insurance Corporation, by the 
     Director of the Office of Thrift Supervision; and
       ``(B) the Federal Credit Union Act, by the Administrator of 
     the National Credit Union Administration with respect to any 
     Federal credit union.
       ``(2) Violations of this title treated as violations of 
     other laws.--For the purpose of the exercise by any agency 
     referred to in paragraph (1) of its powers under any Act 
     referred to in that paragraph, a violation of this title 
     shall be deemed to be a violation of a requirement imposed 
     under that Act. In addition to its powers under any provision 
     of law specifically referred to in paragraph (1), each of the 
     agencies referred to in that paragraph may exercise, for the 
     purpose of enforcing compliance with this title, any other 
     authority conferred on such agency by law.
       ``(c) State Action for Violations.--
       ``(1) Authority of states.--In addition to such other 
     remedies as are provided under State law, if the chief law 
     enforcement officer of a State, or an official or agency 
     designated by a State, has reason to believe that any person 
     has violated or is violating this title, the State--
       ``(A) may bring an action to enjoin such violation in any 
     appropriate United States district court or in any other 
     court of competent jurisdiction;
       ``(B) may bring an action on behalf of the residents of the 
     State to recover damages of not more than $1,000 for each 
     violation; and
       ``(C) in the case of any successful action under 
     subparagraph (A) or (B), shall be awarded the costs of the 
     action and reasonable attorney fees as determined by the 
     court.
       ``(2) Rights of federal regulators.--
       ``(A) Prior notice.--The State shall serve prior written 
     notice of any action under paragraph (1) upon the Federal 
     Trade Commission and, in the case of an action which involves 
     a financial institution described in section 1004(b)(1), the 
     agency referred to in such section with respect to such 
     institution and provide the Federal Trade Commission and any 
     such agency with a copy of its complaint, except in any case 
     in which such prior notice is not feasible, in which case the 
     State shall serve such notice immediately upon instituting 
     such action.
       ``(B) Right to intervene.--The Federal Trade Commission or 
     an agency described in subsection (b) shall have the right--
       ``(i) to intervene in an action under paragraph (1);
       ``(ii) upon so intervening, to be heard on all matters 
     arising therein;
       ``(iii) to remove the action to the appropriate United 
     States district court; and
       ``(iv) to file petitions for appeal.
       ``(3) Investigatory powers.--For purposes of bringing any 
     action under this subsection, no provision of this subsection 
     shall be construed as preventing the chief law enforcement 
     officer, or an official or agency designated by a State, from 
     exercising the powers conferred on the chief law enforcement 
     officer or such official by the laws of such State to conduct 
     investigations or to administer oaths or affirmations or to 
     compel the attendance of witnesses or the production of 
     documentary and other evidence.
       ``(4) Limitation on state action while federal action 
     pending.--If the Federal Trade Commission or any agency 
     described in subsection (b) has instituted a civil action for 
     a violation of this title, no State may, during the pendency 
     of such action, bring an action under this section against 
     any defendant named in the complaint of the Federal Trade 
     Commission or such agency for any violation of this title 
     that is alleged in that complaint.

     ``Sec. 1005. Civil liability

       ``Any person, other than a financial institution, who fails 
     to comply with any provision of this title with respect to 
     any financial institution or any customer information of a 
     financial institution shall be liable to such financial 
     institution or the customer to whom such information relates 
     in an amount equal to the sum of the amounts determined under 
     each of the following paragraphs:
       ``(1) Actual damages.--The greater of--
       ``(A) the amount of any actual damage sustained by the 
     financial institution or customer as a result of such 
     failure; or
       ``(B) any amount received by the person who failed to 
     comply with this title, including an amount equal to the 
     value of any nonmonetary consideration, as a result of the 
     action which constitutes such failure.
       ``(2) Additional damages.--Such additional amount as the 
     court may allow.
       ``(3) Attorneys' fees.--In the case of any successful 
     action to enforce any liability under paragraph (1) or (2), 
     the costs of the action, together with reasonable attorneys' 
     fees.

     ``Sec. 1006. Criminal penalty

       ``(a) In General.--Whoever violates, or attempts to 
     violate, section 1003 shall be fined in accordance with title 
     18, United States Code, or imprisoned for not more than 5 
     years, or both.
       ``(b) Enhanced Penalty for Aggravated Cases.--Whoever 
     violates, or attempts to violate, section 1003 while 
     violating another law of the United States or as part of a 
     pattern of any illegal activity involving more than $100,000 
     in a 12-month period shall be fined twice the amount provided 
     in subsection (b)(3) or (c)(3) (as the case may be) of 
     section 3571 of title 18, United States Code, imprisoned for 
     not more than 10 years, or both.

     ``Sec. 1007. Relation to State laws

       ``(a) In General.--This title shall not be construed as 
     superseding, altering, or affecting the statutes, 
     regulations, orders, or interpretations in effect in any 
     State, except to the extent that such statutes, regulations, 
     orders, or interpretations are inconsistent with the 
     provisions of this title, and then only to the extent of the 
     inconsistency.
       ``(b) Greater Protection Under State Law.--For purposes of 
     this section, a State statute, regulation, order, or 
     interpretation is not inconsistent with the provisions of 
     this title if the protection such statute, regulation, order, 
     or interpretation affords any person is greater than the 
     protection provided under this title.

     ``Sec. 1008. Agency guidance

       ``In furtherance of the objectives of this title, each 
     Federal banking agency (as defined in section 3(z) of the 
     Federal Deposit Insurance Act) shall issue advisories to 
     depository institutions under the jurisdiction of the agency, 
     in order to assist such depository institutions in deterring 
     and detecting activities proscribed under section 1003.''.
       (b) Report to the Congress.--Before the end of the 18-month 
     period beginning on the date of the enactment of this Act, 
     the Comptroller General, in consultation with the Federal 
     Trade Commission, Federal banking agencies, and appropriate 
     Federal law enforcement agencies, shall submit to the 
     Congress a report on the following:
       (1) The efficacy and adequacy of the remedies provided in 
     the amendments made by subsection (a) in addressing attempts 
     to obtain financial information by fraudulent means or by 
     false pretenses.
       (2) Any recommendations for additional legislative or 
     regulatory action to address threats to the privacy of 
     financial information created by attempts to obtain 
     information by fraudulent means or false pretenses.
                                 ______