Citations Affected: IC 24-5.
January 11, 2007, read first time and referred to Committee on Corrections, Criminal, and
Civil Matters.
February 22, 2007, amended, reported favorably _ Do Pass.
February 26, 2007, read second time, amended, ordered engrossed. Engrossed.
February 27, 2007, read third time, passed. Yeas 47, nays 0.
for a consumer to request the: (1) release of the report to a third party; (2) temporary lifting of the freeze for specified period; or (3) removal of the freeze. Requires a consumer reporting agency to develop and make available to consumers, not later than January 1, 2009, secure procedures to process, within 15 minutes of receiving a request, a telephonic or an electronic authorization from a consumer to: (1) release a consumer report subject to a security freeze; (2) temporarily lift a security freeze; or (3) remove a security freeze. Provides that specified persons may receive information from a consumer report that is subject to a security freeze, including licensed insurers. Provides that specified persons are not required to place a security freeze on a consumer's consumer report, including consumer reporting agencies that furnish specialized credit reporting tools to energy utilities. Requires a consumer reporting agency to provide a consumer written notice, in connection with certain required disclosures, that the consumer may place a security freeze on the consumer's consumer report. Prohibits a consumer reporting agency from imposing a charge on a consumer for a request from the consumer to do any of the following: (1) Place a security freeze on the consumer's consumer report. (2) Release the consumer's consumer report to a specified person, if the report is subject to a security freeze. (3) Temporarily lift a security freeze. (4) Remove a security freeze. (5) Issue a personal identification number or password for use by the consumer in releasing information from a frozen consumer report, lifting a security freeze, or removing a security freeze. Prohibits a consumer reporting agency from imposing a charge on a third party to whom a consumer's consumer report is released at the request of the consumer. Provides a cause of action to a consumer aggrieved by a consumer reporting agency's knowing or intentional violation of the provisions concerning security freezes. Allows the attorney general to bring an action to recover a civil penalty from a person who knowingly or intentionally violates the provisions concerning security freezes.
A BILL FOR AN ACT to amend the Indiana Code concerning trade
regulation.
consumer's eligibility for credit to be used primarily for
personal, family, or household purposes.
(b) The term includes a consumer's credit score.
Sec. 3. (a) As used in this chapter, "consumer reporting agency"
means any person that, for monetary fees or dues, or on a
cooperative nonprofit basis, regularly engages in whole or in part
in the practice of assembling or evaluating information concerning
a consumer's credit or other information for the purpose of
furnishing a consumer report to another person.
(b) The term does not include an entity designated as a
commercially reasonable private consumer credit reporting entity
under IC 24-4.5-7-404(5).
Sec. 4. As used in this chapter, "security freeze" means a
designation placed on a consumer's consumer report:
(1) by a consumer reporting agency; and
(2) at the request of the consumer;
that prohibits the consumer reporting agency from releasing the
consumer report without the authorization of the consumer.
Sec. 5. (a) A consumer may place a security freeze on the
consumer's consumer report by:
(1) sending a written request by United States mail to an
address designated by the consumer reporting agency; or
(2) subject to subsection (d), making a request to a consumer
reporting agency through a secure electronic mail connection
provided by the consumer reporting agency.
(b) Except as provided in subsection (c) and section 11 of this
chapter, a consumer reporting agency that receives a request
under subsection (a) shall place a security freeze on the consumer's
consumer report not later than five (5) business days after receipt
of the request.
(c) A consumer reporting agency is not required to place a
security freeze on a consumer report under this section if the
consumer reporting agency determines that the request for a
security freeze:
(1) is materially false; or
(2) does not clearly identify the person making the request as
the consumer.
(d) Not later than January 1, 2009, a consumer reporting agency
shall develop and make available to consumers a secure electronic
mail connection by which a consumer can request:
(1) the placement of a security freeze on the consumer's
consumer report under this section; or
(a)(2), the period during which the security freeze is to be
temporarily lifted.
(d) Not later than January 1, 2009, a consumer reporting agency
shall develop and make available to consumers secure procedures
to authorize the release of a consumer's consumer report under
subsection (a)(1), or to authorize the temporary lifting of a security
freeze under subsection (a)(2), within fifteen (15) minutes of
receiving a request under subsection (b), by any of the following
methods:
(1) Telephone.
(2) The Internet.
(3) Other electronic media, if provided by the consumer
reporting agency.
