[DOCID: f:hr453p3.109] From the House Reports Online via GPO Access [wais.access.gpo.gov] 109th Congress Rept. 109-453 HOUSE OF REPRESENTATIVES 2d Session Part 3 ====================================================================== FINANCIAL DATA PROTECTION ACT OF 2006 _______ June 2, 2006.--Ordered to be printed _______ Mr. Oxley, from the Committee on Financial Services, submitted the following R E P O R T together with DISSENTING VIEWS [To accompany H.R. 4127] [Including cost estimate of the Congressional Budget Office] The Committee on Financial Services, to whom was referred the bill (H.R. 4127) to protect consumers by requiring reasonable security policies and procedures to protect computerized data containing personal information, and to provide for nationwide notice in the event of a security breach, having considered the same, report favorably thereon with amendments and recommend that the bill as amended do pass. CONTENTS Page Amendment........................................................ 2 Purpose and Summary.............................................. 2 Background and Need for Legislation.............................. 3 Hearings......................................................... 3 Committee Consideration.......................................... 3 Committee Votes.................................................. 3 Committee Oversight Findings..................................... 3 Performance Goals and Objectives................................. 3 New Budget Authority, Entitlement Authority, and Tax Expenditures 3 Committee Cost Estimate.......................................... 4 Congressional Budget Office Estimate............................. 4 Federal Mandates Statement....................................... 9 Advisory Committee Statement..................................... 9 Constitutional Authority Statement............................... 9 Applicability to Legislative Branch.............................. 9 Section-by-Section Analysis of the Legislation................... 9 Changes in Existing Law Made by the Bill, as Reported............ 10 Dissenting Views................................................. 11 AMENDMENT The amendments are as follows: Strike all after the enacting clause and insert the text of H.R. 3997, as reported by the Committee on Financial Services. Amend the title so as to read: A bill to amend the Fair Credit Reporting Act to provide for secure financial data, and for other purposes. For the full text of the amendment in the nature of a substitute adopted to H.R. 4127, see House Report 109-454, Part 1, on H.R. 3997, the Financial Data Protection Act of 2006. PURPOSE AND SUMMARY H.R. 4127, as referred to the Committee on Financial Services and as reported with the text of H.R. 3997, the Financial Data Protection Act, builds off of the data safeguards requirements and regulations of the Fair Credit Reporting Act (FCRA) and the Gramm-Leach-Bliley Act (GLBA). It requires certain entities that possess or maintain sensitive information about consumers to keep the information secure, investigate breaches of the information, and notify consumers of data security breaches. As amended, H.R. 4127 establishes the policy that consumer reporters have to protect the security and confidentiality of sensitive financial personal information. All consumer reporters are required to maintain reasonable policies and procedures to protect the security and confidentiality of their sensitive financial personal information relating to any consumer. Should a consumer reporter believe a breach has occurred, or is likely to occur, they are required to immediately investigate. If the potential breach of data security may result in harm or inconvenience to any consumer, then the consumer reporter is required to notify the U.S. Secret Service, appropriate regulator(s), and other consumer reporters in the transaction chain. If the potential breach may result in financial fraud against consumers causing harm or inconvenience, then the consumers must be notified through a uniform mailing. Consumer notification involving sensitive financial identity information must include an offer of free credit file monitoring for the consumer. Consumers who are victims of identity theft are also provided with the right to place a security freeze on their credit report. Notwithstanding the effective date in section 2(c), the requirements of H.R. 4127 shall apply immediately to any Executive agency (as defined in section 105 of title 5, United States Code), including the Veterans Administration, that determines on or after January 1, 2006, that a breach of data security has occurred, is likely to have occurred, or is unavoidable. Such requirements shall include the provisions relating to free credit monitoring, prompt notice to consumers, and data security safeguards as practicable, notwithstanding that the agency made its determination before the date of the enactment of this Act. Any relevant time periods contained in section 630 of the Fair Credit Reporting Act shall be applied with respect to any Executive agency to which such section is applicable as if the determination of the agency were made on the date of the enactment of this Act. BACKGROUND AND NEED FOR