Florida Senate - 2013 CS for SB 566
By the Committee on Commerce and Tourism; and Senator Detert
577-03305-13 2013566c1
1 A bill to be entitled
2 An act relating to security of protected consumer
3 information; creating s. 501.0051, F.S.; providing
4 definitions; authorizing the representative of a
5 protected consumer to place a security freeze on the
6 protected consumer’s consumer record; requiring a
7 consumer reporting agency to establish a record if the
8 protected consumer does not have an existing consumer
9 report; requiring a consumer reporting agency to
10 provide written confirmation of a security freeze
11 within a specified period; prohibiting a consumer
12 reporting agency from stating or implying that a
13 security freeze reflects a negative credit history or
14 rating; requiring a consumer reporting agency to
15 remove a security freeze under specified conditions;
16 providing for applicability; authorizing a consumer
17 reporting agency to charge a fee for placing or
18 removing a security freeze and for reissuing personal
19 identification information; prohibiting a fee under
20 certain circumstances; requiring written notification
21 to change specified information in a protected
22 consumer’s record; providing exemptions; requiring a
23 consumer reporting agency to notify a representative
24 and provide specified information if the consumer
25 reporting agency violates a security freeze; providing
26 penalties and civil remedies; providing written
27 disclosure requirements for consumer reporting
28 agencies pertaining to protected consumer security
29 freezes; providing an effective date.
30
31 Be It Enacted by the Legislature of the State of Florida:
32
33 Section 1. Section 501.0051, Florida Statutes, is created
34 to read:
35 501.0051 Protected consumer security freeze.—
36 (1) As used in this section, the term:
37 (a) “Consumer reporting agency” has the same meaning as
38 provided in 15 U.S.C. s. 1681a(f).
39 (b) “Consumer report” has the same meaning as provided in
40 15 U.S.C. s. 1681a(d).
41 (c) “Protected consumer” means a person younger than 16
42 years of age at the time a security freeze request is made or a
43 person represented by a guardian or other advocate pursuant to
44 chapter 39, chapter 393,chapter 744, or chapter 914.
45 (d) “Record” means a compilation of information that:
46 1. Identifies a protected consumer;
47 2. Is created by a consumer reporting agency exclusively
48 for the purpose of complying with this section; and
49 3. May not be created or used to consider the protected
50 consumer’s credit worthiness, credit standing, credit capacity,
51 character, general reputation, personal characteristics, or
52 eligibility for other financial services.
53 (e) “Representative” means the custodial parent or legal
54 guardian of a protected consumer, including a guardian appointed
55 pursuant to s. 914.17.
56 (f) “Security freeze” means:
57 1. A notice that is placed on the protected consumer’s
58 consumer report that prohibits a consumer reporting agency from
59 releasing the consumer report, credit score, or any information
60 contained within the consumer report to a third party without
61 the express authorization of the representative; or
62 2. A notice that is placed on the protected consumer’s
63 record that prohibits the consumer reporting agency from
64 releasing the protected consumer’s record except as provided in
65 this section, if a consumer reporting agency does not have a
66 file pertaining to the protected consumer.
67 (g) “Sufficient proof of authority” means documentation
68 that shows that a representative has authority to act on behalf
69 of a protected consumer. Sufficient proof of authority includes,
70 but is not limited to, a court order, valid power of attorney,
71 or a written notarized statement signed by a representative that
72 expressly describes the authority of the representative to act
73 on behalf of the protected consumer.
74 (h) “Sufficient proof of identification” means
75 documentation that identifies a protected consumer or a
76 representative of a protected consumer. Sufficient proof of
77 identification includes, but is not limited to, a copy of a
78 social security card, a certified or official copy of a birth
79 certificate, a copy of a valid driver license, or a government
80 issued photo identification.
81 (2) A representative may place a security freeze on a
82 protected consumer’s consumer record by:
83 (a) Submitting a request to a consumer reporting agency in
84 the manner prescribed by that agency;
85 (b) Providing the agency with sufficient proof of authority
86 and sufficient proof of identification; and
87 (c) Paying the agency a fee as authorized under this
88 section.
89 (3) If a consumer reporting agency does not have a consumer
90 report pertaining to a protected consumer when the consumer
91 reporting agency receives a request for a security freeze under
92 subsection (2), the consumer reporting agency shall create a
93 record for the protected consumer and place a security freeze on
94 the record.
95 (4) A consumer reporting agency shall place a security
96 freeze on a consumer record within 30 calendar days after
97 confirming the authenticity of a security freeze request made in
98 accordance with this section.
99 (5) The consumer reporting agency shall send a written
100 confirmation of the security freeze to the representative within
101 10 business days after instituting the security freeze and shall
102 provide the representative with instructions for removing the
103 security freeze and a unique personal identifier to be used by
104 the representative when providing authorization for removal of a
105 security freeze.
