Introduced Version




HOUSE BILL No. 1718

_____


DIGEST OF INTRODUCED BILL



Citations Affected: IC 24-5-24.

Synopsis: Freezing credit reports. Provides that a consumer may prevent access to the consumer's credit report by requesting that the consumer reporting agency place a security freeze on the consumer's credit report. Imposes other requirements and restrictions. Provides that a person who: (1) violates the security freeze laws is liable to a consumer; (2) obtains a consumer report from a consumer reporting agency, requests the placement of a security freeze, or requests a security freeze to be temporarily lifted or removed under false pretenses or in an attempt to violate federal or state law is liable to the consumer reporting agency; and (3) is negligent in failing to comply with the security freeze laws is liable to the consumer.

Effective: July 1, 2007.



Bardon


    January 26, 2007, read first time and referred to Committee on Financial Institutions.




Introduced

First Regular Session 115th General Assembly (2007)


PRINTING CODE. Amendments: Whenever an existing statute (or a section of the Indiana Constitution) is being amended, the text of the existing provision will appear in this style type, additions will appear in this style type, and deletions will appear in this style type.
Additions: Whenever a new statutory provision is being enacted (or a new constitutional provision adopted), the text of the new provision will appear in this style type. Also, the word NEW will appear in that style type in the introductory clause of each SECTION that adds a new provision to the Indiana Code or the Indiana Constitution.
Conflict reconciliation: Text in a statute in this style type or this style type reconciles conflicts between statutes enacted by the 2006 Regular Session of the General Assembly.

HOUSE BILL No. 1718


    A BILL FOR AN ACT to amend the Indiana Code concerning trade regulation.

Be it enacted by the General Assembly of the State of Indiana:

SOURCE: IC 24-5-24; (07)IN1718.1.1. -->     SECTION 1. IC 24-5-24 IS ADDED TO THE INDIANA CODE AS A NEW CHAPTER TO READ AS FOLLOWS [EFFECTIVE JULY 1, 2007]:
    Chapter 24. Security Freeze for Consumer Reports
    Sec. 1. As used in this chapter, "consumer" means an individual who is a resident of Indiana.
    Sec. 2. As used in this chapter, "consumer report" has the meaning set forth in 15 U.S.C. 1681a(d).
    Sec. 3. As used in this chapter, "consumer reporting agency" has the meaning set forth in 15 U.S.C. 1681a(f).
    Sec. 4. As used in this chapter, "person" means an individual, a corporation, a limited liability company, a partnership, or other legal entity.
    Sec. 5. As used in this chapter, "proper identification" has the meaning set forth in 15 U.S.C. 1681h(a)(1).
    Sec. 6. As used in this chapter, "security freeze" means a notice placed in a consumer's consumer report, at the request of the

consumer, that prohibits the consumer reporting agency from releasing the consumer's consumer report or score relating to the extension of credit.
    Sec. 7. The following entities are not required to place a security freeze on a consumer report:
        (1) A consumer reporting agency that:
            (A) acts only as a reseller of credit information by assembling and merging information contained in the data base of another consumer reporting agency or multiple consumer reporting agencies; and
            (B) does not maintain a permanent data base of credit information from which new consumer reports are produced.
        However, a consumer reporting agency acting as a reseller shall honor any security freeze placed on a consumer report by another consumer reporting agency.
        (2) A check services or fraud prevention services company that issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments.
        (3) A deposit account information service company that issues reports regarding:
            (A) account closures due to fraud;
            (B) substantial overdrafts;
            (C) automated teller machine (ATM) abuse; or
            (D) similar negative information regarding a consumer;
        to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring financial institution.
        (4) A consumer reporting agency's data base or file that consists of information concerning, and is used for, one (1) or more of the following:
            (A) Criminal record information.
            (B) Fraud prevention or detection.
            (C) Personal loss history information.
            (D) Employment, tenant, or background screening.
    Sec. 8. A security freeze on a consumer's consumer report does not prohibit the consumer reporting agency from providing the consumer report to the following persons without the authorization of the consumer:
        (1) A person, or a subsidiary, affiliate, or agent of the person,

