CONSUMER REPORT SECURITY FREEZE S.B. 340: COMMITTEE SUMMARY






Senate Bill 340 (as introduced 3-6-07)
Sponsor: Senator Cameron S. Brown
Committee: Banking and Financial Institutions


Date Completed: 3-14-07

CONTENT
The bill would create the "Consumer Credit Protection Act" to do the following:

-- Allow a consumer to place a security freeze on his or her consumer report by making a written request to a consumer reporting agency.
-- Prohibit a consumer reporting agency from releasing information from a consumer report to a third party if a freeze were in place, without the consumer's authorization.
-- Allow a consumer reporting agency to remove or temporarily lift a security freeze only under specific circumstances.
-- Permit a consumer to allow access to his or her consumer report for a specific period of time while a freeze was in place.
-- Allow a consumer reporting agency to charge a fee for placing, temporarily lifting, or removing a freeze, subject to exceptions for victims of identity theft and individuals at least 65 years old.
-- Establish deadlines for a consumer reporting agency to comply with the proposed requirements.
-- Allow a consumer to bring an action against a person who failed to comply with the proposed Act, and permit a consumer reporting agency to bring an action against a person for certain violations.
-- Specify entities that would not be required to place a security freeze on a consumer report.
-- Provide that the Act would not apply to the use of a consumer report by certain entities.

The proposed Act would take effect on January 1, 2008.


Definitions

"Security freeze" would mean a notice placed on a consumer report at the request of the consumer that prohibits a consumer reporting agency from releasing the consumer's consumer report or credit score related to the extension of credit without the express authorization of the consumer except in compliance with the proposed Act.

"Consumer" would mean an individual who resides in this State. "Consumer report" and "consumer reporting agency" and would mean those terms as defined in the Federal Fair Credit Reporting Act (15 USC 1681a(d) and 15 USC 1681a(f), respectively). "Consumer report" would not include a check acceptance service that provides check approval and guarantee services to merchants.

(The Fair Credit Reporting Act defines "consumer report" as any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living that is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for:

-- -- Credit or insurance to be used primarily for personal, family, or household purposes.
-- Employment purposes.
-- Any other purpose authorized under Section 604 of the Act (described below under "Federal Act").


The Act defines "consumer reporting agency" as any person that, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and that uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.)


Placement of Security Freeze

A consumer could place a security freeze on his or her consumer report by making a written request to a consumer reporting agency. The request would have to be sent by certified mail to an address designated by that agency to receive such requests. It would have to include clear and proper identification of the consumer (information generally deemed sufficient to identify an individual). The consumer reporting agency would have to place a security freeze on the consumer report within 10 business days after receiving the written request.


If a security freeze were in place, a consumer reporting agency could not release information from a consumer report to a third party without prior express authorization from the consumer. This provision would not prevent a consumer reporting agency from advising a third party that a security freeze was in effect with respect to the consumer report.


Within 10 business days after a consumer reporting agency received a request for a security freeze, the agency would have to give the consumer a unique personal identification number or password that the consumer could use to authorize the release of his or her consumer report for a specific period of time. Simultaneously, the agency would have to give the consumer in writing the process for placing, removing, and temporarily lifting a security freeze and the process for allowing access to information from the consumer report while the freeze was in effect.

A consumer could request in writing a replacement personal ID number or password. The request would have to comply with the requirements for requesting a security freeze. Within 10 business days after a consumer reporting agency received a request for a replacement, the agency would have to give the consumer with a new, unique personal ID number or password.


If a security freeze were in effect, a consumer reporting agency could not change a consumer's name, address, date of birth, or Social Security number in a consumer report without sending a written confirmation of the change to the consumer within 30 days after the change was posted on the consumer report. If the change were an address change, the agency would have to send a confirmation to both the new address and the former address. Written confirmation would not be required for a technical modification of information in a consumer report.


Removal or Lifting of Freeze

A consumer reporting agency could remove or temporarily lift a security freeze placed on a consumer report only if the consumer made a request and paid any applicable fees to the agency at a point of contact it designated, or if the report were frozen due to a material misrepresentation of a fact by the consumer. If an agency intended to remove a freeze due to material misrepresentation, it would have to notify the consumer in writing before doing so.


If a consumer wished to allow access to his or her consumer report for a specific period of time while a security freeze was in place, he or she would have to contact the consumer reporting agency, request that it temporarily lift the freeze, and provide all of the following to the agency:

-- Clear and proper identification.
-- The unique personal ID number or password provided by the agency.
-- The specific time period that the consumer was requesting the agency to allow users access to the report.


An agency that received a request from a consumer to lift a security freeze temporarily would have to comply with the request within three days after receiving it. An agency could develop procedures involving use of the telephone, facsimile, the internet, or other electronic media to receive and process a request from a consumer to lift a freeze temporarily in an expedited manner.

A security freeze would have to remain in place until the consumer requested that the agency remove it. The agency would have to remove the security freeze within three business days after receiving the request, clear and proper identification, and the unique personal ID number or password provided by the agency.


