HB 37

1	A bill to be entitled
2	An act relating to security of consumer report
3	information; creating s. 501.005, F.S.; defining "security
4	freeze"; authorizing a consumer to place a security freeze
5	on his or her consumer report; providing procedures and
6	requirements with respect to the placement, temporary
7	suspension, and removal of a security freeze on a consumer
8	report; authorizing a consumer to allow specified
9	temporary access to his or her consumer report during a
10	security freeze; providing procedures with respect to such
11	temporary access; providing for removal of a security
12	freeze when a consumer report was frozen due to a material
13	misrepresentation of fact by the consumer; providing
14	applicability; authorizing a consumer reporting agency to
15	charge a fee to place, remove, or temporarily lift a
16	security freeze; prohibiting a consumer reporting agency
17	from charging a fee to specified persons; authorizing the
18	charging of a fee for the reissuance of a personal
19	identification number; restricting the change of specified
20	information in a consumer report when a security freeze is
21	in effect; specifying applicability with respect to
22	certain consumer reporting agencies; specifying entities
23	that are exempt from placing a security freeze on a
24	consumer report; providing for civil remedy; providing
25	requirements with respect to written disclosure by a
26	consumer reporting agency of procedures and consumer
27	rights associated with a security freeze; providing an
28	effective date.
29
30	Be It Enacted by the Legislature of the State of Florida:
31
32	Section 1.  Section 501.005, Florida Statutes, is created
33	to read:
34	501.005  Consumer report security freeze.--
35	(1)  For purposes of this section, a "security freeze"
36	means a notice placed in a consumer report that prohibits a
37	consumer reporting agency, as defined in 15 U.S.C. s. 1681a(f),
38	from releasing the consumer report, credit score, or any
39	information contained within the consumer report to a third
40	party without the express authorization of the consumer. This
41	section does not prevent a consumer reporting agency from
42	advising a third party that a security freeze is in effect with
43	respect to the consumer report. For purposes of this part, the
44	term "consumer report" has the same meaning set forth in 15
45	U.S.C. s. 1681a(d).
46	(2)  A consumer may place a security freeze on his or her
47	consumer report by:
48	(a)  Making a request in writing by certified mail to a
49	consumer reporting agency.
50	(b)  Including information that properly identifies the
51	consumer.
52	(c)  Paying a fee authorized under this section.
53	(3)  A consumer reporting agency shall place a security
54	freeze on a consumer report no later than 5 business days after
55	receiving a request from the consumer.
56	(4)  The consumer reporting agency shall send a written
57	confirmation of the security freeze to the consumer within 10
58	business days after instituting the security freeze and shall
59	provide the consumer with a unique personal identification
60	number or password to be used by the consumer when providing
61	authorization for the removal of a security freeze on his or her
62	consumer report pursuant to subsection (5) or subsection (11).
63	(5)  A consumer may allow his or her consumer report to be
64	accessed for a designated period of time while a security freeze
65	is in effect by contacting the consumer reporting agency and
66	requesting that the freeze be temporarily lifted. The consumer
67	must provide the following information to the consumer reporting
68	agency as part of the request:
69	(a)  Proper identification as determined by the consumer
70	reporting agency.
71	(b)  The unique personal identification number or password
72	provided by the consumer reporting agency pursuant to subsection
73	(4).
74	(c)  Information specifying the period of time for which
75	the report shall be made available.
76	(d)  Payment of a fee authorized by this section.
77	(6)  A consumer reporting agency that receives a request
78	from a consumer to temporarily lift a freeze on a consumer
79	report pursuant to subsection (5) shall comply with the request
80	no later than 3 business days after receiving the request.
81	(7)  No later than July 1, 2007, a consumer reporting
82	agency doing business in this state shall select and develop a
83	secure electronic contact method, which may include the use of
84	telephone, fax, the Internet, or other secure electronic means,
85	by which to receive and process requests from consumers to
86	temporarily lift a freeze on a consumer report pursuant to
87	subsection (5).
88	(8)  A consumer reporting agency shall temporarily lift or
89	remove a security freeze placed on a consumer report only in the
90	following instances:
91	(a)  Upon consumer request, pursuant to subsection (5) or
92	subsection (11).
93	(b)  If the consumer report was frozen due to a material
94	misrepresentation of fact by the consumer. If a consumer
95	reporting agency intends to remove a security freeze on a
96	consumer report pursuant to this paragraph, the consumer
97	reporting agency shall notify the consumer in writing prior to
98	removing the security freeze.
99	(9)  A third party requesting access to a consumer report
100	on which a security freeze is in effect in connection with an
101	application for credit or other permissible use may treat the
102	application as incomplete if the consumer has not authorized a
103	temporary lifting of the security freeze for the period of time
104	during which the request is made.
105	(10)  If a consumer requests a security freeze, the
106	consumer reporting agency shall disclose to the consumer all
107	information relevant to the process of instituting, temporarily
108	lifting, and removing a security freeze and shall include the
109	disclosure required by subsection (17).
