---

---

Citations Affected: IC 24-5.

Synopsis: Security freezes on credit files. Provides that a consumer may prevent access to the consumer's credit report, or any information derived from the consumer's credit file, by requesting that a consumer reporting agency place a security freeze in the credit file. Prohibits a consumer reporting agency from releasing any information from a credit file that is subject to a security freeze unless the consumer requests the release of the information: (1) to a specified third party; or (2) for a specified period. For a credit file subject to a security freeze, sets forth procedures for a consumer to request the: (1) release of information from the credit file; or (2) removal of the security freeze. Requires a consumer reporting agency to develop, not later than September 1, 2008, secure procedures to process, within 15 minutes of receiving a request, a telephonic or an electronic authorization from a consumer to: (1) release information from a credit file subject to a security freeze; or (2) remove a security freeze. Provides that specified persons, including utilities and licensed insurers, may receive information from a credit file that is subject to a security freeze. Provides that specified persons are not required to place a security freeze in a consumer's credit file. Makes a violation of the requirements and restrictions concerning security freezes a Class A infraction. Provides a cause of action to a consumer aggrieved by a person's negligent or willful failure to comply with the requirements and restrictions concerning security freezes.

Effective: July 1, 2007.

---

---

Micon , Bardon , Burton , Ruppel

---

---

    January 8, 2007, read first time and referred to Committee on Financial Institutions.
    February 1, 2007, amended, reported _ Do Pass.

---

---

---

PRINTING CODE. Amendments: Whenever an existing statute (or a section of the Indiana Constitution) is being amended, the text of the existing provision will appear in this style type, additions will appear in this style type, and deletions will appear in this style type.
Additions: Whenever a new statutory provision is being enacted (or a new constitutional provision adopted), the text of the new provision will appear in this style type. Also, the word NEW will appear in that style type in the introductory clause of each SECTIONls that adds a new provision to the Indiana Code or the Indiana Constitution.
Conflict reconciliation: Text in a statute in this style type or this style type reconciles conflicts between statutes enacted by the 2006 Regular Session of the General Assembly.

---

    A BILL FOR AN ACT to amend the Indiana Code concerning trade regulation.

SOURCE: IC 24-5-24; (07)HB1082.1.1. -->     SECTION 1. IC 24-5-24 IS ADDED TO THE INDIANA CODE AS A NEW CHAPTER TO READ AS FOLLOWS [EFFECTIVE JULY 1, 2007]:
    Chapter 24. Security Freezes for Credit Reports
    Sec. 1. (a) As used in this chapter, "consumer" means an individual:
        (1) whose principal residence is in Indiana; and
        (2) whose credit information and history is recorded in a credit report.
    Sec. 2. (a) As used in this chapter, "consumer reporting agency" has the meaning set forth in 15 U.S.C. 1681a(f).
    (b) The term does not include an entity designated as a commercially reasonable private consumer credit reporting entity under IC 24-4.5-7-404(5).
     Sec. 3. As used in this chapter, "credit file" means all the information concerning a consumer that is:
        (1) recorded; and

---

        (2) retained;
by a consumer reporting agency, regardless of how the information is stored.
    Sec. 4. (a) As used in this chapter, "credit report" means any communication of information that:
        (1) is made by a consumer reporting agency by written, oral, electronic, or other means;
        (2) bears on a consumer's creditworthiness, credit standing, or credit capacity;
        (3) is used, expected to be used, or collected for the purpose of serving as a factor in establishing the consumer's eligibility for:
            (A) credit or insurance to be used primarily for personal, family, or household purposes;
            (B) employment purposes; or
            (C) any other purpose authorized by 15 U.S.C. 1681b.
    (b) The term does not include any communication of information described in 15 U.S.C. 1681a(d)(2).
     Sec. 5. As used in this chapter, "credit score" has the meaning set forth in 15 U.S.C. 1681g(f)(2)(A).
     Sec. 6. As used in this chapter, "security freeze" means a notice that:
        (1) is placed in a consumer's credit file:
            (A) by a consumer reporting agency; and
            (B) at the request of the consumer; and
        (2) prohibits the consumer reporting agency from releasing the consumer's credit report or any information derived from the consumer's credit file, including any credit score calculated for the consumer, other than information that a security freeze is in effect with respect to the consumer's credit file, without the authorization of the consumer as provided under this chapter.
     Sec. 7. (a) A consumer may place a security freeze in the consumer's credit file by:
        (1) sending a written request by certified mail to a consumer reporting agency; or
        (2) making a request to a consumer reporting agency through a secure electronic mail connection provided by the consumer reporting agency.
    (b) Except as provided in section 13 of this chapter, a consumer reporting agency that receives a request under subsection (a) shall place a security freeze in the consumer's credit file not later than

