HB-4103, As Passed House, March 20, 2007

 

 

 

 

 

 

 

 

 

 

 

 

 

SUBSTITUTE FOR

 

HOUSE BILL NO. 4103

 

 

 

 

 

 

 

 

 

 

 

 

 

     A bill to require certain consumer reporting agencies to place

 

security freezes on certain consumer credit information; to

 

authorize and limit fees; and to provide remedies.

 

THE PEOPLE OF THE STATE OF MICHIGAN ENACT:

 

     Sec. 1. This act shall be known and may be cited as the

 

"credit security act of 2007".

 

     Sec. 3. As used in this act:

 

     (a) "Clear and proper identification" means information a

 

consumer reporting agency generally considers sufficient to

 

identify an individual.

 

     (b) "Consumer" means an individual who resides in this state.

 

     (c) "Consumer report" means that term as defined in 15 USC

 


House Bill No. 4103 (H-2) as amended March 20, 2007

1681a(d).

 

     (d) "Consumer reporting agency" means that term as defined in

 

15 USC 1681a(f).

 

     (e) "Security freeze" means a notice placed on a consumer

 

report at the request of the consumer that prohibits a consumer

 

reporting agency from releasing the consumer's consumer report or

 

credit score for an extension of credit without the express

 

authorization of the consumer except in compliance with this act.

 

     Sec. 5. (1) [Beginning on the effective date of this act, a

 consumer who is a victim of identity theft, and beginning March 1, 2009, any other consumer] may place a

security freeze on his or her consumer report by making a written

 

request to a consumer reporting agency, sent by certified mail or

 

by overnight delivery using a nationally recognized carrier, to an

 

address designated by that consumer reporting agency to receive

 

requests under this subsection. The request shall include clear and

 

proper identification of the consumer. A consumer reporting agency

 

shall place a security freeze on a consumer's consumer report

 

within 5 business days after receiving a written request for the

 

security freeze from the consumer under this subsection and payment

 

of any applicable fee described in section 13.

 

     (2) Beginning [March] 1, 2009, in addition to accepting

 

written requests under subsection (1), a consumer may make and a

 

consumer reporting agency must accept a request to place a security

 

freeze on his or her consumer report made by electronic mail,

 

secure internet website, telephone, facsimile, or other similar

 

means of telephonic or electronic communication as selected by the

 

consumer reporting agency, and sent to an electronic mail address,

 

internet website, telephone number, or facsimile number designated

 


House Bill No. 4103 (H-2) as amended March 20, 2007

by that consumer reporting agency to receive requests under this

 

subsection. A consumer reporting agency shall place a security

 

freeze on a consumer's consumer file within 5 business days after

 

receiving a request for the security freeze from the consumer under

 

this subsection and payment of any applicable fee described in

 

section 13.

 

     (3) If a security freeze is in place, a consumer reporting

 

agency shall not release information from a consumer report to a

 

third party without prior express authorization from the consumer.

 

This subsection does not prevent a consumer reporting agency from

 

advising a third party that a security freeze is in effect with

 

respect to the consumer's consumer report.

 

     Sec. 7. (1) Within 10 business days after a consumer reporting

 

agency receives a request for a security freeze under section 5,

 

the consumer reporting agency shall provide all of the following to

 

the consumer:

 

     (a) Written confirmation that the security freeze is in place.

 

     (b) A unique personal identification number or password that

 

the consumer may use to provide authorization for access to his or

 

her consumer report for a specific period of time.

 

     (c) A written description of the process for placing,

 

removing, and temporarily lifting a security freeze and the process

 

for allowing access to information from the consumer report while

 

the security freeze is in effect. Beginning [February 1, 2009], the

 

written description described in this subdivision shall include a

 

description of the process and contact information for placing a

 

security freeze under section 5(2) and temporarily lifting the

 


security freeze under section 11(4).

 

     (2) A consumer may request in writing a replacement personal

 

identification number or password for purposes of subsection (1).

 

The request must comply with the requirements for requesting a

 

security freeze under section 5. Within 7 business days after a

 

consumer reporting agency receives a request for a replacement

 

personal identification number or password and payment of any

 

applicable fee described in section 13, the consumer reporting

 

agency shall provide the consumer with a new, unique personal

 

identification number or password to be used by the consumer

 

instead of the number or password that was provided under

 

subsection (1).

 

     Sec. 9. (1) A consumer reporting agency shall notify a person

 

who requests a consumer report if a security freeze is in effect

 

for that consumer report.

 

     (2) If a security freeze is in effect, a consumer reporting

 

agency shall not change a consumer's name, address, date of birth,

 

or social security number in a consumer report without sending a

 

written confirmation of the change to the consumer within 30 days

 

after the posting of the change to the consumer report. If the

 

change is an address change, the consumer reporting agency shall

 

send written confirmation to both the new address and the former

 

address. Written confirmation is not required for a technical

 

modification of information in a consumer report, including name

 

and street abbreviations, complete spellings, or transposition of

 

numbers or letters.

