ENROLLED
2014 Legislature CS for CS for CS for SB 242
2014242er
1
2 An act relating to the security of a protected
3 consumer’s information; providing a short title;
4 creating s. 501.0051, F.S.; providing definitions;
5 authorizing the representative of a protected consumer
6 to place a security freeze on a protected consumer’s
7 consumer report or record; specifying the procedure to
8 request a security freeze; requiring a consumer
9 reporting agency to establish a record if the
10 protected consumer does not have an existing consumer
11 report; prohibiting the use of a consumer record for
12 certain purposes; requiring a consumer reporting
13 agency to place, and to provide written confirmation
14 of, a security freeze within a specified period;
15 prohibiting a consumer reporting agency from stating
16 or implying that a security freeze reflects a negative
17 credit history or rating; requiring a consumer
18 reporting agency to remove a security freeze under
19 specified conditions; specifying the procedure to
20 remove a security freeze; providing applicability;
21 authorizing a consumer reporting agency to charge a
22 fee for placing or removing a security freeze and for
23 reissuing a unique personal identifier; prohibiting a
24 fee under certain circumstances; requiring written
25 notification upon the change of specified information
26 in a protected consumer’s consumer report or record;
27 providing exceptions; requiring a consumer reporting
28 agency to notify a representative and provide
29 specified information if the consumer reporting agency
30 violates a security freeze; requiring the Department
31 of Agriculture and Consumer Services to investigate
32 complaints regarding the violation of a security
33 freeze; providing penalties and civil remedies for the
34 violation of a security freeze; providing written
35 disclosure requirements for consumer reporting
36 agencies relating to a protected consumer’s security
37 freeze; providing an effective date.
38
39 Be It Enacted by the Legislature of the State of Florida:
40
41 Section 1. This act may be cited as the “Keeping I.D. Safe
42 (KIDS) Act.”
43 Section 2. Section 501.0051, Florida Statutes, is created
44 to read:
45 501.0051 Protected consumer report security freeze.—
46 (1) As used in this section, the term:
47 (a) “Consumer report” has the same meaning as provided in
48 15 U.S.C. s. 1681a(d).
49 (b) “Consumer reporting agency” has the same meaning as
50 provided in 15 U.S.C. s. 1681a(f).
51 (c) “Protected consumer” means a person younger than 16
52 years of age at the time a security freeze request is made or a
53 person represented by a guardian or other advocate pursuant to
54 chapter 39, chapter 393, chapter 744, or chapter 914.
55 (d) “Record” means a compilation of information that:
56 1. Identifies a protected consumer; and
57 2. Is created by a consumer reporting agency exclusively
58 for the purpose of complying with this section.
59 (e) “Representative” means the parent or legal guardian of
60 a protected consumer, including a guardian appointed pursuant to
61 s. 914.17.
62 (f) “Security freeze” means:
63 1. A notice placed on a protected consumer’s consumer
64 report which prohibits a consumer reporting agency from
65 releasing the consumer report, the credit score, or any
66 information contained within the consumer report to a third
67 party without the express authorization of the representative;
68 or
69 2. If a consumer reporting agency does not have a consumer
70 report pertaining to a protected consumer, a notice placed on a
71 protected consumer’s record which prohibits the consumer
72 reporting agency from releasing the protected consumer’s record
73 except as provided in this section.
74 (g) “Sufficient proof of authority” means documentation
75 showing that a representative has authority to act on behalf of
76 a protected consumer. The term includes, but is not limited to,
77 a court order, a copy of a valid power of attorney, or a written
78 notarized statement signed by the representative which expressly
79 describes the authority of the representative to act on behalf
80 of the protected consumer. A representative who is a parent may
81 establish sufficient proof of authority by providing a certified
82 or official copy of the protected consumer’s birth certificate.
83 (h) “Sufficient proof of identification” means
84 documentation identifying a protected consumer or a
85 representative. The term includes, but is not limited to, a copy
86 of a social security card, a certified or official copy of a
87 birth certificate, a copy of a valid driver license, or a copy
88 of a government-issued photo identification.