five (5) business days after receipt of the request.
    Sec. 8. Not later than ten (10) business days after receiving a request for a security freeze under section 7 of this chapter, a consumer reporting agency shall issue to the consumer a written confirmation that a security freeze has been placed in the consumer's credit file. The confirmation required by this section must include the following:
        (1) A unique:
            (A) personal identification number; or
            (B) password;
        other than the consumer's Social Security number, to be used by the consumer to perform any of the acts described in subdivision (2).
        (2) Written instructions explaining how the consumer may:
            (A) release the consumer's credit report, or any information derived from the consumer's credit file, to one (1) or more specified third parties;
            (B) temporarily lift the security freeze for a specified period; or
            (C) remove the security freeze.
        (3) Written instructions explaining how the consumer may request that the consumer reporting agency issue the same or a new personal identification number or password to the consumer if the consumer:
            (A) fails to retain the original personal identification number or password issued by the consumer reporting agency under subdivision (1); or
            (B) wishes to obtain a new personal identification number or password of the consumer's own choosing.
        Upon receiving a request described in this subdivision, the consumer reporting agency shall issue the same or a new personal identification number or password to the consumer if the consumer has provided information sufficient to identify the consumer, as specified by the consumer reporting agency in the instructions provided to the consumer under this subdivision. If the consumer's request is made using a method described in section 7(a) of this chapter, the consumer reporting agency shall send, by certified mail, a written notice of the requested personal identification number or password to the consumer not later than five (5) business days after receiving the consumer's request. If the consumer's request is made using any method developed by the consumer reporting

agency under section 9(d) of this chapter, the consumer reporting agency shall issue, using the same method by which the consumer's request is made, the requested personal identification number or password not later than fifteen (15) minutes after receiving the consumer's request.
    Sec. 9. (a) Except as provided in section 12 of this chapter, if a security freeze has been placed in a consumer's credit file, the consumer reporting agency that placed the security freeze in the credit file shall not release the consumer's credit report, or any information derived from the consumer's credit file, unless the consumer authorizes the consumer credit reporting agency to:
        (1) release the consumer's credit report, or any information derived from the consumer's credit file, to one (1) or more specified third parties; or
        (2) temporarily lift the security freeze for a specified period.
    (b) A consumer who seeks to authorize the release of the consumer's credit report, or any information derived from the consumer's credit file, under subsection (a)(1) or (a)(2) shall request the release by contacting the consumer reporting agency by any method:
        (1) described in section 7(a) of this chapter; or
        (2) developed by the consumer reporting agency under subsection (d).
    (c) A request by a consumer under subsection (b) must include the following:
        (1) Information sufficient to identify the consumer, as specified by the consumer reporting agency in the instructions provided to the consumer under section 8(2) of this chapter.
        (2) The unique personal identification number or password assigned to the consumer under section 8(1) or 8(3) of this chapter.
        (3) If the consumer seeks a release of the consumer's credit report, or any information derived from the consumer's credit file, under subsection (a)(1), information sufficient to identify the parties to whom the credit report or other information is to be released, as specified by the consumer reporting agency in the instructions provided to the consumer under section 8(2) of this chapter.
        (4) If the consumer seeks to allow the release of the consumer's credit report, or any information derived from the consumer's credit file, under subsection (a)(2), the period during which the security freeze is to be temporarily lifted.

