[Congressional Record Volume 164, Number 40 (Wednesday, March 7, 2018)]
[Senate]
[Pages S1488-S1489]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

  SA 2123. Mr. MENENDEZ submitted an amendment intended to be proposed 
by him to the bill S. 2155, to promote economic growth, provide 
tailored regulatory relief, and enhance consumer protections, and for 
other purposes; which was ordered to lie on the table; as follows:

       At the appropriate place, insert the following:

     SEC. ___. DATA SECURITY.

       (a) In General.--The Fair Credit Reporting Act (15 U.S.C. 
     1681 et seq.) is amended by inserting after section 605B (15 
     U.S.C. 1681c-2) the following:

     ``SEC. 605C. DATA SECURITY AT CONSUMER REPORTING AGENCIES.

       ``(a) Definitions.--In this section--
       ``(1) the term `affected individual' means a consumer, the 
     sensitive personal information of whom is lost, stolen, or 
     accessed without authorization because of a data breach;
       ``(2) the term `appropriate committees of Congress' means--
       ``(A) the Committee on the Judiciary of the Senate;
       ``(B) the Committee on Banking, Housing, and Urban Affairs 
     of the Senate;
       ``(C) the Committee on the Judiciary of the House of 
     Representatives; and
       ``(D) the Committee on Financial Services of the House of 
     Representatives;
       ``(3) the term `data breach' means the loss, theft, or 
     other unauthorized access, other than access that is 
     incidental to the scope of employment, of data containing 
     sensitive personal information, in electronic or printed 
     form, that results in the potential compromise of the 
     confidentiality or integrity of the data; and
       ``(4) the term `sensitive personal information' means, with 
     respect to a consumer, information--
       ``(A) about the consumer relating to the education, 
     financial transactions, medical history, criminal history, or 
     employment history of the consumer; and
       ``(B) that can be used to distinguish or trace the identity 
     of the consumer, including the name, social security number, 
     date and place of birth, mother's maiden name, and biometric 
     records of the consumer.
       ``(b) Data Breaches at Consumer Reporting Agencies.--With 
     respect to a data breach at a consumer reporting agency, the 
     consumer reporting agency--
       ``(1) shall notify--
       ``(A) not later than 2 days after the date on which the 
     consumer reporting agency discovers the data breach--
       ``(i) the Federal Trade Commission;
       ``(ii) the Bureau; and
       ``(iii) appropriate law enforcement and intelligence 
     agencies, as identified by the Secretary of Homeland 
     Security; and

[[Page S1489]]

       ``(B) subject to paragraph (2), not later than 3 days after 
     the date on which the consumer reporting agency discovers the 
     data breach, and as quickly and efficiently as is 
     practicable, each affected individual with respect to the 
     data breach; and
       ``(2) may receive an extension of the deadline described in 
     paragraph (1)(B) if the Federal Trade Commission and the 
     intelligence agencies identified under paragraph (1)(A)(iii) 
     determine that there is a national security concern that 
     requires granting such an extension.
       ``(c) Annual Study and Report.--
       ``(1) In general.--Beginning in the first full year after 
     the date of enactment of this section, and annually 
     thereafter, the Bureau and the Federal Trade Commission, in 
     consultation with the Attorney General, shall conduct a study 
     regarding the costs to affected individuals from data 
     breaches at consumer reporting agencies, including--
       ``(A) the economic costs to those affected individuals;
       ``(B) the effects on--
       ``(i) the ability of those affected individuals to obtain 
     credit and housing; and
       ``(ii) the reputations of those affected individuals; and
       ``(C) the costs relating to the emotional and psychological 
     stress of those affected individuals from having the 
     sensitive personal information of those affected individuals 
     lost, stolen, or accessed without authorization.
       ``(2) Submission to congress.--Not later than 30 days after 
     the date on which each study conducted under paragraph (1) is 
     completed, the Bureau and the Federal Trade Commission shall 
     submit to the appropriate committees of Congress a report 
     that contains the results of the study.
       ``(3) Contents.--Each study conducted under paragraph (1) 
     and each report submitted under paragraph (2) shall contain a 
     survey of affected individuals who were contacted for the 
     purposes of conducting the study.
       ``(4) Authority.--In conducting any study under paragraph 
     (1), the Bureau, the Federal Trade Commission, and the 
     Attorney General may compel a consumer reporting agency to 
     disclose nonproprietary information.
       ``(d) Rule of Construction.--Nothing in this section may be 
     construed as modifying, limiting, or superseding any 
     provision of State law if the protection that the provision 
     of State law provides to consumers is greater than the 
     protection provided to consumers under this section.''.
       (b) Technical and Conforming Amendment.--The table of 
     contents for the Fair Credit Reporting Act (15 U.S.C. 1681 et 
     seq.) is amended by inserting after the item relating to 
     section 605B the following:

``605C. Data security at consumer reporting agencies.''.
                                 ______