[Congressional Record Volume 148, Number 147 (Thursday, November 14, 2002)]
[Senate]
[Pages S11052-S11056]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]




             IDENTITY THEFT VICTIMS ASSISTANCE ACT OF 2002

  Mr. REID. Mr. President, I ask unanimous consent that the Senate 
proceed to the consideration of Calendar No. 382, S. 1742.
  The PRESIDING OFFICER. The clerk will report the bill by title.
  The assistant legislative clerk read as follows:

       A bill (S. 1742) to prevent the crime of identity theft, 
     mitigate the harm to individuals victimized by identity 
     theft, and for other purposes.

  There being no objection, the Senate proceeded to consider the 
bill which had been reported from the Committee on the Judiciary with 
an amendment to strike all after the enacting clause and inserting in 
lieu thereof the following:

  [Strike the part printed in black brackets and insert the part 
printed in italic.]

                                S. 1742

       Be it enacted by the Senate and House of Representatives of 
     the United States of America in Congress assembled,

     [SECTION 1. SHORT TITLE.

       [This Act may be cited as the ``Restore Your Identity Act 
     of 2001''.

     [SEC. 2. FINDINGS.

       [Congress finds that--
       [(1) the crime of identity theft is the fastest growing 
     crime in the United States;
       [(2) the Federal Trade Commission reports that between 
     March and June of 2001, the total number of identity theft 
     victims in the Commission's Complaint Clearinghouse System, 
     tallied from November 1999, increased from 45,593 to 69,370;
       [(3) consumer inquiries and complaints to the Federal Trade 
     Commission Identity Theft Hotline increased from 68,000 to 
     over 97,000 over the same 3-month period, and consumer calls 
     into the Hotline increased in the same period from 1,800 
     calls per week to over 2,000;
       [(4) the Federal Trade Commission estimates that the call 
     volume to the Identity Theft Hotline represents only 5 to 10 
     percent of the actual number of victims of identity theft;
       [(5) victims of identity theft often have extraordinary 
     difficulty restoring their credit and regaining control of 
     their identity because of the viral nature of identity theft;
       [(6) identity theft may be ruinous to the good name and 
     credit of consumers whose identities are misappropriated, and 
     victims of identity theft may be denied otherwise well-
     deserved credit, may have to spend enormous time, effort, and 
     sums of money to remedy their circumstances, and may suffer 
     extreme emotional distress including deep depression founded 
     in profound frustration as they address the array of problems 
     that may arise as a result of identity theft;
       [(7) victims are often required to contact numerous 
     Federal, State, and local law enforcement agencies, consumer 
     credit reporting agencies, and creditors over many years, as 
     each event of fraud arises;
       [(8) the Government, business entities, and credit 
     reporting agencies have a shared responsibility to assist 
     identity theft victims, to mitigate the harm that results 
     from fraud perpetrated in the victim's name;
       [(9) victims of identity theft need a nationally 
     standardized means of--
       [(A) reporting identity theft to law enforcement, consumer 
     credit reporting agencies, and business entities; and
       [(B) evidencing their true identity to business entities 
     and credit reporting agencies;
       [(10) one of the greatest law enforcement challenges posed 
     by identity theft is that stolen identities are often used to 
     perpetrate crimes in many different localities in different 
     States, and although identity theft is a Federal crime, most 
     often, State and local law enforcement agencies are 
     responsible for investigating and prosecuting the crimes; and
       [(11) the Federal Government should assist State and local 
     law enforcement agencies to effectively combat identity theft 
     and the associated fraud.

     [SEC. 3. DEFINITIONS.

       [In this Act, the following definitions shall apply:
       [(1) Business entity.--The term ``business entity'' means--
       [(A) a creditor, as that term is defined in section 103 of 
     the Truth in Lending Act (15 U.S.C. 1602);
       [(B) any financial information repository;
       [(C) any financial service provider; and
       [(D) any corporation, trust, partnership, sole 
     proprietorship, or unincorporated association (including 
     telecommunications, utilities, and other service providers).
       [(2) Consumer.--The term ``consumer'' means an individual.
       [(3) Financial information.--The term ``financial 
     information'' means information identifiable as relating to 
     an individual consumer that concerns the amount and 
     conditions of the assets, liabilities, or credit of the 
     consumer, including--
       [(A) account numbers and balances;
       [(B) nonpublic personal information, as that term is 
     defined in section 509 of the Gramm-Leach-Bliley Act (15 
     U.S.C. 6809); and
       [(C) codes, passwords, social security numbers, tax 
     identification numbers, State identifier numbers issued by a 
     State department of licensing, and other information used for 
     the purpose of account access or transaction initiation.
       [(4) Financial information repository.--The term 
     ``financial information repository'' means a person engaged 
     in the business of providing services to consumers who have a 
     credit, deposit, trust, stock, or other financial services 
     account or relationship with that person.
       [(5) Identity theft.--The term ``identity theft'' means an 
     actual or potential violation of section 1028 of title 28, 
     United States Code, or any other similar provision of Federal 
     or State law.
       [(6) Means of identification.--The term ``means of 
     identification'' has the meanings given the terms 
     ``identification document'' and ``means of identification'' 
     in section 1028 of title 18, United States Code.
       [(7) Victim.--The term ``victim'' means a consumer whose 
     means of identification or financial information has been 
     used or transferred (or has been alleged to have been used or 
     transferred) without the authority of that consumer with the 
     intent to commit, or to aid or abet, identity theft or any 
     other violation of law.

