[Congressional Bills 110th Congress]
[From the U.S. Government Publishing Office]
[S. 806 Introduced in Senate (IS)]

  1st Session
                                 S. 806

To give consumers tools to protect themselves from ID theft by allowing 
 them to prevent unauthorized access to their credit reports, and for 
                            other purposes.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                             March 7, 2007

   Mr. Pryor introduced the following bill; which was read twice and 
    referred to the Committee on Banking, Housing, and Urban Affairs

_______________________________________________________________________

                                 A BILL


 
To give consumers tools to protect themselves from ID theft by allowing 
 them to prevent unauthorized access to their credit reports, and for 
                            other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Consumer ID Protection and Security 
Act''.

SEC. 2. SECURITY FREEZE.

    (a) In General.--
            (1) Emplacement.--A consumer may place a security freeze on 
        the consumer's credit report by making a request to a consumer 
        credit reporting agency in writing, by telephone, or through a 
        secure electronic connection if such a connection is made 
        available by the consumer credit reporting agency.
            (2) Consumer disclosure.--If a consumer requests a security 
        freeze, the consumer credit reporting agency shall disclose to 
        the consumer the process of placing and removing the security 
        freeze. A consumer credit reporting agency may not imply or 
        inform a consumer that the placement or presence of a security 
        freeze on the consumer's credit report may negatively affect 
        the consumer's credit score.
    (b) Effect of Security Freeze.--
            (1) Release of information blocked.--If a security freeze 
        is in place on a consumer's credit report, a consumer credit 
        reporting agency may not release the credit report for consumer 
        credit purposes to a third party without prior express 
        authorization from the consumer.
            (2) Information provided to third parties.--Paragraph (1) 
        does not prevent a consumer credit reporting agency from 
        advising a third party that a security freeze is in effect with 
        respect to the consumer's credit report. If a third party, in 
        connection with a request for information in any circumstance 
        under which a consumer reporting agency may furnish a consumer 
        report under section 604(a) of the Fair Credit Reporting Act 
        (15 U.S.C. 1681b), requests access to a consumer credit report 
        on which a security freeze is in place, the third party may 
        treat any application associated with the request as 
        incomplete.
            (3) Consumer credit score not affected.--The placement of a 
        security freeze on a credit report may not be taken into 
        account for any purpose in determining the credit score of the 
        consumer to whom the account relates.
    (c) Removal; Temporary Suspension.--
            (1) In general.--Except as provided in paragraph (2)(B), a 
        security freeze shall remain in place until the consumer 
        requests that the security freeze be removed. A consumer may 
        remove a security freeze on the consumer's credit report by 
        making a request to a consumer credit reporting agency in 
        writing, by telephone, or through a secure electronic 
        connection made available by the consumer credit reporting 
        agency.
            (2) Conditions.--A consumer credit reporting agency may 
        remove a security freeze placed on a consumer's credit report 
        only--
                    (A) upon the consumer's request, pursuant to 
                paragraph (1); or
                    (B) if the agency determines that the consumer's 
                credit report was frozen due to a material 
                misrepresentation of fact by the consumer.
            (3) Notification to consumer.--If a consumer credit 
        reporting agency intends to remove a freeze upon a consumer's 
        credit report pursuant to paragraph (2)(B), the consumer credit 
        reporting agency shall notify the consumer in writing prior to 
        removing the freeze on the consumer's credit report.
            (4) Temporary suspension.--A consumer may have a security 
        freeze on the consumer's credit report temporarily suspended by 
        making a request to a consumer credit reporting agency in 
        writing or by telephone and--
                    (A) specifying beginning and ending dates for the 
                period during which the security freeze is not to apply 
                to that consumer's credit report; or
                    (B) specifying a specific third party to which 
                access to the credit report may be granted 
                notwithstanding the freeze.
    (d) Response Times; Notification of Other Entities.--
