First Regular Session Sixty-fifth General Assembly STATE OF COLORADO INTRODUCED LLS NO. 05-0751.01 Michael Dohr SENATE BILL 05-137 SENATE SPONSORSHIP Grossman HOUSE SPONSORSHIP Paccione, and Frangas Senate Committees House Committees Business, Labor and Technology A BILL FOR AN ACT Concerning identity theft. Bill Summary (Note: This summary applies to this bill as introduced and does not necessarily reflect any amendments that may be subsequently adopted.) Permits a consumer to put a security freeze on his or her credit report. Allows the consumer to temporarily lift the freeze to allow a particular entity access to the credit report for the purpose of issuing or extending credit to the consumer. Requires the freeze to be maintained until the consumer specifically requests its removal. Requires that a consumer be notified of the right to place a security freeze on his or her credit report each time the consumer receives a summary of the rights relating to credit reports. Compels a consumer reporting agency to notify the consumer within 5 days after releasing credit information that was in violation of a security freeze. Allows a consumer who had credit information released in violation of a security freeze to bring a private civil right of action against the consumer reporting agency that released the information in violation of the security freeze. Prohibits a consumer reporting agency from furnishing a consumer's credit header to someone who does not have a permissible basis to obtain the consumer credit header. Be it enacted by the General Assembly of the State of Colorado: SECTION 1. Title 12, Colorado Revised Statutes, is amended BY THE ADDITION OF A NEW ARTICLE to read: ARTICLE 14.7 Credit Report Security Freeze Act 12-14.7-101. Short title. This article shall be known and may be cited as the "Credit Report Security Freeze Act". 12-14.7-102. Definitions. As used in this article, unless the context otherwise requires: (1) "Consumer" means an individual. (2) "Consumer report" or "credit report" means a written, oral, or other communication of information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living that is collected in whole or in part and used or expected to be used for the purpose of serving as a factor in establishing the consumer's eligibility for: (a) Credit or insurance to be used primarily for personal, family, or household purposes; (b) Employment; or (c) Any other benefit authorized by law. (3) "Consumer reporting agency" means a person that, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages, in whole or in part, in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties. (4) "Reviewing the account" or "account review" means activities related to account maintenance, monitoring, credit-line increases, and account upgrades and enhancements. (5) "Security freeze" means a notice, at the request of a consumer and subject to certain exceptions, that prohibits a consumer reporting agency from releasing all or any part of the consumer's credit report or any information derived from it without the express authorization of the consumer. 12-14.7-103. Security freeze - timing - covered entities - cost. (1) A consumer may elect to place a security freeze on his or her credit report by: (a) Making a request by certified mail; (b) Making a request by telephone and providing certain personal identification; or (c) Making a request directly to a consumer reporting agency through a secure electronic mail connection if such a connection is made available by the agency. (2) (a) A consumer reporting agency shall place a security freeze on a consumer's credit report no later than five business days after receiving a written or telephone request from the consumer pursuant to paragraph (a) or (b) of subsection (1) of this section or three business days after receiving a secure electronic mail request pursuant to paragraph (c) of subsection (1) of this section. (b) The consumer reporting agency shall send a written confirmation of the security freeze to the consumer within five business days after placing the security freeze and, at the same time, shall provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of his or her credit to a specific party or for a specific period of time. (3) If the consumer chooses to allow his or her credit report to be accessed by a specific party or for a specific period of time while a security freeze is in place, he or she shall contact the consumer reporting agency via telephone, certified mail, or secure electronic mail, to request that the security freeze be temporarily lifted, and provide the following: (a) Proper identification; (b) The unique personal identification number or password provided by the consumer reporting agency pursuant to paragraph (b) of subsection (2) of this section; and (c) The necessary information regarding the third party who may receive the credit report or the time period during which the report shall be available to users of the credit report. (4) A consumer reporting agency that receives a request from a consumer to temporarily lift a security freeze on a credit report pursuant to subsection (3) of this section shall comply with the request no later than three business days after receiving the request. (5) (a) A consumer reporting agency shall only remove or temporarily lift a security freeze placed on a consumer's credit report upon the consumer's request pursuant to: (I) Subsection (3) or (7) of this section; or (II) If the consumer's credit report was frozen due to a material misrepresentation of fact by the consumer. (b) If a consumer reporting agency intends to remove a security freeze placed on a consumer's credit report pursuant to subparagraph (II) of paragraph (a) of this subsection (5), the consumer reporting agency shall notify the consumer in writing five business days prior to removing the freeze on the consumer's credit report. (6) If a third party requests access to a consumer credit report on which a security freeze is in effect for the purpose of receiving, extending, or otherwise utilizing the credit therein, and not for the sole purpose of account review, the consumer reporting agency shall notify the consumer that an attempt has been made to access the credit report. (7) A security freeze shall remain in place until the consumer requests that the security freeze be removed. A consumer reporting agency shall remove a security freeze within three business days after receiving a request for removal from the consumer, who provides both of the following: (a) Proper identification; and (b) The unique personal identification number or password provided by the consumer reporting agency pursuant to paragraph (b) of subsection (2) of this section. (8) A consumer reporting agency shall require proper identification of the person making a request to place or remove a security freeze. (9) A consumer reporting agency shall not suggest or otherwise state or imply to a third party that the consumer's security freeze reflects a negative credit score, history, report, or rating. (10) The provisions of this section shall not apply to the use of a consumer credit report by any of the following: (a) A person, or the person's subsidiary, affiliate, agent, or assignee, with which the consumer has or, prior to assignment, had an account, contract, or debtor-creditor relationship for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or debt; (b) A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under subsection (3) of this section for purposes of facilitating the extension of credit or other permissible use; (c) A person acting pursuant to a court order, warrant, or subpoena; (d) A state or local agency that administers a program for establishing and enforcing child support obligations; (e) The department of health care policy and financing or its agents or assignees acting to investigate fraud; (f) The department of human services or its agents or assignees acting to investigate fraud; (g) The department of revenue or its agents or assignees acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill its other statutory responsibilities; (h) A person for the purposes of prescreening as defined by the "Fair Credit Reporting Act", 15 U.S.C. sec. 1681, et seq.; (i) A person or entity administering a credit file monitoring subscription service to which the consumer has subscribed; or (j) A person or entity for the purpose of providing a consumer with a copy of his or her credit report upon the consumer's request. (11) (a) Except as otherwise provided in paragraph (b) of this subsection (11), a consumer shall not be charged for any security freeze services, including but not limited to the placement or lifting of a security freeze. (b) If a consumer fails to retain the original personal identification number provided by the consumer reporting agency, the agency shall not charge the consumer for a one-time reissue of the same or a new personal identification number. The consumer reporting agency may charge the consumer no more than five dollars for subsequent instances of loss and reissuance or replacement of the personal identification number. 12-14.7-104. Notice of rights. (1) At any time that a consumer is required to receive a summary of rights required under section 609 of the "Fair Credit Reporting Act" or under state law, the following notice shall be included: State Consumers Have the Right to Obtain a Security Freeze. You may obtain a security freeze on your credit report at no charge to protect your privacy and ensure that credit is not granted in your name without your knowledge. You have a right to place a security freeze on your credit report pursuant to state law. The security freeze will prohibit a consumer reporting agency from releasing any information in your credit report without your express authorization or approval. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. When you place a security freeze on your credit report, within five business days you will be provided a personal identification number or password to use if you choose to remove the security freeze on your credit report or to temporarily authorize the release of your credit report to a specific party or parties or for a period of time after the security freeze is in place. To provide that authorization, you must contact the consumer reporting agency and provide all of the following: The unique personal identification number or password provided by the consumer reporting agency; proper identification to verify your identity; and the proper information regarding the third party or parties who are to receive the credit report or the period of time for which the report shall be available to users of the credit report. A consumer reporting agency that receives a request from a consumer to temporarily lift a security freeze on a credit report shall comply with the request no later than three business days after receiving the request. A security freeze does not apply to circumstances where you have an existing account relationship and a copy of your report is requested by your existing creditor or its agents or affiliates for certain types of account review, collection, fraud control or similar activities. If you are actively seeking credit, you should understand that the procedures involved in lifting a security freeze may slow your applications for credit. You should plan ahead and lift a security freeze either completely if you are shopping around, or specifically for a certain creditor a few days before actually applying for new credit. You have a right to bring a civil action against a person or agency who violates your rights under the credit reporting laws. The action can be brought against a consumer reporting agency or a user of your credit report. 12-14.7-105. Violations - penalties. (1) If a consumer reporting agency erroneously, intentionally or unintentionally, violates the security freeze by releasing credit information that has been placed under a security freeze, the affected consumer is entitled to: (a) Notification from the consumer reporting agency within five business days after release of the information, including specificity as to the information released and the third-party recipient of the information; (b) File a complaint with the federal trade commission and the state attorney general; and (c) File a civil action against the consumer reporting agency and recover: (I) Injunctive relief to prevent or restrain further violations of the security freeze; and (II) A civil penalty in an amount not to exceed ten thousand dollars for each violation plus any damages available under other civil laws and reasonable expenses, court costs, investigative costs, and attorney fees. (2) Each violation of a security freeze shall be counted as a separate incident for purposes of imposing penalties under this section. SECTION 2. Part 1 of article 14.3 of title 12, Colorado Revised Statutes, is amended BY THE ADDITION OF A NEW SECTION to read: 12-14.3-110. Providing consumer credit header. (1) A consumer reporting agency shall not furnish a consumer's credit header information to a person or agency unless the person or agency seeks to obtain the consumer's credit report for a permissible purpose under the "Fair Credit Reporting Act", 15 U.S.C. sec. 1681 (b). (2) For purposes of this section, "credit header information" means the written, oral, or other communication of information by a consumer reporting agency regarding the social security number of a consumer, or any derivative thereof, and other personal identifying information of a consumer that is derived using nonpublic personal information, except the name, address, and telephone number of a consumer if all are listed in a residential telephone directory available in the locality of the consumer. SECTION 3. Safety clause. The general assembly hereby finds, determines, and declares that this act is necessary for the immediate preservation of the public peace, health, and safety.