Citations Affected: IC 24-5; IC 34-11.
Synopsis: Freezing of credit reports. Provides that a consumer may
prevent access to the consumer's credit report by requesting that the
consumer reporting agency place a security freeze on the consumer's
credit report. Imposes other requirements and restrictions. Provides
that: (1) a consumer reporting agency may furnish a consumer's
identifying information only to certain persons; (2) a consumer may
bring a civil action against a consumer reporting agency for injury
caused to the consumer by the consumer reporting agency's violation
of the law; and (3) the attorney general may bring an action to recover
a civil penalty of $2,500 for a knowing or intentional violation or series
of violations concerning one consumer and not more than a total of
$100,000 for knowing or intentional violations of the security freeze
law for related violations concerning more than one consumer.
Provides that: (1) a person who fails to comply with the freezing of
credit report requirements is liable to a consumer for certain damages;
and (2) a person who obtains a consumer report, requests a security
freeze, requests to lift a security freeze, or requests a removal of a
security freeze under false pretenses or in violation of a law is liable to
a consumer reporting agency for certain damages.
Effective: July 1, 2007.
January 11, 2007, read first time and referred to Committee on Corrections, Criminal, and
Civil Matters.
February 22, 2007, amended, reported favorably _ Do Pass.
February 26, 2007, read second time, amended, ordered engrossed.
A BILL FOR AN ACT to amend the Indiana Code concerning trade
regulation.
consumer report to a third party.
Sec. 4. As used in this chapter, "credit header information"
means information collected or recorded by a consumer reporting
agency concerning:
(1) the Social Security number of a consumer; or
(2) any other identifying information relating to a consumer
that the consumer reporting agency obtained using any
nonpublic personal information.
The term does not include the name, address, or telephone number
of a consumer if the information is listed in a residential telephone
directory that is available to the public.
Sec. 5. As used in this chapter, "security freeze" means a
designation placed on a consumer's consumer report:
(1) by a consumer reporting agency; and
(2) at the request of the consumer;
that prohibits the consumer reporting agency from releasing the
consumer report without the authorization of the consumer.
Sec. 6. (a) For purposes of this section, "reviewing the account"
includes activities related to account maintenance, monitoring,
credit line increases, and account upgrades and enhancements.
(b) A security freeze on a consumer's consumer report does not
prohibit the consumer reporting agency from providing the
consumer report to the following persons or entities without the
authorization of the consumer:
(1) A state or local unit of government.
(2) A law enforcement agency.
(3) A person, or the person's subsidiary, affiliate, agent,
assignee, or prospective assignee with which the consumer has
or, before the assignment, had an account, contract, or
debtor-creditor relationship, for reviewing the account or
collecting the financial obligation owing for the account,
contract, or debt.
(4) The consumer.
(5) An insurer or insurance producer licensed under IC 27
and the agents, vendors, or employees of the insurer or
insurance producer that are providing services to a consumer.
(6) Any of the following entities that use specialized credit
reporting tools to validate a consumer's identity or to
establish a consumer's creditworthiness:
(A) A public utility.
(B) A municipally owned utility.
(C) A rural electric membership corporation organized
under IC 8-1-13.
(D) A corporation organized under IC 23-17 that is an
electric cooperative and that has at least one (1) member
that is a corporation organized under IC 8-1-13.
(E) An energy utility (as defined in IC 8-1-2.5-2) or an
affiliate of an energy utility.
(c) A security freeze on a consumer's consumer report does not
prohibit the consumer reporting agency from providing the
consumer report:
(1) for purposes of prescreening, as provided in the Fair
Credit Reporting Act (15 U.S.C. 1681 et seq.); or
(2) from a consumer reporting agency's data base or file that
consists entirely of information concerning, and is used solely
for, one (1) or more of the following:
(A) Criminal record history information.
(B) Personal loss history information.
(C) Fraud prevention or detection.
(D) Tenant screening.
(E) Employment screening.
Sec. 7. (a) A consumer may place a security freeze on the
consumer's consumer report by:
(1) making a request through a contact method established by
the consumer reporting agency under section 8 of this
chapter; and
(2) paying a fee required by the consumer reporting agency
under section 16 of this chapter;
to a consumer reporting agency.
(b) Subject to subsection (c), a consumer reporting agency that
receives a request under subsection (a) shall place a security freeze
on the consumer's consumer report not later than five (5) business
days after receipt of the request.
(c) A consumer reporting agency is not required to place a
security freeze on a consumer report under this section if the
consumer reporting agency determines that the request for a
security freeze:
(1) is incomplete;
(2) is materially false; or
(3) does not clearly identify the person making the request as
the consumer.
Sec. 8. (a) A consumer reporting agency shall develop a contact
method to receive and process a consumer request to place,
remove, or temporarily remove a security freeze.
(b) A contact method under subsection (a) must include:
(1) a postal address for certified mail;
(2) a process by which a consumer may make a request by
telephone; and
(3) an electronic method established by the consumer
reporting agency not later than September 1, 2008, including
the use of facsimile (fax) transmission, the Internet, or other
electronic means.
