[Congressional Record Volume 164, Number 40 (Wednesday, March 7, 2018)]
[Senate]
[Pages S1473-S1474]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]
SA 2099. Mr. SCOTT (for himself, Mrs. McCaskill, Mr. Cassidy, Mr.
Peters, Mr. Hoeven, Ms. Stabenow, and Mr. Jones) submitted an amendment
intended to be proposed by him to the bill S. 2155, to promote economic
growth, provide tailored regulatory relief, and enhance consumer
protections, and for other purposes; which was ordered to lie on the
table; as follows:
At the end of title III, add the following:
SEC. ___. REDUCING IDENTITY FRAUD.
(a) Purpose.--The purpose of this section is to reduce the
prevalence of synthetic identity fraud, which
disproportionally affects vulnerable populations, such as
minors and recent immigrants, by facilitating the validation
by permitted entities of fraud protection data, pursuant to
electronically received consumer consent, through use of a
database maintained by the Commissioner.
(b) Definitions.--In this section:
(1) Commissioner.--The term ``Commissioner'' means the
Commissioner of the Social Security Administration.
(2) Financial institution.--The term ``financial
institution'' has the meaning given the term in section 509
of the Gramm-Leach-Bliley Act (15 U.S.C. 6809).
(3) Fraud protection data.--The term ``fraud protection
data'' means a combination of the following information with
respect to an individual:
(A) The name of the individual (including the first name
and any family forename or surname of the individual).
(B) The social security number of the individual.
(C) The date of birth (including the month, day, and year)
of the individual.
(4) Permitted entity.--The term ``permitted entity'' means
a financial institution
[[Page S1474]]
or a service provider, subsidiary, affiliate, agent,
subcontractor, or assignee of a financial institution.
(c) Efficiency.--
(1) Reliance on existing methods.--The Commissioner shall
evaluate the feasibility of making modifications to any
database that is in existence as of the date of enactment of
this Act or a similar resource such that the database or
resource--
(A) is reasonably designed to effectuate the purpose of
this section; and
(B) meets the requirements of subsection (d).
(2) Execution.--The Commissioner shall make the
modifications necessary to any database that is in existence
as of the date of enactment of this Act or similar resource,
or develop a database or similar resource, to effectuate the
requirements described in paragraph (1).
(d) Protection of Vulnerable Consumers.--The database or
similar resource described in subsection (c) shall--
(1) compare fraud protection data provided in an inquiry by
a permitted entity against such information maintained by the
Commissioner in order to confirm (or not confirm) the
validity of the information provided;
(2) be scalable and accommodate reasonably anticipated
volumes of verification requests from permitted entities with
commercially reasonable uptime and availability;
(3) allow permitted entities to submit--
(A) 1 or more individual requests electronically for real-
time machine-to-machine (or similar functionality) accurate
responses; and
(B) multiple requests electronically, such as those
provided in a batch format, for accurate electronic responses
within a reasonable period of time from submission, not to
exceed 24 hours;
(4) be funded, including any appropriate upgrades,
maintenance, and associated direct and indirect
administrative costs, by users of the database or similar
resource, in a manner consistent with that described in
section 1106(b) of the Social Security Act (42 U.S.C.
1306(b)); and
(5) not later than 180 days after the date of enactment of
this Act, be fully operational.
(e) Certification Required.--Before providing confirmation
of fraud protection data to a permitted entity, the
Commissioner shall ensure that the Commissioner has a
certification from the permitted entity that is dated not
more than 2 years before the date on which that confirmation
is provided that includes the following declarations:
(1) The entity is a permitted entity.
(2) The entity is in compliance with this section.
(3) The entity is, and will remain, in compliance with its
privacy and data security requirements, as described in title
V of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.),
with respect to information the entity receives from the
Commissioner pursuant to this section.
(4) The entity will retain sufficient records to
demonstrate its compliance with its certification and this
section for a period of not less than 2 years.
(f) Consumer Consent.--
(1) In general.--Notwithstanding any other provision of law
or regulation, a permitted entity may submit a request to the
database or similar resource described in subsection (c)
only--
(A) pursuant to the written, including electronic, consent
received by a permitted entity from the individual who is the
subject of the request; and
(B) in connection with a credit transaction or any
circumstance described in section 604 of the Fair Credit
Reporting Act (15 U.S.C. 1681b).
(2) Electronic consent requirements.--For a permitted
entity to use the consent of an individual received
electronically pursuant to paragraph (1)(A), the permitted
entity must obtain the individual's electronic signature, as
defined in section 106 of the Electronic Signatures in Global
and National Commerce Act (15 U.S.C. 7006).
(3) Effectuating electronic consent.--No provision of law
or requirement, including section 552a of title 5, United
States Code, shall prevent the use of electronic consent for
purposes of this subsection or for use in any other consent
based verification under the discretion of the Commissioner.
(g) Compliance and Enforcement.--
(1) Audits and monitoring.--
(A) In general.--The Commissioner may--
(i) conduct audits and monitoring to--
(I) ensure proper use by permitted entities of the database
or similar resource described in subsection (c); and
(II) deter fraud and misuse by permitted entities with
respect to the database or similar resource described in
subsection (c); and
(ii) terminate services for any permitted entity that
prevents or refuses to allow the Commissioner to carry out
the activities described in clause (i).
(2) Enforcement.--
(A) In general.--Notwithstanding any other provision of
law, including the matter preceding paragraph (1) of section
505(a) of the Gramm-Leach-Bliley Act (15 U.S.C. 6805(a)), any
violation of this section and any certification made under
this section shall be enforced in accordance with paragraphs
(1) through (7) of such section 505(a) by the agencies
described in those paragraphs.
(B) Relevant information.--Upon discovery by the
Commissioner, pursuant to an audit described in paragraph
(1)(A), of any violation of this section or any certification
made under this section, the Commissioner shall forward any
relevant information pertaining to that violation to the
appropriate agency described in subparagraph (A) for
evaluation by the agency for purposes of enforcing this
section.
______