CREDIT REPORT SECURITY FREEZES

Transcription

1 AFSA SGR Card Subcommittee legislative report prepared by Kimbell Sherman Ellis April 2005 CREDIT REPORT SECURITY FREEZES Twenty three states consider legislation to allow consumers to freeze or block access to their credit reports; Security freeze bills advance in Colorado, Connecticut, Illinois, Kentucky and Washington; Security Freeze legislation in Indiana dies for failure to meet deadline OVERVIEW State legislatures across the country continue their interest in legislation that would permit consumers to freeze access to their credit reports. Despite the enactment of the federal Fair and Accurate Credit Transactions Act ( FACTA ; See November, 2004 KSE Report on Identity Theft), interest in security freeze legislation continues to be stimulated by almost daily media reports of widespread identity theft and large scale security breaches of consumer financial and personal data systems. The media feeding frenzy began when data aggregator ChoicePoint acknowledged that fraudsters posing as legitimate businesses obtained access to 145,000 consumer files. Subsequently, LexisNexis, a subsidiary of Reed Elsevier Group PLC, disclosed that hackers gained illegal access to information related to roughly 32,000 consumer accounts. Bank of America lost computer back up tapes for its federal government charge cards. Boston College had its alumni files, which include Social Security numbers, hacked. And The University of California, Berkeley reported that tens of thousands of names, birth dates, Social Security numbers and addresses were breached when a laptop was stolen. Thieves acquire enough information about 3.25 million people a year to open new accounts or to perpetrate other frauds, according to a Federal Trade Commission study. Another recent publication estimates that identity theft affects 10 million people a year. According to a study conducted by Michigan State University, which has a criminology department that is a leader in identity-theft studies, as much as 70 percent of all identity theft is perpetrated by individuals who have obtained access to private information via their employment. A security freeze means that a consumer credit reporting agency cannot share a consumer s file with potential creditors, insurance companies, landlords or employers doing background checks. Because most businesses will not open credit accounts without checking a consumer's credit history first, an identity thief is less likely to succeed in opening new credit lines in the name of the person with a credit report security freeze in place, even when the thief has a name and Social Security number. Many of the 1 of 7

2 2 bills under consideration would continue to permit access to the information by existing creditors, lenders and government officials. Security freezes are different than the fraud alerts contemplated by FACTA. A fraud alert is a special message on the report that a creditor receives when accessing a consumer's credit information. The message alerts the creditor that there may be fraud involved in the account. A fraud alert may slow down access to new credit, but the potential creditor is not prevented from accessing the information and the consumer does not need to remove the message in order to get new credit. Neither a fraud alert nor a security freeze prevents a consumer from using existing credit cards or other accounts. Some states are considering legislation that would only permit a security freeze after identity theft occurs. Other states would permit information to be frozen without the occurrence of an actual theft, but would in these cases usually permit the credit reporting agencies to charge a fee for the freeze in the absence of a theft. Many of the bills would require the consumer reporting agency to have the security freeze in effect within five business days of a written request and three days of an electronic request. A confirmation must follow within five days. If requested by the consumer, the credit reporting agency would be required to lift the freeze within three business days. The freeze would otherwise be required to remain in effect until lifted by the consumer or if the freeze was put in place through a material misrepresentation by the consumer. Many bills would prohibit a consumer credit reporting agency from changing certain material information while a freeze is in effect. The security freeze process under state law is bound to be more cumbersome than the fraud alert process under FACTA because the consumer must contact each of the credit reporting agencies in order to obtain a total freeze. Most of the bills require the consumer reporting agency to provide the consumer with a personal identification number which can be used to remove or temporarily thaw the freeze. Once a security freeze is in place, a consumer must contact each agency to obtain a thaw, usually for an additional fee. Louisiana, Vermont, California and Texas enacted security freeze legislation prior to January State Legislation Colorado SB 137 has passed the Senate. This bill would permit a consumer to put a security freeze in place, as well as temporarily lift the freeze to allow a specific entity access to the credit report for the purpose of issuing or extending credit to the consumer. The freeze would be maintained until the consumer specifically requests its removal. The bill would also require that a consumer be notified of the right to place a security freeze on his or her credit report each time the consumer receives a summary of the rights relating to credit reports. A consumer reporting agency would be required to notify the consumer within five days after releasing credit information that was in violation of a security freeze. The bill would allow a consumer who had credit information released in violation of a security freeze to bring a private civil right of action against the consumer reporting agency that released the information in violation of the security freeze. A

