PRINTER'S NO. 251
No. 180 Session of 2005
INTRODUCED BY CORMAN, WONDERLING, GREENLEAF, M. WHITE, KASUNIC, RHOADES, TARTAGLIONE, KITCHEN, MUSTO, O'PAKE, COSTA, D. WHITE, STACK, ORIE, RAFFERTY AND ARMSTRONG, FEBRUARY 11, 2005
REFERRED TO BANKING AND INSURANCE, FEBRUARY 11, 2005
AN ACT 1 Providing for protection from identity theft, for security 2 alerts and freezes, for procedures for access after 3 imposition and removal of security freezes and for related 4 matters. 5 The General Assembly of the Commonwealth of Pennsylvania 6 hereby enacts as follows: 7 Section 1. Short title. 8 This act shall be known and may be cited as the Credit 9 Reporting Agency Law. 10 Section 2. Definitions. 11 The following words and phrases when used in this act shall 12 have the meanings given to them in this section unless the 13 context clearly indicates otherwise: 14 "Clear and proper identification." Information generally 15 deemed sufficient to identify a person. 16 "Credit report." Any written, oral or other communication of 17 any credit information by a credit reporting agency, as defined 18 in the Fair Credit Reporting Act (Public Law 91-508, 15 U.S.C. §
1 1681 et seq.), which operates or maintains a database of 2 consumer credit information bearing on a consumer's 3 creditworthiness, credit standing or credit capacity. 4 "Credit reporting agency." Any person who, for monetary 5 fees, dues or on a cooperative nonprofit basis, regularly 6 engages in whole or in part in the practice of assembling or 7 evaluating consumer credit information or other information on 8 consumers for the purpose of furnishing consumer reports to 9 third parties and who uses any means or facility of interstate 10 commerce for the purpose of preparing or furnishing consumer 11 reports. The term does not mean a check acceptance service which 12 provides check approval and guarantees services to merchants. 13 "Security alert." A notice placed on a consumer file or in a 14 consumer's report, at the request of the consumer, that is sent 15 to a recipient of a consumer report or file involving that 16 consumer file, signifying the fact that the consumer's identity 17 may have been used without the consumer's consent to 18 fraudulently obtain goods or services in the consumer's name. 19 "Security freeze." A notice placed on a consumer file, at 20 the request of the consumer and subject to certain exceptions, 21 that prohibits a credit reporting agency from releasing the 22 consumer's credit report or credit score without the express 23 authorization of the consumer. 24 Section 3. Security alert. 25 (a) General rule.--A consumer may elect to place a security 26 alert in his or her credit report by making a request in writing 27 or by telephone to a consumer credit reporting agency. 28 (b) Notification.--A consumer credit reporting agency shall 29 notify each person requesting consumer credit information with 30 respect to a consumer of the existence of a security alert in 20050S0180B0251 - 2 -
1 the credit report of that consumer, regardless of whether a full 2 credit report, credit score or summary report is requested. 3 (c) Toll-free telephone number.--Each consumer credit 4 reporting agency shall maintain a toll-free telephone number to 5 accept security alert requests from consumers 24 hours a day, 6 seven days a week. The toll-free telephone number shall be 7 included in any written disclosure by a consumer credit 8 reporting agency to any consumer and shall be printed in a clear 9 and conspicuous manner. 10 (d) Security alert request.--A consumer credit reporting 11 agency shall place a security alert on a consumer's credit 12 report no later than five business days after receiving a 13 request from the consumer. 14 (e) Placement and renewal.--The security alert shall remain 15 in place for at least one year, and a consumer shall have the 16 right to request a renewal of the security alert. 17 (f) Approval.--Any person who uses a consumer credit report 18 in connection with the approval of credit based on an 19 application for an extension of credit, or with the purchase, 20 lease or rental of goods or noncredit-related services and who 21 receives notification of a security alert pursuant to subsection 22 (a) may not lend money, extend credit or complete the purchase, 23 lease or rental of goods or noncredit-related services without 24 taking reasonable steps to verify the consumer's identity, in 25 order to ensure that the application for an extension of credit 26 or for the purchase, lease or rental of goods or noncredit- 27 related services is not the result of identity theft. If the 28 consumer has placed a statement with the security alert in his 29 or her file requesting that identity be verified by calling a 30 specified telephone number, any person who receives that 20050S0180B0251 - 3 -
1 statement with the security alert in a consumer's file pursuant 2 to subsection (a) shall take reasonable steps to verify the 3 identity of the consumer by contacting the consumer using the 4 specified telephone number prior to lending money, extending 5 credit or completing the purchase, lease or rental of goods or 6 noncredit-related services. If a person uses a consumer credit 7 report to facilitate the extension of credit or for another 8 permissible purpose on behalf of a subsidiary, affiliate, agent, 9 assignee or prospective assignee, that person may verify a 10 consumer's identity under this section in lieu of the 11 subsidiary, affiliate, agent, assignee or prospective assignee. 12 (g) Extension of credit.--For purposes of this section, 13 "extension of credit" does not include an increase in the dollar 14 limit of an existing open-end credit plan, as defined in 15 Regulation Z issued by the Board of Governors of the Federal 16 Reserve System of 12 CFR 226.2 (relating to definitions and 17 rules of construction), or any change to, or review of, an 18 existing credit account. 19 (h) Verification of identity.--If reasonable steps are taken 20 to verify the identity of the consumer, those steps constitute 21 compliance with the requirements of this section, except that if 22 a consumer has placed a statement including a telephone number 23 with the security alert in his or her file, his or her identity 24 shall be verified by contacting the consumer using that 25 telephone number as specified pursuant to subsection (f). 26 (i) Notice of expiration date.--A consumer credit reporting 27 agency shall notify each consumer who has requested that a 28 security alert be placed on his or her consumer credit report of 29 the expiration date of the alert. 30 Section 4. Security freeze. 20050S0180B0251 - 4 -
