House Bill 4103 as passed by the House
Sponsor: Rep. Kathy Angerer
Committee: Banking and Financial Services
First Analysis (5-8-07)
BRIEF SUMMARY: Among many things, the bill would do the following:
· Create a mechanism by which a victim of identity theft could request a consumer reporting agency to place a security freeze on his or her own consumer report.
· Extend the right to request a security freeze to all consumers as of March 1, 2009.
· Specify conditions under which a security freeze could be removed or temporarily lifted.
· Prohibit a consumer reporting agency from releasing information from a consumer report to a third party without the consumer's authorization.
· Prohibit a consumer reporting agency from changing certain personal information while a security freeze was in effect unless it sent written confirmation of the change to the consumer.
· Allow the imposition of a fee for placing a security freeze on a consumer report and a separate fee for replacing a personal identification number or password.
· Require free security freezes for seniors and victims of identity theft.
· Allow a consumer to recover actual damages and reasonable attorney fees, including punitive damages in certain instances, from a person who willfully failed to comply with the bill's requirements.
· Allow a consumer reporting agency to sue a person who obtained a consumer report or requested a security freeze, the temporary lift of a freeze, or the removal of a freeze under false pretenses or in an attempt to violate state or federal laws.
· Exempt certain entities from the requirement to place a security freeze on a consumer report.
· Specify that the bill would not apply to certain uses of a consumer report.
FISCAL IMPACT: The bill would have no fiscal impact on the State of Michigan or its local units of government.
THE APPARENT PROBLEM:
Identity theft occurs when someone uses another individual's personal identifying information (birth date, social security number, name, etc.), without his or her permission, to fraudulently engage in activities such as opening up new lines of credit, purchasing big ticket items like a car or a house, obtaining a cellular phone and service, or accessing the individual's financial accounts. A person may also engage in identity theft to avoid criminal prosecution or even to further terrorist activities. Legislation enacted in 2004 by the Michigan Legislature expanded the protections available to victims of identity theft, prohibited certain uses of Social Security numbers, restricted the availability of certain types of personal information, and increased penalties for committing identity theft. (For more information, see the analyses on Public Acts 452-462 of 2004 prepared by the Legislative Analysis Section of the House Fiscal Agency dated 4-6-05 and by the Senate Fiscal Agency dated 4-18-05.)
Yet, the incidents of identity theft continue to increase. Identity theft is the number one concern among consumers contacting the Federal Trade Commission, and, according to U.S. Department of Justice statistics, is about to surpass drug trafficking as the number one crime in the nation – affecting nearly 10 million consumers a year. Some feel that a piece of the solution may be to allow consumers greater control over their personal consumer credit reports; specifically, allow consumers the option to restrict the release of or access to information contained in their credit records (known as "consumer reports") by placing a security freeze on their reports.
A security freeze differs from a fraud alert or security alert, which tells lenders that the consumer may be a victim of identity theft and therefore additional precautions should be taken before granting credit in that person's name. In contrast, a security freeze requires the agency to obtain the consumer's authorization before releasing a consumer report or information contained in a report. A security freeze can be temporarily lifted upon a consumer's authorization. Over the past few years, at least 30 states and the District of Columbia have enacted laws allowing residents to request a security freeze be placed on consumer reports maintained by the three major consumer credit reporting agencies (Experian, Equifax, and TransUnion). Though the various state laws are similar, there are differences as to applicability (i.e., all consumers or only ID theft victims), fees (some prohibit charges to seniors or victims of ID theft), and available remedies to consumers if an agency violates a security freeze law.
It has been suggested that Michigan should join with the other states that allow consumers to place a security freeze on their consumer reports.
