PRIOR PRINTER'S NOS. 251, 1886 PRINTER'S NO. 1959
No. 180 Session of 2005
INTRODUCED BY CORMAN, WONDERLING, GREENLEAF, M. WHITE, KASUNIC,
RHOADES, TARTAGLIONE, KITCHEN, MUSTO, O'PAKE, COSTA,
D. WHITE, STACK, ORIE, RAFFERTY, ARMSTRONG AND VANCE,
FEBRUARY 11, 2005
SENATOR WENGER, APPROPRIATIONS, RE-REPORTED AS AMENDED,
JUNE 28, 2006
AN ACT
1 Providing for protection from identity theft, for security
2 alerts and freezes, for procedures for access after <--
3 imposition and removal of security freezes and for related
4 matters.
5 The General Assembly of the Commonwealth of Pennsylvania
6 hereby enacts as follows:
7 Section 1. Short title.
8 This act shall be known and may be cited as the Credit
9 Reporting Agency Law.
10 Section 2. Definitions.
11 The following words and phrases when used in this act shall
12 have the meanings given to them in this section unless the
13 context clearly indicates otherwise:
14 "Consumer." An individual.
15 "Consumer report." A written, oral or other communication of
16 any information by a consumer reporting agency bearing on a
17 consumer's creditworthiness, credit standing or credit capacity.
1 "Consumer reporting agency." Any person who, for monetary
2 fees, dues or on a cooperative basis, regularly engages in whole
3 or in part in the practice of assembling or evaluating consumer
4 credit information or other information on consumers for the
5 purpose of furnishing consumer reports to third parties.
6 "Security freeze." A notice placed on a consumer report, at
7 the request of the consumer and subject to certain exceptions,
8 that prohibits a consumer reporting agency from releasing the
9 consumer report without the express authorization of the
10 consumer.
11 Section 3. Security freeze.
12 (a) Request for freeze.--
13 (1) A consumer may elect to place a security freeze on
14 his consumer report by written request, sent by certified <--
15 mail, that includes clear and proper identification, to a
16 consumer reporting agency. A consumer reporting agency shall
17 PROVIDING CLEAR AND PROPER IDENTIFICATION TO A CONSUMER <--
18 REPORTING AGENCY. THE CONSUMER MAY MAKE THE REQUEST:
19 (I) BY CERTIFIED MAIL; OR
20 (II) DIRECTLY TO THE CONSUMER REPORTING AGENCY
21 THROUGH A SECURE INTERNET CONNECTION IF THE CONNECTION IS
22 MADE AVAILABLE BY THE CONSUMER REPORTING AGENCY.
23 (2) EACH CONSUMER REPORTING AGENCY COVERED BY THIS ACT
24 SHALL HAVE A TOLL-FREE TELEPHONE NUMBER AVAILABLE TO ALLOW A
25 CONSUMER TO REQUEST AN APPROPRIATE FORM TO REQUEST A SECURITY
26 FREEZE, WHICH THE CONSUMER MUST RETURN BY CERTIFIED MAIL.
27 (3) A CONSUMER REPORTING AGENCY SHALL place a security
28 freeze on a consumer report no later than five business days
29 after receiving a written request for the security freeze from <--
30 the consumer.
20050S0180B1959 - 2 -
1 (2) (4) The following entities are not required to place <--
2 a security freeze in a consumer report:
3 (i) A credit reporting agency that acts only as a
4 reseller of credit information by assembling and merging
5 information contained in the database of another credit
6 reporting agency or multiple credit reporting agencies
7 and does not maintain a permanent database of credit
8 information from which new credit reports are produced,
9 however, a credit reporting agency acting as a reseller
10 shall honor any security freeze placed on a credit report
11 by another credit reporting agency.
12 (ii) A check services or fraud prevention services
13 company which issues reports on incidents of fraud or
14 authorizations for the purpose of approving or processing
15 negotiable instruments, electronic funds transfers or
16 similar methods of payments.
17 (iii) A deposit account information service company
18 which issues reports regarding account closures due to
19 fraud, substantial overdrafts, automated teller machine
20 (ATM) abuse or similar negative information regarding a
21 consumer to inquiring banks or other financial
22 institutions for use only in reviewing a consumer request
23 for a deposit account at the inquiring bank or financial
24 institution.
25 (b) Effect of security freeze.--Except as provided in
26 subsection (e), when a security freeze is in place, information
27 from a consumer report shall not be released to a third party
28 without prior express authorization from the consumer. This
29 subsection shall not prevent a consumer reporting agency from
30 advising a third party that a security freeze is in effect with
20050S0180B1959 - 3 -
1 respect to a consumer report.
2 (c) Third-party request.--If a third party requests access
3 to a consumer report on which a security freeze is in effect,
4 and the consumer does not allow his or her consumer report to be
5 accessed for that specific party or for a period of time, the
6 third party shall treat the application as incomplete.
