Regular Session 2017-2018 House Bill 1847 P.N. 3129

PRIOR PRINTER'S NO. 2567

PRINTER'S NO. 3129

THE GENERAL ASSEMBLY OF PENNSYLVANIA

HOUSE BILL

No.

1847

Session of

2017

INTRODUCED BY DRISCOLL, THOMAS, MILLARD, DAVIS, WARREN, BOBACK,

ELLIS, RABB, BAKER, PICKETT, SCHLOSSBERG, V. BROWN, KORTZ,

C. QUINN, D. COSTA, W. KELLER, PASHINSKI, HILL-EVANS, MILNE,

IRVIN, KAMPF, HEFFLEY, WATSON, SCHWEYER, DeLUCA, KINSEY,

BRADFORD, ROZZI, DONATUCCI, FRANKEL, NEILSON, SANTORA AND

SOLOMON, OCTOBER 13, 2017

AS AMENDED ON SECOND CONSIDERATION, HOUSE OF REPRESENTATIVES,

MARCH 12, 2018

AN ACT

Amending the act of November 29, 2006 (P.L.1463, No.163),

entitled "An act providing for protection from identity

theft, for security freezes, for procedures for access after

imposition and removal of security freezes and for related

matters," further providing for definitions, FOR SECURITY

FREEZE and for fees; providing for credit monitoring and

consumer reports SERVICES; and prohibiting the waiver of

rights; and further providing for civil relief; AND PROVIDING

FOR PROTECTED PERSONS SECURITY FREEZE.

The General Assembly of the Commonwealth of Pennsylvania

hereby enacts as follows:

Section 1. Section 2 of the act of November 29, 2006

(P.L.1463, No.163), known as the Credit Reporting Agency Act, is

amended by adding definitions to read:

Section 2. Definitions.

The following words and phrases when used in this act shall

have the meanings given to them in this section unless the

context clearly indicates otherwise:

"Breach of the security of the system." The loss,

<--

unauthorized access, acquisition or use of unencrypted data,

encrypted data, the confidential process or key, that is capable

of compromising the security or confidentiality of personal

information maintained by the entity as part of a database of

personal information regarding multiple individuals. The term

does not include good faith acquisition of personal information

by an employee or agent of the entity for the purposes of the

entity if the personal information is not used for a purpose

other than the lawful purpose of the entity and is not subject

to further unauthorized disclosure.

* * *

"Credit monitoring." The process of periodically reviewing a

consumer report by a consumer for accuracy and changes that

could be indicative of fraudulent activity.

* * *

THE UNAUTHORIZED ACCESS AND ACQUISITION OF UNENCRYPTED DATA,

OR ENCRYPTED DATA WITH THE CONFIDENTIAL PROCESS OR KEY REQUIRED

TO DECRYPT THE DATA, THAT IS LIKELY TO COMPROMISE THE SECURITY

OR CONFIDENTIALITY OF PERSONAL INFORMATION MAINTAINED BY THE

ENTITY AS PART OF A DATABASE OF PERSONAL INFORMATION REGARDING

MULTIPLE INDIVIDUALS AND THAT CAUSES OR THE ENTITY REASONABLY

BELIEVES HAS CAUSED OR WILL CAUSE LOSS OR INJURY TO ANY RESIDENT

OF THIS COMMONWEALTH. GOOD FAITH ACQUISITION OF PERSONAL

INFORMATION BY AN EMPLOYEE OR AGENT OF THE ENTITY FOR THE

PURPOSES OF THE ENTITY IS NOT A BREACH OF THE SECURITY OF THE

SYSTEM IF THE PERSONAL INFORMATION IS NOT USED FOR A PURPOSE

OTHER THAN THE LAWFUL PURPOSE OF THE ENTITY AND IS NOT SUBJECT

TO FURTHER UNAUTHORIZED DISCLOSURE.

"CONSUMER." AN INDIVIDUAL WHO IS NOT A PROTECTED PERSON.

"CONSUMER REPORT." A WRITTEN, ORAL OR OTHER COMMUNICATION OF

20170HB1847PN3129 - 2 -

<--

ANY INFORMATION BY A CONSUMER REPORTING AGENCY BEARING ON A

CONSUMER'S OR PROTECTED PERSON'S CREDITWORTHINESS, CREDIT

STANDING OR CREDIT CAPACITY.

