<enum>I</enum><header>Consumer reporting agency cybersecurity</header> <section id="HB07C7110EB22414C82BD0D6D243D2445" section-type="subsequent-section"><enum>101.</enum><header>Cybersecurity supervision and examination of large consumer reporting agencies</header><text display-inline="no-display-inline">The Federal Financial Institutions Examination Council Act of 1978 (<external-xref legal-doc="usc" parsable-cite="usc/12/3301">12 U.S.C. 3301</external-xref> et seq.) is amended by adding at the end the following:</text> <quoted-block display-inline="no-display-inline" id="HF038ADBEAF5D402C9934AB04C4FE04D3" style="OLC"> <section id="HFA07817A6A0B46AA8708E3BD060ED708"><enum>1012.</enum><header>Cybersecurity supervision and examination of large consumer reporting agencies</header> <subsection id="H49494FAF33184EB684781E46BC5A3181"><enum>(a)</enum><header>In general</header><text display-inline="yes-display-inline">Large consumer reporting agencies shall be subject to cybersecurity supervision and examination by the designated agency.</text> </subsection><subsection id="HF7BDB03BA38949A3A716B7579A8B0314"><enum>(b)</enum><header>Rulemaking</header><text>The Council shall—</text> <paragraph id="HD24DB4995A7A4C4998FEC2C0A5B1D528"><enum>(1)</enum><text>establish uniform cybersecurity supervision and examination procedures for purposes of subsection (a); and</text> </paragraph><paragraph id="H8DD877B32EB74260B7FF413E59448CDC"><enum>(2)</enum><text display-inline="yes-display-inline">designate a Federal banking agency, as defined in section 509 of the Gramm-Leach-Bliley Act (<external-xref legal-doc="usc" parsable-cite="usc/15/6809">15 U.S.C. 6809</external-xref>), to serve as the designated agency under subsection (a).</text> </paragraph></subsection><subsection id="HC8B83EF25514406DBBD2BF469550C0E9"><enum>(c)</enum><header>Large consumer reporting agency defined</header><text>The term <term>large consumer reporting agency</term> has the meaning given the term <term>consumer reporting agency that compiles and maintains files on consumers on a nationwide basis</term> under section 603(p) of the Fair Credit Reporting Act.</text></subsection></section><after-quoted-block>.</after-quoted-block></quoted-block> </section>

115 HR 4028 IH: Promoting Responsible Oversight of Transactions and Examinations of Credit Technology Act of 2017 U.S. House of Representatives 2017-10-12 text/xml EN Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.

Short title

This Act may be cited as the

Promoting Responsible Oversight of Transactions and Examinations of Credit Technology Act of 2017

or the

PROTECT Act of 2017

<enum>I</enum><header>Consumer reporting agency cybersecurity</header> <section id="HB07C7110EB22414C82BD0D6D243D2445" section-type="subsequent-section"><enum>101.</enum><header>Cybersecurity supervision and examination of large consumer reporting agencies</header><text display-inline="no-display-inline">The Federal Financial Institutions Examination Council Act of 1978 (<external-xref legal-doc="usc" parsable-cite="usc/12/3301">12 U.S.C. 3301</external-xref> et seq.) is amended by adding at the end the following:</text> <quoted-block display-inline="no-display-inline" id="HF038ADBEAF5D402C9934AB04C4FE04D3" style="OLC"> <section id="HFA07817A6A0B46AA8708E3BD060ED708"><enum>1012.</enum><header>Cybersecurity supervision and examination of large consumer reporting agencies</header> <subsection id="H49494FAF33184EB684781E46BC5A3181"><enum>(a)</enum><header>In general</header><text display-inline="yes-display-inline">Large consumer reporting agencies shall be subject to cybersecurity supervision and examination by the designated agency.</text> </subsection><subsection id="HF7BDB03BA38949A3A716B7579A8B0314"><enum>(b)</enum><header>Rulemaking</header><text>The Council shall—</text> <paragraph id="HD24DB4995A7A4C4998FEC2C0A5B1D528"><enum>(1)</enum><text>establish uniform cybersecurity supervision and examination procedures for purposes of subsection (a); and</text> </paragraph><paragraph id="H8DD877B32EB74260B7FF413E59448CDC"><enum>(2)</enum><text display-inline="yes-display-inline">designate a Federal banking agency, as defined in section 509 of the Gramm-Leach-Bliley Act (<external-xref legal-doc="usc" parsable-cite="usc/15/6809">15 U.S.C. 6809</external-xref>), to serve as the designated agency under subsection (a).</text> </paragraph></subsection><subsection id="HC8B83EF25514406DBBD2BF469550C0E9"><enum>(c)</enum><header>Large consumer reporting agency defined</header><text>The term <term>large consumer reporting agency</term> has the meaning given the term <term>consumer reporting agency that compiles and maintains files on consumers on a nationwide basis</term> under section 603(p) of the Fair Credit Reporting Act.</text></subsection></section><after-quoted-block>.</after-quoted-block></quoted-block> </section><enum>II</enum><header>National Security Freeze</header> <section id="HB6DF1509F62A45CDA1657C439973D473"><enum>201.