LEGISLATION For further background information on H.R. 4127, see House Report 109-454, Part 1, on H.R. 3997, the Financial Data Protection Act of 2006. HEARINGS No hearings were held on H.R. 4127 by the Committee on Financial Services. COMMITTEE CONSIDERATION The Committee on Financial Services met in open session on May 24, 2006, and ordered H.R. 4127 reported to the House as amended by a voice vote. COMMITTEE VOTES Clause 3(b) of rule XIII of the Rules of the House of Representatives requires the Committee to list the record votes on the motion to report legislation and amendments thereto. No record votes were taken with in conjunction with the consideration of this legislation. A motion by Mr. Oxley to report the bill to the House as amended with a favorable recommendation was agreed to by a voice vote. During the consideration of the bill, the following amendments were considered: An amendment in the nature of a substitute offered by Mr. Bachus, No. 1, consisting of the text of H.R. 3997 as reported by the Committee on Financial Services, was agreed to by a voice vote. An amendment offered by Ms. Hooley, No. 1(a), regarding the Veterans Administration data breach scope of application, was offered and withdrawn. COMMITTEE OVERSIGHT FINDINGS Pursuant to clause 3(c)(1) of rule XIII of the Rules of the House of Representatives, the Committee held hearings and made findings that are reflected in this report. PERFORMANCE GOALS AND OBJECTIVES Pursuant to clause 3(c)(4) of rule XIII of the Rules of the House of Representatives, the Committee establishes the following performance related goals and objectives for this legislation: As amended, H.R. 4127, the Financial Data Protection Act, would expand the data safeguards requirements of the Fair Credit Reporting Act (FCRA) and build off the implementation of safeguard and consumer notice provisions from the Gramm-Leach- Bliley Act (GLBA) to establish uniform standards for all consumer reporters that possess or maintain sensitive financial account or identity information about consumers. NEW BUDGET AUTHORITY, ENTITLEMENT AUTHORITY, AND TAX EXPENDITURES In compliance with clause 3(c)(2) of rule XIII of the Rules of the House of Representatives, the Committee adopts as its own the estimate of new budget authority, entitlement authority, or tax expenditures or revenues contained in the cost estimate prepared by the Director of the Congressional Budget Office pursuant to section 402 of the Congressional Budget Act. COMMITTEE COST ESTIMATE The Committee adopts as its own the cost estimate prepared by the Director of the Congressional Budget Office pursuant to section 402 of the Congressional Budget Act of 1974. CONGRESSIONAL BUDGET OFFICE ESTIMATE Pursuant to clause 3(c)(3) of rule XIII of the Rules of the House of Representatives, the following is the cost estimate provided by the Congressional Budget Office pursuant to section 402 of the Congressional Budget Act of 1974: May 26, 2006. Hon. Michael G. Oxley, Chairman, Committee on Financial Services, House of Representatives, Washington, DC. Dear Mr. Chairman: The Congressional Budget Office has prepared the enclosed cost estimate for H.R. 4127, the Financial Data Protection Act of 2006. If you wish further details on this estimate, we will be pleased to provide them. The CBO staff contact are Melissa Z. Petersen (for federal costs), Sarah Puro (for state and local costs), and Page Piper/Bach (for the impact on the private sector). Sincerely, Donald B. Marron, Acting Director. Enclosure. H.R. 4127--Financial Data Protection Act of 2006 Summary: H.R. 4127 would require private companies with access to consumers' personal information to take certain precautions to safeguard that information. Private companies also would be required to notify consumers and certain authorities whenever there is a breach in the security of a consumer's personal information and to investigate and take steps to repair the breach. Under the bill, consumers would have the option of freezing their credit reports in the event of a threat to the security of their personal information. H.R. 4127 would require the Federal Trade Commission (FTC) and other federal regulatory agencies to enforce the restrictions and requirements in the bill and to issue regulations related to the security of consumers' personal information. Assuming appropriation of the necessary amounts, CBO estimates that implementing H.R. 4127 would cost less than $500,000 in 2006 and a total of $5 million over the 2006-2011 period. Enacting the bill would not have a significant impact on direct spending or revenues. H.R. 4127 contains intergovernmental mandates as defined in the Unfunded Mandates Reform Act (UMRA); but CBO estimates that the aggregate cost of complying with those mandates would be small and would not exceed the threshold established in UMRA ($64 million in 2006, adjusted annually for inflation). H.R. 4127 would impose private-sector mandates, as defined in UMRA, on financial institutions, employers, consumer credit- reporting agencies and other entities that engage in assembling or evaluating consumer financial information using any means or facility of interstate commerce. While CBO cannot determine the total direct costs of