3 3 consumer reporting agency would be prohibited from charging fees other than to replace a lost personal identification number. Finally, the bill would prohibit a consumer reporting agency from furnishing a consumer's credit header to someone who does not have a permissible basis to obtain the consumer credit header. The bill was referred to the Appropriations committee on March 2. Connecticut SB 650 has passed a Joint House-Senate Committee on General Law. As of March 31, it has been referred to the Office Legislative Research and Office of Fiscal Analysis. SB 650 would permit a consumer to put a security freeze in place, as well as temporarily lift the freeze to allow a particular entity access to the credit report for the purpose of issuing or extending credit to the consumer. The freeze would be maintained until the consumer specifically requests its removal. A consumer reporting agency would be required to notify the consumer within five days after releasing credit information that was in violation of a security freeze. The bill would permit certain entities to access credit information despite a freeze. Two related bills are pending in Illinois: HB 1058 has passed the House and the first Senate reading is scheduled for April 6. HB 1058 would allow a consumer who has been the victim of identity theft to place a security freeze on his or her credit report without charge. The consumer would be required to file a copy of a police report, investigative report, or complaint that has been filed with law enforcement. A credit reporting agency would have five days to put the security freeze in place. A consumer would be able to thaw the report for a specific party or period or time. While a security freeze is in place, a credit reporting agency would not be permitted to change key information in a credit report without sending a written confirmation of the change to the consumer. The bill would permit certain entities to access credit information despite a freeze. SB 1892 has passed its final Senate Committee and third reading is scheduled for April 6. This bill would allow a consumer who has been the victim of identity theft to place a security freeze on his or her credit report without charge. The consumer would be required to file a copy of a police report, investigative report, or complaint that has filed with law enforcement. A credit reporting agency would have five days to put the security freeze in place. A consumer would be able to thaw the report for a specific party or period or time. While a security freeze is in place, a credit reporting agency would not be permitted to change key information in a credit report without sending a written confirmation of the change to the consumer. The bill would permit certain entities to access credit information despite a freeze. Kentucky HB 396 would allow a consumer to elect to place a security alert or a security freeze on his or her credit report. A credit reporting agency would have five days to put the security freeze in place. A consumer would be able to thaw the report for a specific party or period or time. While a security freeze is in place, a credit reporting agency

4 4 would not be permitted to change key information in a credit report without sending a written confirmation of the change to the consumer. The bill would permit certain entities to access credit information despite a freeze. A consumer who has been the victim of identity theft could not be charged for the placement, thaw or removal of a freeze. The bill was referred to the Rules committee on February 25 at Second reading. Washington SB 5418 has passed the Senate. This bill would permit a consumer to put a security freeze in place, as well as temporarily lift the freeze to allow a particular entity access to the credit report for the purpose of issuing or extending credit to the consumer. The freeze would be maintained until the consumer specifically requests its removal or unless the freeze was obtained through misrepresentation. A credit reporting agency would have five days to put the security freeze in place. A consumer would be able to thaw the report for a specific party or period or time. While a security freeze is in place, a credit reporting agency would not be permitted to change key information in a credit report without sending a written confirmation of the change to the consumer. The bill would permit certain entities to access credit information despite a freeze. A consumer reporting agency would be prohibited from charging fees to a victim of identity theft. The bill has been referred to the House Financial Institutions and Insurance Committee. A public hearing was held on March 17. Other pending legislation: Because many of the bills reviewed have almost identical features as those bills described above, the following is a list of states where bills are pending, bill number, committee where they are pending, with some major differences noted. Alaska HB 226; in Labor and Commerce Committee as of March 21; sets forth the maximum charge a credit reporting agency may charge for a security freeze. SB 148; in Senate Labor and Commerce Committee as of March 21. SB 149; in Labor and Commerce Committee as of March 31; sets forth the maximum charge a credit reporting agency may charge for a security freeze; sets forth fee for reissue of personal identification number or password. Connecticut SB 950 (see also SB 650 above); in Joint Committee on General Law; a public hearing was held January 28; permits the consumer reporting agency to decline a freeze to avoid fraud. Hawaii HB 655 (SB 764); in the Judiciary Committee, having been voted favorably by the House Consumer Protection Committee on February 7; additional entities are exempt from non-access during freeze. Illinois HB 4038; re-referred to House Rules committee on March 10; no charge for freeze for persons 62 and older.

