article: SECTION 1. FINANCIAL INFORMATION PRIVACY. (a) In General.--The Consumer Credit Protection Act (15 U.S.C. 1601 et seq.) is amended by adding at the end the following: ``TITLE X--FINANCIAL INFORMATION PRIVACY PROTECTION ``Sec. ``1001. Short title. ``1002. Definitions. ``1003. Privacy protection for customer information of financial institutions. ``1004. Administrative enforcement. ``1005. Civil liability. ``1006. Criminal penalty. ``1007. Relation to State laws. ``1008. Agency guidance. ``Sec. 1001. Short title ``This title may be cited as the `Financial Information Privacy Act'. ``Sec. 1002. Definitions ``For purposes of this title, the following definitions shall apply: ``(1) Customer.--The term `customer' means, with respect to a financial institution, any person (or authorized representative of a person) to whom the financial institution provides a product or service, including that of acting as a fiduciary. ``(2) Customer information of a financial institution.--The term `customer information of a financial institution' means any information maintained by a financial institution which is derived from the relationship between the financial institution and a customer of the financial institution and is identified with the customer. ``(3) Document.--The term `document' means any information in any form. ``(4) Financial institution.-- ``(A) In general.--The term `financial institution' means any institution engaged in the business of providing financial services to customers who maintain a credit, deposit, trust, or other financial account or relationship with the institution. ``(B) Certain financial institutions specifically included.--The term `financial institution' includes any depository institution (as defined in section 19(b)(1)(A) of the Federal Reserve Act), any loan or finance company, any credit card issuer or operator of a credit card system, and any consumer reporting agency that compiles and maintains files on consumers on a nationwide basis (as defined in section 603(p)). ``(C) Further definition by regulation.--The Board of Governors of the Federal Reserve System may prescribe regulations further defining the term `financial institution', in accordance with subparagraph (A), for purposes of this title. ``Sec. 1003. Privacy protection for customer information of financial institutions ``(a) Prohibition on Obtaining Customer Information by False Pretenses.--It shall be a violation of this title for any person to obtain or attempt to obtain, or cause to be disclosed or attempt to cause to be disclosed to any person, customer information of a financial institution relating to another person-- ``(1) by knowingly making a false, fictitious, or fraudulent statement or representation to an officer, employee, or agent of a financial institution with the intent to deceive the officer, employee, or agent into relying on that statement or representation for purposes of releasing the customer information; ``(2) by knowingly making a false, fictitious, or fraudulent statement or representation to a customer of a financial institution with the intent to deceive the customer into relying on that statement or representation for purposes of releasing the customer information or authorizing the release of such information; or ``(3) by knowingly providing any document to an officer, employee, or agent of a financial institution, knowing that the document is forged, counterfeit, lost, or stolen, was fraudulently obtained, or contains a false, fictitious, or fraudulent statement or representation, if the document is provided with the intent to deceive the officer, employee, or agent into relying on that document for purposes of releasing the customer information. ``(b) Prohibition on Solicitation of a Person To Obtain Customer Information From Financial Institution Under False Pretenses.--It shall be a violation of this title to request a person to obtain customer information of a financial institution, knowing or consciously avoiding knowing that the person will obtain, or attempt to obtain, the information from the institution in any manner described in subsection (a). ``(c) Nonapplicability to Law Enforcement Agencies.--No provision of this section shall be construed so as to prevent any action by a law enforcement agency, or any officer, employee, or agent of such agency, to obtain customer information of a financial institution in connection with the performance of the official duties of the agency. ``(d) Nonapplicability to Financial Institutions in Certain Cases.--No provision of this section shall be construed so as to prevent any financial institution, or any officer, employee, or agent of a financial institution, from obtaining customer information of such financial institution in the course of-- ``(1) testing the security procedures or systems of such institution for maintaining the confidentiality of customer information; ``(2) investigating allegations of misconduct or negligence on the part of any officer, employee, or agent of the financial institution; or ``(3) recovering customer information of the financial institution which was obtained or received by another person in any manner described in subsection (a) or (b). ``(e) Nonapplicability to Certain Types of Customer Information of Financial Institutions.