1Amending the act of November 29, 2006 (P.L.1463, No.163),
2entitled "An act providing for protection from identity
3theft, for security freezes, for procedures for access after
4imposition and removal of security freezes and for related
5matters," providing for findings and intent; and further
6providing for definitions, for security freeze, for consumer
7reporting agency, for temporary access or removal of security
8freeze and for fees.

9The General Assembly of the Commonwealth of Pennsylvania
10hereby enacts as follows:

11Section 1. The act of November 29, 2006 (P.L.1463, No.163),
12known as the Credit Reporting Agency Act, is amended by adding a
13section to read:

14Section 1.1. Findings and intent.

15(a) Findings.--The General Assembly finds and declares as
16follows:

17(1) According to the United States Department of
18Justice:

19(i) In 2010, 8.6 million households in the United
20States had at least one member 12 years of age or older

1who had been victimized by identity theft.

2(ii) In 2010, households in the United States
3experienced approximately $13.3 billion in direct
4financial loss as a result of identity theft.

5(iii) The number of households experiencing the
6misuse of credit cards rose from 3.6 million households
7in 2005 to 5.5 million households in 2010.

8(2) According to the Federal Trade Commission:

9(i) Identity thieves often steal a child's
10information from schools, businesses and government
11agencies.

12(ii) A minimum of 142,000 cases of identity theft
13against children can be identified each year.

14(iii) Of 40,000 children enrolled in an identity
15protection service, over 10% had loans, property, utility
16and other accounts associated with their Social Security
17numbers.

18(iv) Controlling and limiting access to a child's
19information is one of the best ways to protect children
20from identity theft.

21(b) Intent.--It is the intention of the General Assembly to
22protect the financial security and general welfare of the
23citizens of this Commonwealth by providing a mechanism to allow
24citizens to combat identity theft which might be committed
25against them or their children. The General Assembly further
26intends to permit citizens to limit and control access to their
27own personal information and that of their children by
28permitting consumer reporting agencies to place security freezes
29on the credit reports of adults and children.

30Section 2. Sections 2, 3(a), (b), (c) and (d), 4, 7(a) and 9

1of the act are amended to read:

2Section 2. Definitions.

3The following words and phrases when used in this act shall
4have the meanings given to them in this section unless the
5context clearly indicates otherwise:

6"Child." An individual who is under 18 years of age.

7"Consumer." An individual[.], including a child. The term 
8also includes a parent or guardian who makes a request for a 
9security freeze on a consumer report of a child.

10"Consumer report." A written, oral or other communication of
11any information by a consumer reporting agency bearing on a
12consumer's creditworthiness, credit standing or credit capacity.

13"Consumer reporting agency." Any person who, for monetary
14fees, dues or on a cooperative basis, regularly engages in whole
15or in part in the practice of assembling or evaluating consumer
16credit information or other information on consumers for the
17purpose of furnishing consumer reports to third parties.

18"Parent." Includes an adoptive parent.

19"Proper identification." Any of the following:

20(1) An order issued by a court of this Commonwealth.

21(2) A lawfully executed and valid power of attorney.

22(3) A copy of a Social Security card issued by the
23Social Security Administration.

24(4) A certified or official copy of a birth certificate
25issued by an entity authorized to issue the birth
26certificate.

27(5) A copy of a driver's license or another government-
28issued identification.

29(6) Any other document deemed acceptable by a consumer
30reporting agency.

1"Security freeze." A notice placed on a consumer report, at
2the request of the consumer and subject to certain exceptions,
3that prohibits a consumer reporting agency from releasing the
4consumer report without the express authorization of the
5consumer.

6Section 3. Security freeze.

7(a) Request for freeze.--

8[(1) A consumer may elect to place a security freeze on
9his consumer report by providing proper identification to a
10consumer reporting agency. The consumer may make the request
11directly to a consumer reporting agency:

12(i) by certified mail using an address designated by
13the consumer reporting agency; or

14(ii) through a secure Internet connection if the
15connection is made available by the consumer reporting
16agency.]

17(1) The following apply:

18(i) A consumer may elect to place a security freeze
19on:

20(A) the consumer report of the consumer; or

21(B) the consumer report of the consumer's child.

22(ii) In order to place a freeze on a consumer
23report, the consumer must provide proper identification
24to a consumer reporting agency. The consumer may make the
25request directly to a consumer reporting agency:

26(A) by certified mail using an address
27designated by the consumer reporting agency; or

28(B) through a secure Internet connection if the
29connection is made available by the consumer
30reporting agency.

1(2) Each consumer reporting agency covered by this act
2shall have a toll-free telephone number available to allow a
3consumer to receive information about how to request a
4security freeze, which the consumer must return by certified
5mail.

6(3) A consumer reporting agency shall place a security
7freeze on a consumer report no later than five business days
8after receiving a request for the security freeze from the
9consumer.

10(4) The following entities are not required to place a
11security freeze in a consumer report:

12(i) A credit reporting agency that acts only as a
13reseller of credit information by assembling and merging
14information contained in the database of another credit
15reporting agency or multiple credit reporting agencies
16and does not maintain a permanent database of credit
17information from which new credit reports are produced;
18however, a credit reporting agency acting as a reseller
19shall honor any security freeze placed on a credit report
20by another credit reporting agency.

21(ii) A check services or fraud prevention services
22company which issues reports on incidents of fraud or
23authorizations for the purpose of approving or processing
24negotiable instruments, electronic funds transfers or
25similar methods of payments.