complying with each mandate, the security standards and notification requirements in H.R. 4127 would impose compliance costs on a large number of private-sector entities. Based on this information, CBO estimates that the aggregate direct cost of mandates in the bill, could exceed the annual threshold established by UMRA for private-sector mandates ($128 million in 2006, adjusted annually for inflation). Estimated cost to the Federal Government: The estimated budgetary impact of H.R. 4127 is shown in the following table. The costs of this legislation fall within budget function 370 (commerce and housing credit). ---------------------------------------------------------------------------------------------------------------- By fiscal year, in millions of dollars-- ----------------------------------------------- 2006 2007 2008 2009 2010 2011 ---------------------------------------------------------------------------------------------------------------- CHANGES IN SPENDING SUBJECT TO APPROPRIATION \1\ Estimated Authorization Level................................... * 1 1 1 1 1 Estimated Outlays............................................... * 1 1 1 1 1 ---------------------------------------------------------------------------------------------------------------- \1\ Enacting H.R. 4127 would also have small effects on direct spending and revenues, but those effects would be less than $500,000 a year. Note.--* = less than $500,000. Basis of estimate: CBO estimates that implementing H.R. 4127 would cost less than $500,000 in 2006 and about $5 million over the 2006-2011 period to issue regulations and enforce the bill's new provisions regarding the security of consumers' personal information. For this estimate, CBO assumes that the bill will be enacted before the end of 2006, that the estimated amounts will be appropriated for each year, and that outlays will follow historical spending patterns. Enacting the legislation would not have a significant effect on direct spending or revenues. Spending subject to appropriation H.R. 4127 would require that private companies take certain steps to safeguard consumers' personal information. Private companies also would be required to investigate and remedy security breaches and to notify consumers and certain authorities in the event of a breach. Under the bill, consumers would have the option to freeze their credit reports in the event of a threat to the security of their personal information. The Federal Trade Commission, the Office of the Comptroller of the Currency (OCC), the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation (FDIC), the Office of Thrift Supervision (OTS), the National Credit Union Administration (NCUA), the Securities and Exchange Commission (SEC), the Office of Federal Housing Enterprise Oversight (OFHEO), and the Federal Housing Finance (FHFB) would enforce the restrictions and requirements under the bill and create regulations related to the security of consumers' personal information. Based on information provided by the FTC, CBO estimates that implementing H.R. 4127 would cost less than $500,000 in 2006 and $5 million over the 2006-2011 period for the FTC to develop and issue regulations and to enforce the bill's provisions related to information security. Those costs would be subject to the availability of appropriated funds. CBO estimates that implementing the bill would not have a significant impact on spending subject to appropriation for the other regulatory agencies. Direct spending and revenues Enacting H.R. 4127 would affect direct spending and revenues because of provisions affecting financial regulatory agencies and civil penalties. CBO estimates that any such effects would not be significant. H.R. 4127 would require several financial regulatory agencies to enforce the regulations on the security of consumers' personal information as they apply to financial institutions: OCC, FDIC, the Federal Reserve, the NCUA, and OTS. Any additional direct spending by NCUA, OCC, and OTS to implement the bill would have no net budgetary impact because those agencies charge annual fees to cover all of their administrative expenses. In contrast, the FDIC's sources of income--primarily intragovernmental interest earnings and insurance premiums--do not change in tandem with its annual expenditures; as a result, any added costs would increase direct spending unless and until the FDIC raised insurance premiums to offset those expenses. Budgetary effects on the Federal Reserve are recorded as changes in revenues (governmental receipts). According to FDIC officials, enacting H.R. 4127 would not have a significant effect on their workload or budgets. For this estimate, CBO assumes that the FDIC would not assess additional premiums to cover the small costs associated with implementing this bill. Thus, CBO estimates that enacting this bill would increase direct spending and offsetting receipts of the NCUA, OTS, OCC, and FDIC by less than $500,000 a year. Based on information from the Federal Reserve, CBO estimates that enacting H.R. 4127 would reduce revenues by less than $500,000 a year. Enacting H.R. 4127 could increase federal revenues as a result of the collection of additional civil penalties assessed for violation of