SB 340, As Passed Senate

SB-0340, As Passed Senate, May 23, 2007

SUBSTITUTE FOR

SENATE BILL NO. 340

A bill to require certain consumer reporting agencies to place

security freezes on certain consumer credit information; to provide

for the removal and temporary lifting of security freezes; to

provide for the powers and duties of certain state officers and

entities; and to authorize and limit fees.

THE PEOPLE OF THE STATE OF MICHIGAN ENACT:

Sec. 1. This act shall be known and may be cited as the

"consumer credit protection act".

Sec. 3. As used in this act:

(a) "Clear and proper identification" means information

generally considered sufficient to identify an individual.

(b) "Consumer" means an individual who resides in this state.

15 USC 1681a(f). The term does not include a check acceptance

service that provides check approval and guarantee services to

merchants.

(d) "Credit report" means a consumer report, as defined in 15

USC 1681a, that is used or collected in whole or part for the

purpose of serving as a factor in establishing a consumer's

eligibility for credit for personal, family, or household purposes.

(e) In connection with a reply by a consumer reporting agency

to an electronic request, "delay event" means any of the following:

(i) The electronic request is received after 9:30 p.m. and

before 6 a.m. eastern standard time.

(ii) An act of God, including, but not limited to, fire,

earthquake, hurricane, storm, or similar natural disaster or

phenomenon.

(iii) An unauthorized or illegal act by a third party,

including, but not limited to, terrorism, sabotage, riot,

vandalism, a labor strike or dispute disrupting operations, or

similar occurrence.

(iv) An operational interruption, including, but not limited

to, electrical failure, unanticipated delay in equipment or

replacement part delivery, computer hardware or software failure

inhibiting response time, or similar disruption.

(v) Governmental action, including, but not limited to, an

emergency order or regulation, judicial or law enforcement action,

or similar directive.

(vi) Regularly scheduled maintenance of or updates to a

consumer reporting agency's computer system that occur outside of

normal business hours.

(vii) Commercially reasonable maintenance of or repair to a

consumer reporting agency's computer system that is unexpected or

unscheduled.

(viii) The consumer reporting agency cannot access the

electronic mail address, telephone number, or facsimile number

provided by the consumer in compliance with the process described

in section 7(1)(b).

(f) "Electronic request" means a request sent to a consumer

reporting agency by electronic mail, secure internet website,

telephone, facsimile, or other similar means of telephonic or

electronic communication as selected by the consumer reporting

agency, by submitting that request to the electronic mail address,

internet website, telephone number, or facsimile number designated

by the consumer reporting agency to receive that type of request,

that includes clear and proper identification of the consumer.

(g) "Security freeze" means a notice placed on a consumer

report at the request of the consumer that prohibits a consumer

reporting agency from releasing the consumer's credit report or

credit score related to extensions of credit without the express

authorization of the consumer except in compliance with this act.

(h) "Written request" means a request sent to a consumer

reporting agency, in writing, by certified mail to an address

designated by the consumer reporting agency to receive that type of

request, that includes clear and proper identification of the

consumer and the consumer's address for replies.

Sec. 5. (1) Beginning on the effective date of this act, a

consumer who is a victim of identity theft may request and a

consumer reporting agency shall place a security freeze on that

consumer's credit report if that consumer submits a written request

to the consumer reporting agency and includes with the request a

copy of a police report that alleges that he or she was a victim of

identity theft.

(2) All of the following apply beginning September 1, 2008:

(a) As an alternative to a written request under subsection

(1), a consumer who is a victim of identity theft may request and a

consumer reporting agency shall place a security freeze on that

consumer's credit report if that consumer submits an electronic

request to the consumer reporting agency and includes with the

request a copy of a police report that alleges that he or she was a

victim of identity theft.

(b) A consumer who is 65 years old or older may request and a

consumer reporting agency shall place a security freeze on that

consumer's credit report if that consumer submits a written request

or an electronic request to the consumer reporting agency.

(3) Beginning January 1, 2009, any consumer may request and a

consumer reporting agency shall place a security freeze on that

consumer's credit report if that consumer submits a written request

or an electronic request to the consumer reporting agency and

includes with the request payment of the fee under section 13, if

applicable.

(4) A consumer reporting agency shall place a security freeze

on a consumer's credit report within 10 business days after

receiving a written or electronic request for the security freeze

that complies with this section from the consumer.

(5) If a security freeze is in place, a consumer reporting

agency shall not release information from a credit report to a

third party without prior express authorization from the consumer.

This subsection does not prevent a consumer reporting agency from

advising a third party that a security freeze is in effect with

respect to the consumer's credit report.

Sec. 7. (1) Within 10 business days after a consumer reporting

agency receives a written or electronic request to place a security

freeze that complies with section 5, the consumer reporting agency

shall provide the consumer with written confirmation of the

security freeze and a unique personal identification number or

password that the consumer may use to remove or temporarily lift a

security freeze under section 11. In addition, the consumer

reporting agency shall simultaneously provide all of the following

to the consumer in writing:

(a) The process for placing, removing, and temporarily lifting

a security freeze.