Fees

A consumer reporting agency could impose a reasonable fee, not to exceed $10 per request, on a consumer for placing, temporarily lifting, or removing a security freeze on a consumer report. An agency could not charge either of the following a fee for placing or removing a security freeze:

-- A consumer who was a victim of identity theft and who provided the agency upon request with a police report that confirmed that he or she was an identity theft victim.
-- A consumer who was 65 years old or older.


Court Actions

A consumer could bring an action against a person who negligently failed to comply with any requirement imposed by the proposed Act with respect to the consumer, to recover actual damages sustained by the consumer as a result of the failure, plus reasonable attorney fees and court costs. If a person willfully failed the comply with any requirement of the Act, the consumer could bring an action to recover actual damages or damages of at least $100 but not more than $1,000, whichever was greater, plus reasonable attorney fees and court costs if the consumer were successful in obtaining any award in the action.

A consumer reporting agency could bring an action against a person who obtained a consumer report or requested a security freeze, the temporary lifting of a freeze, or the removal of a freeze from the agency under false pretenses or in an attempt to violate Federal or State law, to recover actual damages sustained by the agency or $1,000, whichever was greater.


If the court in an action by a consumer or a consumer reporting agency found that an unsuccessful pleading, motion, or other paper filed in connection with the action was filed in bad faith or for purposes of harassment, the court would have to award attorney fees to the prevailing party in an amount the court found reasonable in relation to the work performed in responding to the pleading, motion, or paper.


Entities Exempt from Placing Freeze


The following entities would not be required to place a security freeze on a consumer report:

-- A consumer reporting agency that acted only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or multiple consumer reporting agencies, and that did not maintain a permanent database of credit information from which new consumer reports were produced, although a consumer reporting agency acting as a reseller would have to honor any freeze placed on a consumer credit report by another consumer reporting agency.
-- A check services or fraud prevention services company that issued reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payment.
-- A deposit account information service company that issued reports regarding account closures due to fraud, substantial overdrafts, automatic teller machine abuse, or similar negative information regarding a consumer to inquiring financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring financial institution.






Exceptions to the Act


The proposed Act would not apply to the use of a consumer report by any of the following:

-- A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to which access had been granted for purposes of facilitating an extension of credit or other permissible use.
-- A State or local agency, law enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena.
-- A child support agency acting pursuant to Part D of Title IV of the Social Security Act (which pertains to child support and establishment of paternity).
-- The State or its agents or assigns acting to investigate fraud, to investigate or collect delinquent taxes or unpaid court orders, or to fulfill any of its other statutory responsibilities if they were consistent with a permissible purpose under Section 604 of the Fair Credit Reporting Act.
-- A person setting or adjusting a rate, adjusting a claim, or underwriting for insurance purposes.
-- A person using credit information for the purpose of prescreening, as provided for by the Fair Credit Reporting Act.
-- A person administering a consumer report monitoring subscription service to which the consumer had subscribed.
-- A person providing a consumer with a copy of his or her consumer report in response to the consumer's request.


If a consumer report were used for the purpose of reviewing an account or collecting the financial obligation owing for an account, contract, or negotiable instrument, the proposed Act would not apply to the use of a consumer report by a person with which a consumer presently had or had prior to assignment an account or contract or to which the consumer had issued a negotiable instrument; a subsidiary, affiliate, or agent of that person; an assignee of a financial obligation owed by the consumer to that person; or a prospective assignee of a financial obligation owed by the consumer to that person in conjunction with the proposed purchase of the obligation.


Federal Act


Section 604 of the Fair Credit Reporting Act (42 USC 1681b) prescribes permissible purposes of consumer reports. In general, a consumer reporting agency may furnish a consumer report under the following circumstances:

-- In response to a court order or a Federal grand jury subpoena.
-- According to the written instructions of the consumer.
-- In response to a request by the head of a state or local child support enforcement agency, if certain conditions are met.
-- To an agency administering a state plan for child or spousal support, to set an initial or modified child support award.

A consumer reporting agency also may furnish a consumer report to a person whom the agency has reason to believe intends to use the information as follows:

-- In connection with a credit transaction involving the consumer and the extension of credit to, or review or collection of an account of, the consumer.
-- For employment purposes (subject to specific conditions).
-- In connection with the underwriting of insurance involving the consumer.
-- In connection with a determination of the consumer's eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider the applicant's financial responsibility or status.
-- As a potential investor or servicer, or current insurer, in connection with a valuation of, or an assessment of the credit or prepayment risks associated with, an existing credit obligation.


In addition, a consumer reporting agency may furnish a consumer report to a person whom the agency has reason to believe otherwise has a legitimate business need for the information in connection with a business transaction initiated by the consumer, or to review an account to determine whether the consumer continues to meet the terms of the account.


Legislative Analyst: Suzanne Lowe




FISCAL IMPACT
The bill would have a minimal fiscal impact on State and local government. To the extent that there would be an increase in civil actions as a result of this bill, the courts could incur increased costs, but these would be absorbed by the existing court system.


Fiscal Analyst: Stephanie Yu

Analysis was prepared by nonpartisan Senate staff for use by the Senate in its deliberations and does not constitute an official statement of legislative intent. sb340/0708