Protecting Consumer Information Act of 2021

I 117TH CONGRESS 1ST SESSION H. R. 474 To direct the Federal Trade Commission to review and potentially revise its standards for safeguarding customer information to ensure that such standards require certain consumer reporting agencies and service pro- viders of such agencies to maintain sufficient safeguards against cyber attacks and related threats, to provide for additional authority to enforce such standards with respect to such agencies and providers, and for other purposes. IN THE HOUSE OF REPRESENTATIVES JANUARY 25, 2021 Mr. LIEU introduced the following bill; which was referred to the Committee on Financial Services, and in addition to the Committee on Energy and Commerce, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the juris- diction of the committee concerned A BILL To direct the Federal Trade Commission to review and po- tentially revise its standards for safeguarding customer information to ensure that such standards require certain consumer reporting agencies and service providers of such agencies to maintain sufficient safeguards against cyber attacks and related threats, to provide for addi- tional authority to enforce such standards with respect to such agencies and providers, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 VerDate Sep 11 2014 15:38 Feb 14, 2021 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H474.IH H474 pamtmann on DSKBC07HB2PROD with BILLS 2 •HR 474 IH SECTION 1. SHORT TITLE. 1 This Act may be cited as the ‘‘Protecting Consumer 2 Information Act of 2021’’. 3 SEC. 2. STANDARDS FOR CYBERSECURITY SAFEGUARDS 4 FOR CERTAIN CONSUMER REPORTING AGEN- 5 CIES AND SERVICE PROVIDERS. 6 (a) REVIEW OF STANDARDS; POTENTIAL REVI- 7 SION.— 8 (1) REVIEW.—Not later than 90 days after the 9 date of the enactment of this Act, the Commission 10 shall complete a review of the standards contained in 11 the regulations issued by the Commission under sec- 12 tion 501 of the Gramm-Leach-Bliley Act (15 U.S.C. 13 6801) to determine whether such standards require 14 covered consumer reporting agencies and covered 15 service providers to maintain sufficient safeguards to 16 protect customer records and information against 17 cyber attacks and related threats. 18 (2) REVISION.—If the Commission determines 19 in the review completed under paragraph (1) that 20 the standards contained in the regulations issued by 21 the Commission under section 501 of the Gramm- 22 Leach-Bliley Act (15 U.S.C. 6801) do not require 23 covered consumer reporting agencies and covered 24 service providers to maintain sufficient safeguards to 25 protect customer records and information against 26 VerDate Sep 11 2014 15:38 Feb 14, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H474.IH H474 pamtmann on DSKBC07HB2PROD with BILLS 3 •HR 474 IH cyber attacks and related threats, not later than 180 1 days after the date of the completion of the review, 2 the Commission shall, pursuant to section 553 of 3 title 5, United States Code, revise such regulations 4 so as to provide for standards applicable to covered 5 consumer reporting agencies and covered service 6 providers that require such agencies and providers to 7 maintain sufficient safeguards to protect customer 8 records and information against cyber attacks and 9 related threats. 10 (b) INVESTIGATIONS.— 11 (1) INITIAL INVESTIGATION.— 12 (A) IN GENERAL.—Not later than 18 13 months after the date described in subpara- 14 graph (B), the Commission shall complete an 15 investigation of each person or entity that, as of 16 the date described in such subparagraph, is a 17 covered consumer reporting agency or covered 18 service provider, to determine whether such 19 agency or provider is in compliance with the 20 regulations issued by the Commission under 21 section 501 of the Gramm-Leach-Bliley Act (15 22 U.S.C. 6801). 23 (B) DATE DESCRIBED.—The date de- 24 scribed in this subparagraph is— 25 VerDate Sep 11 2014 15:38 Feb 14, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H474.IH H474 pamtmann on DSKBC07HB2PROD with BILLS 4 •HR 474 IH (i) if no revision of such regulations is 1 required by paragraph (2) of subsection 2 (a), the date of the completion of the re- 3 view required by paragraph (1) of such 4 subsection; or 5 (ii) if revision of such regulations is 6 required by paragraph (2) of such sub- 7 section, the date on which the Commission 8 issues the revised regulations. 9 (2) SUBSEQUENT INVESTIGATIONS.—From time 10 to time after the date that is 18 months after the 11 date described in paragraph (1)(B), the Commission 12 shall complete an investigation of each covered con- 13 sumer reporting agency and each covered service 14 provider to determine whether such agency or pro- 15 vider is in compliance with the regulations issued by 16 the Commission under section 501 of the Gramm- 17 Leach-Bliley Act (15 U.S.C. 6801). 18 SEC. 3. ENFORCEMENT BY FEDERAL TRADE COMMISSION. 19 (a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 20 A violation of a regulation issued by the Commission 21 under section 501 of the Gramm-Leach-Bliley Act (15 22 U.S.C. 6801) by a covered consumer reporting agency or 23 a covered service provider shall be treated as a violation 24 of a rule under section 18(a)(1)(B) of the Federal Trade 25 VerDate Sep 11 2014 15:38 Feb 14, 2021 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H474.IH H474 pamtmann on DSKBC07HB2PROD with BILLS 5 •HR 474 IH Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding un- 1 fair or deceptive acts or practices. 