This is our starting text

HB-4103, As Passed House, March 20, 2007

SUBSTITUTE FOR

HOUSE BILL NO. 4103

A bill to require certain consumer reporting agencies to place

security freezes on certain consumer credit information; to

authorize and limit fees; and to provide remedies.

THE PEOPLE OF THE STATE OF MICHIGAN ENACT:

Sec. 1. This act shall be known and may be cited as the

"credit security act of 2007".

Sec. 3. As used in this act:

(a) "Clear and proper identification" means information a

consumer reporting agency generally considers sufficient to

identify an individual.

(b) "Consumer" means an individual who resides in this state.

House Bill No. 4103 (H-2) as amended March 20, 2007

1681a(d).

(d) "Consumer reporting agency" means that term as defined in

15 USC 1681a(f).

(e) "Security freeze" means a notice placed on a consumer

report at the request of the consumer that prohibits a consumer

reporting agency from releasing the consumer's consumer report or

credit score for an extension of credit without the express

authorization of the consumer except in compliance with this act.

Sec. 5. (1) [Beginning on the effective date of this act, a

consumer who is a victim of identity theft, and beginning March 1, 2009, any other consumer] may place a

security freeze on his or her consumer report by making a written

request to a consumer reporting agency, sent by certified mail or

by overnight delivery using a nationally recognized carrier, to an

address designated by that consumer reporting agency to receive

requests under this subsection. The request shall include clear and

proper identification of the consumer. A consumer reporting agency

shall place a security freeze on a consumer's consumer report

within 5 business days after receiving a written request for the

security freeze from the consumer under this subsection and payment

of any applicable fee described in section 13.

(2) Beginning [March] 1, 2009, in addition to accepting

written requests under subsection (1), a consumer may make and a

consumer reporting agency must accept a request to place a security

freeze on his or her consumer report made by electronic mail,

secure internet website, telephone, facsimile, or other similar

means of telephonic or electronic communication as selected by the

consumer reporting agency, and sent to an electronic mail address,

internet website, telephone number, or facsimile number designated

House Bill No. 4103 (H-2) as amended March 20, 2007

by that consumer reporting agency to receive requests under this

subsection. A consumer reporting agency shall place a security

freeze on a consumer's consumer file within 5 business days after

receiving a request for the security freeze from the consumer under

this subsection and payment of any applicable fee described in

section 13.

(3) If a security freeze is in place, a consumer reporting

agency shall not release information from a consumer report to a

third party without prior express authorization from the consumer.

This subsection does not prevent a consumer reporting agency from

advising a third party that a security freeze is in effect with

respect to the consumer's consumer report.

Sec. 7. (1) Within 10 business days after a consumer reporting

agency receives a request for a security freeze under section 5,

the consumer reporting agency shall provide all of the following to

the consumer:

(a) Written confirmation that the security freeze is in place.

(b) A unique personal identification number or password that

the consumer may use to provide authorization for access to his or

her consumer report for a specific period of time.

removing, and temporarily lifting a security freeze and the process

for allowing access to information from the consumer report while

the security freeze is in effect. Beginning [February 1, 2009], the

written description described in this subdivision shall include a

description of the process and contact information for placing a

security freeze under section 5(2) and temporarily lifting the

security freeze under section 11(4).

(2) A consumer may request in writing a replacement personal

identification number or password for purposes of subsection (1).

The request must comply with the requirements for requesting a

security freeze under section 5. Within 7 business days after a

consumer reporting agency receives a request for a replacement

personal identification number or password and payment of any

applicable fee described in section 13, the consumer reporting

agency shall provide the consumer with a new, unique personal

identification number or password to be used by the consumer

instead of the number or password that was provided under

subsection (1).

Sec. 9. (1) A consumer reporting agency shall notify a person

who requests a consumer report if a security freeze is in effect

for that consumer report.

(2) If a security freeze is in effect, a consumer reporting

agency shall not change a consumer's name, address, date of birth,

or social security number in a consumer report without sending a

written confirmation of the change to the consumer within 30 days

after the posting of the change to the consumer report. If the

change is an address change, the consumer reporting agency shall

send written confirmation to both the new address and the former

address. Written confirmation is not required for a technical

modification of information in a consumer report, including name

and street abbreviations, complete spellings, or transposition of

numbers or letters.

