Brief Description: Allowing consumers to place a credit freeze on a credit report.

Sponsors: Representatives Wallace, Rodne, Kirby, Chase, Schual-Berke, Eddy, Green, Sells, Jarrett, Hurst, P. Sullivan, Kagi, Moeller, Ormsby, Springer and Morrell; by request of Attorney General.

Hearing Date: 2/6/07

Staff: Jon Hedegard (786-7127).

Background:

In 2005, the Legislature allowed victims of identity theft to place a security freeze on their credit reports.

"Security freeze" is defined as "a notice placed in a consumer's credit report, at the request of the consumer and subject to certain exceptions, that prohibits the consumer reporting agency (CRA) from releasing the consumer's credit report or any information from it without the express authorization of the consumer."

"Victim of identity theft" means:

• a victim of identity theft as defined in the statute criminalizing identity theft; or
• a person who has been notified by an agency, person, or business that owns or licenses computerized data of a breach in a computerized data system which has resulted in the acquisition of that person's unencrypted personal information by an unauthorized person or entity.

A victim of identity theft may place a security freeze on his or her credit report by submitting a written request via certified mail to a CRA. Subject to certain exceptions, the CRA is prohibited from releasing the report or information from the report without the consumer's express permission. The CRA must give a victim of identity theft who requests a freeze a personal identification number (PIN). The consumer may use the PIN when making a request for a temporary lifting of the freeze or for a release to a particular person or entity. A CRA may develop procedures involving the use of telephone, fax, the internet, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze in an expedited manner.

The freeze does not apply to the use of a consumer credit report by specified entities, including:

• a person for whom the consumer has lifted the freeze;
• any federal, state, or local entity, or their agents;
• a private collection agency acting under a court order, warrant, or subpoena;
• a child support agency acting under Title IV-D of the Social Security Act (42 U.S.C. et seq.);
• the Department of Social and Health Services;
• the Internal Revenue Service;
• the use of credit information for the purposes of prescreening as provided for by the federal fair credit reporting act;
• any person or entity administering a credit file monitoring subscription service to which the consumer has subscribed; and
• any person or entity for the purpose of providing a consumer with a copy of his or her credit report upon the consumer's request.

If a third party requests to access a "frozen" credit report in connection with an application for credit or any other use, and the consumer does not allow his or her credit report to be accessed for that specific party or period of time, the third party may treat the application as incomplete.

Violations of the Fair Credit Reporting Act are violations of the Consumer Protection Act.

Summary of Bill:

The existing security freeze section is repealed and a new framework is created for "credit freezes." There are a number of new defined terms intended to apply to Chapter 19.182 including "consumer", "consumer credit reporting agency", "credit freeze", "credit report", "normal business hours", "person", "proper identification", and "reviewing the account".

Any consumer can place a credit freeze. The consumer must be prepared to provide proper identification to the consumer credit reporting agency (CCRA) at the time of the request. This information may include such items as name, address, telephone number, social security number, date of birth, or other relevant information requested by the CCRAs that would identify the consumer.

Methods to place a freeze
CCRAs must develop the following methods of receiving a request for a credit freeze within six months of the effective date of this act:

• a postal address;
• a toll-free telephone number; and
• an electronic contact method selected by the CCRA, which may include the use of fax, the internet, other electronic means, or combination of all.

A consumer may request a freeze:

• in writing by regular or certified mail to a CCRA; or
• directly to the CCRA through a toll-free telephone number or secure electronic connection.

A CCRA which receives a valid request and the fee must notify all other CCRAs within twenty-four hours of receiving the request. Upon receipt of a notice, a CCRA must comply with all of the provisions of Chapter 19.182 and may not charge a fee.

A CCRA must place a credit freeze no later than five business days after receiving a request from the consumer. If the consumer notifies a CCRA that he or she is a victim of identity theft, the CCRA must place a credit freeze within twenty-four hours after receiving written or electronic notice from a consumer.

Methods to remove a freeze
A credit freeze remains in place until the consumer requests the removal of the freeze. A CCRA must remove a credit freeze within three business days of receiving a request for removal from the consumer, who provides:

• Proper identification;
• the unique PIN or password; and
• the appropriate fee.

Methods to temporarily lift a freeze
A consumer may allow his or her credit report to be accessed for a specific party or period of time by contacting the CCRA via regular or certified mail, telephone, or a secure electronic method and request that the freeze be temporarily lifted, and provide all of the following:

• proper identification;
• the unique PIN or password provided to the consumer;
• proper information identifying the specific party who is to receive the credit report or the time period for which the credit report shall be available to users of the credit report;
• the appropriate fee.

Time to temporarily lift a freeze
A CCRA that receives a request from a consumer to temporarily lift a freeze must lift the freeze:

• no later than three business days after receiving a mailed request; and
• within fifteen minutes if the request is received during normal business hours through the electronic contact method or the telephone number established by the CCRA.

Fees
A CCRA receiving the request may charge a fee of no more than $3 to a consumer for each freeze, removal of the freeze, or temporary lift of the freeze for a period of time. A consumer may be charged a fee up to $5 to have a new PIN issued or the same PIN reissued.

There is no fee for a consumer who has been:

• the victim of identity theft, as defined in RCW 9.35.005(5); or
• notified of a security breach involving their personal information.

Notice of a security breach or an informational report is sufficient documentation for use by the consumer to obtain the free credit freeze.

Exemptions
The freeze does not apply to the use of a consumer credit report by specified entities, including:

• a person or entity for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument;
• a subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted for the purpose of facilitating the extension of credit or other permissible use;
• any person acting under a court order, warrant, or subpoena;
• a child support agency acting under Title IV-D of the Social Security Act (42 U.S.C. et seq.);
• the Department of Social and Health Services acting to investigate benefits fraud;
• the Internal Revenue Service;
• the use of credit information for the purposes of prescreening as provided for by the federal fair credit reporting act;
• any person or entity administering a credit file monitoring subscription service to which the consumer has subscribed; and
• any person or entity for the purpose of providing a consumer with a copy of his or her credit report upon the consumer's request.

Effect of a freeze on a requester
If a third party requests access to a "frozen" credit report in connection with an application for credit or any other use, and the consumer does not allow the credit report to be accessed for that specific party or period of time, the third party may treat the application as incomplete.

Notice of a violation and remedies
If a CCRA erroneously, whether by accident or design, violates the credit freeze by providing access to credit information that has been placed under a credit freeze, the affected consumer is entitled to:

• notification within five business days of the release of the information, including specific information regarding what was released and the third party recipient;
• file a complaint with the Federal Trade Commission and the Attorney General of this state.

An affected consumer may file a civil action for:

• injunctive relief to prevent or restrain further violation of the credit freeze;
• a civil penalty in an amount not to exceed $10,000 for each violation; and
• the costs of the action including reasonable attorneys' fees.

Violations of Chapter 19.182 RCW are also violations of the Consumer Protection Act.

Appropriation: None.

Fiscal Note: Not requested.

Effective Date: The bill contains an emergency clause and takes effect on July 1, 2007.