     [SEC. 4. IDENTITY THEFT TREATED AS RACKETEERING ACTIVITY.

       [Section 1961(1)(B) of title 18, United States Code, is 
     amended by inserting ``, or any similar offense chargeable 
     under State law'' after ``identification documents)''.

     [SEC. 5. TREATMENT OF IDENTITY THEFT MITIGATION.

       [(a) Information Available to Victims.--
       [(1) In general.--A business entity possessing information 
     relating to an identity theft, or who may have entered into a 
     transaction, provided credit, products, goods, or services, 
     accepted payment, or otherwise done business with a person 
     that has made unauthorized use of the means of identification 
     of the victim, shall, not later than 10 days after receipt of 
     a written request by the victim, provide, without charge, to 
     the victim or to any Federal, State, or local governing law 
     enforcement agency or officer specified by the victim copies 
     of all related application and transaction information and 
     any information required pursuant to subsection (b).
       [(2) Rule of construction.--Nothing in this section 
     requires a business entity to disclose information that the 
     business entity is otherwise prohibited from disclosing under 
     any other provision of Federal or State law, except that any 
     such provision of law that prohibits the disclosure of 
     financial information to third parties shall not be used to 
     deny disclosure of information to the victim under this 
     section.
       [(b) Verification of Identity.--
       [(1) In general.--Unless a business entity is otherwise 
     able to verify the identity of a victim making a request 
     under subsection (a)(1), the victim shall provide to the 
     business entity as proof of positive identification, at the 
     election of the business entity--
       [(A) a copy of a police report evidencing the claim of the 
     victim of identity theft;
       [(B) a copy of a standardized affidavit of identity theft 
     developed and made available by the Federal Trade Commission; 
     or
       [(C) any affidavit of fact that is acceptable to the 
     business entity for that purpose.
       [(c) Limitation on Liability.--No business entity may be 
     held liable for an action taken in good faith to provide 
     information under this section with respect to an individual 
     in connection with an identity theft to other financial 
     information repositories, financial service providers, 
     merchants, law enforcement authorities, victims, or any 
     person alleging to be a victim, if--
       [(1) the business entity complies with subsection (b); and
       [(2) such action was taken--
       [(A) for the purpose of identification and prosecution of 
     identity theft; or
       [(B) to assist a victim in recovery of fines, restitution, 
     rehabilitation of the credit of the victim, or such other 
     relief as may be appropriate.
       [(d) Authority To Decline To Provide Information.--A 
     business entity may decline

[[Page S11053]]

     to provide information pursuant to subsection (a) if, in the 
     exercise of good faith and reasonable judgment, the business 
     entity believes that--
       [(1) this section does not require disclosure of the 
     information; or
       [(2) the request for the information is based on a 
     misrepresentation of fact by the victim relevant to the 
     request for information.
       [(e) No New Recordkeeping Obligation.--Nothing in this 
     section creates an obligation on the part of a business 
     entity to retain or maintain information or records that are 
     not otherwise required to be retained or maintained in the 
     ordinary course of its business or under other applicable 
     law.

     [SEC. 6. AMENDMENTS TO THE FAIR CREDIT REPORTING ACT.

       [(a) Consumer Reporting Agency Blocking of Information 
     Resulting From Identity Theft.--Section 611 of the Fair 
     Credit Reporting Act (15 U.S.C. 1681i) is amended by adding 
     at the end the following:
       [``(e) Block of Information Resulting From Identity 
     Theft.--
       [``(1) Block.--Not later than 30 days after the date of 
     receipt of proof of the identity of a consumer and an 
     official copy of a police report evidencing the claim of the 
     consumer of identity theft, a consumer reporting agency shall 
     permanently block the reporting of any information identified 
     by the consumer in the file of the consumer resulting from 
     the identity theft, so that the information cannot be 
     reported, except as provided in paragraph (3).
       [``(2) Notification.--A consumer reporting agency shall 
     promptly notify the furnisher of information identified by 
     the consumer under paragraph (1) that the information may be 
     a result of identity theft, that a police report has been 
     filed, that a block has been requested under this subsection, 
     and the effective date of the block.
       [``(3) Authority to decline or rescind.--
       [``(A) In general.--A consumer reporting agency may decline 
     to block, or may rescind any block, of consumer information 
     under this subsection if--
       [``(i) in the exercise of good faith and reasonable 
     judgment, the consumer reporting agency believes that--

