| 1 | The Civil Justice Committee recommends the following: |
| 2 |
|
| 3 | Council/Committee Substitute |
| 4 | Remove the entire bill and insert: |
| 5 |
|
| 6 | A bill to be entitled |
| 7 | An act relating to security of consumer report |
| 8 | information; creating s. 501.005, F.S.; defining "consumer |
| 9 | report security freeze"; authorizing a consumer to place a |
| 10 | security freeze on his or her consumer report; providing |
| 11 | procedures and requirements with respect to the placement, |
| 12 | temporary suspension, and removal of a security freeze on |
| 13 | a consumer report; authorizing a consumer to allow |
| 14 | specified temporary access to his or her consumer report |
| 15 | during a security freeze; providing procedures with |
| 16 | respect to such temporary access; providing for removal of |
| 17 | a security freeze when a consumer report was frozen due to |
| 18 | a material misrepresentation of fact by the consumer; |
| 19 | providing applicability; prohibiting a consumer reporting |
| 20 | agency from charging a fee to a victim of identity theft |
| 21 | who requests a security freeze on a consumer report; |
| 22 | authorizing consumer reporting agencies to charge a fee to |
| 23 | place, remove, or temporarily lift a security freeze and |
| 24 | to reissue a personal identification number; restricting |
| 25 | the change of specified information in a consumer report |
| 26 | when a security freeze is in effect; specifying |
| 27 | applicability with respect to certain consumer reporting |
| 28 | agencies; specifying entities that are exempt from placing |
| 29 | a security freeze on a consumer report; providing for |
| 30 | civil remedy; providing requirements with respect to |
| 31 | written disclosure by a consumer reporting agency of |
| 32 | procedures and consumer rights associated with a security |
| 33 | freeze; providing an effective date. |
| 34 |
|
| 35 | Be It Enacted by the Legislature of the State of Florida: |
| 36 |
|
| 37 | Section 1. Section 501.005, Florida Statutes, is created |
| 38 | to read: |
| 39 | 501.005 Consumer report security freeze.-- |
| 40 | (1) For purposes of this section, "consumer report |
| 41 | security freeze" or "security freeze" means a notice placed in a |
| 42 | consumer report that prohibits a consumer reporting agency, as |
| 43 | defined in 15 U.S.C. s. 1681a(f), from releasing the consumer |
| 44 | report, credit score, or any information contained within the |
| 45 | consumer report, to a third party without the express |
| 46 | authorization of the consumer. This section does not prevent a |
| 47 | consumer reporting agency from advising a third party that a |
| 48 | security freeze is in effect with respect to the consumer |
| 49 | report. |
| 50 | (2) A consumer may place a security freeze on his or her |
| 51 | consumer report by making a request in writing by certified mail |
| 52 | to a consumer reporting agency. |
| 53 | (3) A consumer reporting agency shall place a security |
| 54 | freeze on a consumer report no later than 5 business days after |
| 55 | receiving a request from the consumer. |
| 56 | (4) The consumer reporting agency shall send a written |
| 57 | confirmation of the security freeze to the consumer within 5 |
| 58 | business days after instituting the security freeze and shall |
| 59 | provide the consumer with a unique personal identification |
| 60 | number or password to be used by the consumer when providing |
| 61 | authorization for the limited release of his or her consumer |
| 62 | report for a designated period of time during the security |
| 63 | freeze as provided in subsection (5). |
| 64 | (5) A consumer may allow his or her consumer report to be |
| 65 | accessed for a designated period of time while a security freeze |
| 66 | is in effect by contacting the consumer reporting agency and |
| 67 | requesting that the freeze be temporarily lifted. The consumer |
| 68 | must provide the following information to the consumer reporting |
| 69 | agency as part of the request: |
| 70 | (a) Proper identification as determined by the consumer |
| 71 | reporting agency. |
| 72 | (b) The unique personal identification number or password |
| 73 | provided by the consumer reporting agency pursuant to subsection |
| 74 | (4). |
| 75 | (c) Information specifying the period of time for which |
| 76 | the report shall be made available. |
| 77 | (6) A consumer reporting agency that receives a request |
| 78 | from a consumer to temporarily lift a freeze on a consumer |
