text: SECTION 1. FINANCIAL INFORMATION PRIVACY.
  
      (a) In General.--The Consumer Credit Protection Act (15 U.S.C. 1601 
  et seq.) is amended by adding at the end the following:
  
            ``TITLE X--FINANCIAL INFORMATION PRIVACY PROTECTION
  
  ``Sec.
  ``1001. Short title.
  ``1002. Definitions.
  ``1003. Privacy protection for customer information of financial 
                              institutions.
  ``1004. Administrative enforcement.
  ``1005. Civil liability.
  ``1006. Criminal penalty.
  ``1007. Relation to State laws.
  ``1008. Agency guidance.
  ``Sec. 1001. Short title
      ``This title may be cited as the `Financial Information Privacy 
  Act'.
  ``Sec. 1002. Definitions
      ``For purposes of this title, the following definitions shall 
  apply:
              ``(1) Customer.--The term `customer' means, with respect to 
          a financial institution, any person (or authorized 
          representative of a person) to whom the financial institution 
          provides a product or service, including that of acting as a 
          fiduciary.
              ``(2) Customer information of a financial institution.--The 
          term `customer information of a financial institution' means 
          any information maintained by a financial institution which is 
          derived from the relationship between the financial institution 
          and a customer of the financial institution and is identified 
          with the customer.
              ``(3) Document.--The term `document' means any information 
          in any form.
              ``(4) Financial institution.--
                      ``(A) In general.--The term `financial institution' 
                  means any institution engaged in the business of 
                  providing financial services to customers who maintain 
                  a credit, deposit, trust, or other financial account or 
                  relationship with the institution.
                      ``(B) Certain financial institutions specifically 
                  included.--The term `financial institution' includes 
                  any depository institution (as defined in section 
                  19(b)(1)(A) of the Federal Reserve Act), any loan or 
                  finance company, any credit card issuer or operator of 
                  a credit card system, and any consumer reporting agency 
                  that compiles and maintains files on consumers on a 
                  nationwide basis (as defined in section 603(p)).
                      ``(C) Further definition by regulation.--The Board 
                  of Governors of the Federal Reserve System may 
                  prescribe regulations further defining the term 
                  `financial institution', in accordance with 
                  subparagraph (A), for purposes of this title.
  ``Sec. 1003. Privacy protection for customer information of financial 
                institutions
      ``(a) Prohibition on Obtaining Customer Information by False 
  Pretenses.--It shall be a violation of this title for any person to 
  obtain or attempt to obtain, or cause to be disclosed or attempt to 
  cause to be disclosed to any person, customer information of a 
  financial institution relating to another person--
              ``(1) by knowingly making a false, fictitious, or 
          fraudulent statement or representation to an officer, employee, 
          or agent of a financial institution with the intent to deceive 
          the officer, employee, or agent into relying on that statement 
          or representation for purposes of releasing the customer 
          information;
              ``(2) by knowingly making a false, fictitious, or 
          fraudulent statement or representation to a customer of a 
          financial institution with the intent to deceive the customer 
          into relying on that statement or representation for purposes 
          of releasing the customer information or authorizing the 
          release of such information; or
              ``(3) by knowingly providing any document to an officer, 
          employee, or agent of a financial institution, knowing that the 
          document is forged, counterfeit, lost, or stolen, was 
          fraudulently obtained, or contains a false, fictitious, or 
          fraudulent statement or representation, if the document is 
          provided with the intent to deceive the officer, employee, or 
          agent into relying on that document for purposes of releasing 
          the customer information.
      ``(b) Prohibition on Solicitation of a Person To Obtain Customer 
  Information From Financial Institution Under False Pretenses.--It shall 
  be a violation of this title to request a person to obtain customer 
  information of a financial institution, knowing or consciously avoiding 
  knowing that the person will obtain, or attempt to obtain, the 
  information from the institution in any manner described in subsection 
  (a).
      ``(c) Nonapplicability to Law Enforcement Agencies.--No provision 
  of this section shall be construed so as to prevent any action by a law 
  enforcement agency, or any officer, employee, or agent of such agency, 
  to obtain customer information of a financial institution in connection 
  with the performance of the official duties of the agency.
      ``(d) Nonapplicability to Financial Institutions in Certain 
  Cases.--No provision of this section shall be construed so as to 
  prevent any financial institution, or any officer, employee, or agent 
  of a financial institution, from obtaining customer information of such 
  financial institution in the course of--
              ``(1) testing the security procedures or systems of such 
          institution for maintaining the confidentiality of customer 
          information;
              ``(2) investigating allegations of misconduct or negligence 
          on the part of any officer, employee, or agent of the financial 
          institution; or
              ``(3) recovering customer information of the financial 
          institution which was obtained or received by another person in 
          any manner described in subsection (a) or (b).