"CONSUMER REPORTING AGENCY." ANY PERSON WHO, FOR MONETARY

FEES, DUES OR ON A COOPERATIVE BASIS, REGULARLY ENGAGES IN WHOLE

OR IN PART IN THE PRACTICE OF ASSEMBLING OR EVALUATING CONSUMER

CREDIT INFORMATION OR OTHER INFORMATION ON CONSUMERS OR

PROTECTED PERSONS FOR THE PURPOSE OF FURNISHING CONSUMER REPORTS

TO THIRD PARTIES.

"CREDIT MONITORING SERVICES." THE PROCESS OF PERIODICALLY

REVIEWING A CONSUMER REPORT FOR ACTIVITY AND CHANGES THAT COULD

BE INDICATIVE OF FRAUDULENT ACTIVITY AND REPORTING THE RESULTS

OF EACH REVIEW TO THE CONSUMER.

"PROTECTED PERSON." AN INDIVIDUAL WHO IS ANY OF THE

FOLLOWING:

(1) NOT EMANCIPATED AND UNDER 16 YEARS OF AGE AT THE

TIME A REQUEST FOR THE PLACEMENT OF A PROTECTED PERSONS

SECURITY FREEZE IS MADE.

(2) AN INCAPACITATED PERSON UNDER 20 PA.C.S. CH. 55

(RELATING TO INCAPACITATED PERSONS).

(3) A PROTECTED PERSON UNDER 20 PA.C.S. CH. 59 (RELATING

TO UNIFORM ADULT GUARDIANSHIP AND PROTECTIVE PROCEEDINGS

JURISDICTION).

"PROTECTED PERSONS SECURITY FREEZE." EITHER OF THE

FOLLOWING:

(1) IF A CONSUMER REPORTING AGENCY DOES NOT HAVE A FILE

PERTAINING TO A PROTECTED PERSON, A RESTRICTION THAT:

(I) IS PLACED ON THE PROTECTED PERSON'S RECORD IN

ACCORDANCE WITH SECTION 10.1.

(II) PROHIBITS THE CONSUMER REPORTING AGENCY FROM

20170HB1847PN3129 - 3 -

RELEASING THE PROTECTED PERSON'S RECORD EXCEPT AS

PROVIDED IN SECTION 10.1.

(2) IF A CONSUMER REPORTING AGENCY HAS A FILE PERTAINING

TO A PROTECTED PERSON, A RESTRICTION THAT:

(I) IS PLACED ON THE PROTECTED PERSON'S CONSUMER

REPORT IN ACCORDANCE WITH SECTION 10.1.

(II) PROHIBITS THE CONSUMER REPORTING AGENCY FROM

RELEASING THE PROTECTED PERSON'S CONSUMER REPORT OR ANY

INFORMATION DERIVED FROM THE PROTECTED PERSON'S CONSUMER

REPORT EXCEPT AS PROVIDED IN SECTION 10.1.

"RECORD." A COMPILATION OF INFORMATION THAT:

(1) IDENTIFIES A PROTECTED PERSON.

(2) IS CREATED BY A CONSUMER REPORTING AGENCY SOLELY FOR

THE PURPOSE OF COMPLYING WITH SECTION 10.1.

(3) MAY NOT BE CREATED OR USED TO CONSIDER THE PROTECTED

PERSON'S CREDIT WORTHINESS, CREDIT STANDING, CREDIT CAPACITY,

CHARACTER, GENERAL REPUTATION, PERSONAL CHARACTERISTICS OR

MODE OF LIVING FOR ANY PURPOSE LISTED IN THE FAIR CREDIT

REPORTING ACT (PUBLIC LAW 91-508, 15 U.S.C. § 1681B).

"REPRESENTATIVE." A PERSON PROVIDING TO A CONSUMER REPORTING

AGENCY SUFFICIENT PROOF OF AUTHORITY TO ACT ON BEHALF OF A

PROTECTED PERSON.