THE CONTENT OF THE BILL:
The bill would create the Credit Security Act of 2007 to require certain consumer reporting agencies to place security freezes on consumer credit information, to authorize certain fees, and to allow consumers and consumer reporting agencies to sue to recover damages for certain violations of the act. The bill would take effect 60 days after enactment. Beginning with the bill's effective date, it would apply only to victims of identity theft; it would apply to all other consumers as of March 1, 2009. The bill would apply to a consumer reporting agency as defined in the federal Fair Credit Reporting Act [15 USC 1681a(f)]. Significant components of the bill include the following:
Security freeze.
A "security freeze" would mean a notice placed on a consumer report, as defined in the federal Fair Credit Reporting Act, at the request of a consumer that would prohibit a consumer reporting agency from releasing a consumer's consumer report or credit score for an extension of credit without the consumer's express authorization. A consumer reporting agency could advise a third party that a security freeze was in effect.
Beginning on the bill's effective date, a victim of identity theft could place a security freeze on his or her consumer report by making a written request to a consumer reporting agency, including clear and proper identification of himself or herself, and sending the request and payment of any applicable fee by certified mail or overnight delivery. The security freeze would have to be placed on the consumer report by the consumer reporting agency within five business days of receiving the request. Beginning March 1, 2009, this provision would apply to all other consumers. Also as of that date, requests, and presumably payments of applicable fees, could be submitted electronically; that is, by e-mail, phone, or fax, or to an Internet website.
When a security freeze was in effect, a consumer reporting agency could not change certain personal identifying information in a consumer report (specifically, a consumer's name, address, date of birth, or social security number) without sending a written confirmation of the change within 30 days after the posting of the change. If the address was changed, the confirmation would have to be sent to both the old and the new address.
A security freeze could only be removed or temporarily lifted by a consumer reporting agency if: 1) the consumer requested it to be lifted, or 2) the report had been frozen due to a material misrepresentation of fact by the consumer. (If the agency intended to remove the freeze, the consumer would have to be notified in writing before the freeze was removed).
[The Fair Credit Reporting Act defines a "consumer report" to mean, in general, "any written, oral, or other communication by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for credit or insurance to be used primarily for personal, family, or household purposes; employment purposes; or any other purpose authorized under Section 1681b" of the act. The act excludes several types of reports or communications from the definition of "consumer report," for example, the term does not include a report that contains information solely as to transactions between the consumer and the person making the report.]
Responsibilities of a consumer reporting agency.
A consumer reporting agency would have to place a security freeze on a consumer's consumer report within five business days after receiving a consumer's written request. Within 10 business days of receiving the request for a security freeze, an agency would also have to provide all of the following to the consumer:
· Written confirmation that the security freeze was in place.
· A unique personal identification number or password to be used by the consumer to provide authorization for access to his or her consumer report for a specific period of time. A request for a replacement PIN or password could be made in writing; a new PIN or password would have to be provided by an agency within seven business days of receiving the request and payment of any applicable fee.
· A written description of the process for placing, removing, and temporarily lifting a security freeze as well as the process for allowing access to information from the consumer report during the period a security freeze is in effect. Beginning February 1, 2009, this information must also include a description of the process and contact information to be used for making electronic requests for a security freeze or a temporary lift of the freeze.
In addition, a consumer reporting agency would have to do the following:
· Notify a person requesting a consumer report if a security freeze was in effect for that report.
· Remove a security freeze within three business days after receiving a request from the consumer that included clear and proper identification and the consumer's PIN or password.
· Temporarily lift a security freeze within three business days of receiving a written request and, beginning March 1, 2009, within 15 minutes of receiving – between 6 a.m. and 9:30 p.m. (EST) – an electronic request.
[The Fair Credit Reporting Act defines a "consumer reporting agency" as "any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports."]
Temporary lifting of a security freeze.
To allow access to a consumer report for a specific period of time while a security freeze was in effect, a consumer would send a written request for a temporary lift to a consumer reporting agency by certified mail or overnight delivery. A consumer reporting agency would have to comply within three business days of receiving the request. The request would have to contain clear and proper identification of the consumer; the consumer's PIN or password; and the specific time period for the lift to be in place. (Though not specified in the bill, it is presumed that the security freeze would automatically resume at the expiration of the time specified by the consumer in the request for a temporary lift.)