</enum><header>National security freeze and additional protections for files and credit records of protected consumers</header><text display-inline="no-display-inline">Section 605 of the Fair Credit Reporting Act (<external-xref legal-doc="usc" parsable-cite="usc/15/1681c">15 U.S.C. 1681c</external-xref>) is amended by adding at the end the following:</text> <quoted-block display-inline="no-display-inline" id="HE3FF8BEE6B484A5D814540A797A4D96F" style="USC"> <subsection id="HE1175F4EC36D457D8822B169AF83B228"><enum>(i)</enum><header>National security freeze and additional protections for files and credit records of protected consumers</header> <paragraph id="H08F7B27038804B168ED7A168D2A3E06C"><enum>(1)</enum><header>Definitions</header><text>For purposes of this subsection:</text> <subparagraph id="H882EAFCE4F974ACDB524959440FECFA5"><enum>(A)</enum><text display-inline="yes-display-inline">The term <term>proper identification</term> has the meaning of such term as used under section 610.</text> </subparagraph><subparagraph id="HB892867DA9294E03B74A1FF64911B5DA"><enum>(B)</enum><text display-inline="yes-display-inline">The term <term>consumer reporting agency</term> means a consumer reporting agency that compiles and maintains files on consumers on a nationwide basis.</text> </subparagraph><subparagraph id="HAAB2D8C4087044AF9736D02393B2A1FC"><enum>(C)</enum><text>The term <term>security freeze</term> means a restriction placed on making consumer reports of a consumer, at the request of the consumer, that prohibits a consumer reporting agency from making a consumer report with respect to the consumer to any person for the purpose of opening a new account involving the extension of credit.</text> </subparagraph></paragraph><paragraph id="H7924EA1E89314CD394CDB8724958311A"><enum>(2)</enum><header>Request for security freeze, processing time, confirmation of freeze and personal identification number or password</header> <subparagraph id="HE18D3D2AB990472E9D0D544FEDE9BB36"><enum>(A)</enum><header>Request</header><text display-inline="yes-display-inline">A consumer may request that a consumer reporting agency place a security freeze by sending a request via mail, telephone, facsimile, internet, or other electronic media to the consumer reporting agency in a manner designated by the consumer reporting agency to receive such requests.</text> </subparagraph><subparagraph id="H392F30550F2640C1BD078B592840CCB3"><enum>(B)</enum><header>Placement of security freeze</header><text>A consumer reporting agency shall place a security freeze no later than 5 business days after receiving from the consumer—</text> <clause id="H764CC801CEE546B49CAE564DA61AE0D5"><enum>(i)</enum><text>a request described under subparagraph (A);</text> </clause><clause id="HF5995FEAAEDD4444AFBB7B1F07D3614C"><enum>(ii)</enum><text>proper identification; and</text> </clause><clause id="H83063D2C22134D079E19E42683D22678"><enum>(iii)</enum><text>payment of the required fee, if applicable.</text> </clause></subparagraph><subparagraph id="H9CCAA927286643079A1B2E071A9FEA59"><enum>(C)</enum><header>Confirmation and additional information</header><text display-inline="yes-display-inline">Not later than 10 business days after placing a security freeze, the consumer reporting agency shall—</text> <clause id="H021F376882B5457A860B2F5FE7B8CA04"><enum>(i)</enum><text display-inline="yes-display-inline">send confirmation of the placement to the consumer;</text> </clause><clause id="H2ABFA6448F5D46BB9AC43956BFC79B75"><enum>(ii)</enum><text display-inline="yes-display-inline">inform the consumer of the process by which the consumer may temporarily lift the security freeze and allow the consumer reporting agency to make a consumer report with respect to the consumer for a specific entity or a specific period of time;</text> </clause><clause id="HE9974C59FC6C4319809D566405921933"><enum>(iii)</enum><text>provide the consumer with a unique personal identification number or password to be used with the process described under subparagraph (B); and</text> </clause><clause id="H129267C1A22A480BA18BA08A00D07E4D"><enum>(iv)</enum><text display-inline="yes-display-inline">inform the consumer of the process by which the consumer may remove the security freeze.</text> </clause></subparagraph><subparagraph id="HE1B20B0AF8BC4DC19FFCEF0CE48EE916"><enum>(D)</enum><header>Notice to third parties</header><text>A consumer reporting agency may advise a third party that a security freeze has been placed with respect to a consumer.</text> </subparagraph></paragraph><paragraph id="H3D385F1A4E8D4C83B4F9D7B3A0ED7C67"><enum>(3)</enum><header>Requests to temporarily lift freeze, timing, request procedures</header> <subparagraph id="H2D94A837485A47B69ED045C6136C9358"><enum>(A)</enum><header>In general</header><text>If a consumer with a security freeze in place wishes to temporarily allow a consumer reporting agency to make a consumer report with respect to the consumer for a specific entity or a specific period of time, the consumer may notify the consumer reporting agency using a method of contact designated by the consumer reporting agency, requesting that the freeze be temporarily lifted, and providing, to complete the request, all of the following:</text> <clause id="H297594D35D524E3AA31F4BCF70F30BCD"><enum>(i)</enum><text>Proper identification.</text> </clause><clause id="HC732255DD9CE4E09B0529EE6C872DEEF"><enum>(ii)</enum><text>The unique personal identification number or password provided by the consumer reporting agency pursuant to paragraph (2)(C).