HB 0037

CS

CHAMBER ACTION

1	The Commerce Council recommends the following:
2
3	Council/Committee Substitute
4	Remove the entire bill and insert:
5
6	A bill to be entitled
7	An act relating to security of consumer report
8	information; creating s. 501.005, F.S.; defining "security
9	freeze"; authorizing a consumer to place a security freeze
10	on his or her consumer report; providing procedures and
11	requirements with respect to the placement, temporary
12	suspension, and removal of a security freeze on a consumer
13	report; authorizing a consumer to allow specified
14	temporary access to his or her consumer report during a
15	security freeze; providing procedures with respect to such
16	temporary access; providing for removal of a security
17	freeze when a consumer report was frozen due to a material
18	misrepresentation of fact by the consumer; providing
19	applicability; prohibiting a consumer reporting agency
20	from charging a fee to a victim of identity theft who
21	requests a security freeze on a consumer report;
22	authorizing consumer reporting agencies to charge a fee to
23	place, remove, or temporarily lift a security freeze and
24	to reissue a personal identification number; restricting
25	the change of specified information in a consumer report
26	when a security freeze is in effect; specifying
27	applicability with respect to certain consumer reporting
28	agencies; specifying entities that are exempt from placing
29	a security freeze on a consumer report; providing for
30	civil remedy; providing requirements with respect to
31	written disclosure by a consumer reporting agency of
32	procedures and consumer rights associated with a security
33	freeze; providing an effective date.
34
35	Be It Enacted by the Legislature of the State of Florida:
36
37	Section 1.  Section 501.005, Florida Statutes, is created
38	to read:
39	501.005  Consumer report security freeze.--
40	(1)  For purposes of this section, a "security freeze"
41	means a notice placed in a consumer report that prohibits a
42	consumer reporting agency, as defined in 15 U.S.C. s. 1681a(f),
43	from releasing the consumer report, credit score, or any
44	information contained within the consumer report relating to the
45	extension of credit to a third party without the express
46	authorization of the consumer. This section does not prevent a
47	consumer reporting agency from advising a third party that a
48	security freeze is in effect with respect to the consumer
49	report. For purposes of this part, the term "consumer report"
50	has the same meaning set forth in 15 U.S.C. s. 1681a(d).
51	(2)  A consumer may place a security freeze on his or her
52	consumer report by:
53	(a)  Making a request in writing by certified mail to a
54	consumer reporting agency.
55	(b)  Including information that properly identifies the
56	consumer.
57	(c)  Paying a fee authorized under this section.
58	(3)  A consumer reporting agency shall place a security
59	freeze on a consumer report no later than 5 business days after
60	receiving a request from the consumer.
61	(4)  The consumer reporting agency shall send a written
62	confirmation of the security freeze to the consumer within 10
63	business days after instituting the security freeze and shall
64	provide the consumer with a unique personal identification
65	number or password to be used by the consumer when providing
66	authorization for the removal of a security freeze on his or her
67	consumer report pursuant to subsection (5) or subsection (11).
68	(5)  A consumer may allow his or her consumer report to be
69	accessed for a designated period of time while a security freeze
70	is in effect by contacting the consumer reporting agency and
71	requesting that the freeze be temporarily lifted. The consumer
72	must provide the following information to the consumer reporting
73	agency as part of the request:
74	(a)  Proper identification as determined by the consumer
75	reporting agency.
76	(b)  The unique personal identification number or password
77	provided by the consumer reporting agency pursuant to subsection
78	(4).
79	(c)  Information specifying the period of time for which
80	the report shall be made available.
81	(d)  Payment of a fee authorized by this section.
82	(6)  A consumer reporting agency that receives a request
83	from a consumer to temporarily lift a freeze on a consumer
84	report pursuant to subsection (5) shall comply with the request
85	no later than 3 business days after receiving the request.
86	(7)  A consumer reporting agency doing business in this
87	state shall develop telephonic communication or any form of
88	secure electronic media to receive and process a request from a
89	consumer pursuant to subsection (5).
90	(8)  A consumer reporting agency shall temporarily lift or
91	remove a security freeze placed on a consumer report only in the
92	following instances:
93	(a)  Upon consumer request, pursuant to subsection (5) or
94	subsection (11).
95	(b)  If the consumer report was frozen due to a material
96	misrepresentation of fact by the consumer. If a consumer
97	reporting agency intends to remove a security freeze on a
98	consumer report pursuant to this paragraph, the consumer
99	reporting agency shall notify the consumer in writing prior to
100	removing the security freeze.
101	(9)  A third party requesting access to a consumer report
102	on which a security freeze is in effect in connection with an
103	application for credit or other permissible use may treat the
104	application as incomplete if the consumer has not authorized a
105	temporary lifting of the security freeze for the period of time
106	during which the request is made.
