Florida Senate - 2013 SB 566
By Senator Detert
28-00625A-13 2013566__
1 A bill to be entitled
2 An act relating to security of protected consumer
3 information; creating s. 501.0051, F.S.; providing
4 definitions; authorizing the representative of a
5 protected consumer to place a security freeze on the
6 protected consumer’s consumer record; requiring a
7 consumer reporting agency to establish a record if the
8 protected consumer does not have an existing consumer
9 report; requiring a consumer reporting agency to
10 provide written confirmation of a security freeze
11 within a specified period; prohibiting a consumer
12 reporting agency from stating or implying that a
13 security freeze reflects a negative credit history or
14 rating; requiring a consumer reporting agency to
15 remove a security freeze under specified conditions;
16 providing for applicability; authorizing a consumer
17 reporting agency to charge a fee for placing or
18 removing a security freeze and for reissuing personal
19 identification information; prohibiting a fee under
20 certain circumstances; requiring written notification
21 to change specified information in a protected
22 consumer’s record; providing exemptions; requiring a
23 consumer reporting agency to notify a representative
24 and provide specified information if the consumer
25 reporting agency violates a security freeze; providing
26 penalties and civil remedies; amending s. 501.005,
27 F.S.; revising written disclosure requirements for
28 consumer reporting agencies pertaining to consumer
29 rights associated with a security freeze; conforming a
30 cross-reference; providing an effective date.
31
32 Be It Enacted by the Legislature of the State of Florida:
33
34 Section 1. Section 501.0051, Florida Statutes, is created
35 to read:
36 501.0051 Protected consumer security freeze.—
37 (1) As used in this section, the term:
38 (a) “Consumer reporting agency” has the same meaning as
39 provided in 15 U.S.C. s. 1681a(f).
40 (b) “Consumer report” has the same meaning as provided in
41 15 U.S.C. s. 1681a(d).
42 (c) “Protected consumer” means a person younger than 16
43 years of age at the time a security freeze request is made or a
44 person represented by a guardian or other advocate pursuant to
45 chapter 39, chapter 393, or chapter 744.
46 (d) “Record” means a compilation of information that:
47 1. Identifies a protected consumer;
48 2. Is created by a consumer reporting agency exclusively
49 for the purpose of complying with this section; and
50 3. May not be created or used to consider the protected
51 consumer’s credit worthiness, credit standing, credit capacity,
52 character, general reputation, personal characteristics, or
53 eligibility for other financial services.
54 (e) “Representative” means the custodial parent or legal
55 guardian of a protected consumer, including a guardian appointed
56 pursuant to s. 914.17.
57 (f) “Security freeze” means:
58 1. A notice that is placed on the protected consumer’s
59 consumer report that prohibits a consumer reporting agency from
60 releasing the consumer report, credit score, or any information
61 contained within the consumer report to a third party without
62 the express authorization of the representative; or
63 2. A notice that is placed on the protected consumer’s
64 record that prohibits the consumer reporting agency from
65 releasing the protected consumer’s record except as provided in
66 this section, if a consumer reporting agency does not have a
67 file pertaining to the protected consumer.
68 (g) “Sufficient proof of authority” means documentation
69 that shows that a representative has authority to act on behalf
70 of a protected consumer. Sufficient proof of authority includes,
71 but is not limited to, a court order, valid power of attorney,
72 or a written notarized statement signed by a representative that
73 expressly describes the authority of the representative to act
74 on behalf of the protected consumer.
75 (h) “Sufficient proof of identification” means
76 documentation that identifies a protected consumer or a
77 representative of a protected consumer. Sufficient proof of
78 identification includes, but is not limited to, a copy of a
79 social security card, a certified or official copy of a birth
80 certificate, a copy of a valid driver license, or a government
81 issued photo identification.
82 (2) A representative may place a security freeze on a
83 protected consumer’s consumer record by:
84 (a) Submitting a request to a consumer reporting agency in
85 the manner prescribed by that agency;
86 (b) Providing the agency with sufficient proof of authority
87 and sufficient proof of identification; and
88 (c) Paying the agency a fee as authorized under this
89 section.
90 (3) If a consumer reporting agency does not have a consumer
91 report pertaining to a protected consumer when the consumer
92 reporting agency receives a request for a security freeze under
93 subsection (2), the consumer reporting agency shall create a
94 record for the protected consumer and place a security freeze on
95 the record.
96 (4) A consumer reporting agency shall place a security
97 freeze on a consumer record within 30 days after confirming the
98 authenticity of a security freeze request made in accordance
99 with this section.
100 (5) The consumer reporting agency shall send a written
101 confirmation of the security freeze to the representative within
102 10 business days after instituting the security freeze and shall
103 provide the representative with instructions for removing the
104 security freeze and a unique personal identifier to be used by
105 the representative when providing authorization for removal of a
106 security freeze.
107 (6) A consumer reporting agency may not state or imply to
108 any person that a security freeze on a protected consumer’s
109 consumer record reflects a negative credit score, negative
110 credit history, or a negative credit rating.
