H.R. 8787: Servicemember Payment Data Privacy and Security Act

The Servicemember Payment Data Privacy and Security Act is designed to enhance the security of payment processing within contracts related to the Department of Defense (DoD). Here are the key provisions:

Review of Retailers

Within 180 days after the bill becomes law, the Secretary of Defense is required to assess all retailers that provide payment processing equipment, systems, or services to determine whether they use certain payment processing technologies that are deemed concerning.

Guidance and Prohibition

Following the review, the Secretary will issue guidance within 90 days to prohibit the use of identified payment processing systems or services in contracts with the DoD. This will apply unless the retailer fixes the issues identified in the review in a timely manner. Starting January 1, 2027, the Secretary of Defense cannot enter into contracts with any retailer that uses these specified technologies.

Definition of Covered Technologies

The bill defines "covered equipment, systems, or services" as those related to payment processing that are developed or controlled by entities from certain "countries of concern," which include:

• China
• Russia
• Iran
• North Korea
• Any other country designated by the Secretary of Defense as a significant national security risk.

Components of Payment Processing

Covered technologies can include hardware, software, or any technology that is directly or indirectly linked to these countries. This also captures systems heavily comprised of components from such entities.

Reporting Requirements

The Secretary of Defense must report to Congress within one year of the bill's enactment on how these requirements have been implemented.

Definitions

The bill provides specific definitions for terms such as:

• Electronic fund transfer: Includes any electronic transaction not initiated by a paper check.
• Payment processing equipment, system, or service: Encompasses devices or methods allowing consumers to initiate electronic fund transfers.
• Retailer: Defined according to U.S. legal standards.

Implementation Timeline

The bill sets clear timelines for the review of retailers, the issuance of guidance, and the effective prohibition of certain technologies, aiming to enhance security for servicemembers using payment processing services.

Relevant Companies

• V - Visa Inc.: As a major payment processing company, Visa would be affected if their systems or those of their merchants fall under the categories deemed concerning.
• MA - Mastercard Incorporated: Similar to Visa, Mastercard could face restrictions depending on the compliance of their adopted technologies.
• INTU - Intuit Inc.: If the payment processing systems used in their products are found to fall under the prohibited categories, they may be impeded in government contracts.