Sec. 9. If a security freeze has been placed on a consumer report,
the consumer reporting agency may require a person or an entity
described in section 6 of this chapter to provide information to the
consumer reporting agency confirming the identity of the person
or entity before releasing the consumer report to the person or
entity.
Sec. 10. A consumer reporting agency that receives a truthful
and complete request for a security freeze shall, not later than ten
(10) business days after receipt of the request, issue to the
consumer requesting the security freeze:
(1) a unique personal identification number; and
(2) written information explaining how to:
(A) remove a security freeze; and
(B) allow access to a consumer report:
(i) for a specified period; and
(ii) by a specified third party.
Sec. 11. (a) Except as provided in section 6 of this chapter, if a
security freeze has been placed on a consumer's consumer report,
the consumer reporting agency that placed the security freeze on
the consumer report shall not release the consumer report unless
the consumer reporting agency receives authorization from the
consumer.
(b) For purposes of subsection (a), a consumer gives
authorization to release the consumer's consumer report if the
consumer provides the consumer's unique personal identification
number to the consumer reporting agency:
(1) in conjunction with a request by the consumer to allow
access to the consumer's consumer report:
(A) for a specified period; or
(B) to a specific third party; and
(2) in the manner established by the consumer reporting
agency under section 8 of this chapter.
Sec. 12. (a) A third party that requests a consumer's consumer
report in connection with an application by the consumer for credit
shall treat the application for credit as incomplete if:
(1) a security freeze has been placed on the consumer report;
(2) the consumer has not allowed access to the consumer's
consumer report for a specified period or to a specified third
party; and
(3) the consumer reporting agency refuses to release the
consumer report to the third party based on subdivisions (1)
and (2).
(b) A consumer reporting agency that refuses under subsection
(a)(3) to release a consumer report shall notify the third party that
requested the consumer report of the existence of a security freeze
as the basis for the refusal to release the consumer report to the
third party.
(c) A consumer reporting agency shall not:
(1) state; or
(2) otherwise imply;
to a third party that the consumer's security freeze under this
chapter reflects a negative credit score, history, report, or rating.
Sec. 13. (a) A security freeze remains in effect until the
consumer who requested the security freeze requests, in a manner
established by the consumer reporting agency under section 8 of
this chapter, that the security freeze be removed.
(b) Subject to subsections (c) and (d), a consumer reporting
agency shall remove a security freeze not later than:
(1) three (3) business days after the consumer reporting
agency receives a request under subsection (a) by certified
mail; or
(2) fifteen (15) minutes after the consumer reporting agency
receives a request under subsection (a), by:
(A) an electronic method; or
(B) telephone;
as established by the consumer reporting agency under
section 8 of this chapter.
(c) A consumer reporting agency is not required to remove a
security freeze under this section if the consumer reporting agency
determines that the request to remove the security freeze:
(1) is incomplete;
(2) is materially false; or
(3) does not clearly identify the person making the request as
the consumer.
(d) The consumer reporting agency is not required to remove a
security freeze within the time provided under subsection (b) if the
consumer reporting agency's ability to remove the security freeze
is prevented by:
(1) an act of God, including fire, earthquakes, hurricanes,
storms, or similar natural disaster or phenomena;
(2) unauthorized or illegal acts by a third party, including
terrorism, sabotage, riot, vandalism, or labor strikes or
disputes disrupting operations;
(3) operational interruption, including electrical failure,
unanticipated delay in equipment, or replacement part
delivery, or computer hardware or software failures;
(4) governmental action, including emergency orders or
regulations or judicial or law enforcement action;
(5) regularly scheduled maintenance, during other than
normal business hours, of the consumer reporting agency's
system; or
(6) commercially reasonable maintenance of, or repair to, the
consumer reporting agency's system that is unexpected or
unscheduled.
Sec. 14. (a) Subject to subsection (d), a consumer reporting
agency that placed a security freeze on a consumer's consumer
report and issued a unique personal identification number to the
consumer under this chapter shall issue a replacement unique
personal identification number to the consumer if the consumer
requests a replacement unique personal identification number.
(b) A request for a replacement unique personal identification
number must be made in a manner prescribed by the consumer
reporting agency.
(c) Subject to subsection (d), a consumer reporting agency shall
issue a replacement unique personal identification number not
later than seven (7) business days after the consumer reporting
agency receives a request under subsection (b).
(d) A consumer reporting agency is not required to issue a
replacement unique personal identification number under this
section if the consumer reporting agency determines that the
request for the replacement unique personal identification
number:
(1) is incomplete;
(2) is materially false; or
(3) does not clearly identify the person making the request as
the consumer.
Sec. 15. (a) A consumer reporting agency may remove a security
freeze if the consumer reporting agency determines that the
placement of the security freeze was based on a material
misrepresentation of fact.
(b) A consumer reporting agency must provide written notice to
a consumer before removing a security freeze from the consumer's
consumer report under this section.
