[Congressional Record Volume 149, Number 51 (Monday, March 31, 2003)]
[Senate]
[Pages S4559-S4570]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

      By Mrs. FEINSTEIN:
  S. 745. A bill to require the consent of an individual prior to the 
sale and marketing of such individual's personally identifiable 
information, and for other purposes; to the Committee on the Judiciary.
  Mrs. FEINSTEIN. Mr. President, I am pleased to introduce the 
``Privacy Act of 2003.''
  This legislation would establish, for the first time, a comprehensive 
national system of privacy protection.
  It would: require companies to gain consumers' written consent prior 
to selling their most sensitive personal information including personal 
health information, financial information, Social Security numbers, and 
drivers' license data; and require companies to provide consumers' 
notice and an opportunity to refuse to allow their less sensitive 
personal information to be sold.
  Simply put, this legislation would give consumers more control over 
how their personal information is used.
  The personal information of today's consumer is too vulnerable to 
abuse. With access to sensitive data so widely available--often just at 
the touch of a keyboard--it is easy to understand why identity theft 
has become one of the country's fastest growing crimes.
  Recent statistics on the growth of identity theft suggest we have no 
time to waste in protecting personal privacy.
  Identity theft is the number one consumer complaint reported to the 
Federal Trade Commission. American consumers filed approximately 
163,000 identity theft complaints with the FTC in 2002. Fully 43 
percent of all the complaints the FTC receives are about identity 
theft.
  An estimated 700,000 cases of identity theft occur each year. The 
average victim spends an average of 175 hours over a two-year period 
clearing off an average of $17,000 fraud off their credit reports.
  My own State, California, has more victims than any other state. The 
FTC recorded 30,738 identity theft cases last year from California 
consumers alone.
  While modern technology has increased the threat to personal security 
and privacy, the protections for individual privacy have not kept pace. 
Our country's privacy laws form an incomplete and inconsistent 
patchwork.
  For example, Americans enjoy the highest level of privacy protection 
concerning the names of the movies they rent at a video store. But, at 
the same time, it is perfectly legal to sell another person's Social 
Security number over the Internet.
  The Privacy Act would establish a Federal privacy standard that 
adjusts the level of privacy protection according to the sensitivity of 
the information at issue.
  The legislation provides the highest level of protection for a 
person's most sensitive data--personal financial data, health data, 
driver's license information, and Social Security numbers.
  For this sensitive data, the bill gives the individual ultimate 
control over whether or not his or her information is shared. If an 
individual does not actively decide to permit sharing of personal data, 
the data is not disclosed.
  Specifically, this legislation tightens the privacy provisions of the 
Financial Services Modernization Act, commonly known as the Gramm-
Leach-Bliley Act. Under Gramm-Leach-Bliley, a bank can share a 
customer's personal information with other companies so long as it 
gives consumers notice and the right to opt-out of the data sharing.
  The problem with opt-out is that most people toss out their privacy 
notices from banks along with the rest of the unrelenting pile of 
commercial solicitations they receive. Since the passage of Gramm-
Leach-Bliley, banks have sent out over one billion privacy notices.
  According to available published information, fewer than 5 percent of 
bank customers have opted out of sharing their personal information, 
and for many financial institutions, the response rate has been less 
than one percent.
  It is not surprising that consumers do not respond overwhelmingly to 
these notices, since, by some estimates, the average American household 
received a dozen of these notices. A consumer should not have the 
burden of constantly monitoring how his or her most sensitive personal 
information is shared with other companies.
  Accordingly, the Privacy Act prohibits the sale or disclosure of 
sensitive personal financial information to third parties unless the 
consumer affirmatively consents or opts in.
  This legislation also toughens Federal financial privacy laws for 
affiliate sharing and joint marketing. An affiliate is a company that 
is linked by common ownership with another company. Under Federal law, 
a bank can share with affiliates or joint marketing partners regardless 
of whether the consumer wants this information shared.
  The Privacy Act of 2003 would require that banks give consumers the 
option of opting out of the sharing of their personal financial 
information with the bank's affiliates or joint partners.
  Some banks argue that affiliates are just branches of an 
organization, and a bank should for efficiency purposes be able to 
share data within the entire organization. In an era where a bank had 
one or two affiliates, that might be true.
  But, now, some companies are so big that if a customer has no control 
over

[[Page S4560]]

affiliate sharing, then the customer is unable to prevent the 
disclosure of their data to hundreds of companies. For example, in 
recent testimony before Congress, U.S. PIRG reported that Citibank has 
2,761 affiliates, Key Bank had 871 affiliates, and Bank of America has 
1,576 affiliates.
  Similarly, a customer must be able to restrict a bank's sharing of 
personal information with its joint venture partners if the customer 
wants to maintain control over his personal information.
  I would also like to describe several other key components of the 
financial privacy section.
  The bill prohibits banks from denying a customer a financial product 
or financial service just because the customer chooses to not disclose 
his personal information to third parties, affiliates, or joint venture 
partners. However, the bill does allow banks to offer incentives to 
customers to encourage them to permit the sharing of their personal 
information.
  Additionally, the bill permits banks to disclose, but not sell, 
personal information to third parties for vital public interest 
purposes such as identifying or locating missing and abducted children, 
witnesses, criminals and fugitives, parents delinquent in child support 
payments, organ and bone marrow donors, pension fund beneficiaries, and 
missing heirs.
  Just as with financial data, personal health data deserves the most 
stringent privacy protections.
  The recently adopted Department of Health and Human Services privacy 
regulations set a basic opt-in framework for disclosure of health 
information. But more can be done to protect patient privacy.
  The regulations only prohibit ``covered entities''--namely health 
insurers, health providers, and health care clearinghouses--from 
selling a patient's health information without that patient's prior 
consent.
  Meanwhile, non-covered entities such as business associates, health 
researchers, schools or universities, and life insurers are not subject 
to this opt-in requirement, except through contractual arrangements.

  This legislation would preserve the privacy of health information 
wherever the information is sold. Any business associate, life insurer, 
school or non-covered entity trying to sell or market protected health 
information would, like covered entities, have to get the patient's 
prior consent.
  Drivers' license data also is given the strongest level of protection 
under this bill.
  With its recent amendments, the Driver's Privacy Protection Act, 
DPPA, offers some meaningful protections for drivers privacy.
  For example, under the DPPA, a State Department of Motor Vehicles 
must obtain the prior consent, Opt-in, of the driver before ``highly 
sensitive information''--defined as the driver's photograph, image, 
Social Security number, medical or disability information--can be 
disclosed to a third party.
  However, loopholes remain. Other sensitive information found on a 
driver's license deserves equal protection.
  The Privacy Act would expand the definition of ``highly sensitive 
information'' to include a physical copy of a driver's license, the 
driver identification number, birth date, information on the driver's 
physical characteristics and any biometric identifiers, such as a 
fingerprint, that are found on the driver's license.
  Thus, this bill would ensure consumers have control over how their 
motor vehicle records and driver's license data are used.
  I would like to take a moment to highlight the Social Security number 
section of the privacy bill, which reflects over four years of 
negotiation with Senator Hatch, Senator Gregg, Senator Grassley, 
Senator Baucus, and other Senate colleagues. I have also introduced 
this section as a stand-alone bill, Senate bill 228.
  It is crucial to protect Social Security numbers because the numbers 
are the key to a person's identity. Many identity theft cases start 
with the theft of a Social Security number. Once a thief has access to 
a victim's Social Security number, it is only a short step to acquiring 
credit cards, driver's licenses, or other crucial identification 
documents.
  Not surprisingly, members of the public have flooded our Federal 
agencies with pleas for assistance. Reports to the Social Security 
Administration of Social Security number misuse have increased from 
7,868 in 1997 to 73,000 in 2002--an astonishing increase of over 800%.
  The Feinstein/Gregg compromise bars the sale or display of Social 
Security numbers to the public except in a very narrow set of 
circumstances.
  Display or sale is permitted if the Social Security number holder 
consents or if there are compelling public safety needs.
  Government entities will have to redact Social Security numbers from 
electronic records that are readily available to the public on the 
Internet.
  Moreover, State governments will no longer be permitted to use the 
Social Security number as the default driver's license number.
  The legislation, however, recognizes that some industries rely on 
Social Security numbers to exchange information between databases and 
complete identification verification necessary for certain 
transactions.
  Thus, the bill directs the Attorney General to develop regulations 
allowing for the sale or purchase of Social Security Numbers to 
facilitate business-to-business and business-to-government transactions 
so long as businesses put appropriate safeguards in place and do not 
permit public access to the number.
  Recognizing that not all personal information merits the same 
restrictions, the bill permits businesses to collect and sell 
nonsensitive personal information, e.g., name, phone number, address, 
to third parties so long as they give customers notice and the 
opportunity to opt-out of the sale.
  The opt-out standard for non-sensitive information means that if a 
person fills out a warranty card, signs up for a computer service, or 
submits an entry for a sweepstakes, the business must notify him before 
it sells his personal information to other businesses or marketers.
  This framework guarantees basic privacy protections for consumers 
without unduly impacting commerce.
  To further minimize the regulatory burden of these privacy rules, the 
bill sets up a safe harbor so that industries and industry-sponsored 
seal programs which have already adopted Notice-and-Opt Out information 
policies, will be exempt from the regulatory requirements of the 
legislation.
  To ensure uniformity of the laws across all 50 states, the bill 
preempts inconsistent state laws regarding the treatment of non-
sensitive information.
  A jumbled patchwork of State privacy laws helps neither businesses 
nor consumers. Consumers will have confused expectations about what 
information is protected.
  Another distinguishing characteristic of the Privacy Act of 2003 is 
that it protects the privacy of information regardless of the medium 
through which it is collected.
  Other privacy proposals have tried to confine privacy legislation to 
the Internet.
  These proposals unfairly discriminate against high technology users. 
Put simply, companies and other entities can misuse personal 
information from off-line sources just as easily as with on-line 
sources.
  For example, telemarketers who besiege consumers with phone calls 
during the dinner hour do not typically get customer information from 
the Internet. Much of the identifying information used to make these 
calls comes from consumers filling out and mailing back warranty and 
registration cards.
  Regardless of how information is collected, it should get equal 
protection.
  This legislation codifies steps Congress can take to protect citizens 
from identity thieves and other predators of personal information.
  It restores to an individual more control over his or her most 
sensitive personal information such as Social Security numbers, health 
information, and financial information. It also sets reasonable 
guidelines for businesses that handle our personal information every 
day.
  A byproduct of our information economy--personal information is much 
more vulnerable to exploitation than ever before.
  Every American has a fundamental right to privacy, no matter how fast 
our technology grows or changes. A

[[Page S4561]]

person should be able to have control over how their most sensitive 
personal information is used.
  But our right to privacy only will remain vital, if we take strong 
action to protect it.
  I ask unanimous consent that the text of the legislation be printed 
in the Record.
  I look forward to working with my colleagues to enact the Privacy Act 
of 2003.
  There being no objection, the bill was ordered to be printed in the 
Record, as follows:

                                 S. 745

       Be it enacted by the Senate and House of Representatives of 
     the United States of America in Congress assembled,

     SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

       (a) Short Title.--This Act may be cited as the ``Privacy 
     Act of 2003''.
       (b) Table of Contents.--The table of contents of this Act 
     is as follows:

Sec. 1. Short title; table of contents.

   TITLE I--COMMERCIAL SALE AND MARKETING OF PERSONALLY IDENTIFIABLE 
                              INFORMATION

Sec. 101. Collection and distribution of personally identifiable 
              information.
Sec. 102. Enforcement.
Sec. 103. Safe harbor.
Sec. 104. Definitions.
Sec. 105. Preemption.
Sec. 106. Effective Date.

           TITLE II--SOCIAL SECURITY NUMBER MISUSE PREVENTION

Sec. 201. Findings.
Sec. 202. Prohibition of the display, sale, or purchase of social 
              security numbers.
Sec. 203. Application of prohibition of the display, sale, or purchase 
              of social security numbers to public records.
Sec. 204. Rulemaking authority of the Attorney General.
Sec. 205. Treatment of social security numbers on government documents.
Sec. 206. Limits on personal disclosure of a social security number for 
              consumer transactions.
Sec. 207. Extension of civil monetary penalties for misuse of a social 
              security number.
Sec. 208. Criminal penalties for the misuse of a social security 
              number.
Sec. 209. Civil actions and civil penalties.
Sec. 210. Federal injunctive authority.