The procedures developed by a consumer reporting agency under
this subsection must require the consumer to provide the
information set forth in subsection (c).
(e) A consumer reporting agency that receives a request from a
consumer under this section shall comply with the request within
the following time frames:
(1) Not later than three (3) business days after receiving the
request, if the consumer makes the request by the method
described in section 5(a)(1) of this chapter.
(2) Not later than fifteen (15) minutes after receiving the
request, if the consumer makes the request using the method
described in section 5(a)(2) of this chapter or by any method
developed by the consumer reporting agency under subsection
(d). However, a consumer reporting agency is not required to
comply with a consumer's request within the fifteen (15)
minute time frame set forth in this subdivision if:
(A) the consumer does not provide one (1) or more of the
items listed in subsection (c); or
(B) the consumer reporting agency's ability to comply with
the request within the fifteen (15) minute time frame set
forth in this subdivision is prevented by any of the
following:
(i) An act of God, including fire, an earthquake, a
hurricane, a storm, or a similar natural disaster or
phenomenon.
(ii) Unauthorized or illegal acts by a third party,
including terrorism, sabotage, riot, vandalism, labor
strikes or disputes disrupting operations, or similar
occurrences.
(a)(3) to release a consumer report shall notify the third party
requesting the consumer report of the existence of a security freeze
as the basis for the refusal to release the consumer report to the
third party.
(c) A consumer reporting agency shall not:
(1) state; or
(2) otherwise imply;
to a third party that the consumer's security freeze under this
chapter reflects a negative credit score, history, report, or rating.
Sec. 9. (a) A security freeze remains in effect until the consumer
who requested the security freeze requests that the security freeze
be removed. A consumer who seeks to authorize a consumer
reporting agency to remove a security freeze shall request the
removal by contacting the consumer reporting agency by any
method:
(1) described in section 5(a) of this chapter; or
(2) developed by a consumer reporting agency under section
7(d) of this chapter for receiving a consumer's request to
authorize the release of a consumer report or the temporary
lifting of a security freeze.
(b) A request by a consumer under subsection (a) must include
the following:
(1) Information sufficient to identify the consumer, as
specified by the consumer reporting agency in the instructions
provided to the consumer under section 6(a)(2) of this
chapter.
(2) The unique personal identification number or password
assigned to the consumer under section 6(a)(1) or 6(a)(3) of
this chapter.
(c) Subject to subsection (d), a consumer reporting agency must
remove a security freeze within the following time frames:
(1) Not later than three (3) business days after receiving a
request under subsection (a), if the consumer makes the
request by the method described in section 5(a)(1) of this
chapter.
(2) Not later than fifteen (15) minutes after receiving a request
under subsection (a), if the consumer makes the request using
the method described in section 5(a)(2) of this chapter or by
any method developed by the consumer reporting agency
under section 7(d) of this chapter. However, a consumer
reporting agency is not required to comply with a consumer's
request within the fifteen (15) minute time frame set forth in
this subdivision if:
(A) the consumer does not provide one (1) or more of the
items listed in subsection (b); or
(B) the consumer reporting agency's ability to comply with
the request within the fifteen (15) minute time frame set
forth in this subdivision is prevented by any of the
following:
(i) An act of God, including fire, an earthquake, a
hurricane, a storm, or a similar natural disaster or
phenomenon.
(ii) Unauthorized or illegal acts by a third party,
including terrorism, sabotage, riot, vandalism, labor
strikes or disputes disrupting operations, or similar
occurrences.
(iii) An operational interruption, including an electrical
failure, an unanticipated delay in the delivery of
equipment or replacement parts, computer hardware or
software failures inhibiting response time, or similar
disruptions.
(iv) A governmental action, including an emergency
order or regulation, a judicial action, a law enforcement
action, or a similar directive.
(v) Regularly scheduled maintenance of, or updates to,
the consumer reporting agency's computer systems, if
the maintenance activities or updates occur other than
during normal business hours.
(vi) Commercially reasonable maintenance of, or repairs
to, the consumer reporting agency's computer systems,
if the maintenance activities or repairs are unexpected or
are necessitated by unanticipated conditions or
malfunctions.
(vii) For a request made by telephone, receipt of a
request under this section other than during the
consumer reporting agency's normal business hours,
including any extended business hours observed by the
consumer reporting agency. The exemption provided by
this item does not apply to a request made by a consumer
through the Internet or other electronic media. A
consumer reporting agency must comply with a request
made by a consumer through the Internet or other
electronic media within the fifteen (15) minute time
frame set forth in this subdivision, even if the request is
made at a time other than during the consumer
reporting agency's normal or extended business hours.
