Enrolled Act, Senate Bill 0403

    SECTION 1. IC 24-5-24 IS ADDED TO THE INDIANA CODE AS A NEW CHAPTER TO READ AS FOLLOWS [EFFECTIVE SEPTEMBER 1, 2007]:
     Chapter 24. Security Freezes for Consumer Reports
    Sec. 1. As used in this chapter, "consumer" means an individual:
        (1) whose principal residence is in Indiana; and
        (2) whose credit information and history is recorded in a consumer report.
    Sec. 2. (a) As used in this chapter, "consumer report" means any written, oral, or other communication of any information that:
        (1) is made by a consumer reporting agency;
        (2) bears on a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living; and
        (3) is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing a consumer's eligibility for credit to be used primarily for personal, family, or household purposes.
    (b) The term includes a consumer's credit score.
    Sec. 3. (a) As used in this chapter, "consumer reporting agency"
means any person that, for monetary fees or dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating information concerning a consumer's credit or other information for the purpose of furnishing a consumer report to another person.
    (b) The term does not include an entity designated as a commercially reasonable private consumer credit reporting entity under IC 24-4.5-7-404(5).
    Sec. 4. As used in this chapter, "security freeze" means a designation placed on a consumer's consumer report:
        (1) by a consumer reporting agency; and
        (2) at the request of the consumer;
that prohibits the consumer reporting agency from releasing the consumer report without the authorization of the consumer.
    Sec. 5. (a) A consumer may place a security freeze on the consumer's consumer report by:
        (1) sending a written request by United States mail to an address designated by the consumer reporting agency; or
        (2) subject to subsection (d), making a request to a consumer reporting agency through a secure electronic mail connection provided by the consumer reporting agency.
    (b) Except as provided in subsection (c) and section 11 of this chapter, a consumer reporting agency that receives a request under subsection (a) shall place a security freeze on the consumer's consumer report not later than five (5) business days after receipt of the request.
    (c) A consumer reporting agency is not required to place a security freeze on a consumer report under this section if the consumer reporting agency determines that the request for a security freeze:
        (1) is materially false; or
        (2) does not clearly identify the person making the request as the consumer.
    (d) Not later than January 1, 2009, a consumer reporting agency shall develop and make available to consumers a secure electronic mail connection by which a consumer can request:
        (1) the placement of a security freeze on the consumer's consumer report under this section; or
        (2) the same or a new personal identification number or password under section 6(b) of this chapter.
    Sec. 6. (a) Not later than ten (10) business days after receiving a request for a security freeze under section 5 of this chapter, a
consumer reporting agency shall issue to the consumer a written confirmation that a security freeze has been placed on the consumer's consumer report. The confirmation required by this section must include the following:
        (1) A unique:
            (A) personal identification number; or
            (B) password;
        other than the consumer's Social Security number, or any multiple digit segment of the consumer's Social Security number, to be used by the consumer to perform any of the acts described in subdivision (2).
        (2) Written instructions explaining how the consumer may:
            (A) release the consumer's consumer report to one (1) or more specified third parties;
            (B) temporarily lift the security freeze for a specified period; or
            (C) remove the security freeze.
        (3) Written instructions explaining how the consumer may request, using one (1) of the methods described in section 5(a) of this chapter, that the consumer reporting agency issue the same or a new personal identification number or password to the consumer if the consumer fails to retain the original personal identification number or password issued by the consumer reporting agency under subdivision (1).
    (b) Upon receiving a request described in subsection (a)(3), the consumer reporting agency shall issue the same or a new personal identification number or password to the requesting consumer if the consumer has provided information sufficient to identify the consumer, as specified by the consumer reporting agency in the instructions provided to the consumer under subsection (a)(3). If the consumer's request is made using the method described in section 5(a)(1) of this chapter, the consumer reporting agency shall send, by United States mail, the personal identification number or password to the consumer not later than five (5) business days after receiving the consumer's request. If the consumer's request is made using the method described in section 5(a)(2) of this chapter, the consumer reporting agency shall issue the personal identification number or password not later than:
        (1) subject to the exceptions set forth in sections 7(e)(2) and 9(c)(2) of this chapter, as applicable, fifteen (15) minutes after receiving the request, if the consumer reporting agency elects to issue the personal identification number or password by a
secure electronic mail connection provided by the consumer reporting agency under section 5(d) of this chapter; or
        (2) five (5) business days after receiving the request, if the consumer reporting agency elects to issue the personal identification number or password by United States mail.
