INTRODUCTION OF THE PERSONAL INFORMATION PRIVACY ACT -- HON. GERALD D. KLECZKA (Extensions of Remarks - April 15, 1999)

[Page: E667]
---

HON. GERALD D. KLECZKA OF WISCONSIN IN THE HOUSE OF REPRESENTATIVES THURSDAY, APRIL 15, 1999

Mr. KLECZKA. Mr. Speaker, information on the most personal aspects of our lives continues to be spread across the landscape. Once taken for granted, our wall of privacy is crumbling.

Today, I am re-introducing the Personal Information Privacy Act. This legislation attempts to restore some control over the use of our personal information. The bill prevents credit bureaus from giving out Social Security numbers and prohibits the sale or purchase of any information that includes anyone's Social Security number unless they have written consent to do so.

A merchant who requires a Social Security number on a check used for a purchase or a cable company who demands a Social Security number on an application for service will be prohibited from such practices or be charged with an unfair and deceptive business violation.

Further, this bill prohibits any state department of motor vehicles from selling drivers' photographs and drivers lists containing Social Security numbers. In addition, marketers will not be able to sell consumers' purchasing experiences or credit transactions without prior approval.

This bill also provides for civil and criminal penalties for violations. The criminal penalties are now possible because of action taken in the 105th Congress. Last year, Congress passed the Identity Theft and Assumption Deterrence Act, which, for the first time, criminalizes identity theft. Finally, victims of identity theft have a means to prosecute those who assume their identities and ruin their credit histories. While I am pleased that this legislation, which I cosponsored, was signed into law by President Clinton, I feel that further action is needed. We must pass legislation to prevent these crimes from occurring.

This legislation is necessary because anyone's personal information is easily accessible, be it through the presentation of false identification or through the internet. The information can be as innocuous as a name, address, and phone number or as intrusive as a detailed summary of personal finances, including bank account balances and investment portfolios.

One of the main reasons information is so accessible is that a person's Social Security number has become a personal identifier. Many private entities, from doctors to universities, now follow the example of the federal government by using the SSN as an identifier.

Recently, the Government Accounting Office completed a report that states ``No single federal law regulates the overall uses of SSNs.'' It further notes that ``Businesses and governments are not limited to using SSNs for purposes required by federal law.'' Consequently, requiring a person's SSN, the key to a wealth of personal information, as a condition of doing business is now common practice.

Mr. Speaker, this legislation is designed to curtail the rampant invasion of our privacy. What we buy and where we buy it is no one's business but our own. And, the unauthorized use and abuse of our Social Security number must stop. I urge all of my colleagues to cosponsor and support this legislation. SECTION 1. SHORT TITLE

The title of this Act is the ``Personal Information Privacy Act of 1999.'' SECTION 2. CONFIDENTIAL TREATMENT OF CREDIT HEADER INFORMATION

Section 2 would add a sentence to §603(d) of the Fair Credit Reporting Act (FCRA), 15 U.S.C. §1681a(d), which defines the term ``consumer report'' for purposes of the FCRA. The team currently means, essentially, any communication of information by a consumer reporting agency about a consumer that is used or expected to be used as a factor in establishing the consumer's eligibility for credit, insurance, employment, or for any other legitimate business purpose. Under §604 of the FCRA, 15 U.S.C. §1681b, a consumer reporting agency may not furnish a consumer report except for specified purposes. The new sentence that §2 would add to the definition of ``consumer report'' provides: ``The term also includes any other identifying information of the consumer, except the name, address, and telephone number of the consumer if listed in a residential telephone directory available in the locality of the consumer.'' If this new sentence becomes law, then consumer reporting agencies would be prohibited from disclosing such identifying information except for a purpose specified in §604. SECTION 3. PROTECTING PRIVACY BY PROHIBITING USE OF THE SOCIAL SECURITY NUMBER FOR COMMERCIAL PURPOSES WITHOUT CONSENT

This section would add a new section to the general administrative provisions of Title 11 of the Social Security Act, 42 U.S.C. §1301 et seq., prohibiting persons from buying or selling any information that includes an individual's social security account number (``SSN''), without the written consent of the individual. In addition, no person may use an individual's SSN for identification purposes without the written consent of the individual. In order for consent to be valid, the person desiring to use an individual's SSN must inform the individual of all the purposes for which the SSN will be utilized, the persons to whom the number will be known, and obtain the individual's consent in writing.

