Reprinted

April 10, 2007





ENGROSSED

SENATE BILL No. 403

_____


DIGEST OF SB 403 (Updated April 9, 2007 9:44 pm - DI 114)



Citations Affected: IC 24-5.

Synopsis: Freezing of consumer reports. Provides that a consumer may prevent access to the consumer's consumer report by requesting that a consumer reporting agency place a security freeze on the consumer report. Requires a consumer reporting agency to develop and make available to consumers, not later than January 1, 2009, a secure electronic mail connection by which a consumer can request: (1) the placement of a security freeze; or (2) the same or a new personal identification number or password for use in releasing a report subject to a freeze to a third party, or in temporarily lifting a security freeze. Prohibits a consumer reporting agency from releasing any information from a consumer report that is subject to a security freeze unless the consumer requests: (1) the release of the report to a specified third party; or (2) the temporary lifting of the freeze for a specified period. For a consumer report subject to a security freeze, sets forth procedures
(Continued next page)


Effective: September 1, 2007.





Dillon , Boots , Hershman,
Lanane, Tallian, Drozda, Miller
(HOUSE SPONSORS _ MICON, WALORSKI, BARDON, SUMMERS)




    January 11, 2007, read first time and referred to Committee on Corrections, Criminal, and Civil Matters.
    February 22, 2007, amended, reported favorably _ Do Pass.
    February 26, 2007, read second time, amended, ordered engrossed. Engrossed.
    February 27, 2007, read third time, passed. Yeas 47, nays 0.

HOUSE ACTION

    March 6, 2007, read first time and referred to Committee on Financial Institutions.
    April 3, 2007, amended, reported _ Do Pass.
    April 9, 2007, read second time, amended, ordered engrossed.





Digest Continued

for a consumer to request the: (1) release of the report to a third party; (2) temporary lifting of the freeze for specified period; or (3) removal of the freeze. Requires a consumer reporting agency to develop and make available to consumers, not later than January 1, 2009, secure procedures to process, within 15 minutes of receiving a request, a telephonic or an electronic authorization from a consumer to: (1) release a consumer report subject to a security freeze; (2) temporarily lift a security freeze; or (3) remove a security freeze. Provides that specified persons may receive information from a consumer report that is subject to a security freeze, including licensed insurers. Provides that specified persons are not required to place a security freeze on a consumer's consumer report, including consumer reporting agencies that furnish specialized credit reporting tools to energy utilities. Requires a consumer reporting agency to provide a consumer written notice, in connection with certain required disclosures, that the consumer may place a security freeze on the consumer's consumer report. Prohibits a consumer reporting agency from imposing a charge on a consumer for a request from the consumer to do any of the following: (1) Place a security freeze on the consumer's consumer report. (2) Release the consumer's consumer report to a specified person, if the report is subject to a security freeze. (3) Temporarily lift a security freeze. (4) Remove a security freeze. (5) Issue a personal identification number or password for use by the consumer in releasing information from a frozen consumer report, lifting a security freeze, or removing a security freeze. Prohibits a consumer reporting agency from imposing a charge on a third party to whom a consumer's consumer report is released at the request of the consumer. Provides a cause of action to a consumer aggrieved by a consumer reporting agency's knowing or intentional violation of the provisions concerning security freezes. Allows the attorney general to bring an action to recover a civil penalty from a person who knowingly or intentionally violates the provisions concerning security freezes.


Reprinted

April 10, 2007

First Regular Session 115th General Assembly (2007)


PRINTING CODE. Amendments: Whenever an existing statute (or a section of the Indiana Constitution) is being amended, the text of the existing provision will appear in this style type, additions will appear in this style type, and deletions will appear in this style type.
Additions: Whenever a new statutory provision is being enacted (or a new constitutional provision adopted), the text of the new provision will appear in this style type. Also, the word NEW will appear in that style type in the introductory clause of each SECTION that adds a new provision to the Indiana Code or the Indiana Constitution.
Conflict reconciliation: Text in a statute in this style type or this style type reconciles conflicts between statutes enacted by the 2006 Regular Session of the General Assembly.


