Act No. 76

Public Acts of 2018

Approved by the Governor

March 19, 2018

Filed with the Secretary of State

March 19, 2018

EFFECTIVE DATE: June 17, 2018

STATE OF MICHIGAN

99TH LEGISLATURE

REGULAR SESSION OF 2018

Introduced by Rep. Bellino

ENROLLED HOUSE BILL No. 5094

AN ACT to amend 2013 PA 229, entitled “An act to require certain consumer reporting agencies to place security freezes for consumers under certain circumstances; to provide for the removal of those security freezes; to authorize and limit fees; to prescribe the powers and duties of certain state agencies and officials; and to provide remedies,” by amending the title and sections 11, 14, 17, 21, 23, and 31 (MCL 445.2521, 445.2524, 445.2527, 445.2531, 445.2533, and 445.2541).

The People of the State of Michigan enact:

TITLE

An act to require certain consumer reporting agencies to place security freezes for consumers under certain circumstances; to provide for the removal of those security freezes; to prescribe the powers and duties of certain state agencies and officials; and to provide remedies.

Sec. 11. (1) A consumer reporting agency shall place a security freeze on a consumer’s credit report if all of the following are met:

(a) The consumer reporting agency receives a request from the consumer for the placement of the security freeze under this act.

(b) The consumer does all of the following:

(i) Submits the request described in subdivision (a) to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency.

(ii) Provides to the consumer reporting agency sufficient proof of identification of the consumer.

(2) Within 5 business days after receiving a request that meets the requirements of subsection (1), a consumer reporting agency shall place a security freeze for the consumer.

Sec. 14. (1) A consumer who does all of the following may temporarily lift a security freeze to allow access to the consumer’s credit report by a specific person or for a specific period of time while the security freeze is in place:

(a) Contacts the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency for making a request under subdivision (b).

(b) Requests that the consumer reporting agency temporarily lift the security freeze.

(d) Includes with the request under subdivision (b) the unique personal identification number or password provided to the consumer under section 12(b).

(e) Provides the proper information regarding the person that is to receive the credit report or the time period during which the credit report is to be available to users of the credit report.

(2) Except as provided in subsection (3), a consumer reporting agency that receives a request to temporarily lift a security freeze under subsection (1) shall comply with the request within 3 business days after receiving the request.

(3) If a consumer reporting agency receives a request to temporarily lift a security freeze under subsection (1) by telephone, by electronic mail, or by secure connection on the website of the consumer reporting agency, the consumer reporting agency shall comply with the request within 15 minutes after receiving the request. However, a consumer reporting agency is not required to temporarily lift a security freeze within 15 minutes if a delay in complying with the request is caused by any of the following:

(a) An act of God, including, but not limited to, a fire, earthquake, hurricane, storm, or similar natural disaster or phenomena.

(b) An unauthorized or illegal act by a third party, including, but not limited to, an act of terrorism, sabotage, riot, or vandalism, a labor strike or other labor dispute that disrupts the consumer reporting agency’s operations, or a similar occurrence.

(c) An interruption of the consumer reporting agency’s operations, including, but not limited to, an electrical failure, an unanticipated delay in equipment or replacement part delivery, a computer hardware or software failure that inhibits response time, or a similar disruption.

(d) Governmental action, including, but not limited to, an emergency order or regulation, judicial or law enforcement action, or a similar directive.

(e) Regularly scheduled maintenance of, or updates to, the consumer reporting agency’s systems that occurs outside of normal business hours.

(f) Commercially reasonable maintenance of, or repair to, the consumer reporting agency’s systems that is unexpected or unscheduled.

Sec. 17. (1) A consumer reporting agency shall remove a security freeze on a consumer’s credit report if the consumer does all of the following:

(a) Contacts the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency for making a request to remove a security freeze.

(b) Requests the removal of the security freeze on his or her credit report.

(d) Includes with the request under subdivision (b) the unique personal identification number or password provided to the consumer under section 12(b).

(2) A consumer reporting agency that receives a request for removal of a security freeze under subsection (1) shall comply with the request within 3 business days after receiving the request.

Sec. 21. (1) A consumer reporting agency shall place a security freeze on a protected consumer’s credit report if all of the following are met:

(a) The consumer reporting agency receives a request from the representative of the protected consumer for the placement of the security freeze.

(b) The protected consumer’s representative does all of the following:

(i) Submits the request to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency.

(ii) Provides to the consumer reporting agency sufficient proof of identification for the protected consumer and the representative.

(iii) Provides to the consumer reporting agency his or her sufficient proof of authority.

(2) If a consumer reporting agency does not have a file pertaining to a protected consumer when the consumer reporting agency receives a request under subsection (1), the consumer reporting agency shall create a record for the protected consumer.

(3) Within 30 days after receiving a request that meets the requirements of subsection (1), a consumer reporting agency shall place a security freeze for the protected consumer.

Sec. 23. A consumer reporting agency shall remove a security freeze for a protected consumer placed under section 21 within 30 days after the protected consumer or the protected consumer’s representative does all of the following:

(a) Submits a request for the removal of the security freeze to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency.

(b) Provides 1 of the following to the consumer reporting agency:

(i) If the request for removal is submitted by the protected consumer, all of the following:

(A) Proof that the sufficient proof of authority for the protected consumer’s representative to act on behalf of the protected consumer is no longer valid.

(B) Sufficient proof of identification of the protected consumer.

(ii) If the request for removal is submitted by the representative of a protected consumer, all of the following:

(A) Sufficient proof of identification of the protected consumer and the representative.

(B) Sufficient proof of authority to act on behalf of the protected consumer.

Sec. 31. A consumer reporting agency may not charge a fee for the placement, temporary lifting, or removal of a security freeze for a consumer under article 2 or for a protected consumer under article 3.

Enacting section 1. This amendatory act takes effect 90 days after the date it is enacted into law.

This act is ordered to take immediate effect.

Clerk of the House of Representatives

Secretary of the Senate

Approved

Governor