BILL REQ. #:  Z-0449.1 

Read first time 01/22/2007.   Referred to Committee on Insurance, Financial Service & Consumer Protection.

     AN ACT Relating to placing a credit freeze on a credit report; adding new sections to chapter 19.182 RCW; repealing RCW 19.182.170; prescribing penalties; providing an effective date; and declaring an emergency.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

NEW SECTION.  Sec. 1   A new section is added to chapter 19.182 RCW to read as follows:
     The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.
     (1) "Consumer" means an individual or the person responsible for legal decisions of an individual.
     (2) "Consumer credit reporting agency" means any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing credit reports to third parties.
     (3) "Credit freeze" means a notice placed in a consumer's credit report, at the request of the consumer and subject to certain exceptions, that prohibits the consumer credit reporting agency from releasing all or any part of the consumer's credit report or any information derived from it without the express authorization of the consumer.
     If a credit freeze is in place, such a report or information may not be released to a third party without prior express authorization from the consumer. This subsection does not prevent a consumer credit reporting agency from advising a third party that a credit freeze is in effect with respect to the consumer's credit report.
     (4) "Credit report" means any written, oral, or other communication of any information by a consumer credit reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for:
     (a) Credit or insurance to be used primarily for personal, family, or household purposes;
     (b) Employment purposes; or
     (c) Any other purpose authorized under 15 U.S.C. Sec. 1681b.
     (5) "Normal business hours" means Sunday through Saturday, between the hours of 6:00 a.m. and 9:00 p.m., Pacific Standard Time.
     (6) "Person" means any individual, partnership, corporation, trust, estate, cooperative, association, government or governmental subdivision or agency, or other entity.
     (7) "Proper identification" means information sufficient to verify identity.
     (8) "Reviewing the account" or "account review" includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.