These new prohibitions would not affect any statutorily authorized uses of the SSN under §205(c)(2) of the Social Security Act, 42 U.S.C. §405(c)(2) (SSN used for Social Security wage records, and for various enumerated purposes by federal agencies and state and local governments), §7(a)(2) of the Privacy Act of 1974 (5 U.S.C. 552a note) (authorizing state and local governments to require disclosure of an individual's SSN if required by federal law or if the required disclosure was pursuant to a system of records in effect prior to January 1, 1975), or 26 U.S.C. §6109(d) (an individual's SSN is used for all identifying purposes specified in the Tax Code).

Individuals are authorized to bring a civil action seeking equitable relief and damages in a U.S. District Court for violations of this section. Damages may include the greater of actual damages or liquidated damages of $25,000, or, in case of a willful violation resulting in profit or monetary gain, $50,000. The court may assess, against the respondent, reasonable attorney's fees and other litigation costs in cases where an individual prevails. A statute of limitation of 3 years is provided. The remedies provided by this section are in addition to any other lawful remedies available to an individual.

The Commissioner of Social Security is authorized to assess a civil money penalty of not more than $25,000 for each violation of this section, or in the case of violations found to constitute a general business practice, not more than $500,000. The enforcement procedures for civil money penalties are the same as set forth in section 1128A of the Social Security Act, 42 U.S.C. §1320a-7a(d), (e), (g), (k), (l) and the first sentence of (c). These set forth the criteria for determining the amount of the civil penalty, the investigation and injunction authority of the Commissioner, and courts of appeals review of civil money penalty determinations. Also applicable are the provisions of section 205(d) and (e) of the Social Security Act, 42 U.S.C. §405(d) and (e), which authorize the Commissioner of Social Security to
```
[Page: E668]
```
issue subpoenas during investigations, and provide for judicial enforcement of such subpoenas.

The Commissioner of Social Security is directed to coordinate enforcement of the provisions of this section with the Justice Department's enforcement of criminal provisions relating to fraudulent identification documents, and with the Federal Trade Commission's jurisdiction relating to identity theft violations.

The provisions of this section do not preclude state laws relating to protection of privacy that are consistent with this section. The effective date of this section would be two years after enactment of this bill.

If a person refuses to do business with an individual because the individual will not consent to disclosure of this or her SSN, then such refusal will be considered an unfair or deceptive act of practice under section 5 of the Federal Trade Commission Act (15 U.S.C. §45). The Commission may issue a cease and desist order, violation of which is subject to civil money penalties of up to $10,000 per violation. SECTION 4. RESTRICTION ON USE OF SOCIAL SECURITY NUMBERS BY STATE DEPARTMENTS OF MOTOR VEHICLES

18 U.S.C. §2721(b) sets forth permissible uses of personal information obtained by a state department of motor vehicles. This section provides that, with respect to the SSN of an individual, such personal information may only be disclosed to a government agency, court or law enforcement agency in carrying out its functions to the extent permitted or required under section 205(c)(2) of the Social Security Act, 42 U.S.C. §405(c)(2), section 7a(2) of the Privacy Act of 2974, 5 U.S.C. §552a note, section 6109(d) of the Internal Revenue Code, or any other provision of law specifically identifying such use. This section would also prohibit the disclosure of SSNs by state departments of motor vehicles for bulk distributions for surveys, marketing or solicitations purposes. SECTION 5. RESTRICTION ON USE OF PHOTOGRAPHS BY STATE DEPARTMENTS OF MOTOR VEHICLES

Section 5(a) would add a new subsection to 18 U.S.C. §2721, which currently generally prohibits the release of certain personal information from state motor vehicle records. This new subsection would prohibit the release of an individual's photograph, in any form or format, by a state department of motor vehicles without the express written consent of the individual. An exception would be permitted for disclosure of an individual's photograph to a law enforcement agency of any government for a civil or criminal law enforcement activity if authorized by law and pursuant to a written request.