106 (6) A consumer reporting agency may not state or imply to
107 any person that a security freeze on a protected consumer’s
108 consumer record reflects a negative credit score, negative
109 credit history, or a negative credit rating.
110 (7) A consumer reporting agency shall remove a security
111 freeze placed on a consumer record of a protected consumer only
112 in the following instances:
113 (a) Upon request of a representative pursuant to paragraph
114 (8)(a).
115 (b) Upon request of a protected consumer pursuant to
116 paragraph (8)(b).
117 (c) If the security freeze was instituted due to a material
118 misrepresentation of fact by a representative. If a consumer
119 reporting agency intends to remove a security freeze pursuant to
120 this paragraph, the consumer reporting agency shall notify the
121 representative in writing before removing the security freeze.
122 (8) A security freeze placed in accordance with this
123 section shall remain in place until a representative or
124 protected consumer requests that it be removed. A consumer
125 reporting agency shall remove a security freeze within 30
126 calendar days after receiving a request for removal from a
127 protected consumer or representative.
128 (a) A representative submitting a request for removal must
129 provide the following:
130 1. Sufficient proof of identification and sufficient proof
131 of authority as determined by the consumer reporting agency.
132 2. The unique personal identifier provided by the consumer
133 reporting agency pursuant to subsection (5).
134 3. Payment of a fee as authorized by this section.
135 (b) A protected consumer submitting a request for removal
136 must provide the following:
137 1. Sufficient proof of identification as determined by the
138 consumer reporting agency.
139 2. Documentation that the sufficient proof of authority for
140 the protected consumer’s representative to act on behalf of the
141 protected consumer is no longer valid.
142 (9) This section does not apply to use of a consumer record
143 by the following persons or for the following reasons:
144 (a) A state agency acting within its lawful investigative
145 or regulatory authority.
146 (b) A state or local law enforcement agency investigating a
147 crime or conducting a criminal background check.
148 (c) Any person administering a credit file monitoring
149 subscription service to which the protected consumer has
150 subscribed.
151 (d) Any person for the purpose of providing the protected
152 consumer’s consumer report upon the representative’s request.
153 (e) Any person with a court order lawfully entered.
154 (f) Any insurance company for use in setting or adjusting a
155 rate, adjusting a claim, or underwriting for insurance purposes.
156 (g) A consumer reporting agency’s database or file which
157 consists entirely of information concerning, and is used
158 exclusively for, one or more of the following:
159 1. Criminal record information.
160 2. Personal loss history information.
161 3. Fraud prevention or detection.
162 4. Tenant screening.
163 5. Employment screening.
164 6. Personal insurance policy information.
165 7. Noncredit information used for insurance purposes.
166 (h) A check services company that issues authorizations for
167 the purpose of approving or processing negotiable instruments,
168 electronic funds transfers, or similar methods of payment.
169 (i) A deposit account information service company that
170 issues reports regarding account closures due to fraud,
171 substantial overdrafts, automatic teller machine abuse, or
172 similar negative information regarding a protected consumer to
173 an inquiring financial institution, as defined in s. 655.005 or
174 in federal law, for use only in reviewing a representative’s
175 request for a deposit account for the protected consumer at the
176 inquiring financial institution.
177 (j) A consumer reporting agency that acts only as a
178 reseller of credit information by assembling and merging
179 information contained in the database of another consumer
180 reporting agency or multiple consumer reporting agencies and
181 does not maintain a permanent database of credit information
182 from which new consumer reports are produced. However, a
183 consumer reporting agency shall honor any security freeze placed
184 or removed by another consumer reporting agency.
185 (k) A fraud prevention services company issuing reports to
186 prevent or investigate fraud.
187 (10)(a) A consumer reporting agency may charge a reasonable
188 fee, not to exceed $10, to a representative who elects to place
189 or remove a security freeze.
190 (b) A consumer reporting agency may charge a reasonable
191 fee, not to exceed $10, if the representative fails to retain
192 the original personal identifier provided by the consumer
193 reporting agency and the agency must reissue the personal
194 identifier or provide a new personal identifier to the
195 representative.
196 (c) A consumer reporting agency may not charge any fee
197 under this section to a representative of a protected consumer
198 who is a victim of identity theft if the representative submits,
199 at the time the security freeze is requested, a copy of a valid
200 investigative report or incident report or complaint with a law
201 enforcement agency about the unlawful use of the protected
202 consumer’s identifying information by another person.
203 (11) If a security freeze is in effect, a consumer
204 reporting agency may not change any of the following official
205 information in the consumer record without sending a written
206 confirmation of the change to the representative within 30
207 calendar days after the change is posted to the protected
208 consumer’s record:
209 (a) The protected consumer’s name.
210 (b) The protected consumer’s address.
211 (c) The protected consumer’s date of birth.
212 (d) The protected consumer’s social security number.
