Florida Senate - 2014 SB 242 By Senator Detert 28-00307-14 2014242__ 1 A bill to be entitled 2 An act relating to the security of a protected 3 consumer’s information; creating s. 501.0051, F.S.; 4 providing definitions; authorizing the representative 5 of a protected consumer to place a security freeze on 6 a protected consumer’s consumer report or record; 7 specifying the procedure to request a security freeze; 8 requiring a consumer reporting agency to establish a 9 record if the protected consumer does not have an 10 existing consumer report; prohibiting the use of a 11 consumer record for certain purposes; providing that a 12 security freeze on a consumer record applies to a 13 subsequently created consumer report; requiring a 14 consumer reporting agency to place, and to provide 15 written confirmation of, a security freeze within a 16 specified period; prohibiting a consumer reporting 17 agency from stating or implying that a security freeze 18 reflects a negative credit history or rating; 19 requiring a consumer reporting agency to provide a 20 copy of a consumer report or record to a protected 21 consumer or his or her representative upon request; 22 authorizing a consumer reporting agency to charge a 23 fee for a copy of a protected consumer’s consumer 24 report or record; specifying the procedure to request 25 a copy of a protected consumer’s consumer report or 26 record; requiring a consumer reporting agency to 27 remove a security freeze under specified conditions; 28 specifying the procedure to remove a security freeze; 29 providing applicability; authorizing a consumer 30 reporting agency to charge a fee for placing or 31 removing a security freeze and for reissuing a unique 32 personal identifier; prohibiting a fee under certain 33 circumstances; requiring written notification upon the 34 change of specified information in a protected 35 consumer’s consumer report or record; providing 36 exceptions; requiring a consumer reporting agency to 37 notify a representative and provide specified 38 information if the consumer reporting agency violates 39 a security freeze; providing penalties and civil 40 remedies; providing written disclosure requirements 41 for consumer reporting agencies relating to a 42 protected consumer’s security freeze; providing an 43 effective date. 44 45 Be It Enacted by the Legislature of the State of Florida: 46 47 Section 1. Section 501.0051, Florida Statutes, is created 48 to read: 49 501.0051 Protected consumer report security freeze.— 50 (1) As used in this section, the term: 51 (a) “Consumer report” has the same meaning as provided in 52 15 U.S.C. s. 1681a(d). 53 (b) “Consumer reporting agency” has the same meaning as 54 provided in 15 U.S.C. s. 1681a(f). 55 (c) “Protected consumer” means a person younger than 16 56 years of age at the time a security freeze request is made or a 57 person represented by a guardian or other advocate pursuant to 58 chapter 39, chapter 393, chapter 744, or chapter 914. 59 (d) “Record” means a compilation of information that: 60 1. Identifies a protected consumer; and 61 2. Is created by a consumer reporting agency exclusively 62 for the purpose of complying with this section. 63 (e) “Representative” means the custodial parent or legal 64 guardian of a protected consumer, including a guardian appointed 65 pursuant to s. 914.17. 66 (f) “Security freeze” means: 67 1. A notice placed on a protected consumer’s consumer 68 report which prohibits a consumer reporting agency from 69 releasing the consumer report, the credit score, or any 70 information contained within the consumer report to a third 71 party without the express authorization of the representative; 72 or 73 2. If a consumer reporting agency does not have a consumer 74 report pertaining to the protected consumer, a notice placed on 75 the protected consumer’s record which prohibits the consumer 76 reporting agency from releasing the protected consumer’s record 77 except as provided in this section. 78 (g) “Sufficient proof of authority” means documentation 79 showing that a representative has authority to act on behalf of 80 a protected consumer. The term includes, but is not limited to, 81 a court order, a copy of a valid power of attorney, or a written 82 notarized statement signed by a representative which expressly 83 describes the authority of the representative to act on behalf 84 of the protected consumer. 85 (h) “Sufficient proof of identification” means 86 documentation identifying a protected consumer or a 87 representative of a protected consumer. The term includes, but 88 is not limited to, a copy of a social security card, a certified 89 or official copy of a birth certificate, a copy of a valid 90 driver license, or a copy of a government-issued photo 91 identification. 92 (2) A representative may place a security freeze on a 93 protected consumer’s consumer report by: 94 (a) Submitting a request to a consumer reporting agency in 95 the manner prescribed by that agency; 96 (b) Providing the agency with sufficient proof of authority 97 and sufficient proof of identification of the representative; 98 and 99 (c) Paying the agency a fee as authorized under this 100 section. 