42 U.S.C. § 1306c

(a) In general The Secretary of Commerce shall not disclose to any person information contained on the Death Master File with respect to any deceased individual at any time during the 3-calendar-year period beginning on the date of the individual’s death, unless such person is certified under the program established under subsection (b). (b) Certification program (1) In general The Secretary of Commerce shall establish a program— (A) to certify persons who are eligible to access the information described in subsection (a) contained on the Death Master File, and (B) to perform periodic and unscheduled audits of certified persons to determine the compliance by such certified persons with the requirements of the program. (2) Certification A person shall not be certified under the program established under paragraph (1) unless such person certifies that access to the information described in subsection (a) is appropriate because such person— (A) has— (i) a legitimate fraud prevention interest, or (ii) a legitimate business purpose pursuant to a law, governmental rule, regulation, or fiduciary duty, and (B) has systems, facilities, and procedures in place to safeguard such information, and experience in maintaining the confidentiality, security, and appropriate use of such information, pursuant to requirements similar to the requirements of section 6103(p)(4) of the Internal Revenue Code of 1986, and (C) agrees to satisfy the requirements of such section 6103(p)(4) as if such section applied to such person. (3) Fees (A) In general The Secretary of Commerce shall establish under section 9701 of title 31 a program for the charge of fees sufficient to cover (but not to exceed) all costs associated with evaluating applications for certification and auditing, inspecting, and monitoring certified persons under the program. Any fees so collected shall be deposited and credited as offsetting collections to the accounts from which such costs are paid. (B) Report The Secretary of Commerce shall report on an annual basis to the Committee on Finance of the Senate and the Committee on Ways and Means of the House of Representatives on the total fees collected during the preceding year and the cost of administering the certification program under this subsection for such year. (c) Imposition of penalty (1) In general Any person who is certified under the program established under subsection (b), who receives information described in subsection (a), and who during the period of time described in subsection (a)— (A) discloses such information to any person other than a person who meets the requirements of subparagraphs (A), (B), and (C) of subsection (b)(2), (B) discloses such information to any person who uses the information for any purpose not listed under subsection (b)(2)(A) or who further discloses the information to a person who does not meet such requirements, or (C) uses any such information for any purpose not listed under subsection (b)(2)(A), and any person to whom such information is disclosed who further discloses or uses such information as described in the preceding subparagraphs, shall pay a penalty of $1,000 for each such disclosure or use. (2) Limitation on penalty (A) In general The total amount of the penalty imposed under this subsection on any person for any calendar year shall not exceed $250,000. (B) Exception for willful violations Subparagraph (A) shall not apply in the case of violations under paragraph (1) that the Secretary of Commerce determines to be willful or intentional violations. (d) Death Master File For purposes of this section, the term “Death Master File” means information on the name, social security account number, date of birth, and date of death of deceased individuals maintained by the Commissioner of Social Security, other than information that was provided to such Commissioner under section 405(r) of this title . (e) Exemption from Freedom of Information Act requirement with respect to certain records of deceased individuals (1) In general No Federal agency shall be compelled to disclose the information described in subsection (a) to any person who is not certified under the program established under subsection (b). (2) Treatment of information For purposes of section 552 of title 5 , this section shall be considered a statute described in subsection (b)(3) of such section 552. (f) Effective date (1) In general Except as provided in paragraph (2), this section shall take effect on the date that is 90 days after December 26, 2013 . (2) FOIA exemption Subsection (e) shall take effect on December 26, 2013 .