laws related to information security. Collections of civil penalties are recorded in the budget as revenues. CBO estimates, however, that any additional revenues that would result from enacting the bill would not be significant because of the relatively small number of cases likely to be involved. Estimated impact on state, local, and tribal governments: H.R. 4127 contains intergovernmental mandates as defined in UMRA because it would require state entities that regulate insurance to enforce certain administrative rules and would explicitly preempt laws in about 20 states that regulate the protection and use of certain personal data. Based on information from state and local governments and a review of current legal precedents, CBO expects that intergovernmental entities would not be required to comply with new data security and notification requirements contained in the bill. CBO estimates, therefore, that the aggregate cost to intergovernmental entities of complying with the mandates in the bill would be small and would not exceed the threshold established in UMRA ($64 million in 2006, adjusted annually for inflation). Estimated impact on the private sector: H.R. 4127 would impose private-sector mandates, as defined in UMRA, on financial institutions, employers, consumer credit-reporting agencies, and other entities that engage in assembling or evaluating consumer financial information using any means or facility of interstate commerce. Each entity would be required to protect ``sensitive financial personal information'' relating to any consumer against unauthorized access that is reasonably likely to result in harm or inconvenience and to provide notice to consumers of data security breaches. The legislation defines sensitive financial personal information as a combination of sensitive financial identity information (name, address, or phone number with Social Security number, driver's license number, or other personal identification information), or sensitive financial account information (financial account number with information allowing access to the account), or both. In addition, the bill would require the Secretary of the Treasury, the Federal Reserve System, the Federal Trade Commission, and certain other federal regulatory agencies to jointly develop standards and guidelines to implement data security safeguards. Because those standards and regulations have not been issued, CBO cannot determine the total direct costs of complying with those mandates, however, certain mandates in H.R. 4127 would impose compliance costs on a large number of private-sector entities. Based on this information, CBO estimates that the aggregate direct cost of the mandates could exceed the annual threshold established by UMRA for private-sector mandates ($128 million in 2006, adjusted annually for inflation). Protection of sensitive financial personal information Section 2 would require certain private companies to implement and maintain reasonable measures to protect he security and confidentiality of sensitive financial personal information, including the proper disposal of such information. Such companies would include consumer reporting agencies, financial institutions, businesses, employers, and other entities that assemble or evaluate sensitive financial personal information using any means or facility of interstate commerce. The cost of this mandate would depend on both the number of covered entities and the average cost to an entity of complying with the mandates. According to industry sources, generally all consumer reporting entities have some measure of security in place. But because standards and regulations have not been issued, CBO does not have enough information to determine the incremental cost for such entities to comply with the mandate. Notification of security breach Section 2 also would require certain private entities to comply with certain procedures for notifying the Secret Service, regulatory agencies, affected third parties, and consumers if a security breach involving sensitive financial personal information has occurred, is likely to have occurred, or is unavoidable. In addition, the bill would require consumer reporters to: <bullet> Investigate any suspected breach of security; <bullet> Notify credit reporting agencies if the breach affects 1,000 or more consumers; <bullet> Take prompt and reasonable measures to repair a breach of security and restore the integrity of the security safeguards; and <bullet> Delay the release of any security breach notification if requested by law enforcement. If an entity becomes award that a security breach is reasonably likely to have occurred or is unavoidable, they would be required to provide a specific notification to any affected consumer. Any entity required to provide such notification also would be required to offer affected consumers free credit-file monitoring and identity-monitoring services for at least six months. The cost of this mandate depends on the number of security breaches that occur, the average number of persons affected by a breach, and the cost per person for notification and credit- file monitoring. According to several industry sources, over 100 security breaches involving sensitive information