ENGROSSED

SENATE BILL No. 403



    A BILL FOR AN ACT to amend the Indiana Code concerning trade regulation.

Be it enacted by the General Assembly of the State of Indiana:

SOURCE: IC 24-5-24; (07)ES0403.2.1. -->     SECTION 1. IC 24-5-24 IS ADDED TO THE INDIANA CODE AS A NEW CHAPTER TO READ AS FOLLOWS [EFFECTIVE SEPTEMBER 1, 2007]:
     Chapter 24. Security Freezes for Consumer Reports
    Sec. 1. (a) As used in this chapter, "consumer" means an individual:
        (1) whose principal residence is in Indiana; and
        (2) whose credit information and history is recorded in a consumer report.
    Sec. 2. (a) As used in this chapter, "consumer report" means any written, oral, or other communication of any information that:
        (1) is made by a consumer reporting agency;
        (2) bears on a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living; and
        (3) is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing a

consumer's eligibility for credit to be used primarily for personal, family, or household purposes.
    (b) The term includes a consumer's credit score.
    Sec. 3. (a) As used in this chapter, "consumer reporting agency" means any person that, for monetary fees or dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating information concerning a consumer's credit or other information for the purpose of furnishing a consumer report to another person.
    (b) The term does not include an entity designated as a commercially reasonable private consumer credit reporting entity under IC 24-4.5-7-404(5).
    Sec. 4. As used in this chapter, "security freeze" means a designation placed on a consumer's consumer report:
        (1) by a consumer reporting agency; and
        (2) at the request of the consumer;
that prohibits the consumer reporting agency from releasing the consumer report without the authorization of the consumer.
    Sec. 5. (a) A consumer may place a security freeze on the consumer's consumer report by:
        (1) sending a written request by United States mail to an address designated by the consumer reporting agency; or
        (2) subject to subsection (d), making a request to a consumer reporting agency through a secure electronic mail connection provided by the consumer reporting agency.
    (b) Except as provided in subsection (c) and section 11 of this chapter, a consumer reporting agency that receives a request under subsection (a) shall place a security freeze on the consumer's consumer report not later than five (5) business days after receipt of the request.
    (c) A consumer reporting agency is not required to place a security freeze on a consumer report under this section if the consumer reporting agency determines that the request for a security freeze:
        (1) is materially false; or
        (2) does not clearly identify the person making the request as the consumer.
    (d) Not later than January 1, 2009, a consumer reporting agency shall develop and make available to consumers a secure electronic mail connection by which a consumer can request:
        (1) the placement of a security freeze on the consumer's consumer report under this section; or