107	(10)  If a consumer requests a security freeze, the
108	consumer reporting agency shall disclose to the consumer all
109	information relevant to the process of instituting, temporarily
110	lifting, and removing a security freeze and shall include the
111	disclosure required by subsection (17).
112	(11)  A security freeze shall remain in place until the
113	consumer requests that it be removed. A consumer reporting
114	agency shall remove a security freeze within 3 business days
115	after receiving a request for removal from the consumer, who,
116	upon making the request for removal, must provide the following:
117	(a)  Proper identification as determined by the consumer
118	reporting agency.
119	(b)  The unique personal identification number or password
120	provided by the consumer reporting agency pursuant to subsection
121	(4).
122	(c)  Payment of a fee authorized by this section.
123	(12)  The provisions of this section do not apply to the
124	use of a consumer report by the following persons or for the
125	following reasons:
126	(a)  A person to whom the consumer owes a financial
127	obligation or a subsidiary, affiliate, or agent of the person,
128	or an assignee of a financial obligation owed by the consumer to
129	the person, or a prospective assignee of a financial obligation
130	owed by the consumer to the person in conjunction with the
131	proposed purchase of the financial obligation, with which the
132	consumer has or had prior to assignment an account or contract,
133	including a deposit account, or to whom the consumer issued a
134	negotiable instrument, for the purposes of reviewing the account
135	or collecting the financial obligation owed for the account,
136	contract, or negotiable instrument. For purposes of this
137	paragraph, "reviewing the account" includes activities related
138	to account maintenance, monitoring, credit line increases, and
139	account upgrades and enhancements.
140	(b)  A subsidiary, affiliate, agent, assignee, or
141	prospective assignee of a person to whom access has been granted
142	under this section for purposes of facilitating the extension of
143	credit or other permissible use.
144	(c)  A state agency acting within its lawful investigative
145	or regulatory authority.
146	(d)  A state or local law enforcement agency acting to
147	investigate a crime or conducting a criminal background check.
148	(e)  Any person administering a credit file monitoring
149	subscription service to which the consumer has subscribed.
150	(f)  Any person for the purpose of providing a consumer
151	with a copy of the consumer report upon the consumer's request.
152	(g)  Pursuant to a court order lawfully entered.
153	(h)  The use of credit information for the purposes of
154	prescreening as provided for by the federal Fair Credit
155	Reporting Act.
156	(i)  Any person in connection with the underwriting of
157	insurance.
158	(13)  A consumer reporting agency shall not charge any fee
159	to a victim of identity theft who has submitted, at the time the
160	security freeze is requested, a copy of a valid investigative or
161	incident report or complaint with a law enforcement agency about
162	the unlawful use of the victim's identifying information by
163	another person. A consumer reporting agency may charge a
164	reasonable fee, not to exceed $10, to a consumer who elects to
165	place, remove, or temporarily lift a security freeze on his or
166	her consumer report. A consumer may be charged a reasonable fee,
167	not to exceed $10, if the consumer fails to retain the original
168	personal identification number or password provided by the
169	consumer reporting agency, and the agency must reissue the
170	personal identification number or password or provide a new
171	personal identification number or password to the consumer.
172	(14)  If a security freeze is in effect, a consumer
173	reporting agency shall not change any of the following official
174	information in a consumer report without sending a written
175	confirmation of the change to the consumer within 30 days after
176	the change is posted to the consumer's file:
177	(a)  Name.
178	(b)  Address.
179	(c)  Date of birth.
180	(d)  Social security number.
181
182	Written confirmation is not required for technical corrections
183	of a consumer's official information, including name and street
184	abbreviations, complete spellings, or transposition of numbers
185	or letters. In the case of an address change, the written
186	confirmation shall be sent to both the new address and the
187	former address.
188	(15)  The provisions of this section do not apply to the
189	following entities:
190	(a)  A check services company, which issues authorizations
191	for the purpose of approving or processing negotiable
192	instruments, electronic funds transfers, or similar methods of
193	payment.
194	(b)  A deposit account information service company, which
195	issues reports regarding account closures due to fraud,
196	substantial overdrafts, automatic teller machine abuse, or
197	similar negative information regarding a consumer to inquiring
198	banks or other financial institutions for use only in reviewing
199	a consumer request for a deposit account at the inquiring bank
200	or financial institution, as defined in s. 655.005(1)(g) or (h),
201	or in federal law.
202	(c)  A consumer reporting agency that acts only as a
203	reseller of credit information by assembling and merging
204	information contained in the database of another consumer
205	reporting agency or multiple consumer reporting agencies and
206	does not maintain a permanent database of credit information
207	from which new consumer reports are produced. However, a
208	consumer reporting agency shall honor any security freeze placed
209	on a consumer report by another consumer reporting agency.
210	(d)  A fraud prevention services company issuing reports to
211	prevent or investigate fraud.