Sec. 11. (1) A consumer reporting agency shall remove or

House Bill No. 4103 (H-2) as amended March 20, 2007

temporarily lift a security freeze placed on a consumer report only

if 1 of the following applies:

(a) The consumer makes a request under this section and pays

any applicable fee under section 13 to the consumer reporting

agency at a point of contact designated by that consumer reporting

agency.

(b) The consumer report is frozen due to a material

misrepresentation of fact by the consumer. If a consumer reporting

agency intends to remove a security freeze on a consumer report

under this subdivision, the consumer reporting agency shall notify

the consumer in writing before removing the security freeze.

(2) If a consumer wishes to allow access to his or her

consumer report for a specific period of time while a security

freeze is in place, he or she shall contact the consumer reporting

agency under subsection (3) or (4), request that the consumer

reporting agency temporarily lift the security freeze, and provide

all of the following to the consumer reporting agency:

(a) Clear and proper identification of the consumer.

(b) The consumer's unique personal identification number or

password provided by the consumer reporting agency under section 7.

the consumer reporting agency allow users access to his or her

consumer report.

(d) Any applicable fee under section 13.

(3) [Beginning on the effective date of this act], a consumer

reporting agency

shall accept a request from a consumer [who was a victim of identity

theft, and beginning March 1, 2009, a consumer reporting agency shall accept a request from any other consumer,] to temporarily lift a

security freeze on his or her consumer report under subsection (2)

House Bill No. 4103 (H-2) as amended March 20, 2007

if the request is made in writing and is sent by certified mail or

by overnight delivery using a nationally recognized carrier to an

address designated by that consumer reporting agency to receive

requests under this subsection. A consumer reporting agency shall

comply with a request to temporarily lift a security freeze under

this subsection within 3 business days after receiving the request

and payment of any applicable fee described in section 13.

(4) Beginning [March] 1, 2009, in addition to accepting

written requests under subsection (3), a consumer may make and a

consumer reporting agency must accept a request that a consumer

reporting agency temporarily lift a security freeze on his or her

consumer report by electronic mail, secure internet website,

telephone, facsimile, or other similar means of telephonic or

electronic communication as selected by the consumer reporting

agency, and sent to an electronic mail address, internet website,

telephone number, or facsimile number designated by that consumer

reporting agency to receive requests under this subsection. [The request

shall include the consumer's unique personal identification number or password or shall include the correct answer to a security question selected by the consumer with the agreement of the consumer reporting agency before the consumer's request under this subsection.] A

consumer reporting agency shall comply with a request to

temporarily lift a security freeze under this subsection within 15

minutes after receiving the request unless the request is received

after 9:30 p.m. and before 6 a.m. eastern standard time or unless

the consumer reporting agency's ability to temporarily lift the

security freeze within 15 minutes is prevented by any of the

following:

(a) An act of God, including, but not limited to, fire,

earthquake, hurricane, storm, or similar natural disaster or

phenomena.

(b) An unauthorized or illegal act by a third party,

including, but not limited to, terrorism, sabotage, riot,

vandalism, labor strikes or disputes disrupting operations, or

similar occurrence.

to, electrical failure, unanticipated delay in equipment or

replacement part delivery, computer hardware or software failures

inhibiting response time, or similar disruption.

(d) Governmental action, including, but not limited to, an

emergency order or regulation, judicial or law enforcement action,

or similar directive.

(e) Regularly scheduled maintenance of or updates to the

consumer reporting agency's computer systems that occurs outside of

normal business hours.

(f) Commercially reasonable maintenance of or repair to the

consumer reporting agency’s computer systems that is unexpected or

unscheduled.

(5) A security freeze shall remain in place until the consumer

requests that the consumer reporting agency remove the security

freeze. A consumer reporting agency shall remove a security freeze

within 3 business days after receiving a request for removal from

the consumer and the all of the following information from the

consumer:

(a) Clear and proper identification.

(b) The unique personal identification number or password

provided by the consumer reporting agency under section 7.

Sec. 13. (1) Subject to subsection (2), a consumer reporting

House Bill No. 4103 (H-2) as amended March 20, 2007

agency may impose a reasonable fee on a consumer for placing a

security freeze on a consumer report under section 5. The amount of

a fee imposed under this subsection shall not exceed $20.00.

(2) A consumer reporting agency may not charge a fee for

placing a security freeze on a consumer report if the consumer is a

victim of identity theft and provides the consumer reporting agency

upon request with a police report that confirms that the consumer

was a victim of identity theft [or if the consumer is 60 years old or

older].

