Introduced Version




HOUSE BILL No. 1609

_____


DIGEST OF INTRODUCED BILL



Citations Affected: IC 24-5-24; IC 34-11-2-13.

Synopsis: Freezing of credit reports. Provides that a consumer may prevent access to the consumer's credit report by requesting that the consumer reporting agency place a security freeze on the consumer's credit report. Imposes other requirements and restrictions. Provides that: (1) a consumer reporting agency may furnish a consumer's identifying information only to certain persons; (2) a consumer may bring a civil action against a consumer reporting agency for injury caused to the consumer by the consumer reporting agency's violation of the law; and (3) the attorney general may bring an action to recover a civil penalty of $2,500 for a knowing or intentional violation or series of violations concerning one consumer and not more than a total of $100,000 for knowing or intentional violations of the security freeze law for related violations concerning more than one consumer.

Effective: July 1, 2007.



Elrod, Walorski


    January 23, 2007, read first time and referred to Committee on Financial Institutions.




Introduced

First Regular Session 115th General Assembly (2007)


PRINTING CODE. Amendments: Whenever an existing statute (or a section of the Indiana Constitution) is being amended, the text of the existing provision will appear in this style type, additions will appear in this style type, and deletions will appear in this style type.
Additions: Whenever a new statutory provision is being enacted (or a new constitutional provision adopted), the text of the new provision will appear in this style type. Also, the word NEW will appear in that style type in the introductory clause of each SECTION that adds a new provision to the Indiana Code or the Indiana Constitution.
Conflict reconciliation: Text in a statute in this style type or this style type reconciles conflicts between statutes enacted by the 2006 Regular Session of the General Assembly.

HOUSE BILL No. 1609


    A BILL FOR AN ACT to amend the Indiana Code concerning trade regulation.

Be it enacted by the General Assembly of the State of Indiana:

SOURCE: IC 24-5-24; (07)IN1609.1.1. -->     SECTION 1. IC 24-5-24 IS ADDED TO THE INDIANA CODE AS A NEW CHAPTER TO READ AS FOLLOWS [EFFECTIVE JULY 1, 2007]:
     Chapter 24. Security Freeze for Credit Reports; Identifying Information
    Sec. 1. As used in this chapter, "consumer" means a person whose credit information and history are recorded in a consumer report.
    Sec. 2. As used in this chapter, "consumer report" has the meaning set forth in 15 U.S.C. 1681a.
     Sec. 3. As used in this chapter, "consumer reporting agency" means an entity that:
        (1) for a fee; or
        (2) on a cooperative nonprofit basis;
assembles or evaluates consumer credit information or other information regarding a consumer for the purpose of furnishing a consumer report to a third party.
     Sec. 4. As used in this chapter, "credit header information" means information collected or recorded by a consumer reporting agency concerning:
        (1) the Social Security number of a consumer; or
        (2) any other identifying information relating to a consumer that the consumer reporting agency obtained using any nonpublic personal information.
The term does not include the name, address, or telephone number of a consumer if the information is listed in a residential telephone directory that is available to the public.
     Sec. 5. As used in this chapter, "security freeze" means a designation placed on a consumer's consumer report:
        (1) by a consumer reporting agency; and
        (2) at the request of the consumer;
that prohibits the consumer reporting agency from releasing the consumer report without the authorization of the consumer.
     Sec. 6. A security freeze on a consumer's consumer report does not prohibit the consumer reporting agency from providing the consumer report to the following persons or entities without the authorization of the consumer:
        (1) A state or local unit of government.
        (2) A law enforcement agency.
        (3) A creditor of the consumer, including an assignee or a purchaser of the consumer's debt, for use in recovering the outstanding debt of the consumer.
         (4) The consumer.
         (5) An insurer or insurance producer licensed under IC 27 and the agents, vendors, or employees of the insurer or insurance producer that are providing services to a consumer.
     Sec. 7. (a) A consumer may place a security freeze on the consumer's consumer report by:
        (1) making a request through a contact method established by the consumer reporting agency under section 8 of this chapter; and
        (2) paying a fee required by the consumer reporting agency under section 16 of this chapter;
to a consumer reporting agency.
    (b) Subject to subsection (c), a consumer reporting agency that receives a request under subsection (a) shall place a security freeze on the consumer's consumer report not later than five (5) business days after receipt of the request.
     (c) A consumer reporting agency is not required to place a