---

    (d) Not later than September 1, 2008, a consumer reporting agency shall develop secure procedures to receive and process, within fifteen (15) minutes of receiving a request, an authorization from a consumer under subsection (b) by any of the following:
        (1) Telephone.
        (2) Facsimile.
        (3) The Internet.
        (4) Other electronic media.
The procedures developed by a consumer reporting agency under this subsection must require the consumer to provide the information set forth in subsection (c).
    (e) A consumer reporting agency that receives a request from a consumer under this section shall comply with the request within the following time frames:
        (1) Not later than three (3) business days after receiving the request, if the consumer makes the request by a method described in section 7(a) of this chapter.
        (2) Not later than fifteen (15) minutes after receiving the request, if the consumer makes the request by any method developed by the consumer reporting agency under subsection (d). However, a consumer reporting agency is not required to comply with a consumer's request within the time frame set forth in this subdivision if:
            (A) the consumer does not provide one (1) or more of the items listed in subsection (c); or
            (B) the consumer reporting agency's ability to comply with the request within the time frame set forth in this subdivision is prevented by any of the following:
                (i) An act of God, including fire, an earthquake, a hurricane, a storm, or a similar natural disaster or phenomenon.
                (ii) Unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrences.
                (iii) An operational interruption, including an electrical failure, an unanticipated delay in the delivery of equipment or replacement parts, computer hardware or software failures inhibiting response time, or similar disruptions.
                (iv) A governmental action, including an emergency order or regulation, a judicial action, a law enforcement

action, or a similar directive.
                (v) Regularly scheduled maintenance of, or updates to, the consumer reporting agency's computer systems, if the maintenance activities or updates occur other than during normal business hours.
                (vi) Commercially reasonable maintenance of, or repairs to, the consumer reporting agency's computer systems, if the maintenance activities or repairs are unexpected or are necessitated by unanticipated conditions or malfunctions.
                (vii) For a request made by telephone or facsimile, receipt of a request under this section other than during the consumer reporting agency's normal business hours, including any extended business hours observed by the consumer reporting agency. The exemption provided by this item does not apply to a request made by a consumer through the Internet or other electronic media. A consumer reporting agency must comply with a request made by a consumer through the Internet or other electronic media within the time frame set forth in this subdivision, even if the request is made at a time other than during the consumer reporting agency's normal or extended business hours.
    Sec. 10. (a) A third party that requests a consumer's credit report, or any information derived from the consumer's credit file, in connection with an application by the consumer for credit shall treat the application for credit as incomplete if:
        (1) a security freeze has been placed in the consumer's credit file;
        (2) the consumer has not authorized the release of the consumer's credit report, or any information derived from the consumer's credit file, under section 9 of this chapter; and
        (3) the consumer reporting agency refuses to release the credit report, or any information derived from the consumer's credit file, to the third party based on subdivisions (1) and (2).
    (b) A consumer reporting agency that refuses under subsection (a)(3) to release a credit report, or any information derived from a consumer's credit file, shall notify the third party requesting the credit report or other information of the existence of a security freeze as the basis for the refusal to release the credit report or other information to the third party.
    Sec. 11. (a) A security freeze remains in effect until the

consumer who requested the security freeze requests that the security freeze be removed. A consumer who seeks to remove a security freeze shall request the removal by contacting the consumer reporting agency by any method:
        (1) described in section 7(a) of this chapter; or
        (2) developed by a consumer reporting agency under section 9(d) of this chapter for receiving a consumer's request to release a credit report, or any information derived from a consumer's credit file.
    (b) A request by a consumer under subsection (a) must include the following:
        (1) Information sufficient to identify the consumer, as specified by the consumer reporting agency in the instructions provided to the consumer under section 8(2) of this chapter.
        (2) The unique personal identification number or password assigned to the consumer under section 8(1) or 8(3) of this chapter.
    (c) A consumer reporting agency must remove a security freeze within the following time frames:
        (1) Not later than three (3) business days after receiving a request under subsection (a), if the consumer makes the request by a method described in section 7(a) of this chapter.
        (2) Not later than fifteen (15) minutes after receiving a request under subsection (a), if the consumer makes the request by any method developed by the consumer reporting agency under section 9(d) of this chapter. However, a consumer reporting agency is not required to comply with a consumer's request within the time frame set forth in this subdivision if:
            (A) the consumer does not provide one (1) or more of the items listed in subsection (b); or
            (B) the consumer reporting agency's ability to comply with the request within the time frame set forth in this subdivision is prevented by any of the following:
                (i) An act of God, including fire, an earthquake, a hurricane, a storm, or a similar natural disaster or phenomenon.
                (ii) Unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrences.
                (iii) An operational interruption, including an electrical failure, an unanticipated delay in the delivery of

