PRINTER'S NO. 251
No. 180 Session of 2005
INTRODUCED BY CORMAN, WONDERLING, GREENLEAF, M. WHITE, KASUNIC,
RHOADES, TARTAGLIONE, KITCHEN, MUSTO, O'PAKE, COSTA,
D. WHITE, STACK, ORIE, RAFFERTY AND ARMSTRONG,
FEBRUARY 11, 2005
REFERRED TO BANKING AND INSURANCE, FEBRUARY 11, 2005
AN ACT
1 Providing for protection from identity theft, for security
2 alerts and freezes, for procedures for access after
3 imposition and removal of security freezes and for related
4 matters.
5 The General Assembly of the Commonwealth of Pennsylvania
6 hereby enacts as follows:
7 Section 1. Short title.
8 This act shall be known and may be cited as the Credit
9 Reporting Agency Law.
10 Section 2. Definitions.
11 The following words and phrases when used in this act shall
12 have the meanings given to them in this section unless the
13 context clearly indicates otherwise:
14 "Clear and proper identification." Information generally
15 deemed sufficient to identify a person.
16 "Credit report." Any written, oral or other communication of
17 any credit information by a credit reporting agency, as defined
18 in the Fair Credit Reporting Act (Public Law 91-508, 15 U.S.C. §
1 1681 et seq.), which operates or maintains a database of
2 consumer credit information bearing on a consumer's
3 creditworthiness, credit standing or credit capacity.
4 "Credit reporting agency." Any person who, for monetary
5 fees, dues or on a cooperative nonprofit basis, regularly
6 engages in whole or in part in the practice of assembling or
7 evaluating consumer credit information or other information on
8 consumers for the purpose of furnishing consumer reports to
9 third parties and who uses any means or facility of interstate
10 commerce for the purpose of preparing or furnishing consumer
11 reports. The term does not mean a check acceptance service which
12 provides check approval and guarantees services to merchants.
13 "Security alert." A notice placed on a consumer file or in a
14 consumer's report, at the request of the consumer, that is sent
15 to a recipient of a consumer report or file involving that
16 consumer file, signifying the fact that the consumer's identity
17 may have been used without the consumer's consent to
18 fraudulently obtain goods or services in the consumer's name.
19 "Security freeze." A notice placed on a consumer file, at
20 the request of the consumer and subject to certain exceptions,
21 that prohibits a credit reporting agency from releasing the
22 consumer's credit report or credit score without the express
23 authorization of the consumer.
24 Section 3. Security alert.
25 (a) General rule.--A consumer may elect to place a security
26 alert in his or her credit report by making a request in writing
27 or by telephone to a consumer credit reporting agency.
28 (b) Notification.--A consumer credit reporting agency shall
29 notify each person requesting consumer credit information with
30 respect to a consumer of the existence of a security alert in
20050S0180B0251 - 2 -
1 the credit report of that consumer, regardless of whether a full
2 credit report, credit score or summary report is requested.
3 (c) Toll-free telephone number.--Each consumer credit
4 reporting agency shall maintain a toll-free telephone number to
5 accept security alert requests from consumers 24 hours a day,
6 seven days a week. The toll-free telephone number shall be
7 included in any written disclosure by a consumer credit
8 reporting agency to any consumer and shall be printed in a clear
9 and conspicuous manner.
10 (d) Security alert request.--A consumer credit reporting
11 agency shall place a security alert on a consumer's credit
12 report no later than five business days after receiving a
13 request from the consumer.
14 (e) Placement and renewal.--The security alert shall remain
15 in place for at least one year, and a consumer shall have the
16 right to request a renewal of the security alert.
17 (f) Approval.--Any person who uses a consumer credit report
18 in connection with the approval of credit based on an
19 application for an extension of credit, or with the purchase,
20 lease or rental of goods or noncredit-related services and who
21 receives notification of a security alert pursuant to subsection
22 (a) may not lend money, extend credit or complete the purchase,
23 lease or rental of goods or noncredit-related services without
24 taking reasonable steps to verify the consumer's identity, in
25 order to ensure that the application for an extension of credit
26 or for the purchase, lease or rental of goods or noncredit-
27 related services is not the result of identity theft. If the
28 consumer has placed a statement with the security alert in his
29 or her file requesting that identity be verified by calling a
30 specified telephone number, any person who receives that
20050S0180B0251 - 3 -
1 statement with the security alert in a consumer's file pursuant
2 to subsection (a) shall take reasonable steps to verify the
3 identity of the consumer by contacting the consumer using the
4 specified telephone number prior to lending money, extending
5 credit or completing the purchase, lease or rental of goods or
6 noncredit-related services. If a person uses a consumer credit
7 report to facilitate the extension of credit or for another
8 permissible purpose on behalf of a subsidiary, affiliate, agent,
9 assignee or prospective assignee, that person may verify a
10 consumer's identity under this section in lieu of the
11 subsidiary, affiliate, agent, assignee or prospective assignee.