1 (a) Request for freeze.--A consumer may elect to place a 2 security freeze on his credit report by written request, sent by 3 certified mail, that includes clear and proper identification, 4 to a credit reporting agency. A credit reporting agency shall 5 place a security freeze on a consumer's credit report no later 6 than five business days after receiving a written request for 7 the security freeze from the consumer. 8 (b) Effect of security freeze.--When a security freeze is in 9 place, information from a consumer's credit report shall not be 10 released to a third party without prior express authorization 11 from the consumer. This subsection shall not prevent a credit 12 reporting agency from advising a third party that a security 13 freeze is in effect with respect to the consumer's credit 14 report. 15 (c) Third party request.--If a third party requests access 16 to a consumer credit report on which a security freeze is in 17 effect, and this request is in connection with an application 18 for credit or any other use, and the consumer does not allow his 19 or her credit report to be accessed for that specific party or 20 period of time, the third party may treat the application as 21 incomplete. 22 Section 5. Credit reporting agency. 23 The credit reporting agency shall, no later than ten business 24 days after the date the agency receives the request for a 25 security freeze, send the consumer a written confirmation that 26 provides the consumer with a unique personal identification 27 number or password to be used by the consumer when providing 28 authorization for the access to his credit file for a specific 29 period of time. In addition, the credit reporting agency shall 30 simultaneously provide to the consumer in writing notification 20050S0180B0251 - 5 -
1 of the process of placing, removing the temporarily lifting a 2 security freeze and the process for allowing access to 3 information from the consumer's credit file for a specific party 4 or for a specific period while the security freeze is in effect. 5 Section 6. Personal identification. 6 A consumer may request in writing a replacement personal 7 identification number or password. The request must comply with 8 the requirements for requesting a security freeze under section 9 4 (relating to security freeze). The credit reporting agency 10 shall, no later than seven business days after the date the 11 agency receives the request for a replacement personal 12 identification number or password, provide the consumer with a 13 new, unique personal identification number or password to be 14 used by the consumer instead of the number or password that was 15 provided under section 5 (relating to credit reporting agency). 16 Section 7. Notification of freeze. 17 A credit reporting agency shall notify a person who requests 18 a consumer report or score if a security alert or freeze is in 19 effect for the consumer file involved in that report or score. 20 Section 8. Effect of freeze. 21 If a third party requests access to a consumer credit report 22 on which a security freeze is in effect and this request is in 23 connection with an application for credit or any other use and 24 the consumer does not allow his credit report to be accessed for 25 that specific period of time, the third party must treat the 26 application as incomplete. 27 Section 9. Temporary freeze. 28 (a) Request.--If the consumer wishes to allow his credit 29 report or score to be accessed for a specific period of time 30 while a freeze is in place, he shall contact the credit 20050S0180B0251 - 6 -
1 reporting agency and request that the freeze be temporarily 2 lifted and provide the following: 3 (1) Clear and proper identification. 4 (2) The unique personal identification number or 5 password provided by the credit reporting agency pursuant to 6 section 5 (relating to credit reporting agency). 7 (3) The proper information regarding the time period for 8 which the report shall be available to users of the credit 9 report. 10 (4) The proper information regarding the third party who 11 is to receive the credit report or the time period for which 12 the report shall be available to users of the credit report. 13 (b) Agency requirement.--A credit reporting agency that 14 receives a request from a consumer to temporarily lift a freeze 15 on a credit report pursuant to subsection (a) shall comply with 16 the request no later than three business days after receiving 17 the request. A credit reporting agency may develop procedures 18 involving the use of the telephone, facsimile, Internet or other 19 electronic media to receive and process a request from a 20 consumer to temporarily lift a freeze on a credit report or 21 score pursuant to subsection (a) in an expedited manner. 22 (c) Removal of temporary freeze.--A credit reporting agency 23 shall remove or temporarily lift a freeze placed on a consumer's 24 credit report only in the following cases: 25 (1) Upon consumer request as provided in this section. 26 (2) If the consumer's credit report was frozen due to a 27 material misrepresentation of fact by the consumer. If a 28 credit reporting agency intends to remove a freeze upon a 29 consumer's credit report pursuant to this paragraph, the 30 credit reporting agency shall notify the consumer in writing 20050S0180B0251 - 7 -
