Title: An act relating to consumer credit reports.

Brief Description: Modifying consumer credit report provisions.

Sponsors: By Senate Committee on Financial Institutions & Insurance (originally sponsored by Senators Berkey, Benton, Roach, Zarelli, Kauffman, Marr, Kilmer, Carrell, Hobbs, Schoesler, Franklin, Haugen and Shin).

Brief History:

Insurance, Financial Services & Consumer Protection: 3/20/07, 3/27/07 [DPA].

Floor Activity:

Passed House - Amended: 4/4/07, 96-0.

HOUSE COMMITTEE ON INSURANCE, FINANCIAL SERVICES & CONSUMER PROTECTION

Majority Report: Do pass as amended. Signed by 8 members: Representatives Kirby, Chair; Kelley, Vice Chair; Roach, Ranking Minority Member; Strow, Assistant Ranking Minority Member; Hurst, Rodne, Santos and Simpson.

Staff: Jon Hedegard (786-7127).

Background:

In 2005, the Legislature allowed victims of identity theft to place a security freeze on their credit reports.

"Security freeze" is defined as "a notice placed in a consumer's credit report, at the request of the consumer and subject to certain exceptions, that prohibits the consumer reporting agency (CRA) from releasing the consumer's credit report or any information from it without the express authorization of the consumer."

"Victim of identity theft" means:

• a victim of identity theft as defined in the statute criminalizing identity theft; or
• a person who has been notified that a computer data system breach has resulted in the unauthorized acquisition of that person's unencrypted personal information by another.

A victim of identity theft may place a security freeze on his or her credit report by submitting a written request via certified mail to a CRA. Subject to certain exceptions, the CRA is prohibited from releasing the report or information from the report without the consumer's express permission. The CRA must give a victim of identity theft who requests a freeze a personal identification number (PIN). The consumer may use the PIN when making a request for a temporary lifting of the freeze or for a release to a particular person or entity. A CRA may develop procedures involving the use of telephone, fax, the Internet, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze in an expedited manner.

The freeze does not apply to the use of a consumer credit report by specified entities, including:

• a person for whom the consumer has lifted the freeze;
• any federal, state, or local entity, or their agents;
• a private collection agency acting under a court order, warrant, or subpoena;
• a child support agency acting under Title IV-D of the Social Security Act (42 U.S.C. et seq.);
• the Department of Social and Health Services;
• the Internal Revenue Service;
• the use of credit information for the purposes of prescreening as provided for by the federal Fair Credit Reporting Act;
• any person or entity administering a credit file monitoring subscription service to which the consumer has subscribed; and
• any person or entity for the purpose of providing a consumer with a copy of his or her credit report upon the consumer's request.

Violations of the Fair Credit Reporting Act are violations of the Consumer Protection Act.

Summary of Amended Bill:

All consumers who are residents of this state may place a security freeze on their credit report.

Definitions
The definition of "victim of identity theft" is modified.

A definition of "credit report" is added. "Credit report" means a consumer report, as defined in 15 U.S.C. Sec. 1681a, that is used or collected to serve as a factor in establishing a consumer's eligibility for credit for personal, family, or household purposes.

A definition of "normal business hours" is added. "Normal business hours" means Sunday through Saturday, between the hours of 6:00 a.m. and 9:30 p.m., Pacific Time.

The definition of "security freeze" is altered to mean "a prohibition, consistent with this section, on a CRA's furnishing of a consumer's credit report to a third party intending to use the credit report to determine the consumer's eligibility for credit."

Fees
A CRA may charge a fee of no more than $10 to a consumer for each freeze, removal of the freeze, or temporary lift of the freeze for a period of time. A CRA must not charge a fee to a victim of identity theft or a person who is 65 years or older.

"15-minute Thaw"
A CRA must allow a consumer to lift a freeze within 15 minutes of receiving the request from the consumer through the electronic contact method chosen by the CRA if the request:

• is received during normal business hours; and
• includes the consumer's proper identification, fee, and correct PIN or password.

A CRA does not have to lift a freeze within 15 minutes if the CRA's ability to remove the security freeze within 15 minutes is prevented by:

• an Act of God, including: fire, earthquakes, hurricanes, storms, or similar natural disasters or phenomena;
• unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes, or disputes disrupting operations, or similar occurrences;
• an interruption in operations, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruptions;
• governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar directives;
• regularly scheduled maintenance of, or updates to, the CRA's systems outside of normal business hours;
• commercially reasonable maintenance of, or repair to, the CRA's systems that is unexpected or unscheduled; or
• receipt of a removal request outside of normal business hours.

Exemptions From a Freeze
The existing exemption for private collection agencies acting under a court order, warrant, or subpoena is expanded to include any person acting under a court order, warrant, or subpoena.

Mortgage brokers or persons required to be licensed under Chapter 19.146 RCW are exempt from a freeze. A CRA is not liable if through inadvertence or mistake, the CRA releases information to a person or entity that purports to be a mortgage broker or loan originator but is not a mortgage broker or loan originator.

The consumer's request for a security freeze does not prohibit a CRA from disclosing the consumer's credit report for other than credit-related purposes consistent with the definition of "credit report" in the bill.

A consumer may not sue under the Consumer Protection Act if a CRA does not perform a temporary lift of a freeze within the required time-frame. The Attorney General may enforce violations of the time frames concerning a lift of a consumer freeze.

Appropriation: None.

Fiscal Note: Not requested.

Effective Date of Amended Bill: The bill takes effect September 1, 2008.

Staff Summary of Public Testimony:

(In support) This is an important issue. There are two main features that the Attorney General believes are crucial in any bill. The first is the expansion of the scope to allow all consumers to place a freeze. The second is to allow for a 15-minute lift of a freeze. Both of those provisions are in this bill. The Attorney General supports this bill. This is a good bill. There are two things that would provide for even greater consumer protections. First, the fees are $10 per activity. We prefer the $5 amount in the House bill. Second is the effective date, the CRAs do need time to implement the law but they must comply with the Utah deadline of September 1, 2008. If the effective date is later than this year, it should be the Utah deadline. I support the bill. It should be made effective this year. The fees should be lower. There should be an educational component for consumers. A lift should be available at any time.

(In support of amendment) We can support the bill. There have been a number of compromises made to get to this place. Regarding fees, $10 similar to standards in states around the country. The bill exempts seniors and that is not available anywhere else. While we support the bill, if you do open up the fee issue, we would prefer a "reasonable" standard instead of a set amount for a lift of a freeze. That is the standard in Utah. We don't recommend revisiting policy decisions but we have other preferences also if policy decisions are being considered. There are some technical issues we do ask the committee to consider. Our counsel prefers a rewording of some Consumer Protection Act exemption language. There are a few references to "consumer credit reporting agencies" that we recommend be changed to "consumer reporting agency." Finally, there is a reference to "Pacific Standard Time" that would work better if "standard" was removed. One of the three major CRAs is testing a product that allows for a freeze online. The other two do not have a product today. Even if they are able to develop the product, we don't know if it will be economically viable. It is possible that this will be available and in the market before it is required by law. We don't believe that it should be required before they all are able to offer it.

Persons Testifying: (In support) Steve Larsen, Office of the Attorney General; Cheryl Reed, AARP Washington; and Amy Fortier.

(In support of amendment) Cliff Webster, Consumer Data Industry Association.

Persons Signed In To Testify But Not Testifying: Steve Buckner, Washington Mortgage Brokers Association; and Scott Hazlegrove, Washington State Auto Dealers Association.