</text> </clause><clause id="HEDDBC660C61241BBA8A66A999DFC5829"><enum>(iii)</enum><text>The applicable information regarding the entity or time period with respect to which the consumer wishes the security freeze to be lifted.</text> </clause><clause id="HC6CDD56D89754E3680C4EB0EF6A224A2"><enum>(iv)</enum><text>The required fee, if applicable.</text> </clause></subparagraph><subparagraph id="H2F0EEF7EC89B426BA56EF8D498C7DBD7"><enum>(B)</enum><header>Temporary lifting of security freeze</header><text display-inline="yes-display-inline">A consumer reporting agency that receives a request described under subparagraph (A) shall comply with the request not later than 3 business days after receiving the request.</text> </subparagraph><subparagraph id="H8265CBBC3E6B419DBB7F42214DA3A132"><enum>(C)</enum><header>Procedures</header><text display-inline="yes-display-inline">A consumer reporting agency may develop procedures involving the use of telephone, facsimile, the internet, or other electronic media to receive and process a request from a consumer described under subparagraph (A) in an expedited manner.</text> </subparagraph></paragraph><paragraph id="HC307C4C5DAE945B4959D486E17B9A8EA"><enum>(4)</enum><header>Mandatory removal or temporary lifting of freeze, notice to consumer, and third party requests</header> <subparagraph id="H4E980CEDA64048D9BAFFC4A7417CC1F4"><enum>(A)</enum><header>In general</header><text>A consumer reporting agency shall remove or temporarily lift a freeze placed on the consumer report of a consumer only in the following cases:</text> <clause id="H837B8ADF5B994A349627FBAE69EC4BED"><enum>(i)</enum><text>Upon consumer request.</text> </clause><clause id="H0A8B8FDC70894E3DBEE3AB006F3FC74D"><enum>(ii)</enum><text>The security freeze was placed due to a material misrepresentation of fact by the consumer.</text> </clause></subparagraph><subparagraph id="H08F2F04F012E4440990242B9E746158E"><enum>(B)</enum><header>Notice if removal not by request</header><text>If a consumer reporting agency intends to remove a security freeze with respect to a consumer, and is not doing so at the request of the consumer, the consumer reporting agency shall notify the consumer in writing prior to removing the security freeze.</text> </subparagraph><subparagraph id="H7E6F57026661460EAA7CA4C762AEADBE"><enum>(C)</enum><header>Third party requests</header><text>If a third party requests access to a consumer report of a consumer with respect to which a security freeze is in effect, where such request is in connection with an application for credit or any other use, and the consumer does not allow such consumer report to be accessed, the third party may treat the application as incomplete.</text> </subparagraph></paragraph><paragraph id="H03493E1F608445E3BDEC2113F68EF071"><enum>(5)</enum><header>Removal of freeze by consumer request</header><text>A security freeze shall remain in place until the consumer requests, using a method of contact designated by the consumer reporting agency, that the security freeze be removed. A consumer reporting agency shall remove a security freeze within 3 business days of receiving such a request for removal from the consumer, who provides along with it—</text> <subparagraph id="H37EA2437F1C34497AA632B96D4FC5F32"><enum>(A)</enum><text>proper identification;</text> </subparagraph><subparagraph id="H1562F228D8724E89B3089D5D106F5DEB"><enum>(B)</enum><text display-inline="yes-display-inline">the unique personal identification number or password provided by the consumer reporting agency pursuant to paragraph (2)(C); and</text> </subparagraph><subparagraph id="H07B93AA3872E46738948945D858F8118"><enum>(C)</enum><text>the required fee, if applicable.</text> </subparagraph></paragraph><paragraph id="HF4F3114BB60C4859965A80813DBA4D90"><enum>(6)</enum><header>Exceptions</header><text>A security freeze shall not apply to the making of a consumer report for use by the following:</text> <subparagraph id="H46890A57C2E346BCAB7C629AC66B951F"><enum>(A)</enum><text>A person or entity, or a subsidiary, affiliate, or agent of that person or entity, or an assignee of a financial obligation owed by the consumer to that person or entity, or a prospective assignee of a financial obligation owed by the consumer to that person or entity in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment an account or contract including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owed for the account, contract, or negotiable instrument. For purposes of this subparagraph, <quote>reviewing the account</quote> includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.</text> </subparagraph><subparagraph id="HB666ED8E915F45288F071A55E9F149E8"><enum>(B)</enum><text>A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted for purposes of facilitating the extension of credit or other permissible use.</text> </subparagraph><subparagraph id="H832BCCD04DE8407AA8205EE9B07258B1"><enum>(C)</enum><text>Any Federal, State or local agency, law enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena.</text> </subparagraph><subparagraph id="H799B347FCC8147D78AABB0B45133CD8B"><enum>(D)</enum><text>A child support agency acting pursuant to part D of title IV of the Social Security Act.