[Congressional Record Volume 145, Number 52 (Thursday, April 15, 1999)]
[Extensions of Remarks]
[Pages E667-E668]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]




          INTRODUCTION OF THE PERSONAL INFORMATION PRIVACY ACT

                                 ______
                                 

                         HON. GERALD D. KLECZKA

                              of wisconsin

                    in the house of representatives

                        Thursday, April 15, 1999

  Mr. KLECZKA. Mr. Speaker, information on the most personal aspects of 
our lives continues to be spread across the landscape. Once taken for 
granted, our wall of privacy is crumbling.
  Today, I am re-introducing the Personal Information Privacy Act. This 
legislation attempts to restore some control over the use of our 
personal information. The bill prevents credit bureaus from giving out 
Social Security numbers and prohibits the sale or purchase of any 
information that includes anyone's Social Security number unless they 
have written consent to do so.
  A merchant who requires a Social Security number on a check used for 
a purchase or a cable company who demands a Social Security number on 
an application for service will be prohibited from such practices or be 
charged with an unfair and deceptive business violation.
  Further, this bill prohibits any state department of motor vehicles 
from selling drivers' photographs and drivers lists containing Social 
Security numbers. In addition, marketers will not be able to sell 
consumers' purchasing experiences or credit transactions without prior 
approval.
  This bill also provides for civil and criminal penalties for 
violations. The criminal penalties are now possible because of action 
taken in the 105th Congress. Last year, Congress passed the Identity 
Theft and Assumption Deterrence Act, which, for the first time, 
criminalizes identity theft. Finally, victims of identity theft have a 
means to prosecute those who assume their identities and ruin their 
credit histories. While I am pleased that this legislation, which I 
cosponsored, was signed into law by President Clinton, I feel that 
further action is needed. We must pass legislation to prevent these 
crimes from occurring.
  This legislation is necessary because anyone's personal information 
is easily accessible, be it through the presentation of false 
identification or through the internet. The information can be as 
innocuous as a name, address, and phone number or as intrusive as a 
detailed summary of personal finances, including bank account balances 
and investment portfolios.
  One of the main reasons information is so accessible is that a 
person's Social Security number has become a personal identifier. Many 
private entities, from doctors to universities, now follow the example 
of the federal government by using the SSN as an identifier.
  Recently, the Government Accounting Office completed a report that 
states ``No single federal law regulates the overall uses of SSNs.'' It 
further notes that ``Businesses and governments are not limited to 
using SSNs for purposes required by federal law.'' Consequently, 
requiring a person's SSN, the key to a wealth of personal information, 
as a condition of doing business is now common practice.
  Mr. Speaker, this legislation is designed to curtail the rampant 
invasion of our privacy. What we buy and where we buy it is no one's 
business but our own. And, the unauthorized use and abuse of our Social 
Security number must stop. I urge all of my colleagues to cosponsor and 
support this legislation.


                         Section 1. Short Title

  The title of this Act is the ``Personal Information Privacy Act of 
1999.''


     Section 2. Confidential Treatment of Credit Header Information

  Section 2 would add a sentence to Sec. 603(d) of the Fair Credit 
Reporting Act (FCRA), 15 U.S.C. Sec. 1681a(d), which defines the term 
``consumer report'' for purposes of the FCRA. The team currently means, 
essentially, any communication of information by a consumer reporting 
agency about a consumer that is used or expected to be used as a factor 
in establishing the consumer's eligibility for credit, insurance, 
employment, or for any other legitimate business purpose. Under 
Sec. 604 of the FCRA, 15 U.S.C. Sec. 1681b, a consumer reporting agency 
may not furnish a consumer report except for specified purposes. The 
new sentence that Sec. 2 would add to the definition of ``consumer 
report'' provides: ``The term also includes any other identifying 
information of the consumer, except the name, address, and telephone 
number of the consumer if listed in a residential telephone directory 
available in the locality of the consumer.'' If this new sentence 
becomes law, then consumer reporting agencies would be prohibited from 
disclosing such identifying information except for a purpose specified 
in Sec. 604.