   TITLE III--LIMITATIONS ON SALE AND SHARING OF NONPUBLIC PERSONAL 
                         FINANCIAL INFORMATION

Sec. 301. Definition of sale.
Sec. 302. Rules applicable to sale of nonpublic personal information.
Sec. 303. Exceptions to disclosure prohibition.
Sec. 304. Conforming amendments.
Sec. 305. Regulatory authority.
Sec. 306. Effective date.

 TITLE IV--LIMITATIONS ON THE PROVISION OF PROTECTED HEALTH INFORMATION

Sec. 401. Definitions.
Sec. 402. Prohibition against selling protected health information.
Sec. 403. Authorization for sale or marketing of protected health 
              information by noncovered entities.
Sec. 404. Prohibition against retaliation.
Sec. 405. Rule of construction.
Sec. 406. Regulations.
Sec. 407. Enforcement.

                   TITLE V--DRIVER'S LICENSE PRIVACY

Sec. 501. Driver's license privacy.

                        TITLE VI--MISCELLANEOUS

Sec. 601. Enforcement by State Attorneys General.
Sec. 602. Federal injunctive authority.

   TITLE I--COMMERCIAL SALE AND MARKETING OF PERSONALLY IDENTIFIABLE 
                              INFORMATION

     SEC. 101. COLLECTION AND DISTRIBUTION OF PERSONALLY 
                   IDENTIFIABLE INFORMATION.

       (a) Prohibition.--
       (1) In general.--It is unlawful for a commercial entity to 
     collect personally identifiable information and disclose such 
     information to any nonaffiliated third party for marketing 
     purposes or sell such information to any nonaffiliated third 
     party, unless the commercial entity provides--
       (A) notice to the individual to whom the information 
     relates in accordance with the requirements of subsection 
     (b); and
       (B) an opportunity for such individual to restrict the 
     disclosure or sale of such information.
       (2) Exception.--A commercial entity may collect personally 
     identifiable information and use such information to market 
     to potential customers such entity's product.
       (b) Notice.--
       (1) In general.--A notice under subsection (a) shall 
     contain statements describing the following:
       (A) The identity of the commercial entity collecting the 
     personally identifiable information.
       (B) The types of personally identifiable information that 
     are being collected on the individual.
       (C) How the commercial entity may use such information.
       (D) A description of the categories of potential recipients 
     of such personally identifiable information.
       (E) Whether the individual is required to provide 
     personally identifiable information in order to do business 
     with the commercial entity.
       (F) How an individual may decline to have such personally 
     identifiable information used or sold as described in 
     subsection (a).
       (2) Time of notice.--Notice shall be conveyed prior to the 
     sale or use of the personally identifiable information as 
     described in subsection (a) in such a manner as to allow the 
     individual a reasonable period of time to consider the notice 
     and limit such sale or use.
       (3) Medium of notice.--The medium for providing notice must 
     be--
       (A) the same medium in which the personally identifiable 
     information is or will be collected, or a medium approved by 
     the individual; or
       (B) in the case of oral communication, notice may be 
     conveyed orally or in writing.
       (4) Form of notice.--The notice shall be clear and 
     conspicuous.
       (c) Opt-Out.--
       (1) Opportunity to opt-out of sale or marketing.--The 
     opportunity provided to limit the sale of personally 
     identifiable information to nonaffiliated third parties or 
     the disclosure of such information for marketing purposes, 
     shall be easy to use, accessible and available in the medium 
     the information is collected, or in a medium approved by the 
     individual.
       (2) Duration of limitation.--An individual's limitation on 
     the sale or marketing of personally identifiable information 
     shall be considered permanent, unless otherwise specified by 
     the individual.
       (3) Revocation of consent.--After an individual grants 
     consent to the use of that individual's personally 
     identifiable information, the individual may revoke the 
     consent at any time, except to the extent that the commercial 
     entity has taken action in reliance thereon. The commercial 
     entity shall provide the individual an opportunity to revoke 
     consent that is easy to use, accessible, and available in the 
     medium the information was or is collected.
       (4) Not applicable.--This section shall not apply to 
     disclosure of personally identifiable information--
       (A) that is necessary to facilitate a transaction 
     specifically requested by the consumer;
       (B) is used for the sole purpose of facilitating this 
     transaction; and
       (C) in which the entity receiving or obtaining such 
     information is limited, by contract, to use such formation 
     for the purpose of completing the transaction.

     SEC. 102. ENFORCEMENT.

       (a) In General.--In accordance with the provisions of this 
     section, the Federal Trade Commission shall have the 
     authority to enforce any violation of section 101 of this 
     Act.
       (b) Violations.--The Federal Trade Commission shall treat a 
     violation of section 101 as a violation of a rule under 
     section 18a(a)(1)(B) of the Federal Trade Commission Act (15 
     U.S.C. 57a(a)(1)(B)).
       (c) Transfer of Enforcement Authority.--The Federal Trade 
     Commission shall promulgate rules in accordance with section 
     553 of title 5, United States Code, allowing for the transfer 
     of enforcement authority from the Federal Trade Commission to 
     a Federal agency regarding section 101 of this Act. The 
     Federal Trade Commission may permit a Federal agency to 
     enforce any violation of section 101 if such agency submits a 
     written request to the Commission to enforce such violations 
     and includes in such request--
       (1) a description of the entities regulated by such agency 
     that will be subject to the provisions of section 101;
       (2) an assurance that such agency has sufficient authority 
     over the entities to enforce violations of section 101; and
       (3) a list of proposed rules that such agency shall use in 
     regulating such entities and enforcing section 101.
       (d) Actions by the Commission.--Absent transfer of 
     enforcement authority to a Federal agency under subsection 
     (c), the Federal Trade Commission shall prevent any person 
     from violating section 101 in the same manner, by the same 
     means, and with the same jurisdiction, powers, and duties as 
     provided to such Commission under the Federal Trade 
     Commission Act (15 U.S.C. 41 et seq.). Any entity that 
     violates section 101 is subject to the penalties and entitled 
     to the privileges and immunities provided in such Act in the 
     same manner, by the same means, and with the same 
     jurisdiction, power, and duties under such Act.
       (e) Relationship to Other Laws.--
       (1) Commission authority.--Nothing contained in this title 
     shall be construed to limit authority provided to the 
     Commission under any other law.
       (2) Communications act.--Nothing in section 101 requires an 
     operator of a website to take any action that is inconsistent 
     with the requirements of section 222 or 631 of the 
     Communications Act of 1934 (47 U.S.C. 222 and 5551).
       (3) Other acts.--Nothing in this title is intended to 
     affect the applicability or the enforceability of any 
     provision of, or any amendment made by--
       (A) the Children's Online Privacy Protection Act of 1998 
     (15 U.S.C. 6501 et seq.);

[[Page S4562]]

       (B) title V of the Gramm-Leach-Bliley Act;
       (C) the Health Insurance Portability and Accountability Act 
     of 1996; or
       (D) the Fair Credit Reporting Act.
       (f) Public Records.--Nothing in this title shall be 
     construed to restrict commercial entities from obtaining or 
     disclosing personally identifying information from public 
     records.
       (g) Civil Penalties.--In addition to any other penalty 
     applicable to a violation of section 101(a), a penalty of up 
     to $25,000 may be issued for each violation.
       (h) Enforcement Regarding Programs.--
       (1) In general.--A Federal agency or department providing 
     financial assistance to any entity required to comply with 
     section 101 of this Act shall issue regulations requiring 
     that such entity comply with such section or forfeit some or 
     all of such assistance. Such regulations shall prescribe 
     sanctions for noncompliance, require that such department or 
     agency provide notice of failure to comply with such section 
     prior to any action being taken against such recipient, and 
     require that a determination be made prior to any action 
     being taken against such recipient that compliance cannot be 
     secured by voluntary means.
       (2) Federal financial assistance.--The term ``Federal 
     financial assistance'' means assistance through a grant, 
     cooperative agreement, loan, or contract other than a 
     contract of insurance or guaranty.

     SEC. 103. SAFE HARBOR.

       A commercial entity may not be held to have violated any 
     provision of this title if such entity complies with self-
     regulatory guidelines that--
       ``(1) are issued by seal programs or representatives of the 
     marketing or online industries or by any other person; and
       ``(2) are approved by the Federal Trade Commission, after 
     public comment has been received on such guidelines by the 
     Commission, as meeting the requirements of this title.

     SEC. 104. DEFINITIONS.

       In this title:
       (1) Commercial entity.--The term ``commercial entity''--
       (A) means any person offering products or services 
     involving commerce--
       (i) among the several States or with 1 or more foreign 
     nations;
       (ii) in any territory of the United States or in the 
     District of Columbia, or between any such territory and--

       (I) another such territory; or
       (II) any State or foreign nation; or

       (iii) between the District of Columbia and any State, 
     territory, or foreign nation; and
       (B) does not include--
       (i) any nonprofit entity that would otherwise be exempt 
     from coverage under section 5 of the Federal Trade Commission 
     Act (15 U.S.C. 45);
       (ii) any financial institution that is subject to title V 
     of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.); or
       (iii) any group health plan, health insurance issuer, or 
     other entity that is subject to the Health Insurance 
     Portability and Accountability Act of 1996 (42 U.S.C. 201 
     note).
       (2) Commission.--The term ``Commission'' means the Federal 
     Trade Commission.
       (3) Individual.--The term ``individual'' means a person 
     whose personally identifying information has been, is, or 
     will be collected by a commercial entity.
       (4) Marketing.--The term ``marketing'' means to make a 
     communication about a product or service a purpose of which 
     is to encourage recipients of the communication to purchase 
     or use the product or service.
       (5) Medium.--The term ``medium'' means any channel or 
     system of communication including oral, written, and online 
     communication.
       (6) Nonaffiliated third party.--The term ``nonaffiliated 
     third party'' means any entity that is not related by common 
     ownership or affiliated by corporate control with, the 
     commercial entity, but does not include a joint employee of 
     such institution.
       (7) Personally identifiable information.--The term 
     ``personally identifiable information'' means individually 
     identifiable information about the individual that is 
     collected including--
       (A) a first, middle, or last name, whether given at birth 
     or adoption, assumed, or legally changed;
       (B) a home or other physical address, including the street 
     name, zip code, and name of a city or town;
       (C) an e-mail address;
       (D) a telephone number;
       (E) a photograph or other form of visual identification;
       (F) a birth date, birth certificate number, or place of 
     birth for that person; or
       (G) information concerning the individual that is combined 
     with any other identifier in this paragraph.
       (8) Sale; Sell; Sold.--The terms ``sale'', ``sell'', and 
     ``sold'', with respect to personally identifiable 
     information, mean the exchanging of such information for any 
     thing of value, directly or indirectly, including the 
     licensing, bartering, or renting of such information.
       (9) Writing.--The term ``writing'' means writing in either 
     a paper-based or computer-based form, including electronic 
     and digital signatures.

     SEC. 105. PREEMPTION.

       The provisions of this title shall supersede any statutory 
     and common law of States and their political subdivisions 
     insofar as that law may now or hereafter relate to the--
       (1) collection and disclosure of personally identifiable 
     information for marketing purposes; and
       (2) collection and sale of personally identifiable 
     information.

     SEC. 106. EFFECTIVE DATE.

       This title and the amendments made by this title shall take 
     effect 1 year after the date of enactment of this Act.

           TITLE II--SOCIAL SECURITY NUMBER MISUSE PREVENTION

     SEC. 201. FINDINGS.