Beginning March 1, 2009, a request could be made electronically (phone, fax, e-mail, secure Internet website, etc.). The consumer reporting agency would have to lift the security freeze within 15 minutes for requests made after 6 a.m. and before 9:30 p.m. (EST). However, the bill would provide several exceptions to the 15 minute requirement; for example, actions prevented by natural disasters, labor strikes, riots, electrical failures, and regularly scheduled maintenance or upgrades to an agency's computer systems (see the bill for a complete list).
The bill specifies that a request for a temporary lift of the security freeze is to be accompanied by payment of any applicable fee described in Section 13; however, that section currently prohibits an agency from charging a fee for a temporary lift.
Fees.
A fee up to $20 could be charged by a consumer reporting agency to a consumer who was not a victim of identity theft to place a security freeze on the person's consumer report. No fee could be charged to a person 60 years old or older or to a victim of identity theft. If requested by a consumer reporting agency, a victim of identity theft would have to send the agency a copy of the police report confirming he or she had been a victim of identity theft.
A reasonable fee not to exceed $10 could be imposed for replacing a personal identification number (PIN) or password. (The bill does not specifically exclude seniors or victims of identity theft from this fee; therefore, it is presumed that this charge would apply to any consumer.)
A fee could not be charged to any consumer for temporarily lifting or removing a security freeze.
Consumer-initiated and reporting agency-initiated civil actions.
A consumer could bring an action against a person that willfully failed to comply with the bill's requirements to recover actual damages the consumer sustained as a result of the person's failure to comply or damages of not less than $100 or greater than $1,000, whichever was greater, in addition to reasonable attorney fees and court costs if he or she (the consumer) were the prevailing party. A court could also award to the consumer punitive damages it considered proper.
A consumer reporting agency could bring an action against a person that obtained a consumer report or requested a security freeze, the temporary lift of a freeze, or the removal of a freeze from the agency under false pretenses or in an attempt to violate state or federal law. Actual damages sustained by the agency or $1,000, whichever was greater, could be recovered.
If, in a civil action initiated by either a consumer or a consumer reporting agency, the court found that an unsuccessful pleading, motion, or other paper filed in connection with the action had been filed in bad faith or for purposes of harassment, the court would be require to award attorney fees to the prevailing party in the amount the court found reasonable in relation to the work expended in responding to the pleading, motion, or paper.
Exempted uses of a consumer report.
The act would not apply to the use of a consumer report by certain entities; for example, a child support agency acting under provisions of Title IV of the Social Security Act; a state or local agency, law enforcement agency, trial court, or private collection agency acting under a court order, warrant, or subpoena; a person lawfully using credit information for the purpose of credit prescreening; a person setting or adjusting a rate, adjusting a claim, or underwriting for insurance purposes; or a person administering a consumer with a copy of his or her consumer report in response to the consumer's request.
Entities exempted from placing a security freeze on a consumer report.
The following would not be required to place a security freeze on a consumer report:
· A consumer reporting agency acting only as a reseller of credit information, although the agency would have to honor any security freeze placed on a consumer report by another consumer reporting agency.
· A check services or fraud prevention services company issuing reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments.
· A deposit account information service company that issued reports regarding account closures due to fraud, ATM abuse, or substantial overdrafts to inquiring financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring financial institution.
· A consumer reporting agency, if its database or file consisted only of information concerning and used for criminal record information, fraud prevention or detection, personal loss history information, or employment, tenant, or background screening.
BACKGROUND INFORMATION:
Senate Bill 340, which is similar to House Bill 4103, would create the Consumer Credit Security Act. Senate Bill 340 is tie-barred to Senate Bill 75, which would create the Consumer Credit Protection Remedies Act. Senate Bill 75 would authorize a consumer, a consumer reporting agency, and the attorney general to bring an action for violations of the Consumer Credit Security Act. Both bills have been reported from the Senate Banking and Financial Institutions Committee and are pending action on the Senate floor.