110	(11)  A security freeze shall remain in place until the
111	consumer requests that it be removed. A consumer reporting
112	agency shall remove a security freeze within 3 business days
113	after receiving a request for removal from the consumer, who,
114	upon making the request for removal, must provide the following:
115	(a)  Proper identification as determined by the consumer
116	reporting agency.
117	(b)  The unique personal identification number or password
118	provided by the consumer reporting agency pursuant to subsection
119	(4).
120	(c)  Payment of a fee authorized by this section.
121	(12)  The provisions of this section do not apply to the
122	use of a consumer report by the following persons or for the
123	following reasons:
124	(a)  A person to whom the consumer owes a financial
125	obligation or a subsidiary, affiliate, or agent of the person,
126	or an assignee of a financial obligation owed by the consumer to
127	the person, or a prospective assignee of a financial obligation
128	owed by the consumer to the person in conjunction with the
129	proposed purchase of the financial obligation, with which the
130	consumer has or had prior to assignment an account or contract,
131	including a deposit account, or to whom the consumer issued a
132	negotiable instrument, for the purposes of reviewing the account
133	or collecting the financial obligation owed for the account,
134	contract, or negotiable instrument. For purposes of this
135	paragraph, "reviewing the account" includes activities related
136	to account maintenance, monitoring, credit line increases, and
137	account upgrades and enhancements.
138	(b)  A subsidiary, affiliate, agent, assignee, or
139	prospective assignee of a person to whom access has been granted
140	under this section for purposes of facilitating the extension of
141	credit or other permissible use.
142	(c)  A state agency acting within its lawful investigative
143	or regulatory authority.
144	(d)  A state or local law enforcement agency acting to
145	investigate a crime or conducting a criminal background check.
146	(e)  Any person administering a credit file monitoring
147	subscription service to which the consumer has subscribed.
148	(f)  Any person for the purpose of providing a consumer
149	with a copy of the consumer report upon the consumer's request.
150	(g)  Pursuant to a court order lawfully entered.
151	(h)  The use of credit information for the purposes of
152	prescreening as provided for by the federal Fair Credit
153	Reporting Act.
154	(i)  Any insurance company for use in setting or adjusting
155	a rate, adjusting a claim, or underwriting for insurance
156	purposes.
157	(j)  A consumer reporting agency's database or file which
158	consists entirely of information concerning, and is used solely
159	for, one or more of the following:
160	1.  Criminal record information.
161	2.  Personal loss history information.
162	3.  Fraud prevention or detection.
163	4.  Tenant screening.
164	5.  Employment screening.
165	(13)(a)  A consumer reporting agency may charge a
166	reasonable fee, not to exceed $10, to a consumer who elects to
167	place, remove, or temporarily lift a security freeze on his or
168	her consumer report.
169	(b)  A consumer reporting agency shall not charge any fee:
170	1.  To a consumer 65 years of age or older for the initial
171	placement or removal of a security freeze; or
172	2.  To a victim of identity theft who has submitted, at the
173	time the security freeze is requested, a copy of a valid
174	investigative or incident report or complaint with a law
175	enforcement agency about the unlawful use of the victim's
176	identifying information by another person.
177	(c)  A consumer reporting agency may charge a reasonable
178	fee, not to exceed $10, if the consumer fails to retain the
179	original personal identification number or password provided by
180	the consumer reporting agency and the agency must reissue the
181	personal identification number or password or provide a new
182	personal identification number or password to the consumer.
183	(14)  If a security freeze is in effect, a consumer
184	reporting agency shall not change any of the following official
185	information in a consumer report without sending a written
186	confirmation of the change to the consumer within 30 days after
187	the change is posted to the consumer's file:
188	(a)  Name.
189	(b)  Address.
190	(c)  Date of birth.
191	(d)  Social security number.
192
193	Written confirmation is not required for technical corrections
194	of a consumer's official information, including name and street
195	abbreviations, complete spellings, or transposition of numbers
196	or letters. In the case of an address change, the written
197	confirmation shall be sent to both the new address and the
198	former address.
199	(15)  The provisions of this section do not apply to the
200	following entities:
201	(a)  A check services company, which issues authorizations
202	for the purpose of approving or processing negotiable
203	instruments, electronic funds transfers, or similar methods of
204	payment.
205	(b)  A deposit account information service company, which
206	issues reports regarding account closures due to fraud,
207	substantial overdrafts, automatic teller machine abuse, or
208	similar negative information regarding a consumer to inquiring
209	banks or other financial institutions for use only in reviewing
210	a consumer request for a deposit account at the inquiring bank
211	or financial institution, as defined in s. 655.005(1)(g) or (h),
212	or in federal law.
213	(c)  A consumer reporting agency that acts only as a
214	reseller of credit information by assembling and merging
215	information contained in the database of another consumer
216	reporting agency or multiple consumer reporting agencies and
217	does not maintain a permanent database of credit information
218	from which new consumer reports are produced. However, a
219	consumer reporting agency shall honor any security freeze
220	placed, removed, or temporary lifted on a consumer report by
221	another consumer reporting agency.