89 (2) A representative may place a security freeze on a
90 protected consumer’s consumer report by:
91 (a) Submitting a request to a consumer reporting agency in
92 the manner prescribed by that agency;
93 (b) Providing the agency with sufficient proof of authority
94 and sufficient proof of identification of the representative;
95 and
96 (c) Paying the agency a fee as authorized under this
97 section.
98 (3) If a consumer reporting agency does not have a consumer
99 report pertaining to a protected consumer when the consumer
100 reporting agency receives a request for a security freeze under
101 subsection (2), the consumer reporting agency shall create a
102 record for the protected consumer and place a security freeze on
103 the record. A record may not be created or used to consider the
104 protected consumer’s credit worthiness, credit standing, credit
105 capacity, character, general reputation, personal
106 characteristics, or eligibility for other financial services.
107 (4) A consumer reporting agency shall place a security
108 freeze on a consumer report or record within 30 days after
109 confirming the authenticity of a security freeze request made in
110 accordance with this section.
111 (5) The consumer reporting agency shall send a written
112 confirmation of the security freeze to the representative within
113 10 business days after instituting the security freeze on the
114 consumer report or record and shall provide the representative
115 with instructions for removing the security freeze and a unique
116 personal identifier to be used by the representative when
117 providing authorization for removal of the security freeze.
118 (6) A consumer reporting agency may not state or imply to
119 any person that a security freeze reflects a negative credit
120 score, a negative credit history, or a negative credit rating.
121 (7) A consumer reporting agency shall remove a security
122 freeze from a protected consumer’s consumer report or record
123 only under either of the following circumstances:
124 (a) Upon the request of a representative or a protected
125 consumer. A consumer reporting agency shall remove a security
126 freeze within 30 days after receiving a request for removal from
127 a protected consumer or his or her representative.
128 1. A representative submitting a request for removal must
129 provide all of the following:
130 a. Sufficient proof of identification of the representative
131 and sufficient proof of authority as determined by the consumer
132 reporting agency.
133 b. The unique personal identifier provided by the consumer
134 reporting agency pursuant to subsection (5).
135 c. A fee as authorized under this section.
136 2. A protected consumer submitting a request for removal
137 must provide all of the following:
138 a. Sufficient proof of identification of the protected
139 consumer as determined by the consumer reporting agency.
140 b. Documentation that the sufficient proof of authority of
141 the protected consumer’s representative to act on behalf of the
142 protected consumer is no longer valid.
143 c. A fee as authorized under this section.
144 (b) If the security freeze was instituted due to a material
145 misrepresentation of fact. A consumer reporting agency that
146 intends to remove a security freeze under this paragraph shall
147 notify the representative and protected consumer in writing
148 before removing the security freeze.
149 (8) This section does not apply to the use of a protected
150 consumer’s consumer report or record by the following persons or
151 for the following reasons:
152 (a) A state agency acting within its lawful investigative
153 or regulatory authority.
154 (b) A state or local law enforcement agency investigating a
155 crime or conducting a criminal background check.
156 (c) A person administering a credit file monitoring
157 subscription service to which the protected consumer or the
158 representative, on behalf of the protected consumer, has
159 subscribed.
160 (d) A person providing the protected consumer’s consumer
161 report or record to the protected consumer or representative
162 upon the request of the protected consumer or representative.
163 (e) Pursuant to a court order lawfully entered.
164 (f) An insurance company for use in setting or adjusting a
165 rate, adjusting a claim, or underwriting for insurance purposes.
166 (g) A consumer reporting agency’s database or file that
167 consists entirely of information concerning, and used
168 exclusively for, one or more of the following:
169 1. Criminal record information.
170 2. Personal loss history information.
171 3. Fraud prevention or detection.
172 4. Tenant screening.
173 5. Employment screening.
174 6. Personal insurance policy information.
