1. Short title This Act may be cited as the Consumer Data Protection Act . 2. Data security (a) In general The Fair Credit Reporting Act ( 15 U.S.C. 1681 et seq.) is amended by inserting after section 605B ( 15 U.S.C. 1681c–2 ) the following: 605C. Data security at consumer reporting agencies (a) Definitions In this section— (1) the term affected individual means an individual, the sensitive personal information of whom is lost, stolen, or accessed without authorization because of a data breach; (2) the term appropriate committees of Congress means— (A) the Committee on the Judiciary of the Senate; (B) the Committee on Banking, Housing, and Urban Affairs of the Senate; (C) the Committee on the Judiciary of the House of Representatives; and (D) the Committee on Financial Services of the House of Representatives; (3) the term covered action means an action that restricts the legal rights available to a consumer, including— (A) requiring the consumer to— (i) waive the right of the consumer to— (I) file a civil action in an appropriate court; or (II) bring, or participate in, a class action; or (ii) engage in settlement negotiations before bringing an action under subsection (c)(3); and (B) offering a financial inducement in exchange for the consumer waiving any right of the consumer; (4) the term credit freeze — (A) except as provided in subparagraph (B), means a restriction placed on the consumer report of a consumer at the request of the consumer, or a personal representative of the consumer, that prohibits a consumer reporting agency from releasing the consumer report for any purpose; and (B) with respect to the consumer report of a consumer, shall not apply to the use of the consumer report by— (i) a person, or a subsidiary, affiliate, agent, subcontractor, or assignee of the person, with which the consumer has, or before assignment had, an account, contract, or debtor-creditor relationship for the purposes of— (I) reviewing the active account