            (1) In general.--A consumer credit reporting agency shall--
                    (A) place a security freeze on a consumer's credit 
                report under subsection (a) no later than 3 business 
                days after receiving a request from the consumer under 
                subsection (a)(1);
                    (B) remove a security freeze within 3 business days 
                after receiving a request for removal from the consumer 
                under subsection (c); and
                    (C) temporarily suspend a security freeze within 1 
                business day after receiving a request under subsection 
                (c)(4).
            (2) Notification of other covered entities.--If the 
        consumer requests in writing, by telephone, or by secure 
        electronic connection that other covered entities be notified 
        of the request, the consumer credit reporting agency shall 
        notify all other consumer credit reporting agencies described 
        in section 603(p)(1) of the Fair Credit Reporting Act (15 
        U.S.C. 1681a(p)(1)) of the request within 3 days after placing 
        or removing a security freeze on the consumer's credit report 
        under subsection (a) or (c)(2)(A), or within 1 day after 
        temporarily suspending a security freeze on the consumer's 
        credit report under subsection (c)(4).
            (3) Implementation by other covered entities.--A consumer 
        credit reporting agency that is notified of a request under 
        paragraph (2) to place, remove, or temporarily suspend a 
        security freeze on a consumer's credit report shall--
                    (A) request proper identification from the 
                consumer, in accordance with subsection (f), within 3 
                business days after receiving the notification; and
                    (B) place, remove, or temporarily suspend the 
                security freeze on that credit report within 3 business 
                days after receiving proper identification.
    (e) Confirmation.--Except as provided in subsection (c)(3), 
whenever a consumer credit reporting agency places, removes, or 
temporarily suspends a security freeze on a consumer's credit report at 
the request of that consumer under subsection (a) or (c), respectively, 
it shall send a written confirmation thereof to the consumer within 10 
business days after placing, removing, or temporarily suspending the 
security freeze on the credit report. This subsection does not apply to 
the placement, removal, or temporary suspension of a security freeze by 
a consumer credit reporting agency because of a notification received 
under subsection (d)(2).
    (f) ID Required.--A consumer credit reporting agency may not place, 
remove, or temporarily suspend a security freeze on a consumer's credit 
report at the consumer's request unless the consumer provides proper 
identification (within the meaning of section 610(a)(1) of the Fair 
Credit Reporting Act (15 U.S.C. 1681h) and the regulations thereunder.
    (g) Exceptions.--This section does not apply to the use of a 
consumer credit report by any of the following:
            (1) A person or entity, or a subsidiary, affiliate, or 
        agent of that person or entity, or an assignee of a financial 
        obligation owing by the consumer to that person or entity, or a 
        prospective assignee of a financial obligation owing by the 
        consumer to that person or entity in conjunction with the 
        proposed purchase of the financial obligation, with which the 
        consumer has or had prior to assignment an account or contract, 
        including a demand deposit account, or to whom the consumer 
        issued a negotiable instrument, for the purposes of reviewing 
        the account or collecting the financial obligation owing for 
        the account, contract, or negotiable instrument.
            (2) Any Federal, State or local agency, law enforcement 
        agency, trial court, or private collection agency acting 
        pursuant to a court order, warrant, subpoena, or other 
        compulsory process.
            (3) A child support agency or its agents or assigns acting 
        pursuant to subtitle D of title IV of the Social Security Act 
        (42 U.S.C. et seq.) or similar State law.
            (4) The Department of Health and Human Services, a similar 
        State agency, or the agents or assigns of the Federal or State 
        agency acting to investigate medicare or medicaid fraud.
            (5) The Internal Revenue Service or a State or municipal 
        taxing authority, or a State department of motor vehicles, or 
        any of the agents or assigns of these Federal, State, or 
        municipal agencies acting to investigate or collect delinquent 
        taxes or unpaid court orders or to fulfill any of their other 
        statutory responsibilities.
            (6) Any person or entity administering a credit file 
        monitoring subscription to which the consumer has subscribed.
            (7) Any person or entity for the purpose of providing a 