(3) A consumer reporting agency may impose a reasonable fee on

a consumer for replacing a personal identification number or

password under section 7(2). The amount of a fee imposed under this

subsection shall not exceed $10.00.

(4) A consumer reporting agency shall not charge a consumer a

fee for temporarily lifting or removing a security freeze under

section 11.

Sec. 15. (1) A consumer may bring an action against a person

that negligently fails to comply with any requirement imposed under

this act with respect to the consumer to recover actual damages

sustained by the consumer as a result of the failure, plus

reasonable attorney fees and court costs.

(2) A consumer may bring an action against a person that

willfully fails to comply with any requirement imposed under this

act with respect to the consumer to recover actual damages

sustained by the consumer as a result of the failure or damages of

not less than $100.00 and not more than $1,000.00, whichever is

greater, plus reasonable attorney fees and court costs if the

consumer is successful in obtaining any award in the action. The

House Bill No. 4103 (H-2) as amended March 20, 2007

court may also award the [consumer] any punitive damages that it

considers proper.

(3) A consumer reporting agency may bring an action against a

person that obtains a consumer report or requests a security

freeze, the temporary lift of a freeze, or the removal of a freeze

from the consumer reporting agency under false pretenses or in an

attempt to violate federal or state law to recover actual damages

sustained by the consumer reporting agency or $1,000.00, whichever

is greater.

(4) If the court in an action described in this section finds

that an unsuccessful pleading, motion, or other paper filed in

connection with the action was filed in bad faith or for purposes

of harassment, the court shall award attorney fees to the

prevailing party in an amount the court finds reasonable in

relation to the work expended in responding to the pleading,

motion, or paper.

Sec. 17. (1) This act does not apply to the use of a consumer

report by any of the following:

(a) If the consumer report is used for the purpose of

reviewing the account or collecting the financial obligation owing

for the account, contract, or negotiable instrument, a person with

which a consumer has or had prior to assignment an account or

contract or to which the consumer has issued a negotiable

instrument; a subsidiary, affiliate, or agent of that person; an

assignee of a financial obligation owed by the consumer to that

person; or a prospective assignee of a financial obligation owed by

the consumer to that person in conjunction with the proposed

purchase of the financial obligation.

(b) A subsidiary, affiliate, agent, assignee, or prospective

assignee of a person to which access has been granted for purposes

of facilitating an extension of credit or other permissible use.

court, or private collection agency acting pursuant to a court

order, warrant, or subpoena.

(d) A child support agency acting pursuant to part d of title

IV of the social security act, 42 USC 651 to 669b.

(e) The state or its agents or assigns acting to investigate

fraud, acting to investigate or collect delinquent taxes or unpaid

court orders, or acting to fulfill any of its other statutory

responsibilities if those responsibilities are consistent with a

permissible purpose under 15 USC 1681b.

(f) A person setting or adjusting a rate, adjusting a claim,

or underwriting for insurance purposes.

(g) A person using credit information for the purpose of

prescreening as provided for by the fair credit reporting act, 15

USC 1681 to 1681v.

(h) A person administering a consumer report monitoring

subscription service to which the consumer has subscribed.

(i) A person providing a consumer with a copy of his or her

consumer report in response to the consumer's request.

(2) As used in this section:

(a) "Account" includes a demand deposit account.

(b) "Reviewing the account" includes activities related to

account maintenance, monitoring, credit line increases, and account

upgrades and enhancements.

Sec. 19. The following entities are not required to place a

security freeze on a consumer report:

(a) A consumer reporting agency that acts only as a reseller

of credit information by assembling and merging information

contained in the database of another consumer reporting agency or

multiple consumer reporting agencies and does not maintain a

permanent database of credit information from which new consumer

reports are produced. However, a consumer reporting agency acting

as a reseller shall honor any security freeze placed on a consumer

credit report by another consumer reporting agency.

(b) A check services or fraud prevention services company that

issues reports on incidents of fraud or authorizations for the

purpose of approving or processing negotiable instruments,

electronic funds transfers, or similar methods of payments.

reports regarding account closures due to fraud, substantial

overdrafts, automatic teller machine abuse, or similar negative

information regarding a consumer to inquiring financial

institutions for use only in reviewing a consumer request for a

deposit account at the inquiring financial institution.

(d) A consumer reporting agency, if its database or file

consists only of information concerning and used for criminal

record information, fraud prevention or detection, personal loss

history information, or employment, tenant, or background

screening.

Enacting section 1. This act takes effect 60 days after the