    Sec. 7. (a) Except as provided in section 10 of this chapter, if a security freeze has been placed on a consumer's consumer report, the consumer reporting agency that placed the security freeze on the consumer report shall not release the consumer's consumer report unless the consumer authorizes the consumer reporting agency to:
        (1) release the consumer's consumer report to one (1) or more specified third parties; or
        (2) temporarily lift the security freeze for a specified period.
    (b) A consumer who seeks to authorize the release of the consumer's consumer report under subsection (a)(1) or (a)(2) shall request the release by contacting the consumer reporting agency by any method:
        (1) described in section 5(a) of this chapter; or
        (2) developed by the consumer reporting agency under subsection (d).
    (c) A request by a consumer under subsection (b) must include the following:
        (1) Information sufficient to identify the consumer, as specified by the consumer reporting agency in the instructions provided to the consumer under section 6(a)(2) of this chapter.
        (2) The unique personal identification number or password assigned to the consumer under section 6(a)(1) or 6(a)(3) of this chapter.
        (3) If the consumer seeks to authorize the release of the consumer's consumer report under subsection (a)(1), information sufficient to identify the parties to whom the consumer report is to be released, as specified by the consumer reporting agency in the instructions provided to the consumer under section 6(a)(2) of this chapter.
        (4) If the consumer seeks to authorize the consumer reporting agency to temporarily lift a security freeze under subsection (a)(2), the period during which the security freeze is to be temporarily lifted.
    (d) Not later than January 1, 2009, a consumer reporting agency shall develop and make available to consumers secure procedures
to authorize the release of a consumer's consumer report under subsection (a)(1), or to authorize the temporary lifting of a security freeze under subsection (a)(2), within fifteen (15) minutes of receiving a request under subsection (b), by any of the following methods:
        (1) Telephone.
        (2) The Internet.
        (3) Other electronic media, if provided by the consumer reporting agency.
The procedures developed by a consumer reporting agency under this subsection must require the consumer to provide the information set forth in subsection (c).
    (e) A consumer reporting agency that receives a request from a consumer under this section shall comply with the request within the following time frames:
        (1) Not later than three (3) business days after receiving the request, if the consumer makes the request by the method described in section 5(a)(1) of this chapter.
        (2) Not later than fifteen (15) minutes after receiving the request, if the consumer makes the request using the method described in section 5(a)(2) of this chapter or by any method developed by the consumer reporting agency under subsection (d). However, a consumer reporting agency is not required to comply with a consumer's request within the fifteen (15) minute time frame set forth in this subdivision if:
            (A) the consumer does not provide one (1) or more of the items listed in subsection (c); or
            (B) the consumer reporting agency's ability to comply with the request within the fifteen (15) minute time frame set forth in this subdivision is prevented by any of the following:
                (i) An act of God, including fire, an earthquake, a hurricane, a storm, or a similar natural disaster or phenomenon.
                (ii) Unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrences.
                (iii) An operational interruption, including an electrical failure, an unanticipated delay in the delivery of equipment or replacement parts, computer hardware or software failures inhibiting response time, or similar
disruptions.
                (iv) A governmental action, including an emergency order or regulation, a judicial action, a law enforcement action, or a similar directive.
                (v) Regularly scheduled maintenance of, or updates to, the consumer reporting agency's computer systems, if the maintenance activities or updates occur other than during normal business hours.
                (vi) Commercially reasonable maintenance of, or repairs to, the consumer reporting agency's computer systems, if the maintenance activities or repairs are unexpected or are necessitated by unanticipated conditions or malfunctions.