(b) The process for obtaining a replacement or reminder of a

personal identification number or password for purposes of

subsections (2) and (3), including, but not limited to, a

description of how a consumer may submit an electronic request for

a replacement or reminder of a personal identification number or

password; whether the consumer reporting agency uses electronic

mail, telephone calls, facsimile transmissions, postings to secure

internet websites, or other similar means of telephonic or

electronic communication to send replacements or reminders of

personal identification numbers or passwords under subsection (4);

and how a consumer may provide or update his or her electronic mail

address, telephone number, facsimile number, or other telephonic or

electronic contact information to the consumer reporting agency.

identification number or password for purposes of subsection (5).

(2) A consumer who has forgotten or cannot locate his or her

personal identification number or password for purposes of

subsection (1) may submit a written request for a replacement

personal identification number or password. Within 10 business days

after a consumer reporting agency receives a written request for a

replacement personal identification number or password, the

consumer reporting agency shall provide the consumer with a new,

unique personal identification number or password to be used by the

consumer instead of the number or password that was provided under

subsection (1).

(3) Beginning January 1, 2009, as an alternative to making a

written request for a replacement personal identification number or

password under subsection (2), if a consumer who is entitled to

make an electronic request to place a security freeze under section

5 forgets or cannot locate his or her personal identification

number or password, the consumer may obtain a replacement or

reminder of his or her personal identification number or password

by submitting an electronic request for a replacement or reminder

of his or her personal identification number or password to the

consumer reporting agency.

(4) Within 15 minutes after a consumer reporting agency

receives an electronic request for a replacement or reminder of a

personal identification number or password under subsection (3),

unless the consumer reporting agency's ability to respond in 15

minutes is prevented by a delay event, the consumer reporting

agency shall provide the consumer with a new, unique personal

identification number or password that the consumer may use instead

of the number or password provided under subsection (1), or provide

the consumer with a reminder of his or her personal identification

number or password. The consumer reporting agency shall send the

replacement personal identification number or password or reminder

of the consumer's personal identification number or password to the

consumer's electronic mail address, telephone number, facsimile

number, secure internet website, or other telephonic or electronic

communication destination number or address provided pursuant to

the process described in subsection (1)(b). If the consumer has not

provided a current electronic mail address, telephone number, or

facsimile number to the consumer reporting agency in compliance

with that process, the consumer reporting agency may provide the

replacement personal identification number or password or reminder

of the consumer's personal identification number or password to the

consumer pursuant to subsection (2).

(5) A consumer may submit a written request, or an electronic

request if that consumer is entitled to make an electronic request

to place a security freeze under section 5, for a specific personal

identification number or password that the consumer may use to

remove or temporarily lift a security freeze under section 11. The

request must include the personal identification number or password

assigned by the consumer reporting agency; include the specific

personal identification number or password requested by the

consumer; and comply with the process described in subsection

(1)(c). Within 10 business days after a consumer reporting agency

receives a request for a specific personal identification number or

password under this subsection, the consumer reporting agency shall

provide the consumer with the personal identification number or

password requested by the consumer or notification that the

personal identification number or password is unavailable for use

by the consumer.

Sec. 9. If a security freeze is in effect, a consumer

reporting agency shall not change a consumer's name, address, date

of birth, or social security number in a credit report without

sending a written confirmation of the change to the consumer within

30 days after the posting of the change to the credit report. If

the change is an address change, the consumer reporting agency

shall send written confirmation to both the new address and the

former address. Written confirmation is not required for a

technical modification of information in a credit report, including

name and street abbreviations, complete spellings, or transposition

of numbers or letters.

Sec. 11. (1) A consumer reporting agency shall remove or

temporarily lift a security freeze placed on a credit report only

if 1 of the following applies:

(a) The consumer makes a request under this section to the

consumer reporting agency at a point of contact designated by that

consumer reporting agency.

(b) The credit report is frozen due to a material

misrepresentation of fact by the consumer. If a consumer reporting

agency intends to remove a security freeze on a credit report under

this subdivision, the consumer reporting agency shall provide

written notice to the consumer before removing the security freeze.

(2) If a consumer wishes to allow access to his or her credit

report for a specific period of time while a security freeze is in

place, he or she may make a written request to the consumer

reporting agency to temporarily lift the security freeze. The

written request shall include the unique personal identification

number or password established under section 7 and the specific

time period that the consumer requests that the consumer reporting

agency allow a creditor or proposed creditor access to his or her

credit report. A consumer reporting agency that receives a written

request to temporarily lift a security freeze on a consumer's

credit report shall comply with the request within 3 business days

after receiving the request.