       [``(I) the information was blocked due to a 
     misrepresentation of fact by the consumer relevant to the 
     request to block; or
       [``(II) the consumer knowingly obtained possession of 
     goods, services, or moneys as a result of the blocked 
     transaction or transactions, or the consumer should have 
     known that the consumer obtained possession of goods, 
     services, or moneys as a result of the blocked transaction or 
     transactions; or

       [``(ii) the consumer agrees that the blocked information or 
     portions of the blocked information were blocked in error.
       [``(B) Notification to consumer.--If the block of 
     information is declined or rescinded under this paragraph, 
     the affected consumer shall be notified promptly, in the same 
     manner as consumers are notified of the reinsertion of 
     information pursuant to subsection (a)(5)(B).
       [``(C) Significance of block.--For purposes of this 
     paragraph, the prior presence of blocked information in the 
     file of a consumer is not evidence of whether the consumer 
     knew or should have known that the consumer obtained 
     possession of any goods, services, or monies as a result of 
     the block.''.
       [(b) Statute of Limitations.--Section 618 of the Fair 
     Credit Reporting Act (15 U.S.C. 1681p) is amended by striking 
     ``jurisdiction'' and all that follows through ``years after'' 
     and inserting ``jurisdiction, not later than 2 years after''.

     [SEC. 7. COMMISSION STUDY OF COORDINATION BETWEEN FEDERAL, 
                   STATE, AND LOCAL AUTHORITIES IN ENFORCING 
                   IDENTITY THEFT LAWS.

       [(a) Membership.--Section 2(b) of the Internet False 
     Identification Prevention Act of 2000 (18 U.S.C. 1028 note) 
     is amended by inserting ``the Postmaster General, the 
     Commissioner of the United States Customs Service,'' after 
     ``Trade Commissioner''.
       [(b) Consultation.--Section 2 of the Internet False 
     Identification Prevention Act of 2000 (18 U.S.C. 1028 note) 
     is amended--
       [(1) by redesignating subsection (d) as subsection (e); and
       [(2) by inserting after subsection (c) the following:
       [``(d) Consultation.--The coordinating committee shall 
     consult with interested parties, including State and local 
     law enforcement agencies, State attorneys general, 
     representatives of business entities (as that term is defined 
     in section 4 of the Restore Your Identity Act of 2001), 
     including telecommunications and utility companies, and 
     organizations representing consumers.''.
       [(c) Report Contents.--Section 2(e) of the Internet False 
     Identification Prevention Act of 2000 (18 U.S.C. 1028 note) 
     (as redesignated by this section) is amended--
       [(1) in subparagraph (E), by striking ``and'' at the end; 
     and
       [(2) by striking subparagraph (F) and inserting the 
     following:
       [``(F) a comprehensive description of Federal assistance to 
     address identity theft provided to State and local law 
     enforcement agencies;
       [``(G) a comprehensive description of coordination 
     activities between Federal, State, and local law enforcement 
     agencies in regard to addressing identity theft and 
     recommendations, if any, for legislative changes that could 
     facilitate more effective investigation and prosecution of 
     the creation and distribution of false identification 
     documents;
       [``(H) a comprehensive description of how the Federal 
     Government can best provide to State and local law 
     enforcement agencies timely and current information regarding 
     terrorists or terrorist activity where such information 
     specifically relates to identity theft; and
       [``(I) recommendations, if any, for legislative or 
     administrative changes that would--
       [``(i) facilitate more effective investigation and 
     prosecution of cases involving identity theft;
       [``(ii) improve the effectiveness of Federal assistance to 
     State and local law enforcement agencies and coordination 
     between Federal, State, and local law enforcement agencies;
       [``(iii) simplify efforts by a person necessary to rectify 
     the harm that results from the theft of the identity of the 
     person; and
       [``(iv) if deemed appropriate, provide for the 
     establishment of a Federal identity theft and false 
     identification office or agency.''.

     [SEC. 8. ENFORCEMENT BY STATE ATTORNEYS GENERAL.

