SB-0340, As Passed Senate, May 23, 2007

 

 

 

 

 

 

 

 

 

 

 

 

SUBSTITUTE FOR

 

SENATE BILL NO. 340

 

 

 

 

 

 

 

 

 

 

 

 

 

     A bill to require certain consumer reporting agencies to place

 

security freezes on certain consumer credit information; to provide

 

for the removal and temporary lifting of security freezes; to

 

provide for the powers and duties of certain state officers and

 

entities; and to authorize and limit fees.

 

THE PEOPLE OF THE STATE OF MICHIGAN ENACT:

 

     Sec. 1. This act shall be known and may be cited as the

 

"consumer credit protection act".

 

     Sec. 3. As used in this act:

 

     (a) "Clear and proper identification" means information

 

generally considered sufficient to identify an individual.

 

     (b) "Consumer" means an individual who resides in this state.

 

     (c) "Consumer reporting agency" means that term as defined in


 

15 USC 1681a(f). The term does not include a check acceptance

 

service that provides check approval and guarantee services to

 

merchants.

 

     (d) "Credit report" means a consumer report, as defined in 15

 

USC 1681a, that is used or collected in whole or part for the

 

purpose of serving as a factor in establishing a consumer's

 

eligibility for credit for personal, family, or household purposes.

 

     (e) In connection with a reply by a consumer reporting agency

 

to an electronic request, "delay event" means any of the following:

 

     (i) The electronic request is received after 9:30 p.m. and

 

before 6 a.m. eastern standard time.

 

     (ii) An act of God, including, but not limited to, fire,

 

earthquake, hurricane, storm, or similar natural disaster or

 

phenomenon.

 

     (iii) An unauthorized or illegal act by a third party,

 

including, but not limited to, terrorism, sabotage, riot,

 

vandalism, a labor strike or dispute disrupting operations, or

 

similar occurrence.

 

     (iv) An operational interruption, including, but not limited

 

to, electrical failure, unanticipated delay in equipment or

 

replacement part delivery, computer hardware or software failure

 

inhibiting response time, or similar disruption.

 

     (v) Governmental action, including, but not limited to, an

 

emergency order or regulation, judicial or law enforcement action,

 

or similar directive.

 

     (vi) Regularly scheduled maintenance of or updates to a

 

consumer reporting agency's computer system that occur outside of


 

normal business hours.

 

     (vii) Commercially reasonable maintenance of or repair to a

 

consumer reporting agency's computer system that is unexpected or

 

unscheduled.

 

     (viii) The consumer reporting agency cannot access the

 

electronic mail address, telephone number, or facsimile number

 

provided by the consumer in compliance with the process described

 

in section 7(1)(b).

 

     (f) "Electronic request" means a request sent to a consumer

 

reporting agency by electronic mail, secure internet website,

 

telephone, facsimile, or other similar means of telephonic or

 

electronic communication as selected by the consumer reporting

 

agency, by submitting that request to the electronic mail address,

 

internet website, telephone number, or facsimile number designated

 

by the consumer reporting agency to receive that type of request,

 

that includes clear and proper identification of the consumer.

 

     (g) "Security freeze" means a notice placed on a consumer

 

report at the request of the consumer that prohibits a consumer

 

reporting agency from releasing the consumer's credit report or

 

credit score related to extensions of credit without the express

 

authorization of the consumer except in compliance with this act.

 

     (h) "Written request" means a request sent to a consumer

 

reporting agency, in writing, by certified mail to an address

 

designated by the consumer reporting agency to receive that type of

 

request, that includes clear and proper identification of the

 

consumer and the consumer's address for replies.

 

     Sec. 5. (1) Beginning on the effective date of this act, a


 

consumer who is a victim of identity theft may request and a

 

consumer reporting agency shall place a security freeze on that

 

consumer's credit report if that consumer submits a written request

 

to the consumer reporting agency and includes with the request a

 

copy of a police report that alleges that he or she was a victim of

 

identity theft.

 

     (2) All of the following apply beginning September 1, 2008:

 

     (a) As an alternative to a written request under subsection

 

(1), a consumer who is a victim of identity theft may request and a

 

consumer reporting agency shall place a security freeze on that

 

consumer's credit report if that consumer submits an electronic

 

request to the consumer reporting agency and includes with the

 

request a copy of a police report that alleges that he or she was a

 

victim of identity theft.