(d) A consumer reporting agency is not required to remove a
security freeze under this section if the consumer reporting agency
determines that the request to remove the security freeze:
(1) is materially false; or
(2) does not clearly identify the person making the request as
the consumer.
Sec. 10. The placement of a security freeze on a consumer's
consumer report does not prohibit a consumer reporting agency
from providing the consumer's consumer report to the following
persons without the authorization of the consumer:
(1) A person, including a subsidiary, an affiliate, an agent, an
assignee of a financial obligation owed by the consumer to the
person, or a prospective assignee of a financial obligation
owed by the consumer to the person in connection with the
proposed purchase of the financial obligation, to whom the
consumer owes a financial obligation in connection with any
of the following:
(A) An account, including a demand deposit account, that
the consumer has with the person, for the purpose of:
(i) reviewing the account, including activities related to
account maintenance, monitoring, credit line increases,
and account upgrades and enhancements; or
(ii) collecting the obligation owed in connection with the
account.
(B) A contract, for the purpose of collecting the obligation
owed in connection with the contract.
(C) A negotiable instrument that the consumer has issued
to the person, for the purpose of collecting the obligation
owed in connection with the negotiable instrument.
(2) A person, including a subsidiary, an affiliate, an agent, or
an assignee of a financial obligation owed by the consumer to
the person, to whom the consumer has authorized the release
of the consumer's consumer report under section 7(a)(1) of
this chapter, for the purpose of facilitating the extension of
credit or for any permissible purpose under subdivision (1).
(3) A law enforcement agency.
(4) Any person for the purpose of prescreening, as provided
in the federal Fair Credit Reporting Act (15 U.S.C. 1681 et
seq.).
(5) Any person administering a credit monitoring subscription
service to which the consumer has subscribed.
(6) The consumer, upon the consumer's request, or any other
person for the purpose of providing the consumer with a copy
of the consumer's consumer report, upon the consumer's
request.
(7) Any of the following that provides services to a consumer:
(A) An insurer licensed under IC 27.
(B) An insurance producer licensed under IC 27.
(C) An agent, a vendor, or an employee of:
(i) an insurer licensed under IC 27; or
(ii) an insurance producer licensed under IC 27;
while acting on behalf of the insurer or the insurance
producer.
Sec. 11. (a) As used in this section, "energy utility" has the
meaning set forth in IC 8-1-2.5-2.
(b) As used in this section, "specialized credit reporting tool"
means a scoring model that:
(1) is available only to an energy utility; and
(2) is used by the energy utility to validate a consumer's
identity and creditworthiness.
(c) The following persons are not required to place a security
freeze on a consumer's consumer report:
(1) A consumer reporting agency that acts only as a reseller
(as defined in 15 U.S.C. 1681a(u)) of information. However, a
consumer reporting agency must honor any security freeze
placed on a consumer's consumer report by another consumer
reporting agency.
(2) A:
(A) check services; or
(B) fraud prevention services;
company that reports on incidents of fraud or issues
authorizations for the purpose of approving or processing
negotiable instruments, electronic fund transfers, or similar
methods of payment.
(3) A deposit account information service company that issues
reports concerning account closures due to:
(A) fraud;
(B) substantial overdrafts;
(C) ATM abuse; or
(D) similar negative information concerning a consumer;
to inquiring financial institutions for use only in reviewing a
consumer's request for a deposit account at the inquiring
financial institution.
(4) A consumer reporting agency that furnishes specialized
credit reporting tools to an energy utility.
Sec. 12. (a) Except as provided in subsection (b), if a security
freeze is in place with respect to a consumer's consumer report, a
consumer reporting agency may not change any of the following
official information on the consumer's consumer report without
sending written confirmation of the change to the consumer not
later than thirty (30) days after the change is posted to the
consumer's consumer report:
(1) Name.
(2) Date of birth.
(3) Social Security number.
(4) Address.
In the case of an address change, the written confirmation required
under this section shall be sent to both the new address and the old
address.
(b) Written confirmation is not required under this section for
technical modifications of a consumer's official information,
including changes involving:
(1) the use of name or street:
(A) abbreviations; or
(B) complete spellings; or
(2) transpositions of numbers or letters in a consumer's name
or address.
