Title: An act relating to placing a security freeze on a credit report.

Brief Description: Allowing consumers to place a security freeze on a credit report.

Sponsors: Senators Berkey, Benton, Fairley, Shin, Kastama, Carrell, McAuliffe, Benson, Prentice, Delvin, Kohl-Welles, Keiser and Kline.

Brief History:

Financial Institutions & Insurance: 3/17/05, 3/31/05 [DPA].

HOUSE COMMITTEE ON FINANCIAL INSTITUTIONS & INSURANCE

Majority Report: Do pass as amended. Signed by 7 members: Representatives Kirby, Chair; Ericks, Vice Chair; Roach, Ranking Minority Member; O'Brien, Santos, Simpson and Williams.

Minority Report: Do not pass. Signed by 4 members: Representatives Tom, Assistant Ranking Minority Member; Newhouse, Serben and Strow.

Staff: CeCe Clynch (786-7168).

Background:

"Identity theft" is defined, by the Federal Trade Commission (FTC), as "someone appropriating your personal information without your knowledge to commit fraud or theft." With 5,654 complaints reported in Washington in 2004, this state is eighth among the states in the per capita reporting of identity theft.

Consumer credit reports contain personal information such as name, address, former address, and social security number. They also include information on bill paying habits, credit history, and public record information on finances such as bankruptcies, liens, and court judgments. The three primary consumer credit reporting agencies - Equifax, Experian, and Transunion - obtain much of their information from national credit card, automobile finance, and student loan companies which report to these three primary agencies regularly. Other, smaller entities which extend credit to consumers provide information as well, though not always on a regular basis.

Individuals, businesses, and government agencies may request a credit report for legitimate business needs involving a transaction with a consumer such as an application for credit, opening an account, a security clearance, employment, and collection of an account.

Current Washington law permits a victim of identity theft to permanently block a consumer reporting agency from reporting information the consumer identifies as being the result of identity theft. Federal law contains similar blocking provisions available to identity theft victims. In addition, under federal law, all consumers are entitled to one free credit report per year.

Neither federal law nor Washington law allows a consumer to block dissemination of his or her credit report. Some states do permit consumers to place a security freeze on their credit reports. All consumers in California and Louisiana may do so. In Texas and Vermont, only victims of identity theft may institute such a freeze.

Summary of Amended Bill:

A "victim of identity theft" may elect to place a security freeze on his or her credit report by submitting a written request via certified mail to a consumer reporting agency. Subject to certain enumerated exceptions, upon receipt of the written request the consumer reporting agency is prohibited from releasing the report or information from the report without the consumer's express permission. A victim of identity theft requesting a freeze is given a personal identification number to use when making a request for a temporary lifting of the freeze or for a release to a particular person or entity.

"Victim of identity theft" means a victim of identity theft as defined in the statute criminalizing identity theft or a person who has been notified by an agency, person, or business that owns or licenses computerized data of a breach in a computerized data system which has resulted in the acquisition of that person's unencrypted personal information by an unauthorized person or entity.

A freeze does not apply to:

• persons or entities to whom the consumer owes money;
• affiliates or subsidiaries of entities with respect to whom the freeze has been lifted by the consumer;
• law enforcement, federal, state and local agencies, and courts;
• private collection agencies acting under court order;
• a child support agency acting under Title IV-D of the Social Security Act;
• the Department of Social and Health Services acting to fulfill any of its statutory responsibilities;
• the Internal Revenue Service (IRS);
• the use of credit information for purposes of pre-screening as provided by the Federal Fair Credit Reporting Act;
• a person administering credit file monitoring with respect to a subscription service to which a consumer has subscribed; and
• a request for which a consumer has lifted the freeze.

While a freeze is in effect, a consumer reporting agency must provide the consumer with notice before changing the name, date of birth, social security number, or address in the consumer's file. A reporting agency may advise third parties that a freeze is in effect. A reporting agency may also furnish to a government agency certain information such as the consumer's name, address, former address, place of employment, and former place of employment.

Certain entities are not required to place a security freeze in a credit report:

• check services or fraud prevention services company; and
• a deposit account information service company which issues reports regarding account closures and ATM abuse.

Amended Bill Compared to Original Bill:

Rather than all consumers, only victims of identity theft may place a security freeze on their credit reports. The definition of "victim of identity theft" is expanded to also include persons who have been notified by an agency, person, or business that owns or licenses computerized data of a breach in a computerized data system which has resulted in the acquisition of that person's unencrypted personal information by an unauthorized person or entity. The provision which would have allowed a fee to be charged for placing, removing, or lifting a freeze is removed. Another section which would have allowed consumers, by means of a phone call or in writing, to remove their names from lists furnished for purposes of credit card solicitation is also removed. All references to "consumer credit reporting agency" are changed to "consumer reporting agency", making the references consistent with the definition and terminology found in Chapter 19.182 RCW.