--No provision of this section shall be construed so as to prevent any person from obtaining customer information of a financial institution that otherwise is available as a public record filed pursuant to the securities laws (as defined in section 3(a)(47) of the Securities Exchange Act of 1934). ``Sec. 1004. Administrative enforcement ``(a) Enforcement by Federal Trade Commission.--Except as provided in subsection (b), compliance with this title shall be enforced by the Federal Trade Commission in the same manner and with the same power and authority as the Commission has under title VIII, the Fair Debt Collection Practices Act, to enforce compliance with such title. ``(b) Enforcement by Other Agencies in Certain Cases.-- ``(1) In general.--Compliance with this title shall be enforced under-- ``(A) section 8 of the Federal Deposit Insurance Act, in the case of-- ``(i) national banks, and Federal branches and Federal agencies of foreign banks, by the Office of the Comptroller of the Currency; ``(ii) member banks of the Federal Reserve System (other than national banks), branches and agencies of foreign banks (other than Federal branches, Federal agencies, and insured State branches of foreign banks), commercial lending companies owned or controlled by foreign banks, and organizations operating under section 25 or 25A of the Federal Reserve Act, by the Board; ``(iii) banks insured by the Federal Deposit Insurance Corporation (other than members of the Federal Reserve System and national nonmember banks) and insured State branches of foreign banks, by the Board of Directors of the Federal Deposit Insurance Corporation; and ``(iv) savings associations the deposits of which are insured by the Federal Deposit Insurance Corporation, by the Director of the Office of Thrift Supervision; and ``(B) the Federal Credit Union Act, by the Administrator of the National Credit Union Administration with respect to any Federal credit union. ``(2) Violations of this title treated as violations of other laws.--For the purpose of the exercise by any agency referred to in paragraph (1) of its powers under any Act referred to in that paragraph, a violation of this title shall be deemed to be a violation of a requirement imposed under that Act. In addition to its powers under any provision of law specifically referred to in paragraph (1), each of the agencies referred to in that paragraph may exercise, for the purpose of enforcing compliance with this title, any other authority conferred on such agency by law. ``(c) State Action for Violations.-- ``(1) Authority of states.--In addition to such other remedies as are provided under State law, if the chief law enforcement officer of a State, or an official or agency designated by a State, has reason to believe that any person has violated or is violating this title, the State-- ``(A) may bring an action to enjoin such violation in any appropriate United States district court or in any other court of competent jurisdiction; ``(B) may bring an action on behalf of the residents of the State to recover damages of not more than $1,000 for each violation; and ``(C) in the case of any successful action under subparagraph (A) or (B), shall be awarded the costs of the action and reasonable attorney fees as determined by the court. ``(2) Rights of federal regulators.-- ``(A) Prior notice.--The State shall serve prior written notice of any action under paragraph (1) upon the Federal Trade Commission and, in the case of an action which involves a financial institution described in section 1004(b)(1), the agency referred to in such section with respect to such institution and provide the Federal Trade Commission and any such agency with a copy of its complaint, except in any case in which such prior notice is not feasible, in which case the State shall serve such notice immediately upon instituting such action. ``(B) Right to intervene.--The Federal Trade Commission or an agency described in subsection (b) shall have the right-- ``(i) to intervene in an action under paragraph (1); ``(ii) upon so intervening, to be heard on all matters arising therein; ``(iii) to remove the action to the appropriate United States district court; and ``(iv) to file petitions for appeal. ``(3) Investigatory powers.--For purposes of bringing any action under this subsection, no provision of this subsection shall be construed as preventing the chief law enforcement officer, or an official or agency designated by a State, from exercising the powers conferred on the chief law enforcement officer or such official by the laws of such State to conduct investigations or to administer oaths or affirmations or to compel the attendance of witnesses or the production of documentary and other evidence. ``(4) Limitation on state action while federal action pending.