"SECURITY FREEZE." A NOTICE PLACED ON A CONSUMER REPORT, AT

THE REQUEST OF THE CONSUMER AND SUBJECT TO CERTAIN EXCEPTIONS,

THAT PROHIBITS A CONSUMER REPORTING AGENCY FROM RELEASING THE

CONSUMER REPORT WITHOUT THE EXPRESS AUTHORIZATION OF THE

CONSUMER.

"SUFFICIENT PROOF OF AUTHORITY." DOCUMENTATION SHOWING THAT

A REPRESENTATIVE HAS AUTHORITY TO ACT ON BEHALF OF A PROTECTED

PERSON, INCLUDING, BUT NOT LIMITED TO, ANY OF THE FOLLOWING:

20170HB1847PN3129 - 4 -

(1) AN ORDER ISSUED BY A COURT OF LAW.

(2) A LAWFULLY EXECUTED AND VALID POWER OF ATTORNEY.

(3) A WRITTEN AND NOTARIZED STATEMENT SIGNED BY THE

REPRESENTATIVE THAT EXPRESSLY DESCRIBES THE AUTHORITY OF THE

REPRESENTATIVE TO ACT ON BEHALF OF THE PROTECTED PERSON.

"SUFFICIENT PROOF OF IDENTIFICATION." INFORMATION OR

DOCUMENTATION THAT IDENTIFIES A PROTECTED PERSON OR A

REPRESENTATIVE, INCLUDING, BUT NOT LIMITED TO, ANY OF THE

FOLLOWING:

(1) A SOCIAL SECURITY NUMBER OR A COPY OF A SOCIAL

SECURITY CARD ISSUED BY THE SOCIAL SECURITY ADMINISTRATION.

(2) A CERTIFIED OR OFFICIAL COPY OF A BIRTH CERTIFICATE

ISSUED BY THE ENTITY AUTHORIZED TO ISSUE THE BIRTH

CERTIFICATE.

(3) A COPY OF A DRIVER'S LICENSE, AN IDENTIFICATION CARD

ISSUED BY THE DEPARTMENT OF TRANSPORTATION OR ANY OTHER

GOVERNMENT-ISSUED IDENTIFICATION.

(4) A COPY OF A BILL, INCLUDING, BUT NOT LIMITED TO, A

BILL FOR TELEPHONE, SEWER, SEPTIC TANK, WATER, ELECTRIC, OIL

OR NATURAL GAS SERVICES, THAT SHOWS A NAME AND HOME ADDRESS.

Section 2. Section 9(a) of the act is amended to read:

SECTION 2. SECTIONS 3(D) AND 9 OF THE ACT ARE AMENDED TO

READ:

SECTION 3. SECURITY FREEZE.

* * *

(D) DURATION OF FREEZE.--A SECURITY FREEZE SHALL:

(1) REMAIN IN PLACE [UNTIL THE EARLIER OF], EXCEPT AS

PROVIDED UNDER SECTION 7(A); OR

(2) BE REMOVED WITHIN THREE BUSINESS DAYS FROM THE DATE

THE CONSUMER REPORTING AGENCY RECEIVES A REQUEST FROM THE

20170HB1847PN3129 - 5 -

<--

CONSUMER TO REMOVE THE SECURITY FREEZE [OR UNTIL SEVEN YEARS

FROM THE DATE THAT THE SECURITY FREEZE WAS PUT IN PLACE BY

THE CONSUMER REPORTING AGENCY] IN ACCORDANCE WITH THIS ACT.

* * *

Section 9. Fees.

(a) General rule.--

(1) A consumer reporting agency may impose a reasonable

charge on a consumer for initially placing a security freeze

on a consumer report. The amount of the charge may not exceed

[$10] $5. The charge to temporarily lift the security freeze

may not exceed [$10] $5 per request. At no time shall the

consumer be charged for removing the freeze.

(2) A consumer reporting agency who has been affected by

a breach of the security of the system may not impose a

charge on a consumer for placing a security freeze on a

consumer report.

