SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Personal Information Privacy Act of 
1997''.

SEC. 2. CONFIDENTIAL TREATMENT OF CREDIT HEADER INFORMATION.

    Section 603(d) of the Fair Credit Reporting Act (15 U.S.C. 
1681a(d)) is amended by inserting after the first
sentence the following: ``The term also includes any other identifying 
information of the consumer, except the name, address, and telephone 
number of the consumer if listed in a residential telephone directory 
available in the locality of the consumer.''.

SEC. 3. PROTECTING PRIVACY BY PROHIBITING USE OF THE SOCIAL SECURITY 
              NUMBER FOR COMMERCIAL PURPOSES WITHOUT CONSENT.

    (a) In General.--Part A of title XI of the Social Security Act (42 
U.S.C. 1301 et seq.) is amended by adding at the end the following:

 ``prohibition of certain misuses of the social security account number

    ``Sec. 1146. (a) Prohibition of Commercial Acquisition or 
Distribution.--No person may buy, sell, offer for sale, take or give in 
exchange, or pledge or give in pledge any information for the purpose, 
in whole or in part, of conveying by means of such information any 
individual's social security account number, or any derivative of such 
number, without the written consent of such individual.
    ``(b) Prohibition of Use as Personal Identification Number.--No 
person may utilize any individual's social security account number, or 
any derivative of such number, for purposes of identification of such 
individual without the written consent of such individual.
    ``(c) Prerequisites for Consent.--In order for consent to exist 
under subsection (a) or (b), the person engaged in, or seeking to 
engage in, an activity described in such subsection shall--
            ``(1) inform the individual of all the purposes for which 
        the number will be utilized and the persons to whom the number 
        will be known; and
            ``(2) obtain affirmatively expressed consent in writing.
    ``(d) Exceptions.--Nothing in this section shall be construed to 
prohibit any use of social security account numbers permitted or 
required under section 205(c)(2) of this Act, section 7(a)(2) of the 
Privacy Act of 1974 (5 U.S.C. 552a note; 88 Stat. 1909), or section 
6109(d) of the Internal Revenue Code of 1986.
    ``(e) Civil Action in United States District Court; Damages; 
Attorneys Fees and Costs; Nonexclusive Nature of Remedy.--
            ``(1) In general.--Any individual aggrieved by any act of 
        any person in violation of this section may bring a civil 
        action in a United States district court to recover--
                    ``(A) such preliminary and equitable relief as the 
                court determines to be appropriate; and
                    ``(B) the greater of--
                            ``(i) actual damages; and
                            ``(ii) liquidated damages of $25,000 or, in 
                        the case of a violation that was willful and 
                        resulted in profit or monetary gain, $50,000.
            ``(2) Attorney's fees and costs.--In the case of a civil 
        action brought under paragraph (1) in which the aggrieved 
        individual has substantially prevailed, the court may assess 
        against the respondent a reasonable attorney's fee and other 
        litigation costs and expenses (including expert fees) 
        reasonably incurred.
            ``(3) Statute of limitations.--No action may be commenced 
        under this subsection more than 3 years after the date on which 
        the violation was or should reasonably have been discovered by 
        the aggrieved individual.
            ``(4) Nonexclusive remedy.--The remedy provided under this 
        subsection shall be in addition to any other lawful remedy 
        available to the individual.
    ``(f) Civil Money Penalties.--
            ``(1) In general.--Any person who the Commissioner of 
        Social Security determines has violated this section shall be 
        subject, in addition to any other penalties that may be 
        prescribed by law, to--
                    ``(A) a civil money penalty of not more than 
                $25,000 for each such violation, and
                    ``(B) a civil money penalty of not more than 
                $500,000, if violations have occurred with such 
                frequency as to constitute a general business practice.
            ``(2) Determination of violations.-- Any violation 
        committed contemporaneously with respect to the social security 
        account numbers of 2 or more individuals by means of mail, 
        telecommunication, or otherwise shall be treated as a separate 
        violation with respect to each such individual.
            ``(3) Enforcement procedures.--The provisions of section 
        1128A (other than subsections (a), (b), (f), (h), (i), (j), and 
        (m), and the first sentence of subsection (c)) and the 
        provisions of subsections (d) and (e) of section 205 shall 
        apply to civil money penalties under this subsection in the 
        same manner as such provisions apply to a penalty or proceeding 
        under section 1128A(a), except that, for purposes of this 
        paragraph, any reference in section 1128A to the Secretary 
        shall be deemed a reference to the Commissioner of Social 
        Security.
    ``(g) Regulation by States.--Nothing in this section shall be 
construed to prohibit any State authority from enacting or enforcing 
laws consistent with this section for the protection of privacy.''.
    (b) Effective Date.--The amendment made by this section applies 
with respect to violations occurring on and after the date which is 2 
years after the date of enactment of this Act.

 SEC. 4. RESTRICTION ON USE OF SOCIAL SECURITY NUMBERS BY STATE 
              DEPARTMENTS OF MOTOR VEHICLES.

    (a) Restriction on Governmental Use.--Section 2721(b)(1) of title 
18, United States Code, is amended by striking ``its functions.'' and 
inserting ``its functions, but in the case of social security numbers, 
only to the extent permitted or required under section 205(c)(2) of the 
Social Security Act (42 U.S.C. 405(c)(2)), section 7(a)(2) of the 
Privacy Act of 1974 (5 U.S.C. 552a note, 88 Stat. 1909), section 
6109(d) of the Internal Revenue Code of 1986, or any other provision of 
law specifically identifying such use.''.
    (b) Prohibition of Use by Marketing Companies.--Section 2721(b)(12) 
of title 18, United States Code, is amended by striking ``For'' and 
inserting ``Except in the case of social security numbers, for''.
Personal Information Privacy Act of 1997 - Amends the Fair Credit Reporting Act to redefine the term "consumer report" to exclude identifying information listed in a local telephone directory (thereby ensuring that the personal identification information in the credit headers accompanying credit reports of unlisted individuals remains confidential). 
Amends part A (General Provisions) of title XI of the Social Security Act to prohibit the commercial acquisition or distribution of an individual's social security number (or any derivative of it) as well as its use as a personal identification number without the individual's written consent. 
Provides for a civil action in a U.S. District Court by any individual aggrieved by any violation of this prohibition.  Provides for civil money penalties for violations as well. 
Amends the Federal criminal code to require the uses of social security numbers by State departments of motor vehicles to be consistent with the uses authorized by the Social Security Act, the Privacy Act, and by any other statutes explicitly authorizing their use.  Prohibits the use of social security numbers by marketing companies.
Personal Information Privacy Act of 1997