April 26, 2005, Introduced by Reps. Angerer, Kehrl, Polidori, Spade, Wojno, Byrnes, Vagnozzi, Sheltrown, Lemmons, Jr., Donigan, Clemente, Gonzales, Condino, McDowell, Espinoza, Alma Smith, Waters, Bieda, Gleason, Hune, Gaffney, Jones, Kathleen Law, Hopgood, Hansen, Byrum, Plakas, Pearce, Green, Mortimer, Ball, Wenke, Anderson and Nofs and referred to the Committee on Commerce.
A bill to require certain credit reporting agencies to place
security alerts and security freezes on certain consumer credit
information; to authorize and limit fees; and to provide remedies.
THE PEOPLE OF THE STATE OF MICHIGAN ENACT:
Sec. 1. This act shall be known and may be cited as the
"credit security act of 2005".
Sec. 3. As used in this act:
(a) "Clear and proper identification" means information
generally deemed sufficient to identify an individual.
(b) "Consumer" means an individual who resides in this state.
(c) "Consumer file" means any file or record maintained by a
credit reporting agency about a consumer.
(d) "Credit report" means any written, oral, or other
communication of any credit information by a credit reporting
agency that operates or maintains a database of consumer credit
information bearing on a consumer's creditworthiness, credit
standing, or credit capacity.
(e) "Credit reporting agency" means any person who, for
monetary fees or dues or on a cooperative nonprofit basis,
regularly engages in whole or in part in the practice of assembling
or evaluating consumer credit information or other information on
consumers for the purpose of furnishing consumer reports to third
parties and who uses any means or facility of interstate commerce
for the purpose of preparing or furnishing credit reports. The term
does not include a check acceptance service that provides check
approval and guarantee services to merchants.
(f) "Security alert" means a notice that is placed on a
consumer file at the request of the consumer, is sent to a
recipient of a credit report involving that consumer file, and
states that the consumer's identity may have been used without the
consumer's consent to fraudulently obtain goods or services in the
consumer's name.
(g) "Security freeze" means a notice placed on a consumer file
at the request of the consumer and that prohibits a credit
reporting agency from releasing the consumer's credit report or
credit score without the express authorization of the consumer
except in compliance with this act.
Sec. 5. (1) A consumer may place a security freeze on his or
her consumer file by making a written request to a credit reporting
agency that includes clear and proper identification of the
consumer. A credit reporting agency shall place a security freeze
on a consumer's consumer file within 10 business days after
receiving a written request for the security freeze from the
consumer under this subsection.
(2) If a security freeze is in place, a credit reporting
agency shall not release information from a consumer file to a
third party without prior express authorization from the consumer.
This subsection does not prevent a credit reporting agency from
advising a third party that a security freeze is in effect with
respect to the consumer's consumer file.
Sec. 7. (1) Within 10 business days after a credit reporting
agency receives a request for a security freeze under section 5,
the credit reporting agency shall provide the consumer with a
unique personal identification number or password that the consumer
may use to provide authorization for access to his or her consumer
file for a specific period of time. In addition, the credit
reporting agency shall simultaneously provide to the consumer in
writing the process for placing, removing, and temporarily lifting
a security freeze and the process for allowing access to
information from the consumer file while the security freeze is in
effect.
(2) A consumer may request in writing a replacement personal
identification number or password for purposes of subsection (1).
The request must comply with the requirements for requesting a
security freeze under section 5. Within 7 business days after a
credit reporting agency receives a request for a replacement
personal identification number or password, the credit reporting
agency shall provide the consumer with a new, unique personal
identification number or password to be used by the consumer
instead of the number or password that was provided under
subsection (1).
Sec. 9. (1) A credit reporting agency shall notify a person
who requests a credit report if a security freeze is in effect for
the consumer file involved in that credit report.
(2) If a security freeze is in effect, a credit reporting
agency shall not change any of the following information in a
consumer file without sending a written confirmation of the change
to the consumer within 30 days after the posting of the change to
the consumer's file: name, date of birth, social security number,
or address. If the change is an address change, the credit
reporting agency shall send written confirmation to both the new
address and the former address. Written confirmation is not
required for a technical modification of information in a consumer
file, including name and street abbreviations, complete spellings,
or transposition of numbers or letters.
Sec. 11. (1) A credit reporting agency shall remove or
temporarily lift a security freeze placed on a consumer file only
if 1 of the following applies:
(a) The consumer makes a request under this section and pays
any applicable fees under section 13.
(b) The consumer file is frozen due to a material
misrepresentation of fact by the consumer. If a credit reporting
agency intends to remove a security freeze on a consumer file under
this subdivision, the credit reporting agency shall notify the
consumer in writing before removing the security freeze.
(2) If a consumer wishes to allow access to his or her
consumer file for a specific period of time while a security freeze
is in place, he or she shall contact the credit reporting agency
and request that the credit reporting agency temporarily lift the
security freeze and provide all of the following to the credit
reporting agency:
(a) Clear and proper identification.
(b) The unique personal identification number or password
provided by the credit reporting agency under section 5.
(c) The specific time period that the consumer requests that
the credit reporting agency allow users access to his or her
consumer file.
(3) A credit reporting agency that receives a request from a
consumer to temporarily lift a security freeze on his or her
consumer file under subsection (2) shall comply with the request
within 3 business days after receiving the request. A credit
reporting agency may develop procedures involving the use of
telephone, facsimile, the internet, or other electronic media to
receive and process a request from a consumer to temporarily lift a
security freeze on a consumer file in an expedited manner.
(4) A security freeze shall remain in place until the consumer
requests that the credit reporting agency remove the security
freeze. A credit reporting agency shall remove a security freeze
within 3 business days after receiving a request for removal from
the consumer and the all of the following information from the
consumer:
(a) Clear and proper identification.
(b) The unique personal identification number or password
provided by the credit reporting agency under section 7.
Sec. 13. (1) A credit reporting agency may impose a reasonable
fee on a consumer for initially placing a security freeze on a
consumer file. The amount of the fee may not exceed $10.00.
(2) A credit reporting agency may impose a reasonable fee on a
consumer to temporarily lift a security freeze on a consumer file.
The amount of the fee may not exceed $8.00 per request.
(3) A credit reporting agency may not charge a consumer a fee
for revoking a security freeze.
Sec. 15. A consumer damaged by an intentional or negligent
violation of this act may bring an action for and is entitled to
recover his or her actual damages, plus reasonable attorney fees
and court costs.