2 (b) POWERS OF COMMISSION.—The Commission 3 shall enforce, with respect to covered consumer reporting 4 agencies and covered service providers, the regulations 5 issued by the Commission under section 501 of the 6 Gramm-Leach-Bliley Act (15 U.S.C. 6801) in the same 7 manner, by the same means, and with the same jurisdic- 8 tion, powers, and duties as though all applicable terms and 9 provisions of the Federal Trade Commission Act (15 10 U.S.C. 41 et seq.) were incorporated into and made a part 11 of such section. Any covered consumer reporting agency 12 or covered service provider that violates such a regulation 13 shall be subject to the penalties and entitled to the privi- 14 leges and immunities provided in the Federal Trade Com- 15 mission Act. 16 SEC. 4. ENFORCEMENT BY STATE ATTORNEYS GENERAL. 17 (a) IN GENERAL.—In any case in which the attorney 18 general of a State, or an official or agency of a State, 19 has reason to believe that an interest of the residents of 20 such State has been or is threatened or adversely affected 21 by an act or practice by a covered consumer reporting 22 agency or covered service provider in violation of a regula- 23 tion issued by the Commission under section 501 of the 24 Gramm-Leach-Bliley Act (15 U.S.C. 6801), the State, as 25 VerDate Sep 11 2014 15:38 Feb 14, 2021 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H474.IH H474 pamtmann on DSKBC07HB2PROD with BILLS 6 •HR 474 IH parens patriae, may bring a civil action on behalf of the 1 residents of the State in an appropriate district court of 2 the United States to— 3 (1) enjoin such act or practice; 4 (2) enforce compliance with such regulation; 5 (3) obtain damages, restitution, or other com- 6 pensation on behalf of residents of the State; or 7 (4) obtain such other legal and equitable relief 8 as the court may consider to be appropriate. 9 (b) NOTICE.—Before filing an action under this sec- 10 tion, the attorney general, official, or agency of the State 11 involved shall provide to the Commission a written notice 12 of such action and a copy of the complaint for such action. 13 If the attorney general, official, or agency determines that 14 it is not feasible to provide the notice described in this 15 subsection before the filing of the action, the attorney gen- 16 eral, official, or agency shall provide written notice of the 17 action and a copy of the complaint to the Commission im- 18 mediately upon the filing of the action. 19 (c) AUTHORITY OF COMMISSION.— 20 (1) IN GENERAL.—On receiving notice under 21 subsection (b) of an action under this section, the 22 Commission shall have the right— 23 (A) to intervene in the action; 24 VerDate Sep 11 2014 15:38 Feb 14, 2021 Jkt 019200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H474.IH H474 pamtmann on DSKBC07HB2PROD with BILLS 7 •HR 474 IH (B) upon so intervening, to be heard on all 1 matters arising therein; and 2 (C) to file petitions for appeal. 3 (2) LIMITATION ON STATE ACTION WHILE FED- 4 ERAL ACTION IS PENDING.—If the Commission or 5 the Attorney General of the United States has insti- 6 tuted a civil action for violation of a regulation 7 issued by the Commission under section 501 of the 8 Gramm-Leach-Bliley Act (15 U.S.C. 6801) by a cov- 9 ered consumer reporting agency or covered service 10 provider (referred to in this paragraph as the ‘‘Fed- 11 eral action’’), no State attorney general, official, or 12 agency may bring an action under this section dur- 13 ing the pendency of the Federal action against any 14 defendant named in the complaint in the Federal ac- 15 tion for any violation of such regulation alleged in 16 such complaint. 17 (d) RULE OF CONSTRUCTION.—For purposes of 18 bringing a civil action under this section, nothing in this 19 Act shall be construed to prevent an attorney general, offi- 20 cial, or agency of a State from exercising the powers con- 21 ferred on the attorney general, official, or agency by the 22 laws of such State to conduct investigations, administer 23 oaths and affirmations, or compel the attendance of wit- 24 VerDate Sep 11 2014 15:38 Feb 14, 2021 Jkt 019200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H474.IH H474 pamtmann on DSKBC07HB2PROD with BILLS 8 •HR 474 IH nesses or the production of documentary and other evi- 1 dence. 2 SEC. 5. DEFINITIONS. 3 In this Act: 4 (1) COMMISSION.—The term ‘‘Commission’’ 5 means the Federal Trade Commission. 6 (2) COVERED CONSUMER REPORTING AGEN- 7 CY.—The term ‘‘covered consumer reporting agency’’ 8 means a consumer reporting agency that compiles 9 and maintains files on consumers on a nationwide 10 basis (as defined in section 603(p) of the Fair Cred- 11 it Reporting Act (15 U.S.C. 1681a(p))). 12 (3) COVERED SERVICE PROVIDER.—The term 13 ‘‘covered service provider’’ means any person or enti- 14 ty that is a service provider (as defined in section 15 314.2 of title 16, Code of Federal Regulations) 16 through provision of services to a covered consumer 17 reporting agency. 18 Æ VerDate Sep 11 2014 15:38 Feb 14, 2021 Jkt 019200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6301 E:\BILLS\H474.IH H474 pamtmann on DSKBC07HB2PROD with BILLS