 

     (b) A consumer who is 65 years old or older may request and a

 

consumer reporting agency shall place a security freeze on that

 

consumer's credit report if that consumer submits a written request

 

or an electronic request to the consumer reporting agency.

 

     (3) Beginning January 1, 2009, any consumer may request and a

 

consumer reporting agency shall place a security freeze on that

 

consumer's credit report if that consumer submits a written request

 

or an electronic request to the consumer reporting agency and

 

includes with the request payment of the fee under section 13, if

 

applicable.

 

     (4) A consumer reporting agency shall place a security freeze

 

on a consumer's credit report within 10 business days after

 

receiving a written or electronic request for the security freeze


 

that complies with this section from the consumer.

 

     (5) If a security freeze is in place, a consumer reporting

 

agency shall not release information from a credit report to a

 

third party without prior express authorization from the consumer.

 

This subsection does not prevent a consumer reporting agency from

 

advising a third party that a security freeze is in effect with

 

respect to the consumer's credit report.

 

     Sec. 7. (1) Within 10 business days after a consumer reporting

 

agency receives a written or electronic request to place a security

 

freeze that complies with section 5, the consumer reporting agency

 

shall provide the consumer with written confirmation of the

 

security freeze and a unique personal identification number or

 

password that the consumer may use to remove or temporarily lift a

 

security freeze under section 11. In addition, the consumer

 

reporting agency shall simultaneously provide all of the following

 

to the consumer in writing:

 

     (a) The process for placing, removing, and temporarily lifting

 

a security freeze.

 

     (b) The process for obtaining a replacement or reminder of a

 

personal identification number or password for purposes of

 

subsections (2) and (3), including, but not limited to, a

 

description of how a consumer may submit an electronic request for

 

a replacement or reminder of a personal identification number or

 

password; whether the consumer reporting agency uses electronic

 

mail, telephone calls, facsimile transmissions, postings to secure

 

internet websites, or other similar means of telephonic or

 

electronic communication to send replacements or reminders of


 

personal identification numbers or passwords under subsection (4);

 

and how a consumer may provide or update his or her electronic mail

 

address, telephone number, facsimile number, or other telephonic or

 

electronic contact information to the consumer reporting agency.

 

     (c) The process for obtaining a specific personal

 

identification number or password for purposes of subsection (5).

 

     (2) A consumer who has forgotten or cannot locate his or her

 

personal identification number or password for purposes of

 

subsection (1) may submit a written request for a replacement

 

personal identification number or password. Within 10 business days

 

after a consumer reporting agency receives a written request for a

 

replacement personal identification number or password, the

 

consumer reporting agency shall provide the consumer with a new,

 

unique personal identification number or password to be used by the

 

consumer instead of the number or password that was provided under

 

subsection (1).

 

     (3) Beginning January 1, 2009, as an alternative to making a

 

written request for a replacement personal identification number or

 

password under subsection (2), if a consumer who is entitled to

 

make an electronic request to place a security freeze under section

 

5 forgets or cannot locate his or her personal identification

 

number or password, the consumer may obtain a replacement or

 

reminder of his or her personal identification number or password

 

by submitting an electronic request for a replacement or reminder

 

of his or her personal identification number or password to the

 

consumer reporting agency.

 

     (4) Within 15 minutes after a consumer reporting agency


 

receives an electronic request for a replacement or reminder of a

 

personal identification number or password under subsection (3),

 

unless the consumer reporting agency's ability to respond in 15

 

minutes is prevented by a delay event, the consumer reporting

 

agency shall provide the consumer with a new, unique personal

 

identification number or password that the consumer may use instead

 

of the number or password provided under subsection (1), or provide

 

the consumer with a reminder of his or her personal identification

 

number or password. The consumer reporting agency shall send the

 

replacement personal identification number or password or reminder

 

of the consumer's personal identification number or password to the

 

consumer's electronic mail address, telephone number, facsimile

 

number, secure internet website, or other telephonic or electronic

 

communication destination number or address provided pursuant to

 

the process described in subsection (1)(b). If the consumer has not

 

provided a current electronic mail address, telephone number, or

 

facsimile number to the consumer reporting agency in compliance

 

with that process, the consumer reporting agency may provide the

 

replacement personal identification number or password or reminder

 

of the consumer's personal identification number or password to the

 

consumer pursuant to subsection (2).