12 (g) Extension of credit.--For purposes of this section,
13 "extension of credit" does not include an increase in the dollar
14 limit of an existing open-end credit plan, as defined in
15 Regulation Z issued by the Board of Governors of the Federal
16 Reserve System of 12 CFR 226.2 (relating to definitions and
17 rules of construction), or any change to, or review of, an
18 existing credit account.
19 (h) Verification of identity.--If reasonable steps are taken
20 to verify the identity of the consumer, those steps constitute
21 compliance with the requirements of this section, except that if
22 a consumer has placed a statement including a telephone number
23 with the security alert in his or her file, his or her identity
24 shall be verified by contacting the consumer using that
25 telephone number as specified pursuant to subsection (f).
26 (i) Notice of expiration date.--A consumer credit reporting
27 agency shall notify each consumer who has requested that a
28 security alert be placed on his or her consumer credit report of
29 the expiration date of the alert.
30 Section 4. Security freeze.
20050S0180B0251 - 4 -
1 (a) Request for freeze.--A consumer may elect to place a
2 security freeze on his credit report by written request, sent by
3 certified mail, that includes clear and proper identification,
4 to a credit reporting agency. A credit reporting agency shall
5 place a security freeze on a consumer's credit report no later
6 than five business days after receiving a written request for
7 the security freeze from the consumer.
8 (b) Effect of security freeze.--When a security freeze is in
9 place, information from a consumer's credit report shall not be
10 released to a third party without prior express authorization
11 from the consumer. This subsection shall not prevent a credit
12 reporting agency from advising a third party that a security
13 freeze is in effect with respect to the consumer's credit
14 report.
15 (c) Third party request.--If a third party requests access
16 to a consumer credit report on which a security freeze is in
17 effect, and this request is in connection with an application
18 for credit or any other use, and the consumer does not allow his
19 or her credit report to be accessed for that specific party or
20 period of time, the third party may treat the application as
21 incomplete.
22 Section 5. Credit reporting agency.
23 The credit reporting agency shall, no later than ten business
24 days after the date the agency receives the request for a
25 security freeze, send the consumer a written confirmation that
26 provides the consumer with a unique personal identification
27 number or password to be used by the consumer when providing
28 authorization for the access to his credit file for a specific
29 period of time. In addition, the credit reporting agency shall
30 simultaneously provide to the consumer in writing notification
20050S0180B0251 - 5 -
1 of the process of placing, removing the temporarily lifting a
2 security freeze and the process for allowing access to
3 information from the consumer's credit file for a specific party
4 or for a specific period while the security freeze is in effect.
5 Section 6. Personal identification.
6 A consumer may request in writing a replacement personal
7 identification number or password. The request must comply with
8 the requirements for requesting a security freeze under section
9 4 (relating to security freeze). The credit reporting agency
10 shall, no later than seven business days after the date the
11 agency receives the request for a replacement personal
12 identification number or password, provide the consumer with a
13 new, unique personal identification number or password to be
14 used by the consumer instead of the number or password that was
15 provided under section 5 (relating to credit reporting agency).
16 Section 7. Notification of freeze.
17 A credit reporting agency shall notify a person who requests
18 a consumer report or score if a security alert or freeze is in
19 effect for the consumer file involved in that report or score.
20 Section 8. Effect of freeze.
21 If a third party requests access to a consumer credit report
22 on which a security freeze is in effect and this request is in
23 connection with an application for credit or any other use and
24 the consumer does not allow his credit report to be accessed for
25 that specific period of time, the third party must treat the
26 application as incomplete.
27 Section 9. Temporary freeze.
28 (a) Request.--If the consumer wishes to allow his credit
29 report or score to be accessed for a specific period of time
30 while a freeze is in place, he shall contact the credit
20050S0180B0251 - 6 -
1 reporting agency and request that the freeze be temporarily
2 lifted and provide the following:
3 (1) Clear and proper identification.
4 (2) The unique personal identification number or
5 password provided by the credit reporting agency pursuant to
6 section 5 (relating to credit reporting agency).
7 (3) The proper information regarding the time period for
8 which the report shall be available to users of the credit
9 report.
10 (4) The proper information regarding the third party who
11 is to receive the credit report or the time period for which
12 the report shall be available to users of the credit report.
13 (b) Agency requirement.--A credit reporting agency that
14 receives a request from a consumer to temporarily lift a freeze
15 on a credit report pursuant to subsection (a) shall comply with
16 the request no later than three business days after receiving
17 the request. A credit reporting agency may develop procedures
18 involving the use of the telephone, facsimile, Internet or other
19 electronic media to receive and process a request from a
20 consumer to temporarily lift a freeze on a credit report or
21 score pursuant to subsection (a) in an expedited manner.
22 (c) Removal of temporary freeze.--A credit reporting agency
23 shall remove or temporarily lift a freeze placed on a consumer's
24 credit report only in the following cases:
25 (1) Upon consumer request as provided in this section.