        consumer with a copy of the consumer's credit report or credit 
        score upon the consumer's request.
            (8) Except when access is restricted to a specific third 
        party during a temporary suspension of a security freeze under 
        subsection (c)(4)(B), any person who seeks access during the 
        time period that a security freeze is temporarily suspended for 
        the purpose of facilitating the extension of credit or another 
        permissable use.
    (h) Fees.--
            (1) In general.--Except as provided in paragraph (2), a 
        consumer credit reporting agency may charge a fee, not in 
        excess of $15, for placing, removing, or temporarily suspending 
        a security freeze on a consumer's credit report.
            (2) Fees prohibited.--
                    (A) ID theft victims and notified consumers.--A 
                consumer credit reporting agency may not charge a fee 
                for placing, removing, or temporarily suspending a 
                security freeze on a consumer's credit report if--
                            (i) the consumer is a victim of identity 
                        theft or has received a notice under section 
                        3(c) of this Act;
                            (ii) the consumer requests the security 
                        freeze in writing;
                            (iii) the consumer has filed a police 
                        report with respect to the theft, or an 
                        identity theft report (as defined in section 
                        603(q)(4) of the Fair Credit Reporting Act (15 
                        U.S.C. 1681a(q)(4))), within 90 days after the 
                        theft occurred or was discovered by the 
                        consumer; and
                            (iv) the consumer provides a copy of the 
                        report to the credit reporting agency.
                    (B) Categorical classes.--A consumer credit 
                reporting agency may not charge a fee for placing, 
                removing, or temporarily suspending a security freeze 
                on a consumer's credit report if the consumer 
                requesting it--
                            (i) has attained the age of 65 years;
                            (ii) is a on active duty or in the ready 
                        reserve component of an armed force of the 
                        United States; or
                            (iii) is the spouse of an individual 
                        described in clause (ii).
    (i) Limitation on Information Changes in Frozen Reports.--
            (1) In general.--If a security freeze is in place on a 
        consumer's credit report, a consumer credit reporting agency 
        may not change any of the following official information in 
        that credit report without sending a written confirmation of 
        the change to the consumer within 30 days after the change is 
        made:
                    (A) Name.
                    (B) Date of birth.
                    (C) Social Security number.
                    (D) Address.
            (2) Confirmation.--Paragraph (1) does not require written 
        confirmation for technical modifications of a consumer's 
        official information, including name and street abbreviations, 
        complete spellings, or transposition of numbers or letters. In 
        the case of an address change, the written confirmation shall 
        be sent to both the new address and to the former address.
    (j) Certain Entity Exemptions.--
            (1) Resellers and other agencies.--The provisions of this 
        Act do not apply to a consumer credit reporting agency that 
        acts only as a reseller of credit information by assembling and 
        merging information contained in the data base of another 
        consumer credit reporting agency or multiple consumer credit 
        reporting agencies, and does not maintain a permanent data base 
        of credit information from which new consumer credit reports 
        are produced.
            (2) Other exempted entities.--The following entities are 
        not required to place a security freeze in a credit report:
                    (A) A check services or fraud prevention services 
                company, which issues reports on incidents of fraud or 
                authorizations for the purpose of approving or 
                processing negotiable instruments, electronic funds 
                transfers, or similar methods of payments.
                    (B) A deposit account information service company, 
                which issues reports regarding account closures due to 
                fraud, substantial overdrafts, ATM abuse, or similar 
                negative information regarding a consumer, to inquiring 
                banks or other financial institutions for use only in 
                reviewing a consumer request for a deposit account at 
                the inquiring bank or financial institution.