--If the Federal Trade Commission or any agency described in subsection (b) has instituted a civil action for a violation of this title, no State may, during the pendency of such action, bring an action under this section against any defendant named in the complaint of the Federal Trade Commission or such agency for any violation of this title that is alleged in that complaint. ``Sec. 1005. Civil liability ``Any person, other than a financial institution, who fails to comply with any provision of this title with respect to any financial institution or any customer information of a financial institution shall be liable to such financial institution or the customer to whom such information relates in an amount equal to the sum of the amounts determined under each of the following paragraphs: ``(1) Actual damages.--The greater of-- ``(A) the amount of any actual damage sustained by the financial institution or customer as a result of such failure; or ``(B) any amount received by the person who failed to comply with this title, including an amount equal to the value of any nonmonetary consideration, as a result of the action which constitutes such failure. ``(2) Additional damages.--Such additional amount as the court may allow. ``(3) Attorneys' fees.--In the case of any successful action to enforce any liability under paragraph (1) or (2), the costs of the action, together with reasonable attorneys' fees. ``Sec. 1006. Criminal penalty ``(a) In General.--Whoever violates, or attempts to violate, section 1003 shall be fined in accordance with title 18, United States Code, or imprisoned for not more than 5 years, or both. ``(b) Enhanced Penalty for Aggravated Cases.--Whoever violates, or attempts to violate, section 1003 while violating another law of the United States or as part of a pattern of any illegal activity involving more than $100,000 in a 12-month period shall be fined twice the amount provided in subsection (b)(3) or (c)(3) (as the case may be) of section 3571 of title 18, United States Code, imprisoned for not more than 10 years, or both. ``Sec. 1007. Relation to State laws ``(a) In General.--This title shall not be construed as superseding, altering, or affecting the statutes, regulations, orders, or interpretations in effect in any State, except to the extent that such statutes, regulations, orders, or interpretations are inconsistent with the provisions of this title, and then only to the extent of the inconsistency. ``(b) Greater Protection Under State Law.--For purposes of this section, a State statute, regulation, order, or interpretation is not inconsistent with the provisions of this title if the protection such statute, regulation, order, or interpretation affords any person is greater than the protection provided under this title. ``Sec. 1008. Agency guidance ``In furtherance of the objectives of this title, each Federal banking agency (as defined in section 3(z) of the Federal Deposit Insurance Act) shall issue advisories to depository institutions under the jurisdiction of the agency, in order to assist such depository institutions in deterring and detecting activities proscribed under section 1003.''. (b) Report to the Congress.--Before the end of the 18-month period beginning on the date of the enactment of this Act, the Comptroller General, in consultation with the Federal Trade Commission, Federal banking agencies, and appropriate Federal law enforcement agencies, shall submit to the Congress a report on the following: (1) The efficacy and adequacy of the remedies provided in the amendments made by subsection (a) in addressing attempts to obtain financial information by fraudulent means or by false pretenses. (2) Any recommendations for additional legislative or regulatory action to address threats to the privacy of financial information created by attempts to obtain information by fraudulent means or false pretenses.
summary: Financial Information Privacy Act - Amends the Consumer Credit Protection Act to: (1) specify the types of enterprises constituting a financial institution within its purview; and (2) authorize the Board of Governors of the Federal Reserve System to prescribe regulations clarifying or describing the types of institutions which shall be treated as financial institutions for purposes of this Act. Declares it a violation of this Act to obtain or disclose under false pretenses customer information of a financial institution. Grants the Federal Trade Commission (FTC), certain banking regulatory agencies, and the States enforcement powers under this Act. Subjects violations of this Act to civil liability for damages and Federal criminal penalties. Requires each Federal banking agency to issue advisories to depository institutions within its purview in order to assist in deterring and detecting the acts proscribed by this Act. Requires the Comptroller General to report to the Congress on: (1) the efficacy and adequacy of the remedies provided in this Act; and (2) recommendations for additional action to address threats to the privacy of financial information.