212	(16)  In addition to any other penalties or remedies
213	provided under law, a person who is aggrieved by a violation of
214	the provisions of this section may bring a civil action as
215	authorized by this subsection.
216	(a)  Any person who willfully fails to comply with any
217	requirement imposed under this section with respect to any
218	consumer is liable to that consumer for actual damages sustained
219	by the consumer as a result of the failure of not less than $100
220	and not more than $1,000, plus the cost of the action together
221	with reasonable attorney's fees.
222	(b)  Any individual who obtains a consumer report under
223	false pretenses or knowingly without a permissible purpose is
224	liable to the consumer for actual damages sustained by the
225	consumer as a result of the failure or damages of not less than
226	$100 and not more than $1,000, whichever is greater. Any person
227	who obtains a consumer report from a consumer reporting agency
228	under false pretenses or knowingly without a permissible purpose
229	is liable to the consumer reporting agency for actual damages
230	sustained by the consumer reporting agency or $1,000, whichever
231	is greater.
232	(c)  Punitive damages may be assessed for willful
233	violations of this section.
234	(d)  Any person who is negligent in failing to comply with
235	any requirement imposed under this section with respect to any
236	consumer is liable to that consumer for any actual damages
237	sustained by the consumer as a result of the failure of not less
238	than $100 and not more than $1,000.
239	(e)  Upon a finding by the court that an unsuccessful
240	pleading, motion, or other paper filed in connection with an
241	action under this subsection was filed in bad faith or for
242	purposes of harassment, the court shall award to the prevailing
243	party attorney's fees that are reasonable in relation to the
244	work performed in responding to the pleading, motion, or other
245	paper.
246	(17)  Any written disclosure by a consumer reporting
247	agency, pursuant to 15 U.S.C. s. 1681g, to any consumer residing
248	in this state shall include a written summary of all rights the
249	consumer has under this section, and, in the case of a consumer
250	reporting agency which compiles and maintains consumer reports
251	on a nationwide basis, a toll-free telephone number which the
252	consumer can use to communicate with the consumer reporting
253	agency. The information set forth in paragraph (b) of the
254	written summary of rights must be in at least 14-point boldface
255	type in capital letters. The written summary of rights required
256	under this section is sufficient if it is substantially in the
257	following form:
258	(a)  You have a right to place a "security freeze" on your
259	consumer report, which will prohibit a consumer reporting agency
260	from releasing any information in your consumer report without
261	your express authorization. A security freeze must be requested
262	in writing by certified mail to a consumer reporting agency. The
263	security freeze is designed to prevent credit, loans, and
264	services from being approved in your name without your consent.
265	(b)  YOU SHOULD BE AWARE THAT USING A SECURITY FREEZE TO
266	CONTROL ACCESS TO THE PERSONAL AND FINANCIAL INFORMATION IN YOUR
267	CONSUMER REPORT MAY DELAY, INTERFERE WITH, OR PROHIBIT THE
268	TIMELY APPROVAL OF ANY SUBSEQUENT REQUEST OR APPLICATION YOU
269	MAKE REGARDING A NEW LOAN, CREDIT, MORTGAGE, INSURANCE,
270	GOVERNMENT SERVICES OR PAYMENTS, RENTAL HOUSING, EMPLOYMENT,
271	INVESTMENT, LICENSE, CELLULAR PHONE, UTILITIES, DIGITAL
272	SIGNATURE, INTERNET CREDIT CARD TRANSACTION, OR OTHER SERVICES,
273	INCLUDING AN EXTENSION OF CREDIT AT POINT OF SALE.
274	(c)  When you place a security freeze on your consumer
275	report, you will be provided a personal identification number or
276	password to use if you choose to remove the freeze on your
277	consumer report or authorize the release of your consumer report
278	for a designated period of time after the security freeze is in
279	place. To provide that authorization, you must contact the
280	consumer reporting agency and provide all of the following:
281	1.  The personal identification number or password.
282	2.  Proper identification to verify your identity.
283	3.  Information specifying the period of time for which the
284	report shall be made available.
285	4.  Payment of a fee authorized by this section.
286	(d)  A consumer reporting agency must authorize the release
287	of your consumer report no later than 3 business days after
288	receiving the above information.
289	(e)  A security freeze does not apply to a person or
290	entity, or its affiliates, or collection agencies acting on
291	behalf of the person or entity, with which you have an existing
292	account, that requests information in your consumer report for
293	the purposes of reviewing or collecting the account. Reviewing
294	the account includes activities related to account maintenance,
295	monitoring, credit line increases, and account upgrades and
296	enhancements.
297	(f)  You have the right to bring a civil action against
298	anyone, including a consumer reporting agency, who fails to
299	comply with the provisions of s. 501.005, Florida Statutes,
300	which governs the placing of a consumer report security freeze
301	on your consumer report.
302	Section 2.  This act shall take effect July 1, 2006.

CODING: Words stricken are deletions; words underlined are additions.