House of
Representatives
SB 1185
credit report; score; security freeze
Sponsors: Senators Aguirre, Aboud, Arzberger, et al
SB 1185 establishes procedures and requirements for a consumer to request and a credit reporting agency to place or lift a security freeze on the consumer’s credit report.
History
A consumer credit report is the record of an individual’s credit history, including credit card accounts, revolving credit accounts, borrowing and payment history, credit inquiries and credit limits. Additional information typically contained in the report consists of past and present residences of the consumer, whether the consumer has been sued or arrested and any bankruptcy filings. Companies that gather and sell this information are called consumer reporting agencies (CRA); the three main agencies are Equifax, Experian and Trans Union.
A security freeze restricts a consumer reporting agency from releasing a credit report or any information from the report without authorization from the consumer. A freeze also requires authorization to change information—such as the consumer's name, date of birth, Social Security number and address—in a consumer report. A security freeze lasts until the consumer removes it. A person can temporarily remove the freeze to open a new credit account or a new loan. To do this, a consumer must give the consumer reporting agency a special personal identifying number (PIN), which is required to verify the consumer's identity. States have created exemptions for specified organizations that still can access credit report information even if a freeze is in place. These organizations include law enforcement agencies, child support enforcement, insurance, and subsidiaries and affiliates of companies that have existing accounts with the consumer.
Equifax, Experian and TransUnion's allow Arizona residents to request a security freeze for free if the person has been a victim of identity theft. If the person is not a victim of identity theft the fee for placing a security freeze on the credit report is $10.
According to the National Conference of State Legislatures, 40 states have enacted security freeze laws. Of the states that have security freeze laws, Arkansas, Kansas, Mississippi and South Dakota only allow victims of identity theft to place security freezes on their information. Most states allow the consumer reporting agencies to charge a fee that ranges from $5 to $20. Utah does not specify the exact amount of a fee but allows a "reasonable fee". South Dakota law does not contain a fee provision. Six states prohibit the charging of fees to senior citizens and most states prohibit a fee when the person requesting the security freeze has been a victim of identity theft.
Provisions
Requesting a Security Freeze
· Allows a consumer to request that a CRA place a security freeze on the consumer’s credit report and prohibits a CRA from releasing a consumer’s credit report or score that has been frozen to a third party without the consumer’s prior authorization. However, a CRA may advise a third party that a security freeze is in effect.
· Requires a CRA to place a security freeze on a consumer’s credit report or credit score within ten business days of receiving a written request from the consumer.
· Requires a CRA to send a written confirmation of the security freeze to the consumer within ten business days after placing the freeze that contains a unique personal identification number (PIN) or password, other than the consumer’s social security number, that the consumer can use to gain access to the frozen report.
· Allows a third party to treat an application for credit or any other purpose as incomplete if the third party requests access to a credit report that is frozen.
Removing and Temporarily Lifting a Freeze
· Requires a security freeze to remain in effect until the consumer requests that the security freeze be removed or temporarily lifted unless the freeze was due to a material misrepresentation of fact and the CRA notifies the consumer before removing the freeze.
· Allows a consumer to request by mail, telephone, Internet or other electronic contact method, in a form acceptable to the CRA, that a security freeze be removed or temporarily lifted.
· Requires a consumer to provide proper identification and the PIN or password to remove a security freeze.
· Requires, to temporarily lift a security freeze, the consumer to provide to the CRA proper identification, the PIN or password and the proper information regarding the time period the report will be available to users.
· Requires a CRA to remove or temporarily lift a security freeze within:
o three business days after receiving a consumer’s request by mail.
o 15 minutes after receiving the consumer’s request by telephone, Internet or other electronic contact method in a form acceptable to the CRA, during normal business hours.
