PRINTER'S NO. 501
THE GENERAL ASSEMBLY OF PENNSYLVANIA
HOUSE BILL
No.
452
Session of
2015
INTRODUCED BY SCHLOSSBERG, KORTZ, SCHWEYER, GRELL, FREEMAN,
READSHAW, D. COSTA, V. BROWN, KINSEY, WHEATLEY, THOMAS,
COHEN, BROWNLEE, CALTAGIRONE, MACKENZIE, MURT, FRANKEL AND
SAMUELSON, FEBRUARY 12, 2015
REFERRED TO COMMITTEE ON CONSUMER AFFAIRS, FEBRUARY 12, 2015
AN ACT
Amending the act of November 29, 2006 (P.L.1463, No.163),
entitled "An act providing for protection from identity
theft, for security freezes, for procedures for access after
imposition and removal of security freezes and for related
matters," further providing for definitions, for security
freeze, for consumer reporting agency, for personal
identification, for temporary access or removal of security
freeze, for secure procedures and for fees; and providing for
construction.
The General Assembly of the Commonwealth of Pennsylvania
hereby enacts as follows:
Section 1. The definitions of "consumer" and "security
freeze" in section 2 of the act of November 29, 2006 (P.L.1463,
No.163), known as the Credit Reporting Agency Act, are amended
and the section is amended by adding definitions to read:
Section 2. Definitions.
The following words and phrases when used in this act shall
have the meanings given to them in this section unless the
context clearly indicates otherwise:
"Consumer." An individual. The term shall not include a
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
protected consumer.
* * *
"Durable power of attorney." As defined in 20 Pa.C.S. Ch. 56
(relating to powers of attorney).
"Protected consumer." An individual who:
(1) is under 18 years of age or has a legal guardian,
agent or conservator appointed; and
(2) has a representative on record with a consumer
credit reporting agency to act on behalf of the individual
with respect to that consumer credit reporting agency.
"Representative." A parent, legal guardian, agent,
conservator or other person who provides a consumer reporting
agency with sufficient proof of authority to act on behalf of a
protected consumer.
"Security freeze." A notice placed on a consumer report, at
the request of the consumer or a representative and subject to
certain exceptions, that prohibits a consumer reporting agency
from releasing the consumer report without the express
authorization of the consumer or the representative.
"Sufficient proof of authority." Proper identification and
other documentation that shows a representative has authority to
act on behalf of a protected consumer, including any of the
following:
(1) An order issued by a court.
(2) A durable power of attorney.
(3) A notarized written statement signed by a
representative that expressly describes the authority of the
representative to act on behalf of the protected consumer.
Section 2. Sections 3, 4, 5, 7, 8 and 9 of the act are
amended to read:
20150HB0452PN0501 - 2 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
Section 3. Security freeze.
(a) Request for freeze.--
(1) A consumer may elect to place a security freeze on
his consumer report by providing proper identification to a
consumer reporting agency. The consumer may make the request
directly to a consumer reporting agency:
(i) by certified mail using an address designated by
the consumer reporting agency; or
(ii) through a secure Internet connection if the
connection is made available by the consumer reporting
agency.
(1.1) A representative may request that a security
freeze be placed on the credit report of the protected
consumer he represents by providing sufficient proof of
authority to the consumer reporting agency. A request for a
security freeze under this paragraph shall be made by a
representative in the same manner as a consumer under
paragraph (1).
(2) Each consumer reporting agency covered by this act
shall have a toll-free telephone number available to allow a
consumer or a representative to receive information about how
to request a security freeze, which the consumer or
representative must return by certified mail.
(3) A consumer reporting agency shall place a security
freeze on a consumer report no later than five business days
after receiving a request for the security freeze from the
consumer or representative.
(4) The following entities are not required to place a
security freeze in a consumer report:
(i) A credit reporting agency that acts only as a
20150HB0452PN0501 - 3 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
reseller of credit information by assembling and merging
information contained in the database of another credit
reporting agency or multiple credit reporting agencies
and does not maintain a permanent database of credit
information from which new credit reports are produced;
however, a credit reporting agency acting as a reseller
shall honor any security freeze placed on a credit report
by another credit reporting agency.
(ii) A check services or fraud prevention services
company which issues reports on incidents of fraud or
authorizations for the purpose of approving or processing
negotiable instruments, electronic funds transfers or
similar methods of payments.
(iii) A deposit account information service company
which issues reports regarding account closures due to
fraud, substantial overdrafts, automated teller machine
(ATM) abuse or similar negative information regarding a
consumer to inquiring banks or other financial
institutions for use only in reviewing a consumer request
for a deposit account at the inquiring bank or financial
institution.
