I 118TH CONGRESS 1ST SESSION H. R. 3071 To amend the Small Business Act to require that credit reporting companies provide certain protections to small businesses, and for other purposes. IN THE HOUSE OF REPRESENTATIVES MAY 2, 2023 Mr. STEUBE introduced the following bill; which was referred to the Committee on Small Business A BILL To amend the Small Business Act to require that credit reporting companies provide certain protections to small businesses, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Small Business Credit 4 Protection Act of 2023’’. 5 SEC. 2. DATA BREACHES. 6 (a) IN GENERAL.—The Small Business Act (15 7 U.S.C. 631 et seq.) is amended— 8 (1) by redesignating section 49 (15 U.S.C. 631 9 note) as section 50; and 10 VerDate Sep 11 2014 03:12 May 13, 2023 Jkt 039200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H3071.IH H3071 pbinns on DSKJLVW7X2PROD with $$_JOB 2 •HR 3071 IH (2) by inserting after section 48 (15 U.S.C. 1 657u) the following new section: 2 ‘‘SEC. 49. DATA BREACHES. 3 ‘‘(a) DEFINITION.—In this section— 4 ‘‘(1) the term ‘consumer report’ has the mean- 5 ing given the term in section 603 of the Fair Credit 6 Reporting Act (15 U.S.C. 1681a); and 7 ‘‘(2) the term ‘credit reporting company’— 8 ‘‘(A) has the meaning given the term ‘con- 9 sumer reporting agency’ in section 603 of the 10 Fair Credit Reporting Act (15 U.S.C. 1681a); 11 and 12 ‘‘(B) includes an entity that collects com- 13 mercial credit data. 14 ‘‘(b) REQUIREMENTS FOR REPORTING BREACHES.— 15 ‘‘(1) APPLICABLE STATE LAW.— 16 ‘‘(A) IN GENERAL.—Except as provided in 17 paragraph (2), if nonpublic data of a small 18 business concern that is collected or stored by 19 a credit reporting company has been breached, 20 the credit reporting company shall report the 21 breach promptly and not later than as required 22 under the law of the State in which the small 23 business concern is located. 24 VerDate Sep 11 2014 03:12 May 13, 2023 Jkt 039200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H3071.IH H3071 pbinns on DSKJLVW7X2PROD with $$_JOB 3 •HR 3071 IH ‘‘(B) LOCATIONS IN MULTIPLE STATES.— 1 If a small business concern that is affected by 2 a breach described in subparagraph (A) has lo- 3 cations in more than 1 State, for the purposes 4 of that subparagraph, the law of the State that 5 imposes the shortest period for the reporting of 6 the breach shall apply. 7 ‘‘(2) EXCEPTION.— 8 ‘‘(A) IN GENERAL.—If a small business 9 concern that is affected by a breach described 10 in paragraph (1)(A) is located in a State that 11 does not have a law that imposes a set period 12 for the reporting of the breach, the credit re- 13 porting company to which the requirement 14 under that paragraph applies shall report the 15 breach in the most expeditious manner prac- 16 ticable and without unreasonable delay. 17 ‘‘(B) RULE OF CONSTRUCTION REGARDING 18 A LAW ENFORCEMENT REQUEST.—For the pur- 19 poses of subparagraph (A), a delay with respect 20 to the reporting of a breach described in that 21 subparagraph that is caused by a requirement 22 to respond to a request submitted by a law en- 23 forcement agency shall be construed to be a 24 reasonable delay. 25 VerDate Sep 11 2014 03:12 May 13, 2023 Jkt 039200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H3071.IH H3071 pbinns on DSKJLVW7X2PROD with $$_JOB 4 •HR 3071 IH ‘‘(c) PROHIBITION.—During the 180-day period be- 1 ginning on the date on which a breach described in sub- 2 section (b)(1)(A) occurs, a credit reporting company may 3 not charge a small business concern that is affected by 4 that breach for providing the small business concern with 5 the consumer report of the small business concern. 6 ‘‘(d) NO PREEMPTION.—Nothing in this section shall 7 preempt any State law with respect to credit reporting 8 companies.’’. 9 (b) GAO REPORT.— 10 (1) DEFINITIONS.—In this subsection: 11 (A) CREDIT REPORTING COMPANY.—The 12 term ‘‘credit reporting company’’— 13 (i) has the meaning given the term 14 ‘‘consumer reporting agency’’ in section 15 603 of the Fair Credit Reporting Act (15 16 U.S.C. 1681a); and 17 (ii) includes an entity that collects 18 commercial credit data. 19 (2) SMALL BUSINESS CONCERN.—The term 20 ‘‘small business concern’’ has the meaning given 21 such term under section 3 of the Small Business Act 22 (15 U.S.C. 632). 23 (3) REPORT.—Not later than 1 year after the 24 date of enactment of this Act, the Comptroller Gen- 25 VerDate Sep 11 2014 03:12 May 13, 2023 Jkt 039200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H3071.IH H3071 pbinns on DSKJLVW7X2PROD with $$_JOB 5 •HR 3071 IH eral of the United States shall submit to Congress 1 a report regarding the economic harm incurred by 2 small business concerns as a result of data breaches 3 at credit reporting companies. 4 Æ VerDate Sep 11 2014 03:12 May 13, 2023 Jkt 039200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6301 E:\BILLS\H3071.IH H3071 pbinns on DSKJLVW7X2PROD with $$_JOB