 

     (5) A consumer may submit a written request, or an electronic

 

request if that consumer is entitled to make an electronic request

 

to place a security freeze under section 5, for a specific personal

 

identification number or password that the consumer may use to

 

remove or temporarily lift a security freeze under section 11. The

 

request must include the personal identification number or password


 

assigned by the consumer reporting agency; include the specific

 

personal identification number or password requested by the

 

consumer; and comply with the process described in subsection

 

(1)(c). Within 10 business days after a consumer reporting agency

 

receives a request for a specific personal identification number or

 

password under this subsection, the consumer reporting agency shall

 

provide the consumer with the personal identification number or

 

password requested by the consumer or notification that the

 

personal identification number or password is unavailable for use

 

by the consumer.

 

     Sec. 9. If a security freeze is in effect, a consumer

 

reporting agency shall not change a consumer's name, address, date

 

of birth, or social security number in a credit report without

 

sending a written confirmation of the change to the consumer within

 

30 days after the posting of the change to the credit report. If

 

the change is an address change, the consumer reporting agency

 

shall send written confirmation to both the new address and the

 

former address. Written confirmation is not required for a

 

technical modification of information in a credit report, including

 

name and street abbreviations, complete spellings, or transposition

 

of numbers or letters.

 

     Sec. 11. (1) A consumer reporting agency shall remove or

 

temporarily lift a security freeze placed on a credit report only

 

if 1 of the following applies:

 

     (a) The consumer makes a request under this section to the

 

consumer reporting agency at a point of contact designated by that

 

consumer reporting agency.


 

     (b) The credit report is frozen due to a material

 

misrepresentation of fact by the consumer. If a consumer reporting

 

agency intends to remove a security freeze on a credit report under

 

this subdivision, the consumer reporting agency shall provide

 

written notice to the consumer before removing the security freeze.

 

     (2) If a consumer wishes to allow access to his or her credit

 

report for a specific period of time while a security freeze is in

 

place, he or she may make a written request to the consumer

 

reporting agency to temporarily lift the security freeze. The

 

written request shall include the unique personal identification

 

number or password established under section 7 and the specific

 

time period that the consumer requests that the consumer reporting

 

agency allow a creditor or proposed creditor access to his or her

 

credit report. A consumer reporting agency that receives a written

 

request to temporarily lift a security freeze on a consumer's

 

credit report shall comply with the request within 3 business days

 

after receiving the request.

 

     (3) If a consumer who is entitled to make an electronic

 

request to place a security freeze under section 5 wishes to allow

 

access to his or her credit report for a specific period of time

 

while a security freeze is in place, he or she may make an

 

electronic request to the consumer reporting agency to temporarily

 

lift the freeze. The electronic request shall include the unique

 

personal identification number or password established under

 

section 7 and the specific time period that the consumer requests

 

that the consumer reporting agency allow a creditor or proposed

 

creditor access to his or her credit report. Within 15 minutes


 

after a consumer reporting agency receives an electronic request to

 

temporarily lift a security freeze, unless the consumer reporting

 

agency's ability to respond in 15 minutes is prevented by a delay

 

event, the consumer reporting agency shall comply with the request

 

to temporarily lift the security freeze and provide the consumer

 

with notice that the security freeze is temporarily lifted.

 

     (4) A security freeze shall remain in place until the consumer

 

requests that the consumer reporting agency remove the security

 

freeze. The request shall include the unique personal

 

identification number or password established under section 7. A

 

consumer reporting agency shall remove a security freeze within 3

 

business days after receiving a written request for removal from a

 

consumer, or after receiving an electronic request for removal from

 

a consumer who is entitled to make an electronic request to place a

 

security freeze under section 5.

 

     Sec. 13. (1) Subject to subsection (2), a consumer reporting

 

agency may impose a reasonable fee on a consumer for placing a

 

security freeze on a credit report. The amount of the fee may not

 

exceed $10.00 per request.