or an assignee of a financial obligation owed by the consumer to the person, or a prospective assignee of a financial obligation owed by the consumer to the person in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment of an account or contract, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owed for the account, contract, or negotiable instrument.
        (2) A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted by a consumer for purposes of facilitating the extension of credit or other permissible use.
        (3) Any state or local agency, law enforcement agency, trial court, or private collection agency acting under a court order, warrant, or subpoena.
        (4) A child support agency acting under Title IV-D of the Social Security Act (42 U.S.C. 651 et seq.).
        (5) The state or agents of the state acting to:
            (A) investigate fraud;
            (B) investigate or collect delinquent taxes or unpaid court orders; or
            (C) fulfill any other statutory responsibilities of the state provided the responsibilities are consistent with a permissible purpose under 15 U.S.C. 1681b.
        (6) The use of credit information for the purposes of prescreening as provided for under the federal Fair Credit Reporting Act (15 U.S.C. 1681 et seq).
        (7) A person administering a credit file monitoring subscription or similar service to which the consumer has subscribed.
        (8) A person for the purpose of providing a consumer with a copy of the consumer's credit report or score upon the consumer's request.
        (9) A person using the information in connection with the underwriting of insurance.
    Sec. 9. (a) A consumer may place a security freeze on the consumer's credit report by sending a request in writing by certified mail to a consumer reporting agency at an address designated by the consumer reporting agency.
    (b) This section does not prevent a consumer reporting agency

from advising a third party that a security freeze is in effect with respect to the consumer's consumer report.
    Sec. 10. (a) A consumer reporting agency shall place a security freeze on a consumer's consumer report not later than five (5) business days after receiving from the consumer:
        (1) a written request described in section 9 of this chapter;
        (2) proper identification; and
        (3) payment of a fee, if applicable.
    (b) The consumer reporting agency shall send a written confirmation of the placement of the security freeze to the consumer not later than (10) business days after receipt of the request.
    (c) Upon placing the security freeze on the consumer's consumer report, the consumer reporting agency shall provide the consumer with a unique personal identification number, password, or similar device to be used by the consumer when providing authorization for the release of the consumer's consumer report for a specific period of time.
    Sec. 11. A consumer gives authorization to release the consumer's consumer report if the consumer:
        (1) contacts the consumer reporting agency using a point of contact designated by the consumer reporting agency;
        (2) requests that the security freeze be temporarily lifted; and
        (3) provides the following:
            (A) Proper identification.
            (B) The unique personal identification number, password, or other device provided to the consumer by the consumer reporting agency under section 10 of this chapter.
            (C) The information regarding the period for which the report shall be available to users of the consumer report.
            (D) A fee, if applicable.
    Sec. 12. A consumer reporting agency that receives a request from a consumer to temporarily lift a security freeze on the consumer's consumer report under section 11 of this chapter, shall comply with the request not later than three (3) business days after receipt of the request.
    Sec. 13. A consumer reporting agency may develop procedures involving the use of a telephone, a facsimile machine, the Internet, or other electronic media to receive and process a request from a consumer to temporarily lift a security freeze on a consumer report under section 11 of this chapter in an expedited manner.
    Sec. 14. A consumer reporting agency shall remove or

temporarily lift a security freeze placed on a consumer's consumer report only in the following cases:
        (1) Upon a request by a consumer under section 11 of this chapter.
        (2) The consumer's consumer report has a security freeze placed on the consumer report due to a material misrepresentation of fact by the consumer. If a consumer reporting agency intends to remove a security freeze placed on a consumer's consumer report under this subdivision, the consumer reporting agency shall notify the consumer in writing prior to removing the security freeze.
    Sec. 15. If a third party requests access to a consumer report on which a security freeze is in effect, and the:
        (1) request is in connection with an application for credit or any other use; and
        (2) consumer does not allow the consumer's consumer report to be accessed for the period;
the third party may treat the application as incomplete.
    Sec. 16. If a consumer requests a security freeze, the consumer reporting agency shall disclose the process for:
        (1) placing and temporarily lifting a security freeze; and
        (2) allowing access to information from the consumer's consumer report for a period while the security freeze is in place.
    Sec. 17. (a) A security freeze must remain in place until the consumer requests, using a point of contact designated by the consumer reporting agency, that the security freeze be removed.
    (b) A consumer reporting agency shall remove a security freeze not later than three (3) business days after receiving a request for removal from a consumer who provides:
        (1) proper identification;
        (2) the unique personal identification number, password, or similar device provided by the consumer reporting agency under section 10 of this chapter; and
        (3) a fee, if applicable.
    Sec. 18. A consumer reporting agency shall require proper identification of a consumer making a request to place or remove a security freeze on a consumer report.
    Sec. 19. (a) Except as provided in subsection (b), a consumer reporting agency may charge a fee of not more than ten dollars ($10) to a consumer for:
        (1) placing a security freeze;