occurred in 2005, but generally only the largest of breaches are noticed and recorded. Nevertheless, available information suggests that security breaches are not rare. Although the cost to notify individuals and other entities in the event of a security breach may be small per person, the potentially large number of people in data systems maintained by some private companies would make the cost of notification and monitoring associated with one breach significant. Furthermore, certain companies do not maintain the mailing addresses of customers for whom they have name and credit card information. It would be costly for those entities to begin keeping that information. While the regulations regarding consumer notification have not been issued, CBO expects that the cost imposed on consumer reporting entities by the notification requirements could be large relative to the annual threshold established by UMRA for private-sector mandates. Credit report security freeze Section 2 also would allow consumers who have been the victim of identity theft to place a security freeze on their credit report by making a request to a consumer credit- reporting agency. The consumer reporting agency would be prevented from releasing the credit report to any third parties without a prior express authorization from the consumer. The agency also would be required to send a written confirmation of the security freeze to the consumer within 10 business days and provide a unique personal identification number or password to be used to authorize the release of any reports. According to industry sources, the major credit-reporting agencies currently provide a security freeze for consumers and have the systems and procedures in place to accept, impose, and release freezes on credit reports. Therefore, CBO expects that the incremental cost to comply with this mandate would be minimal. Previous CBO estimates: CBO has provided cost estimates for six pieces of legislation that deal with identity theft or the safeguarding of personal information. Some have different provisions, but all of the pieces of legislation would require private companies and the government to take certain precautions to safeguard personal information. The cost estimates reflect those differences. <bullet> On May 26, 2006, CBO transmitted a cost estimate for H.R. 3997, the Data Accountability and Trust Act (DATA), as ordered reported by the House Committee on Energy and Commerce on May 24, 2006. <bullet> On April 19, 2006, CBO transmitted a cost estimate for S. 1789, the Personal Data Privacy and Security Act of 2005, as reported by the Senate Committee on the Judiciary on November 17, 2005. <bullet> On April 6, 2006, CBO transmitted a cost estimate for H.R. 4127, the Data Accountability and Trust Act, as ordered reported by the House Committee on Energy and Commerce on March 29, 2006, with a subsequent amendment provided by the committee on April 4, 2006. <bullet> On March 30, 2006, CBO transmitted a cost estimate for H.R. 3997, the Financial Data Protection Act, as ordered reported by the House Committee on Financial Services on March 16, 2006. <bullet> On March 10, 2006, CBO transmitted a cost estimate for S. 1326, the Notification of Risk to Personal Data Act, as ordered reported by the Senate Committee on the Judiciary on October 20, 2005. <bullet> On November 3, 2005, CBO transmitted a cost estimate for S. 1408, the Identity Theft Protection Act, as ordered reported by the Senate Committee on Commerce, Science, and Transportation on July 28, 2005. Estimate prepared by: Federal Costs: Melissa Z. Petersen and Kathleen Gramp. Impact on State, Local, and Tribal Governments: Sarah Puro. Impact on the Private Sector: Paige Piper/Bach. Estimate approved by: Peter H. Fontaine, Deputy Assistant Director for Budget Analysis. FEDERAL MANDATES STATEMENT The Committee adopts as its own the estimate of Federal mandates prepared by the Director of the Congressional Budget Office pursuant to section 423 of the Unfunded Mandates Reform Act. ADVISORY COMMITTEE STATEMENT No advisory committees within the meaning of section 5(b) of the Federal Advisory Committee Act were created by this legislation. CONSTITUTIONAL AUTHORITY STATEMENT Pursuant to clause 3(d)(1) of rule XIII of the Rules of the House of Representatives, the Committee finds that the Constitutional Authority of Congress to enact this legislation is provided by Article 1, section 8, clause 1 (relating to the general welfare of the United States) and clause 3 (relating to the power to regulate interstate commerce). APPLICABILITY TO LEGISLATIVE BRANCH The Committee finds that the legislation does not relate to the terms and conditions of employment or access to public services or accommodations within the meaning of section 102(b)(3) of the Congressional Accountability Act. SECTION-BY-SECTION ANALYSIS OF THE LEGISLATION For a section-by-section analysis of H.R. 4127, see House Report 109-454, Part 1, on H.R. 3997, the Financial Data Protection Act of 2006. CHANGES IN EXISTING LAW MADE BY THE BILL, AS REPORTED The bill was referred to this commitee for consideration of such provisions of the bill and amendment as fall within the jurisdiction of this committee pursuant to clause 1(g) of