But privacy advocates argue that individual commercial data brokers still decide themselves who is eligible to buy personal information.

But the law did not clearly address what data brokers and their subscribers could do with the information already in their systems.

In Washington, legislators have proposed more than 20 bills to monitor data brokers more closely.

Though privacy advocates say there may be hundreds of these online data brokers, no one is sure how many people have used them.

Unintentionally, the firestorm of publicity about the issue has given the data brokers a lift.

Even if Congress adds phone records to the law, it may still be possible that customers using the data brokers won't be liable.

ChoicePoint, another major data broker, said last month that it had inadvertently sold the records of about 145,000 individuals to criminals.

Moreover, by having the raw data first, they can sell this to other data brokers for even more money.

Companies also employ intermediate data brokers to exchange information.

Section 202 Imposes civil penalties on data brokers who violate the requirements of this title.