Section 5(b) would make technical amendments to 18 U.S.C. §2721(a) and (b) to conform that section to the new provisions added by this section. It would also amend 18 U.S.C. §2722(a) to reference the new subsection (e) added by this section. SECTION 6. REPEAL OF CERTAIN PROVISIONS RELATING TO THE CONSUMER REPORTS IN CONNECTION WITH CERTAIN TRANSACTIONS NOT INITIATED BY THE CONSUMER

Section 6(a) would amend §604(c) of the Fair Credit Reporting Act (FCRA), 15 U.S.C. §1681b(c), which governs prescreening to determine a consumer's eligibility for credit or insurance. Prescreening is a practice whereby a user of consumer reports, such as a lender or insurer, contacts a consumer reporting agency without having received an application for credit or insurance from a particular consumer. The user might submit a list of names and ask the agency to identify persons on he list who meet criteria that the user specifies. Or it might ask the consumer reporting agency to create its own list based on the user's criteria. Section 604(c) currently prohibits prescreening, except in two situations, to determine a consumer's eligibility for credit or insurance. It prohibits, in other words, except in two situations, a consumer reporting agency from furnishing a report on a consumer who has not applied for credit or insurance.

The two situations in which it permits prescreening are when: (1) the consumer authorizes the consumer reporting agency to provide the report, or (2) the lender or insurer will make a firm offer to the consumer if prescreening shows the consumer eligible for credit or insurance, and the consumer has not previously asked to be excluded from prescreening done by the consumer reporting agency. Section 6(a) would, in effect, prohibit presceening in connection with credit and insurance except when authorized by the consumer. It would amend §604(c)(1) to provide that a consumer reporting agency would be permitted to furnish a consumer report in connection with a ``credit or insurance transaction that is not initiated by consumer only if the consumer provides express written authorization in accordance with paragraph (2).......'' ``Paragraph (2)'' refers to §604(c)(2) of the FCRA, which would be rewritten by §6(b) of the bill.

Section 6(b) would rewrite §604(c)(2) to provide: ``No authorization referred to in paragraph (1) [§604(c)(1)] with respect to any consumer shall be effective unless the consumer received a notice before such authorization is provided which fully and fairly discloses, in accordance with regulations which the Federal Trade Commission and the Board of Governors of the Federal Reserve System shall jointly prescribe, what specifically is being authorized by the consumer and the potential positive and negative effects the provision of such authorization will have on the consumer.'' The regulations would have to require that the notice be prominently displayed on a separate document or, if the notice appears on a document with other information, that it be clear and conspicuous.

Section 6(c) would repeal the provision, mentioned above, that allows consumers to exclude themselves from prescreening lists. The provision would be unnecessary if prescreening were prohibited except when a consumer had authorized it. SECTION 7. SALE OR TRANSFER OF TRANSACTION OR EXPERIENCE INFORMATION PROHIBITED

Section 7(a) would add a new §626 to the FCRA. New §626(a) would provide: ``No person doing business with a consumer may sell, transfer, or otherwise provide to any other person, for the purpose of marketing such information to any other person, any transaction or experience information relating to the consumer, without the consumer's express written consent.'' A consumer's consent would not be required for the sale, transfer, or provision of transaction or experience information for a purpose other than marketing.

New §626(b) would define ``transaction or experience information'' as ``any information identifying the content or subject of 1 or more transactions between the consumer and a person doing business with a consumer.......'' Section 626(c) would allow six exceptions, where a consumer's consent would not be required for the provision of transaction or experience information: (1) communications ``solely among persons related by common ownership or affiliated by corporate control,'' (2) information provided pursuant to court order or federal grand jury subpoena, (3) ``[i]nformation provided in connection with the licensing or registration by a government agency or department, or any transfer of such license or registration, of any personal property bought, sold, or transferred by the consumer,'' (4) ``[i]nformation required to be provided in connection with any transaction in real estate,'' (5) ``[i]nformation required to be provided in connection with perfecting a security interest in personal property,'' and (6) ``[i]nformation relating to the amount of any transaction or any credit extended in connection with a transaction with a consumer.''

Section 7(b) would make a technical amendment to §603(d)(2)(A) of the FCRA to ensure that it does not conflict with new §626, and §7(c) would make a clerical amendment to add a reference to new §626 to the table of sections for the FCRA.
END