        (2) the same or a new personal identification number or password under section 6(b) of this chapter.
    Sec. 6. (a) Not later than ten (10) business days after receiving a request for a security freeze under section 5 of this chapter, a consumer reporting agency shall issue to the consumer a written confirmation that a security freeze has been placed on the consumer's consumer report. The confirmation required by this section must include the following:
        (1) A unique:
            (A) personal identification number; or
            (B) password;
        other than the consumer's Social Security number, or any multiple digit segment of the consumer's Social Security number, to be used by the consumer to perform any of the acts described in subdivision (2).
        (2) Written instructions explaining how the consumer may:
            (A) release the consumer's consumer report to one (1) or more specified third parties;
            (B) temporarily lift the security freeze for a specified period; or
            (C) remove the security freeze.
        (3) Written instructions explaining how the consumer may request, using one (1) of the methods described in section 5(a) of this chapter, that the consumer reporting agency issue the same or a new personal identification number or password to the consumer if the consumer fails to retain the original personal identification number or password issued by the consumer reporting agency under subdivision (1).
    (b) Upon receiving a request described in subsection (a) (3), the consumer reporting agency shall issue the same or a new personal identification number or password to the requesting consumer if the consumer has provided information sufficient to identify the consumer, as specified by the consumer reporting agency in the instructions provided to the consumer under subsection (a)(3). If the consumer's request is made using the method described in section 5(a)(1) of this chapter, the consumer reporting agency shall send, by United States mail, the personal identification number or password to the consumer not later than five (5) business days after receiving the consumer's request. If the consumer's request is made using the method described in section 5(a)(2) of this chapter, the consumer reporting agency shall issue the personal identification number or password not later than:
        (1) subject to the exceptions set forth in sections 7(e)(2) and 9(c)(2) of this chapter, as applicable, fifteen (15) minutes after receiving the request, if the consumer reporting agency elects to issue the personal identification number or password by a secure electronic mail connection provided by the consumer reporting agency under section 5(d) of this chapter; or
        (2) five (5) business days after receiving the request, if the consumer reporting agency elects to issue the personal identification number or password by United States mail.
    Sec. 7. (a) Except as provided in section 10 of this chapter, if a security freeze has been placed on a consumer's consumer report, the consumer reporting agency that placed the security freeze on the consumer report shall not release the consumer's consumer report unless the consumer authorizes the consumer reporting agency to:
        (1) release the consumer's consumer report to one (1) or more specified third parties; or
        (2) temporarily lift the security freeze for a specified period.
    (b) A consumer who seeks to authorize the release of the consumer's consumer report under subsection (a)(1) or (a)(2) shall request the release by contacting the consumer reporting agency by any method:
        (1) described in section 5(a) of this chapter; or
        (2) developed by the consumer reporting agency under subsection (d).
    (c) A request by a consumer under subsection (b) must include the following:
        (1) Information sufficient to identify the consumer, as specified by the consumer reporting agency in the instructions provided to the consumer under section 6(a)(2) of this chapter.
        (2) The unique personal identification number or password assigned to the consumer under section 6(a)(1) or 6(a)(3) of this chapter.
        (3) If the consumer seeks to authorize the release of the consumer's consumer report under subsection (a)(1), information sufficient to identify the parties to whom the consumer report is to be released, as specified by the consumer reporting agency in the instructions provided to the consumer under section 6(a)(2) of this chapter.
        (4) If the consumer seeks to authorize the consumer reporting agency to temporarily lift a security freeze under subsection

(a)(2), the period during which the security freeze is to be temporarily lifted.
    (d) Not later than January 1, 2009, a consumer reporting agency shall develop and make available to consumers secure procedures to authorize the release of a consumer's consumer report under subsection (a)(1), or to authorize the temporary lifting of a security freeze under subsection (a)(2), within fifteen (15) minutes of receiving a request under subsection (b), by any of the following methods:
        (1) Telephone.
        (2) The Internet.
        (3) Other electronic media, if provided by the consumer reporting agency.
The procedures developed by a consumer reporting agency under this subsection must require the consumer to provide the information set forth in subsection (c).
    (e) A consumer reporting agency that receives a request from a consumer under this section shall comply with the request within the following time frames:
        (1) Not later than three (3) business days after receiving the request, if the consumer makes the request by the method described in section 5(a)(1) of this chapter.
        (2) Not later than fifteen (15) minutes after receiving the request, if the consumer makes the request using the method described in section 5(a)(2) of this chapter or by any method developed by the consumer reporting agency under subsection (d). However, a consumer reporting agency is not required to comply with a consumer's request within the fifteen (15) minute time frame set forth in this subdivision if:
            (A) the consumer does not provide one (1) or more of the items listed in subsection (c); or
            (B) the consumer reporting agency's ability to comply with the request within the fifteen (15) minute time frame set forth in this subdivision is prevented by any of the following:
                (i) An act of God, including fire, an earthquake, a hurricane, a storm, or a similar natural disaster or phenomenon.
                (ii) Unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrences.