</text> </subparagraph><subparagraph id="H73D0F28AAAF240BDAB75F7616F4D8900"><enum>(E)</enum><text>A State or its agents or assigns acting to investigate fraud or acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities, provided such responsibilities are consistent with a permissible purpose under section 604.</text> </subparagraph><subparagraph id="HC9E2B9110146496D9765B62454F6FE17"><enum>(F)</enum><text>A person using credit information for the purposes described under section 604(c).</text> </subparagraph><subparagraph id="HB88194EFFDEC45F495A337DC67AC3598"><enum>(G)</enum><text>Any person or entity administering a credit file monitoring subscription or similar service to which the consumer has subscribed.</text> </subparagraph><subparagraph id="H18715D7980F04DFC9866A22DAB86F16F"><enum>(H)</enum><text>Any person or entity for the purpose of providing a consumer with a copy of the consumer’s consumer report or credit score, upon the request of the consumer.</text> </subparagraph><subparagraph id="HEA525798C57C41CB8BD22499A1BB7895"><enum>(I)</enum><text>Any person using the information in connection with the underwriting of insurance.</text> </subparagraph><subparagraph id="HAD22D8CBF6EC40819A3473A4F112C010"><enum>(J)</enum><text>Any person using the information for employment, tenant, or background screening purposes.</text> </subparagraph></paragraph><paragraph id="HB2DCB0861B6E4387823B5B235208FA29"><enum>(7)</enum><header>Fees</header> <subparagraph id="HC9BA45AEE6F34E8ABF32F1C65944EAE1"><enum>(A)</enum><header>In general</header><text>A consumer reporting agency may charge a fee of no more than $5 to a consumer for each security freeze, removal of a security freeze, or temporary lifting of a security freeze.</text> </subparagraph><subparagraph id="H9BC522A3F2E143B3A7DF87A1A8BE70C4"><enum>(B)</enum><header>Exception</header><text>A consumer reporting agency shall not charge any fee described under subparagraph (A) to—</text> <clause id="H36F4A514A7F34E8299505C536C8CE22E"><enum>(i)</enum><text>a victim of identity theft who has submitted, at the time the security freeze is requested, a copy of a valid investigative or incident report or complaint with a law enforcement agency about the unlawful use of the victim’s identifying information by another person;</text> </clause><clause id="HE336D589AF134D6D94BB5588C5D00166"><enum>(ii)</enum><text>except as provided in subsection (j), a consumer who is a minor or 65 years of age or older for the initial placement and removal of a security freeze; or</text> </clause><clause id="H3CD70019668A4A44A40E6468EAD1E387"><enum>(iii)</enum><text>a consumer who has submitted a copy of the consumer’s orders calling the service member to military service and any orders further extending the service member’s period of service if currently active.</text> </clause></subparagraph></paragraph><paragraph id="H9AB81DF7233241CBB12C44A64E5EDEE8"><enum>(8)</enum><header>Modification of official information</header> <subparagraph id="H5B6091EA75D24F7D871A122ABDDE8DAD"><enum>(A)</enum><header>In general</header><text>If a security freeze is in place, a consumer reporting agency shall not change any of the following official information in the file of a consumer without sending confirmation of the change to the consumer within 30 days of the change being posted to the file of the consumer:</text> <clause id="HE9DF2E0ABF1743ACBCE12DF5C41FE83D"><enum>(i)</enum><text>Name.</text> </clause><clause id="HD885A96D973A41A5B52233BBD3AF80E7"><enum>(ii)</enum><text>Date of birth.</text> </clause><clause id="HBCC8DF1115C644BE800F8586413B64DB"><enum>(iii)</enum><text>Social Security number.</text> </clause><clause id="H882F16B3ABF14C6789AD5F6DB5651A8A"><enum>(iv)</enum><text>Address.</text> </clause></subparagraph><subparagraph id="H6D237402BE2142D18A1DC8B8DE51B373"><enum>(B)</enum><header>Exception for technical modifications</header><text>Subparagraph (A) shall not apply to technical modifications of official information of a consumer, including name and street abbreviations, complete spellings, or transposition of numbers or letters.</text> </subparagraph><subparagraph id="H571E4F8FB0F049E9969B69AB32AD2969"><enum>(C)</enum><header>Address changes</header><text>In the case of an address change, the confirmation described under subparagraph (A) shall be sent to both the new address and to the former address.</text> </subparagraph></paragraph><paragraph id="H105EC5116FB24B28A5C1964DA2663416"><enum>(9)</enum><header>Notice of rights</header><text display-inline="yes-display-inline">At any time a consumer is required to receive a summary of rights required under section 609, the following notice shall be included:</text> <quoted-block display-inline="no-display-inline" id="HB4A0B27BFD3B48A1A0FD6CDB6D9D4CA2" style="OLC"> <subsection commented="no" id="HD32BF078EFE44B9A8C8E730C64289A00"><enum></enum><text display-inline="yes-display-inline">Consumers Have the Right To Obtain a Security Freeze—You have a right to place a <quote>security freeze</quote> on your credit report, which will prohibit a consumer reporting agency from releasing information in your credit report without your express authorization. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, government services or payments, rental housing, employment, investment, license, cellular phone, utilities, digital signature, internet credit card transaction, or other services, including an extension of credit at point of sale. When you place a security freeze on your credit report, you will be provided a personal identification number or password to use if you choose to remove the security freeze on your credit report or authorize the release of your credit report to a particular entity or for a period of time after the freeze is in place. To provide that authorization you must contact the consumer reporting agency by one of the methods that it requires, and provide all of the following:</text> <paragraph id="H06D359B94E3D434589452C48F6734EA4"><enum>(1)</enum><text>The personal identification number or password.</text> </paragraph><paragraph id="H00BAAD989306406AAEE9E8807CFF7E66"><enum>(2)</enum><text>Proper identification to verify your identity.</text> </paragraph><paragraph id="H643F6732B5B1495388207F738BB87494"><enum>(3)</enum><text>The applicable information regarding the entity or time period with respect to which the consumer wishes the security freeze to be lifted.</text> </paragraph><paragraph id="H27827E1EEB3B4757AD995DE3CA6C5207"><enum>(4)</enum><text>The payment of the appropriate fee, if applicable.</text> </paragraph><continuation-text continuation-text-level="subsection">A consumer reporting agency must authorize the release of your credit report no later than 3 business days after receiving all of the above items by any method that the consumer reporting agency allows.</continuation-text></subsection><subsection commented="no" id="H03835BE2CAEE4858AB9E2AF828965118"><enum></enum><text display-inline="yes-display-inline">A security freeze does not apply to a person or entity, or its affiliates, or collection agencies acting on behalf of the person or entity, with which you have an existing account that requests information in your credit report for the purposes of reviewing or collecting the account. Reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.</text> </subsection><subsection commented="no" id="H0AADA849657A47B9814865E912D3F521"><enum></enum><text display-inline="yes-display-inline">You have a right to bring a civil action against anyone, including a consumer reporting agency, who willfully or negligently fails to comply with the Federal law on security freezes (section 605C of the Fair Credit Reporting Act).</text> </subsection><subsection commented="no" id="H82F74EE98DF44212AE0B78D5AF0DFB9C"><enum></enum><text display-inline="yes-display-inline">A consumer reporting agency has the right to charge you up to Five Dollars ($5.00) to place a security freeze, up to Five Dollars ($5.00) to temporarily lift a security freeze, and up to Five Dollars ($5.00) to remove a security freeze. However, you shall not be charged any fee if you are a victim of identity theft who has submitted, at the time the security freeze is requested, a copy of a valid investigative or incident report or complaint with a law enforcement agency about the unlawful use of your identifying information by another person, or if you are a minor or sixty-five (65) years of age or older for the initial placement and removal of a security freeze.</text></subsection><after-quoted-block>.</after-quoted-block></quoted-block> </paragraph></subsection><subsection id="H568EE426149D4B9387948CD390DECCC0"><enum>(j)</enum><header>National protections for files and credit records of protected consumers</header> <paragraph id="H92E625DFF0CF4B8E9121F6C958C63421"><enum>(1)</enum><header>Definitions</header><text>As used in this subsection:</text> <subparagraph id="H499B480034744C928C9B900DB9EE2CB2"><enum>(A)</enum><text display-inline="yes-display-inline">The term <term>consumer reporting agency</term> means a consumer reporting agency that compiles and maintains files on consumers on a nationwide basis.</text> </subparagraph><subparagraph id="H194BC7B95E87475AB6E6774EE8195B99"><enum>(B)</enum><text>The term <term>protected consumer</term> means an individual who is—</text> <clause id="H68FB599379B54014B67CDEA866AF5EEC"><enum>(i)</enum><text>under the age of 16 years at the time a request for the placement of a security freeze is made; or</text> </clause><clause id="H2B0A5B9B55874B5DAF65484BD3C7B292"><enum>(ii)</enum><text>an incapacitated person or a protected person for whom a guardian or conservator has been appointed.</text> </clause></subparagraph><subparagraph id="H99F36FE6EACE42878D3457CC24332F09"><enum>(C)</enum><text>The term <term>record</term> means a compilation of information that—</text> <clause id="HA5680A7161CB43BA947D862F0C559B26"><enum>(i)</enum><text>identifies a protected consumer;</text> </clause><clause id="H5BBBDD3AC51644D5A43057FF007DAA49"><enum>(ii)</enum><text>is created by a consumer reporting agency solely for the purpose of complying with this subsection; and</text> </clause><clause id="HA480A7DBD8C746799767AEE850A7778A"><enum>(iii)</enum><text>may not be created or used to consider the protected consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living.</text> </clause></subparagraph><subparagraph id="H0AF127245E054FD7894F70DD9636385D"><enum>(D)</enum><text>The term <term>representative</term> means a person who provides to a consumer reporting agency sufficient proof of authority to act on behalf of a protected consumer.