        (2) removing a security freeze; and
        (3) temporary lifting a security freeze;
on a consumer report.
    (b) A consumer reporting agency may not charge a fee to a victim of identity theft who has submitted a valid police report to the consumer reporting agency.
    Sec. 20. (a) Except as provided under subsection (b), if a security freeze has been placed on a consumer report, a consumer reporting agency may not change the consumer's:
        (1) name;
        (2) date of birth;
        (3) Social Security number; and
        (4) address;
in a consumer report unless the consumer reporting agency sends a written confirmation of the change to the consumer not more than thirty (30) days before the change is posted to the consumer's file.
    (b) A written confirmation under this section is not required for technical modifications of a consumer's official information, including name and street abbreviations, complete spellings, or transposition of numbers or letters.
    (c) If the consumer has an address change, the credit reporting agency shall sent a written confirmation to the consumer's new address and the consumer's former address.
    Sec. 21. A consumer reporting agency shall provide to a consumer notice with each written disclosure of a summary of rights as required under the federal Fair Credit Reporting Act (15 U.S.C. 1681g(d)), that the consumer may place a security freeze on the consumer's report. The notice under this section must be in substantially the following form:
        "Indiana Consumers Have the Right to Obtain a Security Freeze.
        You have a right to place a "security freeze" on your consumer report, which will prohibit a consumer reporting agency from releasing information in your consumer report without your express authorization. A security freeze must be requested in writing by certified mail. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gets access to the personal and financial information in your consumer report may delay, interfere with, or

prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, government services or payments, rental housing, employment, investment, license, cellular phone, utilities, digital signature, Internet credit card transaction, or other services, including an extension of credit at point of sale. When you place a security freeze on your consumer report, you will be provided a personal identification number or password to use if you choose to remove the freeze on your consumer report or authorize the release of your consumer report for a period of time after the security freeze is in place. To provide that authorization you must contact the consumer reporting agency and provide all of the following:
            (1) The personal identification number, password, or other device.
            (2) Proper identification to verify your identity.
            (3) The proper information regarding the period of time for which the consumer report will be available.
            (4) A payment of the appropriate fee.
        A consumer reporting agency must authorize the release of your consumer report not later than three business days after receiving the above information.
        A security freeze does not apply to a person or entity, or its affiliates, or collection agencies acting on behalf of the person or entity, with which you have an existing account, that requests information in your consumer report for the purposes of reviewing or collecting the account. Reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.
        You have a right to bring civil action against anyone, including a consumer reporting agency, who improperly obtains access to a file, knowingly or willfully misuses file data, or fails to correct inaccurate file data.
        Unless you are a victim of identity theft with a police report to verify the crimes, a consumer reporting agency has the right to charge you up to $10 to place a freeze on your credit report, up to $10 to temporarily lift a freeze on your consumer report and up to $10 to remove a security freeze from your consumer report.".
    Sec. 22. A person who willfully violates any requirement under this chapter with respect to a consumer is liable to the consumer in

an amount equal to the sum of:
        (1) any:
            (A) actual damages sustained by the consumer as a result of the violation; or
            (B) damages of not less than one hundred dollars ($100) and not more than one thousand dollars ($1,000);
        (2) an amount of punitive damages as allowed by the court; and
        (3) in the case of a successful action to enforce liability under this section, the cost of the action and reasonable attorney's fees as determined by the court.
    Sec. 23. A person who:
        (1) obtains a consumer report from a consumer reporting agency;
        (2) requests a consumer reporting agency to place a security freeze; or
        (3) requests a consumer reporting agency to:
            (A) temporarily lift; or
            (B) remove;
        a security freeze on a consumer report;
under false pretenses or in an attempt to violate federal or state law is liable to the consumer reporting agency for actual damages sustained by the consumer reporting agency or one thousand dollars ($1,000), whichever is greater.
    Sec. 24. A person who is negligent in failing to comply with a requirement imposed under this chapter with respect to a consumer is liable to the consumer in an amount equal to the sum of:
        (1) any actual damages sustained by the consumer as a result of the negligent failure to comply; and
        (2) in the case of a successful action to enforce a liability under this section, the costs of the action and reasonable attorney's fees as determined by the court.
    Sec. 25. If a court finds that an unsuccessful pleading, motion, or other paper filed in connection with an action under this chapter was filed in bad faith or for purposes of harassment, the court shall award to the prevailing party reasonable attorney's fees and costs relating to responding to the pleading, motion, or other paper.