ARGUMENTS:
For:
Granting consumers more control over the information contained in their consumer reports may be an important tool in preventing or reducing future incidents of identity theft. By allowing state residents to place a security freeze on consumer reports maintained by national consumer reporting agencies, consumers would be able to restrict access to information contained in their personal files, thus reducing the chance their personal information could be fraudulently used. According to the Consumers Union, at least 30 other states and the District of Columbia have already passed similar laws. Michigan should do the same.
For:
According to information presented on the web by Identity Theft Security, as of 2004, Michigan ranked 16th in the nation for identity theft with 72.3 victims per 100,000 population. Even with tougher state laws adopted in that year, identity theft continues to be a problem in the state. Under federal law, residents can request that a fraud alert be placed on their records. A fraud alert requires lenders to take extra precautions before extending or increasing credit, and allows consumers the ability to review their reports and verify whether or not fraudulent activity appears in their records. However, a fraud alert only lasts up to 90 days at a time, and so must be renewed every few months; a longer alert, up to seven years, can be placed on the consumer report of a victim of identity theft if a police report is included in the request. Some consumers complain that even with a fraud or security alert, businesses are still able to access their consumer reports and, since not all businesses follow the rules and regulations they are supposed to (e.g., increased steps to verify the identity of the person requesting the credit), the alerts do little to stem the incidents of ID theft.
By comparison, a security freeze would prohibit a nationwide consumer reporting agency from releasing any information from, or granting access to, the consumer's file or credit score without the express authorization of that consumer. The bill would also make it more difficult for an ID thief to gain access to a consumer report in an attempt to use information from the report to commit identity theft.
The bill would not stop all incidents of ID theft, but would make it much harder for criminals to be successful. Rather than discovering weeks or months after the fact that a stranger has obtained credit in his or her name, a security freeze allows a consumer to proactively protect his or her sensitive information from being accessed except by those businesses with which he or she wishes to do business.
For:
The bill would create a straightforward process by which a consumer could request a security freeze that should not be overly burdensome to consumers or to businesses. The bill allows a reasonable fee to be charged to initially place a security freeze or to replace a lost PIN; though a consumer would have to pay the fee to each of the major consumer reporting agencies, it is still reasonable considering no charge could be imposed for temporarily lifting the freeze. In addition, senior citizens and persons who could verify, with a police report, that they were victims of ID theft would not have to pay the fee to request a security freeze. The time frames afforded to the consumer reporting agencies of five business days to place the security freeze and three business days for a temporary lift are consistent with legislation enacted by some other states with security freeze laws. The requirement for the agencies to contact a consumer within 30 days of posting a change of address or changes to other sensitive information in the consumer's consumer report should also help reduce ID theft by alerting the consumer in a timely manner that someone is attempting to use his or her identity. The consumer can then take steps to protect his or her credit from further fraudulent activity.
The bill would also allow a consumer to recover for any losses he or she suffered as a result of a consumer reporting agency, or any other business or individual, that willfully failed to comply with requirements of the bill as they relate to the consumer. A consumer could also be awarded punitive damages to the extent a judge deemed proper. As a standard rule or practice, Michigan does not award punitive damages, although there are a few statutes that do allow for such damages in very narrow circumstances; the bill, therefore, is consistent in that it does not have broad application.
A consumer reporting agency could also bring a civil action to recover damages from individuals and businesses that either fraudulently obtained a consumer report or requested the placement or temporary lifting of a security freeze, or who obtained a report in an attempt to violate state or federal law.
Furthermore, the bill clearly outlines who would be required to place security freezes and who would not, and clearly identifies the legitimate uses of a consumer report that could still be conducted even if a security freeze were in place.