(b) Effect of security freeze.--Except as provided in
subsection (e), when a security freeze is in place, information
from a consumer report shall not be released to a third party
without prior express authorization from the consumer or a
representative. This subsection shall not prevent a consumer
reporting agency from advising a third party that a security
freeze is in effect with respect to a consumer report.
(c) Third-party request.--If a third party requests access
to a consumer report on which a security freeze is in effect and
20150HB0452PN0501 - 4 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
the consumer or representative does not allow [his or her] the
consumer report to be accessed for that specific party or for a
period of time, the third party shall treat the application as
incomplete.
(d) Duration of freeze.--A security freeze shall remain in
place until the earlier of the date the consumer reporting
agency receives a request from the consumer or a representative
acting on behalf of a protected consumer to remove the security
freeze or until seven years from the date that the security
freeze was put in place by the consumer reporting agency.
(e) Applicability of freeze.--Notwithstanding a security
freeze, the following entities may receive a consumer report:
(1) A Federal, State or local government entity,
including a law enforcement agency or court, or their agents
or assigns.
(2) A private collection agency for the sole purpose of
assisting in the collection of an existing debt of the
consumer or protected consumer who is the subject of the
consumer report requested.
(3) A person or entity or a subsidiary, affiliate or
agent of that person or entity, or an assignee of a financial
obligation owed by the consumer or protected consumer to that
person or entity, or a prospective assignee of a financial
obligation owed by the consumer or protected consumer to that
person or entity in conjunction with the proposed purchase of
the financial obligation, with which the consumer or
protected consumer has or had prior to assignment an account
or contract, including a demand deposit account, or to whom
the consumer or protected consumer issued a negotiable
instrument, for the purposes of reviewing the account or
20150HB0452PN0501 - 5 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
collecting the financial obligation owing for the account,
contract or negotiable instrument. For purposes of this
paragraph, "reviewing the account" includes activities
related to account maintenance, monitoring, credit line
increases and account upgrades and enhancements.
(4) A subsidiary, affiliate, agent, assignee or
prospective assignee of a person to whom access has been
granted under this section for the purposes of facilitating
the extension of credit.
(5) A person, for the purposes of prescreening as
provided by the Fair Credit Reporting Act (Public Law 91-508,
15 U.S.C. § 1681 et seq.).
(6) A consumer reporting agency for the purposes of
providing a consumer with a copy of his own consumer report
on his request or providing a representative a copy of the
protected consumer's credit report at the request of the
representative.
(7) A child support enforcement agency.
(8) A consumer reporting agency that acts only as a
reseller of credit information by assembling and merging
information contained in the database of another consumer
reporting agency or multiple consumer reporting agencies and
does not maintain a permanent database of credit information
from which new consumer reports are produced. However, a
consumer reporting agency acting as a reseller shall honor
any security freeze placed on a consumer report by another
consumer reporting agency.
(9) A check services or fraud prevention services
company which issues reports on incidents of fraud or
authorizations for the purpose of approving or processing
20150HB0452PN0501 - 6 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
negotiable instruments, electronic funds transfers or similar
methods of payments.
(10) A deposit account information service company which
issues reports regarding account closures due to fraud,
substantial overdrafts, automated teller machine (ATM) abuse
or similar negative information regarding a consumer to
inquiring banks or other financial institutions for use only
in reviewing a consumer or representative request for a
deposit account at the inquiring bank or financial
institution.
(11) Any person or entity for use in setting or
adjusting a rate, issuing or underwriting a policy, adjusting
a claim or servicing a policy for underwriting for property
and casualty insurance purposes.
(12) A person or entity administering a credit file
monitoring subscription service or similar service to which
the consumer or representative has subscribed.
Section 4. Consumer reporting agency.
(a) Duties.--The consumer reporting agency shall[, no]:
(1) No later than ten business days after the date the
agency receives a request from a consumer or representative
for a security freeze, send the consumer or representative a
written confirmation that provides the consumer or
representative with a unique personal identification number
or password to be used by the consumer or representative when
providing authorization for the access to [his] the consumer
report for a specific period of time or for a specific third
party or removing the security freeze. [In addition, the
consumer reporting agency shall simultaneously]
(2) Simultaneously provide to the consumer or
20150HB0452PN0501 - 7 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
representative in writing notification of the process of
removing a security freeze and the process of temporarily
lifting a security freeze and the process for allowing access
to information from the consumer report for a specific party
or for a specific period while the security freeze is in
effect.