| 79 | report pursuant to subsection (5) shall comply with the request |
| 80 | no later than 3 business days after receiving the request. |
| 81 | (7) A consumer reporting agency doing business in this |
| 82 | state shall develop telephonic communication or any form of |
| 83 | secure electronic media to receive and process a request from a |
| 84 | consumer pursuant to subsection (5). |
| 85 | (8) A consumer reporting agency shall temporarily lift or |
| 86 | remove a security freeze placed on a consumer report only in the |
| 87 | following instances: |
| 88 | (a) Upon consumer request, pursuant to subsection (5) or |
| 89 | subsection (11). |
| 90 | (b) If the consumer report was frozen due to a material |
| 91 | misrepresentation of fact by the consumer. If a consumer |
| 92 | reporting agency intends to remove a security freeze on a |
| 93 | consumer report pursuant to this paragraph, the consumer |
| 94 | reporting agency shall notify the consumer in writing prior to |
| 95 | removing the security freeze. |
| 96 | (9) A third party requesting access to a consumer report |
| 97 | on which a security freeze is in effect in connection with an |
| 98 | application for credit or other permissible use may treat the |
| 99 | application as incomplete if the consumer has not authorized a |
| 100 | temporary lifting of the security freeze for the period of time |
| 101 | during which the request is made. |
| 102 | (10) If a consumer requests a security freeze, the |
| 103 | consumer reporting agency shall disclose to the consumer all |
| 104 | information relevant to the process of instituting, temporarily |
| 105 | lifting, and removing a security freeze and shall include the |
| 106 | disclosure required by subsection (17). |
| 107 | (11) A security freeze shall remain in place until the |
| 108 | consumer requests that it be removed. A consumer reporting |
| 109 | agency shall remove a security freeze within 3 business days |
| 110 | after receiving a request for removal from the consumer, who, |
| 111 | upon making the request for removal, must provide the following: |
| 112 | (a) Proper identification as determined by the consumer |
| 113 | reporting agency. |
| 114 | (b) The unique personal identification number or password |
| 115 | provided by the consumer reporting agency pursuant to subsection |
| 116 | (4). |
| 117 | (12) The provisions of this section do not apply to the |
| 118 | use of a consumer report by the following persons or for the |
| 119 | following reasons: |
| 120 | (a) A person to whom the consumer owes a financial |
| 121 | obligation or a subsidiary, affiliate, or agent of the person, |
| 122 | or an assignee of a financial obligation owed by the consumer to |
| 123 | the person, or a prospective assignee of a financial obligation |
| 124 | owed by the consumer to the person in conjunction with the |
| 125 | proposed purchase of the financial obligation, with which the |
| 126 | consumer has or had prior to assignment an account or contract, |
| 127 | including a demand deposit account, or to whom the consumer |
| 128 | issued a negotiable instrument, for the purposes of reviewing |
| 129 | the account or collecting the financial obligation owed for the |
| 130 | account, contract, or negotiable instrument. For purposes of |
| 131 | this paragraph, "reviewing the account" includes activities |
| 132 | related to account maintenance, monitoring, credit line |
| 133 | increases, and account upgrades and enhancements. |
| 134 | (b) A subsidiary, affiliate, agent, assignee, or |
| 135 | prospective assignee of a person to whom access has been granted |
| 136 | under this section for purposes of facilitating the extension of |
| 137 | credit or other permissible use. |
| 138 | (c) A state agency acting within its lawful investigative |
| 139 | or regulatory authority. |
| 140 | (d) A state or local law enforcement agency acting to |
| 141 | investigate a crime or conducting a criminal background check. |
| 142 | (e) Any person administering a credit file monitoring |
| 143 | subscription service to which the consumer has subscribed. |
| 144 | (f) Any person for the purpose of providing a consumer |
| 145 | with a copy of the consumer report upon the consumer's request. |
| 146 | (g) Pursuant to a court order lawfully entered. |
| 147 | (h) The use of credit information for the purposes of |
| 148 | prescreening as provided for by the federal Fair Credit |
| 149 | Reporting Act. |
| 150 | (13) A consumer reporting agency shall not charge any fee |
| 151 | to a victim of identity theft who has submitted, at the time the |