       Congress makes the following findings:
       (1) The inappropriate display, sale, or purchase of social 
     security numbers has contributed to a growing range of 
     illegal activities, including fraud, identity theft, and, in 
     some cases, stalking and other violent crimes.
       (2) While financial institutions, health care providers, 
     and other entities have often used social security numbers to 
     confirm the identity of an individual, the general display to 
     the public, sale, or purchase of these numbers has been used 
     to commit crimes, and also can result in serious invasions of 
     individual privacy.
       (3) The Federal Government requires virtually every 
     individual in the United States to obtain and maintain a 
     social security number in order to pay taxes, to qualify for 
     social security benefits, or to seek employment. An 
     unintended consequence of these requirements is that social 
     security numbers have become one of the tools that can be 
     used to facilitate crime, fraud, and invasions of the privacy 
     of the individuals to whom the numbers are assigned. Because 
     the Federal Government created and maintains this system, and 
     because the Federal Government does not permit individuals to 
     exempt themselves from those requirements, it is appropriate 
     for the Federal Government to take steps to stem the abuse of 
     social security numbers.
       (4) The display, sale, or purchase of social security 
     numbers in no way facilitates uninhibited, robust, and wide-
     open public debate, and restrictions on such display, sale, 
     or purchase would not affect public debate.
       (5) No one should seek to profit from the display, sale, or 
     purchase of social security numbers in circumstances that 
     create a substantial risk of physical, emotional, or 
     financial harm to the individuals to whom those numbers are 
     assigned.
       (6) Consequently, this title provides each individual that 
     has been assigned a social security number some degree of 
     protection from the display, sale, and purchase of that 
     number in any circumstance that might facilitate unlawful 
     conduct.

     SEC. 202. PROHIBITION OF THE DISPLAY, SALE, OR PURCHASE OF 
                   SOCIAL SECURITY NUMBERS.

       (a) Prohibition.--
       (1) In general.--Chapter 47 of title 18, United States 
     Code, is amended by inserting after section 1028 the 
     following:

     ``Sec. 1028A. Prohibition of the display, sale, or purchase 
       of social security numbers

       ``(a) Definitions.--In this section:
       ``(1) Display.--The term `display' means to intentionally 
     communicate or otherwise make available (on the Internet or 
     in any other manner) to the general public an individual's 
     social security number.
       ``(2) Person.--The term `person' means any individual, 
     partnership, corporation, trust, estate, cooperative, 
     association, or any other entity.
       ``(3) Purchase.--The term `purchase' means providing 
     directly or indirectly, anything of value in exchange for a 
     social security number.
       ``(4) Sale.--The term `sale' means obtaining, directly or 
     indirectly, anything of value in exchange for a social 
     security number.
       ``(5) State.--The term `State' means any State of the 
     United States, the District of Columbia, Puerto Rico, the 
     Northern Mariana Islands, the United States Virgin Islands, 
     Guam, American Samoa, and any territory or possession of the 
     United States.
       ``(b) Limitation on Display.--Except as provided in section 
     1028B, no person may display any individual's social security 
     number to the general public without the affirmatively 
     expressed consent of the individual.
       ``(c) Limitation on Sale or Purchase.--Except as otherwise 
     provided in this section, no person may sell or purchase any 
     individual's social security number without the affirmatively 
     expressed consent of the individual.
       ``(d) Prerequisites for Consent.--In order for consent to 
     exist under subsection (b) or (c), the person displaying or 
     seeking to display, selling or attempting to sell, or 
     purchasing or attempting to purchase, an individual's social 
     security number shall--
       ``(1) inform the individual of the general purpose for 
     which the number will be used, the types of persons to whom 
     the number may be available, and the scope of transactions 
     permitted by the consent; and
       ``(2) obtain the affirmatively expressed consent 
     (electronically or in writing) of the individual.
       ``(e) Exceptions.--Nothing in this section shall be 
     construed to prohibit or limit the display, sale, or purchase 
     of a social security number--
       ``(1) required, authorized, or excepted under any Federal 
     law;
       ``(2) for a public health purpose, including the protection 
     of the health or safety of an individual in an emergency 
     situation;
       ``(3) for a national security purpose;

[[Page S4563]]

       ``(4) for a law enforcement purpose, including the 
     investigation of fraud and the enforcement of a child support 
     obligation;
       ``(5) if the display, sale, or purchase of the number is 
     for a use occurring as a result of an interaction between 
     businesses, governments, or business and government 
     (regardless of which entity initiates the interaction), 
     including, but not limited to--
       ``(A) the prevention of fraud (including fraud in 
     protecting an employee's right to employment benefits);
       ``(B) the facilitation of credit checks or the facilitation 
     of background checks of employees, prospective employees, or 
     volunteers;
       ``(C) the retrieval of other information from other 
     businesses, commercial enterprises, government entities, or 
     private nonprofit organizations; or
       ``(D) when the transmission of the number is incidental to, 
     and in the course of, the sale, lease, franchising, or merger 
     of all, or a portion of, a business;
       ``(6) if the transfer of such a number is part of a data 
     matching program involving a Federal, State, or local agency; 
     or
       ``(7) if such number is required to be submitted as part of 
     the process for applying for any type of Federal, State, or 
     local government benefit or program;

     except that, nothing in this subsection shall be construed as 
     permitting a professional or commercial user to display or 
     sell a social security number to the general public.
       ``(f) Limitation.--Nothing in this section shall prohibit 
     or limit the display, sale, or purchase of social security 
     numbers as permitted under title V of the Gramm-Leach-Bliley 
     Act, or for the purpose of affiliate sharing as permitted 
     under the Fair Credit Reporting Act, except that no entity 
     regulated under such Acts may make social security numbers 
     available to the general public, as may be determined by the 
     appropriate regulators under such Acts. For purposes of this 
     subsection, the general public shall not include affiliates 
     or unaffiliated third-party business entities as may be 
     defined by the appropriate regulators.''.
       (2) Conforming Amendment.--The chapter analysis for chapter 
     47 of title 18, United States Code, is amended by inserting 
     after the item relating to section 1028 the following:

``1028A. Prohibition of the display, sale, or purchase of social 
              security numbers.''.
       (b) Study; Report.--
       (1) In general.--The Attorney General shall conduct a study 
     and prepare a report on all of the uses of social security 
     numbers permitted, required, authorized, or excepted under 
     any Federal law. The report shall include a detailed 
     description of the uses allowed as of the date of enactment 
     of this Act and shall evaluate whether such uses should be 
     continued or discontinued by appropriate legislative action.
       (2) Report.--Not later than 1 year after the date of 
     enactment of this Act, the Attorney General shall report to 
     Congress findings under this subsection. The report shall 
     include such recommendations for legislation based on 
     criteria the Attorney General determines to be appropriate.
       (c) Effective Date.--The amendments made by this section 
     shall take effect on the date that is 30 days after the date 
     on which the final regulations promulgated under section 5 
     are published in the Federal Register.

     SEC. 203. APPLICATION OF PROHIBITION OF THE DISPLAY, SALE, OR 
                   PURCHASE OF SOCIAL SECURITY NUMBERS TO PUBLIC 
                   RECORDS.

       (a) Public Records Exception.--
       (1) In general.--Chapter 47 of title 18, United States Code 
     (as amended by section 3(a)(1)), is amended by inserting 
     after section 1028A the following:

     ``Sec. 1028B. Display, sale, or purchase of public records 
       containing social security numbers

       ``(a) Definition.--In this section, the term `public 
     record' means any governmental record that is made available 
     to the general public.
       ``(b) In General.--Except as provided in subsections (c), 
     (d), and (e), section 1028A shall not apply to a public 
     record.
       ``(c) Public Records on the Internet or in an Electronic 
     Medium.--
       ``(1) In general.--Section 1028A shall apply to any public 
     record first posted onto the Internet or provided in an 
     electronic medium by, or on behalf of a government entity 
     after the date of enactment of this section, except as 
     limited by the Attorney General in accordance with paragraph 
     (2).
       ``(2) Exception for government entities already placing 
     public records on the internet or in electronic form.--Not 
     later than 60 days after the date of enactment of this 
     section, the Attorney General shall issue regulations 
     regarding the applicability of section 1028A to any record of 
     a category of public records first posted onto the Internet 
     or provided in an electronic medium by, or on behalf of a 
     government entity prior to the date of enactment of this 
     section. The regulations will determine which individual 
     records within categories of records of these government 
     entities, if any, may continue to be posted on the Internet 
     or in electronic form after the effective date of this 
     section. In promulgating these regulations, the Attorney 
     General may include in the regulations a set of procedures 
     for implementing the regulations and shall consider the 
     following:
       ``(A) The cost and availability of technology available to 
     a governmental entity to redact social security numbers from 
     public records first provided in electronic form after the 
     effective date of this section.
       ``(B) The cost or burden to the general public, businesses, 
     commercial enterprises, non-profit organizations, and to 
     Federal, State, and local governments of complying with 
     section 1028A with respect to such records.
       ``(C) The benefit to the general public, businesses, 
     commercial enterprises, non-profit organizations, and to 
     Federal, State, and local governments if the Attorney General 
     were to determine that section 1028A should apply to such 
     records.

     Nothing in the regulation shall permit a public entity to 
     post a category of public records on the Internet or in 
     electronic form after the effective date of this section if 
     such category had not been placed on the Internet or in 
     electronic form prior to such effective date.
       ``(d) Harvested Social Security Numbers.--Section 1028A 
     shall apply to any public record of a government entity which 
     contains social security numbers extracted from other public 
     records for the purpose of displaying or selling such numbers 
     to the general public.
       ``(e) Attorney General Rulemaking on Paper Records.--
       ``(1) In general.--Not later than 60 days after the date of 
     enactment of this section, the Attorney General shall 
     determine the feasibility and advisability of applying 
     section 1028A to the records listed in paragraph (2) when 
     they appear on paper or on another nonelectronic medium. If 
     the Attorney General deems it appropriate, the Attorney 
     General may issue regulations applying section 1028A to such 
     records.
       ``(2) List of paper and other nonelectronic records.--The 
     records listed in this paragraph are as follows:
       ``(A) Professional or occupational licenses.
       ``(B) Marriage licenses.
       ``(C) Birth certificates.
       ``(D) Death certificates.
       ``(E) Other short public documents that display a social 
     security number in a routine and consistent manner on the 
     face of the document.
       ``(3) Criteria for attorney general review.--In determining 
     whether section 1028A should apply to the records listed in 
     paragraph (2), the Attorney General shall consider the 
     following:
       ``(A) The cost or burden to the general public, businesses, 
     commercial enterprises, non-profit organizations, and to 
     Federal, State, and local governments of complying with 
     section 1028A.
       ``(B) The benefit to the general public, businesses, 
     commercial enterprises, non-profit organizations, and to 
     Federal, State, and local governments if the Attorney General 
     were to determine that section 1028A should apply to such 
     records.''.
       (2) Conforming Amendment.--The chapter analysis for chapter 
     47 of title 18, United States Code (as amended by section 
     202(a)(2)), is amended by inserting after the item relating 
     to section 1028A the following:

``1028B. Display, sale, or purchase of public records containing social 
              security numbers.''.
       (b) Study and Report on Social Security Numbers in Public 
     Records.--
       (1) Study.--The Comptroller General of the United States 
     shall conduct a study and prepare a report on social security 
     numbers in public records. In developing the report, the 
     Comptroller General shall consult with the Administrative 
     Office of the United States Courts, State and local 
     governments that store, maintain, or disseminate public 
     records, and other stakeholders, including members of the 
     private sector who routinely use public records that contain 
     social security numbers.
       (2) Report.--Not later than 1 year after the date of 
     enactment of this Act, the Comptroller General of the United 
     States shall submit to Congress a report on the study 
     conducted under paragraph (1). The report shall include a 
     detailed description of the activities and results of the 
     study and recommendations for such legislative action as the 
     Comptroller General considers appropriate. The report, at a 
     minimum, shall include--
       (A) a review of the uses of social security numbers in non-
     federal public records;
       (B) a review of the manner in which public records are 
     stored (with separate reviews for both paper records and 
     electronic records);
       (C) a review of the advantages or utility of public records 
     that contain social security numbers, including the utility 
     for law enforcement, and for the promotion of homeland 
     security;
       (D) a review of the disadvantages or drawbacks of public 
     records that contain social security numbers, including 
     criminal activity, compromised personal privacy, or threats 
     to homeland security;
       (E) the costs and benefits for State and local governments 
     of removing social security numbers from public records, 
     including a review of current technologies and procedures for 
     removing social security numbers from public records; and
       (F) an assessment of the benefits and costs to businesses, 
     their customers, and the general public of prohibiting the 
     display of social security numbers on public records (with 
     separate assessments for both paper records and electronic 
     records).
       (c) Effective Date.--The prohibition with respect to 
     electronic versions of new classes of public records under 
     section 1028B(b) of title 18, United States Code (as added by 
     subsection (a)(1)) shall not take effect until the

[[Page S4564]]

     date that is 60 days after the date of enactment of this Act.

