HOUSE AMENDED
        PRIOR PRINTER'S NOS. 251, 1886, 1959,         PRINTER'S NO. 2238
        2090

THE GENERAL ASSEMBLY OF PENNSYLVANIA


SENATE BILL

No. 180 Session of 2005


        INTRODUCED BY CORMAN, WONDERLING, GREENLEAF, M. WHITE, KASUNIC,
           RHOADES, TARTAGLIONE, KITCHEN, MUSTO, O'PAKE, COSTA,
           D. WHITE, STACK, ORIE, RAFFERTY, ARMSTRONG AND VANCE,
           FEBRUARY 11, 2005

        AS AMENDED ON THIRD CONSIDERATION, HOUSE OF REPRESENTATIVES,
           NOVEMBER 13, 2006

                                     AN ACT

     1  Providing for protection from identity theft, for security
     2     freezes, for procedures for access after imposition and
     3     removal of security freezes and for related matters.

     4     The General Assembly of the Commonwealth of Pennsylvania
     5  hereby enacts as follows:
     6  Section 1.  Short title.
     7     This act shall be known and may be cited as the Credit
     8  Reporting Agency Law.
     9  Section 2.  Definitions.
    10     The following words and phrases when used in this act shall
    11  have the meanings given to them in this section unless the
    12  context clearly indicates otherwise:
    13     "Consumer."  An individual.
    14     "Consumer report."  A written, oral or other communication of
    15  any information by a consumer reporting agency bearing on a
    16  consumer's creditworthiness, credit standing or credit capacity.

     1     "Consumer reporting agency."  Any person who, for monetary
     2  fees, dues or on a cooperative basis, regularly engages in whole
     3  or in part in the practice of assembling or evaluating consumer
     4  credit information or other information on consumers for the
     5  purpose of furnishing consumer reports to third parties.
     6     "Security freeze."  A notice placed on a consumer report, at
     7  the request of the consumer and subject to certain exceptions,
     8  that prohibits a consumer reporting agency from releasing the
     9  consumer report without the express authorization of the
    10  consumer.
    11  Section 3.  Security freeze.
    12     (a)  Request for freeze.--
    13         (1)  A consumer may elect to place a security freeze on
    14     his consumer report by providing clear and proper              <--
    15     identification to a consumer reporting agency. The consumer
    16     may make the request DIRECTLY TO A CONSUMER REPORTING AGENCY:  <--
    17             (i)  by certified mail USING AN ADDRESS DESIGNATED BY  <--
    18         THE CONSUMER REPORTING AGENCY; or
    19             (ii)  directly to the consumer reporting agency        <--
    20         through a secure Internet connection if the connection is
    21         made available by the consumer reporting agency.
    22         (2)  Each consumer reporting agency covered by this act
    23     shall have a toll-free telephone number available to allow a
    24     consumer to request an appropriate form RECEIVE INFORMATION    <--
    25     ABOUT HOW to request a security freeze, which the consumer
    26     must return by certified mail.
    27         (3)  A consumer reporting agency shall place a security
    28     freeze on a consumer report no later than five business days
    29     after receiving a request for the security freeze from the
    30     consumer.
    20050S0180B2238                  - 2 -     

     1         (4)  The following entities are not required to place a
     2     security freeze in a consumer report:
     3             (i)  A credit reporting agency that acts only as a
     4         reseller of credit information by assembling and merging
     5         information contained in the database of another credit
     6         reporting agency or multiple credit reporting agencies
     7         and does not maintain a permanent database of credit
     8         information from which new credit reports are produced,
     9         however, a credit reporting agency acting as a reseller
    10         shall honor any security freeze placed on a credit report
    11         by another credit reporting agency.
    12             (ii)  A check services or fraud prevention services
    13         company which issues reports on incidents of fraud or
    14         authorizations for the purpose of approving or processing
    15         negotiable instruments, electronic funds transfers or
    16         similar methods of payments.
    17             (iii)  A deposit account information service company
    18         which issues reports regarding account closures due to
    19         fraud, substantial overdrafts, automated teller machine
    20         (ATM) abuse or similar negative information regarding a
    21         consumer to inquiring banks or other financial
    22         institutions for use only in reviewing a consumer request
    23         for a deposit account at the inquiring bank or financial
    24         institution.
    25     (b)  Effect of security freeze.--Except as provided in
    26  subsection (e), when a security freeze is in place, information
    27  from a consumer report shall not be released to a third party
    28  without prior express authorization from the consumer. This
    29  subsection shall not prevent a consumer reporting agency from
    30  advising a third party that a security freeze is in effect with
    20050S0180B2238                  - 3 -     

