PROTECTION OF PERSONALLY IDENTIFIABLE INFORMATION.

SEC. 231. PROTECTION OF PERSONALLY IDENTIFIABLE INFORMATION.(a) Limitation.—Section 363(b)(1) of title 11, United States Code, is amended by striking the period at the end and inserting the following:“, except that if the debtor in connection with offering a product or a service discloses to an individual a policy prohibiting the transfer of personally identifiable information about individuals to persons that are not affiliated with the debtor and if such policy is in effect on the date of the commencement of the case, then the trustee may not sell or lease personally identifiable information to any person unless—119 STAT. 73“(A) such sale or such lease is consistent with such policy; or“(B) after appointment of a consumer privacy ombudsman in accordance with section 332, and after notice and a hearing, the court approves such sale or such lease—“(i) giving due consideration to the facts, circumstances, and conditions of such sale or such lease; and“(ii) finding that no showing was made that such sale or such lease would violate applicable nonbankruptcy law.”.(b) Definition.—Section 101 of title 11, United States Code, is amended by inserting after paragraph (41) the following:“(41A) ‘personally identifiable information’ means—“(A) if provided by an individual to the debtor in connection with obtaining a product or a service from the debtor primarily for personal, family, or household purposes—“(i) the first name (or initial) and last name of such individual, whether given at birth or time of adoption, or resulting from a lawful change of name;“(ii) the geographical address of a physical place of residence of such individual;“(iii) an electronic address (including an e-mail address) of such individual;“(iv) a telephone number dedicated to contacting such individual at such physical place of residence;“(v) a social security account number issued to such individual; or“(vi) the account number of a credit card issued to such individual; or“(B) if identified in connection with 1 or more of the items of information specified in subparagraph (A)—“(i) a birth date, the number of a certificate of birth or adoption, or a place of birth; or“(ii) any other information concerning an identified individual that, if disclosed, will result in contacting or identifying such individual physically or electronically;”.