Protection of data through security freeze

(a)

In general

The Fair Credit Reporting Act (15 U.S.C. 1681 et seq.) is amended by inserting after section 605B (relating to block resulting from identity theft) the following new section:

605C.

Protection of data through security freeze

(a)

In general

(1)

Emplacement

A consumer may place a security freeze on the consumer report of the consumer by making a request to a consumer reporting agency in writing or by telephone. (2)

Consumer disclosure

If a consumer requests a security freeze, the consumer reporting agency shall disclose to the consumer the process of placing and removing the security freeze and explain to the consumer the potential consequences of the security freeze. (b)

Effect of Security Freeze

(1)

Release of information blocked

If a security freeze is in place on a consumer report of a consumer, a consumer reporting agency may not release the consumer report or information from the consumer report to a third party without prior express authorization from the consumer. (2)

Information provided to third parties

Paragraph (2) shall not be construed as preventing a consumer reporting agency from advising a third party that a security freeze is in effect with respect to a consumer report of a consumer. (3)

Treatment as incomplete application

If a third party, in connection with an application for credit, requests access to a consumer report on which a security freeze is in place, the third party may treat the application as incomplete. (c)

Removal; Temporary Suspension

(1)

In general

Except as provided in paragraph (4), a security freeze shall remain in place until the consumer requests that the security freeze be removed. A consumer may remove a security freeze on the consumer report of the consumer by making a request to a consumer reporting agency in writing or by telephone. (2)

Conditions

A consumer reporting agency may remove a security freeze placed on the consumer report of a consumer only— (A)upon the consumer’s request, pursuant to paragraph (1); or (B)if the agency determines that the consumer report of a consumer was frozen due to a material misrepresentation of fact by the consumer. (3)

Notification to consumer

If a consumer reporting agency intends to remove a freeze upon the consumer report of a consumer pursuant to paragraph (2)(B), the consumer reporting agency shall notify the consumer in writing prior to removing the freeze on the consumer report. (4)

Temporary suspension

A consumer may have a security freeze on the consumer report of the consumer temporarily suspended by making a request to a consumer reporting agency in writing or by telephone and specifying beginning and ending dates for the period during which the security freeze is not to apply to the consumer report of the consumer. (d)

Response Times; Notification of Other Entities

(1)

In general

A consumer reporting agency shall— (A)place a security freeze on the consumer report of a consumer under subsection (a) not later than 5 business days after receiving a request from the consumer under subsection (a)(1); and (B)remove, or temporarily suspend, a security freeze within 3 business days after receiving a request for removal or temporary suspension from the consumer under subsection (c). (2)

Notification of other covered entities

If the consumer requests in writing or by telephone that other covered entities be notified of the request, the consumer reporting agency shall notify all other consumer reporting agencies described in section 603(p)(1) of the request within 3 days after placing, removing, or temporarily suspending a security freeze on the consumer report of the consumer under subsection (a), (c)(2)(A), or (c)(4), respectively. (3)

Implementation by other covered entities

A consumer reporting agency that is notified of a request under paragraph (2) to place, remove, or temporarily suspend a security freeze on a consumer report of a consumer shall place, remove, or temporarily suspend the security freeze on that consumer report within 3 business days after receiving the notification. (e)

Confirmation

(1)

In general

Whenever a consumer reporting agency places, removes, or temporarily suspends a security freeze on the consumer report of a consumer at the request of that consumer under subsection (a) or (c), respectively, the consumer reporting agency shall send a written confirmation of such action to the consumer within 10 business days after placing, removing, or temporarily suspending the security freeze on the consumer report. (2)

Exception

This subsection shall not apply to the placement, removal, or temporary suspension of a security freeze by a consumer reporting agency because of a notification received under subsection (d)(2). (f)

ID required

A consumer reporting agency may not place, remove, or temporarily suspend a security freeze on the consumer report of a consumer at the consumer’s request unless the consumer provides proper identification (within the meaning of section 610(a)(1)) and the regulations prescribed under such subsection. (g)

Exceptions

This section shall not apply to the use of a consumer credit report by any of the following: (1)A person or entity, or a subsidiary, affiliate, or agent of that person or entity, or an assignee of a financial obligation owing by the consumer to that person or entity, or a prospective assignee of a financial obligation owing by the consumer to that person or entity in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment an account or contract, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument. (2)Any Federal, State or local agency, law enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena. (3)A child support agency or its agents or assigns acting pursuant to subtitle D of title IV of the Social Security Act or similar State law. (4)The Department of Health and Human Services, a similar State agency, or the agents or assigns of the Federal or State agency acting to investigate medicare or medicaid fraud. (5)The Internal Revenue Service or a State or municipal taxing authority, or a State department of motor vehicles, or any of the agents or assigns of these Federal, State, or municipal agencies acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of their other statutory responsibilities. (6)The use of consumer credit information for the purposes of prescreening as provided under this title. (7)Any person or entity administering a credit file monitoring subscription to which the consumer has subscribed. (8)Any person or entity for the purpose of providing a consumer with a copy of his or her credit report or credit score upon the consumer’s request. (h)

Fees

(1)

In general

(A)

Certain reasonable fees allowed

Except as provided in paragraph (2), a consumer reporting agency may charge a reasonable fee, as determined by the Commission, for placing or temporarily suspending a security freeze on the consumer report of a consumer. (B)

Factors to be considered

In considering what is reasonable for the purpose of subparagraph (A), the Commission shall consider the prevailing fees permitted by State law immediately before the date of the enactment of the Identity Theft Protection Act of 2006. (C)

Fee for removal of freeze prohibited

No fee may be charged for removal of a security freeze. (2)

ID theft victims

A consumer reporting agency may not charge a fee for placing, removing, or temporarily suspending a security freeze on the consumer report of a consumer if— (A)the consumer— (i)is a victim of identity theft; and (ii)has filed a police report, investigative report, or complaint made to a police department with respect to the theft; or (B)the consumer is the recipient of a notice that a breach of data security has occurred with respect to information of the consumer that is required by law to be maintained securely and in confidence. (i)

Limitation on Information Changes in Frozen Reports

(1)

In general

If a security freeze is in place on the consumer report of a consumer, a consumer reporting agency may not change any of the following official information in that consumer report without sending a written confirmation of the change to the consumer within 30 days after the change is made: (A)Name. (B)Date of birth. (C)Social Security number. (D)Address. (2)

Confirmation

(A)

In general

Paragraph (1) shall not be construed as requiring written confirmation for technical modifications of a consumer’s official information, including name and street abbreviations, complete spellings, or transposition of numbers or letters. (B)

Old and new addresses

In the case of an address change, the written confirmation shall be sent to both the new address and to the former address. (j)

Certain Entity Exemptions

(1)

Aggregators and other agencies

The provisions of subsections (a) through (h) shall not apply to a consumer reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the data base of another consumer reporting agency or multiple consumer reporting agencies, and does not maintain a permanent data base of consumer information from which new consumer reports are produced. (2)

Other exempted entities

The following entities shall not be required to place a security freeze in a consumer report under this section: (A)A check services or fraud prevention services company, which issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments. (B)A deposit account information service company, which issues reports regarding account closures due to fraud, substantial overdrafts, automated teller machine abuse, or similar negative information regarding a consumer, to inquiring depository institutions or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring depository institution or other financial institution.

(b)

Effective date

The amendment made by subsection (a) shall take effect at the end of the 6-month period beginning on the date of the enactment of this Act.