213
214 Written confirmation is not required for technical corrections
215 of a protected consumer’s official information, including name
216 and street abbreviations, complete spellings, or transposition
217 of numbers or letters. In the case of an address change, the
218 written confirmation must be sent to both the new address and
219 the former address.
220 (12) If a consumer reporting agency violates a security
221 freeze placed in accordance with this section by releasing
222 information subject to a security freeze without proper
223 authorization, the consumer reporting agency shall, within 5
224 business days after discovering or being notified of the release
225 of information, notify the representative of the protected
226 consumer in writing. The notice shall state the specific
227 information released, and provide the name, address, and other
228 contact information of the recipient of the information.
229 (13) A consumer reporting agency that willfully fails to
230 comply with any requirement imposed under this section with
231 respect to a representative or protected consumer is subject to
232 an administrative fine in the amount of $500 issued pursuant to
233 the administrative procedures established in chapter 120 by the
234 Department of Agriculture and Consumer Services.
235 (14) A person who is aggrieved by a violation of the
236 provisions of this section may bring a civil action as
237 authorized by this subsection.
238 (a) Any person who obtains a record under false pretenses
239 or knowingly without a permissible purpose is liable to the
240 representative and protected consumer for damages of at least
241 $1,000 or the actual damages sustained by the protected consumer
242 as a result of the violation, whichever is greater.
243 (b) Any person who obtains a record from a consumer
244 reporting agency under false pretenses or knowingly without a
245 permissible purpose is liable to the consumer reporting agency
246 for actual damages sustained by the consumer reporting agency or
247 $1,000, whichever is greater.
248 (15) Any written disclosure by a consumer reporting agency,
249 pursuant to 15 U.S.C. s. 1681g, to any representative and
250 protected consumer residing in this state must include a written
251 summary of all rights the representative and protected consumer
252 have under this section and, in the case of a consumer reporting
253 agency that compiles and maintains records on a nationwide
254 basis, a toll-free telephone number which the representative can
255 use to communicate with the consumer reporting agency. The
256 information set forth in paragraph (b) of the written summary of
257 rights must be in at least 12-point boldface type. The written
258 summary of rights required under this section is sufficient if
259 it is substantially in the following form:
260 (a) If you are the custodial parent or legal guardian of a
261 minor younger than 16 years of age or a guardian or advocate of
262 an incapacitated, disabled, or protected person under chapter
263 39, chapter 393, chapter 744, or chapter 914, Florida Statutes,
264 you have a right to place a security freeze on the consumer
265 report of the person you are legally authorized to care for. If
266 no consumer report exists, you have a right to request a record
267 to be created and a security freeze to be placed on the record.
268 A record with a security freeze is intended to prevent the
269 opening of credit accounts until the security freeze is removed.
270 (b) YOU SHOULD BE AWARE THAT USING A SECURITY FREEZE TO
271 CONTROL ACCESS TO THE PERSONAL AND FINANCIAL INFORMATION IN THE
272 CONSUMER RECORD MAY DELAY, INTERFERE WITH, OR PROHIBIT THE
273 TIMELY APPROVAL OF ANY SUBSEQUENT REQUEST OR APPLICATION
274 REGARDING A NEW LOAN, CREDIT, MORTGAGE, INSURANCE, GOVERNMENT
275 SERVICES OR PAYMENTS, RENTAL HOUSING, EMPLOYMENT, INVESTMENT,
276 LICENSE, CELLULAR PHONE, UTILITIES, DIGITAL SIGNATURE, INTERNET
277 CREDIT CARD TRANSACTION, OR OTHER SERVICES, INCLUDING AN
278 EXTENSION OF CREDIT AT POINT OF SALE.
279 (c) When you place a security freeze on the protected
280 consumer’s record you will be provided a process to use if you
281 choose to remove the freeze on the record or authorize the
282 release of the record. To provide that authorization, you must
283 contact the consumer reporting agency and provide all of the
284 following:
285 1. The personal identification required by the consumer
286 reporting agency.
287 2. Sufficient proof of authority over the protected
288 consumer.
289 3. Payment of a fee.
290 (d) A consumer reporting agency must authorize the release
291 of the record no later than 30 calendar days after receiving the
292 above information, or the consumer report no later than 3
293 business days after receiving the above information.
294 (e) A security freeze does not apply to a person or entity,
295 or its affiliates, or collection agencies acting on behalf of
296 the person or entity with which the protected consumer has an
297 existing account that requests information in the protected
298 consumer’s consumer report for the purposes of reviewing or
299 collecting the account. Reviewing the account includes
300 activities related to account maintenance, monitoring, credit
301 line increases, and account upgrades and enhancements.
302 (f) You have the right to bring a civil action as
303 authorized by s. 501.0051, Florida Statutes, which governs the
304 security of protected consumer information.
305 Section 2. This act shall take effect September 1, 2013.