SEC. 3. ENFORCEMENT.

    (a) Enforcement by Commission.--Except as provided in subsection 
(c), this Act shall be enforced by the Commission.
    (b) Violation is Unfair or Deceptive Act or Practice.--The 
violation of any provision of this Act shall be treated as an unfair or 
deceptive act or practice proscribed under a rule issued under section 
18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 
57a(a)(1)(B)).
    (c) Enforcement by Certain Other Agencies.--Compliance with this 
Act shall be enforced under--
            (1) section 8 of the Federal Deposit Insurance Act (12 
        U.S.C. 1818), in the case of--
                    (A) national banks, and Federal branches and 
                Federal agencies of foreign banks, by the Office of the 
                Comptroller of the Currency;
                    (B) member banks of the Federal Reserve System 
                (other than national banks), branches and agencies of 
                foreign banks (other than Federal branches, Federal 
                agencies, and insured State branches of foreign banks), 
                commercial lending companies owned or controlled by 
                foreign banks, and organizations operating under 
                section 25 or 25A of the Federal Reserve Act (12 U.S.C. 
                601 and 611), by the Board; and
                    (C) banks insured by the Federal Deposit Insurance 
                Corporation (other than members of the Federal Reserve 
                System) and insured State branches of foreign banks, by 
                the Board of Directors of the Federal Deposit Insurance 
                Corporation;
            (2) section 8 of the Federal Deposit Insurance Act (12 
        U.S.C. 1818), by the Director of the Office of Thrift 
        Supervision, in the case of a savings association the deposits 
        of which are insured by the Federal Deposit Insurance 
        Corporation;
            (3) the Federal Credit Union Act (12 U.S.C. 1751 et seq.) 
        by the National Credit Union Administration Board with respect 
        to any Federal credit union; and
            (4) the Securities and Exchange Act of 1934 (15 U.S.C. 78a 
        et seq.) by the Securities and Exchange Commission with respect 
        to--
                    (A) a broker or dealer subject to that Act;
                    (B) an investment company subject to the Investment 
                Company Act of 1940 (15 U.S.C. 80a-1 et seq.); and
                    (C) an investment advisor subject to the Investment 
                Advisers Act of 1940 (15 U.S.C. 80b-1 et seq.).
    (d) Exercise of Certain Powers.--For the purpose of the exercise by 
any agency referred to in subsection (c) of its powers under any Act 
referred to in that subsection, a violation of this Act is deemed to be 
a violation of a requirement imposed under that Act. In addition to its 
powers under any provision of law specifically referred to in 
subsection (c), each of the agencies referred to in that subsection may 
exercise, for the purpose of enforcing compliance with any requirement 
imposed under this Act, any other authority conferred on it by law. 
D23/

SEC. 4. DEFINITIONS.

    In this Act:
            (1) Commission.--The term ``Commission'' means the Federal 
        Trade Commission.
            (2) Consumer credit reporting agency.--The term ``consumer 
        credit reporting agency'' means any person which, for monetary 
        fees, dues, or on a cooperative nonprofit basis, regularly 
        engages in whole or in part in the practice of assembling or 
        evaluating consumer credit information or other information on 
        consumers for the purpose of furnishing credit reports to third 
        parties, and which uses any means or facility of interstate 
        commerce for the purpose of preparing or furnishing credit 
        reports.
            (3) Credit report.--The term ``credit report'' means a 
        consumer report, as defined in section 603(d) of the Fair 
        Credit Reporting Act (15 U.S.C. 1681a(d)), that is used or 
        expected to be used or collected in whole or in part for the 
        purpose of serving as a factor in establishing a consumer's 
        eligibility for credit for personal, family or household 
        purposes.
            (4) Identity theft.--The term ``identity theft'' has the 
        meaning given that term by section 603(q)(3) of the Fair Credit 
        Reporting Act (15 U.S.C. 1681a(q)(3)).
            (5) Reviewing the account.--The term ``reviewing the 
        account'' includes activities related to account maintenance, 
        monitoring, credit line increases, and account upgrades and 
        enhancements.
            (6) Security freeze.--The term ``security freeze'' means a 
        notice that--
                    (A) a consumer credit reporting agency places at 
                the request of a consumer in the file on the consumer 
                at the consumer credit reporting agency; and
                    (B) prohibits the agency from releasing consumer 
                credit report information on the consumer for consumer 
                credit purposes without the express authorization of 
                the consumer, except as otherwise provided in this Act.
            (7) Sensitive personal information.--
                    (A) In general.--Except as provided in 
                subparagraphs (B) and (C), the term ``sensitive 
                personal information'' means an individual's name, 
                address, or telephone number combined with 1 or more of 
                the following data elements related to that individual:
                            (i) Social security number, taxpayer 
                        identification number, or an employer 
                        identification number that is the same as or is 
                        derived from the social security number of that 
                        individual.
                            (ii) Financial account number, or credit 
                        card or debit card number of such individual, 
                        combined with any required security code, 
                        access code, or password that would permit 
                        access to such individual's account.
                            (iii) State driver's license identification 
                        number or State resident identification number.
                    (B) FTC modifications.--The Commission may, through 
                a rulemaking proceeding in accordance with section 553 
                of title 5, United States Code, designate other 
                identifying information that may be used to effectuate 
                identity theft as sensitive personal information for 
                purposes of this Act and limit or exclude any 
                information described in subparagraph (A) from the 
                definition of sensitive personal information for 
                purposes of this Act.
                                 <all>