     SEC. 204. RULEMAKING AUTHORITY OF THE ATTORNEY GENERAL.

       (a) In General.--Except as provided in subsection (b), the 
     Attorney General may prescribe such rules and regulations as 
     the Attorney General deems necessary to carry out the 
     provisions of section 1028A(e)(5) of title 18, United States 
     Code (as added by section 202(a)(1)).
       (b) Display, Sale, or Purchase Rulemaking With Respect to 
     Interactions Between Businesses, Governments, or Business and 
     Government.--
       (1) In general.--Not later than 1 year after the date of 
     enactment of this Act, the Attorney General, in consultation 
     with the Commissioner of Social Security, the Chairman of the 
     Federal Trade Commission, and such other heads of Federal 
     agencies as the Attorney General determines appropriate, 
     shall conduct such rulemaking procedures in accordance with 
     subchapter II of chapter 5 of title 5, United States Code, as 
     are necessary to promulgate regulations to implement and 
     clarify the uses occurring as a result of an interaction 
     between businesses, governments, or business and government 
     (regardless of which entity initiates the interaction) 
     permitted under section 1028A(e)(5) of title 18, United 
     States Code (as added by section 202(a)(1)).
       (2) Factors to be considered.--In promulgating the 
     regulations required under paragraph (1), the Attorney 
     General shall, at a minimum, consider the following:
       (A) The benefit to a particular business, to customers of 
     the business, and to the general public of the display, sale, 
     or purchase of an individual's social security number.
       (B) The costs that businesses, customers of businesses, and 
     the general public may incur as a result of prohibitions on 
     the display, sale, or purchase of social security numbers.
       (C) The risk that a particular business practice will 
     promote the use of a social security number to commit fraud, 
     deception, or crime.
       (D) The presence of adequate safeguards and procedures to 
     prevent--
       (i) misuse of social security numbers by employees within a 
     business; and
       (ii) misappropriation of social security numbers by the 
     general public, while permitting internal business uses of 
     such numbers.
       (E) The presence of procedures to prevent identity thieves, 
     stalkers, and other individuals with ill intent from posing 
     as legitimate businesses to obtain social security numbers.

     SEC. 205. TREATMENT OF SOCIAL SECURITY NUMBERS ON GOVERNMENT 
                   DOCUMENTS.

       (a) Prohibition of Use of Social Security Account Numbers 
     on Checks Issued for Payment by Governmental Agencies.--
       (1) In general.--Section 205(c)(2)(C) of the Social 
     Security Act (42 U.S.C. 405(c)(2)(C)) is amended by adding at 
     the end the following:
       ``(x) No Federal, State, or local agency may display the 
     social security account number of any individual, or any 
     derivative of such number, on any check issued for any 
     payment by the Federal, State, or local agency.''.
       (2) Effective date.--The amendment made by this subsection 
     shall apply with respect to violations of section 
     205(c)(2)(C)(x) of the Social Security Act (42 U.S.C. 
     405(c)(2)(C)(x)), as added by paragraph (1), occurring after 
     the date that is 3 years after the date of enactment of this 
     Act.
       (b) Prohibition of Appearance of Social Security Account 
     Numbers on Driver's Licenses or Motor Vehicle Registration.--
       (1) In general.--Section 205(c)(2)(C)(vi) of the Social 
     Security Act (42 U.S.C. 405(c)(2)(C)(vi)) is amended--
       (A) by inserting ``(I)'' after ``(vi)''; and
       (B) by adding at the end the following:
       ``(II)(aa) An agency of a State (or political subdivision 
     thereof), in the administration of any driver's license or 
     motor vehicle registration law within its jurisdiction, may 
     not display the social security account numbers issued by the 
     Commissioner of Social Security, or any derivative of such 
     numbers, on the face of any driver's license or motor vehicle 
     registration or any other document issued by such State (or 
     political subdivision thereof) to an individual for purposes 
     of identification of such individual.
       ``(bb) Nothing in this subclause shall be construed as 
     precluding an agency of a State (or political subdivision 
     thereof), in the administration of any driver's license or 
     motor vehicle registration law within its jurisdiction, from 
     using a social security account number for an internal use or 
     to link with the database of an agency of another State that 
     is responsible for the administration of any driver's license 
     or motor vehicle registration law.''.
       (2) Effective date.--The amendments made by this subsection 
     shall apply with respect to licenses, registrations, and 
     other documents issued or reissued after the date that is 1 
     year after the date of enactment of this Act.
       (c) Prohibition of Inmate Access to Social Security Account 
     Numbers.--
       (1) In general.--Section 205(c)(2)(C) of the Social 
     Security Act (42 U.S.C. 405(c)(2)(C)) (as amended by 
     subsection (b)) is amended by adding at the end the 
     following:
       ``(xi) No Federal, State, or local agency may employ, or 
     enter into a contract for the use or employment of, prisoners 
     in any capacity that would allow such prisoners access to the 
     social security account numbers of other individuals. For 
     purposes of this clause, the term `prisoner' means an 
     individual confined in a jail, prison, or other penal 
     institution or correctional facility pursuant to such 
     individual's conviction of a criminal offense.''.
       (2) Effective date.--The amendment made by this subsection 
     shall apply with respect to employment of prisoners, or entry 
     into contract with prisoners, after the date that is 1 year 
     after the date of enactment of this Act.

     SEC. 206. LIMITS ON PERSONAL DISCLOSURE OF A SOCIAL SECURITY 
                   NUMBER FOR CONSUMER TRANSACTIONS.

       (a) In General.--Part A of title XI of the Social Security 
     Act (42 U.S.C. 1301 et seq.) is amended by adding at the end 
     the following:

     ``SEC. 1150A. LIMITS ON PERSONAL DISCLOSURE OF A SOCIAL 
                   SECURITY NUMBER FOR CONSUMER TRANSACTIONS.

       ``(a) In General.--A commercial entity may not require an 
     individual to provide the individual's social security number 
     when purchasing a commercial good or service or deny an 
     individual the good or service for refusing to provide that 
     number except--
       ``(1) for any purpose relating to--
       ``(A) obtaining a consumer report for any purpose permitted 
     under the Fair Credit Reporting Act;
       ``(B) a background check of the individual conducted by a 
     landlord, lessor, employer, voluntary service agency, or 
     other entity as determined by the Attorney General;
       ``(C) law enforcement; or
       ``(D) a Federal, State, or local law requirement; or
       ``(2) if the social security number is necessary to verify 
     the identity of the consumer to effect, administer, or 
     enforce the specific transaction requested or authorized by 
     the consumer, or to prevent fraud.
       ``(b) Application of Civil Money Penalties.--A violation of 
     this section shall be deemed to be a violation of section 
     1129(a)(3)(F).
       ``(c) Application of Criminal Penalties.--A violation of 
     this section shall be deemed to be a violation of section 
     208(a)(8).
       ``(d) Limitation on Class Actions.--No class action 
     alleging a violation of this section shall be maintained 
     under this section by an individual or any private party in 
     Federal or State court.
       ``(e) State Attorney General Enforcement.--
       ``(1) In general.--
       ``(A) Civil actions.--In any case in which the attorney 
     general of a State has reason to believe that an interest of 
     the residents of that State has been or is threatened or 
     adversely affected by the engagement of any person in a 
     practice that is prohibited under this section, the State, as 
     parens patriae, may bring a civil action on behalf of the 
     residents of the State in a district court of the United 
     States of appropriate jurisdiction to--
       ``(i) enjoin that practice;
       ``(ii) enforce compliance with such section;
       ``(iii) obtain damages, restitution, or other compensation 
     on behalf of residents of the State; or
       ``(iv) obtain such other relief as the court may consider 
     appropriate.
       ``(B) Notice.--
       ``(i) In general.--Before filing an action under 
     subparagraph (A), the attorney general of the State involved 
     shall provide to the Attorney General--

       ``(I) written notice of the action; and
       ``(II) a copy of the complaint for the action.

       ``(ii) Exemption.--

       ``(I) In general.--Clause (i) shall not apply with respect 
     to the filing of an action by an attorney general of a State 
     under this subsection, if the State attorney general 
     determines that it is not feasible to provide the notice 
     described in such subparagraph before the filing of the 
     action.
       ``(II) Notification.--With respect to an action described 
     in subclause (I), the attorney general of a State shall 
     provide notice and a copy of the complaint to the Attorney 
     General at the same time as the State attorney general files 
     the action.

       ``(2) Intervention.--
       ``(A) In general.--On receiving notice under paragraph 
     (1)(B), the Attorney General shall have the right to 
     intervene in the action that is the subject of the notice.
       ``(B) Effect of intervention.--If the Attorney General 
     intervenes in the action under paragraph (1), the Attorney 
     General shall have the right to be heard with respect to any 
     matter that arises in that action.
       ``(3) Construction.--For purposes of bringing any civil 
     action under paragraph (1), nothing in this section shall be 
     construed to prevent an attorney general of a State from 
     exercising the powers conferred on such attorney general by 
     the laws of that State to--
       ``(A) conduct investigations;
       ``(B) administer oaths or affirmations; or
       ``(C) compel the attendance of witnesses or the production 
     of documentary and other evidence.
       ``(4) Actions by the attorney general of the united 
     states.--In any case in which an action is instituted by or 
     on behalf of the Attorney General for violation of a practice 
     that is prohibited under this section, no State may, during 
     the pendency of that action, institute an action under 
     paragraph (1) against any defendant named in the complaint in 
     that action for violation of that practice.
       ``(5) Venue; service of process.--
       ``(A) Venue.--Any action brought under paragraph (1) may be 
     brought in the district court of the United States that meets 
     applicable requirements relating to venue under section 1391 
     of title 28, United States Code.

[[Page S4565]]

       ``(B) Service of process.--In an action brought under 
     paragraph (1), process may be served in any district in which 
     the defendant--
       ``(i) is an inhabitant; or
       ``(ii) may be found.
       ``(f) Sunset.--This section shall not apply on or after the 
     date that is 6 years after the effective date of this 
     section.''.
       (b) Evaluation and Report.--Not later than the date that is 
     6 years and 6 months after the date of enactment of this Act, 
     the Attorney General, in consultation with the chairman of 
     the Federal Trade Commission, shall issue a report evaluating 
     the effectiveness and efficiency of section 1150A of the 
     Social Security Act (as added by subsection (a)) and shall 
     make recommendations to Congress as to any legislative action 
     determined to be necessary or advisable with respect to such 
     section, including a recommendation regarding whether to 
     reauthorize such section.
       (c) Effective Date.--The amendment made by subsection (a) 
     shall apply to requests to provide a social security number 
     occurring after the date that is 1 year after the date of 
     enactment of this Act.

     SEC. 207. EXTENSION OF CIVIL MONETARY PENALTIES FOR MISUSE OF 
                   A SOCIAL SECURITY NUMBER.