101 (3) If a consumer reporting agency does not have a consumer 102 report pertaining to a protected consumer when the consumer 103 reporting agency receives a request for a security freeze under 104 subsection (2), the consumer reporting agency shall create a 105 record for the protected consumer and place a security freeze on 106 the record. A record may not be created or used to consider the 107 protected consumer’s credit worthiness, credit standing, credit 108 capacity, character, general reputation, personal 109 characteristics, or eligibility for other financial services. If 110 a consumer report is subsequently created for a protected 111 consumer with a security freeze on his or her consumer record, 112 the consumer report is also subject to a security freeze until 113 the security freeze is removed from the consumer report pursuant 114 to subsection (8). 115 (4) A consumer reporting agency shall place a security 116 freeze on a consumer report or record within 30 days after 117 confirming the authenticity of a security freeze request made in 118 accordance with this section. 119 (5) The consumer reporting agency shall send a written 120 confirmation of the security freeze to the representative within 121 10 business days after instituting the security freeze on the 122 consumer report or record and shall provide the representative 123 with instructions for removing the security freeze and a unique 124 personal identifier to be used by the representative when 125 providing authorization for removal of the security freeze. 126 (6) A consumer reporting agency may not state or imply to 127 any person that a security freeze reflects a negative credit 128 score, a negative credit history, or a negative credit rating. 129 (7) During any period that a security freeze is in effect, 130 a consumer reporting agency shall provide a copy of a protected 131 consumer’s consumer report or record to the protected consumer 132 or his or her representative upon request. A consumer reporting 133 agency may charge the representative or protected consumer a fee 134 for the copy, not to exceed the amount normally charged by such 135 agency to provide a copy of a consumer report. 136 (a) A representative submitting a request for a copy of a 137 protected consumer’s consumer report or record must provide all 138 of the following: 139 1. Sufficient proof of identification of the representative 140 and sufficient proof of authority as determined by the consumer 141 reporting agency. 142 2. The unique personal identifier provided by the consumer 143 reporting agency pursuant to subsection (5). 144 3. A fee as authorized under this section. 145 (b) A protected consumer submitting a request for a copy of 146 his or her consumer report or record must provide sufficient 147 proof of identification of the protected consumer as determined 148 by the consumer reporting agency and pay a fee as authorized 149 under this section. 150 (8) A consumer reporting agency shall remove a security 151 freeze from a protected consumer’s consumer report or record 152 only under either of the following circumstances: 153 (a) Upon the request of a representative or a protected 154 consumer. A consumer reporting agency shall remove a security 155 freeze within 30 days after receiving such a request for removal 156 from a protected consumer or his or her representative. 157 1. A representative submitting a request for removal must 158 provide all of the following: 159 a. Sufficient proof of identification of the representative 160 and sufficient proof of authority as determined by the consumer 161 reporting agency. 162 b. The unique personal identifier provided by the consumer 163 reporting agency pursuant to subsection (5). 164 c. A fee as authorized under this section. 165 2. A protected consumer submitting a request for removal 166 must provide all of the following: 167 a. Sufficient proof of identification of the protected 168 consumer as determined by the consumer reporting agency. 169 b. Documentation that the sufficient proof of authority of 170 the protected consumer’s representative to act on behalf of the 171 protected consumer is no longer valid. 172 (b) If the security freeze was instituted due to a material 173 misrepresentation of fact. If a consumer reporting agency 174 intends to remove a security freeze under this paragraph, the 175 consumer reporting agency must notify the representative and 176 protected consumer in writing before removing the security 177 freeze. 178 (9) This section does not apply to the use of a protected 179 consumer’s consumer report or record by the following persons or 180 for the following reasons: 181 (a) A state agency acting within its lawful investigative 182 or regulatory authority. 183 (b) A state or local law enforcement agency investigating a 184 crime or conducting a criminal background check. 