rule X of the Rules of the House of Representatives. The changes made to existing law by the amendment reported by this committee are shown in the report filed on May 4, 2006 (Rept. 109-454, Part 1). DISSENTING VIEWS OF RON PAUL Since the version of H.R. 4127, The Data Accountability and Trust Act, reported out of this Committee, is identical to H.R. 3997, the Financial Data Protection Act, I am resubmitting my dissenting views on H.R. 3997: H.R. 3997, The Financial Data Protection Act, is neither a constitutional nor an effective solution to the problems surrounding data security. In fact, H.R. 3997 may provide consumers with a lower level of protection than they could obtain in the market. H.R. 3997 also imposes new costs on small businesses that could deprive consumers of desired goods and services. Finally, but most importantly, H.R. 3997 exceeds the constitutional limits on Congress's power by dictating data security standards and procedures for every business in the nation and by preempting states' data security laws related to data security. H.R. 3997 mandates that every business in the nation maintain ``reasonable policies and procedures'' to protect the security and confidentiality of its data. The bill also requires all businesses to notify consumers of data breaches that cause ``substantial harm or inconvenience'' to consumers. The drafters of H.R. 3997 believe that federal bureaucrats can craft regulations defining ``reasonable policies'' and ``sustainable harm'' that will be both easily adaptable by every business and satisfy every consumer's demand for security. However, the authors of H.R. 3997 overlooked the fact that views differ regarding what is a ``reasonable'' policy or a ``substantial'' harm. Some consumers who have a higher tolerance of risk than others are willing to accept a greater chance of a data breach in exchange for other benefits, such as lower prices. Other consumers are willing to forgo certain benefits in exchange for greater protection than H.R. 3997 provides. Businesses have different definitions of ``reasonable.'' What is ``reasonable'' security for Wal-Mart or amazon.com may be too costly for a small ``mom-and-pop'' business. Thus, by imposing a one-size-fits-all model on the country, H.R. 3997 will make it cost prohibitive for some businesses to compete in certain markets. Driving businesses out of the market ultimately harms consumers who are deprived of goods and services. If Congress allowed the market to operate, consumers would have the ability to demand the amount, and type, of data protection that suits their needs, and businesses could use their data security polices as a means of attracting consumers. Each consumer could then pick the business that offers the combination of price, security, and other services that meets the individual's unique needs. Once a federal standard is imposed, most businesses will not devote time and effort to creating their own data security policies, especially considering it would violate federal law to adopt policies that conflict in any way with H.R. 3997 would be a violation of federal law. Similarly, H.R. 3997's preemption of state laws prohibits states from developing innovative ways to help consumers harmed by negligent failure to adequately protect their data. Proponents of H.R. 3997 claim that the differences among states' laws cause hardships on businesses and consumers that justify the federal government pre-empting state laws and imposing a one-size-fits-all regulatory framework. However, there are two flaws with this argument. First, differences among states' regulations in no way justify violating the Tenth Amendment prohibition on Congress legislating on issues, such as consumer protection, not explicitly placed under congressional jurisdiction in Article I, Section 8. In fact, one of the Founders' purposes in preserving state autonomy was to foster diversity among states' laws so the states can experiment to determine what laws best promote their citizens' interests. Second, states and businesses are quite capable of developing uniform standards without being forced to do so by the federal government. For example, the Uniform Commercial Code, which governs commercial contracts in most states, was drawn up by private attorneys and voluntarily adopted by the states. Similarly, many states have adopted the model law governing corporations without prodding from Congress. ``Model laws'' reflecting the experiences of the states and the people with a diversity of laws and regulations are bound to be superior to laws Washington imposes. H.R. 3997 appears on its surface to be a pro-consumer bill. However, it actually makes it more difficult, if not impossible, for consumers to obtain the data services they need or desire. H.R. 3997 also imposes costs on small business that will deprive consumers of desired goods and services. However, the main reason my colleagues should reject this bill is that Congress has no constitutional authority to dictate to every business in the nation the manner of protecting data security. Furthermore, the provisions of this bill preempting state laws blatantly violate the Tenth Amendment. I, therefore, urge my colleagues to reject this bill. Ron Paul. <all>