October 20, 2005, Introduced by Senator SWITALSKI and referred to the Committee on Banking and Financial Institutions.
A bill to require certain credit reporting agencies to place
security alerts and security freezes on certain consumer credit
information; to authorize and limit fees; and to provide remedies.
THE PEOPLE OF THE STATE OF MICHIGAN ENACT:
Sec. 1. This act shall be known and may be cited as the
"credit freeze act of 2005."
Sec. 2. As used in this act:
(a) "Clear and proper identification" means information
generally deemed sufficient to identify a person.
(b) "Consumer file" means a consumer's credit report and other
information shown in the records of a credit reporting agency.
(c) "Credit report" means any written, oral, or other
communication of any credit information by a credit reporting
agency that operates or maintains a database of consumer credit
information bearing on a consumer's creditworthiness, credit
standing, or credit capacity.
(d) "Credit reporting agency" means any person who, for
monetary fees or dues or on a cooperative nonprofit basis,
regularly engages in whole or in part in the practice of assembling
or evaluating consumer credit information or other information on
consumers for the purpose of furnishing credit reports to third
parties and who uses any means or facility of interstate commerce
for the purpose of preparing or furnishing credit reports. The term
does not include a check acceptance service that provides check
approval and guarantee services to merchants.
(e) "Security freeze" means a notice placed on a consumer file
at the request of the consumer and that prohibits a credit
reporting agency from releasing the consumer's credit report
without the express authorization of the consumer except in
compliance with this act.
Sec. 3. The following persons are not required to place a
security alert or a security freeze on a consumer file under this
act:
(a) A check services or fraud prevention services company that
issues reports on incidents of fraud or authorizations for the
purpose of approving or processing negotiable instruments,
electronic funds transfers, or similar methods of payments.
(b) A deposit account information service company that issues
reports regarding account closures due to fraud, substantial
overdrafts, automatic teller machine abuse, or similar negative
information regarding a consumer to inquiring financial
institutions for use only in reviewing a consumer request for a
deposit account at the inquiring financial institution.
(c) A reseller of credit information that assembles or merges
information contained in the database of another consumer reporting
agency or multiple consumer reporting agencies and does not
maintain a permanent database of credit information from which new
consumer reports are produced.
(d) Any database or file that consists solely of any
information adverse to the interests of the consumer, including,
but not limited to, criminal record information, that is used for
fraud prevention or detection, tenant screening, employment
screening, or any purpose permitted by section 604 of the fair
credit reporting act, 15 USC 1681b.
(e) A person that provides fraud prevention services that
include reports on incidents of fraud or reports used primarily in
the detection or prevention of fraud, but only with respect to
those services.
(f) A state or nationally chartered bank or a state or
federally chartered savings and loan association, savings bank, or
credit union.
Sec. 4. (1) A consumer may place a security freeze on his or
her consumer file by written request, sent by certified mail, that
includes clear and proper identification of the consumer, to a
credit reporting agency. A credit reporting agency shall place a
security freeze on a consumer's consumer file within 10 business
days after receiving a written request for the security freeze from
the consumer under this subsection.
(2) If a security freeze is in place, a credit reporting
agency shall not release information from a consumer file to a
third party without prior express authorization from the consumer.
This subsection does not prevent a credit reporting agency from
advising a third party that a security freeze is in effect with
respect to the consumer's consumer file.
Sec. 5. (1) Within 10 business days after a credit reporting
agency receives a request for a security freeze under section 4,
the credit reporting agency shall provide the consumer with a
unique personal identification number or password that the consumer
may use to provide authorization for access to his or her consumer
file for a specific period of time. In addition, the credit
reporting agency shall simultaneously provide to the consumer in
writing the process for placing, removing, and temporarily lifting
a security freeze and the process for allowing access to
information from the consumer file while the security freeze is in
effect.
(2) A consumer may request in writing a replacement personal
identification number or password for purposes of subsection (1).
The request must comply with the requirements for requesting a
security freeze under section 4. Within 7 business days after a
credit reporting agency receives a request for a replacement
personal identification number or password, the credit reporting
agency shall provide the consumer with a new, unique personal
identification number or password to be used by the consumer
instead of the number or password that was provided under
subsection (1).
Sec. 6. (1) A credit reporting agency shall notify a person
who requests a credit report if a security freeze is in effect for
the consumer file involved in that credit report.
(2) If a third party requests access to a consumer's credit
report while a security freeze is in effect, the request is in
connection with an application for credit or any other use, and the
consumer does not allow access to his or her credit report while
the security freeze is in effect, the third party shall treat the
application as incomplete.
(3) If a security freeze is in effect, a credit reporting
agency shall not change any of the following official information
in a consumer's credit report without sending a written
confirmation of the change to the consumer within 30 days after the
posting of the change to the consumer's file: name, date of birth,
social security number, or address. If the change is an address
change, the credit reporting agency shall send written confirmation
to both the new address and the former address. Written
confirmation is not required for a technical modification of a
consumer's official information, including name and street
abbreviations, complete spellings, or transposition of numbers or
letters.