185 (c) A person administering a credit file monitoring 186 subscription service to which the protected consumer or the 187 representative, on behalf of the protected consumer, has 188 subscribed. 189 (d) A person providing the protected consumer’s consumer 190 report or record to the protected consumer or the representative 191 upon the request of the protected consumer or representative. 192 (e) Pursuant to a court order lawfully entered. 193 (f) An insurance company for use in setting or adjusting a 194 rate, adjusting a claim, or underwriting for insurance purposes. 195 (g) A consumer reporting agency’s database or file that 196 consists entirely of information concerning, and used 197 exclusively for, one or more of the following: 198 1. Criminal record information. 199 2. Personal loss history information. 200 3. Fraud prevention or detection. 201 4. Tenant screening. 202 5. Employment screening. 203 6. Personal insurance policy information. 204 7. Noncredit information used for insurance purposes. 205 (h) A check services company issuing authorizations for the 206 purpose of approving or processing negotiable instruments, 207 electronic funds transfers, or similar methods of payment. 208 (i) A deposit account information service company issuing 209 reports regarding account closures due to fraud, substantial 210 overdrafts, automatic teller machine abuse, or similar negative 211 information regarding a protected consumer to an inquiring 212 financial institution, as defined in s. 655.005 or in federal 213 law, for use only in reviewing a representative’s request for a 214 deposit account for the protected consumer at the inquiring 215 financial institution. 216 (j) A consumer reporting agency that acts only as a 217 reseller of credit information by assembling and merging 218 information contained in the database of another consumer 219 reporting agency or multiple consumer reporting agencies and 220 that does not maintain a permanent database of credit 221 information from which new consumer reports are produced. 222 However, such consumer reporting agency shall honor any security 223 freeze placed or removed by another consumer reporting agency. 224 (k) A fraud prevention services company issuing reports to 225 prevent or investigate fraud. 226 (l) A person or entity, or its affiliates, or a collection 227 agency acting on behalf of the person or entity and with which 228 the protected consumer has an existing account, requesting 229 information in the protected consumer’s consumer report or 230 record for the purposes of reviewing or collecting the account. 231 Reviewing the account includes activities related to account 232 maintenance, monitoring, credit line increases, and account 233 upgrades and enhancements. 234 (10)(a) A consumer reporting agency may charge a reasonable 235 fee, not to exceed $10, to a representative who elects to place 236 or remove a security freeze. 237 (b) A consumer reporting agency may charge a reasonable 238 fee, not to exceed $10, if the representative fails to retain 239 the original unique personal identifier provided by the consumer 240 reporting agency and the agency must reissue the unique personal 241 identifier or provide a new unique personal identifier to the 242 representative. 243 (c) A consumer reporting agency may not charge a fee under 244 this section to the representative of a protected consumer who 245 is a victim of identity theft if the representative submits, at 246 the time the security freeze is requested, a copy of a valid 247 investigative report, an incident report, or a complaint with a 248 law enforcement agency about the unlawful use of the protected 249 consumer’s identifying information by another person. 250 (11) If a security freeze is in effect, a consumer 251 reporting agency must send written confirmation to a protected 252 consumer’s representative of a change to any of the following 253 official information in the protected consumer’s consumer report 254 or record within 30 days after the change is posted: 255 (a) The protected consumer’s name. 256 (b) The protected consumer’s address. 257 (c) The protected consumer’s date of birth. 258 (d) The protected consumer’s social security number. 259 260 Written confirmation is not required for technical corrections 261 of a protected consumer’s official information, including name 262 and street abbreviations, complete spellings, or transposition 263 of numbers or letters. In the case of an address change, the 264 written confirmation must be sent to the representative and to 265 the protected consumer’s new address and former address. 266 (12) If a consumer reporting agency violates a security 267 freeze placed in accordance with this section by releasing 268 information subject to a security freeze without proper 269 authorization, the consumer reporting agency shall, within 5 270 business days after discovering or being notified of the release 271 of information, notify the representative of the protected 272 consumer in writing. The notice shall state the specific 273 information released and provide the name, address, and other 274 contact information of the recipient of the information. 