Background: Consumer credit reports contain personal information, including: name, address, social security number, bill paying habits, credit history, and public record information on bankruptcies, liens, and court judgments. There are three primary consumer credit reporting agencies: Equifax, Experian, and Transunion. Consumer reporting agencies regularly obtain information from national credit card companies, automobile finance companies, student loan companies, and other sources. A person, business, or government agency may request a credit report from a consumer credit reporting agency for legitimate business needs involving a transaction with a consumer including an application for credit, opening an account, a security clearance, employment, or collection of an account.

Any consumer in Washington may request that a consumer reporting agency (agency) place a security freeze on the consumer's credit report. A security freeze is a prohibition on the agency's release of a consumer's credit report to a third party intending to use the credit report to determine the consumer's eligibility for credit. The request for a security freeze must be submitted in writing via certified mail to the agency. The agency is permitted to charge $10 for the placement of a security freeze.

Subject to certain exceptions, the agency is prohibited from releasing the report or information from the report without the consumer's express permission. The agency must give the consumer a personal identification number, which the consumer may use to make a request for a temporary lift of the freeze or for a release to a particular person or entity. Currently, the consumer reporting agency may charge $10 for the removal or temporary lift of a security freeze. Victims of identity theft and persons over 65 years old may place or lift a security freeze free of charge. A consumer's request for a security freeze does not prohibit the release of the consumer's credit report for purposes that are not credit-related.

Summary: An agency may not charge a consumer for placing a security freeze on a credit report, assigning a unique PIN, temporarily lifting a security freeze, or removing a security freeze. The requirement that a consumer may request a security freeze in writing by certified mail is removed.

The Office of Cybersecurity, the Office of Privacy and Data Protection, and the Office of the Attorney General must work with stakeholders to evaluate the impact to consumers and the consumer reporting agencies regarding removal of the security freeze fees. The report must include trends in data breaches, best practices for preventing cybersecurity attacks, identity theft mitigation services available to consumers, and identity theft mitigation protocols recommended by the Federal Trade Commission, the Consumer Financial Protection Bureau, and other relevant federal or state agencies. The report must be submitted to the Legislature by December 1, 2020.

Votes on Final Passage:

Senate	46	2
House	81	15