       [(a) In General.--
       [(1) Civil actions.--In any case in which the attorney 
     general of a State has reason to believe that an interest of 
     the residents of that State has been or is threatened or 
     adversely affected by the engagement of any person in a 
     practice that is prohibited under this Act or under any 
     amendment made by this Act, the State, as parens patriae, may 
     bring a civil action on behalf of the residents of the State 
     in a district court of the United States of appropriate 
     jurisdiction to--
       [(A) enjoin that practice;
       [(B) enforce compliance with this Act or the amendments 
     made by this Act;
       [(C) obtain damage, restitution, or other compensation on 
     behalf of residents of the State; or
       [(D) obtain such other relief as the court may consider to 
     be appropriate.
       [(2) Notice.--
       [(A) In general.--Before filing an action under paragraph 
     (1), the attorney general of the State involved shall provide 
     to the Attorney General of the United States--
       [(i) written notice of the action; and
       [(ii) a copy of the complaint for the action.
       [(B) Exemption.--
       [(i) In general.--Subparagraph (A) shall not apply with 
     respect to the filing of an action by an attorney general of 
     a State under this subsection, if that attorney general 
     determines that it is not feasible to provide the notice 
     described in subparagraph (A) before the filing of the 
     action.
       [(ii) Notification.--In an action described in clause (i), 
     the attorney general of a State shall provide notice and a 
     copy of the complaint to the Attorney General of the United 
     States at the same time as the action is filed.
       [(b) Intervention.--
       [(1) In general.--On receiving notice of an action under 
     subsection (a)(2), the Attorney General of the United States 
     shall have the right to intervene in that action.
       [(2) Effect of intervention.--If the Attorney General of 
     the United States intervenes in an action under subsection 
     (a), the Attorney General shall have the right to be heard 
     with respect to any matter that arises in that action.
       [(c) Construction.--For purposes of bringing any civil 
     action under subsection (a), nothing in this Act or the 
     amendments made by this Act shall be construed to prevent an 
     attorney general of a State from exercising the powers 
     conferred on such attorney general by the laws of that 
     State--
       [(1) to conduct investigations;
       [(2) to administer oaths or affirmations; or
       [(3) to compel the attendance of witnesses or the 
     production of documentary and other evidence.
       [(d) Actions by the Attorney General of the United 
     States.--In any case in which an action is instituted by or 
     on behalf of the Attorney General of the United States for 
     violation of a practice that is prohibited under this Act or 
     under any amendment made by this Act, no State may, during 
     the pendency of that action, institute an action under 
     subsection (a) against any defendant named in the complaint 
     in that action for violation of that practice.
       [(e) Venue; Service of Process.--
       [(1) Venue.--Any action brought under subsection (a) may be 
     brought in the district court of the United States that meets 
     applicable requirements relating to venue under section 1391 
     of title 28, United States Code.
       [(2) Service of process.--In an action brought under 
     subsection (a), process may be served in any district in 
     which the defendant--
       [(A) is an inhabitant; or
       [(B) may be found.]

     SECTION 1. SHORT TITLE.

       This Act may be cited as the ``Identity Theft Victims 
     Assistance Act of 2002''.

     SEC. 2. FINDINGS.

       Congress finds that--
       (1) the crime of identity theft is the fastest growing 
     crime in the United States;
       (2) victims of identity theft often have extraordinary 
     difficulty restoring their credit and regaining control of 
     their identity because of the viral nature of identity theft;
       (3) identity theft may be ruinous to the good name and 
     credit of consumers whose identities are misappropriated, and 
     victims of identity theft may be denied otherwise well-
     deserved

[[Page S11054]]

     credit, may have to spend enormous time, effort, and sums of 
     money to remedy their circumstances, and may suffer extreme 
     emotional distress including deep depression founded in 
     profound frustration as they address the array of problems 
     that may arise as a result of identity theft;
       (4) victims are often required to contact numerous Federal, 
     State, and local law enforcement agencies, consumer credit 
     reporting agencies, and creditors over many years, as each 
     event of fraud arises;
       (5) the Government, business entities, and credit reporting 
     agencies have a shared responsibility to assist identity 
     theft victims, to mitigate the harm that results from fraud 
     perpetrated in the victim's name;
       (6) victims of identity theft need a nationally 
     standardized means of--
       (A) reporting identity theft to consumer credit reporting 
     agencies and business entities; and
       (B) evidencing their true identity and claim of identity 
     theft to consumer credit reporting agencies and business 
     entities;
       (7) one of the greatest law enforcement challenges posed by 
     identity theft is that stolen identities are often used to 
     perpetrate crimes in many different localities in different 
     States, and although identity theft is a Federal crime, most 
     often, State and local law enforcement agencies are 
     responsible for investigating and prosecuting the crimes; and
       (8) the Federal Government should assist State and local 
     law enforcement agencies to effectively combat identity theft 
     and the associated fraud.

     SEC. 3. DEFINITIONS.