                (iii) An operational interruption, including an electrical failure, an unanticipated delay in the delivery of equipment or replacement parts, computer hardware or software failures inhibiting response time, or similar disruptions.
                (iv) A governmental action, including an emergency order or regulation, a judicial action, a law enforcement action, or a similar directive.
                (v) Regularly scheduled maintenance of, or updates to, the consumer reporting agency's computer systems, if the maintenance activities or updates occur other than during normal business hours.
                (vi) Commercially reasonable maintenance of, or repairs to, the consumer reporting agency's computer systems, if the maintenance activities or repairs are unexpected or are necessitated by unanticipated conditions or malfunctions.
                (vii) For a request made by telephone, receipt of a request under this section other than during the consumer reporting agency's normal business hours, including any extended business hours observed by the consumer reporting agency. The exemption provided by this item does not apply to a request made by a consumer through the Internet or other electronic media. A consumer reporting agency must comply with a request made by a consumer through the Internet or other electronic media within the fifteen (15) minute time frame set forth in this subdivision, even if the request is made at a time other than during the consumer reporting agency's normal or extended business hours.
    Sec. 8. (a) A third party that requests a consumer's consumer report in connection with an application by the consumer for credit shall treat the application for credit as incomplete if:
        (1) a security freeze has been placed on the consumer's consumer report;
        (2) the consumer has not authorized the release of the consumer's consumer report under section 7 of this chapter; and
        (3) the consumer reporting agency refuses to release the consumer report to the third party based on subdivisions (1) and (2).
    (b) A consumer reporting agency that refuses under subsection

(a)(3) to release a consumer report shall notify the third party requesting the consumer report of the existence of a security freeze as the basis for the refusal to release the consumer report to the third party.
    (c) A consumer reporting agency shall not:
        (1) state; or
        (2) otherwise imply;
to a third party that the consumer's security freeze under this chapter reflects a negative credit score, history, report, or rating.
    Sec. 9. (a) A security freeze remains in effect until the consumer
who requested the security freeze requests that the security freeze be removed. A consumer who seeks to authorize a consumer reporting agency to remove a security freeze shall request the removal by contacting the consumer reporting agency by any method:
        (1) described in section 5(a) of this chapter; or
        (2) developed by a consumer reporting agency under section 7(d) of this chapter for receiving a consumer's request to authorize the release of a consumer report or the temporary lifting of a security freeze.
    (b) A request by a consumer under subsection (a) must include the following:
        (1) Information sufficient to identify the consumer, as specified by the consumer reporting agency in the instructions provided to the consumer under section 6(a)(2) of this chapter.
        (2) The unique personal identification number or password assigned to the consumer under section 6(a)(1) or 6(a)(3) of this chapter.
    (c) Subject to subsection (d), a consumer reporting agency must remove a security freeze within the following time frames:
        (1) Not later than three (3) business days after receiving a request under subsection (a), if the consumer makes the request by the method described in section 5(a)(1) of this chapter.
        (2) Not later than fifteen (15) minutes after receiving a request under subsection (a), if the consumer makes the request using the method described in section 5(a)(2) of this chapter or by any method developed by the consumer reporting agency under section 7(d) of this chapter. However, a consumer reporting agency is not required to comply with a consumer's request within the fifteen (15) minute time frame set forth in

this subdivision if:
            (A) the consumer does not provide one (1) or more of the items listed in subsection (b); or
            (B) the consumer reporting agency's ability to comply with the request within the fifteen (15) minute time frame set forth in this subdivision is prevented by any of the following:
                (i) An act of God, including fire, an earthquake, a hurricane, a storm, or a similar natural disaster or phenomenon.
                (ii) Unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrences.
                (iii) An operational interruption, including an electrical failure, an unanticipated delay in the delivery of equipment or replacement parts, computer hardware or software failures inhibiting response time, or similar disruptions.
                (iv) A governmental action, including an emergency order or regulation, a judicial action, a law enforcement action, or a similar directive.
                (v) Regularly scheduled maintenance of, or updates to, the consumer reporting agency's computer systems, if the maintenance activities or updates occur other than during normal business hours.
                (vi) Commercially reasonable maintenance of, or repairs to, the consumer reporting agency's computer systems, if the maintenance activities or repairs are unexpected or are necessitated by unanticipated conditions or malfunctions.
                (vii) For a request made by telephone, receipt of a request under this section other than during the consumer reporting agency's normal business hours, including any extended business hours observed by the consumer reporting agency. The exemption provided by this item does not apply to a request made by a consumer through the Internet or other electronic media. A consumer reporting agency must comply with a request made by a consumer through the Internet or other electronic media within the fifteen (15) minute time frame set forth in this subdivision, even if the request is