· Stipulates that a CRA is not required to remove or lift the freeze within 15 minutes if its ability is prevented by:
o an act of God.
o unauthorized or illegal acts by a third party.
o operational interruption.
o governmental action.
o regularly scheduled maintenance during nonbusiness hours.
o commercially reasonable maintenance or repair to the CRA’s systems that is unexpected or unscheduled.
o receipt of a request outside normal business hours.
· Requires the CRA, when a consumer requests a freeze, to disclose the process for placing, removing and temporarily lifting a freeze.
· Allows a CRA to charge a five dollar fee: a) for each security freeze, removal of the freeze and temporary lift of the freeze, unless the consumer is a victim of identity theft and submits a valid police report; or b) if the consumer does not retain the original PIN or password and the CRA must reissue or provide a new PIN or password.
· Prohibits a CRA, if a security freeze is in place, from changing a consumer’s name, date of birth, social security number or address in the consumer’s credit report without sending a written confirmation of the change within 30 days after the change is posted. Notices of address changes must be sent to both the new and former address.
· Allows a CRA to make technical modifications of information in a frozen credit report without written confirmation.
· Specifies that the following groups may continue to access a credit report or score, even if frozen:
o any person or agent of that person in conjunction with the proposed purchase of a financial obligation with which the consumer has or had, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owed for the account, contract or negotiable instrument.
o a subsidiary, affiliate, agent, assignee or prospective assignee of a person to whom access has been granted for the purpose of facilitating the extension of credit or other permissible use.
o any state or local agency, law enforcement agency, trial court or private collection agency acting pursuant to a court order, warrant or subpoena.
o a child support agency acting in accordance with a program for child support obligations.
o the Department of Health Services or its agents or assigns acting to investigate fraud.
o the Department of Revenue or its agents or assigns acting to investigate or collect on delinquent taxes, unpaid court orders or any other statutory responsibilities.
o the Department of Transportation or its agents or assigns acting to investigate or collect on delinquent taxes, unpaid court orders or any other statutory responsibilities.
o the Administrative Office of the Courts to conduct audits, investigate fraud or for applicant screening.
o any agency or entity for the purposes of prescreening under the Federal Fair Credit Reporting Act of 1970.
o any person or entity that administers a credit file monitoring subscription service to which the consumer is subscribed.
o any person or entity for the purpose of providing a consumer with a copy of the consumer’s credit report or credit score on the consumer’s request.
o a person setting or adjusting a rate or claim or underwriting for insurance purposes, except as otherwise provided by law.
o a CRA’s database or file that consists entirely of information concerning, and is used entirely for criminal record information, fraud prevention or detection, tenant screening or employment screening.
o any state or federally regulated financial institution for checking, savings and investment accounts.
· Stipulates that the following entities are not required to place a security freeze on a credit report:
o a check services or fraud prevention services company that issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers or similar methods or payments.
o a deposit account information service company that issues reports regarding account closures due to fraud, substantial overdrafts, automated teller machine abuse or similar negative information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution.
o a CRA that acts only as a reseller of credit information by assembling and merging information contained in the database of another CRA or multiple CRAs and that does not maintain a permanent database of credit information from which new credit reports or credit scores are produced.
Enforcement and Liability
· Classifies a violation of a security freeze requirement as consumer fraud, subject to enforcement through private action and the Attorney General through injunctive relief.
· Exempts a CRA or other information source that reports inaccurate information corrected in compliance with the laws regulating security freezes or that fails to lift a security freeze within the required time period from being liable to the consumer.
· Provides for liability on the part of a CRA, if the CRA is grossly negligent or acts willfully and maliciously with intent to harm a consumer by failing to implement a security freeze or releasing a credit report or credit score when a freeze has been placed by the consumer.
Miscellaneous
· Defines “security freeze” and “proper identification.”
· Becomes effective on August 31, 2008, or the general effective date, whichever is earlier.
·
·
· ---------- DOCUMENT FOOTER ---------
· Forty-eighth Legislature
· Second Regular Session 2 May 5, 2008
·
· ---------- DOCUMENT FOOTER ---------