Brief Description: Modifying consumer credit report provisions.

Sponsors: Senate Committee on Financial Institutions & Insurance (originally sponsored by Senators Berkey, Benton, Roach, Zarelli, Kauffman, Marr, Kilmer, Carrell, Hobbs, Schoesler, Franklin, Haugen and Shin).

Senate Committee on Financial Institutions & Insurance
House Committee on Insurance, Financial Services & Consumer Protection

Background: A victim of identity theft may elect to place a security freeze on his or her credit report by submitting a written request by certified mail to a consumer credit reporting agency. Subject to certain exceptions, within five business days of receipt of the written request, the consumer reporting agency must place the security freeze. Placement of a security freeze prohibits the consumer credit reporting agency from releasing the report or information from the report without the consumer's expressed permission. A victim of identity theft requesting a freeze is given a personal identification number to use when making a request for a temporary lifting or removal of the freeze.

The temporary lifting of a freeze and the removal of a freeze must occur within three business days after the consumer credit reporting agency receives the request. The request to temporarily lift a freeze may be made electronically and limited by the consumer to a period of time or a specific party.

"Victim of identity theft" means a victim of identity theft as defined in the statute criminalizing identity theft. In addition, a victim is a person who has been notified by an agency, person, or business that owns or licenses computerized data of a breach in a computerized data system which has resulted in the acquisition of that person's unencrypted personal information by an unauthorized person or entity. Submission of a police report is required in both instances.

A security freeze does not apply to the following entities or activities: persons or entities to whom the consumer owes money; affiliates or subsidiaries of entities with respect to whom the freeze has been lifted by the consumer; law enforcement, federal, state and local agencies, and courts; private collection agencies acting under court order; a child support agency acting under Title IV-D of the Social Security Act; the Department of Social and Health Services acting to fulfill any of its statutory responsibilities; the Internal Revenue Service (IRS); the use of credit information for purposes of pre-screening as provided by the Federal Fair Credit Reporting Act; a person administering credit file monitoring with respect to a subscription service to which a consumer has subscribed; and a request for which a consumer has lifted the freeze.

While a freeze is in effect, a consumer reporting agency must provide the consumer with notice before changing the name, date of birth, social security number, or address in the consumer's file. A reporting agency may advise third parties that a freeze is in effect. A reporting agency may also furnish to a government agency certain information such as the consumer's name, address, former address, place of employment, and former place of employment. Certain entities are not required to place a security freeze in a credit report, as follows: a check services or fraud prevention services company; and a deposit account information service company which issues reports regarding account closures and ATM abuse.

Summary: Any consumer who is a resident of Washington may place a security freeze on his or her credit report.

A security freeze is redefined to mean that the credit reporting agency is prohibited from furnishing the credit report to a third party who intends to use the credit report for determining the consumer's eligibility for credit.

Only the victim of the crime of identity theft, when requested to do so by the credit reporting agency, must produce a police report.

The federal Fair Credit Reporting Act definition applies to the definition of a credit report. In addition, the report must be for use as a factor in establishing the consumer's eligibility for personal, family or household credit.

The consumer may allow access for a specific period of time while the credit freeze is in place. The consumer's ability to allow access for a specific party is removed.

With some qualifications, the temporary lift of a security freeze must be accomplished by the credit reporting agency within 15 minutes of its receipt of the consumer's request made by electronic contact.

With the exception of victims of identity theft and those aged 65 or older, the fees required are $10 to each credit reporting agency, for each action requested, as follows: placing the security freeze, temporarily lifting the security freeze, and removing the security freeze. There is no fee for victims of identity theft or those aged 65 or older to have a security freeze placed on their credit report.

Mortgage brokers, loan originators, and any person acting under the authority of a court order are added to the list of entities and purposes to which the security freeze on a credit report does not apply.

A credit reporting agency that mistakenly supplies credit report information to a person purporting to be a mortgage broker or loan originator but is not, is not subject to liability for that mistake.

There is no private right of action under the consumer protection act for violations of the 15-minute temporary lift provisions.

Votes on Final Passage:

Senate      49   0
House      96   0   (House amended)
Senate      49   0   (Senate concurred)

Effective:   September 1, 2008