(3) If a consumer who is entitled to make an electronic

request to place a security freeze under section 5 wishes to allow

access to his or her credit report for a specific period of time

while a security freeze is in place, he or she may make an

electronic request to the consumer reporting agency to temporarily

lift the freeze. The electronic request shall include the unique

personal identification number or password established under

section 7 and the specific time period that the consumer requests

that the consumer reporting agency allow a creditor or proposed

creditor access to his or her credit report. Within 15 minutes

after a consumer reporting agency receives an electronic request to

temporarily lift a security freeze, unless the consumer reporting

agency's ability to respond in 15 minutes is prevented by a delay

event, the consumer reporting agency shall comply with the request

to temporarily lift the security freeze and provide the consumer

with notice that the security freeze is temporarily lifted.

(4) A security freeze shall remain in place until the consumer

requests that the consumer reporting agency remove the security

freeze. The request shall include the unique personal

identification number or password established under section 7. A

consumer reporting agency shall remove a security freeze within 3

business days after receiving a written request for removal from a

consumer, or after receiving an electronic request for removal from

a consumer who is entitled to make an electronic request to place a

security freeze under section 5.

Sec. 13. (1) Subject to subsection (2), a consumer reporting

agency may impose a reasonable fee on a consumer for placing a

security freeze on a credit report. The amount of the fee may not

exceed $10.00 per request.

(2) A consumer reporting agency may not charge any of the

following consumers a fee for placing a security freeze on a credit

report:

(a) A consumer who was a victim of identity theft and who

provides the consumer reporting agency with a police report that

alleges that the consumer was a victim of identity theft.

(b) A consumer who is 65 years old or older.

(3) A consumer reporting agency shall not charge a consumer a

fee for lifting or removing a security freeze under this act.

(4) A consumer reporting agency may impose a reasonable fee on

a consumer for issuing a replacement personal identification number

or password or a specific personal identification number or

password under section 7. The amount of the fee may not exceed

$10.00 per request.

Sec. 15. The following entities are not required to place a

security freeze on a credit report:

(a) A consumer reporting agency that acts only as a reseller

of credit information by assembling and merging information

contained in the database of another consumer reporting agency or

multiple consumer reporting agencies and does not maintain a

permanent database of credit information from which new credit

reports are produced. However, a consumer reporting agency acting

as a reseller shall honor any security freeze placed on a credit

report by another consumer reporting agency.

(b) A check services or fraud prevention services company that

issues reports on incidents of fraud or authorizations for the

purpose of approving or processing negotiable instruments,

electronic funds transfers, or similar methods of payments.

reports regarding account closures due to fraud, substantial

overdrafts, automatic teller machine abuse, or similar negative

information regarding a consumer to inquiring financial

institutions for use only in reviewing a consumer request for a

deposit account at the inquiring financial institution.

Sec. 17. (1) This act does not apply to the use of a credit

report by any of the following:

(a) If the credit report is used for the purpose of reviewing

the account or collecting the financial obligation owing for the

account, contract, or negotiable instrument, a person with which a

consumer has or had prior to assignment an account or contract or

to which the consumer has issued a negotiable instrument; a

subsidiary, affiliate, or agent of that person; an assignee of a

financial obligation owed by the consumer to that person; or a

prospective assignee of a financial obligation owed by the consumer

to that person in conjunction with the proposed purchase of the

financial obligation.

(b) A subsidiary, affiliate, agent, assignee, or prospective

assignee of a person to which access has been granted for purposes

of facilitating an extension of credit or other permissible use.

court, or private collection agency acting pursuant to a court

order, warrant, or subpoena.

(d) A child support agency acting pursuant to part d of title

IV of the social security act, 42 USC 651 to 669b.

(e) The state or its agents or assigns acting to investigate

fraud, acting to investigate or collect delinquent taxes or unpaid

court orders, or acting to fulfill any of its other statutory

responsibilities if those responsibilities are consistent with a

permissible purpose under 15 USC 1681b.

(f) A person setting or adjusting a rate, adjusting a claim,

or underwriting for insurance purposes.

(g) A person using credit information for the purpose of

prescreening as provided for by the fair credit reporting act, 15

USC 1681 to 1681v.

(h) A person administering a credit report monitoring

subscription service to which the consumer has subscribed.

(i) A person providing a consumer with a copy of his or her

credit report in response to the consumer's request.

(2) As used in this section:

(a) "Account" includes a demand deposit account.

(b) "Reviewing the account" includes activities related to

account maintenance, monitoring, credit line increases, and account

upgrades and enhancements.

Sec. 19. (1) The office of financial and insurance services in

the department of labor and economic growth shall provide

information describing the process for placing a security freeze

under this act and educational information concerning how placing a

security freeze can help reduce identity theft on a webpage

available to the public through its internet website.

(2) The office of attorney general shall post a link to the

webpage described in subsection (1) on its internet website.

Enacting section 1. This act takes effect 90 days after the

date it is enacted.

Enacting section 2. This act does not take effect unless

Senate Bill No. 75 of the 94th Legislature is enacted into law.