Appropriation: None.

Fiscal Note: Not requested.

Effective Date of Amended Bill: The bill takes effect 90 days after adjournment of session in which bill is passed.

Testimony For: (In support) This will allow individuals to prevent identity theft. A recent front page Wall Street Journal article referred to a security freeze as an "ironclad guarantee" that a person's identity would not be stolen. Current law does have provisions allowing fraud alerts, but unless an individual has been a victim of identity theft and has a police report to that effect, that individual cannot place a seven year fraud alert on his or her credit report. An individual that only suspects that he or she may have been a victim may utilize a 90 day fraud alert but these must be continually renewed and they are routinely ignored. Current laws address identity theft after the fact and do not prevent identity theft in the first place. Being the victim of identity theft can be incredibly difficult, expensive, and traumatic. Allowing a consumer to place a security freeze is a fair and reasonable approach and, because other states like California and Louisiana have already enacted laws which permit a security freeze, the infrastructure is already in place. Even if having a credit freeze in place will delay the granting of credit until the freeze is lifted, this is not reason to vote "no" because credit is much too easy to get these days as it is. There is nothing wrong with having to wait a few more days rather than make a spur of the moment purchase. The implication that people who would request a security freeze have "something to hide" is very insulting. The only thing people who ask for a security freeze have to hide is their very own personal information. After the fact fraud alerts are not adequate protection. According to the Federal Trade Commission, Washington is eighth per capita in terms of reported instances of identity theft but how the percentage of the population reporting identity theft compares to the percentage of the population financing through Fannie Mae and Freddie Mac is unknown.

(With concerns) Insurers use credit related information because it has proven to be an accurate predictor. It is important that this information be accurate and timely. In its current form, enactment of this legislation would slow down insurance transactions. If enacted, there should be an exclusion for insurance purposes.

Testimony Against: Although well-intentioned, there can be many adverse, unintended consequences to security freezes. California and Texas have allowed security freezes since 2003. Two other states, Louisiana and Vermont, have enacted similar legislation which will go into effect later this year. Although only about 2,000 people in California have placed a freeze on their credit reports to date, the experience in California has illustrated the problems with security freezes. Fannie Mae has chosen not to underwrite where there is a freeze in place. In today's competitive home-buying market, time is of the essence. Freezes slow the process down. Sixty- three percent of mortgages are handled by mortgage brokers who then turn around and sell the mortgages. A credit freeze can affect the saleability of a mortgage. While the freeze is supposed to be lifted within three days of a consumer requesting that it be lifted, the actual average time is eight to 12 days. If the consumer loses the PIN number the delay can be even longer. Such a delay can be devastating in a fast paced housing market where the average transaction takes between 30 and 45 days. A buyer can lose the ability to buy the house or be unable to take advantage of favorable terms. Less than 5 percent of persons are hit more than once with identity theft. Allowing a credit freeze will not protect against such theft. Instead, consumers should be educated as to how to protect their credit and the use of Social Security numbers on drivers' licenses, power bills, and the like should be stopped. The fees for requesting and lifting a credit freeze can be significant, especially because there are three different credit reporting agencies. This also means that a consumer receives at least three different PIN numbers. Recent federal laws which just became effective in December of 2004 contain lots of new prevention provisions and there are new rules currently being written at the federal level. These new provisions should be allowed to work. In addition to fraud alerts of seven years and 90 days, the new federal laws allow a consumer to receive two free credit reports during a 12- month period. If there is information being reported due to identity theft, and the credit reporting agency is notified of this, it must remove the information and permanently block any reinsertion of that information. Newly effective laws also make it illegal for a collection agency to knowingly continue to report or try to collect on an account that was created or impacted by identity theft. While consumers are allowed to lift a freeze only for a particular creditor, the consumer often is unaware of the name of the creditor since retailers seldom own their own credit anymore. Considerable time and effort was spent by numerous parties crafting what is current Washington law. Credit freezes were considered but were not included because of the adverse consequences. Any effort to change current law should slow down and make sure that all the stakeholders are at the table so as to avoid unintended consequences. Credit freezes would be great for the GEICO's of the world but horrible for the local independent insurers.

Persons Testifying: (In support) Senator Berkey, prime sponsor; Kevin Moses; Bob Cooper; and Robert Pregulman, Washington Public Interest Research Group.

(With concerns) Mel Sorensen, Property Casualty Insurance Association and All State Insurance Company; and Bob Mithell, Washington Association of Realtors.

(Opposed) Adam Stein, Washington Association of Mortgage Brokers; John Porter, Gary Dunn, and Steve Heaney, Washington American Mortgage Brokers; Jan Gee, Washington Retail Association; and Bill Stauffacher, Independent Insurance Agents.

Persons Signed In To Testify But Not Testifying: None.