Title: An act relating to consumer credit reports.

Brief Description: Modifying consumer credit report provisions.

Sponsors: Representatives Hurst, O'Brien, Eddy, Kessler, Lovick, Rolfes, Williams, Dunshee, Kenney, Green, Hunter, Quall, VanDeWege, Simpson, Hasegawa and Ormsby.

Brief History:

Insurance, Financial Services & Consumer Protection: 2/6/07, 2/20/07 [DPS].

HOUSE COMMITTEE ON INSURANCE, FINANCIAL SERVICES & CONSUMER PROTECTION

Majority Report: The substitute bill be substituted therefor and the substitute bill do pass. Signed by 5 members: Representatives Kirby, Chair; Kelley, Vice Chair; Hurst, Santos and Simpson.

Minority Report: Do not pass. Signed by 3 members: Representatives Roach, Ranking Minority Member; Strow, Assistant Ranking Minority Member and Rodne.

Staff: Jon Hedegard (786-7127).

Background:

In 2005, the Legislature allowed victims of identity theft to place a security freeze on their credit reports.

"Security freeze" is defined as "a notice placed in a consumer's credit report, at the request of the consumer and subject to certain exceptions, that prohibits the consumer reporting agency (CRA) from releasing the consumer's credit report or any information from it without the express authorization of the consumer."

"Victim of identity theft" means:

• a victim of identity theft as defined in the statute criminalizing identity theft; or
• a person who has been notified that a computer data system breach has resulted in the    unauthorized acquisition of that person's unencrypted personal information by another.

A victim of identity theft may place a security freeze on his or her credit report by submitting a written request via certified mail to a CRA. Subject to certain exceptions, the CRA is prohibited from releasing the report or information from the report without the consumer's express permission. The CRA must give a victim of identity theft who requests a freeze a personal identification number (PIN). The consumer may use the PIN when making a request for a temporary lifting of the freeze or for a release to a particular person or entity. A CRA may develop procedures involving the use of telephone, fax, the internet, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze in an expedited manner.

The freeze does not apply to the use of a consumer credit report by specified entities, including:

• a person for whom the consumer has lifted the freeze;
• any federal, state, or local entity, or their agents;
• a private collection agency acting under a court order, warrant, or subpoena;
• a child support agency acting under Title IV-D of the Social Security Act (42 U.S.C. et seq.);
• the Department of Social and Health Services;
• the Internal Revenue Service;
• the use of credit information for the purposes of prescreening as provided for by the federal Fair Credit Reporting Act;
• any person or entity administering a credit file monitoring subscription service to which the consumer has subscribed; and
• any person or entity for the purpose of providing a consumer with a copy of his or her credit report upon the consumer's request.

Violations of the Fair Credit Reporting Act are violations of the Consumer Protection Act.

Summary of Substitute Bill:

All consumers who are residents of this state may place a security freeze on their credit report.

Definitions
The definition of "victim of identity theft" is modified.

A definition of "credit report" is added. "Credit report" means a consumer report, as defined in 15 U.S.C. Sec. 1681a, that is used or collected to serve as a factor in establishing a consumer's eligibility for credit for personal, family, or household purposes.

A definition of "normal business hours" is added. "Normal business hours" means Sunday through Saturday, between the hours of 6:00 a.m. and 9:30 p.m. Pacific Standard Time.

The definition of "security freeze" is altered to mean "a prohibition, consistent with this section, on a consumer reporting agency's furnishing of a consumer's credit report to a third party intending to use the credit report to determine the consumer's eligibility for credit."

Fees
A consumer credit reporting agency may charge a fee of no more than $5 to a consumer for each freeze, removal of the freeze, or temporary lift of the freeze for a period of time. If a single point of entry for placing or lifting a freeze is developed, only one fee per action may be charged. A fee may not be charged to a person who changes their name after placing a freeze. A consumer credit reporting agency must not charge a fee to a victim of identity theft.

"15-minute thaw"
A CRA must allow a consumer to lift a freeze within 15 minutes of receiving the request from the consumer through the electronic contact method chosen by the CRA if the request:

• is received during normal business hours; and
• includes the consumer's proper identification, fee, and correct PIN or password.

A CRA does not have to lift a freeze within 15 minutes if the CRA's ability to remove the security freeze within 15 minutes is prevented by:

• an act of God, including fire, earthquakes, hurricanes, storms, or similar natural disasters or phenomena;
• unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes, or disputes disrupting operations, or similar occurrences;
• an interruption in operations, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruptions;
• governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar directives;
• regularly scheduled maintenance of, or updates to, the CRA's systems outside of normal business hours;
• commercially reasonable maintenance of, or repair to, the CRA's systems that is unexpected or unscheduled; or
• receipt of a removal request outside of normal business hours.

The consumer's request for a security freeze does not prohibit the CRA from disclosing the consumer's credit report for other than credit-related purposes consistent with the definition of "credit report" in the bill.

A consumer may not sue under the Consumer Protection Act if a CRA does not perform a temporary lift of a freeze within the required time-frames.

Substitute Bill Compared to Original Bill:

The definition of "victim of identity theft" is changed to remove victims of security breaches and alter language concerning victims of the crime. Provisions regarding fees are altered. Fees are $5 per each freeze, removal or lift. If a single point of entry for a freeze is developed, only one fee per action may be charged. A fee may not be charged to a person who changes their name after placing a freeze. A freeze may only be lifted for a period of time, not for a specific party. An exemption for mortgage brokers is created along with a related "safe harbor" provision for CRAs. An exemption regarding collectors acting under a court order is broadened to "any person." A consumer may not sue under the Consumer Protection Act if a CRA does not lift a freeze within the required time-frames. The effective date is September 1, 2008.