 

     Sec. 11. (1) A consumer reporting agency shall remove or

 


House Bill No. 4103 (H-2) as amended March 20, 2007

temporarily lift a security freeze placed on a consumer report only

 

if 1 of the following applies:

 

     (a) The consumer makes a request under this section and pays

 

any applicable fee under section 13 to the consumer reporting

 

agency at a point of contact designated by that consumer reporting

 

agency.

 

     (b) The consumer report is frozen due to a material

 

misrepresentation of fact by the consumer. If a consumer reporting

 

agency intends to remove a security freeze on a consumer report

 

under this subdivision, the consumer reporting agency shall notify

 

the consumer in writing before removing the security freeze.

 

     (2) If a consumer wishes to allow access to his or her

 

consumer report for a specific period of time while a security

 

freeze is in place, he or she shall contact the consumer reporting

 

agency under subsection (3) or (4), request that the consumer

 

reporting agency temporarily lift the security freeze, and provide

 

all of the following to the consumer reporting agency:

 

     (a) Clear and proper identification of the consumer.

 

     (b) The consumer's unique personal identification number or

 

password provided by the consumer reporting agency under section 7.

 

     (c) The specific time period that the consumer requests that

 

the consumer reporting agency allow users access to his or her

 

consumer report.

 

     (d) Any applicable fee under section 13.

 

     (3) [Beginning on the effective date of this act], a consumer

 reporting agency

shall accept a request from a consumer [who was a victim of identity

 theft, and beginning March 1, 2009, a consumer reporting agency shall accept a request from any other consumer,] to temporarily lift a

security freeze on his or her consumer report under subsection (2)

 


House Bill No. 4103 (H-2) as amended March 20, 2007

if the request is made in writing and is sent by certified mail or

 

by overnight delivery using a nationally recognized carrier to an

 

address designated by that consumer reporting agency to receive

 

requests under this subsection. A consumer reporting agency shall

 

comply with a request to temporarily lift a security freeze under

 

this subsection within 3 business days after receiving the request

 

and payment of any applicable fee described in section 13.

 

     (4) Beginning [March] 1, 2009, in addition to accepting

 

written requests under subsection (3), a consumer may make and a

 

consumer reporting agency must accept a request that a consumer

 

reporting agency temporarily lift a security freeze on his or her

 

consumer report by electronic mail, secure internet website,

 

telephone, facsimile, or other similar means of telephonic or

 

electronic communication as selected by the consumer reporting

 

agency, and sent to an electronic mail address, internet website,

 

telephone number, or facsimile number designated by that consumer

 

reporting agency to receive requests under this subsection. [The request

 shall include the consumer's unique personal identification number or password or shall include the correct answer to a security question selected by the consumer with the agreement of the consumer reporting agency before the consumer's request under this subsection.] A

consumer reporting agency shall comply with a request to

 

temporarily lift a security freeze under this subsection within 15

 

minutes after receiving the request unless the request is received

 

after 9:30 p.m. and before 6 a.m. eastern standard time or unless

 

the consumer reporting agency's ability to temporarily lift the

 

security freeze within 15 minutes is prevented by any of the

 

following:

 

     (a) An act of God, including, but not limited to, fire,

 

earthquake, hurricane, storm, or similar natural disaster or

 

phenomena.

 


     (b) An unauthorized or illegal act by a third party,

 

including, but not limited to, terrorism, sabotage, riot,

 

vandalism, labor strikes or disputes disrupting operations, or

 

similar occurrence.

 

     (c) An operational interruption, including, but not limited

 

to, electrical failure, unanticipated delay in equipment or

 

replacement part delivery, computer hardware or software failures

 

inhibiting response time, or similar disruption.

 

     (d) Governmental action, including, but not limited to, an

 

emergency order or regulation, judicial or law enforcement action,

 

or similar directive.

 

     (e) Regularly scheduled maintenance of or updates to the

 

consumer reporting agency's computer systems that occurs outside of

 

normal business hours.

 

     (f) Commercially reasonable maintenance of or repair to the

 

consumer reporting agency’s computer systems that is unexpected or

 

unscheduled.

 

     (5) A security freeze shall remain in place until the consumer

 

requests that the consumer reporting agency remove the security

 

freeze. A consumer reporting agency shall remove a security freeze

 

within 3 business days after receiving a request for removal from

 

the consumer and the all of the following information from the

 

consumer:

 

     (a) Clear and proper identification.

 

     (b) The unique personal identification number or password

 

provided by the consumer reporting agency under section 7.

 

     Sec. 13. (1) Subject to subsection (2), a consumer reporting

 


House Bill No. 4103 (H-2) as amended March 20, 2007

agency may impose a reasonable fee on a consumer for placing a

 

security freeze on a consumer report under section 5. The amount of

 

a fee imposed under this subsection shall not exceed $20.00.

 

     (2) A consumer reporting agency may not charge a fee for

 

placing a security freeze on a consumer report if the consumer is a

 

victim of identity theft and provides the consumer reporting agency

 

upon request with a police report that confirms that the consumer

 

was a victim of identity theft [or if the consumer is 60 years old or

 older].