26 (2) If the consumer's credit report was frozen due to a
27 material misrepresentation of fact by the consumer. If a
28 credit reporting agency intends to remove a freeze upon a
29 consumer's credit report pursuant to this paragraph, the
30 credit reporting agency shall notify the consumer in writing
20050S0180B0251 - 7 -
1 prior to removing the freeze on the consumer's credit report.
2 (d) Duration of freeze.--A security freeze shall remain in
3 place until the consumer requests that the security freeze be
4 removed. A credit reporting agency shall remove a security
5 freeze within three business days of receiving a request for
6 removal from the consumer who provides both of the following:
7 (1) Clear and proper identification.
8 (2) The unique personal identification number or
9 password provided by the credit reporting agency.
10 (e) Applicability of freeze.--A security freeze does not
11 apply to a consumer report provided to:
12 (1) A Federal, State or local government entity,
13 including a law enforcement agency or court, or their agents
14 or assigns.
15 (2) A private collection agency for the sole purpose of
16 assisting in the collection of an existing debt of the
17 consumer who is the subject of the credit report requested.
18 (3) A person or entity or a subsidiary, affiliate or
19 agent of that person or entity, or an assignee of a financial
20 obligation owing by the consumer to that person or entity, or
21 a prospective assignee of a financial obligation owing by the
22 consumer to that person or entity in conjunction with the
23 proposed purchase of the financial obligation, with which the
24 consumer has or had prior to assignment an account or
25 contract, including a demand deposit account, or to whom the
26 consumer issued a negotiable instrument, for the purposes of
27 reviewing the account or collecting the financial obligation
28 owing for the account, contract or negotiable instrument. For
29 purposes of this paragraph, "reviewing the account" includes
30 activities related to account maintenance, monitoring, credit
20050S0180B0251 - 8 -
1 line increases and account upgrades and enhancements.
2 (4) A subsidiary, affiliate, agent, assignee or
3 prospective assignee of a person to whom access has been
4 granted under this section for the purposes of facilitating
5 the extension of credit.
6 (5) A person, for the purposes of prescreening as
7 provided by the Fair Credit Reporting Act (Public Law 91-508,
8 15 U.S.C. § 1681 et seq.).
9 (6) A credit reporting agency for the purposes of
10 providing a consumer with a copy of his own report on his
11 request.
12 (7) A child support enforcement agency.
13 (8) A credit reporting agency that acts only as a
14 reseller of credit information by assembling and merging
15 information contained in the database of another credit
16 reporting agency or multiple credit reporting agencies and
17 does not maintain a permanent database of credit information
18 from which new credit reports are produced. However, a credit
19 reporting agency acting as a reseller shall honor any
20 security freeze placed on a credit report by another credit
21 reporting agency.
22 (9) A check services or fraud prevention services
23 company which issues reports on incidents of fraud or
24 authorizations for the purpose of approving or processing
25 negotiable instruments, electronic funds transfers or similar
26 methods of payments.
27 (10) A deposit account information service company which
28 issues reports regarding account closures due to fraud,
29 substantial overdrafts, ATM abuse or similar negative
30 information regarding a consumer to inquiring banks or other
20050S0180B0251 - 9 -
1 financial institutions for use only in reviewing a consumer
2 request for a deposit account at the inquiring bank or
3 financial institution.
4 Section 10. Fees.
5 (a) General rule.--A credit reporting agency may impose a
6 reasonable charge on a consumer for initially placing a security
7 freeze on a consumer file. The amount of the charge may not
8 exceed $10. The charge to temporarily lift the security freeze
9 may not exceed $8 per request. At no time shall the consumer be
10 charged for revoking the freeze. An exception shall be allowed
11 whereby the consumer will be charged $0 by the consumer
12 reporting agency placing the security freeze if any of the
13 following apply:
14 (1) If the consumer is a victim of identity theft and,
15 upon the request of the consumer reporting agency, provides
16 the credit reporting agency with a police report.
17 (2) If the consumer is 62 years of age or older.
18 (b) Confirmation required.--If a security freeze is in
19 place, a credit reporting agency shall not change any of the
20 following official information in a consumer credit report
21 without sending a written confirmation of the change to the
22 consumer within 30 days of the change being posted to the
23 consumer's file:
24 (1) Name.
25 (2) Date of birth.
26 (3) Social Security number.
27 (4) Address.
28 Written confirmation is not required for technical modifications
29 of a consumer's official information, including name and street
30 abbreviations, complete spellings or transposition of numbers or
20050S0180B0251 - 10 -
1 letters. In the case of an address change, the written
2 confirmation shall be sent to both the new address and to the
3 former address.
4 Section 11. Damages.
5 Any consumer damaged by an intentional or negligent violation
6 of this act may bring an action for and shall be entitled to
7 recovery of actual damages, plus reasonable attorney fees, court
8 costs and other reasonable costs of prosecution of the suit.
9 Section 12. Effective date.
10 This act shall take effect in 60 days.
A12L13RLE/20050S0180B0251 - 11 -