Mrs. FEINSTEIN. Mr. President, today, along with my distinguished colleague, Senator Charles Grassley, I am introducing the Personal Information Privacy Act of 1997. This legislation limits the accessibility and unauthorized commercial use of social security numbers, unlisted telephone numbers, and certain other types of sensitive personal information.

In November, the news media reported that companies were distributing social security numbers along with other private information in their online personal locator or look-up services.

In fact, I found that my own social security number was accessible to users of the Internet. My staff retrieved it in less than 3 minutes. I have the printout in my files.

Some of the larger and more visible companies have now discontinued the practice of displaying social security numbers directly on the computer screens of Internet users. Other enterprises have failed to modify their practices. One problem thwarting efforts to protect our citizens' privacy is that there are thousands of information providers on the Internet and elsewhere in the electronic arena--it is impossible to get a comprehensive picture of who is doing what, and where.

But one fact is clear, distributing social security numbers on the Internet is only the tip of the iceberg.

Too many firms profit from renting and selling social security numbers, unlisted telephone numbers, and other forms of sensitive personal information. List compilers and list brokers use records of consumer purchases and other transactions--including medical purchases--along with financial, demographic, and other data to create increasingly detailed profiles of individuals.

The growth of interactive communications has generated an explosive growth in information about our interests, our activities, and our illnesses--about the personal choices we make when we order products, inquire about services, participate in workshops, and visit sites on the Net.

A Newsday article titled `Your Life as an Open Book' recently reported that an individual's call to a toll free number to learn the daily pollen count resulted in a disclosure to a pharmaceutical company that the caller was likely to have an interest in pollen remedies.

It is true that knowledge about personal interests, circumstances, and activities can help companies tailor their products to individual needs and target their marketing efforts. But there need to be limitations.

Prior to the widespread use of computers, individual records were stored on paper in Government file cabinets at scattered locations around the country. These records were difficult to obtain. Now, with networked computers, multiple sets of records can be merged or matched with one another, creating highly detailed portraits of our interests, our allergies, food preferences, musical tastes, levels of wealth, gender, ethnicity, homes, and neighborhoods. These records can be disseminated around the world in seconds.

What is the result? In addition to receiving floods of unwanted mail solicitations, people are losing control over their own identities. We don't know where this information is going, or how it is being used. We don't know how much is out there, and who is getting it. Our private lives are becoming commodities with tremendous value in the marketplace, yet we, the owners of the information, often do not derive the benefits. Information about us can be used to our detriment.

As an example, the widespread availability of Social Security numbers and other personal information has led to an exponential growth in identity theft, whereby criminals are able to assume the identities of others to gain access to charge accounts and bank accounts, to obtain the personal records of others, and to steal Government benefits.

In 1992, Joe Gutierrez, a retired Air Force chief master sergeant in California became a victim of identity theft when a man used his Social Security number to open 20 fraudulent accounts. To this day, Mr. Gutierrez has been hounded by creditors and their collection agencies. `It is pure hell,' he said in an interview with the San Diego Union Tribune. `They have called me a cheat, a deadbeat, a bum. They have questioned my character, my integrity, and my upbringing.'

As an additional problem, the unauthorized distribution of personal information can lead to public safety concerns, including stalking of battered spouses, celebrities, and other citizens.

There are very few laws to protect personal privacy in the United States. The Privacy Act of 1974 is limited, and applies only to the use of personal information by the Government.

With minor exceptions, the collection and use of personal information by the private sector is virtually unregulated. In other words, private companies have nearly unlimited authority to compile and sell information about individuals. As technology becomes more sophisticated, the ability to collect, synthesize and distribute personal information is growing exponentially.

The Personal Information Privacy Act of 1997 will help cut off the dissemination of Social Security numbers, unlisted telephone numbers, and other personal information at the source.

First, the bill amends the Fair Credit Reporting Act to ensure the confidentiality of personal information in the credit headers accompanying credit reports. Credit headers contain personal identification information which serves to link individuals to their credit reports.

Currently, credit bureaus routinely sell and rent credit header information to mailing list brokers and marketing companies. This is not the use for which this information was intended.

The bill we are introducing today would prevent credit bureaus from disseminating Social Security numbers, unlisted telephone numbers, dates of birth, past addresses, and mothers' maiden names. This is important because this kind of information is subject to serious abuse--to open fraudulent charge accounts, to manipulate bank accounts, and to gain access to the personal records of others.

An exception is provided for information that citizens have chosen to list in their local phone directories. This means that phone numbers and addresses may be released if they already are available in phone directories.

As a second means of limiting the circulation of Social Security numbers, the bill restricts the dissemination of Social Security numbers by State departments of motor vehicles. Specifically, the bill amends certain exemptions to the Driver's Protection Act of 1994.

The legislation would prohibit State departments of motor vehicles from disseminating Social Security numbers for bulk distribution for surveys, marketing, or solicitations.

The bill requires uses of Social Security numbers by State Departments of Motor Vehicles to be consistent with the uses authorized by the Social Security Act and by other statutes explicitly authorizing their use.

In addition to the above measures which will limit the accessibility of Social Security numbers, the Personal Information Privacy Act of 1997 penalizes the unauthorized commercial use of Social Security numbers.

Specifically, the bill amends the Social Security Act to prohibit the commercial use of a Social Security number in the absence of the owner's written consent. Exceptions are provided for uses authorized by the Social Security Act, the Privacy Act of 1974, and other statutes specifically authorizing such use.

I believe this bill represents a major step in protecting the privacy of our citizens, and I urge my colleagues to support it. I ask unanimous consent that the text of the bill be included in the Record following our remarks.

There being no objection, the bill was ordered to be printed in the Record, as follows: