WASHINGTON – A bipartisan coalition of Senate Commerce Committee leaders today introduced comprehensive legislation (The Identity Theft Protection Act, S. 1408) that protects consumers from identity theft. The bill sets national standards for notifying consumers of data breaches, requires businesses to improve their safeguards for sensitive consumer information, gives consumers the right to freeze their credit reports to thwart identity theft, and limits the solicitation of Social Security numbers.

The legislative effort is led by Senators Gordon Smith (R-Ore.) and Bill Nelson (D-Fla.) and is co-sponsored by Commerce Committee Chairman Ted Stevens (R-Alaska), Co-Chairman Daniel Inouye (D-Hawaii), Sen. John McCain (R-Ariz.), and Sen. Mark Pryor (D-Ark.). The Commerce Committee has primary jurisdiction over the Federal Trade Commission, which enforces identity theft and fraud laws.

“The Internet and new business technologies have added a lot to daily life, but they’ve also made us more vulnerable,” Sen. Smith said. “We need this bill because having the world at your fingertips shouldn’t get you into a financial world of hurt.”

“The bill’s bipartisan support signals that Congress is poised to act on first-ever regulations for data brokers and other companies that handle consumers' most private information," said Sen. Nelson. “If we don't do something, and do it now, none of us will have any privacy left.”

“I am particularly proud that the Members of our Committee were able to work in a bipartisan fashion to write this important piece of legislation,” said Chairman Stevens. “With the problem of identity theft reaching epidemic proportions, a bill designed to protect Americans is absolutely essential. I look forward to continuing to work with my colleagues on legislation that will mitigate to the greatest extent possible the occurrence of identity theft in this country, but without inhibiting an information sharing system that yields extraordinary benefits to every American.”

The bill addresses two core problems: 1) recent data breaches of sensitive personal identification and 2) the current lack of tools for consumers to protect themselves from identity theft. Included below are some of the key aspects of the legislation:

INFORMATION COLLECTORS: The bill covers any business, school, or other entity that collects sensitive personal information, including Social Security numbers, financial account information, driver’s license information, and other information that the Federal Trade Commission determines can be used for identity theft. The bill also covers any third party that purchases or otherwise acquires this information.

SAFEGUARDS: Businesses, schools and other organizations that hold sensitive personal information will be required to secure it with physical and technological safeguards that will be specified by the Federal Trade Commission.

CONSUMER NOTICE: If any of the sensitive personal identification is lost or otherwise breached, and there is a reasonable risk that the information could be used for identity theft, the holder of that information is required to notify the consumers affected. The information holder also must report data breaches affecting more than 1,000 individuals to the Federal Trade Commission or the holder’s primary regulator. If a business, school or other information holder fails to notify consumers or the FTC of a breach, the FTC or state attorneys general may pursue a fine in federal court of up to $11,000 per individual consumer (capped at $11 million per breach) affected by the security breach.

CREDIT FREEZE: The bill will allow consumers the choice of placing a “credit freeze” on their consumer credit report. That means an identity thief would be prevented from taking out credit in the name of any person who placed such a freeze on their consumer report. Consumers would have the option of lifting the freeze in advance of applying for new credit. The decision whether or not to place a freeze on one’s own credit report is the choice of each individual consumer.

SOCIAL SECURITY NUMBERS: Businesses, schools and other information holders would be prohibited from requesting a person’s social security number unless no other type of identifier can be used in its place. Those holding sensitive personal information also would be prohibited from using social security numbers on identification cards and other forms of identification. Companies would be prohibited from allowing prison-work programs to handle information containing social security numbers.

STATE PRE-EMPTION. The bill would pre-empt state law on all these issues to create more uniform and efficient compliance by businesses, schools, and information holders.

“Our identity theft bill gives consumers the information and tools they need to better protect their identity from thieves around the world,” said Co-Chairman Inouye. “Identity theft is a new threat to our personal security that must be met with new tactics and new laws in the information age.”

“The recent wave of data security breaches throughout our nation highlights once again the tremendous threat of identity theft that Americans face today,” said Sen. McCain. “Every day, more and more of our sensitive personal information is made vulnerable to identity thieves because some companies aren’t doing enough to protect our information. As a result, our social security numbers and other sensitive information are being used against us – 10 million of us per year, according to government statistics. It’s time for a balanced solution to this problem that both protects consumers and maintains the viability of our information economy. This bill strikes that balance.”

“Identity theft is devastating to individuals, both financially and emotionally, and it’s occurring at exponential rates. It’s time to start placing privacy rights first, and this bill is a step forward in addressing that goal,” Sen. Pryor said. “I am pleased that part of this bill is devoted to giving consumers control over their personal financial information. It’s good for business, commerce and consumers.”