1 prior to removing the freeze on the consumer's credit report. 2 (d) Duration of freeze.--A security freeze shall remain in 3 place until the consumer requests that the security freeze be 4 removed. A credit reporting agency shall remove a security 5 freeze within three business days of receiving a request for 6 removal from the consumer who provides both of the following: 7 (1) Clear and proper identification. 8 (2) The unique personal identification number or 9 password provided by the credit reporting agency. 10 (e) Applicability of freeze.--A security freeze does not 11 apply to a consumer report provided to: 12 (1) A Federal, State or local government entity, 13 including a law enforcement agency or court, or their agents 14 or assigns. 15 (2) A private collection agency for the sole purpose of 16 assisting in the collection of an existing debt of the 17 consumer who is the subject of the credit report requested. 18 (3) A person or entity or a subsidiary, affiliate or 19 agent of that person or entity, or an assignee of a financial 20 obligation owing by the consumer to that person or entity, or 21 a prospective assignee of a financial obligation owing by the 22 consumer to that person or entity in conjunction with the 23 proposed purchase of the financial obligation, with which the 24 consumer has or had prior to assignment an account or 25 contract, including a demand deposit account, or to whom the 26 consumer issued a negotiable instrument, for the purposes of 27 reviewing the account or collecting the financial obligation 28 owing for the account, contract or negotiable instrument. For 29 purposes of this paragraph, "reviewing the account" includes 30 activities related to account maintenance, monitoring, credit 20050S0180B0251 - 8 -
1 line increases and account upgrades and enhancements. 2 (4) A subsidiary, affiliate, agent, assignee or 3 prospective assignee of a person to whom access has been 4 granted under this section for the purposes of facilitating 5 the extension of credit. 6 (5) A person, for the purposes of prescreening as 7 provided by the Fair Credit Reporting Act (Public Law 91-508, 8 15 U.S.C. § 1681 et seq.). 9 (6) A credit reporting agency for the purposes of 10 providing a consumer with a copy of his own report on his 11 request. 12 (7) A child support enforcement agency. 13 (8) A credit reporting agency that acts only as a 14 reseller of credit information by assembling and merging 15 information contained in the database of another credit 16 reporting agency or multiple credit reporting agencies and 17 does not maintain a permanent database of credit information 18 from which new credit reports are produced. However, a credit 19 reporting agency acting as a reseller shall honor any 20 security freeze placed on a credit report by another credit 21 reporting agency. 22 (9) A check services or fraud prevention services 23 company which issues reports on incidents of fraud or 24 authorizations for the purpose of approving or processing 25 negotiable instruments, electronic funds transfers or similar 26 methods of payments. 27 (10) A deposit account information service company which 28 issues reports regarding account closures due to fraud, 29 substantial overdrafts, ATM abuse or similar negative 30 information regarding a consumer to inquiring banks or other 20050S0180B0251 - 9 -
1 financial institutions for use only in reviewing a consumer 2 request for a deposit account at the inquiring bank or 3 financial institution. 4 Section 10. Fees. 5 (a) General rule.--A credit reporting agency may impose a 6 reasonable charge on a consumer for initially placing a security 7 freeze on a consumer file. The amount of the charge may not 8 exceed $10. The charge to temporarily lift the security freeze 9 may not exceed $8 per request. At no time shall the consumer be 10 charged for revoking the freeze. An exception shall be allowed 11 whereby the consumer will be charged $0 by the consumer 12 reporting agency placing the security freeze if any of the 13 following apply: 14 (1) If the consumer is a victim of identity theft and, 15 upon the request of the consumer reporting agency, provides 16 the credit reporting agency with a police report. 17 (2) If the consumer is 62 years of age or older. 18 (b) Confirmation required.--If a security freeze is in 19 place, a credit reporting agency shall not change any of the 20 following official information in a consumer credit report 21 without sending a written confirmation of the change to the 22 consumer within 30 days of the change being posted to the 23 consumer's file: 24 (1) Name. 25 (2) Date of birth. 26 (3) Social Security number. 27 (4) Address. 28 Written confirmation is not required for technical modifications 29 of a consumer's official information, including name and street 30 abbreviations, complete spellings or transposition of numbers or 20050S0180B0251 - 10 -
1 letters. In the case of an address change, the written 2 confirmation shall be sent to both the new address and to the 3 former address. 4 Section 11. Damages. 5 Any consumer damaged by an intentional or negligent violation 6 of this act may bring an action for and shall be entitled to 7 recovery of actual damages, plus reasonable attorney fees, court 8 costs and other reasonable costs of prosecution of the suit. 9 Section 12. Effective date. 10 This act shall take effect in 60 days. A12L13RLE/20050S0180B0251 - 11 -