175 7. Noncredit information used for insurance purposes.
176 (h) A check services company issuing authorizations for the
177 purpose of approving or processing negotiable instruments,
178 electronic funds transfers, or similar methods of payment.
179 (i) A deposit account information service company issuing
180 reports regarding account closures due to fraud, substantial
181 overdrafts, automatic teller machine abuse, or similar negative
182 information regarding a protected consumer to an inquiring
183 financial institution, as defined in s. 655.005 or in federal
184 law, for use only in reviewing a representative’s request for a
185 deposit account for the protected consumer at the inquiring
186 financial institution.
187 (j) A consumer reporting agency that acts only as a
188 reseller of credit information by assembling and merging
189 information contained in the database of another consumer
190 reporting agency or multiple consumer reporting agencies and
191 that does not maintain a permanent database of credit
192 information from which new consumer reports are produced.
193 However, such consumer reporting agency shall honor any security
194 freeze placed or removed by another consumer reporting agency.
195 (k) A fraud prevention services company issuing reports to
196 prevent or investigate fraud.
197 (l) A person or entity, or its affiliates, or a collection
198 agency acting on behalf of the person or entity, with which the
199 protected consumer has an existing account, requesting
200 information in the protected consumer’s consumer report or
201 record for the purposes of reviewing or collecting the account.
202 Reviewing the account includes activities related to account
203 maintenance, monitoring, credit line increases, and account
204 upgrades and enhancements.
205 (9)(a) A consumer reporting agency may charge a reasonable
206 fee, not to exceed $10, to place or remove a security freeze.
207 (b) A consumer reporting agency may also charge a
208 reasonable fee, not to exceed $10, if the representative fails
209 to retain the original unique personal identifier provided by
210 the consumer reporting agency and the agency must reissue the
211 unique personal identifier or provide a new unique personal
212 identifier to the representative.
213 (c) A consumer reporting agency may not charge a fee under
214 this section to the representative of a protected consumer who
215 is a victim of identity theft if the representative submits, at
216 the time the security freeze is requested, a copy of a valid
217 investigative report, an incident report, or a complaint with a
218 law enforcement agency about the unlawful use of the protected
219 consumer’s identifying information by another person.
220 (10) If a security freeze is in effect, a consumer
221 reporting agency must send written confirmation to a protected
222 consumer’s representative of a change to any of the following
223 official information in the protected consumer’s consumer report
224 or record within 30 days after the change is posted:
225 (a) The protected consumer’s name.
226 (b) The protected consumer’s address.
227 (c) The protected consumer’s date of birth.
228 (d) The protected consumer’s social security number.
229
230 Written confirmation is not required for technical corrections
231 of a protected consumer’s official information, including name
232 and street abbreviations, complete spellings, or transposition
233 of numbers or letters. In the case of an address change, the
234 written confirmation must be sent to the representative and to
235 the protected consumer’s new address and former address.
236 (11) If a consumer reporting agency violates a security
237 freeze placed in accordance with this section by releasing
238 information subject to a security freeze without proper
239 authorization, the consumer reporting agency shall, within 5
240 business days after discovering or being notified of the release
241 of information, notify the representative of the protected
242 consumer in writing. The notice must state the specific
243 information released and provide the name, address, and other
244 contact information of the recipient of the information.
245 (12) The Department of Agriculture and Consumer Services
246 shall investigate any complaints received concerning violations
247 of this section. If, after investigating any complaint, the
248 department finds that there has been a violation of this
249 section, the department may bring an action to impose an
250 administrative penalty. A consumer reporting agency that
251 willfully fails to comply with any requirement imposed under
252 this section is subject to an administrative penalty in the
253 amount of $500 for each violation, imposed by the department. An
254 administrative proceeding that could result in the entry of an
255 order imposing an administrative penalty must be conducted in
256 accordance with chapter 120. The administrative penalty shall be
257 deposited in the General Inspection Trust Fund.
