HB 0037

CS

CHAMBER ACTION

1	The Agriculture Committee recommends the following:
2
3	Council/Committee Substitute
4	Remove the entire bill and insert:
5
6	A bill to be entitled
7	An act relating to security of consumer report
8	information; creating s. 501.005, F.S.; defining "consumer
9	report security freeze"; authorizing a consumer to place a
10	security freeze on his or her consumer report; providing
11	procedures and requirements with respect to the placement,
12	temporary suspension, and removal of a security freeze on
13	a consumer report; authorizing a consumer to allow
14	specified temporary access to his or her consumer report
15	during a security freeze; providing procedures with
16	respect to such temporary access; providing for removal of
17	a security freeze when a consumer report was frozen due to
18	a material misrepresentation of fact by the consumer;
19	providing applicability; prohibiting a consumer reporting
20	agency from charging a fee to a victim of identity theft
21	who requests a security freeze on a consumer report;
22	authorizing consumer reporting agencies to charge a fee to
23	place, remove, or temporarily lift a security freeze and
24	to reissue a personal identification number; restricting
25	the change of specified information in a consumer report
26	when a security freeze is in effect; specifying
27	applicability with respect to certain consumer reporting
28	agencies; specifying entities that are exempt from placing
29	a security freeze on a consumer report; providing for
30	civil remedy; providing requirements with respect to
31	written disclosure by a consumer reporting agency of
32	procedures and consumer rights associated with a security
33	freeze; providing an effective date.
34
35	Be It Enacted by the Legislature of the State of Florida:
36
37	Section 1.  Section 501.005, Florida Statutes, is created
38	to read:
39	501.005  Consumer report security freeze.--
40	(1)  For purposes of this section, "consumer report
41	security freeze" or "security freeze" means a notice placed in a
42	consumer report that prohibits a consumer reporting agency, as
43	defined in 15 U.S.C. s. 1681a(f), from releasing the consumer
44	report, credit score, or any information contained within the
45	consumer report, to a third party without the express
46	authorization of the consumer. This section does not prevent a
47	consumer reporting agency from advising a third party that a
48	security freeze is in effect with respect to the consumer
49	report.
50	(2)  A consumer may place a security freeze on his or her
51	consumer report by making a request in writing by certified mail
52	to a consumer reporting agency.
53	(3)  A consumer reporting agency shall place a security
54	freeze on a consumer report no later than 5 business days after
55	receiving a request from the consumer.
56	(4)  The consumer reporting agency shall send a written
57	confirmation of the security freeze to the consumer within 5
58	business days after instituting the security freeze and shall
59	provide the consumer with a unique personal identification
60	number or password to be used by the consumer when providing
61	authorization for the limited release of his or her consumer
62	report for a designated period of time during the security
63	freeze as provided in subsection (5).
64	(5)  A consumer may allow his or her consumer report to be
65	accessed for a designated period of time while a security freeze
66	is in effect by contacting the consumer reporting agency and
67	requesting that the freeze be temporarily lifted. The consumer
68	must provide the following information to the consumer reporting
69	agency as part of the request:
70	(a)  Proper identification as determined by the consumer
71	reporting agency.
72	(b)  The unique personal identification number or password
73	provided by the consumer reporting agency pursuant to subsection
74	(4).
75	(c)  Information specifying the period of time for which
76	the report shall be made available.
77	(6)  A consumer reporting agency that receives a request
78	from a consumer to temporarily lift a freeze on a consumer
79	report pursuant to subsection (5) shall comply with the request
80	no later than 3 business days after receiving the request.
81	(7)  A consumer reporting agency shall develop telephonic
82	communication or any form of secure electronic media to receive
83	and process a request from a consumer pursuant to subsection
84	(5).
85	(8)  A consumer reporting agency shall temporarily lift or
86	remove a security freeze placed on a consumer report only in the
87	following instances:
88	(a)  Upon consumer request, pursuant to subsection (5) or
89	subsection (11).
90	(b)  If the consumer report was frozen due to a material
91	misrepresentation of fact by the consumer. If a consumer
92	reporting agency intends to remove a security freeze on a
93	consumer report pursuant to this paragraph, the consumer
94	reporting agency shall notify the consumer in writing prior to
95	removing the security freeze.
96	(9)  A third party requesting access to a consumer report
97	on which a security freeze is in effect in connection with an
98	application for credit or other permissible use may treat the
99	application as incomplete if the consumer has not authorized a
100	temporary lifting of the security freeze for the period of time
101	during which the request is made.
102	(10)  If a consumer requests a security freeze, the
103	consumer reporting agency shall disclose to the consumer all
104	information relevant to the process of instituting, temporarily
105	lifting, and removing a security freeze and shall include the
106	disclosure required by subsection (17).