     (3) A consumer reporting agency may impose a reasonable fee on

 

a consumer for replacing a personal identification number or

 

password under section 7(2). The amount of a fee imposed under this

 

subsection shall not exceed $10.00.

 

     (4) A consumer reporting agency shall not charge a consumer a

 

fee for temporarily lifting or removing a security freeze under

 

section 11.

 

     Sec. 15. (1) A consumer may bring an action against a person

 

that negligently fails to comply with any requirement imposed under

 

this act with respect to the consumer to recover actual damages

 

sustained by the consumer as a result of the failure, plus

 

reasonable attorney fees and court costs.

 

     (2) A consumer may bring an action against a person that

 

willfully fails to comply with any requirement imposed under this

 

act with respect to the consumer to recover actual damages

 

sustained by the consumer as a result of the failure or damages of

 

not less than $100.00 and not more than $1,000.00, whichever is

 

greater, plus reasonable attorney fees and court costs if the

 

consumer is successful in obtaining any award in the action. The

 


House Bill No. 4103 (H-2) as amended March 20, 2007

court may also award the [consumer] any punitive damages that it

 

considers proper.

 

     (3) A consumer reporting agency may bring an action against a

 

person that obtains a consumer report or requests a security

 

freeze, the temporary lift of a freeze, or the removal of a freeze

 

from the consumer reporting agency under false pretenses or in an

 

attempt to violate federal or state law to recover actual damages

 

sustained by the consumer reporting agency or $1,000.00, whichever

 

is greater.

 

     (4) If the court in an action described in this section finds

 

that an unsuccessful pleading, motion, or other paper filed in

 

connection with the action was filed in bad faith or for purposes

 

of harassment, the court shall award attorney fees to the

 

prevailing party in an amount the court finds reasonable in

 

relation to the work expended in responding to the pleading,

 

motion, or paper.

 

     Sec. 17. (1) This act does not apply to the use of a consumer

 

report by any of the following:

 

     (a) If the consumer report is used for the purpose of

 

reviewing the account or collecting the financial obligation owing

 

for the account, contract, or negotiable instrument, a person with

 

which a consumer has or had prior to assignment an account or

 

contract or to which the consumer has issued a negotiable

 

instrument; a subsidiary, affiliate, or agent of that person; an

 

assignee of a financial obligation owed by the consumer to that

 

person; or a prospective assignee of a financial obligation owed by

 

the consumer to that person in conjunction with the proposed

 


purchase of the financial obligation.

 

     (b) A subsidiary, affiliate, agent, assignee, or prospective

 

assignee of a person to which access has been granted for purposes

 

of facilitating an extension of credit or other permissible use.

 

     (c) A state or local agency, law enforcement agency, trial

 

court, or private collection agency acting pursuant to a court

 

order, warrant, or subpoena.

 

     (d) A child support agency acting pursuant to part d of title

 

IV of the social security act, 42 USC 651 to 669b.

 

     (e) The state or its agents or assigns acting to investigate

 

fraud, acting to investigate or collect delinquent taxes or unpaid

 

court orders, or acting to fulfill any of its other statutory

 

responsibilities if those responsibilities are consistent with a

 

permissible purpose under 15 USC 1681b.

 

     (f) A person setting or adjusting a rate, adjusting a claim,

 

or underwriting for insurance purposes.

 

     (g) A person using credit information for the purpose of

 

prescreening as provided for by the fair credit reporting act, 15

 

USC 1681 to 1681v.

 

     (h) A person administering a consumer report monitoring

 

subscription service to which the consumer has subscribed.

 

     (i) A person providing a consumer with a copy of his or her

 

consumer report in response to the consumer's request.

 

     (2) As used in this section:

 

     (a) "Account" includes a demand deposit account.

 

     (b) "Reviewing the account" includes activities related to

 

account maintenance, monitoring, credit line increases, and account

 


upgrades and enhancements.

 

     Sec. 19. The following entities are not required to place a

 

security freeze on a consumer report:

 

     (a) A consumer reporting agency that acts only as a reseller

 

of credit information by assembling and merging information

 

contained in the database of another consumer reporting agency or

 

multiple consumer reporting agencies and does not maintain a

 

permanent database of credit information from which new consumer

 

reports are produced. However, a consumer reporting agency acting

 

as a reseller shall honor any security freeze placed on a consumer

 

credit report by another consumer reporting agency.

 

     (b) A check services or fraud prevention services company that

 

issues reports on incidents of fraud or authorizations for the

 

purpose of approving or processing negotiable instruments,

 

electronic funds transfers, or similar methods of payments.

 

     (c) A deposit account information service company that issues

 

reports regarding account closures due to fraud, substantial

 

overdrafts, automatic teller machine abuse, or similar negative

 

information regarding a consumer to inquiring financial

 

institutions for use only in reviewing a consumer request for a

 

deposit account at the inquiring financial institution.

 

     (d) A consumer reporting agency, if its database or file

 

consists only of information concerning and used for criminal

 

record information, fraud prevention or detection, personal loss

 

history information, or employment, tenant, or background

 

screening.

 

     Enacting section 1. This act takes effect 60 days after the

 


date it is enacted.