Section 3. Protecting Privacy by Prohibiting Use of the Social Security 
             Number for Commercial Purposes Without Consent

  This section would add a new section to the general administrative 
provisions of Title 11 of the Social Security Act, 42 U.S.C. 
Sec. Sec. 1301 et seq., prohibiting persons from buying or selling any 
information that includes an individual's social security account 
number (``SSN''), without the written consent of the individual. In 
addition, no person may use an individual's SSN for identification 
purposes without the written consent of the individual. In order for 
consent to be valid, the person desiring to use an individual's SSN 
must inform the individual of all the purposes for which the SSN will 
be utilized, the persons to whom the number will be known, and obtain 
the individual's consent in writing.
  These new prohibitions would not affect any statutorily authorized 
uses of the SSN under Sec. 205(c)(2) of the Social Security Act, 42 
U.S.C. Sec. 405(c)(2) (SSN used for Social Security wage records, and 
for various enumerated purposes by federal agencies and state and local 
governments), Sec. 7(a)(2) of the Privacy Act of 1974 (5 U.S.C. 552a 
note) (authorizing state and local governments to require disclosure of 
an individual's SSN if required by federal law or if the required 
disclosure was pursuant to a system of records in effect prior to 
January 1, 1975), or 26 U.S.C. Sec. 6109(d) (an individual's SSN is 
used for all identifying purposes specified in the Tax Code).
  Individuals are authorized to bring a civil action seeking equitable 
relief and damages in a U.S. District Court for violations of this 
section. Damages may include the greater of actual damages or 
liquidated damages of $25,000, or, in case of a willful violation 
resulting in profit or monetary gain, $50,000. The court may assess, 
against the respondent, reasonable attorney's fees and other litigation 
costs in cases where an individual prevails. A statute of limitation of 
3 years is provided. The remedies provided by this section are in 
addition to any other lawful remedies available to an individual.

  The Commissioner of Social Security is authorized to assess a civil 
money penalty of not more than $25,000 for each violation of this 
section, or in the case of violations found to constitute a general 
business practice, not more than $500,000. The enforcement procedures 
for civil money penalties are the same as set forth in section 1128A of 
the Social Security Act, 42 U.S.C. Sec. 1320a-7a(d), (e), (g), (k), (l) 
and the first sentence of (c). These set forth the criteria for 
determining the amount of the civil penalty, the investigation and 
injunction authority of the Commissioner, and courts of appeals review 
of civil money penalty determinations. Also applicable are the 
provisions of section 205(d) and (e) of the Social Security Act, 42 
U.S.C. Sec. 405(d) and (e), which authorize the Commissioner of Social 
Security to

[[Page E668]]

issue subpoenas during investigations, and provide for judicial 
enforcement of such subpoenas.
  The Commissioner of Social Security is directed to coordinate 
enforcement of the provisions of this section with the Justice 
Department's enforcement of criminal provisions relating to fraudulent 
identification documents, and with the Federal Trade Commission's 
jurisdiction relating to identity theft violations.
  The provisions of this section do not preclude state laws relating to 
protection of privacy that are consistent with this section. The 
effective date of this section would be two years after enactment of 
this bill.
  If a person refuses to do business with an individual because the 
individual will not consent to disclosure of this or her SSN, then such 
refusal will be considered an unfair or deceptive act of practice under 
section 5 of the Federal Trade Commission Act (15 U.S.C. Sec. 45). The 
Commission may issue a cease and desist order, violation of which is 
subject to civil money penalties of up to $10,000 per violation.


   Section 4. Restriction on Use of Social Security Numbers by State 
                     Departments of Motor Vehicles

  18 U.S.C. Sec. 2721(b) sets forth permissible uses of personal 
information obtained by a state department of motor vehicles. This 
section provides that, with respect to the SSN of an individual, such 
personal information may only be disclosed to a government agency, 
court or law enforcement agency in carrying out its functions to the 
extent permitted or required under section 205(c)(2) of the Social 
Security Act, 42 U.S.C. Sec. 405(c)(2), section 7a(2) of the Privacy 
Act of 2974, 5 U.S.C. Sec. 552a note, section 6109(d) of the Internal 
Revenue Code, or any other provision of law specifically identifying 
such use. This section would also prohibit the disclosure of SSNs by 
state departments of motor vehicles for bulk distributions for surveys, 
marketing or solicitations purposes.


 Section 5. Restriction on Use of Photographs by State Departments of 
                             Motor Vehicles

  Section 5(a) would add a new subsection to 18 U.S.C. Sec. 2721, which 
currently generally prohibits the release of certain personal 
information from state motor vehicle records. This new subsection would 
prohibit the release of an individual's photograph, in any form or 
format, by a state department of motor vehicles without the express 
written consent of the individual. An exception would be permitted for 
disclosure of an individual's photograph to a law enforcement agency of 
any government for a civil or criminal law enforcement activity if 
authorized by law and pursuant to a written request.
  Section 5(b) would make technical amendments to 18 U.S.C. 
Sec. 2721(a) and (b) to conform that section to the new provisions 
added by this section. It would also amend 18 U.S.C. Sec. 2722(a) to 
reference the new subsection (e) added by this section.


