Small Business Credit Protection Act

II 116TH CONGRESS 1ST SESSION S. 84 To amend the Small Business Act to require that consumer reporting agencies and other credit reporting companies provide certain protections to small businesses, and for other purposes. IN THE SENATE OF THE UNITED STATES JANUARY 10, 2019 Mr. RUBIO (for himself, Mr. KENNEDY, Mr. COONS, and Mr. JONES) intro- duced the following bill; which was read twice and referred to the Com- mittee on Small Business and Entrepreneurship A BILL To amend the Small Business Act to require that consumer reporting agencies and other credit reporting companies provide certain protections to small businesses, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Small Business Credit 4 Protection Act’’. 5 SEC. 2. DATA BREACHES. 6 (a) IN GENERAL.—The Small Business Act (15 7 U.S.C. 631 et seq.) is amended— 8 VerDate Sep 11 2014 03:33 Jan 18, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S84.IS S84 kjohnson on DSK79L0C42 with BILLS 2 •S 84 IS (1) by redesignating section 49 (15 U.S.C. 631 1 note) as section 50; and 2 (2) by inserting after section 48 (15 U.S.C. 3 657u) the following: 4 ‘‘SEC. 49. DATA BREACHES. 5 ‘‘(a) DEFINITION.—In this section, the term ‘credit 6 reporting company’— 7 ‘‘(1) has the meaning given the term ‘consumer 8 reporting agency’ in section 603 of the Fair Credit 9 Reporting Act (15 U.S.C. 1681a); and 10 ‘‘(2) includes an entity that collects commercial 11 credit data. 12 ‘‘(b) REQUIREMENTS FOR REPORTING BREACHES.— 13 ‘‘(1) APPLICABLE STATE LAW.— 14 ‘‘(A) IN GENERAL.—Except as provided in 15 paragraph (2), if nonpublic data of a small 16 business concern that is collected or stored by 17 a credit reporting company has been breached, 18 the credit reporting company shall report the 19 breach promptly and not later than as required 20 under the law of the State in which the small 21 business concern is located. 22 ‘‘(B) LOCATIONS IN MULTIPLE STATES.— 23 If a small business concern that is affected by 24 a breach described in subparagraph (A) has lo- 25 VerDate Sep 11 2014 03:33 Jan 18, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S84.IS S84 kjohnson on DSK79L0C42 with BILLS 3 •S 84 IS cations in more than 1 State, for the purposes 1 of that subparagraph, the law of the State that 2 imposes the shortest period for the reporting of 3 the breach shall apply. 4 ‘‘(2) EXCEPTION.— 5 ‘‘(A) IN GENERAL.—If a small business 6 concern that is affected by a breach described 7 in paragraph (1)(A) is located in a State that 8 does not have a law that imposes a set period 9 for the reporting of the breach, the credit re- 10 porting company to which the requirement 11 under that paragraph applies shall report the 12 breach in the most expeditious manner prac- 13 ticable and without unreasonable delay. 14 ‘‘(B) RULE OF CONSTRUCTION REGARDING 15 A LAW ENFORCEMENT REQUEST.—For the pur- 16 poses of subparagraph (A), a delay with respect 17 to the reporting of a breach described in that 18 subparagraph that is caused by a requirement 19 to respond to a request submitted by a law en- 20 forcement agency shall be construed to be a 21 reasonable delay. 22 ‘‘(c) PROHIBITION.—During the 180-day period be- 23 ginning on the date on which a breach described in sub- 24 section (b)(1)(A) occurs, a credit reporting company may 25 VerDate Sep 11 2014 03:33 Jan 18, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S84.IS S84 kjohnson on DSK79L0C42 with BILLS 4 •S 84 IS not charge a small business concern that is affected by 1 that breach for providing the small business concern with 2 the credit report of the small business concern. 3 ‘‘(d) NO PREEMPTION.—Nothing in this section shall 4 preempt any State law with respect to credit reporting 5 companies.’’. 6 (b) GAO REPORT.— 7 (1) DEFINITIONS.—In this subsection— 8 (A) the term ‘‘credit reporting company’’— 9 (i) has the meaning given the term 10 ‘‘consumer reporting agency’’ in section 11 603 of the Fair Credit Reporting Act (15 12 U.S.C. 1681a); and 13 (ii) includes an entity that collects 14 commercial credit data; and 15 (B) the term ‘‘small business concern’’ has 16 the meaning given the term in section 3(a) of 17 the Small Business Act (15 U.S.C. 632(a)). 18 (2) REPORT.—Not later than 1 year after the 19 date of enactment of this Act, the Comptroller Gen- 20 eral of the United States shall submit to Congress 21 a report regarding the economic harm incurred by 22 small business concerns as a result of data breaches 23 at credit reporting companies. 24 Æ VerDate Sep 11 2014 03:33 Jan 18, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6301 E:\BILLS\S84.IS S84 kjohnson on DSK79L0C42 with BILLS