       (a) Treatment of Withholding of Material Facts.--
       (1) Civil penalties.--The first sentence of section 
     1129(a)(1) of the Social Security Act (42 U.S.C. 1320a-
     8(a)(1)) is amended--
       (A) by striking ``who'' and inserting ``who--'';
       (B) by striking ``makes'' and all that follows through 
     ``shall be subject to'' and inserting the following:
       ``(A) makes, or causes to be made, a statement or 
     representation of a material fact, for use in determining any 
     initial or continuing right to or the amount of monthly 
     insurance benefits under title II or benefits or payments 
     under title VIII or XVI, that the person knows or should know 
     is false or misleading;
       ``(B) makes such a statement or representation for such use 
     with knowing disregard for the truth; or
       ``(C) omits from a statement or representation for such 
     use, or otherwise withholds disclosure of, a fact which the 
     individual knows or should know is material to the 
     determination of any initial or continuing right to or the 
     amount of monthly insurance benefits under title II or 
     benefits or payments under title VIII or XVI and the 
     individual knows, or should know, that the statement or 
     representation with such omission is false or misleading or 
     that the withholding of such disclosure is misleading,

     shall be subject to'';
       (C) by inserting ``or each receipt of such benefits while 
     withholding disclosure of such fact'' after ``each such 
     statement or representation'';
       (D) by inserting ``or because of such withholding of 
     disclosure of a material fact'' after ``because of such 
     statement or representation''; and
       (E) by inserting ``or such a withholding of disclosure'' 
     after ``such a statement or representation''.
       (2) Administrative procedure for imposing penalties.--The 
     first sentence of section 1129A(a) of the Social Security Act 
     (42 U.S.C. 1320a-8a(a)) is amended--
       (A) by striking ``who'' and inserting ``who--''; and
       (B) by striking ``makes'' and all that follows through 
     ``shall be subject to'' and inserting the following:
       ``(1) makes, or causes to be made, a statement or 
     representation of a material fact, for use in determining any 
     initial or continuing right to or the amount of monthly 
     insurance benefits under title II or benefits or payments 
     under title VIII or XVI, that the person knows or should know 
     is false or misleading;
       ``(2) makes such a statement or representation for such use 
     with knowing disregard for the truth; or
       ``(3) omits from a statement or representation for such 
     use, or otherwise withholds disclosure of, a fact which the 
     individual knows or should know is material to the 
     determination of any initial or continuing right to or the 
     amount of monthly insurance benefits under title II or 
     benefits or payments under title VIII or XVI and the 
     individual knows, or should know, that the statement or 
     representation with such omission is false or misleading or 
     that the withholding of such disclosure is misleading,

     shall be subject to''.
       (b) Application of Civil Money Penalties to Elements of 
     Criminal Violations.--Section 1129(a) of the Social Security 
     Act (42 U.S.C. 1320a-8(a)), as amended by subsection (a)(1), 
     is amended--
       (1) by redesignating paragraph (2) as paragraph (4);
       (2) by redesignating the last sentence of paragraph (1) as 
     paragraph (2) and inserting such paragraph after paragraph 
     (1); and
       (3) by inserting after paragraph (2) (as so redesignated) 
     the following:
       ``(3) Any person (including an organization, agency, or 
     other entity) who--
       ``(A) uses a social security account number that such 
     person knows or should know has been assigned by the 
     Commissioner of Social Security (in an exercise of authority 
     under section 205(c)(2) to establish and maintain records) on 
     the basis of false information furnished to the Commissioner 
     by any person;
       ``(B) falsely represents a number to be the social security 
     account number assigned by the Commissioner of Social 
     Security to any individual, when such person knows or should 
     know that such number is not the social security account 
     number assigned by the Commissioner to such individual;
       ``(C) knowingly alters a social security card issued by the 
     Commissioner of Social Security, or possesses such a card 
     with intent to alter it;
       ``(D) knowingly displays, sells, or purchases a card that 
     is, or purports to be, a card issued by the Commissioner of 
     Social Security, or possesses such a card with intent to 
     display, purchase, or sell it;
       ``(E) counterfeits a social security card, or possesses a 
     counterfeit social security card with intent to display, 
     sell, or purchase it;
       ``(F) discloses, uses, compels the disclosure of, or 
     knowingly displays, sells, or purchases the social security 
     account number of any person in violation of the laws of the 
     United States;
       ``(G) with intent to deceive the Commissioner of Social 
     Security as to such person's true identity (or the true 
     identity of any other person) furnishes or causes to be 
     furnished false information to the Commissioner with respect 
     to any information required by the Commissioner in connection 
     with the establishment and maintenance of the records 
     provided for in section 205(c)(2);
       ``(H) offers, for a fee, to acquire for any individual, or 
     to assist in acquiring for any individual, an additional 
     social security account number or a number which purports to 
     be a social security account number; or
       ``(I) being an officer or employee of a Federal, State, or 
     local agency in possession of any individual's social 
     security account number, willfully acts or fails to act so as 
     to cause a violation by such agency of clause (vi)(II) or (x) 
     of section 205(c)(2)(C),

     shall be subject to, in addition to any other penalties that 
     may be prescribed by law, a civil money penalty of not more 
     than $5,000 for each violation. Such person shall also be 
     subject to an assessment, in lieu of damages sustained by the 
     United States resulting from such violation, of not more than 
     twice the amount of any benefits or payments paid as a result 
     of such violation.''.
       (c) Clarification of Treatment of Recovered Amounts.--
     Section 1129(e)(2)(B) of the Social Security Act (42 U.S.C. 
     1320a-8(e)(2)(B)) is amended by striking ``In the case of 
     amounts recovered arising out of a determination relating to 
     title VIII or XVI,'' and inserting ``In the case of any other 
     amounts recovered under this section,''.
       (d) Conforming Amendments.--
       (1) Section 1129(b)(3)(A) of the Social Security Act (42 
     U.S.C. 1320a-8(b)(3)(A)) is amended by striking ``charging 
     fraud or false statements''.
       (2) Section 1129(c)(1) of the Social Security Act (42 
     U.S.C. 1320a-8(c)(1)) is amended by striking ``and 
     representations'' and inserting ``, representations, or 
     actions''.
       (3) Section 1129(e)(1)(A) of the Social Security Act (42 
     U.S.C. 1320a-8(e)(1)(A)) is amended by striking ``statement 
     or representation referred to in subsection (a) was made'' 
     and inserting ``violation occurred''.
       (e) Effective Dates.--
       (1) In general.--Except as provided in paragraph (2), the 
     amendments made by this section shall apply with respect to 
     violations of sections 1129 and 1129A of the Social Security 
     Act (42 U.S.C. 1320-8 and 1320a-8a), as amended by this 
     section, committed after the date of enactment of this Act.
       (2) Violations by government agents in possession of social 
     security numbers.--Section 1129(a)(3)(I) of the Social 
     Security Act (42 U.S.C. 1320a-8(a)(3)(I)), as added by 
     subsection (b), shall apply with respect to violations of 
     that section occurring on or after the effective date 
     described in section 202(c).

     SEC. 208. CRIMINAL PENALTIES FOR THE MISUSE OF A SOCIAL 
                   SECURITY NUMBER.

       (a) Prohibition of Wrongful Use as Personal Identification 
     Number.--No person may obtain any individual's social 
     security number for purposes of locating or identifying an 
     individual with the intent to physically injure, harm, or use 
     the identity of the individual for any illegal purpose.
       (b) Criminal Sanctions.--Section 208(a) of the Social 
     Security Act (42 U.S.C. 408(a)) is amended--
       (1) in paragraph (8), by inserting ``or'' after the 
     semicolon; and
       (2) by inserting after paragraph (8) the following:
       ``(9) except as provided in subsections (e) and (f) of 
     section 1028A of title 18, United States Code, knowingly and 
     willfully displays, sells, or purchases (as those terms are 
     defined in section 1028A(a) of title 18, United States Code) 
     any individual's social security account number without 
     having met the prerequisites for consent under section 
     1028A(d) of title 18, United States Code; or
       ``(10) obtains any individual's social security number for 
     the purpose of locating or identifying the individual with 
     the intent to injure or to harm that individual, or to use 
     the identity of that individual for an illegal purpose;''.

     SEC. 209. CIVIL ACTIONS AND CIVIL PENALTIES.

       (a) Civil Action in State Courts.--
       (1) In general.--Any individual aggrieved by an act of any 
     person in violation of this title or any amendments made by 
     this title may, if otherwise permitted by the laws or rules 
     of the court of a State, bring in an appropriate court of 
     that State--
       (A) an action to enjoin such violation;

[[Page S4566]]

       (B) an action to recover for actual monetary loss from such 
     a violation, or to receive up to $500 in damages for each 
     such violation, whichever is greater; or
       (C) both such actions.

     It shall be an affirmative defense in any action brought 
     under this paragraph that the defendant has established and 
     implemented, with due care, reasonable practices and 
     procedures to effectively prevent violations of the 
     regulations prescribed under this title. If the court finds 
     that the defendant willfully or knowingly violated the 
     regulations prescribed under this subsection, the court may, 
     in its discretion, increase the amount of the award to an 
     amount equal to not more than 3 times the amount available 
     under subparagraph (B).
       (2) Statute of limitations.--An action may be commenced 
     under this subsection not later than the earlier of--
       (A) 5 years after the date on which the alleged violation 
     occurred; or
       (B) 3 years after the date on which the alleged violation 
     was or should have been reasonably discovered by the 
     aggrieved individual.
       (3) Nonexclusive remedy.--The remedy provided under this 
     subsection shall be in addition to any other remedies 
     available to the individual.
       (b) Civil Penalties.--
       (1) In general.--Any person who the Attorney General 
     determines has violated any section of this title or of any 
     amendments made by this title shall be subject, in addition 
     to any other penalties that may be prescribed by law--
       (A) to a civil penalty of not more than $5,000 for each 
     such violation; and
       (B) to a civil penalty of not more than $50,000, if the 
     violations have occurred with such frequency as to constitute 
     a general business practice.
       (2) Determination of violations.--Any willful violation 
     committed contemporaneously with respect to the social 
     security numbers of 2 or more individuals by means of mail, 
     telecommunication, or otherwise, shall be treated as a 
     separate violation with respect to each such individual.
       (3) Enforcement procedures.--The provisions of section 
     1128A of the Social Security Act (42 U.S.C. 1320a-7a), other 
     than subsections (a), (b), (f), (h), (i), (j), (m), and (n) 
     and the first sentence of subsection (c) of such section, and 
     the provisions of subsections (d) and (e) of section 205 of 
     such Act (42 U.S.C. 405) shall apply to a civil penalty 
     action under this subsection in the same manner as such 
     provisions apply to a penalty or proceeding under section 
     1128A(a) of such Act (42 U.S.C. 1320a-7a(a)), except that, 
     for purposes of this paragraph, any reference in section 
     1128A of such Act (42 U.S.C. 1320a-7a) to the Secretary shall 
     be deemed to be a reference to the Attorney General.

     SEC. 210. FEDERAL INJUNCTIVE AUTHORITY.

       In addition to any other enforcement authority conferred 
     under this title or the amendments made by this title, the 
     Federal Government shall have injunctive authority with 
     respect to any violation by a public entity of any provision 
     of this title or of any amendments made by this title.

   TITLE III--LIMITATIONS ON SALE AND SHARING OF NONPUBLIC PERSONAL 
                         FINANCIAL INFORMATION

     SEC. 301. DEFINITION OF SALE.

       Section 509 of the Gramm-Leach-Bliley Act (15 U.S.C. 6809) 
     is amended by adding at the end the following:
       ``(12) Sale.--The terms `sale', `sell', and `sold', with 
     respect to nonpublic personal information, mean the exchange 
     of such information for any thing of value, directly or 
     indirectly, including the licensing, bartering, or renting of 
     such information.''.

     SEC. 302. RULES APPLICABLE TO SALE OF NONPUBLIC PERSONAL 
                   INFORMATION.