* * *

[(A) GENERAL RULE.--A CONSUMER REPORTING AGENCY MAY IMPOSE A

REASONABLE CHARGE ON A CONSUMER FOR INITIALLY PLACING A SECURITY

FREEZE ON A CONSUMER REPORT. THE AMOUNT OF THE CHARGE MAY NOT

EXCEED $10. THE CHARGE TO TEMPORARILY LIFT THE SECURITY FREEZE

MAY NOT EXCEED $10 PER REQUEST. AT NO TIME SHALL THE CONSUMER BE

CHARGED FOR REMOVING THE FREEZE.

(B) EXCEPTIONS.--

(1) A CONSUMER WILL NOT BE CHARGED BY A CONSUMER

REPORTING AGENCY FOR PLACING A SECURITY FREEZE OR TEMPORARILY

LIFTING A SECURITY FREEZE IF THE CONSUMER IS A VICTIM OF

IDENTITY THEFT AND PROVIDES, OR HAS PROVIDED, THE CONSUMER

REPORTING AGENCY WITH A COPY OF A POLICE REPORT.

(2) A CONSUMER WILL NOT BE CHARGED BY A CONSUMER

20170HB1847PN3129 - 6 -

<--

REPORTING AGENCY FOR PLACING A SECURITY FREEZE IF THE

CONSUMER IS 65 YEARS OF AGE OR OLDER.

PLACE, A CONSUMER REPORTING AGENCY SHALL NOT CHANGE ANY OF THE

FOLLOWING INFORMATION REGARDING A CONSUMER WITHOUT SENDING A

WRITTEN CONFIRMATION OF THE CHANGE TO THE CONSUMER WITHIN 30

DAYS OF THE CHANGE BEING POSTED:

(1) NAME.

(2) DATE OF BIRTH.

(3) SOCIAL SECURITY NUMBER.

(4) ADDRESS.

WRITTEN CONFIRMATION IS NOT REQUIRED FOR TECHNICAL MODIFICATIONS

OF A CONSUMER'S OFFICIAL INFORMATION, INCLUDING NAME AND STREET

ABBREVIATIONS, COMPLETE SPELLINGS OR TRANSPOSITION OF NUMBERS OR

LETTERS. IN THE CASE OF AN ADDRESS CHANGE, THE WRITTEN

CONFIRMATION SHALL BE SENT TO BOTH THE NEW ADDRESS AND TO THE

FORMER ADDRESS.] A CONSUMER REPORTING AGENCY MAY NOT IMPOSE A

CHARGE ON A CONSUMER FOR PLACING OR TEMPORARILY LIFTING A

SECURITY FREEZE ON A CONSUMER REPORT.

Section 3. The act is amended by adding sections to read:

Section 9.1. Credit monitoring and consumer reports SERVICES .

(a) Credit monitoring.-- A consumer reporting agency which

has been affected by a breach of the security of the system

shall provide each consumer affected by the breach of the

security of the system with credit monitoring of the consumer's

consumer report SERVICES at no charge to the consumer for three

years following a breach of the security of the system.

(b) Consumer reports.--A consumer reporting agency which has

been affected by a breach of the security of the system shall

provide each consumer affected by the breach of the security of

20170HB1847PN3129 - 7 -

<--

the system with up to three consumer reports for one calendar

year after the breach is reported at no charge to the consumer.

FOLLOWING THE BREACH OF THE SECURITY OF THE SYSTEM.

Section 9.2. Prohibition.

A consumer reporting agency which has been affected by a

breach of the security of the system may not require a consumer

to waive the consumer's rights UNDER SECTION 9.1 in order to use

the CREDIT MONITORING services provided under section 9.1 .

Section 4. Section 10 of the act is amended to read:

Section 10. Civil relief.

A violation of this act shall be deemed to be an unfair

method of competition and an unfair or deceptive act or practice

in violation of the act of December 17, 1968 (P.L.1224, No.387),

known as the Unfair Trade Practices and Consumer Protection Law.

The Office of Attorney General shall have exclusive authority to

bring an action under the Unfair Trade Practices and Consumer

Protection Law for a violation of this act.

Section 5. This act shall take effect in 60 days.

SECTION 4. THE ACT IS AMENDED BY ADDING A SECTION TO READ:

SECTION 10.1. PROTECTED PERSONS SECURITY FREEZE.