Sec. 16. (a) Except as provided in subsection (b), a consumer
reporting agency may impose a charge of not more than five
dollars ($5) for:
(1) placing or removing a security freeze on a consumer
report under this chapter;
(2) allowing access to a consumer report under section 11 of
this chapter; or
(3) reissuing or replacing a unique personal identification
number issued under this chapter.
(b) A consumer reporting agency may not impose a charge on
a consumer who demonstrates that the consumer has been a victim
of identity theft by submitting a copy of a complaint filed with a
law enforcement agency concerning the identity theft to the
consumer reporting agency.
Sec. 17. (a) Except as provided in subsection (b), a consumer
reporting agency shall not amend the following information in a
consumer report if a security freeze is in effect on the consumer
report:
(1) The name of the consumer.
(2) The date of birth of the consumer.
(3) The Social Security number of the consumer.
(4) The address of the consumer.
(b) A consumer reporting agency may amend the information
described in subsection (a) despite a security freeze if the consumer
reporting agency receives prior written approval from the
consumer.
Sec. 18. A consumer reporting agency shall provide to a
consumer notice with each written disclosure by the consumer
reporting agency as required under Section 609 of the federal Fair
Credit Reporting Act (15 U.S.C. 1681g) that the consumer may
place a security freeze on the consumer's consumer report. The
notice under this section must be in the following form:
"UNDER IC 24-5-24, YOU MAY OBTAIN A SECURITY
FREEZE ON YOUR CREDIT REPORT TO PROTECT
YOUR PRIVACY AND ENSURE THAT CREDIT IS NOT
GRANTED IN YOUR NAME WITHOUT YOUR
KNOWLEDGE. THE SECURITY FREEZE WILL
PROHIBIT A CONSUMER REPORTING AGENCY FROM
RELEASING ANY INFORMATION IN YOUR CREDIT
REPORT WITHOUT YOUR EXPRESS AUTHORIZATION
OR APPROVAL. THE SECURITY FREEZE IS DESIGNED
TO PREVENT CREDIT LOANS AND SERVICES FROM
BEING APPROVED IN YOUR NAME WITHOUT YOUR
CONSENT. WHEN YOU PLACE A SECURITY FREEZE
ON YOUR CREDIT REPORT, WITHIN TEN (10)
BUSINESS DAYS YOU WILL BE PROVIDED A
PERSONAL IDENTIFICATION NUMBER TO USE IF YOU
CHOOSE TO REMOVE THE SECURITY FREEZE OR TO
TEMPORARILY AUTHORIZE THE RELEASE OF YOUR
CREDIT REPORT FOR A PERIOD OF TIME OR TO A
SPECIFIC PERSON AFTER THE SECURITY FREEZE IS
IN PLACE. A SECURITY FREEZE DOES NOT APPLY TO
PERSONS OR ENTITIES LISTED IN IC 24-5-24-6. IF YOU
ARE ACTIVELY SEEKING CREDIT, YOU SHOULD
UNDERSTAND THAT THE PROCEDURES INVOLVED IN
LIFTING A SECURITY FREEZE MAY SLOW YOUR OWN
APPLICATIONS FOR CREDIT. YOU HAVE A RIGHT TO
BRING A CIVIL ACTION AGAINST SOMEONE WHO
VIOLATES YOUR RIGHTS UNDER IC 24-5-24.".
Sec. 19. A consumer reporting agency may furnish a consumer's
credit header information only to a person who has a permissible
purpose to obtain the consumer's consumer report under Section
604 of the Fair Credit Reporting Act (15 U.S.C. 1681b).
Sec. 20. (a) A consumer who suffers injury by an act of a
consumer reporting agency that violates this chapter may bring a
civil action against the consumer reporting agency in a circuit or
superior court in the county in which the consumer resides.
(b) A civil action brought under this section must be commenced
in accordance with IC 34-11-2-13.
(c) Any person who fails to comply with any requirement
imposed under this chapter with respect to any consumer is liable
to that consumer in an amount equal to the sum of:
(1) Any actual damages sustained by the consumer as a result
of the failure but not less than five hundred dollars ($500) and
no more that six thousand dollars ($6000); and
(2) Such amount of punitive damages as the court may allow;
and
(3) In the case of any successful action to enforce any liability
under this section, the costs of the action together with
reasonable attorney fees as determined by the court.
(d) Any person who obtains a consumer report, requests a
security freeze, requests a temporary lift of a freeze, or the removal
of a security freeze from a consumer reporting agency under false
pretenses or in an attempt to violate federal or state law shall be
liable to the consumer reporting agency for actual damages
sustained by the consumer up to a maximum of six thousand
dollars ($6000).
Sec. 21. (a) The attorney general may bring an action to recover
from a person on behalf of the state a civil penalty described under
subsection (b).
(b) A person who knowingly or intentionally violates this
chapter is subject to a civil penalty of:
(1) not more than two thousand five hundred dollars ($2,500)
for a violation or series of violations concerning one (1)
consumer; and
(2) not more than a total of one hundred thousand dollars
($100,000) for related violations concerning more than one (1)
consumer.