       Section 502 of the Gramm-Leach-Bliley Act (15 U.S.C. 6802) 
     is amended--
       (1) in the section heading, by inserting ``SALES, AND OTHER 
     SHARING'' after ``DISCLOSURES'';
       (2) in subsection (a), by striking ``disclose to'' and 
     inserting ``sell or otherwise disclose to an affiliate or'';
       (3) in subsection (b)--
       (A) in the subsection heading, by inserting ``for 
     Disclosures to Affiliates'' before the period;
       (B) by striking ``a nonaffiliated third party'' each place 
     that term appears and inserting ``an affiliate'';
       (C) by striking ``such third party'' each place that term 
     appears and inserting ``such affiliate'';
       (D) by striking ``may not disclose'' and inserting ``may 
     not sell or otherwise disclose''; and
       (E) by striking paragraph (2) and inserting the following:
       ``(2) Exception.--This subsection shall not prevent a 
     financial institution from providing nonpublic personal 
     information to an affiliated third party to perform services 
     for or functions on behalf of the financial institution, 
     including marketing of the financial institution's own 
     products or services, if the financial institution fully 
     discloses the provision of such information and requires the 
     affiliate to maintain the confidentiality of such 
     information.'';
       (4) in subsection (d), by striking ``disclose'' and 
     inserting ``sell or otherwise disclose'';
       (5) by striking subsection (e);
       (6) by redesignating subsections (c) and (d) as subsections 
     (e) and (f), respectively; and
       (7) by inserting after subsection (b) the following:
       ``(c) Opt In for Disclosures to Nonaffiliated Third 
     Parties.--
       ``(1) Affirmative consent required.--A financial 
     institution may not sell or otherwise disclose nonpublic 
     personal information to any nonaffiliated third party, unless 
     the consumer to whom the information pertains--
       ``(A) has affirmatively consented to the sale or disclosure 
     of such information; and
       ``(B) has not withdrawn the consent.
       ``(2) Exception.--This subsection shall not prevent a 
     financial institution from providing nonpublic personal 
     information to a nonaffiliated third party to perform 
     services for or functions on behalf of the financial 
     institution, including marketing of the financial 
     institution's own products or services (subject to subsection 
     (d) with respect to joint agreements between 2 or more 
     financial institutions), if the financial institution fully 
     discloses the provision of such information and enters into a 
     contractual agreement with the nonaffiliated third party that 
     requires that third party to maintain the confidentiality of 
     such information.
       ``(d) Opt Out for Joint Agreements.--A financial 
     institution may not sell or otherwise disclose nonpublic 
     personal information to a nonaffiliated third party for the 
     purpose of offering financial products or services pursuant 
     to a joint agreement between 2 or more financial 
     institutions, unless--
       ``(1) the financial institution clearly and conspicuously 
     discloses to the consumer to whom the information pertains, 
     in writing or in electronic form or other form permitted by 
     the regulations prescribed under section 504, that such 
     information may be disclosed to such nonaffiliated third 
     party;
       ``(2) the consumer is given the opportunity, before the 
     time that such information is initially disclosed, to direct 
     that such information not be disclosed to such nonaffiliated 
     third party;
       ``(3) the consumer is given an explanation of how the 
     consumer can exercise that nondisclosure option; and
       ``(4) the financial institution receiving the nonpublic 
     personal information signs a written agreement obliging it--
       ``(A) to maintain the confidentiality of the information; 
     and
       ``(B) to refrain from using, selling, or otherwise 
     disclosing the information other than to carry out the joint 
     offering or servicing of the financial product or financial 
     service that is the subject of the written agreement.''.

     SEC. 303. EXCEPTIONS TO DISCLOSURE PROHIBITION.

       (a) In General.--Section 502 of the Gramm-Leach-Bliley Act 
     (15 U.S.C. 6802), as amended by this title, is amended by 
     adding at the end the following:
       ``(g) General Exceptions.--Notwithstanding any other 
     provision of this section, this section does not prohibit--
       ``(1) the sale or other disclosure of nonpublic personal 
     information to an affiliate or a nonaffiliated third party--
       ``(A) as necessary to effect, administer, or enforce a 
     transaction requested or authorized by the consumer to whom 
     the information pertains, or in connection with--
       ``(i) servicing or processing a financial product or 
     service requested or authorized by the consumer;
       ``(ii) maintaining or servicing the account of the consumer 
     with the financial institution, or with another entity as 
     part of a private label credit card program or other 
     extension of credit on behalf of such entity; or
       ``(iii) a proposed or actual securitization, secondary 
     market sale (including sales of servicing rights), or similar 
     transaction related to a transaction of the consumer;
       ``(B) with the consent or at the direction of the consumer, 
     in accordance with applicable rules prescribed under this 
     subtitle;
       ``(C) to the extent specifically permitted or required 
     under other provisions of law and in accordance with the 
     Right to Financial Privacy Act of 1978; or
       ``(D) to law enforcement agencies (including a Federal 
     functional regulator, the Secretary of the Treasury, with 
     respect to subchapter II of chapter 53 of title 31, United 
     States Code, and chapter 2 of title I of Public Law 91-508 
     (12 U.S.C. 1951-1959), a State insurance authority, or the 
     Federal Trade Commission), self-regulatory organizations, or 
     for an investigation on a matter related to public safety;
       ``(2) the disclosure, other than the sale, of nonpublic 
     personal information to identify or locate missing and 
     abducted children, witnesses, criminals, and fugitives, 
     parties to lawsuits, parents, delinquents in child support 
     payments, organ and bone marrow donors, pension fund 
     beneficiaries, and missing heirs; or
       ``(3) the disclosure, other than the sale, of nonpublic 
     personal information--
       ``(A) to protect the confidentiality or security of the 
     records of the financial institution pertaining to the 
     consumer, the service or product, or the transaction therein;
       ``(B) to protect against or prevent actual or potential 
     fraud, unauthorized transactions, claims, or other liability;
       ``(C) for required institutional risk control, or for 
     resolving customer disputes or inquiries;
       ``(D) to persons holding a legal or beneficial interest 
     relating to the consumer;
       ``(E) to persons acting in a fiduciary or representative 
     capacity on behalf of the consumer;
       ``(F) to provide information to insurance rate advisory 
     organizations, guaranty funds

[[Page S4567]]

     or agencies, applicable rating agencies of the financial 
     institution, persons assessing the compliance of the 
     institution with industry standards, or the attorneys, 
     accountants, or auditors of the institution;
       ``(G) to a consumer reporting agency, in accordance with 
     the Fair Credit Reporting Act or from a consumer report 
     reported by a consumer reporting agency, as those terms are 
     defined in that Act;
       ``(H) in connection with a proposed or actual sale, merger, 
     transfer, or exchange of all or a portion of a business or 
     operating unit if the disclosure of nonpublic personal 
     information concerns solely consumers of such business or 
     unit;
       ``(I) to comply with Federal, State, or local laws, rules, 
     or other applicable legal requirements, or with a properly 
     authorized civil, criminal, or regulatory investigation or 
     subpoena or summons by Federal, State, or local authorities; 
     or
       ``(J) to respond to judicial process or government 
     regulatory authorities having jurisdiction over the financial 
     institution for examination, compliance, or other purposes, 
     as authorized by law.
       ``(h) Denial of Service Prohibited.--A financial 
     institution may not deny any consumer a financial product or 
     a financial service as a result of the refusal by the 
     consumer to grant consent to disclosure under this section or 
     the exercise by the consumer of a nondisclosure option under 
     this section, except that nothing in this subsection may be 
     construed to prohibit a financial institution from offering 
     incentives to elicit consumer consent to the use of his or 
     her nonpublic personal information.''.
       (b) Repeal of Regulatory Exemption Authority.--Section 504 
     of the Gramm-Leach-Bliley Act (15 U.S.C. 6804) is amended--
       (1) by striking subsection (b);
       (2) by striking ``(a) Regulatory Authority.--'';
       (3) by redesignating paragraphs (1), (2), and (3) as 
     subsections (a), (b), and (c), respectively, and moving the 
     margins 2 ems to the left; and
       (4) by striking ``paragraph (1)'' and inserting 
     ``subsection (a)''.

     SEC. 304. CONFORMING AMENDMENTS.

       Title V of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 et 
     seq.) is amended--
       (1) in section 503(b)(1) (15 U.S.C. 6803(b)(1))--
       (A) by inserting ``affiliates and'' before 
     ``nonaffiliated''; and
       (B) in subparagraph (A), by striking ``502(e)'' and 
     inserting ``502(g)''; and
       (2) in section 509(3)(D) (15 U.S.C. 6809(3)(D)), by 
     striking ``502(e)(1)(C)'' and inserting 
     ``502(g)(1)(A)(iii)''.

     SEC. 305. REGULATORY AUTHORITY.

       Not later than 6 months after the date of enactment of this 
     Act, the agencies referred to in section 504(a)(1) of the 
     Gramm-Leach-Bliley Act (15 U.S.C. 6804(a)(1)) shall 
     promulgate final regulations in accordance with that section 
     504 to carry out the amendments made by this Act.

     SEC. 306. EFFECTIVE DATE.

       This title and the amendments made by this title shall take 
     effect 6 months after the date of enactment of this Act.

 TITLE IV--LIMITATIONS ON THE PROVISION OF PROTECTED HEALTH INFORMATION

     SEC. 401. DEFINITIONS.

       In this title:
       (1) Business associate.--
       (A) In general.--Except as provided in subparagraph (B), 
     the term ``business associate'' means, with respect to a 
     covered entity, a person who--
       (i) on behalf of such covered entity or of an organized 
     health care arrangement in which the covered entity 
     participates, but other than in the capacity of a member of 
     the workforce of such covered entity or arrangement, 
     performs, or assists in the performance of--

       (I) a function or activity involving the use or disclosure 
     of individually identifiable health information, including 
     claims processing or administration, data analysis, 
     processing or administration, utilization review, quality 
     assurance, billing, benefit management, practice management, 
     and repricing; or
       (II) any other function or activity regulated under 
     subchapter C of title 45, Code of Federal Regulations; or

       (ii) provides, other than in the capacity of a member of 
     the workforce of such covered entity, legal, actuarial, 
     accounting, consulting, data aggregation (as defined in 
     section 164.501 of title 45, Code of Federal Regulations), 
     management, administrative, accreditation, or financial 
     services to or for such covered entity, or to or for an 
     organized health care arrangement in which the covered entity 
     participates, where the provision of the service involves the 
     disclosure of individually identifiable health information 
     from such covered entity or arrangement, or from another 
     business associate of such covered entity or arrangement, to 
     the person.
       (B) Limitations.--
       (i) In general.--A covered entity participating in an 
     organized health care arrangement that performs a function or 
     activity as described by subparagraph (A)(i) for or on behalf 
     of such organized health care arrangement, or that provides a 
     service as described in subparagraph (A)(ii) to or for such 
     organized health care arrangement, does not, simply through 
     the performance of such function or activity or the provision 
     of such service, become a business associate of other covered 
     entities participating in such organized health care 
     arrangement.
       (ii) Limitation.--A covered entity may be a business 
     associate of another covered entity.
       (2) Covered entity.--The term ``covered entity'' means--
       (A) a health plan;
       (B) a health care clearinghouse; and
       (C) a health care provider who transmits any health 
     information in electronic form in connection with a 
     transaction covered by parts 160 through 164 of title 45, 
     Code of Federal Regulations.
       (3) Disclosure.--The term ``disclosure'' means the release, 
     transfer, provision of access to, or divulging in any other 
     manner of information outside the entity holding the 
     information.
       (4) Employer.--The term ``employer'' has the meaning given 
     that term in section 3401(d) of the Internal Revenue Code of 
     1986.
       (5) Group health plan.--The term ``group health plan'' 
     means an employee welfare benefit plan (as defined in section 
     3(1) of the Employee Retirement Income and Security Act of 
     1974 (29 U.S.C. 1002(1)), including insured and self-insured 
     plans, to the extent that the plan provides medical care (as 
     defined in section 2791(a)(2) of the Public Health Service 
     Act, 42 U.S.C. 300gg-91(a)(2)), including items and services 
     paid for as medical care, to employees or their dependents 
     directly or through insurance, reimbursement, or otherwise, 
     that--
       (A) has 50 or more participants (as defined in section 3(7) 
     of Employee Retirement Income and Security Act of 1974, 29 
     U.S.C. 1002(7)); or
       (B) is administered by an entity other than the employer 
     that established and maintains the plan.
       (6) Health care.--The term ``health care'' includes, but is 
     not limited to, the following:
       (A) Preventive, diagnostic, therapeutic, rehabilitative, 
     maintenance, or palliative care and counseling, service, 
     assessment, or procedure with respect to the physical or 
     mental condition, or functional status, of an individual or 
     that affects the structure or function of the body.
       (B) The sale or dispensing of a drug, device, equipment, or 
     other item in accordance with a prescription.
       (7) Health care clearinghouse.--The term ``health care 
     clearinghouse'' means a public or private entity, including a 
     billing service, repricing company, community health 
     management information system or community health information 
     system, and value-added networks and switches, that--
       (A) processes or facilitates the processing of health 
     information received from another entity in a nonstandard 
     format or containing nonstandard data content into standard 
     data elements or a standard transaction; or
       (B) receives a standard transaction from another entity and 
     processes or facilitates the processing of health information 
     into nonstandard format or nonstandard data content for the 
     receiving entity.
       (8) Health care provider.--The term ``health care 
     provider'' has the meaning given the terms ``provider of 
     services'' and ``provider of medical or health services'' in 
     subsections (u) and (s) of section 1861 of the Social 
     Security Act (42 U.S.C. 1395x), respectively, and includes 
     any other person or organization who furnishes, bills, or is 
     paid for health care in the normal course of business.
       (9) Health information.--The term ``health information'' 
     means any information, whether oral or recorded in any form 
     or medium, that--
       (A) is created or received by a health care provider, 
     health plan, public health authority, employer, life insurer, 
     school or university, or health care clearinghouse; and
       (B) relates to the past, present, or future physical or 
     mental health or condition of an individual; the provision of 
     health care to an individual; or the past, present, or future 
     payment for the provision of health care to an individual.
       (10) Health insurance issuer.--The term ``health insurance 
     issuer'' means a health insurance issuer (as defined in 
     section 2791(b)(2) of the Public Health Service Act, 42 
     U.S.C. 300gg-91(b)(2)) and used in the definition of health 
     plan in this section and includes an insurance company, 
     insurance service, or insurance organization (including an 
     HMO) that is licensed to engage in the business of insurance 
     in a State and is subject to State law that regulates 
     insurance. Such term does not include a group health plan.
       (11) Health maintenance organization.--The term ``health 
     maintenance organization'' (HMO) (as defined in section 
     2791(b)(3) of the Public Health Service Act, 42 U.S.C. 300gg-
     91 (b)(3)) and used in the definition of health plan in this 
     section, means a federally qualified HMO, an organization 
     recognized as an HMO under State law, or a similar 
     organization regulated for solvency under State law in the 
     same manner and to the same extent as such an HMO.
       (12) Health oversight agency.--The term ``health oversight 
     agency'' means an agency or authority of the United States, a 
     State, a territory, a political subdivision of a State or 
     territory, or an Indian tribe, or a person or entity acting 
     under a grant of authority from or contract with such public 
     agency, including the employees or agents of such public 
     agency or its contractors or persons or entities to whom it 
     has granted authority, that is authorized by law to oversee 
     the health care system (whether public or private) or 
     government programs in which health information is necessary 
     to determine eligibility or compliance, or to enforce civil