107	(11)  A security freeze shall remain in place until the
108	consumer requests that it be removed. A consumer reporting
109	agency shall remove a security freeze within 3 business days
110	after receiving a request for removal from the consumer, who,
111	upon making the request for removal, must provide the following:
112	(a)  Proper identification as determined by the consumer
113	reporting agency.
114	(b)  The unique personal identification number or password
115	provided by the consumer reporting agency pursuant to subsection
116	(4).
117	(12)  The provisions of this section do not apply to the
118	use of a consumer report by the following persons or for the
119	following reasons:
120	(a)  A person to whom the consumer owes a financial
121	obligation or a subsidiary, affiliate, or agent of the person,
122	or an assignee of a financial obligation owed by the consumer to
123	the person, or a prospective assignee of a financial obligation
124	owed by the consumer to the person in conjunction with the
125	proposed purchase of the financial obligation, with which the
126	consumer has or had prior to assignment an account or contract,
127	including a demand deposit account, or to whom the consumer
128	issued a negotiable instrument, for the purposes of reviewing
129	the account or collecting the financial obligation owed for the
130	account, contract, or negotiable instrument. For purposes of
131	this paragraph, "reviewing the account" includes activities
132	related to account maintenance, monitoring, credit line
133	increases, and account upgrades and enhancements.
134	(b)  A subsidiary, affiliate, agent, assignee, or
135	prospective assignee of a person to whom access has been granted
136	under this section for purposes of facilitating the extension of
137	credit or other permissible use.
138	(c)  A state agency acting within its lawful investigative
139	or regulatory authority.
140	(d)  A state or local law enforcement agency acting to
141	investigate a crime or conducting a criminal background check.
142	(e)  Any person administering a credit file monitoring
143	subscription service to which the consumer has subscribed.
144	(f)  Any person for the purpose of providing a consumer
145	with a copy of the consumer report upon the consumer's request.
146	(g)  Pursuant to a court order lawfully entered.
147	(h)  The use of credit information for the purposes of
148	prescreening as provided for by the federal Fair Credit
149	Reporting Act.
150	(13)  A consumer reporting agency shall not charge any fee
151	to a victim of identity theft who has submitted, at the time the
152	security freeze is requested, a copy of a valid investigative or
153	incident report or complaint with a law enforcement agency about
154	the unlawful use of the victim's identifying information by
155	another person. A consumer reporting agency may charge a
156	reasonable fee, not to exceed $10, to a consumer who elects to
157	place, remove, or temporarily lift a security freeze on his or
158	her consumer report. A consumer may be charged a reasonable fee,
159	not to exceed $10, if the consumer fails to retain the original
160	personal identification number or password provided by the
161	consumer reporting agency, and the agency must reissue the
162	personal identification number or password or provide a new
163	personal identification number or password to the consumer.
164	(14)  If a security freeze is in effect, a consumer
165	reporting agency shall not change any of the following official
166	information in a consumer report without sending a written
167	confirmation of the change to the consumer within 30 days after
168	the change is posted to the consumer's file:
169	(a)  Name.
170	(b)  Address.
171	(c)  Date of birth.
172	(d)  Social security number.
173
174	Written confirmation is not required for technical corrections
175	of a consumer's official information, including name and street
176	abbreviations, complete spellings, or transposition of numbers
177	or letters. In the case of an address change, the written
178	confirmation shall be sent to both the new address and the
179	former address.
180	(15)  The provisions of this section do not apply to the
181	following entities:
182	(a)  A check services company, which issues authorizations
183	for the purpose of approving or processing negotiable
184	instruments, electronic funds transfers, or similar methods of
185	payment.
186	(b)  A demand deposit account information service company,
187	which issues reports regarding account closures due to fraud,
188	substantial overdrafts, automatic teller machine abuse, or
189	similar negative information regarding a consumer to inquiring
190	banks or other financial institutions for use only in reviewing
191	a consumer request for a demand deposit account at the inquiring
192	bank or financial institution, as defined in s. 655.005(1)(g) or
193	(h), or in federal law.
194	(c)  A consumer reporting agency that acts only as a
195	reseller of credit information by assembling and merging
196	information contained in the database of another consumer
197	reporting agency or multiple consumer reporting agencies and
198	does not maintain a permanent database of credit information
199	from which new consumer reports are produced. However, a
200	consumer reporting agency shall honor any security freeze placed
201	on a consumer report by another consumer reporting agency.
202	(d)  A fraud prevention services company issuing reports to
203	prevent or investigate fraud.
204	(16)  In addition to any other penalties or remedies
205	provided under law, a person who is aggrieved by a violation of
206	the provisions of this section may bring a civil action as
207	authorized by this subsection.