(b) Temporary lifting prohibited.--Notwithstanding
subsection (a) or any other provisions of this act, a security
freeze which is in effect under section 3(a)(1.1) may not be
temporarily lifted.
Section 5. Personal identification.
A consumer or representative may request in writing a
replacement personal identification number or password. The
request must comply with the requirements for requesting a
security freeze under section 3. The consumer reporting agency
shall, no later than ten business days after the date the agency
receives the request for a replacement personal identification
number or password, provide the consumer or representative with
a new, unique personal identification number or password to be
used by the consumer or representative instead of the number or
password that was provided under section 4.
Section 7. Temporary access or removal of security freeze.
(a) Request.--[If] Except as provided in section 4, if the
consumer or representative wishes to allow his consumer report
or, in the case of a representative, the consumer report of a
protected consumer to be accessed for a specific period of time
or by a specific third party while a security freeze is in place
or to remove a security freeze, he shall be able to contact the
consumer reporting agency by certified mail or by a toll-free
telephone number which shall be provided by the consumer
20150HB0452PN0501 - 8 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
reporting agency and may be able to contact the consumer
reporting agency through a secure Internet connection which may
be established by the consumer reporting agency and request that
the security freeze be temporarily lifted or removed and provide
all of the following:
(1) Proper identification.
(2) The unique personal identification number or
password provided by the consumer reporting agency pursuant
to this act.
(3) One of the following:
(i) The proper information regarding the time period
for which the consumer report shall be available to any
person.
(ii) The proper information regarding the third
party who is to receive the consumer report.
(iii) A request that the security freeze be removed.
(4) If a representative, sufficient proof of
authority.
(b) Agency requirement.--A consumer reporting agency that
receives a request from a consumer or representative pursuant to
subsection (a) shall comply with the request no later than three
business days after receiving the request.
(c) Removal of security freeze.--[A] Except as provided in
section 4, a consumer reporting agency shall temporarily lift or
remove a security freeze placed on a consumer report only in the
following cases:
(1) Upon the consumer's or representative's request as
provided for in this section.
(2) If the consumer report was frozen due to a material
misrepresentation of fact by the consumer, representative or
20150HB0452PN0501 - 9 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
other person. If a consumer reporting agency intends to
remove a freeze upon a consumer report pursuant to this
paragraph, the consumer reporting agency shall notify the
consumer or representative in writing prior to removing the
freeze on the consumer report.
Section 8. Secure procedures.
In addition to the requirements of this act, a consumer
reporting agency may develop secure procedures, including, but
not limited to, the use of the telephone, facsimile, Internet or
other electronic media, to receive and process a request from a
consumer or representative to place a security freeze,
temporarily lift a security freeze or remove a security freeze
on a consumer report pursuant to this act in an expedited
manner.
Section 9. Fees.
(a) General rule.--A consumer reporting agency may impose a
reasonable charge on a consumer or representative for initially
placing a security freeze on a consumer report. The amount of
the charge may not exceed $10. The charge to temporarily lift
the security freeze may not exceed $10 per request. At no time
shall the consumer or representative be charged for removing the
freeze.
(b) Exceptions.--
(1) A consumer or representative will not be charged by
a consumer reporting agency for placing a security freeze or
temporarily lifting a security freeze if the consumer or
protected consumer is a victim of identity theft and
provides, or has provided, the consumer reporting agency with
a copy of a police report.
(2) A consumer or representative will not be charged by
20150HB0452PN0501 - 10 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
a consumer reporting agency for placing a security freeze if
the consumer is 65 years of age or older or a protected
consumer.
(c) Confirmation required.--If a security freeze is in
place, a consumer reporting agency shall not change any of the
following information regarding a consumer or protected consumer
without sending a written confirmation of the change to the
consumer or representative within 30 days of the change being
posted:
(1) Name.
(2) Date of birth.
(3) Social Security number.
(4) Address.
Written confirmation is not required for technical modifications
of a consumer's or protected consumer's official information,
including name and street abbreviations, complete spellings or
transposition of numbers or letters. In the case of an address
change, the written confirmation shall be sent to both the new
address and to the former address.
Section 3. The act is amended by adding a section to read:
Section 9.1. Construction.
Nothing in this act shall be construed to authorize or
otherwise require a consumer reporting agency to provide a
personal identification number, password or other similar device
to a protected consumer for the purpose of:
(1) releasing any information to the protected consumer;
(2) providing authorization for access to a protected
consumer's consumer report;
(3) providing third-party access to a protected
consumer's consumer report; or
20150HB0452PN0501 - 11 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(4) removing a security freeze.
Section 4. This act shall take effect in 60 days.
20150HB0452PN0501 - 12 -
1
2