[[Page S4568]]

     rights laws for which health information is relevant.
       (13) Health plan.--The term ``health plan'' means an 
     individual or group plan that provides, or pays the cost of, 
     medical care, as defined in section 2791(a)(2) of the Public 
     Health Service Act (42 U.S.C. 300gg-91(a)(2))--
       (A) including, singly or in combination--
       (i) a group health plan;
       (ii) a health insurance issuer;
       (iii) an HMO;
       (iv) part A or B of the medicare program under title XVIII 
     of the Social Security Act (42 U.S.C. 1395 et seq.);
       (v) the medicaid program under title XIX of the Social 
     Security Act (42 U.S.C. 1396 et seq.);
       (vi) an issuer of a medicare supplemental policy (as 
     defined in section 1882(g)(1) of the Social Security Act, 42 
     U.S.C. 1395ss(g)(1));
       (vii) an issuer of a long-term care policy, excluding a 
     nursing home fixed-indemnity policy;
       (viii) an employee welfare benefit plan or any other 
     arrangement that is established or maintained for the purpose 
     of offering or providing health benefits to the employees of 
     2 or more employers;
       (ix) the health care program for active military personnel 
     under title 10, United States Code;
       (x) the veterans health care program under chapter 17 of 
     title 38, United States Code;
       (xi) the Civilian Health and Medical Program of the 
     Uniformed Services (CHAMPUS) (as defined in section 1072(4) 
     of title 10, United States Code);
       (xii) the Indian Health Service program under the Indian 
     Health Care Improvement Act (25 U.S.C. 1601 et seq.);
       (xiii) the Federal Employees Health Benefits Program under 
     chapter 89 of title 5, United States Code;
       (xiv) an approved State child health plan under title XXI 
     of the Social Security Act (42 U.S.C. 1397aa et seq.), 
     providing benefits for child health assistance that meet the 
     requirements of section 2103 of such Act (42 U.S.C. 1397cc);
       (xv) the Medicare+Choice program under part C of title 
     XVIII of the Social Security Act (42 U.S.C. 1395w-21 et 
     seq.);
       (xvi) a high risk pool that is a mechanism established 
     under State law to provide health insurance coverage or 
     comparable coverage to eligible individuals; and
       (xvii) any other individual or group plan, or combination 
     of individual or group plans, that provides or pays for the 
     cost of medical care (as defined in section 2791(a)(2) of the 
     Public Health Service Act (42 U.S.C. 300gg-91(a)(2)); and
       (B) excluding--
       (i) any policy, plan, or program to the extent that it 
     provides, or pays for the cost of, excepted benefits that are 
     listed in section 2791(c)(1) of the Public Health Service Act 
     (42 U.S.C. 300gg-91(c)(1)); and
       (ii) a government-funded program (other than 1 listed in 
     clause (i) through (xvi) of subparagraph (A)), whose 
     principal purpose is other than providing, or paying the cost 
     of, health care, or whose principal activity is the direct 
     provision of health care to persons, or the making of grants 
     to fund the direct provision of health care to persons.
       (14) Individually identifiable health information.--The 
     term ``individually identifiable health information'' means 
     information that is a subset of health information, including 
     demographic information collected from an individual, that--
       (A) is created or received by a covered entity or employer; 
     and
       (B)(i) relates to the past, present, or future physical or 
     mental health or condition of an individual, the provision of 
     health care to an individual, or the past, present, or future 
     payment for the provision of health care to an individual; 
     and
       (ii)(I) identifies an individual; or
       (II) with respect to which there is a reasonable basis to 
     believe that the information can be used to identify an 
     individual.
       (15) Law enforcement official.--The term ``law enforcement 
     official'' means an officer or employee of any agency or 
     authority of the United States, a State, a territory, a 
     political subdivision of a State or territory, or an Indian 
     tribe, who is empowered by law to--
       (A) investigate or conduct an official inquiry into a 
     potential violation of law; or
       (B) prosecute or otherwise conduct a criminal, civil, or 
     administrative proceeding arising from an alleged violation 
     of law.
       (16) Life insurer.--The term ``life insurer'' means a life 
     insurance company (as defined in section 816 of the Internal 
     Revenue Code of 1986), including the employees and agents of 
     such company.
       (17) Marketing.--The term ``marketing'' means to make a 
     communication about a product or service that encourages 
     recipients of the communication to purchase or use the 
     product or service.
       (18) Noncovered entity.--The term ``noncovered entity'' 
     means any person or public or private entity that is not a 
     covered entity, including but not limited to a business 
     associate of a covered entity, a covered entity if such 
     covered entity is acting as a business associate, a health 
     researcher, school or university, life insurer, employer, 
     public health authority, health oversight agency, or law 
     enforcement official, or any person acting as an agent of 
     such entities or persons.
       (19) Organized health care arrangement.--The term 
     ``organized health care arrangement'' means--
       (A) a clinically integrated care setting in which 
     individuals typically receive health care from more than 1 
     health care provider;
       (B) an organized system of health care in which more than 1 
     covered entity participates, and in which the participating 
     covered entities--
       (i) hold themselves out to the public as participating in a 
     joint arrangement; and
       (ii) participate in joint activities including at least--

       (I) utilization review, in which health care decisions by 
     participating covered entities are reviewed by other 
     participating covered entities or by a third party on their 
     behalf;
       (II) quality assessment and improvement activities, in 
     which treatment provided by participating covered entities is 
     assessed by other participating covered entities or by a 
     third party on their behalf; or
       (III) payment activities, if the financial risk for 
     delivering health care is shared, in part or in whole, by 
     participating covered entities through the joint arrangement 
     and if protected health information created or received by a 
     covered entity is reviewed by other participating covered 
     entities or by a third party on their behalf for the purpose 
     of administering the sharing of financial risk;

       (C) a group health plan and a health insurance issuer or 
     HMO with respect to such group health plan, but only with 
     respect to protected health information created or received 
     by such health insurance issuer or HMO that relates to 
     individuals who are or who have been participants or 
     beneficiaries in such group health plan;
       (D) a group health plan and 1 or more other group health 
     plans each of which are maintained by the same plan sponsor; 
     or
       (E) the group health plans described in subparagraph (D) 
     and health insurance issuers or HMOs with respect to such 
     group health plans, but only with respect to protected health 
     information created or received by such health insurance 
     issuers or HMOs that relates to individuals who are or have 
     been participants or beneficiaries in any of such group 
     health plans.
       (20) Protected health information.--
       (A) In general.--The term ``protected health information'' 
     means individually identifiable health information that, 
     except as provided in subparagraph (B), is--
       (i) transmitted by electronic media;
       (ii) maintained in any medium described in the definition 
     of electronic media in section 162.103 of title 45, Code of 
     Federal Regulations; or
       (iii) transmitted or maintained in any other form or 
     medium.
       (B) Exclusions.--Such term does not include individually 
     identifiable health information in--
       (i) education records covered by the Family Educational 
     Rights and Privacy Act of 1974 (section 444 of the General 
     Education Provisions Act (20 U.S.C. 1232g));
       (ii) records described in subsection (a)(4)(B)(iv) of that 
     Act; or
       (iii) employment records held by a covered entity in its 
     role as an employer.
       (21) Public health authority.--The term ``public health 
     authority'' means an agency or authority of the United 
     States, a State, a territory, a political subdivision of a 
     State or territory, or an Indian tribe, or a person or entity 
     acting under a grant of authority from or contract with such 
     public agency, including employees or agents of such public 
     agency or its contractors or persons or entities to whom it 
     has granted authority, that is responsible for public health 
     matters as part of its official mandate.
       (22) School or university.--The term ``school or 
     university'' means an institution or place for instruction or 
     education, including an elementary school, secondary school, 
     or institution of higher learning, a college, or an 
     assemblage of colleges united under 1 corporate organization 
     or government.
       (23) Secretary.--The term ``Secretary'' means the Secretary 
     of Health and Human Services.
       (24) Sale; sell; sold.--The terms ``sale'', ``sell'', and 
     ``sold'', with respect to protected health information, mean 
     the exchange of such information for anything of value, 
     directly or indirectly, including the licensing, bartering, 
     or renting of such information.
       (25) Use.--The term ``use'' means, with respect to 
     individually identifiable health information, the sharing, 
     employment, application, utilization, examination, or 
     analysis of such information within an entity that maintains 
     such information.
       (26) Writing.--The term ``writing'' means writing in either 
     a paper-based or computer-based form, including electronic 
     and digital signatures.

     SEC. 402. PROHIBITION AGAINST SELLING PROTECTED HEALTH 
                   INFORMATION.

       (a) Valid Authorization Required.--
       (1) In General.--A noncovered entity shall not sell the 
     protected health information of an individual or use such 
     information for marketing purposes without an authorization 
     that is valid under section 403. When a noncovered entity 
     obtains or receives authorization to sell such information, 
     such sale must be consistent with such authorization.
       (2) No duplicate authorization required.--Nothing in 
     paragraph (1) shall be construed as requiring a noncovered 
     entity that receives from a covered entity an authorization 
     that is valid under section 403 to obtain a separate 
     authorization from an individual before the sale or use of 
     the individual's protected health information so long as the 
     sale or use of the information is consistent with the terms 
     of the authorization.

[[Page S4569]]

       (b) Scope.--A sale of protected health information as 
     described under subsection (a) shall be limited to the 
     minimum amount of information necessary to accomplish the 
     purpose for which the sale is made.
       (c) Purpose.--A recipient of information sold pursuant to 
     this title may use or disclose such information solely to 
     carry out the purpose for which the information was sold.
       (d) Not Required.--Nothing in this title permitting the 
     sale of protected health information shall be construed to 
     require such sale.
       (e) Identification of Information as Protected Health 
     Information.--Information sold pursuant to this title shall 
     be clearly identified as protected health information.
       (f) No Waiver.--Except as provided in this title, an 
     individual's authorization to sell protected health 
     information shall not be construed as a waiver of any rights 
     that the individual has under other Federal or State laws, 
     the rules of evidence, or common law.