| 152 | security freeze is requested, a copy of a valid investigative or |
| 153 | incident report or complaint with a law enforcement agency about |
| 154 | the unlawful use of the victim's identifying information by |
| 155 | another person. A consumer reporting agency may charge a |
| 156 | reasonable fee, not to exceed $10, to a consumer who elects to |
| 157 | place, remove, or temporarily lift a security freeze on his or |
| 158 | her consumer report. A consumer may be charged a reasonable fee, |
| 159 | not to exceed $10, if the consumer fails to retain the original |
| 160 | personal identification number or password provided by the |
| 161 | consumer reporting agency, and the agency must reissue the |
| 162 | personal identification number or password or provide a new |
| 163 | personal identification number or password to the consumer. |
| 164 | (14) If a security freeze is in effect, a consumer |
| 165 | reporting agency shall not change any of the following official |
| 166 | information in a consumer report without sending a written |
| 167 | confirmation of the change to the consumer within 30 days after |
| 168 | the change is posted to the consumer's file: |
| 169 | (a) Name. |
| 170 | (b) Address. |
| 171 | (c) Date of birth. |
| 172 | (d) Social security number. |
| 173 |
|
| 174 | Written confirmation is not required for technical corrections |
| 175 | of a consumer's official information, including name and street |
| 176 | abbreviations, complete spellings, or transposition of numbers |
| 177 | or letters. In the case of an address change, the written |
| 178 | confirmation shall be sent to both the new address and the |
| 179 | former address. |
| 180 | (15) The provisions of this section do not apply to the |
| 181 | following entities: |
| 182 | (a) A check services company, which issues authorizations |
| 183 | for the purpose of approving or processing negotiable |
| 184 | instruments, electronic funds transfers, or similar methods of |
| 185 | payment. |
| 186 | (b) A demand deposit account information service company, |
| 187 | which issues reports regarding account closures due to fraud, |
| 188 | substantial overdrafts, automatic teller machine abuse, or |
| 189 | similar negative information regarding a consumer to inquiring |
| 190 | banks or other financial institutions for use only in reviewing |
| 191 | a consumer request for a demand deposit account at the inquiring |
| 192 | bank or financial institution, as defined in s. 655.005(1)(g) or |
| 193 | (h), or in federal law. |
| 194 | (c) A consumer reporting agency that acts only as a |
| 195 | reseller of credit information by assembling and merging |
| 196 | information contained in the database of another consumer |
| 197 | reporting agency or multiple consumer reporting agencies and |
| 198 | does not maintain a permanent database of credit information |
| 199 | from which new consumer reports are produced. However, a |
| 200 | consumer reporting agency shall honor any security freeze placed |
| 201 | on a consumer report by another consumer reporting agency. |
| 202 | (d) A fraud prevention services company issuing reports to |
| 203 | prevent or investigate fraud. |
| 204 | (16) In addition to any other penalties or remedies |
| 205 | provided under law, a person who is aggrieved by a violation of |
| 206 | the provisions of this section may bring a civil action as |
| 207 | authorized by this subsection. |
| 208 | (a) Any person who willfully fails to comply with any |
| 209 | requirement imposed under this section with respect to any |
| 210 | consumer is liable to that consumer for actual damages sustained |
| 211 | by the consumer as a result of the failure of not less than $100 |
| 212 | and not more than $1,000, plus the cost of the action together |
| 213 | with reasonable attorney's fees. |
| 214 | (b) Any individual who obtains a consumer report under |
| 215 | false pretenses or knowingly without a permissible purpose is |
| 216 | liable to the consumer for actual damages sustained by the |
| 217 | consumer as a result of the failure or damages of not less than |
| 218 | $100 and not more than $1,000, whichever is greater. Any person |
| 219 | who obtains a consumer report from a consumer reporting agency |
| 220 | under false pretenses or knowingly without a permissible purpose |
| 221 | is liable to the consumer reporting agency for actual damages |
| 222 | sustained by the consumer reporting agency or $1,000, whichever |
| 223 | is greater. |
| 224 | (c) Punitive damages may be assessed for willful |
