; (2) in section 504(a)(1)(A), by striking , except that the Bureau of Consumer Financial Protection shall not have authority to prescribe regulations with respect to the standards under section 501 ; and (3) in section 505(a)(8), by inserting , other than under subsection (c) of section 501 after section 501 . 10. Report on data security risk assessments in examinations of consumer reporting agencies Not later than 90 days after the date of the enactment of this Act, the Director of the Bureau of Consumer Financial Protection shall assess whether examinations conducted by the Director of consumer reporting agencies described under section 603(f) of the Fair Credit Reporting Act ( 15 U.S.C. 1681a(f) ) include sufficient processes to addresses any data security risks to the consumers of such agencies on which such agencies maintain and compile files. Along with the first semiannual report required under section 1016(b) of the Consumer Financial Protection Act of 2010 ( 12 U.S.C. 5496(b) ) to be submitted after the 90-day period after the date of the enactment of this Act, the Director shall submit to Congress a report containing the results of such assessment that includes— (1) recommendations for improving the processes to addresses any such data security risks; and (2) the progress of the Director on making any improvements described under paragraph (1). 11. GAO study on the use of social security numbers (a) Study The Comptroller General of the United States shall carry out a study on the feasibility and means of consumer reporting agencies replacing the use of social security numbers as identifiers with another type of Federal identification. (b) Report Not later than the end of the 2-year period beginning on the date of the enactment of this Act, the Comptroller General shall issue a report to the Congress containing all findings and determinations made in carrying out the study required under subsection (a).