       In this Act, the following definitions shall apply:
       (1) Business entity.--The term ``business entity'' means--
       (A) a creditor, as that term is defined in section 103 of 
     the Truth in Lending Act (15 U.S.C. 1602);
       (B) any financial information repository;
       (C) any financial service provider; and
       (D) any corporation, trust, partnership, sole 
     proprietorship, or unincorporated association (including 
     telecommunications, utilities, and other service providers).
       (2) Consumer.--The term ``consumer'' means an individual.
       (3) Financial information.--The term ``financial 
     information'' means information identifiable as relating to 
     an individual consumer that concerns the amount and 
     conditions of the assets, liabilities, or credit of the 
     consumer, including--
       (A) account numbers and balances;
       (B) nonpublic personal information, as that term is defined 
     in section 509 of the Gramm-Leach-Bliley Act (15 U.S.C. 
     6809); and
       (C) codes, passwords, social security numbers, tax 
     identification numbers, State identifier numbers issued by a 
     State department of licensing, and other information used for 
     the purpose of account access or transaction initiation.
       (4) Financial information repository.--The term ``financial 
     information repository'' means a person engaged in the 
     business of providing services to consumers who have a 
     credit, deposit, trust, stock, or other financial services 
     account or relationship with that person.
       (5) Identity theft.--The term ``identity theft'' means an 
     actual or potential violation of section 1028 of title 18, 
     United States Code, or any other similar provision of Federal 
     or State law.
       (6) Means of identification.--The term ``means of 
     identification'' has the meanings given the terms 
     ``identification document'' and ``means of identification'' 
     in section 1028 of title 18, United States Code.
       (7) Victim.--The term ``victim'' means a consumer whose 
     means of identification or financial information has been 
     used or transferred (or has been alleged to have been used or 
     transferred) without the authority of that consumer with the 
     intent to commit, or to aid or abet, identity theft or any 
     other violation of law.

     SEC. 4. TREATMENT OF IDENTITY THEFT MITIGATION.

       Section 1028 of title 18, United States Code, is amended by 
     adding at the end the following:
       ``(i) Treatment of Identity Theft Mitigation.--
       ``(1) Information available to victims.--
       ``(A) In general.--A business entity that possesses 
     information relating to an alleged identity theft, or that 
     has entered into a transaction, provided credit, products, 
     goods, or services, accepted payment, or otherwise done 
     business with a person that has made unauthorized use of the 
     means of identification of the victim, shall, not later than 
     20 days after the receipt of a written request by the victim 
     under paragraph (2), provide, without charge, a copy of all 
     application and transaction information related to the 
     transaction being alleged as a potential or actual identity 
     theft to--
       ``(i) the victim;
       ``(ii) any Federal, State, or local governing law 
     enforcement agency or officer specified by the victim; or
       ``(iii) any law enforcement agency investigating the 
     identity theft and authorized by the victim to take receipt 
     of records provided under this subsection.
       ``(B) Rule of construction.--
       ``(i) In general.--No provision of Federal or State law 
     prohibiting the disclosure of financial information to third 
     parties shall be used to deny disclosure of information to 
     the victim under this subsection.
       ``(ii) Limitation.--Except as provided in clause (i), 
     nothing in this subsection requires a business entity to 
     disclose information that the business entity is otherwise 
     prohibited from disclosing under any other provision of 
     Federal or State law.
       ``(2) Verification of identity and claim.--Unless a 
     business entity, at its discretion, is otherwise able to 
     verify the identity of a victim making a request under 
     subsection (a)(1), the victim shall provide to the business 
     entity--
       ``(A) as proof of positive identification--
       ``(i) the presentation of a government-issued 
     identification card;
       ``(ii) if providing proof by mail, a copy of a government-
     issued identification card; or
       ``(iii) upon the request of the person seeking business 
     records, the business entity may inform the requesting person 
     of the categories of identifying information that the 
     unauthorized person provided the business entity as 
     personally identifying information, and may require the 
     requesting person to provide identifying information in those 
     categories; and
       ``(B) as proof of a claim of identity theft, at the 
     election of the business entity--
       ``(i) a copy of a police report evidencing the claim of the 
     victim of identity theft;
       ``(ii) a copy of a standardized affidavit of identity theft 
     developed and made available by the Federal Trade Commission; 
     or
       ``(iii) any affidavit of fact that is acceptable to the 
     business entity for that purpose.
       ``(3) Limitation on liability.--No business entity may be 
     held liable for a disclosure, made in good faith and 
     reasonable judgment, to provide information under this 
     section with respect to an individual in connection with an 
     identity theft to other financial information repositories, 
     financial service providers, merchants, law enforcement 
     authorities, victims, or any person alleging to be a victim, 
     if--
       ``(A) the business entity complies with paragraph (2); and
       ``(B) such disclosure was made--
       ``(i) for the purpose of detection, investigation, or 
     prosecution of identity theft; or
       ``(ii) to assist a victim in recovery of fines, 
     restitution, rehabilitation of the credit of the victim, or 
     such other relief as may be appropriate.
       ``(4) Authority to decline to provide information.--A 
     business entity may decline to provide information pursuant 
     to paragraph (1) if, in the exercise of good faith and 
     reasonable judgment, the business entity believes that--
       ``(A) this subsection does not require disclosure of the 
     information; or
       ``(B) the request for the information is based on a 
     misrepresentation of fact by the victim relevant to the 
     request for information.
       ``(5) No new recordkeeping obligation.--Nothing in this 
     subsection creates an obligation on the part of a business 
     entity to obtain, retain, or maintain information or records 
     that are not otherwise required to be retained or maintained 
     in the ordinary course of its business or under other 
     applicable law.
       ``(6) Notification system.--
       ``(A) In general.--A business entity may establish and 
     maintain a notification system for the business entity to 
     comply with this subsection, including a toll-free telephone 
     number and a mailing address.
       ``(B) Requirements.--A notification system under 
     subparagraph (A) shall permit any person to make a request 
     to, or to correspond with, the business entity under this 
     subsection, provided that--
       ``(i) the business entity informs the person--