(A) APPLICABILITY.--THE FOLLOWING SHALL APPLY:

(1) NOTWITHSTANDING THE OTHER PROVISIONS OF THIS ACT,

THIS SECTION SHALL APPLY TO PROTECTED PERSONS AND THEIR

REPRESENTATIVES.

(2) THIS SECTION SHALL NOT APPLY TO:

(I) A PERSON OR ENTITY UNDER SECTION 3(E)(1), (6),

(7), (8), (9), (10) OR (12).

(II) A PERSON OR ENTITY THAT MAINTAINS OR IS A

DATABASE USED SOLELY FOR ANY OF THE FOLLOWING:

(A) CRIMINAL RECORD INFORMATION.

20170HB1847PN3129 - 8 -

<--

(B) PERSONAL LOSS HISTORY INFORMATION.

(D) EMPLOYMENT SCREENING.

(E) TENANT SCREENING.

(B) PLACEMENT.--THE FOLLOWING SHALL APPLY:

(1) A CONSUMER REPORTING AGENCY SHALL PLACE A PROTECTED

PERSONS SECURITY FREEZE IF:

(I) THE CONSUMER REPORTING AGENCY RECEIVES A REQUEST

FROM A REPRESENTATIVE FOR THE PLACEMENT OF THE PROTECTED

PERSONS SECURITY FREEZE.

(II) THE REPRESENTATIVE DOES THE FOLLOWING:

(A) SUBMITS THE REQUEST TO THE CONSUMER

REPORTING AGENCY AT THE ADDRESS OR OTHER POINT OF

CONTACT AND IN THE MANNER SPECIFIED BY THE CONSUMER

REPORTING AGENCY.

(B) PROVIDES TO THE CONSUMER REPORTING AGENCY

SUFFICIENT PROOF OF IDENTIFICATION OF THE PROTECTED

PERSON AND THE REPRESENTATIVE.

SUFFICIENT PROOF OF AUTHORITY TO ACT ON BEHALF OF THE

PROTECTED PERSON.

(2) IF A CONSUMER REPORTING AGENCY DOES NOT HAVE A FILE

PERTAINING TO A PROTECTED PERSON WHEN THE CONSUMER REPORTING

AGENCY RECEIVES A REQUEST UNDER PARAGRAPH (1), THE CONSUMER

REPORTING AGENCY SHALL CREATE A RECORD FOR THE PROTECTED

PERSON.

REQUEST THAT MEETS THE REQUIREMENTS UNDER SUBSECTION (B)(1), A

CONSUMER REPORTING AGENCY SHALL PLACE A PROTECTED PERSONS

SECURITY FREEZE.

20170HB1847PN3129 - 9 -

(D) RELEASE OF CONSUMER REPORT PROHIBITED.--UNLESS A

PROTECTED PERSONS SECURITY FREEZE IS REMOVED IN ACCORDANCE WITH

SUBSECTION (F) OR (I), A CONSUMER REPORTING AGENCY MAY NOT

RELEASE THE PROTECTED PERSON'S CONSUMER REPORT, ANY INFORMATION

DERIVED FROM THE PROTECTED PERSON'S CONSUMER REPORT OR ANY

RECORD CREATED FOR THE PROTECTED PERSON.

(E) EFFECTIVE PERIOD.--A PROTECTED PERSONS SECURITY FREEZE

SHALL REMAIN IN EFFECT UNTIL EITHER OF THE FOLLOWING OCCURS:

(1) THE PROTECTED PERSON OR REPRESENTATIVE REQUESTS THE

CONSUMER REPORTING AGENCY TO REMOVE THE SECURITY FREEZE IN

ACCORDANCE WITH SUBSECTION (F).

(2) THE PROTECTED PERSONS SECURITY FREEZE IS REMOVED IN

ACCORDANCE WITH SUBSECTION (I).

(F) REMOVAL.--IF A PROTECTED PERSON OR REPRESENTATIVE WISHES

TO REMOVE A PROTECTED PERSONS SECURITY FREEZE, THE PROTECTED

PERSON OR REPRESENTATIVE SHALL:

(1) SUBMIT A REQUEST FOR THE REMOVAL OF THE SECURITY

FREEZE TO THE CONSUMER REPORTING AGENCY AT THE ADDRESS OR

OTHER POINT OF CONTACT AND IN THE MANNER SPECIFIED BY THE

CONSUMER REPORTING AGENCY.

