Brief Description: Modifying consumer credit report provisions.

Sponsors: Senate Committee on Financial Institutions & Insurance (originally sponsored by Senators Berkey, Benton, Roach, Zarelli, Kauffman, Marr, Kilmer, Carrell, Hobbs, Schoesler, Franklin, Haugen and Shin).

Hearing Date: 3/20/07

Staff: Jon Hedegard (786-7127).

Background:

In 2005, the Legislature allowed victims of identity theft to place a security freeze on their credit reports.

"Security freeze" is defined as "a notice placed in a consumer's credit report, at the request of the consumer and subject to certain exceptions, that prohibits the consumer reporting agency (CRA) from releasing the consumer's credit report or any information from it without the express authorization of the consumer."

"Victim of identity theft" means:

• a victim of identity theft as defined in the statute criminalizing identity theft; or
• a person who has been notified that a computer data system breach has resulted in the unauthorized acquisition of that person's unencrypted personal information by another.

A victim of identity theft may place a security freeze on his or her credit report by submitting a written request via certified mail to a CRA. Subject to certain exceptions, the CRA is prohibited from releasing the report or information from the report without the consumer's express permission. The CRA must give a victim of identity theft who requests a freeze a personal identification number (PIN). The consumer may use the PIN when making a request for a temporary lifting of the freeze or for a release to a particular person or entity. A CRA may develop procedures involving the use of telephone, fax, the internet, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze in an expedited manner.

The freeze does not apply to the use of a consumer credit report by specified entities, including:

• a person for whom the consumer has lifted the freeze;
• any federal, state, or local entity, or their agents;
• a private collection agency acting under a court order, warrant, or subpoena;
• a child support agency acting under Title IV-D of the Social Security Act (42 U.S.C. et seq.);
• the Department of Social and Health Services;
• the Internal Revenue Service;
• the use of credit information for the purposes of prescreening as provided for by the federal Fair Credit Reporting Act;
• any person or entity administering a credit file monitoring subscription service to which the consumer has subscribed; and
• any person or entity for the purpose of providing a consumer with a copy of his or her credit report upon the consumer's request.

Violations of the Fair Credit Reporting Act are violations of the Consumer Protection Act.

Summary of Bill:

All consumers who are residents of this state may place a security freeze on their credit report.

Definitions
The definition of "victim of identity theft" is modified.

A definition of "credit report" is added. "Credit report" means a consumer report, as defined in 15 U.S.C. Sec. 1681a, that is used or collected to serve as a factor in establishing a consumer's eligibility for credit for personal, family, or household purposes.

A definition of "normal business hours" is added. "Normal business hours" means Sunday through Saturday, between the hours of 6:00 a.m. and 9:30 p.m. Pacific Standard Time.

The definition of "security freeze" is altered to mean "a prohibition, consistent with this section, on a consumer reporting agency's furnishing of a consumer's credit report to a third party intending to use the credit report to determine the consumer's eligibility for credit."

Fees
A consumer credit reporting agency may charge a fee of no more than $10 to a consumer for each freeze, removal of the freeze, or temporary lift of the freeze for a period of time. A consumer credit reporting agency must not charge a fee to a victim of identity theft or a person who is 65 years or older.

"15-minute thaw"
A CRA must allow a consumer to lift a freeze within 15 minutes of receiving the request from the consumer through the electronic contact method chosen by the CRA if the request:

• is received during normal business hours; and
• includes the consumer's proper identification, fee, and correct PIN or password.

A CRA does not have to lift a freeze within 15 minutes if the CRA's ability to remove the security freeze within 15 minutes is prevented by:

• an act of God, including fire, earthquakes, hurricanes, storms, or similar natural disasters or phenomena;
• unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes, or disputes disrupting operations, or similar occurrences;
• an interruption in operations, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruptions;
• governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar directives;
• regularly scheduled maintenance of, or updates to, the CRA's systems outside of normal business hours;
• commercially reasonable maintenance of, or repair to, the CRA's systems that is unexpected or unscheduled; or
• receipt of a removal request outside of normal business hours.

Exemptions from a freeze
Th existing exemption for private collection agencies acting under a court order, warrant, or subpoena is expanded to include any person acting under a court order, warrant, or subpoena.

Mortgage brokers or persons required to be licensed under chapter 19.146 RCW are exempt from a freeze. A CRA is not liable if through inadvertence or mistake, the CRA releases information to a person or entity that purports to be a mortgage broker or loan originator but is not mortgage broker or loan originator.

The consumer's request for a security freeze does not prohibit a CRA from disclosing the consumer's credit report for other than credit-related purposes consistent with the definition of "credit report" in the bill.

A consumer may not sue under the Consumer Protection Act if a CRA does not perform a temporary lift of a freeze within the required time-frames.

Appropriation: None.

Fiscal Note: Not requested.

Effective Date: The bill takes effect 90 days after adjournment of session in which bill is passed.