       ``(I) that any person may request information under this 
     subsection; and
       ``(II) of the address and toll-free telephone number 
     established and maintained for this purpose; and

       ``(ii) a person representing the business entity--

       ``(I) responds to an information request through the toll-
     free number within 3 business days of receiving the request; 
     and

       ``(II) facilitates the provision of such information to the 
     person who initiated the request.''.

     SEC. 5. AMENDMENTS TO THE FAIR CREDIT REPORTING ACT.

       (a) Consumer Reporting Agency Blocking of Information 
     Resulting From Identity Theft.--Section 611 of the Fair 
     Credit Reporting Act (15 U.S.C. 1681i) is amended by adding 
     at the end the following:
       ``(e) Block of Information Resulting From Identity Theft.--
       ``(1) Block.--Except as provided in paragraph (3) and not 
     later than 30 days after the date of receipt of proof of the 
     identity of a consumer and an official copy of a police 
     report evidencing the claim of the consumer of identity 
     theft, a consumer reporting agency shall permanently block 
     the reporting of any information identified by the consumer 
     in the file of the consumer resulting from the identity 
     theft, so that the information cannot be reported, except as 
     provided in paragraph (3).
       ``(2) Notification.--A consumer reporting agency shall 
     promptly notify the furnisher of information identified by 
     the consumer under paragraph (1)--
       ``(A) that the information may be a result of identity 
     theft;
       ``(B) that a police report has been filed;
       ``(C) that a block has been requested under this 
     subsection; and
       ``(D) of the effective date of the block.
       ``(3) Authority to decline or rescind.--
       ``(A) In general.--A consumer reporting agency may decline 
     to block, or may rescind any block, of consumer information 
     under this subsection if--
       ``(i) in the exercise of good faith and reasonable 
     judgment, the consumer reporting agency believes that--

       ``(I) the information was blocked due to a 
     misrepresentation of fact by the consumer relevant to the 
     request to block; or
       ``(II) the consumer knowingly obtained possession of goods, 
     services, or moneys as a result of the blocked transaction or 
     transactions, or the consumer should have known that the 
     consumer obtained possession of goods, services, or moneys as 
     a result of the blocked transaction or transactions; or

       ``(ii) the consumer agrees that the blocked information or 
     portions of the blocked information were blocked in error.

[[Page S11055]]

       ``(B) Notification to consumer.--If the block of 
     information is declined or rescinded under this paragraph, 
     the affected consumer shall be notified promptly, in the same 
     manner as consumers are notified of the reinsertion of 
     information under subsection (a)(5)(B).
       ``(C) Significance of block.--For purposes of this 
     paragraph, the prior presence of blocked information in the 
     file of a consumer is not evidence of whether the consumer 
     knew or should have known that the consumer obtained 
     possession of any goods, services, or monies as a result of 
     the block.
       ``(4) Exception.--A consumer reporting agency shall not be 
     required to comply with this subsection when the agency is 
     issuing information for authorizations, for the purpose of 
     approving or processing negotiable instruments, electronic 
     funds transfers, or similar methods of payment, based solely 
     on negative information, including--
       ``(A) dishonored checks;
       ``(B) accounts closed for cause;
       ``(C) substantial overdrafts;
       ``(D) abuse of automated teller machines; or
       ``(E) other information which indicates a risk of fraud 
     occurring.''.
       (b) False Claims.--Section 1028 of title 18, United States 
     Code, is amended by adding at the end the following:
       ``(j) Whoever knowingly falsely claims to be a victim of 
     identity theft for the purpose of obtaining the blocking of 
     information by a consumer reporting agency under section 
     611(e)(1) of the Fair Credit Reporting Act (15 U.S.C. 
     1681i(e)(1)) shall be fined under this title, imprisoned not 
     more than 3 years, or both.''.
       (c) Statute of Limitations.--Section 618 of the Fair Credit 
     Reporting Act (15 U.S.C. 1681p) is amended to read as 
     follows:

     ``SEC. 618. JURISDICTION OF COURTS; LIMITATION ON ACTIONS.