111 (7) A consumer reporting agency shall remove a security
112 freeze placed on a consumer record of a protected consumer only
113 in the following instances:
114 (a) Upon request of a representative pursuant to paragraph
115 (8)(a).
116 (b) Upon request of a protected consumer pursuant to
117 paragraph (8)(b).
118 (c) If the security freeze was instituted due to a material
119 misrepresentation of fact by a representative. If a consumer
120 reporting agency intends to remove a security freeze pursuant to
121 this paragraph, the consumer reporting agency shall notify the
122 representative in writing before removing the security freeze.
123 (8) A security freeze placed in accordance with this
124 section shall remain in place until a representative or
125 protected consumer requests that it be removed. A consumer
126 reporting agency shall remove a security freeze within 30 days
127 after receiving a request for removal from a protected consumer
128 or representative.
129 (a) A representative submitting a request for removal must
130 provide the following:
131 1. Sufficient proof of identification and sufficient proof
132 of authority as determined by the consumer reporting agency.
133 2. The unique personal identifier provided by the consumer
134 reporting agency pursuant to subsection (5).
135 3. Payment of a fee as authorized by this section.
136 (b) A protected consumer submitting a request for removal
137 must provide the following:
138 1. Sufficient proof of identification as determined by the
139 consumer reporting agency.
140 2. Documentation that the sufficient proof of authority for
141 the protected consumer’s representative to act on behalf of the
142 protected consumer is no longer valid.
143 (9) This section does not apply to use of a consumer record
144 by the following persons or for the following reasons:
145 (a) A state agency acting within its lawful investigative
146 or regulatory authority.
147 (b) A state or local law enforcement agency investigating a
148 crime or conducting a criminal background check.
149 (c) Any person administering a credit file monitoring
150 subscription service to which the protected consumer has
151 subscribed.
152 (d) Any person for the purpose of providing the protected
153 consumer’s consumer report upon the representative’s request.
154 (e) Any person with a court order lawfully entered.
155 (f) Any insurance company for use in setting or adjusting a
156 rate, adjusting a claim, or underwriting for insurance purposes.
157 (g) A consumer reporting agency’s database or file which
158 consists entirely of information concerning, and is used
159 exclusively for, one or more of the following:
160 1. Criminal record information.
161 2. Personal loss history information.
162 3. Fraud prevention or detection.
163 4. Tenant screening.
164 5. Employment screening.
165 6. Personal insurance policy information.
166 7. Noncredit information used for insurance purposes.
167 (h) A check services company that issues authorizations for
168 the purpose of approving or processing negotiable instruments,
169 electronic funds transfers, or similar methods of payment.
170 (i) A deposit account information service company that
171 issues reports regarding account closures due to fraud,
172 substantial overdrafts, automatic teller machine abuse, or
173 similar negative information regarding a protected consumer to
174 an inquiring financial institution, as defined in s. 655.005 or
175 in federal law, for use only in reviewing a representative’s
176 request for a deposit account for the protected consumer at the
177 inquiring financial institution.
178 (j) A consumer reporting agency that acts only as a
179 reseller of credit information by assembling and merging
180 information contained in the database of another consumer
181 reporting agency or multiple consumer reporting agencies and
182 does not maintain a permanent database of credit information
183 from which new consumer reports are produced. However, a
184 consumer reporting agency shall honor any security freeze placed
185 or removed by another consumer reporting agency.
186 (k) A fraud prevention services company issuing reports to
187 prevent or investigate fraud.
188 (10)(a) A consumer reporting agency may charge a reasonable
189 fee, not to exceed $10, to a representative who elects to place
190 or remove a security freeze.
191 (b) A consumer reporting agency may charge a reasonable
192 fee, not to exceed $10, if the representative fails to retain
193 the original personal identifier provided by the consumer
194 reporting agency and the agency must reissue the personal
195 identifier or provide a new personal identifier to the
196 representative.
197 (c) A consumer reporting agency may not charge any fee
198 under this section to a representative of a protected consumer
199 who is a victim of identity theft if the representative submits,
200 at the time the security freeze is requested, a copy of a valid
201 investigative report or incident report or complaint with a law
202 enforcement agency about the unlawful use of the protected
203 consumer’s identifying information by another person.
204 (11) If a security freeze is in effect, a consumer
205 reporting agency may not change any of the following official
206 information in the consumer record without sending a written
207 confirmation of the change to the representative within 30 days
208 after the change is posted to the protected consumer’s record:
209 (a) The protected consumer’s name.
210 (b) The protected consumer’s address.
211 (c) The protected consumer’s date of birth.
212 (d) The protected consumer’s social security number.
213
214 Written confirmation is not required for technical corrections
215 of a protected consumer’s official information, including name
216 and street abbreviations, complete spellings, or transposition
217 of numbers or letters. In the case of an address change, the
218 written confirmation must be sent to both the new address and
219 the former address.
