S.B. 239

             1     

CREDIT REPORT PROTECTION FOR MINORS

             2     
2014 GENERAL SESSION

             3     
STATE OF UTAH

             4     
Chief Sponsor: Curtis S. Bramble

             5     
House Sponsor: ____________

             6     
             7      LONG TITLE
             8      General Description:
             9          This bill modifies and enacts provisions of the Consumer Credit Protection Act relating
             10      to certain minors, incapacitated adults, and protected persons.
             11      Highlighted Provisions:
             12          This bill:
             13          .    defines terms;
             14          .    upon request and in accordance with the provisions of this bill, requires a credit
             15      reporting agency to place a security freeze for:
             16              .    an individual who is less than 16 years of age;
             17              .    an incapacitated adult; or
             18              .    a protected person;
             19          .    provides a procedure by which an individual or an individual's representative may
             20      remove a security freeze;
             21          .    allows, under certain circumstances, a credit reporting agency to charge a reasonable
             22      fee of $5 or less for the placement or removal of a security freeze;
             23          .    provides that the attorney general may enforce the provisions of this bill; and
             24          .    makes technical and conforming changes.
             25      Money Appropriated in this Bill:
             26          None
             27      Other Special Clauses:


             28          This bill takes effect on January 1, 2015.
             29      Utah Code Sections Affected:
             30      AMENDS:
             31           13-45-102 , as enacted by Laws of Utah 2006, Chapter 344
             32           13-45-201 , as enacted by Laws of Utah 2006, Chapter 344
             33           13-45-202 , as enacted by Laws of Utah 2006, Chapter 344
             34           13-45-401 , as enacted by Laws of Utah 2006, Chapter 344
             35      ENACTS:
             36           13-45-503 , Utah Code Annotated 1953
             37           13-45-504 , Utah Code Annotated 1953
             38           13-45-505 , Utah Code Annotated 1953
             39           13-45-506 , Utah Code Annotated 1953
             40           38-45-501 , Utah Code Annotated 1953
             41           38-45-502 , Utah Code Annotated 1953
             42     
             43      Be it enacted by the Legislature of the state of Utah:
             44          Section 1. Section 13-45-102 is amended to read:
             45           13-45-102. Definitions.
             46          As used in this chapter:
             47          (1) "Consumer" means [a natural person] an individual who is not a protected
             48      consumer.
             49          (2) "Consumer reporting agency" means a person who, for fees, dues, or on a
             50      cooperative basis, regularly engages in whole or in part in the practice of assembling or
             51      evaluating information concerning a consumer's credit or other information for the purpose of
             52      furnishing a credit report to another person.
             53          (3) "Consumer who is subject to a protected consumer security freeze" means an
             54      individual:
             55          (a) for whom a credit reporting agency placed a security freeze under Section
             56      13-45-503 ; and
             57          (b) who, on the day on which a request for the removal of the security freeze is
             58      submitted under Section 13-45-504 , is not a protected consumer.


             59          [(3)] (4) "Credit report" means a consumer report, as defined in 15 U.S.C. Sec. 1681a,
             60      that is used or collected in whole or part for the purpose of serving as a factor in establishing a
             61      consumer's eligibility for credit for personal, family, or household purposes.
             62          (5) "File" is as defined in 15 U.S.C. Sec. 1681a.
             63          (6) "Incapacitated person" means an individual who is incapacitated, as defined in
             64      Section 75-1-201 .
             65          [(4)] (7) "Normal business hours" means Sunday through Saturday, between the hours
             66      of 6:00 a.m. and 9:30 p.m., Mountain Standard or Mountain Daylight Time.
             67          [(5)] (8) (a) "Personal information" means personally identifiable financial
             68      information:
             69          (i) provided by a consumer to another person;
             70          (ii) resulting from any transaction with the consumer or any service performed for the
             71      consumer; or
             72          (iii) otherwise obtained by another person.
             73          (b) "Personal information" does not include:
             74          (i) publicly available information, as that term is defined by the regulations prescribed
             75      under 15 U.S.C. Sec. 6804; or
             76          (ii) any list, description, or other grouping of consumers, and publicly available
             77      information pertaining to the consumers, that is derived without using any nonpublic personal
             78      information.
             79          (c) Notwithstanding Subsection [(5)] (8)(b), "personal information" includes any list,
             80      description, or other grouping of consumers, and publicly available information pertaining to
             81      the consumers, that is derived using any nonpublic personal information other than publicly
             82      available information.
             83          [(6)] (9) "Proper identification" has the same meaning as in 15 U.S.C. Sec.
             84      1681h(a)(1), and includes:
             85          (a) the consumer's full name, including first, last, and middle names and any suffix;
             86          (b) any name the consumer previously used;
             87          (c) the consumer's current and recent full addresses, including street address, any
             88      apartment number, city, state, and ZIP code;
             89          (d) the consumer's social security number; and


