By:  West, Estes                                                  S.B. No. 674


A BILL TO BE ENTITLED

AN ACT

relating to limiting the use of customers' social security numbers 
by persons; providing a civil penalty.
	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:                        
	SECTION 1.  Subchapter D, Chapter 35, Business & Commerce 
Code, is amended by adding Section 35.62 to read as follows:
	Sec. 35.62.  PROHIBITED ACTS WITH RESPECT TO USE OF 
CUSTOMERS' SOCIAL SECURITY NUMBERS.  (a)  In this section:
		(1)  "Customer" means an individual who has established 
or is attempting to establish an account with a person.
		(2)  "Financial institution" means:                                    
			(A)  a bank, savings association, savings bank, or 
credit union maintaining an office, branch, or agency office in 
this state; and
			(B)  a financial institution as defined by 15 
U.S.C. Sections 6801-6809.
	(b)  A person may not request a customer's social security 
number, or another number that includes four or more consecutive 
digits of a customer's social security number, as an identifier 
unless the number is needed to complete a credit check that is 
required to provide a service or product requested by the customer.
	(c)  A person that requests a customer's number to complete a 
credit check, as provided in Subsection (b), shall:
		(1)  destroy each record of the number by shredding, 
erasing, or other means after the credit check is completed; or
		(2)  maintain the number:                                              
			(A)  for the sole purpose of allowing authorized 
employees to use the number to collect a debt or to protect against 
fraud or unauthorized transactions; and
			(B)  in a database or other location that ensures 
the security and confidentiality of the number and protects against 
unauthorized access to, or use of, the number.
	(d)  When a customer's number is no longer maintained by the 
person as required by Subsection (c)(2), the person shall destroy 
each record of the number by shredding, erasing, or other means.
	(e)  A person may not request an existing customer's social 
security number, or another number that includes four or more 
consecutive digits of an existing customer's social security 
number, to verify the customer's relationship with the person.
	(f)  This section does not apply to:                                    
		(1)  a financial institution, mortgage lender, or 
mortgage broker;   
		(2)  a covered entity as defined by Section 601.001 or 
602.001, Insurance Code;
		(3)  a governmental entity; or                                         
		(4)  a person who is required to maintain and 
disseminate a privacy policy under the Health Insurance Portability 
and Accountability Act of 1996 (Pub. L. No. 104-191).
	(g)  A person that violates this section is liable to the 
state for a civil penalty of $1,000 for each violation.  The 
attorney general or the prosecuting attorney in the county in which 
the violation occurs may bring suit to recover the civil penalty 
imposed under this section.  The attorney general may bring an 
action in the name of the state to restrain or enjoin a business 
from violating this section.
	SECTION 2.  (a)  The Office of Consumer Credit Commissioner, 
with the assistance of the attorney general, shall conduct a study 
to develop and evaluate proposals to limit the use of social 
security numbers by businesses in this state.
	(b)  In conducting the study, the consumer credit 
commissioner shall receive input from credit reporting agencies, 
businesses, and consumer groups.
	(c)  The consumer credit commissioner shall evaluate 
whether, when a business contacts a credit reporting agency for a 
credit check of a customer, the business and credit reporting 
agency should create a unique code that:
		(1)  would allow the business to retrieve the social 
security number of the customer for collection purposes; and
		(2)  permit the business to delete the social security 
number of the customer from the records of the business.
	(d)  The consumer credit commissioner shall determine the 
date on which the system described by Subsection (c) of this section 
could be implemented and the feasibility of monitoring compliance 
with the system.
	(e)  Not later than July 1, 2006, the consumer credit 
commissioner shall submit a report to the legislature regarding the 
results of the study conducted under this section.
	(f)  This section expires September 1, 2006.                                   
	SECTION 3.  This Act takes effect September 1, 2005.