equipment or replacement parts, computer hardware or software failures inhibiting response time, or similar disruptions.
                (iv) A governmental action, including an emergency order or regulation, a judicial action, a law enforcement action, or a similar directive.
                (v) Regularly scheduled maintenance of, or updates to, the consumer reporting agency's computer systems, if the maintenance activities or updates occur other than during normal business hours.
                (vi) Commercially reasonable maintenance of, or repairs to, the consumer reporting agency's computer systems, if the maintenance activities or repairs are unexpected or are necessitated by unanticipated conditions or malfunctions.
                (vii) For a request made by telephone or facsimile, receipt of a request under this section other than during the consumer reporting agency's normal business hours, including any extended business hours observed by the consumer reporting agency. The exemption provided by this item does not apply to a request made by a consumer through the Internet or other electronic media. A consumer reporting agency must comply with a request made by a consumer through the Internet or other electronic media within the time frame set forth in this subdivision, even if the request is made at a time other than during the consumer reporting agency's normal or extended business hours.
    Sec. 12. (a) As used in this section, "person" includes:
        (1) a subsidiary;
        (2) an affiliate;
        (3) an agent; or
        (4) an assignee;
of the person.
    (b) The placement of a security freeze in a consumer's credit file does not prohibit a consumer reporting agency from providing the consumer's credit report, or any information derived from the consumer's credit file, to the following persons without the authorization of the consumer:
        (1) A person to whom the consumer owes a financial obligation in connection with any of the following:
            (A) An account, including a demand deposit account, that

the consumer has with the person, for the purpose of:
                (i) reviewing the account, including activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements; or
                (ii) collecting the obligation owed in connection with the account.
            (B) A contract, for the purpose of collecting the obligation owed in connection with the contract.
            (C) A negotiable instrument that the consumer has issued to the person, for the purpose of collecting the obligation owed in connection with the negotiable instrument.
        (2) A person to whom the consumer has released the consumer's credit report under section 9(a)(1) of this chapter.
        (3) Any:
            (A) agency of the state or of a political subdivision of the state, including a state or local child support enforcement agency (as defined in 15 U.S.C. 1681a(j)(2));
            (B) law enforcement agency;
            (C) court; or
            (D) collection agency;
        acting under a court order, warrant, or subpoena.
        (4) Any person for the purpose of prescreening, as provided in the federal Fair Credit Reporting Act (15 U.S.C. 1681 et seq.).
        (5) Any person administering a credit monitoring subscription service to which the consumer has subscribed.
        (6) The consumer, upon the consumer's request, or any other person for the purpose of providing the consumer with a copy of the consumer's credit report, or any information derived from the consumer's credit file, upon the consumer's request.
        (7) Any of the following that uses specialized credit reporting tools to validate a consumer's identity or to establish a consumer's creditworthiness:
            (A) A public utility.
            (B) A municipally owned utility.
            (C) A rural electric membership corporation organized under IC 8-1-13.
            (D) A corporation organized under IC 23-17 that is an electric cooperative and that has at least one (1) member that is a corporation organized under IC 8-1-13.
            (E) An energy utility (as defined in IC 8-1-2.5-2) or an affiliate of an energy utility.