                (vii) For a request made by telephone, receipt of a request under this section other than during the consumer reporting agency's normal business hours, including any extended business hours observed by the consumer reporting agency. The exemption provided by this item does not apply to a request made by a consumer through the Internet or other electronic media. A consumer reporting agency must comply with a request made by a consumer through the Internet or other electronic media within the fifteen (15) minute time frame set forth in this subdivision, even if the request is made at a time other than during the consumer reporting agency's normal or extended business hours.
    Sec. 8. (a) A third party that requests a consumer's consumer report in connection with an application by the consumer for credit shall treat the application for credit as incomplete if:
        (1) a security freeze has been placed on the consumer's consumer report;
        (2) the consumer has not authorized the release of the consumer's consumer report under section 7 of this chapter; and
        (3) the consumer reporting agency refuses to release the consumer report to the third party based on subdivisions (1) and (2).
    (b) A consumer reporting agency that refuses under subsection (a)(3) to release a consumer report shall notify the third party requesting the consumer report of the existence of a security freeze as the basis for the refusal to release the consumer report to the third party.
    (c) A consumer reporting agency shall not:
        (1) state; or
        (2) otherwise imply;
to a third party that the consumer's security freeze under this chapter reflects a negative credit score, history, report, or rating.
    Sec. 9. (a) A security freeze remains in effect until the consumer who requested the security freeze requests that the security freeze be removed. A consumer who seeks to authorize a consumer reporting agency to remove a security freeze shall request the removal by contacting the consumer reporting agency by any method:
        (1) described in section 5(a) of this chapter; or
        (2) developed by a consumer reporting agency under section 7(d) of this chapter for receiving a consumer's request to authorize the release of a consumer report or the temporary lifting of a security freeze.
    (b) A request by a consumer under subsection (a) must include the following:
        (1) Information sufficient to identify the consumer, as specified by the consumer reporting agency in the instructions provided to the consumer under section 6(a)(2) of this chapter.
        (2) The unique personal identification number or password assigned to the consumer under section 6(a)(1) or 6(a)(3) of this chapter.
    (c) Subject to subsection (d), a consumer reporting agency must remove a security freeze within the following time frames:
        (1) Not later than three (3) business days after receiving a request under subsection (a), if the consumer makes the request by the method described in section 5(a)(1) of this chapter.
        (2) Not later than fifteen (15) minutes after receiving a request under subsection (a), if the consumer makes the request using the method described in section 5(a)(2) of this chapter or by any method developed by the consumer reporting agency under section 7(d) of this chapter. However, a consumer reporting agency is not required to comply with a consumer's request within the fifteen (15) minute time frame set forth in this subdivision if:
            (A) the consumer does not provide one (1) or more of the items listed in subsection (b); or
            (B) the consumer reporting agency's ability to comply with
the request within the fifteen (15) minute time frame set forth in this subdivision is prevented by any of the following:
                (i) An act of God, including fire, an earthquake, a hurricane, a storm, or a similar natural disaster or phenomenon.
                (ii) Unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrences.
                (iii) An operational interruption, including an electrical failure, an unanticipated delay in the delivery of equipment or replacement parts, computer hardware or software failures inhibiting response time, or similar disruptions.
                (iv) A governmental action, including an emergency order or regulation, a judicial action, a law enforcement action, or a similar directive.
                (v) Regularly scheduled maintenance of, or updates to, the consumer reporting agency's computer systems, if the maintenance activities or updates occur other than during normal business hours.
                (vi) Commercially reasonable maintenance of, or repairs to, the consumer reporting agency's computer systems, if the maintenance activities or repairs are unexpected or are necessitated by unanticipated conditions or malfunctions.
                (vii) For a request made by telephone, receipt of a request under this section other than during the consumer reporting agency's normal business hours, including any extended business hours observed by the consumer reporting agency. The exemption provided by this item does not apply to a request made by a consumer through the Internet or other electronic media. A consumer reporting agency must comply with a request made by a consumer through the Internet or other electronic media within the fifteen (15) minute time frame set forth in this subdivision, even if the request is made at a time other than during the consumer reporting agency's normal or extended business hours.
    (d) A consumer reporting agency is not required to remove a security freeze under this section if the consumer reporting agency
determines that the request to remove the security freeze:
        (1) is materially false; or
        (2) does not clearly identify the person making the request as the consumer.