5 5 SB 1942; re-referred to the Senate Rules Committee as of March 18; would allow a consumer to place either a security alert or a security freeze on his or her credit report. Kansas HB 2438; referred to Financial Institutions on February 11; additional entities are exempt from non-access during freeze; no charge if victim of identity theft. Maine LD 581 (SP 190); House referred to the Committee on Business, Research and Economic Development in concurrence on February 8; Senate Committee on Business, Research and Economic Development ordered printed February 3 sent down for concurrence. LD 956 (HP 666, LR 1671); Under suspension of the Senate Rules, referred to the Committee on Business, Research and Economic Development and ordered printed, in concurrence on February 24. Maryland HB 1569; re-referred to the Economic Matters Committee and a hearing was held on March 23. SB 879; Hearing March 22; re-referred to Finance Committee February 24. Massachusetts SB 184; (pre-filed); no charge for placing, thawing or removing a freeze. SB 237 (SD 1657); (pre-filed); additional entities are exempt from non-access during freeze. Minnesota HB 1943; referred to Commerce and Financial Institutions on March 17. SB 2002; referred to Commerce on March 31. Montana LC 933; (pre-filed) Nevada SB 80; referred to Commerce and Labor Committee on February 17. New Jersey AB 3274; referred to Consumer Affairs Committee on September 27, AB 3472; referred to the Consumer Affairs Committee on November 4. SB 1914; referred to the Commerce Committee October 4, 2004; additional entities are exempt from non-access during freeze. New Mexico SB 701; referred to the Senate Committee s Committee before the Legislature adjourned March 19. New York

6 6 AB 2785; referred to the Consumer Affairs and Protection Committee on January 28. SB 2950; referred to the Consumer Protection Committee on March 1. SB 3494; referred to Consumer Protection Committee. North Carolina HB 629 (HB 608); referred to the Committee on Finance; consumer reporting agency would be required to replace a lost personal identification number or password upon request. SB 921; referred to Commerce Committee on March 24. Oregon H 2412; public hearing March 16; referred to Business, Labor and Consumer Affairs on January 26. SB 627; public hearing March 10; referred to Commerce Committee on February 22. Pennsylvania HB 1243; referred to Commerce Committee on March 31, SB 180; referred to Banking and Insurance on February 11, South Carolina SB 423; referred to Committee on Banking and Insurance on February 8. SB 518; referred to Committee on Banking and Insurance on February 23. Texas SB 100; referred to the Business and Commerce Committee on January 31. Washington HB 1468; referred to Financial Institutions and Insurance Committee on January 25, Bills that have died Indiana SB 178 would have allowed a consumer to prevent access to the consumer's credit report. The bill died upon committee reporting deadline. Maryland SB 369; unfavorable vote in Finance Committee on March 8. ### CLARIFICATION of March 2004 Report on Live Checks with respect to Virginia HB This bill would create an exception to an existing criminal statute for an instrument that clearly and conspicuously discloses that it is not a check as provided in the bill.

7 7