---

         (8) Any of the following that provides services to a consumer:
            (A) An insurer licensed under IC 27.
            (B) An insurance producer licensed under IC 27.
            (C) An agent, a vendor, or an employee of:
                (i) an insurer licensed under IC 27; or
                (ii) an insurance producer licensed under IC 27;
             while acting on behalf of the insurer or the insurance producer.
    Sec. 13. The following persons are not required to place a security freeze in a consumer's credit file:
        (1) A consumer reporting agency that acts only as a reseller (as defined in 15 U.S.C. 1681a(u)) of information. However, a consumer reporting agency must honor any security freeze placed in a consumer's credit file by another consumer reporting agency.
        (2) A:
            (A) check services; or
            (B) fraud prevention services;
        company that reports on incidents of fraud or issues authorizations for the purpose of approving or processing negotiable instruments, electronic fund transfers, or similar methods of payment.
         (3) A deposit account information service company that issues reports concerning account closures due to:
            (A) fraud;
            (B) substantial overdrafts;
            (C) ATM abuse; or
            (D) similar negative information concerning a consumer;
        to inquiring financial institutions for use only in reviewing a consumer's request for a deposit account at the inquiring financial institution.
    Sec. 14. (a) Except as provided in subsection (b), if a security freeze is in place with respect to a consumer's credit file, a consumer reporting agency may not change any of the following official information in the consumer's credit file without sending written confirmation of the change to the consumer not later than thirty (30) days after the change is posted to the consumer's credit file:
        (1) Name.
        (2) Date of birth.
        (3) Social Security number.
        (4) Address.

---

In the case of an address change, the written confirmation required under this section shall be sent to both the new address and the old address.
    (b) Written confirmation is not required under this section for technical modifications of a consumer's official information, including changes involving:
        (1) the use of name or street:
            (A) abbreviations; or
            (B) complete spellings; or
        (2) transpositions of numbers or letters in a consumer's name or address.
     Sec. 15. A consumer reporting agency may not impose a charge for:
        (1) placing a security freeze in a consumer's credit file under section 7 of this chapter;
        (2) issuing the same or a new personal identification number or password to a consumer under section 8 of this chapter;
        (3) releasing a consumer's credit report, or any information derived from a consumer's credit file, to a third party upon request of the consumer under section 9(a)(1) of this chapter;
        (4) temporarily lifting a security freeze under section 9(a)(2) of this chapter; or
        (5) removing a security freeze under section 11 of this chapter.
     Sec. 16. A person who violates this chapter commits a Class A infraction. Each violation of this chapter constitutes a separate offense.
     Sec. 17. (a) Any person who is negligent in failing to comply with this chapter with respect to a consumer is liable to the consumer in an amount equal to the sum of:
        (1) an amount equal to the greater of:
            (A) the damages actually suffered by the consumer as a result of the person's negligence; or
            (B) five hundred dollars ($500); and
        (2) in the case of a successful action by a consumer under this section, the costs of the action, plus reasonable attorney's fees as determined by the court.
An action under this section must be brought in the circuit or superior court of the aggrieved consumer's county of residence.
     (b) If a court finds that an unsuccessful pleading, motion, or other paper filed in connection with an action under this section was filed in bad faith or for purposes of harassment, the court may

award to the prevailing party attorney's fees that are reasonable in relation to the work expended in responding to the pleading, motion, or other paper.
    Sec. 18. (a) Any person who willfully fails to comply with the requirements of this chapter with respect to a consumer is liable to the consumer in an amount equal to the sum of:
        (1) an amount equal to the greater of:
            (A) three (3) times the damages actually suffered by the consumer as a result of the person's willful failure to comply; or
            (B) one thousand dollars ($1,000); and
        (2) in the case of a successful action by a consumer under this section, the costs of the action, plus reasonable attorney's fees as determined by the court.
An action under this section must be brought in the circuit or superior court of the aggrieved consumer's county of residence.
    (b) If a court finds that an unsuccessful pleading, motion, or other paper filed in connection with an action under this section was filed in bad faith or for purposes of harassment, the court may award to the prevailing party attorney's fees that are reasonable in relation to the work expended in responding to the pleading, motion, or other paper.
     Sec. 19. The provisions of this chapter are severable as provided in IC 1-1-1-8(b).