June 21, 2006, Introduced by Senator PATTERSON and referred to the Committee on Banking and Financial Institutions.
A bill to require certain credit reporting agencies to place
security alerts and security freezes on certain consumer credit
information; to authorize and limit fees; and to provide remedies.
THE PEOPLE OF THE STATE OF MICHIGAN ENACT:
Sec. 1. This act shall be known and may be cited as the
"credit security act".
Sec. 2. As used in this act:
(a) "Clear and proper identification" means information
generally deemed sufficient to identify an individual.
(b) "Consumer" means an individual who resides in this state.
(c) "Consumer file" means any file or record maintained by a
credit reporting agency about a consumer.
(d) "Credit report" means any written, oral, or other
communication of any credit information by a credit reporting
agency that operates or maintains a database of consumer credit
information bearing on a consumer's creditworthiness, credit
standing, or credit capacity.
(e) "Credit reporting agency" means any person who, for
monetary fees or dues or on a cooperative nonprofit basis,
regularly engages in whole or in part in the practice of assembling
or evaluating consumer credit information or other information on
consumers for the purpose of furnishing credit reports to third
parties and who uses any means or facility of interstate commerce
for the purpose of preparing or furnishing credit reports. The term
does not include a check acceptance service that provides check
approval and guarantee services to merchants.
(f) "Security alert" means a notice that is placed on a
consumer file at the request of the consumer, is sent to a
recipient of a credit report involving that consumer file, and
states that the consumer's identity may have been used without the
consumer's consent to fraudulently obtain goods or services in the
consumer's name.
(g) "Security freeze" means a notice placed on a consumer file
at the request of the consumer and that prohibits a credit
reporting agency from releasing the consumer's credit report or
credit score without the express authorization of the consumer
except in compliance with this act.
Sec. 3. (1) A consumer may place a security freeze on his or
her consumer file by making a written request to a credit reporting
agency that includes clear and proper identification of the
consumer. A credit reporting agency shall place a security freeze
on a consumer's consumer file within 10 business days after
receiving a written request for the security freeze from the
consumer under this subsection.
(2) If a security freeze is in effect, a credit reporting
agency shall not release information from a consumer file to a
third party without prior express authorization from the consumer.
(3) A credit reporting agency shall notify a person who
requests a credit report if a security freeze is in effect for the
consumer file involved in that credit report.
Sec. 4. (1) Within 10 business days after a credit reporting
agency receives a request for a security freeze under section 5,
the credit reporting agency shall provide the consumer with a
unique personal identification number or password that the consumer
may use to provide authorization for access to his or her consumer
file for a specific period of time. In addition, the credit
reporting agency shall simultaneously provide to the consumer in
writing the process for placing, removing, and temporarily lifting
a security freeze and the process for allowing access to
information from the consumer file while the security freeze is in
effect.
(2) A consumer may request in writing a replacement personal
identification number or password for purposes of subsection (1).
The request must comply with the requirements for requesting a
security freeze under section 3. Within 7 business days after a
credit reporting agency receives a request for a replacement
personal identification number or password, the credit reporting
agency shall provide the consumer with a new, unique personal
identification number or password to be used by the consumer
instead of the number or password that was provided under
subsection (1).
Sec. 5. If a security freeze is in effect, a consumer
reporting agency shall not change a consumer's name, address, date
of birth, or social security number in a consumer file without
sending a written confirmation of the change to the consumer within
30 days after the posting of the change to the consumer file. If
the change is an address change, the consumer reporting agency
shall send written confirmation to both the new address and the
former address. Written confirmation is not required for a
technical modification of information in a consumer file, including
name and street abbreviations, complete spellings, or transposition
of numbers or letters.
Sec. 6. (1) A credit reporting agency shall remove or
temporarily lift a security freeze placed on a consumer file only
if 1 of the following applies:
(a) The consumer makes a request under this section and pays
any applicable fees under section 8.