     1  respect to a consumer report.
     2     (c)  Third-party request.--If a third party requests access
     3  to a consumer report on which a security freeze is in effect,
     4  and the consumer does not allow his or her consumer report to be
     5  accessed for that specific party or for a period of time, the
     6  third party shall treat the application as incomplete.
     7     (d)  Duration of freeze.--A security freeze shall remain in
     8  place until the consumer requests that the security freeze be     <--
     9  removed under section 7. PLACE UNTIL THE EARLIER OF THE DATE THE  <--
    10  CONSUMER REPORTING AGENCY RECEIVES A REQUEST FROM THE CONSUMER
    11  TO REMOVE THE SECURITY FREEZE OR UNTIL SEVEN YEARS FROM THE DATE
    12  THAT THE SECURITY FREEZE WAS PUT IN PLACE BY THE CONSUMER
    13  REPORTING AGENCY.
    14     (e)  Applicability of freeze.--A security freeze does not      <--
    15  apply to a consumer report provided to: NOTWITHSTANDING A         <--
    16  SECURITY FREEZE THE FOLLOWING ENTITIES MAY RECEIVE A CONSUMER
    17  REPORT:
    18         (1)  A Federal, State or local government entity,
    19     including a law enforcement agency or court, or their agents
    20     or assigns.
    21         (2)  A private collection agency for the sole purpose of
    22     assisting in the collection of an existing debt of the
    23     consumer who is the subject of the consumer report requested.
    24         (3)  A person or entity or a subsidiary, affiliate or
    25     agent of that person or entity, or an assignee of a financial
    26     obligation owed by the consumer to that person or entity, or
    27     a prospective assignee of a financial obligation owed by the
    28     consumer to that person or entity in conjunction with the
    29     proposed purchase of the financial obligation, with which the
    30     consumer has or had prior to assignment an account or
    20050S0180B2238                  - 4 -     

     1     contract, including a demand deposit account, or to whom the
     2     consumer issued a negotiable instrument, for the purposes of
     3     reviewing the account or collecting the financial obligation
     4     owing for the account, contract or negotiable instrument. For
     5     purposes of this paragraph, "reviewing the account" includes
     6     activities related to account maintenance, monitoring, credit
     7     line increases and account upgrades and enhancements.
     8         (4)  A subsidiary, affiliate, agent, assignee or
     9     prospective assignee of a person to whom access has been
    10     granted under this section for the purposes of facilitating
    11     the extension of credit.
    12         (5)  A person, for the purposes of prescreening as
    13     provided by the Fair Credit Reporting Act (Public Law 91-508,
    14     15 U.S.C. § 1681 et seq.).
    15         (6)  A consumer reporting agency for the purposes of
    16     providing a consumer with a copy of his own consumer report
    17     on his request.
    18         (7)  A child support enforcement agency.
    19         (8)  A consumer reporting agency that acts only as a
    20     reseller of credit information by assembling and merging
    21     information contained in the database of another consumer
    22     reporting agency or multiple consumer reporting agencies and
    23     does not maintain a permanent database of credit information
    24     from which new consumer reports are produced. However, a
    25     consumer reporting agency acting as a reseller shall honor
    26     any security freeze placed on a consumer report by another
    27     consumer reporting agency.
    28         (9)  A check services or fraud prevention services
    29     company which issues reports on incidents of fraud or
    30     authorizations for the purpose of approving or processing
    20050S0180B2238                  - 5 -     

     1     negotiable instruments, electronic funds transfers or similar
     2     methods of payments.
     3         (10)  A deposit account information service company which
     4     issues reports regarding account closures due to fraud,
     5     substantial overdrafts, automated teller machine (ATM) abuse
     6     or similar negative information regarding a consumer to
     7     inquiring banks or other financial institutions for use only
     8     in reviewing a consumer request for a deposit account at the
     9     inquiring bank or financial institution.
    10         (11)  Any person or entity for use in setting or
    11     adjusting a rate, issuing or underwriting a policy, adjusting
    12     a claim or servicing a policy for underwriting for property
    13     and casualty insurance purposes.
    14         (12)  A person or entity administering a credit file
    15     monitoring subscription service or similar service to which
    16     the consumer has subscribed.
    17  Section 4.  Consumer reporting agency.
    18     The consumer reporting agency shall, no later than ten
    19  business days after the date the agency receives a request from
    20  a consumer for a security freeze, send the consumer a written
    21  confirmation that provides the consumer with a unique personal
    22  identification number or password to be used by the consumer
    23  when providing authorization for the access to his consumer
    24  report for a specific period of time or for a specific third
    25  party or removing the security freeze. In addition, the consumer
    26  reporting agency shall simultaneously provide to the consumer in
    27  writing notification of the process of removing a security
    28  freeze and the process of temporarily lifting a security freeze
    29  and the process for allowing access to information from the
    30  consumer report for a specific party or for a specific period
    20050S0180B2238                  - 6 -     