Sec. 13. A consumer reporting agency shall provide to a
consumer notice with each written disclosure by the consumer
reporting agency as required under Section 609 of the federal Fair
Credit Reporting Act (15 U.S.C. 1681g) that the consumer may
place a security freeze on the consumer's consumer report. The
notice under this section must be in the following form:
"UNDER IC 24-5-24, YOU MAY OBTAIN A SECURITY
FREEZE ON YOUR CONSUMER REPORT TO PROTECT
YOUR PRIVACY AND ENSURE THAT CREDIT IS NOT
GRANTED IN YOUR NAME WITHOUT YOUR
KNOWLEDGE. THE SECURITY FREEZE WILL
PROHIBIT A CONSUMER REPORTING AGENCY FROM
RELEASING ANY INFORMATION IN YOUR CONSUMER
REPORT WITHOUT YOUR EXPRESS AUTHORIZATION
OR APPROVAL. THE SECURITY FREEZE IS DESIGNED
TO PREVENT CREDIT LOANS AND SERVICES FROM
BEING APPROVED IN YOUR NAME WITHOUT YOUR
CONSENT. WHEN YOU PLACE A SECURITY FREEZE
ON YOUR CONSUMER REPORT, WITHIN TEN (10)
BUSINESS DAYS YOU WILL BE PROVIDED A
PERSONAL IDENTIFICATION NUMBER TO USE IF YOU
CHOOSE TO REMOVE THE SECURITY FREEZE OR TO
TEMPORARILY AUTHORIZE THE RELEASE OF YOUR
CONSUMER REPORT FOR A PERIOD OF TIME OR TO
A SPECIFIC PERSON AFTER THE SECURITY FREEZE
IS IN PLACE. A SECURITY FREEZE DOES NOT APPLY
TO PERSONS OR ENTITIES LISTED IN IC 24-5-24-11. IF
YOU ARE ACTIVELY SEEKING CREDIT, YOU SHOULD
UNDERSTAND THAT THE PROCEDURES INVOLVED IN
LIFTING A SECURITY FREEZE MAY SLOW YOUR OWN
APPLICATIONS FOR CREDIT. YOU HAVE A RIGHT TO
BRING A CIVIL ACTION AGAINST SOMEONE WHO
VIOLATES YOUR RIGHTS UNDER IC 24-5-24.".
Sec. 14. A consumer reporting agency may not impose a charge
on a consumer for a request from the consumer to do any of the
following:
(1) Place a security freeze on a consumer's consumer report
under section 5 of this chapter.
(2) Issue the same or a new personal identification number or
password to a consumer under section 6 of this chapter.
(3) Release a consumer's consumer report to a third party
upon request of the consumer under section 7(a)(1) of this
chapter. In addition a consumer reporting agency may not
impose a charge on the third party to whom the consumer's
consumer report is released under section 7(a)(1) of this
chapter in connection with the release.
(4) Temporarily lift a security freeze under section 7(a)(2) of
this chapter.
(5) Remove a security freeze under section 9 of this chapter.
Sec. 15. (a) A consumer who suffers injury by an act of a
consumer reporting agency that violates this chapter may bring a
civil action against the consumer reporting agency in a circuit or
superior court in the county in which the consumer resides.
(b) A person who knowingly or intentionally fails to comply with
any requirement imposed under this chapter with respect to a
consumer is liable to that consumer in an amount equal to the sum
of the following:
(1) The greater of:
(A) the amount of actual damages sustained by the
consumer as a result of the failure to comply; or
(B) five hundred dollars ($500).
However, the amount awarded to a consumer under this
subdivision may not exceed six thousand dollars ($6,000),
regardless of the consumer's actual damages.
(2) Such punitive damages as the court may allow.
(3) In the case of a successful action by a consumer under this
section, the costs of the action together with reasonable
attorney's fees as determined by the court.
Sec. 16. (a) The attorney general may bring an action to recover
from a person on behalf of the state a civil penalty described in
subsection (b).
(b) A person who knowingly or intentionally violates this
chapter is subject to a civil penalty of:
(1) not more than two thousand five hundred dollars ($2,500)
for a violation or series of violations concerning one (1)
consumer; or
(2) not more than a total of one hundred thousand dollars
($100,000) for related violations concerning more than one (1)
consumer.
Sec. 17. The provisions of this chapter are severable as provided
in IC 1-1-1-8(b).