208	(a)  Any person who willfully fails to comply with any
209	requirement imposed under this section with respect to any
210	consumer is liable to that consumer for actual damages sustained
211	by the consumer as a result of the failure or damages of not
212	less than $100 and not more than $1,000.
213	(b)  Any individual who obtains a consumer report under
214	false pretenses or knowingly without a permissible purpose is
215	liable to the consumer for actual damages sustained by the
216	consumer as a result of the failure or damages of not less than
217	$100 and not more than $1,000, whichever is greater. Any person
218	who obtains a consumer report from a consumer reporting agency
219	under false pretenses or knowingly without a permissible purpose
220	is liable to the consumer reporting agency for actual damages
221	sustained by the consumer reporting agency or $1,000, whichever
222	is greater.
223	(c)  Punitive damages may be assessed for willful
224	violations of this section.
225	(d)  Any person who is negligent in failing to comply with
226	any requirement imposed under this section with respect to any
227	consumer is liable to that consumer for any actual damages
228	sustained by the consumer as a result of the failure, plus the
229	costs of the action together with reasonable attorney's fees.
230	(e)  Upon a finding by the court that an unsuccessful
231	pleading, motion, or other paper filed in connection with an
232	action under this subsection was filed in bad faith or for
233	purposes of harassment, the court shall award to the prevailing
234	party attorney's fees that are reasonable in relation to the
235	work performed in responding to the pleading, motion, or other
236	paper.
237	(17)  Any written disclosure by a consumer reporting agency
238	to any consumer, pursuant to 15 U.S.C. s. 1681g, shall include a
239	written summary of all rights the consumer has under this
240	section, and, in the case of a consumer reporting agency which
241	compiles and maintains consumer reports on a nationwide basis, a
242	toll-free telephone number which the consumer can use to
243	communicate with the consumer reporting agency. The information
244	set forth in paragraph (b) of the written summary of rights must
245	be in at least 14-point boldface type in capital letters. The
246	written summary of rights required under this section is
247	sufficient if it is substantially in the following form:
248	(a)  You have a right to place a "security freeze" on your
249	consumer report, which will prohibit a consumer reporting agency
250	from releasing any information in your consumer report without
251	your express authorization. A security freeze must be requested
252	in writing by certified mail to a consumer reporting agency. The
253	security freeze is designed to prevent credit, loans, and
254	services from being approved in your name without your consent.
255	(b)  YOU SHOULD BE AWARE THAT USING A SECURITY FREEZE TO
256	CONTROL ACCESS TO THE PERSONAL AND FINANCIAL INFORMATION IN YOUR
257	CONSUMER REPORT MAY DELAY, INTERFERE WITH, OR PROHIBIT THE
258	TIMELY APPROVAL OF ANY SUBSEQUENT REQUEST OR APPLICATION YOU
259	MAKE REGARDING A NEW LOAN, CREDIT, MORTGAGE, INSURANCE,
260	GOVERNMENT SERVICES OR PAYMENTS, RENTAL HOUSING, EMPLOYMENT,
261	INVESTMENT, LICENSE, CELLULAR PHONE, UTILITIES, DIGITAL
262	SIGNATURE, INTERNET CREDIT CARD TRANSACTION, OR OTHER SERVICES,
263	INCLUDING AN EXTENSION OF CREDIT AT POINT OF SALE.
264	(c)  When you place a security freeze on your consumer
265	report, you will be provided a personal identification number or
266	password to use if you choose to remove the freeze on your
267	consumer report or authorize the release of your consumer report
268	for a designated period of time after the security freeze is in
269	place. To provide that authorization, you must contact the
270	consumer reporting agency and provide all of the following:
271	1.  The personal identification number or password.
272	2.  Proper identification to verify your identity.
273	3.  Information specifying the period of time for which the
274	report shall be made available.
275	(d)  A consumer reporting agency must authorize the release
276	of your consumer report no later than 3 business days after
277	receiving the above information.
278	(e)  A security freeze does not apply to a person or
279	entity, or its affiliates, or collection agencies acting on
280	behalf of the person or entity, with which you have an existing
281	account, that requests information in your consumer report for
282	the purposes of reviewing or collecting the account. Reviewing
283	the account includes activities related to account maintenance,
284	monitoring, credit line increases, and account upgrades and
285	enhancements.
286	(f)  You have the right to bring a civil action against
287	anyone, including a consumer reporting agency, who fails to
288	comply with the provisions of s. 501.005, Florida Statutes,
289	which governs the placing of a consumer report security freeze
290	on your consumer report.
291	Section 2.  This act shall take effect July 1, 2006.

CODING: Words stricken are deletions; words underlined are additions.