             90          (e) the consumer's date of birth.
             91          [(7) "Security freeze" means a prohibition, consistent with Section 13-45-201 , on a
             92      consumer reporting agency's furnishing of a consumer's credit report to a third party intending
             93      to use the credit report to determine the consumer's eligibility for credit.]
             94          (10) "Protected consumer" means an individual who, at the time a request for a security
             95      freeze is made, is:
             96          (a) less than 16 years of age;
             97          (b) an incapacitated person; or
             98          (c) a protected person.
             99          (11) "Protected person" is as defined in Section 75-5b-102 .
             100          (12) "Record" means a compilation of information that:
             101          (a) identifies a protected consumer;
             102          (b) is created by a consumer reporting agency solely for the purpose of complying with
             103      this section; and
             104          (c) may not be created or used to consider the protected consumer's credit worthiness,
             105      credit standing, credit capacity, character, general reputation, personal characteristics, or mode
             106      of living.
             107          (13) "Representative" means a person who provides to a consumer reporting agency
             108      sufficient proof of authority to act on behalf of a protected consumer.
             109          (14) (a) "Sufficient proof of authority" means documentation that shows that a person
             110      has authority to act on behalf of a protected consumer.
             111          (b) "Sufficient proof of authority" includes:
             112          (i) a court order;
             113          (ii) a lawfully executed power of attorney; or
             114          (iii) a written, notarized statement signed by the person that expressly describes the
             115      person's authority to act on behalf of the protected consumer.
             116          (15) (a) "Sufficient proof of identification" means information or documentation that
             117      identifies a protected consumer or a representative.
             118          (b) "Sufficient proof of identification" includes:
             119          (i) a Social Security number or a copy of a Social Security card issued by the United
             120      States Social Security Administration;


             121          (ii) a certified or official copy of a birth certificate; or
             122          (iii) a copy of a government issued driver license or identification card.
             123          Section 2. Section 13-45-201 is amended to read:
             124           13-45-201. Security freeze.
             125          (1) As used in this part, "security freeze" means a prohibition, consistent with the
             126      provisions of this section, on a consumer reporting agency's furnishing of a consumer's credit
             127      report to a third party intending to use the credit report to determine the consumer's eligibility
             128      for credit.
             129          [(1)] (2) A consumer may place a security freeze on the consumer's credit report by:
             130          (a) making a request to a consumer reporting agency in writing by certified mail;
             131          (b) providing proper identification; and
             132          (c) paying the fee required by the consumer reporting agency in accordance with
             133      Section 13-45-204 .
             134          [(2)] (3) If a security freeze is in place, a consumer reporting agency may not release a
             135      consumer's credit report, or information from the credit report, to a third party that intends to
             136      use the information to determine a consumer's eligibility for credit without prior authorization
             137      from the consumer.
             138          [(3)] (4) (a) Notwithstanding Subsection [(2)] (3), a consumer reporting agency may
             139      communicate to a third party requesting a consumer's credit report that a security freeze is in
             140      effect on the consumer's credit report.
             141          (b) If a third party requesting a consumer's credit report in connection with the
             142      consumer's application for credit is notified of the existence of a security freeze under
             143      Subsection [(3)] (4)(a), the third party may treat the consumer's application as incomplete.
             144          [(4)] (5) Upon receiving a request from a consumer under Subsection [(1)] (2), the
             145      consumer reporting agency shall:
             146          (a) place a security freeze on the consumer's credit report within five business days
             147      after receiving the consumer's request;
             148          (b) send a written confirmation of the security freeze to the consumer within 10
             149      business days after placing the security freeze; and
             150          (c) provide the consumer with a unique personal identification number or password to
             151      be used by the consumer when providing authorizations for removal or temporary removal of


