Title: An act relating to consumer credit reports.

Brief Description: Modifying consumer credit report provisions.

Sponsors: Senators Berkey, Benton, Roach, Zarelli, Kauffman, Marr, Kilmer, Carrell, Hobbs, Schoesler, Franklin, Haugen and Shin.

Brief History:

Committee Activity: Financial Institutions & Insurance: 2/14/07, 2/20/07 [DPS].

SENATE COMMITTEE ON FINANCIAL INSTITUTIONS & INSURANCE

Majority Report: That Substitute Senate Bill No. 5826 be substituted therefor, and the substitute bill do pass.Signed by Senators Berkey, Chair; Hobbs, Vice Chair; Benton, Ranking Minority Member; Franklin, Hatfield, Parlette and Schoesler.

Staff: Diane Smith (786-7410)

Background: A victim of identity theft may elect to place a security freeze on his or her credit report by submitting a written request by certified mail to a consumer credit reporting agency. Subject to certain exceptions, within five business days of receipt of the written request, the consumer reporting agency must place the security freeze. Placement of a security freeze prohibits the consumer credit reporting agency from releasing the report or information from the report without the consumer's expressed permission. A victim of identity theft requesting a freeze is given a personal identification number to use when making a request for a temporary lifting or removal of the freeze.

The temporary lifting of a freeze and the removal of a freeze must occur within three business days after the consumer credit reporting agency receives the request. The request to temporarily lift a freeze may be made electronically and limited by the consumer to a period of time or a specific party.

"Victim of identity theft" means a victim of identity theft as defined in the statute criminalizing identity theft. In addition, a victim is a person who has been notified by an agency, person, or business that owns or licenses computerized data of a breach in a computerized data system which has resulted in the acquisition of that person's unencrypted personal information by an unauthorized person or entity. Submission of a police report is required in both instances.

A security freeze does not apply to the following entities or activities: persons or entities to whom the consumer owes money; affiliates or subsidiaries of entities with respect to whom the freeze has been lifted by the consumer; law enforcement, federal, state and local agencies, and courts; private collection agencies acting under court order; a child support agency acting under Title IV-D of the Social Security Act; the Department of Social and Health Services acting to fulfill any of its statutory responsibilities; the Internal Revenue Service (IRS); the use of credit information for purposes of pre-screening as provided by the Federal Fair Credit Reporting Act; a person administering credit file monitoring with respect to a subscription service to which a consumer has subscribed; and a request for which a consumer has lifted the freeze.

While a freeze is in effect, a consumer reporting agency must provide the consumer with notice before changing the name, date of birth, social security number, or address in the consumer's file. A reporting agency may advise third parties that a freeze is in effect. A reporting agency may also furnish to a government agency certain information such as the consumer's name, address, former address, place of employment, and former place of employment. Certain entities are not required to place a security freeze in a credit report, as follows: a check services or fraud prevention services company; and a deposit account information service company which issues reports regarding account closures and ATM abuse.

Summary of Bill: Any consumer who is a resident of Washington may place a security freeze on his or her credit report.

A security freeze is redefined to mean that the credit reporting agency is prohibited from furnishing the credit report to a third party who intends to use the credit report for determining the consumer's eligibility for credit.

Only the victim of the crime of identity theft, when requested to do so by the credit reporting agency, must produce a police report.

The federal Fair Credit Reporting Act definition applies to the definition of a credit report. In addition, the report must be for use as a factor in establishing the consumer's eligibility for personal, family or household credit.

The consumer may allow access for a specific period of time while the credit freeze is in place. The consumer's ability to allow access for a specific party is removed.

With some qualifications, the temporary lift of a security freeze must be accomplished by the credit reporting agency within 15 minutes of its receipt of the consumer's request made by electronic contact.

With the exception of victims of identity theft, the fees required are $10 to each credit reporting agency, for each action requested, as follows: placing the security freeze, temporarily lifting the security freeze, and removing the security freeze. There is no fee for a victim of identity theft to have a security freeze placed on his or her credit report.

Mortgage brokers and loan originators are added to the list of entities and purposes to which the security freeze on a credit report does not apply.

A credit reporting agency that mistakenly supplies credit report information to a person purporting to be a mortgage broker or loan originator but is not, is not subject to liability for that mistake.

EFFECT OF CHANGES MADE BY RECOMMENDED SUBSTITUTE AS PASSED COMMITTEE (Financial Institutions & Insurance): Those subject to a security breach are removed from the definition of identity theft victims; allows all consumers aged 65 years or older to place a security freeze without charge; permits any person, rather than only private collection agencies, acting under a court order, to gain access to a consumer credit report during a security freeze; and removes the private right of action under the consumer protection act for violations of the 15-minute temporary lift provisions.

Appropriation: None.

Fiscal Note: Not requested.

Committee/Commission/Task Force Created: No.

Effective Date: The bill takes effect on July 1, 2009.

Staff Summary of Public Testimony: PRO: This bill is the farthest along of any drafts in the Legislature. We support it except the thaw should be removed and replaced with a study by Department of Financial Institutions over the 2009 interim with implementation in 2010 of a thaw that is efficient and encourages no further fraud. We want to see how Utah's system works. We want consistency with California so that there is consistency all up and down the west coast.

Auto dealers' law on bushing has a time limit on how long it can take for a dealer to decide on a transaction. The thaw is key and the California approach won't work here for that reason. The July 1, 2009 effective date is also key so that we have the experience of Utah and Delaware to draw upon. There is a huge commercial incentive for the consumer to have the freeze and have access for commercial transactions.

The thaw is critical for timely and spontaneous purchases.

The distinction between the freeze applying to extensions of credit versus non-lending purposes is important and preserved in the bill and the law in three places. Non-lending purposes do not bring the risk of theft of credit or money from the consumer.

This bill gets us where we want to go: affording the protection of the security freeze to everyone before the theft happens. We are absolutely confident a working system will be up and running when Utah's bill is effective in September 2008. However, $30 is prohibitive especially when the system is up an running and the freeze/thaw can happen at the push of a button.
   
CON: Collection agencies and local collection bureaus don't determine eligibility for credit and the bill needs to be changed to reflect that, since it applies to all consumers.

The victims of a security breach must be removed from the definition of victim of identity theft because being part of a security breach does not necessarily mean that identity theft has occurred. Utah and Delaware are the only states with a 15-minute thaw. Lifting the freeze for the wrong person could result from inadequate time within the 15 minutes to make all necessary verifications. While the idea of the bill is to protect people from identity theft, lifting the freeze on a whim does not fit that same intent. Credit reporting agencies are working diligently and market forces and customer demands will arrive at a solution for the freeze/thaw issue at the right time and at the right price. Arbitrary fees should not be in statute. The private right of action would reward people for gaming the system with frivolous requests to lift freezes that fall 15 minutes and one second over the timeline.

Persons Testifying: PRO: Hunter Goodman, Attorney General's Office; Mel Sorenson, Property Casualty Insurers Association of America; Lauren Moughon, American Association of Retired People Washington; Denny Eliason, Washington Bankers Association; Scott Hazlegrove, Washington State Auto Dealers Association.

CON: Kevin Underwood, Washington Collectors Association; Jennifer Flynn, Cliff Webster, Consumer Data Industry Association.