     1  while the security freeze is in effect.
     2  Section 5.  Personal identification.
     3     A consumer may request in writing a replacement personal
     4  identification number or password. The request must comply with
     5  the requirements for requesting a security freeze under section
     6  3. The consumer reporting agency shall, no later than ten
     7  business days after the date the agency receives the request for
     8  a replacement personal identification number or password,
     9  provide the consumer with a new, unique personal identification
    10  number or password to be used by the consumer instead of the
    11  number or password that was provided under section 4.
    12  Section 6.  Notification of freeze.
    13     A consumer reporting agency shall notify a person who
    14  requests a consumer report if a security freeze is in effect for
    15  the consumer report requested.
    16  Section 7.  Temporary access or removal of security freeze.
    17     (a)  Request.--If the consumer wishes to allow his consumer
    18  report to be accessed for a specific period of time or by a
    19  specific third party while a security freeze is in place or to
    20  remove a security freeze he shall be able to contact the
    21  consumer reporting agency by certified mail or by a toll-free
    22  telephone number which shall be provided by the consumer
    23  reporting agency and may be able to contact the consumer
    24  reporting agency through a secure Internet connection which may
    25  be established by the consumer reporting agency and request that
    26  the security freeze be temporarily lifted or removed and provide
    27  all of the following:
    28         (1)  Clear and proper PROPER identification.               <--
    29         (2)  The unique personal identification number or
    30     password provided by the consumer reporting agency pursuant
    20050S0180B2238                  - 7 -     

     1     to this act.
     2         (3)  One of the following:
     3             (i)  The proper information regarding the time period
     4         for which the consumer report shall be available to any
     5         person.
     6             (ii)  The proper information regarding the third
     7         party who is to receive the consumer report.
     8             (iii)  A request that the security freeze be removed.
     9     (b)  Agency requirement.--A consumer reporting agency that
    10  receives a request from a consumer pursuant to subsection (a)
    11  shall comply with the request no later than three business days
    12  after receiving the request.
    13     (c)  Removal of security freeze.--A consumer reporting agency
    14  shall temporarily lift or remove a security freeze placed on a
    15  consumer report only in the following cases:
    16         (1)  Upon the consumer's request as provided for in this
    17     section.
    18         (2)  If the consumer report was frozen due to a material
    19     misrepresentation of fact by the consumer or other person. If
    20     a consumer reporting agency intends to remove a freeze upon a
    21     consumer report pursuant to this paragraph, the consumer
    22     reporting agency shall notify the consumer in writing prior
    23     to removing the freeze on the consumer report.
    24  Section 8.  Secure procedures.
    25     In addition to the requirements of this act, a consumer
    26  reporting agency may develop secure procedures, including, but
    27  not limited to, the use of the telephone, facsimile, Internet or
    28  other electronic media to receive and process a request from a
    29  consumer to place a security freeze, temporarily lift a security
    30  freeze or remove a security freeze on a consumer report pursuant
    20050S0180B2238                  - 8 -     

     1  to this act in an expedited manner.
     2  Section 9.  Fees.
     3     (a)  General rule.--A consumer reporting agency may impose a
     4  reasonable charge on a consumer for initially placing a security
     5  freeze on a consumer report. The amount of the charge may not
     6  exceed $10. The charge to temporarily lift the security freeze
     7  may not exceed $10 per request. At no time shall the consumer be
     8  charged for removing the freeze.
     9     (b)  Exceptions.--
    10         (1)  A consumer will not be charged by a consumer
    11     reporting agency for placing a security freeze or temporarily
    12     lifting a security freeze if the consumer is a victim of
    13     identity theft and provides, or has provided, the consumer
    14     reporting agency with a copy of a police report.
    15         (2)  A consumer will not be charged by a consumer
    16     reporting agency for placing a security freeze if the
    17     consumer is 65 years of age or older.
    18     (c)  Confirmation required.--If a security freeze is in
    19  place, a consumer reporting agency shall not change any of the
    20  following information regarding a consumer without sending a
    21  written confirmation of the change to the consumer within 30
    22  days of the change being posted:
    23         (1)  Name.
    24         (2)  Date of birth.
    25         (3)  Social Security number.
    26         (4)  Address.
    27  Written confirmation is not required for technical modifications
    28  of a consumer's official information, including name and street
    29  abbreviations, complete spellings or transposition of numbers or
    30  letters. In the case of an address change, the written
    20050S0180B2238                  - 9 -     

     1  confirmation shall be sent to both the new address and to the
     2  former address.
     3  Section 10.  Civil relief.
     4     A violation of this act shall be deemed to be an unfair or
     5  deceptive act or practice in violation of the act of December
     6  17, 1968 (P.L.1224, No.387), known as the Unfair Trade Practices
     7  and Consumer Protection Law. The Office of Attorney General
     8  shall have exclusive authority to bring an action under the
     9  Unfair Trade Practices and Consumer Protection Law for a
    10  violation of this act.
    11  Section 11.  Effective date.
    12     This act shall take effect January 1, 2007.












    A12L13RLE/20050S0180B2238       - 10 -
See other bills
under the
same topic