Response:
A security freeze can still be a cumbersome process. On paper, it sounds great until a cell phone is lost and the consumer finds he or she must write a letter, wait for it to be delivered, and then wait three business days before being able to have the phone replaced. The same would be true before lines of credit could be opened for big ticket items such as cars, appliances, and electronics (think big-screen TVs), and even mortgages. If the consumer lost or misplaced his or her PIN, the process would take even longer. As a result, consumers could miss out on time-sensitive offers of low interest loans or credit cards, special deals on vehicles, or a low-but-quickly-changing mortgage rate. Businesses selling high ticket items, such as car dealerships, may also be disadvantaged if during the waiting period for the temporary lift to take effect, the consumer decided to buy elsewhere. By March of 2009, the reporting agencies would have to implement a temporary lift within 15 minutes of receiving an electronic request; until then, consumers will need to plan days or weeks in advance before taking that big shopping outing, and try to correctly calculate the time needed for the business to access the needed credit information so to know when to request the freeze reinstated. After all, anytime a temporary lift is in place, a window would be opened in which the consumer's consumer report could once again be vulnerable to identity thieves.
Against:
According to AARP Michigan, the bill as passed by the House would unnecessarily delay the ability of most consumers in the state to benefit from its provisions. For instance, until March of 2009, only victims of identity theft could request a security freeze be placed on their consumer reports. Yet, provisions contained in legislation enacted by some other states that would allow any consumer to request a security freeze are set to take effect by 2008. Since the nationwide consumer reporting agencies must have policies and procedures in place to deal with those laws by then, there is no reason to delay the application of the bill to all consumers.
Against:
Under the bill, a person who was setting or adjusting a rate, adjusting a claim, or underwriting for insurance purposes could still access a consumer report even if a security freeze is in place. Some feel this exemption should be eliminated. Rules promulgated by the commissioner of the Office of Financial and Insurance Services several years ago banned the use of insurance credit scoring in the rating and underwriting of automobile, home, and other personal lines of insurance. The rule has not yet taken effect because the matter is being litigated and therefore cannot be implemented at this time. Until the court settles the matter, the bill should not encourage a practice banned by the commissioner.
Response:
Insurance companies may, under current laws and regulations, access consumer reports. The bill merely keeps the status quo while the OFIS rule is being litigated. In addition, research supports that financial responsibility is a predictor of future insurance loss. To completely deny access to consumer reports would hamper insurers from setting rates that would keep the companies viable. A better approach than banning access to consumer reports by insurers is to regulate how information gleaned by those reports could be used in rate setting. For example, a consumer should not face higher rates if his or her report shows multiple lender inquiries because the consumer applied to several mortgage companies to get the best interest rate for a home purchase. Nor should a person who had been financially responsible, but has had recent problems due to a medical emergency, be disadvantaged. House Bill 4070, currently referred to the House Insurance Committee, would address many of these concerns.
POSITIONS:
The Michigan Credit Union League supports the bill. (5-4-07)
The Michigan Bankers Association supports the bill. (5-3-07)
Mastercard Worldwide supports the bill. (5-4-07)
The Pittsfield Township Department of Public Safety supports the bill. (5-7-07)
The Prosecuting Attorneys Association of Michigan supports the concept of the bill. (3-20-07)
The Office of Financial and Insurance Services supports the concept of security freezes, but does not support the inclusion of the exemption for insurance companies to use consumer reports to assess rates until while the matter is being litigated. (5-7-07)
AARP Michigan supports the concepts embodied in the bill. (5-2-07)
The Insurance Institute of Michigan supported the H-1 version of the bill and is currently reviewing the House-passed version before adopting a final position. (5-7-07)
The Michigan Association of Insurance Agents is neutral on the bill. (5-4-07)
The Auto Dealers of Michigan, LLC is neutral on the bill. (5-4-07)
Legislative Analyst: Susan Stutzky
Fiscal Analyst: Richard Child
■ This analysis was prepared by nonpartisan House staff for use by House members in their deliberations, and does not constitute an official statement of legislative intent.