258 (13) In addition to any other penalties or remedies
259 provided under law, persons who are aggrieved by a violation of
260 this section may bring a civil action as follows:
261 (a) A person who obtains a protected consumer’s consumer
262 report or record from a consumer reporting agency under false
263 pretenses or who knowingly obtains a protected consumer’s
264 consumer report or record without a permissible purpose is
265 liable to the representative and protected consumer for actual
266 damages sustained by the protected consumer or $1,000, whichever
267 is greater.
268 (b) A person who obtains a protected consumer’s consumer
269 report or record from a consumer reporting agency under false
270 pretenses or who knowingly obtains a protected consumer’s
271 consumer report or record without a permissible purpose is
272 liable to the consumer reporting agency for actual damages
273 sustained by the consumer reporting agency or $1,000, whichever
274 is greater.
275 (14) A written disclosure by a consumer reporting agency,
276 pursuant to 15 U.S.C. s. 1681g, to a representative and
277 protected consumer residing in this state must include a written
278 summary of all rights that the representative and protected
279 consumer have under this section and, in the case of a consumer
280 reporting agency that compiles and maintains records on a
281 nationwide basis, a toll-free telephone number that the
282 representative can use to communicate with the consumer
283 reporting agency. The information provided in paragraph (b) must
284 be in at least 12-point boldfaced type. The written summary of
285 rights required under this section is sufficient if it is
286 substantially in the following form:
287 (a) If you are the parent or legal guardian of a minor
288 younger than 16 years of age or a guardian or advocate of an
289 incapacitated, disabled, or protected person under chapter 39,
290 chapter 393, chapter 744, or chapter 914, Florida Statutes, you
291 have the right to place a security freeze on the consumer report
292 of the person you are legally authorized to care for. If no
293 consumer report exists, you have the right to request that a
294 record be created and a security freeze be placed on the record.
295 A record with a security freeze is intended to prevent the
296 opening of credit accounts until the security freeze is removed.
297 (b) YOU SHOULD BE AWARE THAT USING A SECURITY FREEZE TO
298 CONTROL ACCESS TO THE PERSONAL AND FINANCIAL INFORMATION IN A
299 CONSUMER REPORT OR RECORD MAY DELAY, INTERFERE WITH, OR PROHIBIT
300 THE TIMELY APPROVAL OF ANY SUBSEQUENT REQUEST OR APPLICATION
301 REGARDING A NEW LOAN, CREDIT, MORTGAGE, INSURANCE, GOVERNMENT
302 SERVICES OR PAYMENTS, RENTAL HOUSING, EMPLOYMENT, INVESTMENT,
303 LICENSE, CELLULAR PHONE, UTILITIES, DIGITAL SIGNATURE, INTERNET
304 CREDIT CARD TRANSACTION, OR OTHER SERVICES, INCLUDING AN
305 EXTENSION OF CREDIT AT POINT OF SALE.
306 (c) To remove the security freeze on the protected
307 consumer’s record or report, you must contact the consumer
308 reporting agency and provide all of the following:
309 1. Proof of identification as required by the consumer
310 reporting agency.
311 2. Proof of authority over the protected consumer as
312 required by the consumer reporting agency.
313 3. The unique personal identifier provided by the consumer
314 reporting agency.
315 4. Payment of a fee.
316 (d) A consumer reporting agency must, within 30 days after
317 receiving the above information, authorize the removal of the
318 security freeze.
319 (e) A security freeze does not apply to a person or entity,
320 or its affiliates, or a collection agency acting on behalf of
321 the person or entity, with which the protected consumer has an
322 existing account, which requests information in the protected
323 consumer’s consumer report or record for the purposes of
324 reviewing or collecting the account. Reviewing the account
325 includes activities related to account maintenance, monitoring,
326 credit line increases, and account upgrades and enhancements.
327 (f) You have the right to bring a civil action as
328 authorized by section 501.0051, Florida Statutes, which governs
329 the security of protected consumer information.
330 Section 3. This act shall take effect September 1, 2014.