    Sec. 10. The placement of a security freeze on a consumer's consumer report does not prohibit a consumer reporting agency from providing the consumer's consumer report to the following persons without the authorization of the consumer:
        (1) A person, including a subsidiary, an affiliate, an agent, an assignee of a financial obligation owed by the consumer to the person, or a prospective assignee of a financial obligation owed by the consumer to the person in connection with the proposed purchase of the financial obligation, to whom the consumer owes a financial obligation in connection with any of the following:
            (A) An account, including a demand deposit account, that the consumer has with the person, for the purpose of:
                (i) reviewing the account, including activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements; or
                (ii) collecting the obligation owed in connection with the account.
            (B) A contract, for the purpose of collecting the obligation owed in connection with the contract.
            (C) A negotiable instrument that the consumer has issued to the person, for the purpose of collecting the obligation owed in connection with the negotiable instrument.
        (2) A person, including a subsidiary, an affiliate, an agent, or an assignee of a financial obligation owed by the consumer to the person, to whom the consumer has authorized the release of the consumer's consumer report under section 7(a)(1) of this chapter, for the purpose of facilitating the extension of credit or for any permissible purpose under subdivision (1).
        (3) A law enforcement agency.
        (4) Any person for the purpose of prescreening, as provided in the federal Fair Credit Reporting Act (15 U.S.C. 1681 et seq.).
        (5) Any person administering a credit monitoring subscription service to which the consumer has subscribed.
        (6) The consumer, upon the consumer's request, or any other person for the purpose of providing the consumer with a copy of the consumer's consumer report, upon the consumer's

request.
         (7) Any of the following that provides services to a consumer:
            (A) An insurer licensed under IC 27.
            (B) An insurance producer licensed under IC 27.
            (C) An agent, a vendor, or an employee of:
                (i) an insurer licensed under IC 27; or
                (ii) an insurance producer licensed under IC 27;
             while acting on behalf of the insurer or the insurance producer.
    Sec. 11. (a) As used in this section, "energy utility" has the meaning set forth in IC 8-1-2.5-2.
    (b) As used in this section, "specialized credit reporting tool" means a scoring model that:
        (1) is available only to an energy utility; and
        (2) is used by the energy utility to validate a consumer's identity and creditworthiness.
    (c) The following persons are not required to place a security freeze on a consumer's consumer report:
        (1) A consumer reporting agency that acts only as a reseller (as defined in 15 U.S.C. 1681a(u)) of information. However, a consumer reporting agency must honor any security freeze placed on a consumer's consumer report by another consumer reporting agency.
        (2) A:
            (A) check services; or
            (B) fraud prevention services;
        company that reports on incidents of fraud or issues authorizations for the purpose of approving or processing negotiable instruments, electronic fund transfers, or similar methods of payment.
         (3) A deposit account information service company that issues reports concerning account closures due to:
            (A) fraud;
            (B) substantial overdrafts;
            (C) ATM abuse; or
            (D) similar negative information concerning a consumer;
        to inquiring financial institutions for use only in reviewing a consumer's request for a deposit account at the inquiring financial institution.
        (4) A consumer reporting agency that furnishes specialized credit reporting tools to an energy utility.
    Sec. 12. (a) Except as provided in subsection (b), if a security

freeze is in place with respect to a consumer's consumer report, a consumer reporting agency may not change any of the following official information on the consumer's consumer report without sending written confirmation of the change to the consumer not later than thirty (30) days after the change is posted to the consumer's consumer report:
        (1) Name.
        (2) Date of birth.
        (3) Social Security number.
        (4) Address.
In the case of an address change, the written confirmation required under this section shall be sent to both the new address and the old address.
    (b) Written confirmation is not required under this section for technical modifications of a consumer's official information, including changes involving:
        (1) the use of name or street:
            (A) abbreviations; or
            (B) complete spellings; or
        (2) transpositions of numbers or letters in a consumer's name or address.