275 (13) A consumer reporting agency that willfully fails to 276 comply with any requirement imposed under this section is 277 subject to an administrative fine in the amount of $500, imposed 278 by the Department of Agriculture and Consumer Services pursuant 279 to the administrative procedures established in chapter 120. 280 (14) In addition to any other penalties or remedies 281 provided under law, the following persons who are aggrieved by a 282 violation of this section may bring a civil action as follows: 283 (a) A person who obtains a protected consumer’s consumer 284 report or record from a consumer reporting agency under false 285 pretenses or who knowingly obtains a protected consumer’s 286 consumer report or record without a permissible purpose is 287 liable to the representative and protected consumer for actual 288 damages sustained by the protected consumer or $1,000, whichever 289 is greater. 290 (b) A person who obtains a protected consumer’s consumer 291 report or record from a consumer reporting agency under false 292 pretenses or who knowingly obtains a protected consumer’s 293 consumer report or record without a permissible purpose is 294 liable to the consumer reporting agency for actual damages 295 sustained by the consumer reporting agency or $1,000, whichever 296 is greater. 297 (15) A written disclosure by a consumer reporting agency, 298 pursuant to 15 U.S.C. s. 1681g, to a representative and 299 protected consumer residing in this state must include a written 300 summary of all rights that the representative and protected 301 consumer have under this section and, in the case of a consumer 302 reporting agency that compiles and maintains records on a 303 nationwide basis, a toll-free telephone number that the 304 representative can use to communicate with the consumer 305 reporting agency. The information provided in paragraph (b) must 306 be in at least 12-point boldfaced type. The written summary of 307 rights required under this section is sufficient if it is 308 substantially in the following form: 309 (a) If you are the custodial parent or legal guardian of a 310 minor younger than 16 years of age or a guardian or advocate of 311 an incapacitated, disabled, or protected person under chapter 312 39, chapter 393, chapter 744, or chapter 914, Florida Statutes, 313 you have the right to place a security freeze on the consumer 314 report of the person you are legally authorized to care for. If 315 no consumer report exists, you have the right to request that a 316 record be created and a security freeze be placed on the record. 317 A record with a security freeze is intended to prevent the 318 opening of credit accounts until the security freeze is removed. 319 (b) YOU SHOULD BE AWARE THAT USING A SECURITY FREEZE TO 320 CONTROL ACCESS TO THE PERSONAL AND FINANCIAL INFORMATION IN A 321 CONSUMER REPORT OR RECORD MAY DELAY, INTERFERE WITH, OR PROHIBIT 322 THE TIMELY APPROVAL OF ANY SUBSEQUENT REQUEST OR APPLICATION 323 REGARDING A NEW LOAN, CREDIT, MORTGAGE, INSURANCE, GOVERNMENT 324 SERVICES OR PAYMENTS, RENTAL HOUSING, EMPLOYMENT, INVESTMENT, 325 LICENSE, CELLULAR PHONE, UTILITIES, DIGITAL SIGNATURE, INTERNET 326 CREDIT CARD TRANSACTION, OR OTHER SERVICES, INCLUDING AN 327 EXTENSION OF CREDIT AT POINT OF SALE. 328 (c) To remove the security freeze on the protected 329 consumer’s record or report, you must contact the consumer 330 reporting agency and provide all of the following: 331 1. Proof of identification as required by the consumer 332 reporting agency. 333 2. Proof of authority over the protected consumer as 334 required by the consumer reporting agency. 335 3. The unique personal identifier provided by the consumer 336 reporting agency. 337 4. Payment of a fee. 338 (d) A consumer reporting agency must, within 30 days after 339 receiving the above information, authorize the removal of the 340 security freeze. 341 (e) A security freeze does not apply to a person or entity, 342 or its affiliates, or a collection agency acting on behalf of 343 the person or entity and with which the protected consumer has 344 an existing account, which requests information in the protected 345 consumer’s consumer report or record for the purposes of 346 reviewing or collecting the account. Reviewing the account 347 includes activities related to account maintenance, monitoring, 348 credit line increases, and account upgrades and enhancements. 349 (f) You have the right to bring a civil action against 350 anyone, including a consumer reporting agency, who fails to 351 comply with section 501.0051, Florida Statutes, which governs 352 the placement and removal of a security freeze on a protected 353 consumer’s consumer report or record. 354 Section 2. This act shall take effect September 1, 2014.