220 (12) If a consumer reporting agency violates a security
221 freeze placed in accordance with this section by releasing
222 information subject to a security freeze without proper
223 authorization, the consumer reporting agency shall, within 5
224 business days after discovering or being notified of the release
225 of information, notify the representative of the protected
226 consumer in writing. The notice shall state the specific
227 information released, and provide the name, address, and other
228 contact information of the recipient of the information.
229 (13)(a) Any consumer reporting agency that willfully fails
230 to comply with any requirement imposed under this section with
231 respect to any representative or protected consumer is subject
232 to an administrative fine in the amount of up to $500 issued
233 pursuant to the administrative procedures established in chapter
234 120 by the Department of Agriculture and Consumer Services.
235 (b) Any individual who obtains a record under false
236 pretenses or knowingly without a permissible purpose is liable
237 to the representative and protected consumer for actual damages
238 sustained by the protected consumer as a result of the failure
239 of at least $100 but not more than $1,000.
240 (c) Any person who obtains a record from a consumer
241 reporting agency under false pretenses or knowingly without a
242 permissible purpose is liable to the consumer reporting agency
243 for actual damages sustained by the consumer reporting agency or
244 $1,000, whichever is greater.
245 Section 2. Subsection (17) of section 501.005, Florida
246 Statutes, is amended to read:
247 501.005 Consumer report security freeze.—
248 (17) Any written disclosure by a consumer reporting agency,
249 pursuant to 15 U.S.C. s. 1681g, to any consumer residing in this
250 state shall include a written summary of all rights the consumer
251 has under this section and s. 501.0051, and, in the case of a
252 consumer reporting agency which compiles and maintains consumer
253 reports on a nationwide basis, a toll-free telephone number
254 which the consumer can use to communicate with the consumer
255 reporting agency. The information set forth in paragraph (c) (b)
256 of the written summary of rights must be in at least 12-point
257 boldface type. The written summary of rights required under this
258 section is sufficient if it is substantially in the following
259 form:
260 (a) You have a right to place a “security freeze” on your
261 consumer report, which will prohibit a consumer reporting agency
262 from releasing any information in your consumer report without
263 your express authorization. A security freeze must be requested
264 in writing by certified mail to a consumer reporting agency. The
265 security freeze is designed to prevent credit, loans, and
266 services from being approved in your name without your consent.
267 (b) If you are the custodial parent or legal guardian of a
268 minor younger than 16 years of age or a guardian or advocate of
269 an incapacitated, disabled, or protected person under chapter
270 39, chapter 393, chapter 744, or chapter 914, Florida Statutes,
271 you have a right to place a security freeze on the consumer
272 report of the person you are legally authorized to care for. If
273 no consumer report exists, you have a right to request a record
274 to be created and a security freeze to be placed on the record.
275 A record with a security freeze is intended to prevent the
276 opening of credit accounts until the security freeze is removed.
277 (c)(b) YOU SHOULD BE AWARE THAT USING A SECURITY FREEZE TO
278 CONTROL ACCESS TO THE PERSONAL AND FINANCIAL INFORMATION IN YOUR
279 CONSUMER REPORT MAY DELAY, INTERFERE WITH, OR PROHIBIT THE
280 TIMELY APPROVAL OF ANY SUBSEQUENT REQUEST OR APPLICATION YOU
281 MAKE REGARDING A NEW LOAN, CREDIT, MORTGAGE, INSURANCE,
282 GOVERNMENT SERVICES OR PAYMENTS, RENTAL HOUSING, EMPLOYMENT,
283 INVESTMENT, LICENSE, CELLULAR PHONE, UTILITIES, DIGITAL
284 SIGNATURE, INTERNET CREDIT CARD TRANSACTION, OR OTHER SERVICES,
285 INCLUDING AN EXTENSION OF CREDIT AT POINT OF SALE.
286 (d)(c) When you place a security freeze on your consumer
287 report, you will be provided a personal identification number or
288 password to use if you choose to remove the freeze on your
289 consumer report or authorize the release of your consumer report
290 for a designated period of time after the security freeze is in
291 place. To provide that authorization, you must contact the
292 consumer reporting agency and provide all of the following:
293 1. The personal identification number or password.
294 2. Proper identification to verify your identity.
295 3. Information specifying the period of time for which the
296 report shall be made available.
297 4. Payment of a fee authorized by this section.
298 (e)(d) A consumer reporting agency must authorize the
299 release of your consumer report no later than 3 business days
300 after receiving the above information.
301 (f)(e) A security freeze does not apply to a person or
302 entity, or its affiliates, or collection agencies acting on
303 behalf of the person or entity, with which you have an existing
304 account, that requests information in your consumer report for
305 the purposes of reviewing or collecting the account. Reviewing
306 the account includes activities related to account maintenance,
307 monitoring, credit line increases, and account upgrades and
308 enhancements.
309 (g)(f) You have the right to bring a civil action against
310 anyone, including a consumer reporting agency, who fails to
311 comply with the provisions of s. 501.005, Florida Statutes,
312 which governs the placing of a consumer report security freeze
313 on your consumer report.
314 Section 3. This act shall take effect September 1, 2013.