Appropriation: None.

Fiscal Note: Not requested.

Effective Date of Substitute Bill: The bill takes effect on September 1, 2008.

Staff Summary of Public Testimony:

(In support) Identity theft is a major issue today. The scope of it is extraordinary. Police have found tens of thousands of documents from retailers in a single raid. The thieves were building profiles of thousands of people and intending to take out credit in their name. Law enforcement can catch and penalize criminals but this bill is targeted to prevention. Identity theft victims have the option of freezing their credit today. All consumers should have that option. It is difficult to balance the needs of consumers with the needs of business. This bill attempts to make that balance. Some issues may need further review. If changes are needed, they should be made. The bill focuses on the extension of credit. There are other uses of credit reports but the other uses don't generally lead to identity theft. The bill is tailored to try to eliminate that potential criminal use. The Attorney General supports additional protections for consumers. It is also important that commerce is impeded as little as possible. The bill provides important protections and does not interfere with business. This is an important issue for consumers. A survey about identity theft shows that 85 percent of consumers support the expansion of the scope of the law so all consumers can place a credit freeze. This bill has a delayed effective date. It appears that the delay is to allow the industry to comply with the requirements of a quick temporary lift. Consumers would rather have the ability to freeze their credit than obtain instant credit. If the lift mechanism takes two years to implement, then it should be delayed. The scope of the law should be expanded immediately. States that allow credit freezes for all consumers have not seen problems with commerce. The fees in the bill could be problematic for many consumers. A single fee of $5 to $10 is more appropriate. The bill offers tools for consumers to take control of their information. There are many threats to a person's financial information. Most people or businesses are honest. Some are not honest. The impact on CRAs appears to be minimal. This provides a tool for consumers. They should be able to lift a freeze quickly. Uniformity is less important than consumer protection. A consumer education component would be useful. Auto dealers support the bill. It is a reasonable balance of consumer protections and the needs of business. The ability to lift a freeze within 15 minutes is critical. Consumers need a quick, predictable method to address the issues. Under current law, an auto dealer could not get a thaw lifted in time to sell a car to a person who is ready and willing to buy but has a freeze in place. The delayed effective date is important for two reasons. First, the CRAs have time to develop the mechanisms to comply. Second, it enables Washington to watch Utah and Delaware implement their new laws and learn from the experiences of those states.

(With concerns) There does not seem to be any consistency in what the states are doing in this area. It is not clear that the Consumer Data Information Association (CDIA) will be able to provide a temporary lift within 15 minutes. A better option is to not include the quick lift. A study in 2009 could examine the experience of the states that have implemented a quick freeze and makes recommendations for the 2010 Legislature. The narrowed scope and purpose in the bill are appreciated. Insurers may suggest a specific exemption also just to make sure it does not apply to the insurance industry.

(Opposed) The credit reporting agencies would like uniformity on this issue. There are 26 different laws across the United States. This bill is based on a model similar to other states. The CDIA has a different position than in 2005. In 2005, the CDIA asked the Legislature to narrow the scope to just victims of identity theft. With that narrow scope, we offered to provide this service for free. Today, the CDIA supports expanding the scope to all consumers but we would ask for the ability to charge a fee to victims of the crime of identity theft. The current law defines people who experience a security breach as a victim of identity theft. Few people who experience a security breach ever become a victim of the crime of identity theft. To allow a free freeze for these security breach victims is unnecessary, not uniform, and shifts the costs associated with a freeze from the entity that allowed the breach to the consumer reporting agencies. The CDIA has concerns about the temporary lift. We don't have the ability to do that today. Two states have adopted temporary lifts. Utah's law is effective in September of 2008. Delaware's law is effective in January of 2009. The CDIA would prefer to expand the scope of the law to provide for a freeze to all consumers. We would like to make sure that a temporary lift system is in place and working before adopting it in law. Additionally, there is no experience that would allow for an informed decision about pricing a temporary lift. The consumer data reporting industry is working on these issues. We can often lift today within hours. It is possible that a temporary lift within 15 minutes is achievable in the near future. That is a possibility, it should not become a legal standard. Mortgage brokers have an issue with the bill. It is our understanding that the Federal National Mortgage Association (Fannie Mae) and the Federal Home Loan Mortgage Corporation (Freddie Mac) won't secure a loan if there is a credit freeze in place. If that is the case, it is a significant problem. Our industry does not believe that a freeze is a proven, effective deterrent to identity theft. Additionally, there are questions whether or not CRAs can and will comply. If mortgage brokers are exempted from the bill, our concerns are resolved. The bill raises issues for small CRAs. The existing law has a broad exemption that works for collection agencies. The bill includes a narrow exemption for collection agencies acting in certain circumstances. This doesn't make sense since collection agencies don't issue credit. The collection agencies should be removed from that provision.

Persons Testifying: (In support) Representative Hurst, prime sponsor; Hunter Goodman and Steve Larsen, Attorney General's Office; Lauren Moughon, American Association of Retired Persons; Charles F. Heebner; and Scott Hazlegrove, Washington State Auto Dealers Association.

(With concerns) Denny Eliason, Washington Banker's Association; and Mel Sorensen, Property Casualty Insurers Association.

(Opposed) Cliff Webster, Consumer Data Industry Association; Adam Stein, Washington Association of Mortgage Brokers; and Kevin Underwood, Washington Collectors Association.

Persons Signed In To Testify But Not Testifying: None.