security freeze on a consumer report under this section if the consumer reporting agency determines that the request for a security freeze:
        (1) is incomplete;
        (2) is materially false; or
        (3) does not clearly identify the person making the request as the consumer.
     Sec. 8. (a) A consumer reporting agency shall develop a contact method to receive and process a consumer request to place, remove, or temporarily remove a security freeze.
    (b) A contact method under subsection (a) may include:
        (1) a postal address for certified mail;
        (2) a process by which a consumer may make a request by telephone; or
        (3) an electronic method established by the consumer reporting agency, including the use of facsimile (fax) transmission, the Internet, or other electronic means.
    Sec. 9. If a security freeze has been placed on a consumer report, the consumer reporting agency may require a person or an entity described in section 6 of this chapter to provide information to the consumer reporting agency confirming the identity of the person or entity before releasing the consumer report to the person or entity.
    Sec. 10. A consumer reporting agency that receives a truthful and complete request for a security freeze shall, not later than ten (10) business days after receipt of the request, issue to the consumer requesting the security freeze:
        (1) a unique personal identification number; and
        (2) written information explaining how to:
            (A) remove a security freeze; and
            (B) allow access to a consumer report:
                (i) for a specified period; and
                (ii) by a specified third party.
    Sec. 11. (a) Except as provided in section 6 of this chapter, if a security freeze has been placed on a consumer's consumer report, the consumer reporting agency that placed the security freeze on the consumer report shall not release the consumer report unless the consumer reporting agency receives authorization from the consumer.
     (b) For purposes of subsection (a), a consumer gives authorization to release the consumer's consumer report if the consumer provides the consumer's unique personal identification

number to the consumer reporting agency:
        (1) in conjunction with a request by the consumer to allow access to the consumer's consumer report:
            (A) for a specified period; or
            (B) to a specific third party; and
        (2) in the manner established by the consumer reporting agency under section 8 of this chapter.
     Sec. 12. (a) A third party that requests a consumer's consumer report in connection with an application by the consumer for credit shall treat the application for credit as incomplete if:
        (1) a security freeze has been placed on the consumer report;
        (2) the consumer has not allowed access to the consumer's consumer report for a specified period or to a specified third party; and
        (3) the consumer reporting agency refuses to release the consumer report to the third party based on subdivisions (1) and (2).
     (b) A consumer reporting agency that refuses under subsection (a)(3) to release a consumer report shall notify the third party that requested the consumer report of the existence of a security freeze as the basis for the refusal to release the consumer report to the third party.
    (c) A consumer reporting agency shall not:
        (1) state; or
        (2) otherwise imply;
to a third party that the consumer's security freeze under this chapter reflects a negative credit score, history, report, or rating.
    Sec. 13. (a) A security freeze remains in effect until the consumer who requested the security freeze requests, in a manner established by the consumer reporting agency under section 8 of this chapter, that the security freeze be removed.
    (b) Subject to subsections (c) and (d), a consumer reporting agency shall remove a security freeze not later than:
        (1) three (3) business days after the consumer reporting agency receives a request under subsection (a) by certified mail; or
        (2) fifteen (15) minutes after the consumer reporting agency receives a request under subsection (a), during normal business hours, by:
            (A) an electronic method; or
            (B) telephone;
        as established by the consumer reporting agency under

section 8 of this chapter.
    (c) A consumer reporting agency is not required to remove a security freeze under this section if the consumer reporting agency determines that the request to remove the security freeze:
        (1) is incomplete;
        (2) is materially false; or
        (3) does not clearly identify the person making the request as the consumer.
     (d) The consumer reporting agency is not required to remove a security freeze within the time provided under subsection (b) if the consumer reporting agency's ability to remove the security freeze is prevented by:
        (1) an act of God, including fire, earthquakes, hurricanes, storms, or similar natural disaster or phenomena;
        (2) unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, or labor strikes or disputes disrupting operations;
        (3) operational interruption, including electrical failure, unanticipated delay in equipment, or replacement part delivery, or computer hardware or software failures;
        (4) governmental action, including emergency orders or regulations or judicial or law enforcement action;
         (5) regularly scheduled maintenance, during other than normal business hours, of the consumer reporting agency's system;
        (6) commercially reasonable maintenance of, or repair to, the consumer reporting agency's system that is unexpected or unscheduled; or
        (7) receipt of a removal request outside of normal business hours.
     Sec. 14. (a) Subject to subsection (d), a consumer reporting agency that placed a security freeze on a consumer's consumer report and issued a unique personal identification number to the consumer under this chapter shall issue a replacement unique personal identification number to the consumer if the consumer requests a replacement unique personal identification number.
     (b) A request for a replacement unique personal identification number must be made in a manner prescribed by the consumer reporting agency.
    (c) Subject to subsection (d), a consumer reporting agency shall issue a replacement unique personal identification number not later than seven (7) business days after the consumer reporting