       ``(a) In General.--Except as provided in subsections (b) 
     and (c), an action to enforce any liability created under 
     this title may be brought in any appropriate United States 
     district court without regard to the amount in controversy, 
     or in any other court of competent jurisdiction, not later 
     than 2 years from the date of the defendant's violation of 
     any requirement under this title.
       ``(b) Willful Misrepresentation.--In any case in which the 
     defendant has materially and willfully misrepresented any 
     information required to be disclosed to an individual under 
     this title, and the information misrepresented is material to 
     the establishment of the liability of the defendant to that 
     individual under this title, an action to enforce a liability 
     created under this title may be brought at any time within 2 
     years after the date of discovery by the individual of the 
     misrepresentation.
       ``(c) Identity Theft.--An action to enforce a liability 
     created under this title may be brought not later than 5 
     years from the date of the defendant's violation if--
       ``(1) the plaintiff is the victim of an identity theft; or
       ``(2) the plaintiff--
       ``(A) has reasonable grounds to believe that the plaintiff 
     is the victim of an identity theft; and
       ``(B) has not materially and willfully misrepresented such 
     a claim.''.

     SEC. 6. COMMISSION STUDY OF COORDINATION BETWEEN FEDERAL, 
                   STATE, AND LOCAL AUTHORITIES IN ENFORCING 
                   IDENTITY THEFT LAWS.

       (a) Membership; Term.--Section 2 of the Internet False 
     Identification Prevention Act of 2000 (18 U.S.C. 1028 note) 
     is amended--
       (1) in subsection (b), by striking ``and the Commissioner 
     of Immigration and Naturalization'' and inserting ``the 
     Commissioner of Immigration and Naturalization, the Chairman 
     of the Federal Trade Commission, the Postmaster General, and 
     the Commissioner of the United States Customs Service,''; and
       (2) in subsection (c), by striking ``2 years'' and 
     inserting ``6 years''.
       (b) Consultation.--Section 2 of the Internet False 
     Identification Prevention Act of 2000 (18 U.S.C. 1028 note) 
     is amended--
       (1) by redesignating subsection (d) as subsection (e); and
       (2) by inserting after subsection (c) the following:
       ``(d) Consultation.--The coordinating committee shall 
     consult with interested parties, including State and local 
     law enforcement agencies, State attorneys general, 
     representatives of business entities (as that term is defined 
     in section 4 of the Identity Theft Victims Assistance Act of 
     2002), including telecommunications and utility companies, 
     and organizations representing consumers.''.
       (c) Report Contents.--Section 2(e) of the Internet False 
     Identification Prevention Act of 2000 (18 U.S.C. 1028 note) 
     (as redesignated by this section) is amended--
       (1) in subparagraph (E), by striking ``and'' at the end; 
     and
       (2) by striking subparagraph (F) and inserting the 
     following:
       ``(F) a comprehensive description of Federal assistance 
     provided to State and local law enforcement agencies to 
     address identity theft;
       ``(G) a comprehensive description of coordination 
     activities between Federal, State, and local law enforcement 
     agencies that address identity theft;
       ``(H) a comprehensive description of how the Federal 
     Government can best provide State and local law enforcement 
     agencies with timely and current information regarding 
     terrorists or terrorist activity where such information 
     specifically relates to identity theft; and
       ``(I) recommendations in the discretion of the President, 
     if any, for legislative or administrative changes that 
     would--
       ``(i) facilitate more effective investigation and 
     prosecution of--

       ``(I) cases involving identity theft; and
       ``(II) the creation and distribution of false 
     identification documents;

       ``(ii) improve the effectiveness of Federal assistance to 
     State and local law enforcement agencies and coordination 
     between Federal, State, and local law enforcement agencies;
       ``(iii) simplify efforts by a person necessary to rectify 
     the harm that results from the theft of the identity of such 
     person; and
       ``(iv) if deemed appropriate, provide for the establishment 
     of a Federal identity theft and false identification office 
     or agency.''.

     SEC. 7. ENFORCEMENT.

