View all text of Subchapter II [§ 401 - § 434]
§ 405b. Reducing identity fraud
(a) Purpose
(b) DefinitionsIn this section:
(1) Commissioner
(2) Financial institution
(3) Fraud protection dataThe term “fraud protection data” means a combination of the following information with respect to an individual:
(A) The name of the individual (including the first name and any family forename or surname of the individual).
(B) The social security number of the individual.
(C) The date of birth (including the month, day, and year) of the individual.
(4) Permitted entity
(c) Efficiency
(1) Reliance on existing methodsThe Commissioner shall evaluate the feasibility of making modifications to any database that is in existence as of May 24, 2018, or a similar resource such that the database or resource—
(A) is reasonably designed to effectuate the purpose of this section; and
(B) meets the requirements of subsection (d).
(2) Execution
(d) Protection of vulnerable consumersThe database or similar resource described in subsection (c) shall—
(1) compare fraud protection data provided in an inquiry by a permitted entity against such information maintained by the Commissioner in order to confirm (or not confirm) the validity of the information provided;
(2) be scalable and accommodate reasonably anticipated volumes of verification requests from permitted entities with commercially reasonable uptime and availability; and
(3) allow permitted entities to submit—
(A) 1 or more individual requests electronically for real-time machine-to-machine (or similar functionality) accurate responses; and
(B) multiple requests electronically, such as those provided in a batch format, for accurate electronic responses within a reasonable period of time from submission, not to exceed 24 hours.
(e) Certification requiredBefore providing confirmation of fraud protection data to a permitted entity, the Commissioner shall ensure that the Commissioner has a certification from the permitted entity that is dated not more than 2 years before the date on which that confirmation is provided that includes the following declarations:
(1) The entity is a permitted entity.
(2) The entity is in compliance with this section.
(3) The entity is, and will remain, in compliance with its privacy and data security requirements, as described in title V of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.), with respect to information the entity receives from the Commissioner pursuant to this section.
(4) The entity will retain sufficient records to demonstrate its compliance with its certification and this section for a period of not less than 2 years.
(f) Consumer consent
(1) In generalNotwithstanding any other provision of law or regulation, a permitted entity may submit a request to the database or similar resource described in subsection (c) only—
(A) pursuant to the written, including electronic, consent received by a permitted entity from the individual who is the subject of the request; and
(B) in connection with a credit transaction or any circumstance described in section 1681b of title 15.
(2) Electronic consent requirements
(3) Effectuating electronic consent
(g) Compliance and enforcement
(1) Audits and monitoringThe Commissioner may—
(A) conduct audits and monitoring to—
(i) ensure proper use by permitted entities of the database or similar resource described in subsection (c); and
(ii) deter fraud and misuse by permitted entities with respect to the database or similar resource described in subsection (c); and
(B) terminate services for any permitted entity that prevents or refuses to allow the Commissioner to carry out the activities described in subparagraph (A).
(2) Enforcement
(A) In general
(B) Relevant information
(h) Recovery of costs
(1) In general
(A) In general
(B) Prices fixed by Commissioner
(2) Initial development
(3) Existing resources
(4) Annual report
(Pub. L. 115–174, title II, § 215, May 24, 2018, 132 Stat. 1323.)