 

     (2) A consumer reporting agency may not charge any of the

 

following consumers a fee for placing a security freeze on a credit

 

report:

 

     (a) A consumer who was a victim of identity theft and who

 

provides the consumer reporting agency with a police report that

 

alleges that the consumer was a victim of identity theft.

 

     (b) A consumer who is 65 years old or older.

 

     (3) A consumer reporting agency shall not charge a consumer a


 

fee for lifting or removing a security freeze under this act.

 

     (4) A consumer reporting agency may impose a reasonable fee on

 

a consumer for issuing a replacement personal identification number

 

or password or a specific personal identification number or

 

password under section 7. The amount of the fee may not exceed

 

$10.00 per request.

 

     Sec. 15. The following entities are not required to place a

 

security freeze on a credit report:

 

     (a) A consumer reporting agency that acts only as a reseller

 

of credit information by assembling and merging information

 

contained in the database of another consumer reporting agency or

 

multiple consumer reporting agencies and does not maintain a

 

permanent database of credit information from which new credit

 

reports are produced. However, a consumer reporting agency acting

 

as a reseller shall honor any security freeze placed on a credit

 

report by another consumer reporting agency.

 

     (b) A check services or fraud prevention services company that

 

issues reports on incidents of fraud or authorizations for the

 

purpose of approving or processing negotiable instruments,

 

electronic funds transfers, or similar methods of payments.

 

     (c) A deposit account information service company that issues

 

reports regarding account closures due to fraud, substantial

 

overdrafts, automatic teller machine abuse, or similar negative

 

information regarding a consumer to inquiring financial

 

institutions for use only in reviewing a consumer request for a

 

deposit account at the inquiring financial institution.

 

     Sec. 17. (1) This act does not apply to the use of a credit


 

report by any of the following:

 

     (a) If the credit report is used for the purpose of reviewing

 

the account or collecting the financial obligation owing for the

 

account, contract, or negotiable instrument, a person with which a

 

consumer has or had prior to assignment an account or contract or

 

to which the consumer has issued a negotiable instrument; a

 

subsidiary, affiliate, or agent of that person; an assignee of a

 

financial obligation owed by the consumer to that person; or a

 

prospective assignee of a financial obligation owed by the consumer

 

to that person in conjunction with the proposed purchase of the

 

financial obligation.

 

     (b) A subsidiary, affiliate, agent, assignee, or prospective

 

assignee of a person to which access has been granted for purposes

 

of facilitating an extension of credit or other permissible use.

 

     (c) A state or local agency, law enforcement agency, trial

 

court, or private collection agency acting pursuant to a court

 

order, warrant, or subpoena.

 

     (d) A child support agency acting pursuant to part d of title

 

IV of the social security act, 42 USC 651 to 669b.

 

     (e) The state or its agents or assigns acting to investigate

 

fraud, acting to investigate or collect delinquent taxes or unpaid

 

court orders, or acting to fulfill any of its other statutory

 

responsibilities if those responsibilities are consistent with a

 

permissible purpose under 15 USC 1681b.

 

     (f) A person setting or adjusting a rate, adjusting a claim,

 

or underwriting for insurance purposes.

 

     (g) A person using credit information for the purpose of


 

prescreening as provided for by the fair credit reporting act, 15

 

USC 1681 to 1681v.

 

     (h) A person administering a credit report monitoring

 

subscription service to which the consumer has subscribed.

 

     (i) A person providing a consumer with a copy of his or her

 

credit report in response to the consumer's request.

 

     (2) As used in this section:

 

     (a) "Account" includes a demand deposit account.

 

     (b) "Reviewing the account" includes activities related to

 

account maintenance, monitoring, credit line increases, and account

 

upgrades and enhancements.

 

     Sec. 19. (1) The office of financial and insurance services in

 

the department of labor and economic growth shall provide

 

information describing the process for placing a security freeze

 

under this act and educational information concerning how placing a

 

security freeze can help reduce identity theft on a webpage

 

available to the public through its internet website.

 

     (2) The office of attorney general shall post a link to the

 

webpage described in subsection (1) on its internet website.

 

     Enacting section 1. This act takes effect 90 days after the

 

date it is enacted.

 

     Enacting section 2. This act does not take effect unless

 

Senate Bill No. 75 of the 94th Legislature is enacted into law.