NEW SECTION.  Sec. 2   A new section is added to chapter 19.182 RCW to read as follows:
     (1)(a) A consumer may elect to place a credit freeze on his or her credit report by making a request:
     (i) In writing by regular or certified mail to a consumer credit reporting agency; or
     (ii) Directly to the consumer credit reporting agency through a toll-free telephone number or secure electronic connection. Consumer credit reporting agencies shall develop and make available direct contact methods of requesting a credit freeze within six months of the effective date of this section. These methods must include:
     (A) A postal address;
     (B) A toll-free telephone number; and
     (C) An electronic contact method selected by the consumer credit reporting agency, which may include the use of fax, the internet, other electronic means, or combination of all.
     (b) The consumer must be prepared to provide proper identification to the consumer credit reporting agency at the time of the request. This information may include such items as name, address, telephone number, social security number, date of birth, or other relevant information requested by the consumer credit reporting agencies that would identify the consumer.
     (2) A consumer credit reporting agency which receives a valid request, including a three dollar fee, except as indicated in subsection (13)(a) of this section, and proper identification, from a consumer requesting a credit freeze, shall notify all other consumer credit reporting agencies within twenty-four hours of receiving the request. Upon receipt of a notice pursuant to this subsection, a consumer credit reporting agency shall comply with all of the provisions of this chapter for no additional fees.
     (3) A consumer credit reporting agency shall place a credit freeze on a consumer's credit report no later than five business days after receiving a request from the consumer. Except that, if as a part of this request, a consumer notifies a consumer credit reporting agency that he or she has been notified of a security breach involving his or her personal information or is a victim of identity theft, the consumer credit reporting agency shall place a credit freeze on a consumer's credit report no later than twenty-four hours after receiving written or electronic notice from a consumer.
     (4) The consumer credit reporting agency shall send a written confirmation of the credit freeze to the consumer within five business days of placing the freeze and at the same time shall provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of his or her credit for a specific party or period of time.
     (5) If the consumer wishes to remove a credit freeze or to allow his or her credit report to be accessed for a specific party or period of time while a freeze is in place, the consumer shall contact the consumer credit reporting agency via regular or certified mail, telephone, or a secure electronic method and request that the freeze be temporarily lifted, and provide all of the following:
     (a) Proper identification;
     (b) The unique personal identification number or password provided by the consumer credit reporting agency under subsection (4) of this section; and
     (c) The proper information identifying the specific party who is to receive the credit report or the time period for which the credit report shall be available to users of the credit report.
     (6) A consumer credit reporting agency that receives a request from a consumer to temporarily lift a freeze on a consumer's credit report under subsection (5) of this section shall comply with the request as follows:
     (a) No later than three business days after receiving a written request to lift the credit freeze at the postal address established by the consumer credit reporting agency under subsection (1)(a)(ii)(A) of this section; and
     (b) Within fifteen minutes after the consumer's request to temporarily lift a credit freeze for a period of time received during normal business hours by the consumer credit reporting agency through the electronic contact method or the telephone number established by the consumer credit reporting agency under subsections (1)(a)(ii)(B) and (C) of this section.
     (7) A consumer credit reporting agency shall remove or temporarily lift a freeze placed on a consumer's credit report only upon consumer request, subject to subsection (5) or (10) of this section.
     (8) If a third party requests access to a consumer's credit report on which a credit freeze is in effect, and this request is in connection with an application for credit or any other use, and the consumer does not allow the credit report to be accessed for that specific party or period of time, the third party may treat the application as incomplete.
     (9) If a third party requests access to a consumer's credit report or information derived from it on which a credit freeze is in effect for the purpose of receiving, extending, or otherwise utilizing the credit therein, and not for the sole purpose of account review, the consumer credit reporting agency must notify the consumer that an attempt has been made to access the credit report.
     (10) A credit freeze remains in place until the consumer requests that the credit freeze be removed. A consumer credit reporting agency shall remove a credit freeze within three business days of receiving a request for removal from the consumer, who provides both of the following:
     (a) Proper identification; and
     (b) The unique personal identification number or password provided by the consumer credit reporting agency under subsection (4) of this section.
     (11) A consumer credit reporting agency may not suggest or otherwise state or imply to a third party that the consumer's credit freeze reflects a negative credit score, history, report, or rating.
     (12) This section does not apply to the use of a consumer's credit report by any of the following:
     (a) A person or entity, or a subsidiary, affiliate, or agent of that person or entity, or an assignee of a financial obligation owing by the consumer to that person or entity, or a prospective assignee of a financial obligation owing by the consumer to that person or entity in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment an account or contract, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument;
     (b) A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under subsection (5) of this section for purposes of facilitating the extension of credit or other permissible use;
     (c) Any person acting under a court order, warrant, or subpoena;
     (d) A child support agency acting under Title IV-D of the social security act (42 U.S.C. et seq.);
     (e) The department of social and health services acting to investigate benefits fraud;
     (f) The internal revenue service acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities;
     (g) The use of credit information for the purposes of prescreening as provided for by the federal fair credit reporting act;
     (h) Any person or entity administering a credit file monitoring subscription service to which the consumer has subscribed; and
     (i) Any person or entity for the purpose of providing a consumer with a copy of his or her credit report upon the consumer's request.
     (13)(a) A consumer credit reporting agency shall not charge a fee to a consumer who has been the victim of identity theft, as defined in RCW 9.35.005(5), or who has been notified of a security breach involving their personal information, as outlined in chapter 19.255 RCW. Notice of a security breach or an informational report is sufficient documentation for use by the consumer to obtain the free credit freeze under this subsection.
     (b) The consumer credit reporting agency receiving the request, except as indicated in subsection (14)(a) of this section, may charge a fee of no more than three dollars to a consumer for each freeze, removal of the freeze, or temporary lift of the freeze for a period of time.
     (c) A consumer may be charged a reasonable fee, not to exceed five dollars, if the consumer fails to retain the original personal identification number provided by the consumer credit reporting agency and must be reissued the same or a new personal identification number.
     (14) If a consumer credit reporting agency erroneously, whether by accident or design, violates the credit freeze by providing access to credit information that has been placed under a credit freeze, the affected consumer is entitled to:
     (a) Notification within five business days of the release of the information, including specificity as to the information released and the third party recipient of the information;
     (b) File a complaint with the federal trade commission and the Washington state attorney general's office of consumer protection; and
     (c) In a civil action against the consumer credit reporting agency, recover:
     (i) Injunctive relief to prevent or restrain further violation of the credit freeze;
     (ii) A civil penalty in an amount not to exceed ten thousand dollars for each violation; and
     (iii) The costs of the action including reasonable attorneys' fees.

NEW SECTION.  Sec. 3   A new section is added to chapter 19.182 RCW to read as follows:
     The legislature finds that the practices covered by this chapter are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW. A violation of this chapter is not reasonable in relation to the development and preservation of business and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.

NEW SECTION.  Sec. 4   RCW 19.182.170 (Victim of identity theft--Security freeze) and 2005 c 342 s 1 are each repealed.

NEW SECTION.  Sec. 5   If any provision of this act or its application to any person or circumstance is held invalid, the remainder of the act or the application of the provision to other persons or circumstances is not affected.

NEW SECTION.  Sec. 6   This act is necessary for the immediate preservation of the public peace, health, or safety, or support of the state government and its existing public institutions, and takes effect July 1, 2007.