7 (d) Duration of freeze.--A security freeze shall remain in
8 place until the consumer requests that the security freeze be
9 removed under section 7.
10 (e) Applicability of freeze.--A security freeze does not
11 apply to a consumer report provided to:
12 (1) A Federal, State or local government entity,
13 including a law enforcement agency or court, or their agents
14 or assigns.
15 (2) A private collection agency for the sole purpose of
16 assisting in the collection of an existing debt of the
17 consumer who is the subject of the consumer report requested.
18 (3) A person or entity or a subsidiary, affiliate or
19 agent of that person or entity, or an assignee of a financial
20 obligation owed by the consumer to that person or entity, or
21 a prospective assignee of a financial obligation owed by the
22 consumer to that person or entity in conjunction with the
23 proposed purchase of the financial obligation, with which the
24 consumer has or had prior to assignment an account or
25 contract, including a demand deposit account, or to whom the
26 consumer issued a negotiable instrument, for the purposes of
27 reviewing the account or collecting the financial obligation
28 owing for the account, contract or negotiable instrument. For
29 purposes of this paragraph, "reviewing the account" includes
30 activities related to account maintenance, monitoring, credit
20050S0180B1959 - 4 -
1 line increases and account upgrades and enhancements.
2 (4) A subsidiary, affiliate, agent, assignee or
3 prospective assignee of a person to whom access has been
4 granted under this section for the purposes of facilitating
5 the extension of credit.
6 (5) A person, for the purposes of prescreening as
7 provided by the Fair Credit Reporting Act (Public Law 91-508,
8 15 U.S.C. § 1681 et seq.).
9 (6) A consumer reporting agency for the purposes of
10 providing a consumer with a copy of his own consumer report
11 on his request.
12 (7) A child support enforcement agency.
13 (8) A consumer reporting agency that acts only as a
14 reseller of credit information by assembling and merging
15 information contained in the database of another consumer
16 reporting agency or multiple consumer reporting agencies and
17 does not maintain a permanent database of credit information
18 from which new consumer reports are produced. However, a
19 consumer reporting agency acting as a reseller shall honor
20 any security freeze placed on a consumer report by another
21 consumer reporting agency.
22 (9) A check services or fraud prevention services
23 company which issues reports on incidents of fraud or
24 authorizations for the purpose of approving or processing
25 negotiable instruments, electronic funds transfers or similar
26 methods of payments.
27 (10) A deposit account information service company which
28 issues reports regarding account closures due to fraud,
29 substantial overdrafts, automated teller machine (ATM) abuse
30 or similar negative information regarding a consumer to
20050S0180B1959 - 5 -
1 inquiring banks or other financial institutions for use only
2 in reviewing a consumer request for a deposit account at the
3 inquiring bank or financial institution.
4 (11) Any person or entity for use in setting or
5 adjusting a rate, issuing or underwriting a policy, adjusting
6 a claim or servicing a policy for underwriting for property
7 and casualty insurance purposes.
8 (12) A person or entity administering a credit file
9 monitoring subscription service or similar service to which
10 the consumer has subscribed.
11 Section 4. Consumer reporting agency.
12 The consumer reporting agency shall, no later than ten
13 business days after the date the agency receives a request from
14 a consumer for a security freeze, send the consumer a written
15 confirmation that provides the consumer with a unique personal
16 identification number or password to be used by the consumer
17 when providing authorization for the access to his consumer
18 report for a specific period of time or for a specific third
19 party or removing the security freeze. In addition, the consumer
20 reporting agency shall simultaneously provide to the consumer in
21 writing notification of the process of removing a security
22 freeze and the process of temporarily lifting a security freeze
23 and the process for allowing access to information from the
24 consumer report for a specific party or for a specific period
25 while the security freeze is in effect.
26 Section 5. Personal identification.
27 A consumer may request in writing a replacement personal
28 identification number or password. The request must comply with
29 the requirements for requesting a security freeze under section
30 3. The consumer reporting agency shall, no later than ten
20050S0180B1959 - 6 -
1 business days after the date the agency receives the request for
2 a replacement personal identification number or password,
3 provide the consumer with a new, unique personal identification
4 number or password to be used by the consumer instead of the
5 number or password that was provided under section 4.
6 Section 6. Notification of freeze.
7 A consumer reporting agency shall notify a person who
8 requests a consumer report if a security freeze is in effect for
9 the consumer report requested.