made at a time other than during the consumer reporting agency's normal or extended business hours.
    (d) A consumer reporting agency is not required to remove a security freeze under this section if the consumer reporting agency determines that the request to remove the security freeze:
        (1) is materially false; or
        (2) does not clearly identify the person making the request as the consumer.
    Sec. 10. The placement of a security freeze on a consumer's consumer report does not prohibit a consumer reporting agency from providing the consumer's consumer report to the following persons without the authorization of the consumer:
        (1) A person, including a subsidiary, an affiliate, an agent, an assignee of a financial obligation owed by the consumer to the person, or a prospective assignee of a financial obligation owed by the consumer to the person in connection with the proposed purchase of the financial obligation, to whom the consumer owes a financial obligation in connection with any of the following:
            (A) An account, including a demand deposit account, that the consumer has with the person, for the purpose of:
                (i) reviewing the account, including activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements; or
                (ii) collecting the obligation owed in connection with the account.
            (B) A contract, for the purpose of collecting the obligation owed in connection with the contract.
            (C) A negotiable instrument that the consumer has issued to the person, for the purpose of collecting the obligation owed in connection with the negotiable instrument.
        (2) A person, including a subsidiary, an affiliate, an agent, or an assignee of a financial obligation owed by the consumer to the person, to whom the consumer has authorized the release of the consumer's consumer report under section 7(a)(1) of this chapter, for the purpose of facilitating the extension of credit or for any permissible purpose under subdivision (1).
        (3) A law enforcement agency.
        (4) Any person for the purpose of prescreening, as provided in the federal Fair Credit Reporting Act (15 U.S.C. 1681 et seq.).
        (5) Any person administering a credit monitoring subscription

service to which the consumer has subscribed.
        (6) The consumer, upon the consumer's request, or any other person for the purpose of providing the consumer with a copy of the consumer's consumer report, upon the consumer's request.

         (7) Any of the following that provides services to a consumer:
            (A) An insurer licensed under IC 27.
            (B) An insurance producer licensed under IC 27.
            (C) An agent, a vendor, or an employee of:
                (i) an insurer licensed under IC 27; or
                (ii) an insurance producer licensed under IC 27;

             while acting on behalf of the insurer or the insurance producer.
    Sec. 11. (a) As used in this section, "energy utility" has the meaning set forth in IC 8-1-2.5-2.
    (b) As used in this section, "specialized credit reporting tool" means a scoring model that:
        (1) is available only to an energy utility; and
        (2) is used by the energy utility to validate a consumer's identity and creditworthiness.
    (c) The following persons are not required to place a security freeze on a consumer's consumer report:
        (1) A consumer reporting agency that acts only as a reseller (as defined in 15 U.S.C. 1681a(u)) of information. However, a consumer reporting agency must honor any security freeze placed on a consumer's consumer report by another consumer reporting agency.
        (2) A:
            (A) check services; or
            (B) fraud prevention services;
        company that reports on incidents of fraud or issues authorizations for the purpose of approving or processing negotiable instruments, electronic fund transfers, or similar methods of payment
.
         (3) A deposit account information service company that issues reports concerning account closures due to:
            (A) fraud;
            (B) substantial overdrafts;
            (C) ATM abuse; or
            (D) similar negative information concerning a consumer;
        to inquiring financial institutions for use only in reviewing a consumer's request for a deposit account at the inquiring

financial institution.
        (4) A consumer reporting agency that furnishes specialized credit reporting tools to an energy utility.
    Sec. 12. (a) Except as provided in subsection (b), if a security freeze is in place with respect to a consumer's consumer report, a consumer reporting agency may not change any of the following official information on the consumer's consumer report without sending written confirmation of the change to the consumer not later than thirty (30) days after the change is posted to the consumer's consumer report:
        (1) Name.
        (2) Date of birth.
        (3) Social Security number.
        (4) Address.
In the case of an address change, the written confirmation required under this section shall be sent to both the new address and the old address.
    (b) Written confirmation is not required under this section for technical modifications of a consumer's official information, including changes involving:
        (1) the use of name or street:
            (A) abbreviations; or
            (B) complete spellings; or
        (2) transpositions of numbers or letters in a consumer's name or address.
    Sec. 13. A consumer reporting agency shall provide to a consumer notice with each written disclosure by the consumer reporting agency as required under Section 609 of the federal Fair Credit Reporting Act (15 U.S.C. 1681g) that the consumer may place a security freeze on the consumer's consumer report. The notice under this section must be in the following form:
        "UNDER IC 24-5-24, YOU MAY OBTAIN A SECURITY FREEZE ON YOUR CONSUMER REPORT TO PROTECT YOUR PRIVACY AND ENSURE THAT CREDIT IS NOT GRANTED IN YOUR NAME WITHOUT YOUR KNOWLEDGE. THE SECURITY FREEZE WILL PROHIBIT A CONSUMER REPORTING AGENCY FROM RELEASING ANY INFORMATION IN YOUR CONSUMER REPORT WITHOUT YOUR EXPRESS AUTHORIZATION OR APPROVAL. THE SECURITY FREEZE IS DESIGNED TO PREVENT CREDIT LOANS AND SERVICES FROM BEING APPROVED IN YOUR NAME WITHOUT YOUR

