Brief Description: Modifying consumer credit report provisions.

Sponsors: Representatives Hurst, O'Brien, Eddy, Kessler, Lovick, Rolfes, Williams, Dunshee, Kenney, Green, Hunter, Quall, VanDeWege, Simpson, Hasegawa and Ormsby.

Hearing Date: 2/6/07

Staff: Jon Hedegard (786-7127).

Background:

In 2005, the Legislature allowed victims of identity theft to place a security freeze on their credit reports.

"Security freeze" is defined as "a notice placed in a consumer's credit report, at the request of the consumer and subject to certain exceptions, that prohibits the consumer reporting agency (CRA) from releasing the consumer's credit report or any information from it without the express authorization of the consumer."

"Victim of identity theft" means:

• a victim of identity theft as defined in the statute criminalizing identity theft; or
• a person who has been notified that a computer data system breach has resulted in the    unauthorized acquisition of that person's unencrypted personal information by another.

A victim of identity theft may place a security freeze on his or her credit report by submitting a written request via certified mail to a CRA. Subject to certain exceptions, the CRA is prohibited from releasing the report or information from the report without the consumer's express permission. The CRA must give a victim of identity theft who requests a freeze a personal identification number (PIN). The consumer may use the PIN when making a request for a temporary lifting of the freeze or for a release to a particular person or entity. A CRA may develop procedures involving the use of telephone, fax, the internet, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze in an expedited manner.

The freeze does not apply to the use of a consumer credit report by specified entities, including:

• a person for whom the consumer has lifted the freeze;
• any federal, state, or local entity, or their agents;
• a private collection agency acting under a court order, warrant, or subpoena;
• a child support agency acting under Title IV-D of the Social Security Act (42 U.S.C. et seq.);
• the Department of Social and Health Services;
• the Internal Revenue Service;
• the use of credit information for the purposes of prescreening as provided for by the federal fair credit reporting act;
• any person or entity administering a credit file monitoring subscription service to which the consumer has subscribed; and
• any person or entity for the purpose of providing a consumer with a copy of his or her credit report upon the consumer's request.

Violations of the Fair Credit Reporting Act are violations of the Consumer Protection Act.

Summary of Bill:

All consumers who are residents of this state may place a security freeze on their credit report.

The definition of "security freeze" is altered to mean "a prohibition, consistent with this section, on a CRA's furnishing of a consumer's credit report to a third party intending to use the credit report to determine the consumer's eligibility for credit."

A definition of "credit report" is added. "Credit report" means a consumer report, as defined in 15 U.S.C. Sec. 1681a, that is used or collected to serve as a factor in establishing a consumer's eligibility for credit for personal, family, or household purposes.

A definition of "normal business hours" is added. "Normal business hours" means Sunday through Saturday, between the hours of 6:00 a.m. and 9:30 p.m. Pacific Standard Time.

Fees
A consumer credit reporting agency may charge the following fees for access to a consumer credit report:

• A fee of no more than $10 to a consumer for each freeze, removal of the freeze, or temporary lift of the freeze for a period of time; or
• A fee of no more than $12 for a temporary lift of a freeze for a specific party.

A consumer credit reporting agency must not charge a fee to a victim of identity theft.

"15-minute thaw"
A CRA must allow a consumer to lift a freeze within 15 minutes of receiving the request from the consumer through the electronic contact method chosen by the CRA if the request:

• is received during normal business hours; and
• includes the consumer's proper identification, fee, and correct PIN or password.

A CRA does not have to lift within 15 minutes if the CRA's ability to remove the security freeze within fifteen minutes is prevented by:

• an act of God, including fire, earthquakes, hurricanes, storms, or similar natural disasters or phenomena;
• unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes, or disputes disrupting operations, or similar occurrences;
• an interruption in operations, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruptions;
• governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar directives;
• regularly scheduled maintenance of, or updates to, the CRA's systems outside of normal business hours;
• commercially reasonable maintenance of, or repair to, the CRA's systems that is unexpected or unscheduled; or
• receipt of a removal request outside of normal business hours.

The consumer's request for a security freeze does not prohibit the CRA from disclosing the consumer's credit report for other than credit-related purposes consistent with the definition of credit report, as found in this section.

Appropriation: None.

Fiscal Note: Not requested.

Effective Date: The effective date is delayed until July 1, 2009.