10 Section 7. Temporary access or removal of security freeze.
11 (a) Request.--If the consumer wishes to allow his consumer
12 report to be accessed for a specific period of time or by a
13 specific third party while a SECURITY freeze is in place or to <--
14 remove a security freeze he shall BE ABLE TO contact the <--
15 consumer reporting agency by certified mail OR BY A TOLL-FREE <--
16 TELEPHONE NUMBER WHICH SHALL BE PROVIDED BY THE CONSUMER
17 REPORTING AGENCY AND MAY BE ABLE TO CONTACT THE CONSUMER
18 REPORTING AGENCY THROUGH A SECURE INTERNET CONNECTION WHICH MAY
19 BE ESTABLISHED BY THE CONSUMER REPORTING AGENCY and request that
20 the SECURITY freeze be temporarily lifted or removed and provide <--
21 all of the following:
22 (1) Clear and proper identification.
23 (2) The unique personal identification number or
24 password provided by the consumer reporting agency pursuant
25 to this act.
26 (3) One of the following:
27 (i) The proper information regarding the time period
28 for which the consumer report shall be available to any
29 person.
30 (ii) The proper information regarding the third
20050S0180B1959 - 7 -
1 party who is to receive the consumer report.
2 (iii) A request that the security freeze be removed.
3 (b) Agency requirement.--A consumer reporting agency that
4 receives a request from a consumer pursuant to subsection (a)
5 shall comply with the request no later than three business days
6 after receiving the request.
7 (c) Removal of security freeze.--A consumer reporting agency
8 shall temporarily lift or remove a security freeze placed on a
9 consumer report only in the following cases:
10 (1) Upon the consumer's request as provided for in this
11 section.
12 (2) If the consumer report was frozen due to a material
13 misrepresentation of fact by the consumer or other person. If
14 a consumer reporting agency intends to remove a freeze upon a
15 consumer report pursuant to this paragraph, the consumer
16 reporting agency shall notify the consumer in writing prior
17 to removing the freeze on the consumer report.
18 Section 8. Secure procedures.
19 In addition to the requirements of this act, a consumer
20 reporting agency may develop secure procedures, including, but
21 not limited to, the use of the telephone, facsimile, Internet or
22 other electronic media to receive and process a request from a
23 consumer to place a security freeze, temporarily lift a security
24 freeze or remove a security freeze on a consumer report pursuant
25 to this act in an expedited manner.
26 Section 9. Fees.
27 (a) General rule.--A consumer reporting agency may impose a
28 reasonable charge on a consumer for initially placing a security
29 freeze on a consumer report. The amount of the charge may not
30 exceed $10. The charge to temporarily lift the security freeze
20050S0180B1959 - 8 -
1 may not exceed $10 per request. At no time shall the consumer be
2 charged for removing the freeze. An exception shall be allowed <--
3 whereby a consumer will not be charged by the consumer reporting
4 agency for placing a security freeze if any of the following
5 apply:
6 (1) If the consumer is a victim of identity theft and
7 provides the consumer reporting agency with a police report.
8 (2) If the consumer is 62 years of age or older.
9 (B) EXCEPTIONS.-- <--
10 (1) A CONSUMER WILL NOT BE CHARGED BY A CONSUMER
11 REPORTING AGENCY FOR PLACING A SECURITY FREEZE OR TEMPORARILY
12 LIFTING A SECURITY FREEZE IF THE CONSUMER IS A VICTIM OF
13 IDENTITY THEFT AND PROVIDES, OR HAS PROVIDED, THE CONSUMER
14 REPORTING AGENCY WITH A COPY OF A POLICE REPORT.
15 (2) A CONSUMER WILL NOT BE CHARGED BY A CONSUMER
16 REPORTING AGENCY FOR PLACING A SECURITY FREEZE IF THE
17 CONSUMER IS 65 YEARS OF AGE OR OLDER.
18 (b) (C) Confirmation required.--If a security freeze is in <--
19 place, a consumer reporting agency shall not change any of the
20 following information regarding a consumer without sending a
21 written confirmation of the change to the consumer within 30
22 days of the change being posted:
23 (1) Name.
24 (2) Date of birth.
25 (3) Social Security number.
26 (4) Address.
27 Written confirmation is not required for technical modifications
28 of a consumer's official information, including name and street
29 abbreviations, complete spellings or transposition of numbers or
30 letters. In the case of an address change, the written
20050S0180B1959 - 9 -
1 confirmation shall be sent to both the new address and to the
2 former address.
3 Section 10. Civil relief.
4 A violation of this act shall be deemed to be an unfair or
5 deceptive act or practice in violation of the act of December
6 17, 1968 (P.L.1224, No.387), known as the Unfair Trade Practices
7 and Consumer Protection Law. The Office of Attorney General
8 shall have exclusive authority to bring an action under the
9 Unfair Trade Practices and Consumer Protection Law for a
10 violation of this act.
11 Section 11. Effective date.
12 This act shall take effect January 1, 2007.
A12L13RLE/20050S0180B1959 - 10 -