</text> </subparagraph><subparagraph id="H7C4395B5CAD14668A5B6AF2626AA7002"><enum>(E)</enum><text>The term <term>security freeze</term> means—</text> <clause id="HD20B7E8CD42D42179E4DB3A4D78C3D4B"><enum>(i)</enum><text>if a consumer reporting agency does not have a file pertaining to a protected consumer, a restriction that—</text> <subclause id="HCFC199F1D9984E7AB9B432BC74A901F2"><enum>(I)</enum><text>is placed on the protected consumer’s record in accordance with this subsection; and</text> </subclause><subclause id="H6BEC731F6E1744498BBF5FF39BC2E041"><enum>(II)</enum><text>prohibits the consumer reporting agency from releasing the protected consumer’s record except as provided in this subsection; or</text> </subclause></clause><clause id="H8757BBCB63074B23917E80EE2DB3ED28"><enum>(ii)</enum><text>if a consumer reporting agency has a file pertaining to the protected consumer, a restriction that—</text> <subclause id="HEC03AB58CB91457582E9E49A81E64C8D"><enum>(I)</enum><text>is placed on the protected consumer’s consumer report in accordance with this subsection; and</text> </subclause><subclause id="H0B6D32DB6A124FF09CBAE5061BB4F319"><enum>(II)</enum><text>prohibits the consumer reporting agency from releasing the protected consumer’s consumer report except as provided in this subsection.</text> </subclause></clause></subparagraph><subparagraph id="H3F5638497479419686DBDA183066E450"><enum>(F)</enum><text>The term <term>sufficient proof of authority</term> means documentation that shows a representative has authority to act on behalf of a protected consumer and includes—</text> <clause id="H1A3CF9291745498ABB088C683C249F49"><enum>(i)</enum><text>an order issued by a court of law;</text> </clause><clause id="H93E3D389E604453BBD4D01FED1BE57C0"><enum>(ii)</enum><text>a lawfully executed and valid power of attorney; or</text> </clause><clause id="HD292340DE85A4F2D951CFDC40C95F47B"><enum>(iii)</enum><text>a written, notarized statement signed by a representative that expressly describes the authority of the representative to act on behalf of a protected consumer.</text> </clause></subparagraph><subparagraph id="H96AD065D6F184E0E80DA0EB5C3E38673"><enum>(G)</enum><text>The term <term>sufficient proof of identification</term> means information or documentation that identifies a protected consumer or a representative of a protected consumer and includes—</text> <clause id="HBEDB68DB00704C5E93AE5CA1CEF2C28E"><enum>(i)</enum><text>a Social Security number or a copy of a Social Security card issued by the Social Security Administration;</text> </clause><clause id="H13BD21CDBC314485BDED448A8CA98E54"><enum>(ii)</enum><text>a certified or official copy of a birth certificate issued by the entity authorized to issue the birth certificate; or</text> </clause><clause id="H910285B90FBE47E595636ABF962D73CE"><enum>(iii)</enum><text>a copy of a driver’s license, an identification card issued by the Motor Vehicle Administration, or any other government-issued identification.</text> </clause></subparagraph></paragraph><paragraph id="HA0EDDE53BD1A4CFBA451924FBE7C7DFB"><enum>(2)</enum><header>Exceptions</header><text display-inline="yes-display-inline">This subsection shall not apply to the making of a consumer report for use by the following:</text> <subparagraph id="H7FCB49EF0BD74C0A9E36B28FAB0448DE"><enum>(A)</enum><text>A person or entity, or a subsidiary, affiliate, or agent of that person or entity, or an assignee of a financial obligation owed by the consumer to that person or entity, or a prospective assignee of a financial obligation owed by the consumer to that person or entity in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment an account or contract including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owed for the account, contract, or negotiable instrument. For purposes of this subparagraph, <quote>reviewing the account</quote> includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.</text> </subparagraph><subparagraph id="H325311D427B94D28B040B84A390EB6B3"><enum>(B)</enum><text>A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted for purposes of facilitating the extension of credit or other permissible use.</text> </subparagraph><subparagraph id="H92651A40B1FC409693F397DEECF99A4F"><enum>(C)</enum><text>Any Federal, State or local agency, law enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena.</text> </subparagraph><subparagraph id="HCC639F3D792B4D1481E4A6E6C9C949C6"><enum>(D)</enum><text>A child support agency acting pursuant to part D of title IV of the Social Security Act.</text> </subparagraph><subparagraph id="H4E8947112FA641CC81EB77B79CFD5E21"><enum>(E)</enum><text>The State or its agents or assigns acting to investigate fraud or acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities, provided such responsibilities are consistent with a permissible purpose under section 604.</text> </subparagraph><subparagraph id="H0F9B7ABB8D1B4883A1CA52892A748A2C"><enum>(F)</enum><text display-inline="yes-display-inline">A person using credit information for the purposes described under section 604(c).