HOUSE BILL REPORT

SHB 2859

As Passed Legislature

Title: An act relating to credit report security freezes.

Brief Description: Concerning credit report security freezes for minors and incapacitated persons.

Sponsors: House Committee on Business & Financial Services (originally sponsored by Representatives S. Hunt, Hudgins and Santos).

Brief History:

Committee Activity:

Business & Financial Services: 1/26/16, 2/2/16 [DPS].

Floor Activity:

Passed House: 2/17/16, 98-0.

Passed Senate: 3/1/16, 48-0.

Passed Legislature.

Majority Report: The substitute bill be substituted therefor and the substitute bill do pass. Signed by 11 members: Representatives Kirby, Chair; Stanford, Vice Chair; Vick, Ranking Minority Member; McCabe, Assistant Ranking Minority Member; Blake, Dye, Hurst, Kochmar, Ryu, Santos and G. Hunt.

Staff: David Rubenstein (786-7153).

Background:

Security Freezes Generally.

Any consumer in Washington may request that a consumer reporting agency (agency) place a security freeze on the consumer's credit report. A "security freeze" is a prohibition on the agency's release of a consumer's credit report to a third party intending to use the credit report to determine the consumer's eligibility for credit. The request for a security freeze must be submitted in writing via certified mail to the agency The agency is permitted to charge $10 for the placement of a security freeze.

Subject to certain exceptions, the agency is prohibited from releasing the report or information from the report without the consumer's express permission. The agency must give the consumer a personal identification number (PIN), which the consumer may use to make a request for a temporary lift of the freeze or for a release to a particular person or entity. The consumer reporting agency may charge $10 for the removal or temporary lift of a security freeze. Victims of identity theft and persons over 65 years old may place or lift a security freeze free of charge.

Fifteen-Minute Thaws.

Unless prevented by an act of God or other intervening force, a consumer reporting agency must allow a consumer to lift a freeze within 15 minutes of receiving the request from the consumer through the electronic contact method chosen by the agency if the request:

• is received during normal business hours; and

• includes the consumer's proper identification, fee, and correct PIN or password.

Exemptions from Security Freezes.

The freeze does not apply to the use of a consumer credit report by specified entities, including:

• a person for whom the consumer has lifted the freeze;

• any federal, state, or local entity, or their agents;

• any person acting under a court order, warrant, or subpoena;

• a child support agency acting under Title IV-D of the Social Security Act (42 U.S.C. et seq.);

• the Department of Social and Health Services;

• the Internal Revenue Service;

• a mortgage broker or loan originator;

• the use of credit information for the purposes of prescreening as provided for by the federal Fair Credit Reporting Act;

• any person or entity administering a credit file monitoring subscription service to which the consumer has subscribed; and

• any person or entity for the purpose of providing a consumer with a copy of his or her credit report upon the consumer's request.

A consumer reporting agency is not liable for the inadvertent release of a credit report to a person claiming to be a mortgage broker or loan originator if that person is not, in fact, a mortgage broker or loan originator.

A consumer's request for a security freeze does not prohibit the release of the consumer's credit report for other than credit-related purposes.

Change of Information.

If a security freeze is in place, the consumer reporting agency may not change the consumer's name, birth date, social security number, or address in its file on that consumer without written notice to the consumer within 30 days of the change being made.

Enforcement.

Except with regard to temporary lifts discussed below, a violation of a consumer's security freeze rights is a violation of the Consumer Protection Act.

Consumers have no private cause of action for violations of the agency's failure to lift a security freeze. Enforcement is placed exclusively with the attorney general.

Birth Certificates.

The Department of Health (DOH) administers state laws regarding birth certificates and other vital records. The DOH is responsible for issuing certified copies of vital records, including birth certificates showing the child's full name, sex, date of birth, and date of filing the certificate, but local health authorities may also issue birth certificates. The statutes governing birth certificates establish a standard birth certificate form, the requirements for completing and forwarding birth certificate information, and requirements for issuing new or amended birth certificates.

Guardians and Limited Guardians.

Guardianship is a legal process through which a guardian or limited guardian is given the power to make decisions for a person who is determined to be "incapacitated" and therefore unable to take care of himself or herself. A person may be incapacitated if the individual is at a significant risk of financial harm because of an inability to manage his or her property or financial affairs or has a significant risk of personal harm because of an inability to provide for nutrition, health, housing, or physical safety.

Summary of Substitute Bill:

A new definitions section is created separate from the definitions section applicable to the remainder of the chapter.

Protected Consumer Security Freezes.

"Protected consumer" is defined to mean:

• a person under the age of 16 years old at the time of the request; or

• an incapacitated person for whom a guardian or limited guardian has been appointed.

"Representative" is defined to mean a person who can provide sufficient proof of authority to act on behalf of a protected consumer. "Sufficient proof of authority" means:

• a copy of the consumer's birth certificate if the representative is the consumer's parent;

• a court order;

• a valid power of attorney; or

• a notarized written statement signed by the representative describing the representative's authority to act on the consumer's behalf.

Placing a Freeze.

A representative may request a security freeze on behalf of a protected consumer by submitting a request to a consumer reporting agency at the address or other point of contact specified by the agency. To request a security freeze on behalf of a protected consumer, the representative must provide proof of identity for both the representative and the protected consumer, sufficient proof of authority to act on behalf of the protected consumer, and a fee not to exceed $10. If the consumer reporting agency does not have a credit file on the protected consumer at the time of the request, the agency must create a special record for the purpose of the freeze. The freeze must take effect within 30 days of the agency's receiving the request.

The $10 fee for placing and lifting a security freeze is waived for minors under the age of 16 on whom the agency already has a file at the time of the request and for those protected consumers who produce evidence of identity theft.

Lift of Freeze.A freeze remains in effect until lifted by request of the protected consumer or protected consumer's representative, or if the agency determines that the freeze was placed based on a material representation of fact by the consumer or representative. A request for a lift by a representative must also include proof of identity and authority, while a request by the protected consumer must include proof that the representative's authority is no longer valid. The freeze must be lifted within 30 days of a request to do so.

Violations.

A violation of the protected consumer security freeze provision is enforced in the same manner as a violation of the general security freeze provisions.

Exemptions.

The following persons and transactions are exempt from the protected consumer security freeze requirements:

• government agencies;

• actions under court orders;

• child support agencies;

• credit file monitoring services;

• credit reports provided to the consumer; and

• persons maintaining information for criminal record, personal loss history, fraud prevention nor detection, employment screening, and tenant screening information.

Information to Accompany Birth Certificates.

The issuer of a birth certificate must include information prepared by the DOH describing the advisability of a security freeze and procedures for obtaining one.

Appropriation: None.

Fiscal Note: Available.

Effective Date: The bill takes effect January 1, 2017.

Staff Summary of Public Testimony:

(In support) This bill protects children like similar laws in several other states, including North Carolina on which this bill is based. New parents have a great deal to worry about, but usually they don't think about their children's identities being stolen. Currently, a stolen social security number can put a child at risk indefinitely. Credit bureaus do not maintain files on minors and will not create one even if you ask them to, so there is no way to request a freeze for your child. This bill would require that they create a file for the purposes of a freeze.

(Opposed) None.

(Other) The Consumer Data Industry Association (CDIA) does not object to this bill, but it has concerns with the drafting. The CDIA would prefer to use the same language that other states have used for uniformity.

Persons Testifying: (In support) Hilary Hunt.

(Other) Cliff Webster, Consumer Data Industry Association.

Persons Signed In To Testify But Not Testifying: None.