222	(d)  A fraud prevention services company issuing reports to
223	prevent or investigate fraud.
224	(16)  In addition to any other penalties or remedies
225	provided under law, a person who is aggrieved by a violation of
226	the provisions of this section may bring a civil action as
227	authorized by this subsection.
228	(a)  Any person who willfully fails to comply with any
229	requirement imposed under this section with respect to any
230	consumer is liable to that consumer for actual damages sustained
231	by the consumer as a result of the failure of not less than $100
232	and not more than $1,000, plus the cost of the action together
233	with reasonable attorney's fees.
234	(b)  Any individual who obtains a consumer report under
235	false pretenses or knowingly without a permissible purpose is
236	liable to the consumer for actual damages sustained by the
237	consumer as a result of the failure or damages of not less than
238	$100 and not more than $1,000, whichever is greater. Any person
239	who obtains a consumer report from a consumer reporting agency
240	under false pretenses or knowingly without a permissible purpose
241	is liable to the consumer reporting agency for actual damages
242	sustained by the consumer reporting agency or $1,000, whichever
243	is greater.
244	(c)  Punitive damages may be assessed for willful
245	violations of this section.
246	(d)  Any person who is negligent in failing to comply with
247	any requirement imposed under this section with respect to any
248	consumer is liable to that consumer for any actual damages
249	sustained by the consumer as a result of the failure of not less
250	than $100 and not more than $1,000.
251	(e)  Upon a finding by the court that an unsuccessful
252	pleading, motion, or other paper filed in connection with an
253	action under this subsection was filed in bad faith or for
254	purposes of harassment, the court shall award to the prevailing
255	party attorney's fees that are reasonable in relation to the
256	work performed in responding to the pleading, motion, or other
257	paper.
258	(17)  Any written disclosure by a consumer reporting
259	agency, pursuant to 15 U.S.C. s. 1681g, to any consumer residing
260	in this state shall include a written summary of all rights the
261	consumer has under this section, and, in the case of a consumer
262	reporting agency which compiles and maintains consumer reports
263	on a nationwide basis, a toll-free telephone number which the
264	consumer can use to communicate with the consumer reporting
265	agency. The information set forth in paragraph (b) of the
266	written summary of rights must be in at least 12-point boldface
267	type. The written summary of rights required under this section
268	is sufficient if it is substantially in the following form:
269	(a)  You have a right to place a "security freeze" on your
270	consumer report, which will prohibit a consumer reporting agency
271	from releasing any information in your consumer report without
272	your express authorization. A security freeze must be requested
273	in writing by certified mail to a consumer reporting agency. The
274	security freeze is designed to prevent credit, loans, and
275	services from being approved in your name without your consent.
276	(b)  YOU SHOULD BE AWARE THAT USING A SECURITY FREEZE TO
277	CONTROL ACCESS TO THE PERSONAL AND FINANCIAL INFORMATION IN YOUR
278	CONSUMER REPORT MAY DELAY, INTERFERE WITH, OR PROHIBIT THE
279	TIMELY APPROVAL OF ANY SUBSEQUENT REQUEST OR APPLICATION YOU
280	MAKE REGARDING A NEW LOAN, CREDIT, MORTGAGE, INSURANCE,
281	GOVERNMENT SERVICES OR PAYMENTS, RENTAL HOUSING, EMPLOYMENT,
282	INVESTMENT, LICENSE, CELLULAR PHONE, UTILITIES, DIGITAL
283	SIGNATURE, INTERNET CREDIT CARD TRANSACTION, OR OTHER SERVICES,
284	INCLUDING AN EXTENSION OF CREDIT AT POINT OF SALE.
285	(c)  When you place a security freeze on your consumer
286	report, you will be provided a personal identification number or
287	password to use if you choose to remove the freeze on your
288	consumer report or authorize the release of your consumer report
289	for a designated period of time after the security freeze is in
290	place. To provide that authorization, you must contact the
291	consumer reporting agency and provide all of the following:
292	1.  The personal identification number or password.
293	2.  Proper identification to verify your identity.
294	3.  Information specifying the period of time for which the
295	report shall be made available.
296	4.  Payment of a fee authorized by this section.
297	(d)  A consumer reporting agency must authorize the release
298	of your consumer report no later than 3 business days after
299	receiving the above information.
300	(e)  A security freeze does not apply to a person or
301	entity, or its affiliates, or collection agencies acting on
302	behalf of the person or entity, with which you have an existing
303	account, that requests information in your consumer report for
304	the purposes of reviewing or collecting the account. Reviewing
305	the account includes activities related to account maintenance,
306	monitoring, credit line increases, and account upgrades and
307	enhancements.
308	(f)  You have the right to bring a civil action against
309	anyone, including a consumer reporting agency, who fails to
310	comply with the provisions of s. 501.005, Florida Statutes,
311	which governs the placing of a consumer report security freeze
312	on your consumer report.
313	Section 2.  This act shall take effect July 1, 2006.

CODING: Words stricken are deletions; words underlined are additions.