CONSENT. WHEN YOU PLACE A SECURITY FREEZE ON YOUR CONSUMER REPORT, WITHIN TEN (10) BUSINESS DAYS YOU WILL BE PROVIDED A PERSONAL IDENTIFICATION NUMBER TO USE IF YOU CHOOSE TO REMOVE THE SECURITY FREEZE OR TO TEMPORARILY AUTHORIZE THE RELEASE OF YOUR CONSUMER REPORT FOR A PERIOD OF TIME OR TO A SPECIFIC PERSON AFTER THE SECURITY FREEZE IS IN PLACE. A SECURITY FREEZE DOES NOT APPLY TO PERSONS OR ENTITIES LISTED IN IC 24-5-24-11. IF YOU ARE ACTIVELY SEEKING CREDIT, YOU SHOULD UNDERSTAND THAT THE PROCEDURES INVOLVED IN LIFTING A SECURITY FREEZE MAY SLOW YOUR OWN APPLICATIONS FOR CREDIT. YOU HAVE A RIGHT TO BRING A CIVIL ACTION AGAINST SOMEONE WHO VIOLATES YOUR RIGHTS UNDER IC 24-5-24.".
     Sec. 14. A consumer reporting agency may not impose a charge on a consumer for a request from the consumer to do any of the following:
        (1) Place a security freeze on a consumer's consumer report under section 5 of this chapter.
        (2) Issue the same or a new personal identification number or password to a consumer under section 6 of this chapter.
        (3) Release a consumer's consumer report to a third party upon request of the consumer under section 7(a)(1) of this chapter. In addition a consumer reporting agency may not impose a charge on the third party to whom the consumer's consumer report is released under section 7(a)(1) of this chapter in connection with the release.
        (4) Temporarily lift a security freeze under section 7(a)(2) of this chapter.
        (5) Remove a security freeze under section 9 of this chapter.

     Sec. 15. (a) A consumer who suffers injury by an act of a consumer reporting agency that violates this chapter may bring a civil action against the consumer reporting agency in a circuit or superior court in the county in which the consumer resides.
    (b) A person who knowingly or intentionally fails to comply with any requirement imposed under this chapter with respect to a consumer is liable to that consumer in an amount equal to the sum of the following:
        (1) The greater of:
            (A) the amount of actual damages sustained by the

consumer as a result of the failure to comply; or
            (B) five hundred dollars ($500).
        However, the amount awarded to a consumer under this subdivision may not exceed six thousand dollars ($6,000), regardless of the consumer's actual damages.
        (2) Such punitive damages as the court may allow.
        (3) In the case of a successful action by a consumer under this section, the costs of the action together with reasonable attorney's fees as determined by the court.
    Sec. 16. (a) The attorney general may bring an action to recover from a person on behalf of the state a civil penalty described in subsection (b).
    (b) A person who knowingly or intentionally violates this chapter is subject to a civil penalty of:
        (1) not more than two thousand five hundred dollars ($2,500) for a violation or series of violations concerning one (1) consumer; or
        (2) not more than a total of one hundred thousand dollars ($100,000) for related violations concerning more than one (1) consumer.

     Sec. 17. The provisions of this chapter are severable as provided in IC 1-1-1-8(b).