26(iii) A deposit account information service company
27which issues reports regarding account closures due to
28fraud, substantial overdrafts, automated teller machine
29(ATM) abuse or similar negative information regarding a
30consumer to inquiring banks or other financial

1institutions for use only in reviewing a consumer request
2for a deposit account at the inquiring bank or financial
3institution.

4(b) Effect of security freeze.--Except as provided in
5subsection (e), when a security freeze is in place, information
6from a consumer report shall not be released to a third party
7without prior express authorization from the consumer or the 
8consumer's parent or guardian in the case of a consumer who is a 
9child. This subsection shall not prevent a consumer reporting
10agency from advising a third party that a security freeze is in
11effect with respect to a consumer report.

12(c) Third-party request.--If a third party requests access
13to a consumer report on which a security freeze is in effect and
14the consumer does not allow his [or her] consumer report or the 
15consumer report of a child to be accessed for that specific
16party or for a period of time, the third party shall treat the
17application as incomplete.

18(d) Duration of freeze.--[A security freeze shall remain in
19place until the earlier of the date the consumer reporting
20agency receives a request from the consumer to remove the
21security freeze or until seven years from the date that the
22security freeze was put in place by the consumer reporting
23agency.] The following apply:

24(1) A security freeze shall remain in place until the
25earlier of the date the consumer reporting agency receives a
26request from the consumer to remove the security freeze or
27until seven years from the date that the security freeze was
28put in place by the consumer reporting agency.

29(2) There shall be no limit on the number of security
30freezes which a consumer may request on the consumer's behalf

1or on behalf of the consumer's child.

2(3) A security freeze placed on the consumer report of a
3child shall expire on the child's 18th birthday. The child
4may request a security freeze on the child's own behalf when
5the child is at least 18 years of age.

6* * *

7Section 4. Consumer reporting agency.

8The consumer reporting agency shall, no later than ten
9business days after the date the agency receives a request from
10a consumer [for] to place a security freeze on the consumer 
11report of the consumer or the consumer report of a child, send
12the consumer a written confirmation that provides the consumer
13with a unique personal identification number or password to be
14used by the consumer when providing authorization for the access
15to his consumer report or the consumer report of a child for a
16specific period of time or for a specific third party or
17removing the security freeze. In addition, the consumer
18reporting agency shall simultaneously provide to the consumer in
19writing notification of the process of removing a security
20freeze and the process of temporarily lifting a security freeze
21and the process for allowing access to information from the
22consumer report for a specific party or for a specific period
23while the security freeze is in effect.

24Section 7. Temporary access or removal of security freeze.

25(a) Request.--If the consumer wishes to allow his consumer
26report or the consumer report of a child to be accessed for a
27specific period of time or by a specific third party while a
28security freeze is in place or to remove a security freeze, he
29shall be able to contact the consumer reporting agency by
30certified mail or by a toll-free telephone number which shall be

1provided by the consumer reporting agency and may be able to
2contact the consumer reporting agency through a secure Internet
3connection which may be established by the consumer reporting
4agency and request that the security freeze be temporarily
5lifted or removed and provide all of the following:

6(1) Proper identification.

7(2) The unique personal identification number or
8password provided by the consumer reporting agency pursuant
9to this act.

10(3) One of the following:

11(i) The proper information regarding the time period
12for which the consumer report shall be available to any
13person.

14(ii) The proper information regarding the third
15party who is to receive the consumer report.

16(iii) A request that the security freeze be removed.

17* * *

18Section 9. Fees.

19(a) General rule.--[A consumer reporting agency may impose a
20reasonable charge on a consumer for initially placing a security
21freeze on a consumer report. The amount of the charge may not
22exceed $10. The charge to temporarily lift the security freeze
23may not exceed $10 per request. At no time shall the consumer be
24charged for removing the freeze.] Subject to subsection (b), the 
25following apply:

26(1) A consumer reporting agency may impose a reasonable
27charge to initially place a security freeze on a consumer
28report or to temporarily lift the security freeze on a
29consumer report.

30(2) In the case of a security freeze placed on a

1consumer report of a consumer who is at least 18 years of
2age, the amount of the charge to initially place or
3temporarily lift the freeze may not exceed $10.

4(3) In the case of a security freeze placed on a
5consumer report of a child, the amount of the charge to
6initially place or temporarily lift the freeze may not exceed
7$5.

8(4) A consumer reporting agency may charge a fee for
9each request to temporarily lift the freeze.

10(5) At no time shall the consumer be charged for
11removing the security freeze.

12(b) Exceptions.--

13(1) A consumer [will] may not be charged by a consumer
14reporting agency for placing a security freeze or temporarily
15lifting a security freeze if the consumer or the consumer's 
16child is a victim of identity theft and provides, or has
17provided, the consumer reporting agency with a copy of a
18police report.

19(2) A consumer [will] may not be charged by a consumer
20reporting agency for placing a security freeze if the
21consumer is 65 years of age or older.

22(c) Confirmation required.--If a security freeze is in
23place, a consumer reporting agency shall not change any of the
24following information regarding a consumer without sending a
25written confirmation of the change to the consumer or the 
26consumer's parent or guardian, in the case of a consumer who is 
27a child, within 30 days of the change being posted:

28(1) Name.

29(2) Date of birth.

30(3) Social Security number.

1(4) Address.

2Written confirmation is not required for technical modifications
3of a consumer's official information, including name and street
4abbreviations, complete spellings or transposition of numbers or
5letters. In the case of an address change, the written
6confirmation shall be sent to both the new address and to the
7former address.

8Section 3. This act shall take effect in 60 days.