</text> </subparagraph><subparagraph id="H43044B6F124846AF8B20788584C535DD"><enum>(G)</enum><text>Any person or entity administering a credit file monitoring subscription or similar service to which the consumer has subscribed.</text> </subparagraph><subparagraph id="H55D5327A51E54128BC2BC0008F43AC60"><enum>(H)</enum><text>Any person or entity for the purpose of providing a consumer with a copy of the consumer’s consumer report or credit score, upon the request of the consumer.</text> </subparagraph><subparagraph id="H3B52DB87CCAE429FA25AC6BFFB3F758C"><enum>(I)</enum><text>Any person using the information in connection with the underwriting of insurance.</text> </subparagraph><subparagraph id="H69E2E1A9C42F4066922304F1533AF57A"><enum>(J)</enum><text>Any person using the information for employment, tenant or background screening purposes.</text> </subparagraph></paragraph><paragraph id="HFA3A9D0B7768497E858BE444AA590E80"><enum>(3)</enum><header>Placing a freeze for a protected consumer</header> <subparagraph id="HEFB30F277C2D49978D1D30E12D296D24"><enum>(A)</enum><header>In general</header><text display-inline="yes-display-inline">A consumer reporting agency shall place a security freeze for a protected consumer if—</text> <clause id="HA87C5477D500406B9F7A919DDEA85D6F"><enum>(i)</enum><text>the consumer reporting agency receives a request from the protected consumer’s representative for the placement of the security freeze under this subsection; and</text> </clause><clause id="H0EE164C6288C4A35BA1B02C5913A5C35"><enum>(ii)</enum><text>the protected consumer’s representative—</text> <subclause id="HB9727C244572487C92222AEA31B89E7D"><enum>(I)</enum><text>submits the request to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency;</text> </subclause><subclause id="H8F0214664DD34E41B6AFF15013572700"><enum>(II)</enum><text>provides to the consumer reporting agency sufficient proof of identification of the protected consumer and the representative;</text> </subclause><subclause id="H0BC89D4AAA784C65AFDE79D6F9DF59A1"><enum>(III)</enum><text>provides to the consumer reporting agency sufficient proof of authority to act on behalf of the protected consumer; and</text> </subclause><subclause id="H125DB0791B2F45E49CD65C79BB28EB12"><enum>(IV)</enum><text>pays to the consumer reporting agency a fee as provided under this subsection.</text> </subclause></clause></subparagraph><subparagraph id="HF7BFB0E4A5C74EE59F37F195AD558E9D"><enum>(B)</enum><header>Creation of file</header><text>If a consumer reporting agency does not have a file pertaining to a protected consumer when the consumer reporting agency receives a request under subparagraph (A), the consumer reporting agency shall create a credit record for the protected consumer.</text> </subparagraph><subparagraph id="H03D2D1FA8CC142969596D1E17629DEC7"><enum>(C)</enum><header>Placement of security freeze</header><text>Within 3 days after receiving a request described under subparagraph (A), a consumer reporting agency shall place a security freeze for the protected consumer.</text> </subparagraph></paragraph><paragraph id="H162C0BAF4AE94F08A5B109178E1AB84D"><enum>(4)</enum><header>Prohibition on release of record or file of protected consumer</header><text display-inline="yes-display-inline">Unless a security freeze for a protected consumer is removed in accordance with this subsection, a consumer reporting agency may not release the protected consumer’s consumer report, any information derived from the protected consumer’s consumer report, or any record created for the protected consumer.</text> </paragraph><paragraph id="H6B575DAE447B4C8F9042063963588525"><enum>(5)</enum><header>Timeline for a freeze for a protected consumer</header><text>A security freeze for a protected consumer placed under this subsection shall remain in effect until—</text> <subparagraph id="HEC7677D0578A4A948F5C00FBC9F72956"><enum>(A)</enum><text>the protected consumer or the protected consumer’s representative requests the consumer reporting agency to remove the security freeze in accordance with paragraph (6); or</text> </subparagraph><subparagraph id="HF950881905354069A8937E065607A4E8"><enum>(B)</enum><text>the security freeze is removed in accordance with paragraph (9).</text> </subparagraph></paragraph><paragraph id="H6A6AE6A0941245A484451134ED9063CB"><enum>(6)</enum><header>Removal of a protected consumer security freeze</header><text>If a protected consumer or a protected consumer’s representative wishes to remove a security freeze for the protected consumer, the protected consumer or the protected consumer’s representative shall—</text> <subparagraph id="H1F7A7CC8DFBE43969CBA1867F1378ECB"><enum>(A)</enum><text>submit a request for the removal of the security freeze to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency;</text> </subparagraph><subparagraph id="H2524A5CDDF93485CAAA55C40BB7788DB"><enum>(B)</enum><text>provide to the consumer reporting agency—</text> <clause id="H3DDA894D2B4B406792282BA487BCC168"><enum>(i)</enum><text>in the case of a request by the protected consumer—</text> <subclause id="HD2A9F8BC14B14C99B1C3E9796B92B1A5"><enum>(I)</enum><text>proof that the sufficient proof of authority for the protected consumer’s representative to act on behalf of the protected consumer is no longer