Sec. 7. (1) A credit reporting agency shall remove or
temporarily lift a security freeze placed on a consumer file only
if 1 of the following applies:
(a) The consumer makes a request under this section.
(b) The consumer file is frozen due to a material
misrepresentation of fact by the consumer. If a credit reporting
agency intends to remove a security freeze on a consumer file under
this subdivision, the credit reporting agency shall notify the
consumer in writing before removing the security freeze.
(2) If a consumer wishes to allow access to his or her
consumer file for a specific period of time while a security freeze
is in place, he or she shall contact the credit reporting agency
and request that the credit reporting agency temporarily lift the
security freeze and provide all of the following to the credit
reporting agency:
(a) Clear and proper identification.
(b) The unique personal identification number or password
provided by the credit reporting agency under section 5.
(c) The specific time period that the consumer requests that
the credit reporting agency allow users access to his or her
consumer file.
(3) A credit reporting agency that receives a request from a
consumer to temporarily lift a security freeze on his or her
consumer file under subsection (2) shall comply with the request
within 3 business days after receiving the request. A credit
reporting agency may develop procedures involving the use of
telephone, facsimile, the internet, or other electronic media to
receive and process a request from a consumer to temporarily lift a
security freeze on a consumer file in an expedited manner.
(4) A security freeze shall remain in place until the consumer
requests that the credit reporting agency remove the security
freeze. A credit reporting agency shall remove a security freeze
within 3 business days after receiving a request for removal from
the consumer and all of the following information from the
consumer:
(a) Clear and proper identification.
(b) The unique personal identification number or password
provided by the credit reporting agency under section 5.
Sec. 8. A security freeze does not apply to a credit report
provided to any of the following:
(a) To a law enforcement agency, court, or other federal,
state, or local governmental entity or an agent or assignee of that
agency.
(b) If provided for the sole purpose of assisting in the
collection of an existing debt of the consumer who is the subject
of the credit report requested, to a private collection agency.
(c) If provided for the purpose of reviewing an account or
collecting a financial obligation owed for an account, contract, or
negotiable instrument, to a person; to a subsidiary, affiliate, or
agent of that person; or to an assignee of a financial obligation a
consumer owes that person, or a prospective assignee of a financial
obligation a consumer owes that person in conjunction with a
proposed purchase of that financial obligation, if the consumer has
or had before the assignment an account or contract, including a
demand deposit account, with that person or had issued a negotiable
instrument to that person. As used in this subdivision, "reviewing
the account" includes activities related to account maintenance,
monitoring, credit line increases, and account upgrades and
enhancements.
(d) If provided to facilitate an extension of credit, to a
subsidiary, affiliate, agent, assignee, or prospective assignee of
a person given access to a credit report by a consumer under
section 7(2).
(e) To a person for the purpose of prescreening under the fair
credit reporting act, 15 USC 1681 to 1681v.
(f) To a credit reporting agency for the purpose of providing
a consumer with a copy of his or her own credit report at his or
her request.
(g) To a child support enforcement agency.
(h) To a credit reporting agency that acts only as a reseller
of credit information by assembling and merging information
contained in the database of another credit reporting agency or
multiple credit reporting agencies and does not maintain a
permanent database of credit information from which new credit
reports are produced. However, a credit reporting agency acting as
a reseller shall honor any security freeze placed on a credit
report by another credit reporting agency.
(i) To a check services or fraud prevention services company
that issues reports on incidents of fraud or authorizations for the
purpose of approving or processing negotiable instruments,
electronic funds transfers, or similar methods of payment.
(j) To a deposit account information service company that
issues reports regarding account closures due to fraud, substantial
overdrafts, automatic teller machine abuse, or similar negative
information regarding a consumer to inquiring banks or other
financial institutions for use only in reviewing a consumer request
for a deposit account at the inquiring bank or financial
institution.
Sec. 9. (1) Subject to subsection (4), a credit reporting
agency may impose a reasonable fee on a consumer for initially
placing a security freeze on a consumer file. The amount of the fee
may not exceed $10.00.
(2) A credit reporting agency may impose a reasonable fee on a
consumer to temporarily lift a security freeze on a consumer file.
The amount of the fee may not exceed $8.00 per request.
(3) A credit reporting agency may not charge a consumer a fee
for revoking a security freeze.
(4) A credit reporting agency may not charge any of the
following consumers a fee for placing a security freeze on a
consumer file:
(a) A consumer who is a victim of identity theft and who
provides the credit reporting agency upon request with a police
report that confirms that he or she has reported the identity
theft.
(b) A consumer who is 62 years old or older.
Sec. 10. A consumer damaged by an intentional or negligent
violation of this act may bring an action for and is entitled to
recover his or her actual damages, plus reasonable attorney fees
and court costs.