AN ACT Relating to credit report security freezes; adding new sections to chapter 19.182 RCW; adding a new section to chapter 70.58 RCW; and providing an effective date.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

NEW SECTION.  Sec. 1.  A new section is added to chapter 19.182 RCW to read as follows:

The definitions in this section apply throughout this section and sections 2 and 3 of this act unless the context clearly requires otherwise.

(1) "Credit report" means a consumer report, as defined in 15 U.S.C. Sec. 1681a, that is used or collected to serve as a factor in establishing a consumer's eligibility for credit for personal, family, or household purposes.

(2) "Normal business hours" means Sunday through Saturday, between the hours of 6:00 a.m. and 9:30 p.m. Pacific time.

(3) "Protected consumer" means an individual who is:

(a) Under the age of sixteen years old at the time a request for the placement of a security freeze is made pursuant to section 2 of this act; or

(b) Incapacitated and for whom a guardian or limited guardian has been appointed.

(4) "Record" means a compilation of information that:

(a) Identifies a protected consumer;

(b) Is created by a consumer reporting agency solely for the purpose of complying with section 2 of this act; and

(c) May not be created or used to consider the protected consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living for any purpose listed in RCW 19.182.020.

(5) "Representative" means a person who provides to a consumer reporting agency sufficient proof of authority to act on behalf of a protected consumer.

(6) "Security freeze" means:

(a) If a consumer reporting agency does not have a file pertaining to a protected consumer, a restriction that:

(i) Is placed on the protected consumer's record in accordance with section 2 of this act; and

(ii) Prohibits the consumer reporting agency from releasing the protected consumer's record except as provided in section 2 of this act; or

(b) If a consumer reporting agency has a file pertaining to the protected consumer, a restriction that:

(i) Is placed on the protected consumer's consumer report in accordance with section 2 of this act; and

(ii) Prohibits the consumer reporting agency from releasing the protected consumer's consumer report or any information derived from the protected consumer's consumer report except as provided in section 2 of this act.

(7) "Sufficient proof of authority" means documentation that shows a representative has authority to act on behalf of a protected consumer, including:

(a) An order issued by a court of law;

(b) A lawfully executed and valid power of attorney; and

(c) A written, notarized statement signed by a representative that expressly describes the authority of the representative to act on behalf of a protected consumer.

(8) "Sufficient proof of identification" means information or documentation that identifies a protected consumer or a representative of a protected consumer, including:

(a) A social security number or a copy of a social security card issued by the social security administration;

(b) A certified or official copy of a birth certificate issued by the entity authorized to issue the birth certificate;

(c) A copy of a driver's license, an identicard issued under RCW 46.20.117, or any other government-issued identification; or

(d) A copy of a bill, including a bill for telephone, sewer, septic tank, water, electric, oil, or natural gas services, that shows a name and home address.

NEW SECTION.  Sec. 2.  A new section is added to chapter 19.182 RCW to read as follows:

(1) A consumer reporting agency shall place a security freeze for a protected consumer if:

(a) The consumer reporting agency receives a request from the protected consumer's representative for the placement of the security freeze under this section; and

(b) The protected consumer's representative:

(i) Submits the request to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency;

(ii) Provides to the consumer reporting agency sufficient proof of identification of the protected consumer and the representative;

(iii) Provides to the consumer reporting agency sufficient proof of authority to act on behalf of the protected consumer; and

(iv) Pays to the consumer reporting agency a fee as provided in this section.

(2) If a consumer reporting agency does not have a file pertaining to a protected consumer when the consumer reporting agency receives a request under subsection (1)(a) of this section, the consumer reporting agency shall create a record for the protected consumer.

(3) Within thirty days after receiving a request that meets the requirements of subsection (1) of this section, a consumer reporting agency shall place a security freeze for the protected consumer.

(4) Unless a security freeze for a protected consumer is removed in accordance with subsection (6) or (9) of this section, a consumer reporting agency may not release the protected consumer's consumer report, any information derived from the protected consumer's consumer report, or any record created for the protected consumer.

(5) A security freeze for a protected consumer placed in accordance with this section shall remain in effect until:

(a) The protected consumer or the protected consumer's representative requests the consumer reporting agency to remove the security freeze in accordance with subsection (6) of this section; or

(b) The security freeze is removed in accordance with subsection (9) of this section.

(6) If a protected consumer or a protected consumer's representative wishes to remove a security freeze for the protected consumer, the protected consumer or the protected consumer's representative shall:

(a) Submit a request for the removal of the security freeze to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency;

(b) Provide to the consumer reporting agency:

(i) In the case of a request by the protected consumer:

(A) Proof that the sufficient proof of authority for the protected consumer's representative to act on behalf of the protected consumer is no longer valid; and

(B) Sufficient proof of identification of the protected consumer;

(ii) In the case of a request by the representative of a protected consumer:

(A) Sufficient proof of identification of the protected consumer and the representative; and

(B) Sufficient proof of authority to act on behalf of the protected consumer; and

(iii) In any case, pay to the consumer reporting agency a fee as provided in this section.

(7) Within thirty days after receiving a request that meets the requirements of subsection (6) of this section, the consumer reporting agency shall remove the security freeze for the protected consumer.

(8)(a) Except as provided in (b) of this subsection, a consumer reporting agency may not charge a fee for any service performed under this section.

(b) A consumer reporting agency may charge a reasonable fee, not exceeding ten dollars, for each placement or removal of a security freeze for a protected consumer.

(c) A consumer reporting agency may not charge any fee under this section if:

(i) The protected consumer's representative:

(A) Has obtained a report from a federal, state, county, or local law enforcement alleging identity theft in violation of RCW 9.35.020 against the protected consumer; and

(B) Provides a copy of the report to the consumer reporting agency; or

(ii)(A) A request for the placement or removal of a security freeze is for a protected consumer who is under the age of sixteen years at the time of the request; and

(B) The consumer reporting agency has a consumer report pertaining to the protected consumer.

(9) A consumer reporting agency may remove a security freeze for a protected consumer or delete a record of a protected consumer if the security freeze was placed or the record was created based on a material misrepresentation of fact by the protected consumer or the protected consumer's representative.

(10) A violation of this section is enforced in accordance with RCW 19.182.170(17).

(11) This section does not apply to:

(a) Persons or transactions described in RCW 19.182.170(14)(b), (c), (d), (e), (f), (h), or (i);

(b) Persons or transactions described in RCW 19.182.190;

(c) Persons or transactions described in RCW 19.182.200; or

(d) A person or entity that maintains, or a database used solely for, the following:

(i) Criminal record information;

(ii) Personal loss history information;

(iii) Fraud prevention or detection;

(iv) Employment screening; or

(v) Tenant screening.

NEW SECTION.  Sec. 3.  A new section is added to chapter 70.58 RCW to read as follows:

The issuer of a certified birth certificate shall include information prepared by the department setting forth the advisability of a security freeze under section 2 of this act and the process for acquiring a security freeze.

--- END ---