agency receives a request under subsection (b).
    (d) A consumer reporting agency is not required to issue a replacement unique personal identification number under this section if the consumer reporting agency determines that the request for the replacement unique personal identification number:
        (1) is incomplete;
        (2) is materially false; or
        (3) does not clearly identify the person making the request as the consumer.
     Sec. 15. (a) A consumer reporting agency may remove a security freeze if the consumer reporting agency determines that the placement of the security freeze was based on a material misrepresentation of fact.
     (b) A consumer reporting agency must provide written notice to a consumer before removing a security freeze from the consumer's consumer report under this section.
    Sec. 16. A consumer reporting agency may impose a charge of not more than ten dollars ($10) for:
        (1) placing or removing a security freeze on a consumer report under this chapter;
        (2) allowing access to a consumer report under section 11 of this chapter; or
        (3) reissuing or replacing a unique personal identification number issued under this chapter.
     Sec. 17. (a) Except as provided in subsection (b), a consumer reporting agency shall not amend the following information in a consumer report if a security freeze is in effect on the consumer report:
        (1) The name of the consumer.
        (2) The date of birth of the consumer.
        (3) The Social Security number of the consumer.
        (4) The address of the consumer.
    (b) A consumer reporting agency may amend the information described in subsection (a) despite a security freeze if the consumer reporting agency receives prior written approval from the consumer.
    Sec. 18. A consumer reporting agency shall provide to a consumer notice with each written disclosure by the consumer reporting agency as required under Section 609 of the federal Fair Credit Reporting Act (15 U.S.C. 1681g) that the consumer may place a security freeze on the consumer's consumer report. The

notice under this section must be in the following form:
        "UNDER IC 24-5-24, YOU MAY OBTAIN A SECURITY FREEZE ON YOUR CREDIT REPORT TO PROTECT YOUR PRIVACY AND ENSURE THAT CREDIT IS NOT GRANTED IN YOUR NAME WITHOUT YOUR KNOWLEDGE. THE SECURITY FREEZE WILL PROHIBIT A CONSUMER REPORTING AGENCY FROM RELEASING ANY INFORMATION IN YOUR CREDIT REPORT WITHOUT YOUR EXPRESS AUTHORIZATION OR APPROVAL. THE SECURITY FREEZE IS DESIGNED TO PREVENT CREDIT LOANS AND SERVICES FROM BEING APPROVED IN YOUR NAME WITHOUT YOUR CONSENT. WHEN YOU PLACE A SECURITY FREEZE ON YOUR CREDIT REPORT, WITHIN TEN (10) BUSINESS DAYS YOU WILL BE PROVIDED A PERSONAL IDENTIFICATION NUMBER TO USE IF YOU CHOOSE TO REMOVE THE SECURITY FREEZE OR TO TEMPORARILY AUTHORIZE THE RELEASE OF YOUR CREDIT REPORT FOR A PERIOD OF TIME OR TO A SPECIFIC PERSON AFTER THE SECURITY FREEZE IS IN PLACE. A SECURITY FREEZE DOES NOT APPLY TO PERSONS OR ENTITIES LISTED IN IC 24-5-24-6. IF YOU ARE ACTIVELY SEEKING CREDIT, YOU SHOULD UNDERSTAND THAT THE PROCEDURES INVOLVED IN LIFTING A SECURITY FREEZE MAY SLOW YOUR OWN APPLICATIONS FOR CREDIT. YOU HAVE A RIGHT TO BRING A CIVIL ACTION AGAINST SOMEONE WHO VIOLATES YOUR RIGHTS UNDER IC 24-5-24.".
    Sec. 19. A consumer reporting agency may furnish a consumer's credit header information only to a person who has a permissible purpose to obtain the consumer's consumer report under Section 604 of the Fair Credit Reporting Act (15 U.S.C. 1681b).
    Sec. 20. (a) A consumer who suffers injury by an act of a consumer reporting agency that violates this chapter may bring a civil action against the consumer reporting agency in a circuit or superior court in the county in which the consumer resides.
    (b) A civil action brought under this section must be commenced in accordance with IC 34-11-2-13.
    (c) A court may award damages, fees, costs, and reasonable attorney's fees in a civil action brought under this section.
     Sec. 21. (a) The attorney general may bring an action to recover from a person on behalf of the state a civil penalty described under

subsection (b).
    (b) A person who knowingly or intentionally violates this chapter is subject to a civil penalty of:
        (1) not more than two thousand five hundred dollars ($2,500) for a violation or series of violations concerning one (1) consumer; and
        (2) not more than a total of one hundred thousand dollars ($100,000) for related violations concerning more than one (1) consumer.

SOURCE: IC 34-11-2-13; (07)IN1609.1.2. -->     SECTION 2. IC 34-11-2-13 IS ADDED TO THE INDIANA CODE AS A NEW SECTION TO READ AS FOLLOWS [EFFECTIVE JULY 1, 2007]: Sec. 13. An action against a consumer reporting agency by a consumer under IC 24-5-24-20 (governing consumer reports) must be commenced not later than two (2) years after the date of the alleged violation of IC 24-5-24.