(b) The consumer file is frozen due to a material
misrepresentation of fact by the consumer. If a credit reporting
agency intends to remove a security freeze on a consumer file under
this subdivision, the credit reporting agency shall notify the
consumer in writing before removing the security freeze.
(2) If a consumer wishes to allow access to his or her
consumer file for a specific period of time while a security freeze
is in place, he or she shall contact the credit reporting agency
and request that the credit reporting agency temporarily lift the
security freeze and provide all of the following to the credit
reporting agency:
(a) Clear and proper identification.
(b) The unique personal identification number or password
provided by the credit reporting agency under section 4.
(c) The specific time period that the consumer requests that
the credit reporting agency allow users access to his or her
consumer file.
(3) A credit reporting agency that receives a request from a
consumer to temporarily lift a security freeze on his or her
consumer file under subsection (2) shall comply with the request
within 3 business days after receiving the request. A credit
reporting agency may develop procedures involving the use of
telephone, facsimile, the internet, or other electronic media to
receive and process a request from a consumer to temporarily lift a
security freeze on a consumer file in an expedited manner.
(4) A security freeze shall remain in place until the consumer
requests that the credit reporting agency remove the security
freeze. A credit reporting agency shall remove a security freeze
within 3 business days after receiving a request for removal from
the consumer and the all of the following information from the
consumer:
(a) Clear and proper identification.
(b) The unique personal identification number or password
provided by the credit reporting agency under section 4.
Sec. 7. A security freeze does not apply to a credit report
provided to any of the following:
(a) To a law enforcement agency, court, or other federal,
state, or local governmental entity or an agent or assignee of that
agency.
(b) If provided for the sole purpose of assisting in the
collection of an existing debt of the consumer who is the subject
of the credit report requested, to a private collection agency.
(c) If provided for the purpose of reviewing an account or
collecting a financial obligation owed for an account, contract, or
negotiable instrument, to a person; to a subsidiary, affiliate, or
agent of that person; or to an assignee of a financial obligation a
consumer owes that person, or a prospective assignee of a financial
obligation a consumer owes that person in conjunction with a
proposed purchase of that financial obligation, if the consumer has
or had before the assignment an account or contract, including a
demand deposit account, with that person or had issued a negotiable
instrument to that person. As used in this subdivision, "reviewing
the account" includes activities related to account maintenance,
monitoring, credit line increases, and account upgrades and
enhancements.
(d) If provided to facilitate an extension of credit, to a
subsidiary, affiliate, agent, assignee, or prospective assignee of
a person given access to a credit report by a consumer under
section 6(2).
(e) To a person for the purpose of prescreening under the fair
credit reporting act, 15 USC 1681 to 1681v.
(f) To a credit reporting agency for the purpose of providing
a consumer with a copy of his or her own credit report at his or
her request.
(g) To a child support enforcement agency.
(h) To a person administering a credit report monitoring
subscription service to which the consumer has subscribed.
(i) To a check services or fraud prevention services company
that issues reports on incidents of fraud or authorizations for the
purpose of approving or processing negotiable instruments,
electronic funds transfers, or similar methods of payment.
(j) To a deposit account information service company that
issues reports regarding account closures due to fraud, substantial
overdrafts, automatic teller machine abuse, or similar negative
information regarding a consumer to inquiring banks or other
financial institutions for use only in reviewing a consumer request
for a deposit account at the inquiring bank or financial
institution.
Sec. 8. (1) A credit reporting agency may impose a reasonable
fee on a consumer for initially placing a security freeze on a
consumer file. The amount of the fee may not exceed $10.00.
(2) A credit reporting agency may impose a reasonable fee on a
consumer to temporarily lift a security freeze on a consumer file.
The amount of the fee may not exceed $8.00 per request.
(3) A credit reporting agency may not charge a consumer a fee
for revoking a security freeze.
Sec. 9. A consumer damaged by an intentional or negligent
violation of this act may bring an action for and is entitled to
recover his or her actual damages, plus reasonable attorney fees
and court costs.