SENATE BILL No. 66

 

 

January 27, 2009, Introduced by Senators JACOBS and SWITALSKI and referred to the Committee on Economic Development and Regulatory Reform.

 

 

 

     A bill to require certain consumer reporting agencies to place

 

security freezes on certain consumer information; to authorize and

 

limit fees; and to provide remedies.

 

THE PEOPLE OF THE STATE OF MICHIGAN ENACT:

 

     Sec. 1. This act shall be known and may be cited as the

 

"consumer security act".

 

     Sec. 3. As used in this act:

 

     (a) "Clear and proper identification" means information

 

generally deemed sufficient to identify an individual.

 

     (b) "Consumer" means an individual who resides in this state.

 

     (c) "Consumer file" means all of the information on a consumer

 

recorded and retained by a consumer reporting agency regardless of

 

how the information is stored.

 

     (d) "Consumer report" means any written, oral, or other


 

communication of any information by a consumer reporting agency

 

bearing on a consumer's creditworthiness, credit standing, credit

 

capacity, character, general reputation, personal characteristics,

 

or mode of living that is issued or expected to be used or

 

collected in whole or in part for the purpose of serving as a

 

factor in establishing the consumer's eligibility for any of the

 

following:

 

     (i) Credit or insurance to be used primarily for personal,

 

family, or household purposes.

 

     (ii) Employment purposes.

 

     (iii) Any other purpose authorized under section 604 of the fair

 

credit reporting act, 15 USC 1681b.

 

     (e) "Consumer reporting agency" means any person who, for

 

monetary fees or dues or on a cooperative nonprofit basis,

 

regularly engages in whole or in part in the practice of assembling

 

or evaluating consumer credit information or other information on

 

consumers for the purpose of furnishing consumer reports to third

 

parties and who uses any means or facility of interstate commerce

 

for the purpose of preparing or furnishing consumer reports.

 

     (f) "Security freeze" means a notice that is placed on a

 

consumer report or consumer file at the request of the consumer and

 

that prohibits a consumer reporting agency from releasing the

 

consumer's consumer report, any information from the consumer

 

report, or the consumer's credit score, without the express

 

authorization of the consumer except in compliance with this act.

 

     (g) "Written request" means either of the following:

 

     (i) A request in writing sent by certified mail, overnight


 

mail, or ordinary mail to a consumer reporting agency.

 

     (ii) A direct request sent to a consumer reporting agency

 

through a secure electronic connection, if the consumer reporting

 

agency provides a secure electronic connection.

 

     Sec. 5. (1) A consumer may place a security freeze on his or

 

her consumer file by making a written request to a consumer

 

reporting agency that includes clear and proper identification of

 

the consumer.

 

     (2) A consumer reporting agency shall place a security freeze

 

on a consumer's consumer file within 5 business days after

 

receiving a written request for the security freeze from the

 

consumer under subsection (1).

 

     (3) If a security freeze is in place, a consumer reporting

 

agency shall not release information from a consumer file to a

 

third party without prior express authorization from the consumer.

 

This subsection does not prevent a consumer reporting agency from

 

advising a third party that a security freeze is in effect with

 

respect to the consumer's consumer file.

 

     Sec. 7. (1) Within 5 business days after a consumer reporting

 

agency places a security freeze on a consumer's consumer file under

 

section 5, the consumer reporting agency shall send a written

 

confirmation of the security freeze to the consumer that includes a

 

unique personal identification number or password that the consumer

 

may use to provide authorization for the release of his or her

 

consumer report, consumer file, or credit information to a specific

 

person or for a specific period of time. In addition, the consumer

 

reporting agency shall simultaneously provide to the consumer in


 

writing the process for placing, removing, and temporarily lifting

 

a security freeze and the process for allowing access to

 

information from the consumer file while the security freeze is in

 

effect.

 

     (2) A consumer may request in writing a replacement personal

 

identification number or password for purposes of subsection (1).

 

The request must comply with the requirements for requesting a

 

security freeze under section 5. Within 5 business days after a

 

consumer reporting agency receives a request for a replacement

 

personal identification number or password, the consumer reporting

 

agency shall provide the consumer with a new, unique personal

 

identification number or password to be used by the consumer

 

instead of the number or password that was provided under

 

subsection (1).

 

     Sec. 9. A consumer reporting agency shall notify a person who

 

requests a consumer report if a security freeze is in effect for

 

the consumer file involved in that consumer report.

 

     Sec. 11. (1) If a consumer wishes to allow access to his or

 

her consumer file to a specific person or for a specific period of

 

time while a security freeze is in place, he or she shall contact

 

the consumer reporting agency, request that the consumer reporting

 

agency allow access to his or her consumer file, and provide all of

 

the following to the consumer reporting agency:

 

     (a) Clear and proper identification.

 

     (b) The unique personal identification number or password

 

provided by the consumer reporting agency under section 5.

 

     (c) Information sufficient to identify the person who is to


 

receive information from the consumer file or a consumer report or

 

the specific time period that the consumer reporting agency should

 

allow users access to the consumer's consumer file.

 

     (2) A consumer reporting agency that receives a request from a

 

consumer to temporarily lift a security freeze on his or her

 

consumer file under subsection (1) shall comply with the request

 

within 3 business days after receiving the request. A consumer

 

reporting agency may develop procedures involving the use of

 

telephone, facsimile, the internet, or other electronic media to

 

receive and process a request from a consumer to temporarily lift a

 

security freeze on a consumer file in an expedited manner.

 

     (3) A security freeze shall remain in place until the consumer

 

requests that the consumer reporting agency remove the security

 

freeze. A consumer reporting agency shall remove a security freeze

 

within 3 business days after receiving a request for removal from

 

the consumer and all of the following information from the

 

consumer:

 

     (a) Clear and proper identification.

 

     (b) The unique personal identification number or password

 

provided by the consumer reporting agency under section 7.

 

     Sec. 13. (1) A consumer reporting agency may impose a

 

reasonable fee on a consumer for initially placing a security

 

freeze on a consumer file. The amount of the fee may not exceed

 

$10.00.

 

     (2) A consumer reporting agency may impose a reasonable fee on

 

a consumer for a request to allow limited access to a consumer file

 

under section 11(1). The amount of the fee may not exceed $8.00 per


 

request.

 

     (3) A consumer reporting agency may not charge a consumer a

 

fee for removing a security freeze under section 11(3).

 

     Sec. 15. A consumer damaged by an intentional or negligent

 

violation of this act by a consumer reporting agency may bring an

 

action for that violation and is entitled to recover his or her

 

actual damages, plus reasonable attorney fees and court costs.