      ``(e) Nonapplicability to Certain Types of Customer Information of 
  Financial Institutions.--No provision of this section shall be 
  construed so as to prevent any person from obtaining customer 
  information of a financial institution that otherwise is available as a 
  public record filed pursuant to the securities laws (as defined in 
  section 3(a)(47) of the Securities Exchange Act of 1934).
  ``Sec. 1004. Administrative enforcement
      ``(a) Enforcement by Federal Trade Commission.--Except as provided 
  in subsection (b), compliance with this title shall be enforced by the 
  Federal Trade Commission in the same manner and with the same power and 
  authority as the Commission has under title VIII, the Fair Debt 
  Collection Practices Act, to enforce compliance with such title.
      ``(b) Enforcement by Other Agencies in Certain Cases.--
              ``(1) In general.--Compliance with this title shall be 
          enforced under--
                      ``(A) section 8 of the Federal Deposit Insurance 
                  Act, in the case of--
                              ``(i) national banks, and Federal branches 
                          and Federal agencies of foreign banks, by the 
                          Office of the Comptroller of the Currency;
                              ``(ii) member banks of the Federal Reserve 
                          System (other than national banks), branches 
                          and agencies of foreign banks (other than 
                          Federal branches, Federal agencies, and insured 
                          State branches of foreign banks), commercial 
                          lending companies owned or controlled by 
                          foreign banks, and organizations operating 
                          under section 25 or 25A of the Federal Reserve 
                          Act, by the Board;
                              ``(iii) banks insured by the Federal 
                          Deposit Insurance Corporation (other than 
                          members of the Federal Reserve System and 
                          national nonmember banks) and insured State 
                          branches of foreign banks, by the Board of 
                          Directors of the Federal Deposit Insurance 
                          Corporation; and
                              ``(iv) savings associations the deposits of 
                          which are insured by the Federal Deposit 
                          Insurance Corporation, by the Director of the 
                          Office of Thrift Supervision; and
                      ``(B) the Federal Credit Union Act, by the 
                  Administrator of the National Credit Union 
                  Administration with respect to any Federal credit 
                  union.
              ``(2) Violations of this title treated as violations of 
          other laws.--For the purpose of the exercise by any agency 
          referred to in paragraph (1) of its powers under any Act 
          referred to in that paragraph, a violation of this title shall 
          be deemed to be a violation of a requirement imposed under that 
          Act. In addition to its powers under any provision of law 
          specifically referred to in paragraph (1), each of the agencies 
          referred to in that paragraph may exercise, for the purpose of 
          enforcing compliance with this title, any other authority 
          conferred on such agency by law.
      ``(c) State Action for Violations.--
              ``(1) Authority of states.--In addition to such other 
          remedies as are provided under State law, if the chief law 
          enforcement officer of a State, or an official or agency 
          designated by a State, has reason to believe that any person 
  has violated or is violating this title, the State--
                      ``(A) may bring an action to enjoin such violation 
                  in any appropriate United States district court or in 
                  any other court of competent jurisdiction;
                      ``(B) may bring an action on behalf of the 
                  residents of the State to recover damages of not more 
                  than $1,000 for each violation; and
                      ``(C) in the case of any successful action under 
                  subparagraph (A) or (B), shall be awarded the costs of 
                  the action and reasonable attorney fees as determined 
                  by the court.
              ``(2) Rights of federal regulators.--
                      ``(A) Prior notice.--The State shall serve prior 
                  written notice of any action under paragraph (1) upon 
                  the Federal Trade Commission and, in the case of an 
                  action which involves a financial institution described 
                  in section 1004(b)(1), the agency referred to in such 
                  section with respect to such institution and provide 
                  the Federal Trade Commission and any such agency with a 
                  copy of its complaint, except in any case in which such 
                  prior notice is not feasible, in which case the State 
                  shall serve such notice immediately upon instituting 
                  such action.
                      ``(B) Right to intervene.--The Federal Trade 
                  Commission or an agency described in subsection (b) 
                  shall have the right--
                              ``(i) to intervene in an action under 
                          paragraph (1);
                              ``(ii) upon so intervening, to be heard on 
                          all matters arising therein;
                              ``(iii) to remove the action to the 
                          appropriate United States district court; and
                              ``(iv) to file petitions for appeal.
              ``(3) Investigatory powers.--For purposes of bringing any 
          action under this subsection, no provision of this subsection 
          shall be construed as preventing the chief law enforcement 
          officer, or an official or agency designated by a State, from 
          exercising the powers conferred on the chief law enforcement 
          officer or such official by the laws of such State to conduct 
          investigations or to administer oaths or affirmations or to 
          compel the attendance of witnesses or the production of 
          documentary and other evidence.