valid; and</text> </subclause><subclause id="H49A7A34FF1B84DF3B6ED24110D1715E9"><enum>(II)</enum><text>sufficient proof of identification of the protected consumer; or</text> </subclause></clause><clause id="HE2E77017A9894ACEA458E25EE3BC1659"><enum>(ii)</enum><text>in the case of a request by the representative of a protected consumer—</text> <subclause id="H96C0750685FA460C94E3B5E43789E99E"><enum>(I)</enum><text>sufficient proof of identification of the protected consumer and the representative; and</text> </subclause><subclause id="HCF64EB430A144F1DAB5D5E1E1F4DD67E"><enum>(II)</enum><text>sufficient proof of authority to act on behalf of the protected consumer; and</text> </subclause></clause><clause id="HE72B6F418511412CB0E574898DE3D57B"><enum>(iii)</enum><text>pay to the consumer reporting agency a fee, if applicable, as provided in paragraph (8).</text> </clause></subparagraph></paragraph><paragraph id="H1219ADD3BE3B4A698E33EE7423CEB7DA"><enum>(7)</enum><header>Timing of removal of a protected consumer freeze</header><text>Within 3 days after receiving a request described under paragraph (6), the consumer reporting agency shall remove the security freeze for the protected consumer.</text> </paragraph><paragraph id="H063E55561EBC4551AAA2C7F9EF772612"><enum>(8)</enum><header>Fees for a protected consumer freeze</header> <subparagraph id="H4E10FCE9C4434F7EBCF9CED95EC3D58F"><enum>(A)</enum><header>In general</header><text>Except as provided in subparagraph (B), a consumer reporting agency may not charge a fee for any service performed under this subsection.</text> </subparagraph><subparagraph id="H8A3DE294A6394B9EAD9216520EC5F8E5"><enum>(B)</enum><header>Reasonable fee permitted</header><text>A consumer reporting agency may charge a reasonable fee, not exceeding $5, for each placement or removal of a security freeze for a protected consumer.</text> </subparagraph><subparagraph id="HC8D47AAFC1724671978DE4EB65B5633F"><enum>(C)</enum><header>Exceptions</header><text>Notwithstanding subparagraph (B), a consumer reporting agency may not charge any fee under this subsection if—</text> <clause id="H1A0A60E217A146A98A71695FEF008908"><enum>(i)</enum><text>the protected consumer’s representative has obtained a police report or affidavit of alleged identity fraud against the protected consumer and provides a copy of the report to the consumer reporting agency; or</text> </clause><clause id="HB0AA9C828710451D8B989B11AF24E979"><enum>(ii)</enum><text>a request for the placement or removal of a security freeze is for a protected consumer who is under the age of sixteen years of age at the time of the request and the consumer reporting agency has a consumer report pertaining to the protected consumer.</text> </clause></subparagraph></paragraph><paragraph id="H881EE96032C6434D9AF8B8183F624778"><enum>(9)</enum><header>Deletion of file or record created based on a material misrepresentation</header><text>A consumer reporting agency may remove a security freeze for a protected consumer or delete a record of a protected consumer if the security freeze was placed or the record was created based on a material misrepresentation of fact by the protected consumer or the protected consumer’s representative.</text></paragraph></subsection><after-quoted-block>.</after-quoted-block></quoted-block> </section><enum>III</enum><header>Credit rating agency use of social security numbers</header> <section id="H4FEFCE05613A4000B830CB574B79528B"><enum>301.</enum><header>Prohibition on the use of Social Security numbers</header> <subsection id="H594CE327626541B387C36DE6BC9B2E36"><enum>(a)</enum><header>In general</header><text>Section 605 of the Fair Credit Reporting Act (<external-xref legal-doc="usc" parsable-cite="usc/15/1681c">15 U.S.C. 1681c</external-xref>), as amended by title II, is amended by adding at the end the following:</text> <quoted-block id="H7A0A075EFF254FC29584CDA6ED5316F1" style="OLC"> <subsection id="H2A52250BAC7D473CBC421945053AFDED"><enum>(k)</enum><header>Prohibition on the use of social security numbers</header><text>A consumer reporting agency that compiles and maintains files on consumers on a nationwide basis—</text> <paragraph id="HAF612C2E0CBB4223822D1B8150E2BA63"><enum>(1)</enum><text>may not make any consumer report containing a Social Security number; and</text> </paragraph><paragraph id="H09E9C6045AC2415D8F9C6AE87A3D2EF8"><enum>(2)</enum><text>may not use the Social Security number of a consumer as a method to identify the consumer, or for any other purpose.</text></paragraph></subsection><after-quoted-block>.</after-quoted-block></quoted-block> </subsection><subsection id="H3C273F33D4624FD6A8875B25BA972306"><enum>(b)</enum><header>Conforming amendment</header><text>Section 609(a)(1) of the Fair Credit Reporting Act (<external-xref legal-doc="usc" parsable-cite="usc/15/1681g">15 U.S.C. 1681g(a)(1)</external-xref>) is amended by striking <quote>except that—</quote> and all that follows through <quote>(B) nothing</quote> and inserting <quote>except that nothing</quote>.</text> </subsection><subsection id="H6045978A21D04077B4A1E333D69ED803"><enum>(c)</enum><header>Effective date</header><text>The amendments made by this section shall take effect on January 1, 2020.</text> </subsection></section>