       (a) In General.--
       (1) Civil actions.--In any case in which the attorney 
     general of a State has reason to believe that an interest of 
     the residents of that State has been, or is threatened to be, 
     adversely affected by a violation of section 4 of this Act by 
     any business entity, the State, as parens patriae, may bring 
     a civil action on behalf of the residents of the State in a 
     district court of the United States of appropriate 
     jurisdiction to--
       (A) enjoin that practice;
       (B) enforce compliance with this Act or the amendments made 
     by this Act;
       (C) obtain damages--
       (i) in the sum of actual damages, restitution, and other 
     compensation on behalf of the residents of the State; and
       (ii) punitive damages, if the violation is willful or 
     intentional; and
       (D) obtain such other equitable relief as the court may 
     consider to be appropriate.
       (2) Notice.--Before filing an action under paragraph (1), 
     the attorney general of the State involved shall provide to 
     the Attorney General of the United States--
       (A) written notice of the action; and
       (B) a copy of the complaint for the action.
       (b) Intervention.--
       (1) In general.--On receiving notice of an action under 
     subsection (a)(2), the Attorney General of the United States 
     shall have the right to intervene in that action.
       (2) Effect of intervention.--If the Attorney General of the 
     United States intervenes in an action under subsection (a), 
     the Attorney General shall have the right to be heard with 
     respect to any matter that arises in that action.
       (3) Service of process.--Upon request of the Attorney 
     General of the United States, the attorney general of a State 
     that has filed an action under subsection (a) shall, pursuant 
     to Rule 4(d)(4) of the Federal Rules of Civil Procedure, 
     serve the Government with--
       (A) a copy of the complaint; and
       (B) written disclosure of substantially all material 
     evidence and information in the possession of the attorney 
     general of the state.
       (c) Construction.--For purposes of bringing any civil 
     action under subsection (a), nothing in this Act or the 
     amendments made by this Act shall be construed to prevent an 
     attorney general of a State from exercising the powers 
     conferred on such attorney general by the laws of that 
     State--
       (1) to conduct investigations;
       (2) to administer oaths or affirmations; or
       (3) to compel the attendance of witnesses or the production 
     of documentary and other evidence.
       (d) Actions by the Attorney General of the United States.--
     In any case in which an action is instituted by or on behalf 
     of the Attorney General of the United States for a violation 
     of section 4, no State may, during the pendency of that 
     action, institute an action under subsection (a) against any 
     defendant named in the complaint in that action for violation 
     of that practice.
       (e) Venue; Service of Process.--
       (1) Venue.--Any action brought under subsection (a) may be 
     brought in the district court of the United States--
       (A) where the defendant resides;
       (B) where the defendant is doing business; or
       (C) that meets applicable requirements relating to venue 
     under section 1391 of title 28, United States Code.
       (2) Service of process.--In an action brought under 
     subsection (a), process may be served in any district in 
     which the defendant--
       (A) resides;
       (B) is doing business; or
       (B) may be found.

  Mr. GRAMM. Madam President, the Senate today is considering S. 1742, 
the Identity Theft Victims Assistance Act of 2002. This is an important 
issue, and it is proper for the Senate to be giving it consideration. 
While the text of this bill is seriously flawed and needs careful work 
and refinement in order for it to have a significantly positive effect 
in curbing identity theft, I believe that passage of this legislation 
by the Senate will be seen as an indication of the importance that the 
Senate attaches to relieving the disruption caused in the lives of 
victims of these crimes.
  When the Senate returns to this issue in the next Congress, I hope 
that the problems with this bill can be resolved, that the complexity 
of the issues involved can be adequately considered so that the 
legislation focuses on the real culprits without penalizing law-abiding 
citizens and businesses, and without the substantial confusion to the 
enforcement responsibilities of federal financial regulators that the 
draft before us would cause. The text in its current form would also 
expand opportunities for predatory lawsuits, creating new

[[Page S11056]]

victims, and we must avoid that. We do little good for the country that 
way.
  Mr. REID. Mr. President, Senators Cantwell and Grassley and others 
have an amendment at the desk. I ask that that amendment be considered 
and agreed to; that the committee substitute, as amended, be agreed to; 
the bill, as amended, be read the third time and passed, and the motion 
to reconsider be laid upon the table; and that any statements be 
printed in the Record, with no intervening action or debate.
  The PRESIDING OFFICER. Without objection, it is so ordered.
  The amendment (No. 4954) was agreed to.
  (The amendment is printed in today's Record under ``Text of 
Amendments.'')
  The committee amendment in the nature of a substitute, as amended, 
was agreed to.
  The bill (S. 1742), as amended, was read the third time and passed, 
as follows:
  (The bill will be printed in a future edition of the Record.)
  Mr. REID. Mr. President, let me say I have been working in recent 
hours with the Senator from Washington, Ms. Cantwell. She has worked 
tirelessly on this piece of legislation. She has given a number of 
statements on the floor related to this issue, dealing with what has 
taken place and what she knows regarding identity theft. I commend and 
applaud her for her diligence and perseverance. The burden is now on 
the House of Representatives. They are still in session. There is no 
reason in the world that they cannot pass this most important piece of 
legislation.

                          ____________________