| 225 | violations of this section. |
| 226 | (d) Any person who is negligent in failing to comply with |
| 227 | any requirement imposed under this section with respect to any |
| 228 | consumer is liable to that consumer for any actual damages |
| 229 | sustained by the consumer as a result of the failure of not less |
| 230 | than $100 and not more than $1,000. |
| 231 | (e) Upon a finding by the court that an unsuccessful |
| 232 | pleading, motion, or other paper filed in connection with an |
| 233 | action under this subsection was filed in bad faith or for |
| 234 | purposes of harassment, the court shall award to the prevailing |
| 235 | party attorney's fees that are reasonable in relation to the |
| 236 | work performed in responding to the pleading, motion, or other |
| 237 | paper. |
| 238 | (17) Any written disclosure by a consumer reporting |
| 239 | agency, pursuant to 15 U.S.C. s. 1681g, to any consumer residing |
| 240 | in this state shall include a written summary of all rights the |
| 241 | consumer has under this section, and, in the case of a consumer |
| 242 | reporting agency which compiles and maintains consumer reports |
| 243 | on a nationwide basis, a toll-free telephone number which the |
| 244 | consumer can use to communicate with the consumer reporting |
| 245 | agency. The information set forth in paragraph (b) of the |
| 246 | written summary of rights must be in at least 14-point boldface |
| 247 | type in capital letters. The written summary of rights required |
| 248 | under this section is sufficient if it is substantially in the |
| 249 | following form: |
| 250 | (a) You have a right to place a "security freeze" on your |
| 251 | consumer report, which will prohibit a consumer reporting agency |
| 252 | from releasing any information in your consumer report without |
| 253 | your express authorization. A security freeze must be requested |
| 254 | in writing by certified mail to a consumer reporting agency. The |
| 255 | security freeze is designed to prevent credit, loans, and |
| 256 | services from being approved in your name without your consent. |
| 257 | (b) YOU SHOULD BE AWARE THAT USING A SECURITY FREEZE TO |
| 258 | CONTROL ACCESS TO THE PERSONAL AND FINANCIAL INFORMATION IN YOUR |
| 259 | CONSUMER REPORT MAY DELAY, INTERFERE WITH, OR PROHIBIT THE |
| 260 | TIMELY APPROVAL OF ANY SUBSEQUENT REQUEST OR APPLICATION YOU |
| 261 | MAKE REGARDING A NEW LOAN, CREDIT, MORTGAGE, INSURANCE, |
| 262 | GOVERNMENT SERVICES OR PAYMENTS, RENTAL HOUSING, EMPLOYMENT, |
| 263 | INVESTMENT, LICENSE, CELLULAR PHONE, UTILITIES, DIGITAL |
| 264 | SIGNATURE, INTERNET CREDIT CARD TRANSACTION, OR OTHER SERVICES, |
| 265 | INCLUDING AN EXTENSION OF CREDIT AT POINT OF SALE. |
| 266 | (c) When you place a security freeze on your consumer |
| 267 | report, you will be provided a personal identification number or |
| 268 | password to use if you choose to remove the freeze on your |
| 269 | consumer report or authorize the release of your consumer report |
| 270 | for a designated period of time after the security freeze is in |
| 271 | place. To provide that authorization, you must contact the |
| 272 | consumer reporting agency and provide all of the following: |
| 273 | 1. The personal identification number or password. |
| 274 | 2. Proper identification to verify your identity. |
| 275 | 3. Information specifying the period of time for which the |
| 276 | report shall be made available. |
| 277 | (d) A consumer reporting agency must authorize the release |
| 278 | of your consumer report no later than 3 business days after |
| 279 | receiving the above information. |
| 280 | (e) A security freeze does not apply to a person or |
| 281 | entity, or its affiliates, or collection agencies acting on |
| 282 | behalf of the person or entity, with which you have an existing |
| 283 | account, that requests information in your consumer report for |
| 284 | the purposes of reviewing or collecting the account. Reviewing |
| 285 | the account includes activities related to account maintenance, |
| 286 | monitoring, credit line increases, and account upgrades and |
| 287 | enhancements. |
| 288 | (f) You have the right to bring a civil action against |
| 289 | anyone, including a consumer reporting agency, who fails to |
| 290 | comply with the provisions of s. 501.005, Florida Statutes, |
| 291 | which governs the placing of a consumer report security freeze |
| 292 | on your consumer report. |
| 293 | Section 2. This act shall take effect July 1, 2006. |