    Sec. 13. A consumer reporting agency shall provide to a consumer notice with each written disclosure by the consumer reporting agency as required under Section 609 of the federal Fair Credit Reporting Act (15 U.S.C. 1681g) that the consumer may place a security freeze on the consumer's consumer report. The notice under this section must be in the following form:
        "UNDER IC 24-5-24, YOU MAY OBTAIN A SECURITY FREEZE ON YOUR CONSUMER REPORT TO PROTECT YOUR PRIVACY AND ENSURE THAT CREDIT IS NOT GRANTED IN YOUR NAME WITHOUT YOUR KNOWLEDGE. THE SECURITY FREEZE WILL PROHIBIT A CONSUMER REPORTING AGENCY FROM RELEASING ANY INFORMATION IN YOUR CONSUMER REPORT WITHOUT YOUR EXPRESS AUTHORIZATION OR APPROVAL. THE SECURITY FREEZE IS DESIGNED TO PREVENT CREDIT LOANS AND SERVICES FROM BEING APPROVED IN YOUR NAME WITHOUT YOUR CONSENT. WHEN YOU PLACE A SECURITY FREEZE ON YOUR CONSUMER REPORT, WITHIN TEN (10) BUSINESS DAYS YOU WILL BE PROVIDED A PERSONAL IDENTIFICATION NUMBER TO USE IF YOU

CHOOSE TO REMOVE THE SECURITY FREEZE OR TO TEMPORARILY AUTHORIZE THE RELEASE OF YOUR CONSUMER REPORT FOR A PERIOD OF TIME OR TO A SPECIFIC PERSON AFTER THE SECURITY FREEZE IS IN PLACE. A SECURITY FREEZE DOES NOT APPLY TO PERSONS OR ENTITIES LISTED IN IC 24-5-24-11. IF YOU ARE ACTIVELY SEEKING CREDIT, YOU SHOULD UNDERSTAND THAT THE PROCEDURES INVOLVED IN LIFTING A SECURITY FREEZE MAY SLOW YOUR OWN APPLICATIONS FOR CREDIT. YOU HAVE A RIGHT TO BRING A CIVIL ACTION AGAINST SOMEONE WHO VIOLATES YOUR RIGHTS UNDER IC 24-5-24.".
     Sec. 14. A consumer reporting agency may not impose a charge on a consumer for a request from the consumer to do any of the following:
        (1) Place a security freeze on a consumer's consumer report under section 5 of this chapter.
        (2) Issue the same or a new personal identification number or password to a consumer under section 6 of this chapter.
        (3) Release a consumer's consumer report to a third party upon request of the consumer under section 7(a)(1) of this chapter. In addition a consumer reporting agency may not impose a charge on the third party to whom the consumer's consumer report is released under section 7(a)(1) of this chapter in connection with the release.
        (4) Temporarily lift a security freeze under section 7(a)(2) of this chapter.
        (5) Remove a security freeze under section 9 of this chapter.
     Sec. 15. (a) A consumer who suffers injury by an act of a consumer reporting agency that violates this chapter may bring a civil action against the consumer reporting agency in a circuit or superior court in the county in which the consumer resides.
    (b) A person who knowingly or intentionally fails to comply with any requirement imposed under this chapter with respect to a consumer is liable to that consumer in an amount equal to the sum of the following:
        (1) The greater of:
            (A) the amount of actual damages sustained by the consumer as a result of the failure to comply; or
            (B) five hundred dollars ($500).
        However, the amount awarded to a consumer under this subdivision may not exceed six thousand dollars ($6,000),

regardless of the consumer's actual damages.
        (2) Such punitive damages as the court may allow.
        (3) In the case of a successful action by a consumer under this section, the costs of the action together with reasonable attorney's fees as determined by the court.
    Sec. 16. (a) The attorney general may bring an action to recover from a person on behalf of the state a civil penalty described in subsection (b).
    (b) A person who knowingly or intentionally violates this chapter is subject to a civil penalty of:
        (1) not more than two thousand five hundred dollars ($2,500) for a violation or series of violations concerning one (1) consumer; or
        (2) not more than a total of one hundred thousand dollars ($100,000) for related violations concerning more than one (1) consumer.
     Sec. 17. The provisions of this chapter are severable as provided in IC 1-1-1-8(b).