              ``(4) Limitation on state action while federal action 
          pending.--If the Federal Trade Commission or any agency 
          described in subsection (b) has instituted a civil action for a 
          violation of this title, no State may, during the pendency of 
          such action, bring an action under this section against any 
          defendant named in the complaint of the Federal Trade 
          Commission or such agency for any violation of this title that 
          is alleged in that complaint.
  ``Sec. 1005. Civil liability
      ``Any person, other than a financial institution, who fails to 
  comply with any provision of this title with respect to any financial 
  institution or any customer information of a financial institution 
  shall be liable to such financial institution or the customer to whom 
  such information relates in an amount equal to the sum of the amounts 
  determined under each of the following paragraphs:
              ``(1) Actual damages.--The greater of--
                      ``(A) the amount of any actual damage sustained by 
                  the financial institution or customer as a result of 
                  such failure; or
                      ``(B) any amount received by the person who failed 
                  to comply with this title, including an amount equal to 
                  the value of any nonmonetary consideration, as a result 
                  of the action which constitutes such failure.
              ``(2) Additional damages.--Such additional amount as the 
          court may allow.
              ``(3) Attorneys' fees.--In the case of any successful 
          action to enforce any liability under paragraph (1) or (2), the 
          costs of the action, together with reasonable attorneys' fees.
  ``Sec. 1006. Criminal penalty
      ``(a) In General.--Whoever violates, or attempts to violate, 
  section 1003 shall be fined in accordance with title 18, United States 
  Code, or imprisoned for not more than 5 years, or both.
      ``(b) Enhanced Penalty for Aggravated Cases.--Whoever violates, or 
  attempts to violate, section 1003 while violating another law of the 
  United States or as part of a pattern of any illegal activity involving 
  more than $100,000 in a 12-month period shall be fined twice the amount 
  provided in subsection (b)(3) or (c)(3) (as the case may be) of section 
  3571 of title 18, United States Code, imprisoned for not more than 10 
  years, or both.
  ``Sec. 1007. Relation to State laws
      ``(a) In General.--This title shall not be construed as 
  superseding, altering, or affecting the statutes, regulations, orders, 
  or interpretations in effect in any State, except to the extent that 
  such statutes, regulations, orders, or interpretations are inconsistent 
  with the provisions of this title, and then only to the extent of the 
  inconsistency.
      ``(b) Greater Protection Under State Law.--For purposes of this 
  section, a State statute, regulation, order, or interpretation is not 
  inconsistent with the provisions of this title if the protection such 
  statute, regulation, order, or interpretation affords any person is 
  greater than the protection provided under this title.
  ``Sec. 1008. Agency guidance
      ``In furtherance of the objectives of this title, each Federal 
  banking agency (as defined in section 3(z) of the Federal Deposit 
  Insurance Act) shall issue advisories to depository institutions under 
  the jurisdiction of the agency, in order to assist such depository 
  institutions in deterring and detecting activities proscribed under 
  section 1003.''.
      (b) Report to the Congress.--Before the end of the 18-month period 
  beginning on the date of the enactment of this Act, the Comptroller 
  General, in consultation with the Federal Trade Commission, Federal 
  banking agencies, and appropriate Federal law enforcement agencies, 
  shall submit to the Congress a report on the following:
              (1) The efficacy and adequacy of the remedies provided in 
          the amendments made by subsection (a) in addressing attempts to 
          obtain financial information by fraudulent means or by false 
          pretenses.
              (2) Any recommendations for additional legislative or 
          regulatory action to address threats to the privacy of 
          financial information created by attempts to obtain information 
          by fraudulent means or false pretenses.
target: Financial Information Privacy Act - Amends the Consumer Credit Protection Act to:  (1) specify the types of enterprises constituting a financial institution within its purview; and (2) authorize the Board of Governors of the Federal Reserve System to prescribe regulations clarifying or describing the types of institutions which shall be treated as financial institutions for purposes of this Act. 
  Declares it a violation of this Act to obtain or disclose under false pretenses customer information of a financial institution. Grants the Federal Trade Commission (FTC), certain banking regulatory agencies, and the States enforcement powers under this Act. 
  Subjects violations of this Act to civil liability for damages and Federal criminal penalties. 
  Requires each Federal banking agency to issue advisories to depository institutions within its purview in order to assist in deterring and detecting the acts proscribed by this Act. 
  Requires the Comptroller General to report to the Congress on:  (1) the efficacy and adequacy of the remedies provided in this Act; and (2) recommendations for additional action to address threats to the privacy of financial information.
feat_title: Financial Information Privacy Act