   Section 6. Repeal of Certain Provisions Relating to the Consumer 
 Reports in Connection with Certain Transactions Not Initiated by the 
                                Consumer

  Section 6(a) would amend Sec. 604(c) of the Fair Credit Reporting Act 
(FCRA), 15 U.S.C. Sec. 1681b(c), which governs prescreening to 
determine a consumer's eligibility for credit or insurance. 
Prescreening is a practice whereby a user of consumer reports, such as 
a lender or insurer, contacts a consumer reporting agency without 
having received an application for credit or insurance from a 
particular consumer. The user might submit a list of names and ask the 
agency to identify persons on he list who meet criteria that the user 
specifies. Or it might ask the consumer reporting agency to create its 
own list based on the user's criteria. Section 604(c) currently 
prohibits prescreening, except in two situations, to determine a 
consumer's eligibility for credit or insurance. It prohibits, in other 
words, except in two situations, a consumer reporting agency from 
furnishing a report on a consumer who has not applied for credit or 
insurance.
  The two situations in which it permits prescreening are when: (1) the 
consumer authorizes the consumer reporting agency to provide the 
report, or (2) the lender or insurer will make a firm offer to the 
consumer if prescreening shows the consumer eligible for credit or 
insurance, and the consumer has not previously asked to be excluded 
from prescreening done by the consumer reporting agency. Section 6(a) 
would, in effect, prohibit presceening in connection with credit and 
insurance except when authorized by the consumer. It would amend 
Sec. 604(c)(1) to provide that a consumer reporting agency would be 
permitted to furnish a consumer report in connection with a ``credit or 
insurance transaction that is not initiated by consumer only if the 
consumer provides express written authorization in accordance with 
paragraph (2). . . .'' ``Paragraph (2)'' refers to Sec. 604(c)(2) of 
the FCRA, which would be rewritten by Sec. 6(b) of the bill.
  Section 6(b) would rewrite Sec. 604(c)(2) to provide: ``No 
authorization referred to in paragraph (1) [Sec. 604(c)(1)] with 
respect to any consumer shall be effective unless the consumer received 
a notice before such authorization is provided which fully and fairly 
discloses, in accordance with regulations which the Federal Trade 
Commission and the Board of Governors of the Federal Reserve System 
shall jointly prescribe, what specifically is being authorized by the 
consumer and the potential positive and negative effects the provision 
of such authorization will have on the consumer.'' The regulations 
would have to require that the notice be prominently displayed on a 
separate document or, if the notice appears on a document with other 
information, that it be clear and conspicuous.
  Section 6(c) would repeal the provision, mentioned above, that allows 
consumers to exclude themselves from prescreening lists. The provision 
would be unnecessary if prescreening were prohibited except when a 
consumer had authorized it.


 Section 7. Sale or Transfer of Transaction or Experience Information 
                               Prohibited

  Section 7(a) would add a new Sec. 626 to the FCRA. New Sec. 626(a) 
would provide: ``No person doing business with a consumer may sell, 
transfer, or otherwise provide to any other person, for the purpose of 
marketing such information to any other person, any transaction or 
experience information relating to the consumer, without the consumer's 
express written consent.'' A consumer's consent would not be required 
for the sale, transfer, or provision of transaction or experience 
information for a purpose other than marketing.
  New Sec. 626(b) would define ``transaction or experience 
information'' as ``any information identifying the content or subject 
of 1 or more transactions between the consumer and a person doing 
business with a consumer. . . .'' Section 626(c) would allow six 
exceptions, where a consumer's consent would not be required for the 
provision of transaction or experience information: (1) communications 
``solely among persons related by common ownership or affiliated by 
corporate control,'' (2) information provided pursuant to court order 
or federal grand jury subpoena, (3) ``[i]nformation provided in 
connection with the licensing or registration by a government agency or 
department, or any transfer of such license or registration, of any 
personal property bought, sold, or transferred by the consumer,'' (4) 
``[i]nformation required to be provided in connection with any 
transaction in real estate,'' (5) ``[i]nformation required to be 
provided in connection with perfecting a security interest in personal 
property,'' and (6) ``[i]nformation relating to the amount of any 
transaction or any credit extended in connection with a transaction 
with a consumer.''
  Section 7(b) would make a technical amendment to Sec. 603(d)(2)(A) of 
the FCRA to ensure that it does not conflict with new Sec. 626, and 
Sec. 7(c) would make a clerical amendment to add a reference to new 
Sec. 626 to the table of sections for the FCRA.

                          ____________________