(2) PROVIDE THE FOLLOWING TO THE CONSUMER REPORTING

AGENCY:

(I) IN THE CASE OF A REQUEST BY THE PROTECTED

PERSON:

(A) PROOF THAT THE SUFFICIENT PROOF OF AUTHORITY

FOR THE REPRESENTATIVE TO ACT ON BEHALF OF THE

PROTECTED PERSON IS NO LONGER VALID.

(B) SUFFICIENT PROOF OF IDENTIFICATION OF THE

PROTECTED PERSON.

(II) IN THE CASE OF A REQUEST BY A REPRESENTATIVE:

20170HB1847PN3129 - 10 -

(A) SUFFICIENT PROOF OF IDENTIFICATION OF THE

PROTECTED PERSON AND REPRESENTATIVE.

(B) SUFFICIENT PROOF OF AUTHORITY TO ACT ON

BEHALF OF THE PROTECTED PERSON.

(G) TIMING OF REMOVAL.--WITHIN 30 DAYS AFTER RECEIVING A

REQUEST THAT MEETS THE REQUIREMENTS OF SUBSECTION (F), THE

CONSUMER REPORTING AGENCY SHALL REMOVE THE PROTECTED PERSONS

SECURITY FREEZE.

(H) NOTICE.--ANY TIME THAT A CONSUMER IS ENTITLED TO RECEIVE

A SUMMARY OF RIGHTS UNDER THE FAIR CREDIT REPORTING ACT (PUBLIC

LAW 91-508, 15 U.S.C. § 1681G(C)), THE FOLLOWING NOTICE SHALL BE

INCLUDED:

PARENTS, GUARDIANS OR CUSTODIANS OF A MINOR CHILD UNDER

16 YEARS OF AGE, GUARDIANS OF AN INCAPACITATED PERSON

UNDER STATE LAW AND GUARDIANS OF A PROTECTED PERSON UNDER

STATE LAW HAVE A RIGHT TO HAVE A RECORD CREATED WITH

CERTAIN CONSUMER REPORTING AGENCIES, MORE COMMONLY KNOWN

AS CREDIT BUREAUS, TO PREVENT THE CREATION OF A CREDIT

REPORT FOR A PROTECTED PERSON AS DEFINED UNDER THE ACT.

TO PLACE OR REMOVE A RECORD, YOU SHOULD CONTACT A

CONSUMER REPORTING AGENCY AT THE CONTACT POINT PROVIDED

FOR THESE REQUESTS. A CONSUMER REPORTING AGENCY MAY NOT

CHARGE A FEE FOR THE PLACEMENT AND REMOVAL OF A RECORD.

(I) EFFECT OF MATERIAL MISREPRESENTATION OF FACT.--A

CONSUMER REPORTING AGENCY MAY REMOVE A PROTECTED PERSONS

SECURITY FREEZE OR DELETE A RECORD OF A PROTECTED PERSON IF THE

PROTECTED PERSONS SECURITY FREEZE WAS PLACED OR THE RECORD WAS

CREATED BASED ON A MATERIAL MISREPRESENTATION OF FACT BY THE

PROTECTED PERSON OR REPRESENTATIVE.

(J) REMEDY FOR VIOLATION OF SECTION.--A CONSUMER REPORTING

20170HB1847PN3129 - 11 -

AGENCY'S SOLE LIABILITY IS FOR ACTUAL DAMAGES AS A RESULT OF A

VIOLATION OF THIS SECTION.

SECTION 5. THIS ACT SHALL TAKE EFFECT AS FOLLOWS:

(1) THE ADDITION OF SECTION 10.1 OF THE ACT SHALL TAKE

EFFECT JANUARY 1, 2018, OR IMMEDIATELY, WHICHEVER IS LATER.

(2) THIS SECTION SHALL TAKE EFFECT IMMEDIATELY.

(3) THE REMAINDER OF THIS ACT SHALL TAKE EFFECT IN 60

DAYS.

20170HB1847PN3129 - 12 -