     SEC. 403. AUTHORIZATION FOR SALE OR MARKETING OF PROTECTED 
                   HEALTH INFORMATION BY NONCOVERED ENTITIES.

       (a) Valid Authorization.--A valid authorization is a 
     document that complies with all requirements of this section. 
     Such authorization may include additional information not 
     required under this section, provided that such information 
     is not inconsistent with the requirements of this section.
       (b) Defective Authorization.--An authorization is not 
     valid, if the document submitted has any of the following 
     defects:
       (1) The expiration date has passed or the expiration event 
     is known by the noncovered entity to have occurred.
       (2) The authorization has not been filled out completely, 
     with respect to an element described in subsections (e) and 
     (f).
       (3) The authorization is known by the noncovered entity to 
     have been revoked.
       (4) The authorization lacks an element required by 
     subsections (e) and (f).
       (5) Any material information in the authorization is known 
     by the noncovered entity to be false.
       (c) Revocation of Authorization.--An individual may revoke 
     an authorization provided under this section at any time 
     provided that the revocation is in writing, except to the 
     extent that the noncovered entity has taken action in 
     reliance thereon.
       (d) Documentation.--
       (1) In general.--A noncovered entity must document and 
     retain any signed authorization under this section as 
     required under paragraph (2).
       (2) Standard.--A noncovered entity shall, if a 
     communication is required by this title to be in writing, 
     maintain such writing, or an electronic copy, as 
     documentation.
       (3) Retention period.--A noncovered entity shall retain the 
     documentation required by this section for 6 years from the 
     date of its creation or the date when it last was in effect, 
     whichever is later.
       (e) Content of Authorization.--
       (1) Content.--An authorization described in subsection (a) 
     shall--
       (A) contain a description of the information to be sold 
     that identifies such information in a specific and meaningful 
     manner;
       (B) contain the name or other specific identification of 
     the person, or class of persons, authorized to sell the 
     information;
       (C) contain the name or other specific identification of 
     the person, or class of persons, to whom the information is 
     to be sold;
       (D) include an expiration date or an expiration event 
     relating to the selling of such information that signifies 
     that the authorization is valid until such date or event;
       (E) include a statement that the individual has a right to 
     revoke the authorization in writing and the exceptions to the 
     right to revoke, and a description of the procedure involved 
     in such revocation;
       (F) be in writing and include the signature of the 
     individual and the date, or if the authorization is signed by 
     a personal representative of the individual, a description of 
     such representative's authority to act for the individual; 
     and
       (G) include a statement explaining the purpose for which 
     such information is sold.
       (2) Plain language.--The authorization shall be written in 
     plain language.
       (f) Notice.--
       (1) In general.--The authorization shall include a 
     statement that the individual may--
       (A) inspect or copy the protected health information to be 
     sold; and
       (B) refuse to sign the authorization.
       (2) Copy to the individual.--A noncovered entity shall 
     provide the individual with a copy of the signed 
     authorization.
       (g) Model Authorizations.--The Secretary, after notice and 
     opportunity for public comment, shall develop and disseminate 
     model written authorizations of the type described in this 
     section and model statements of the limitations on such 
     authorizations. Any authorization obtained on a model 
     authorization form developed by the Secretary pursuant to the 
     preceding sentence shall be deemed to satisfy the 
     requirements of this section.
       (h) Noncoercion.--A covered entity or noncovered entity 
     shall not condition the purchase of a product or the 
     provision of a service to an individual based on whether such 
     individual provides an authorization to such entity as 
     described in this section.

     SEC. 404. PROHIBITION AGAINST RETALIATION.

       A noncovered entity that collects protected health 
     information, may not adversely affect another person, 
     directly or indirectly, because such person has exercised a 
     right under this title, disclosed information relating to a 
     possible violation of this title, or associated with, or 
     assisted, a person in the exercise of a right under this 
     title.

     SEC. 405. RULE OF CONSTRUCTION.

       The requirements of this title shall not be construed to 
     impose any additional requirements or in any way alter the 
     requirements imposed upon covered entities under parts 160 
     through 164 of title 45, Code of Federal Regulations.

     SEC. 406. REGULATIONS.

       (a) In General.--The Secretary shall promulgate regulations 
     implementing the provisions of this title.
       (b) Timeframe.--Not later than 1 year after the date of 
     enactment of this Act, the Secretary shall publish proposed 
     regulations in the Federal Register. With regard to such 
     proposed regulations, the Secretary shall provide an 
     opportunity for submission of comments by interested persons 
     during a period of not less than 90 days. Not later than 2 
     years after the date of enactment of this Act, the Secretary 
     shall publish final regulations in the Federal Register.

     SEC. 407. ENFORCEMENT.

       (a) In General.--A covered entity or noncovered entity that 
     knowingly violates section 402 shall be subject to a civil 
     money penalty under this section.
       (b) Amount.--The civil money penalty described in 
     subsection (a) shall not exceed $100,000. In determining the 
     amount of any penalty to be assessed, the Secretary shall 
     take into account the previous record of compliance of the 
     entity being assessed with the applicable provisions of this 
     title and the gravity of the violation.
       (c) Administrative Review.--
       (1) Opportunity for hearing.--The entity assessed shall be 
     afforded an opportunity for a hearing by the Secretary upon 
     request made within 30 days after the date of the issuance of 
     a notice of assessment. In such hearing the decision shall be 
     made on the record pursuant to section 554 of title 5, United 
     States Code. If no hearing is requested, the assessment shall 
     constitute a final and unappealable order.
       (2) Hearing procedure.--If a hearing is requested, the 
     initial agency decision shall be made by an administrative 
     law judge, and such decision shall become the final order 
     unless the Secretary modifies or vacates the decision. Notice 
     of intent to modify or vacate the decision of the 
     administrative law judge shall be issued to the parties 
     within 30 days after the date of the decision of the judge. A 
     final order which takes effect under this paragraph shall be 
     subject to review only as provided under subsection (d).
       (d) Judicial Review.--
       (1) Filing of action for review.--Any entity against whom 
     an order imposing a civil money penalty has been entered 
     after an agency hearing under this section may obtain review 
     by the United States district court for any district in which 
     such entity is located or the United States District Court 
     for the District of Columbia by filing a notice of appeal in 
     such court within 30 days from the date of such order, and 
     simultaneously sending a copy of such notice by registered 
     mail to the Secretary.
       (2) Certification of administrative record.--The Secretary 
     shall promptly certify and file in such court the record upon 
     which the penalty was imposed.
       (3) Standard for review.--The findings of the Secretary 
     shall be set aside only if found to be unsupported by 
     substantial evidence as provided by section 706(2)(E) of 
     title 5, United States Code.
       (4) Appeal.--Any final decision, order, or judgment of the 
     district court concerning such review shall be subject to 
     appeal as provided in chapter 83 of title 28 of such Code.
       (e) Failure To Pay Assessment; Maintenance of Action.--
       (1) Failure to pay assessment.--If any entity fails to pay 
     an assessment after it has become a final and unappealable 
     order, or after the court has entered final judgment in favor 
     of the Secretary, the Secretary shall refer the matter to the 
     Attorney General who shall recover the amount assessed by 
     action in the appropriate United States district court.
       (2) Nonreviewability.--In such action the validity and 
     appropriateness of the final order imposing the penalty shall 
     not be subject to review.
       (f) Payment of Penalties.--Except as otherwise provided, 
     penalties collected under this section shall be paid to the 
     Secretary (or other officer) imposing the penalty and shall 
     be available without appropriation and until expended for the 
     purpose of enforcing the provisions with respect to which the 
     penalty was imposed.

                   TITLE V--DRIVER'S LICENSE PRIVACY

     SEC. 501. DRIVER'S LICENSE PRIVACY.

       Section 2725 of title 18, United States Code, is amended by 
     striking paragraphs (2) through (4) and adding the following:
       ``(2) `person' means an individual, organization, or 
     entity, but does not include a State or agency thereof;
       ``(3) `personal information' means information that 
     identifies an individual, including an individual's 
     photograph, social security number, driver identification 
     number, name, address (but not the 5-digit zip code), 
     telephone number, medical or disability information, any 
     physical copy of a driver's license, birth date, information 
     on physical characteristics, including height, weight, sex or 
     eye color, or any biometric identifiers on

[[Page S4570]]

     a license, including a finger print, but not information on 
     vehicular accidents, driving violations, and driver's status;
       ``(4) `highly restricted personal information' means an 
     individual's photograph or image, social security number, 
     medical or disability information, any physical copy of a 
     driver's license, driver identification number, birth date, 
     information on physical characteristics, including height, 
     weight, sex, or eye color, or any biometric identifiers on a 
     license, including a finger print; and''.

                        TITLE VI--MISCELLANEOUS

     SEC. 601. ENFORCEMENT BY STATE ATTORNEYS GENERAL.

       (a) In General.--
       (1) Civil actions.--In any case in which the attorney 
     general of a State has reason to believe that an interest of 
     the residents of that State has been or is threatened or 
     adversely affected by the engagement of any person in a 
     practice that is prohibited under title I, II, or IV of this 
     Act or under any amendment made by such a title, the State, 
     as parens patriae, may bring a civil action on behalf of the 
     residents of the State in a district court of the United 
     States of appropriate jurisdiction to--
       (A) enjoin that practice;
       (B) enforce compliance with such titles or such amendments;
       (C) obtain damage, restitution, or other compensation on 
     behalf of residents of the State; or
       (D) obtain such other relief as the court may consider to 
     be appropriate.
       (2) Notice.--
       (A) In general.--Before filing an action under paragraph 
     (1), the attorney general of the State involved shall provide 
     to the Attorney General--
       (i) written notice of the action; and
       (ii) a copy of the complaint for the action.
       (B) Exemption.--
       (i) In general.--Subparagraph (A) shall not apply with 
     respect to the filing of an action by an attorney general of 
     a State under this subsection, if the State attorney general 
     determines that it is not feasible to provide the notice 
     described in such subparagraph before the filing of the 
     action.
       (ii) Notification.--In an action described in clause (i), 
     the attorney general of a State shall provide notice and a 
     copy of the complaint to the Attorney General at the same 
     time as the State attorney general files the action.
       (b) Intervention.--
       (1) In general.--On receiving notice under subsection 
     (a)(2), the Attorney General shall have the right to 
     intervene in the action that is the subject of the notice.
       (2) Effect of intervention.--If the Attorney General 
     intervenes in an action under subsection (a), the Attorney 
     General shall have the right to be heard with respect to any 
     matter that arises in that action.
       (c) Construction.--For purposes of bringing any civil 
     action under subsection (a), nothing in this Act shall be 
     construed to prevent an attorney general of a State from 
     exercising the powers conferred on such attorney general by 
     the laws of that State to--
       (1) conduct investigations;
       (2) administer oaths or affirmations; or
       (3) compel the attendance of witnesses or the production of 
     documentary and other evidence.
       (d) Actions by the Attorney General of the United States.--
     In any case in which an action is instituted by or on behalf 
     of the Attorney General for violation of a practice that is 
     prohibited under title I, II, IV, or V of this Act or under 
     any amendment made by such a title, no State may, during the 
     pendency of that action, institute an action under subsection 
     (a) against any defendant named in the complaint in that 
     action for violation of that practice.
       (e) Venue; Service of Process.--
       (1) Venue.--Any action brought under subsection (a) may be 
     brought in the district court of the United States that meets 
     applicable requirements relating to venue under section 1391 
     of title 28, United States Code.
       (2) Service of process.--In an action brought under 
     subsection (a), process may be served in any district in 
     which the defendant--
       (A) is an inhabitant; or
       (B) may be found.

     SEC. 602. FEDERAL INJUNCTIVE AUTHORITY.

       In addition to any other enforcement authority conferred 
     under this Act or under an amendment made by this Act, the 
     Federal Government shall have injunctive authority with 
     respect to any violation of any provision of title I, II, or 
     IV of this Act or of any amendment made by such a title, 
     without regard to whether a public or private entity violates 
     such provision.
                                 ______