             152      the security freeze under Section 13-45-202 .
             153          [(5)] (6) A consumer reporting agency shall require proper identification of the
             154      consumer requesting to place, remove, or temporarily remove a security freeze.
             155          [(6)] (7) (a) A consumer reporting agency shall develop a contact method to receive
             156      and process a consumer's request to place, remove, or temporarily remove a security freeze.
             157          (b) A contact method under Subsection [(6)] (7)(a) shall include:
             158          (i) a postal address;
             159          (ii) an electronic contact method chosen by the consumer reporting agency, which may
             160      include the use of fax, Internet, or other electronic means; and
             161          (iii) the use of telephone in a manner that is consistent with any federal requirements
             162      placed on the consumer reporting agency.
             163          [(7)] (8) A security freeze placed under this section may be removed only in
             164      accordance with Section 13-45-202 .
             165          Section 3. Section 13-45-202 is amended to read:
             166           13-45-202. Removal of security freeze -- Requirements and timing.
             167          (1) A consumer reporting agency may remove a security freeze from a consumer's
             168      credit report only if:
             169          (a) (i) the consumer reporting agency receives the consumer's request through a contact
             170      method established and required in accordance with Subsection 13-45-201 [(6)](7); and
             171          (ii) the consumer reporting agency receives the consumer's proper identification and:
             172          (A) other information sufficient to identify the consumer; or
             173          (B) the consumer provides the consumer's personal identification number or password;
             174      or
             175          (b) the consumer makes a material misrepresentation of fact in connection with the
             176      placement of the security freeze and the consumer reporting agency notifies the consumer in
             177      writing before removing the security freeze.
             178          (2) (a) A consumer reporting agency shall temporarily remove a security freeze upon
             179      receipt of:
             180          (i) the consumer's request through the contact method established by the consumer
             181      reporting agency in accordance with Subsection 13-45-201 [(6)](7);
             182          (ii) the consumer's proper identification and:


             183          (A) other information sufficient to identify the consumer; or
             184          (B) personal identification number or password;
             185          (iii) a specific designation of the period of time for which the security freeze is to be
             186      removed; and
             187          (iv) the consumer reporting agency receives the payment of any fee required under
             188      Section 13-45-204 .
             189          (b) A consumer reporting agency shall remove a security freeze from a consumer's
             190      credit report within:
             191          (i) three business days after the business day on which the consumer's written request
             192      to remove the security freeze is received by the consumer reporting agency at the postal address
             193      chosen by the consumer reporting agency in accordance with Subsection 13-45-201 [(6)](7); or
             194          (ii) 15 minutes after the consumer's request is received by the consumer reporting
             195      agency through the electronic contact method chosen by the consumer reporting agency in
             196      accordance with Subsection 13-45-201 [(6)](7), or the use of telephone, during normal business
             197      hours and includes the consumer's proper identification and correct personal identification
             198      number or password.
             199          (3) A consumer reporting agency need not remove a security freeze within the time
             200      provided in Subsection (2)(b)(ii) if:
             201          (a) the consumer fails to meet the requirements of Subsection 13-45-202 (1); or
             202          (b) the consumer reporting agency's ability to remove the security freeze within 15
             203      minutes is prevented by:
             204          (i) an act of God, including fire, earthquakes, hurricanes, storms, or similar natural
             205      disaster or phenomena;
             206          (ii) unauthorized or illegal acts by a third party, including terrorism, sabotage, riot,
             207      vandalism, labor strikes or disputes disrupting operations, or similar occurrence;
             208          (iii) operational interruption, including electrical failure, unanticipated delay in
             209      equipment or replacement part delivery, computer hardware or software failures inhibiting
             210      response time, or similar disruption;
             211          (iv) governmental action, including emergency orders or regulations, judicial or law
             212      enforcement action, or similar directives;
             213          (v) regularly scheduled maintenance, during other than normal business hours, of, or


             214      updates to, the consumer reporting agency's systems;
             215          (vi) commercially reasonable maintenance of, or repair to, the consumer reporting
             216      agency's systems that is unexpected or unscheduled; or
             217          (vii) receipt of a removal request outside of normal business hours.
             218          Section 4. Section 13-45-401 is amended to read:
             219           13-45-401. Enforcement.
             220          (1) The attorney general may enforce [this chapter's provisions] the provisions of this
             221      chapter.
             222          (2) A person who violates [this chapter's provisions] a provision of Section 13-45-201 ,
             223      13-45-202 , 13-45-203 , 13-45-204 , 13-45-205 , or 13-45-301 is subject to a civil fine of:
             224          (a) no greater than $2,500 for a violation or series of violations concerning a specific
             225      consumer; and
             226          (b) no greater than $100,000 in the aggregate for related violations concerning more
             227      than one consumer.
             228          (3) In addition to the penalties provided in Subsection (2), the attorney general may
             229      seek injunctive relief to prevent future violations of this chapter in:
             230          (a) the district court located in Salt Lake City; or
             231          (b) the district court for the district in which resides a consumer who is the subject of a
             232      credit report on which a violation occurs.
             233          Section 5. Section 38-45-501 is enacted to read:
             234     
Part 5. Credit Report Protection for Minors

             235          38-45-501. Title.
             236          This part is known as "Credit Report Protection for Minors."
             237          Section 6. Section 38-45-502 is enacted to read:
             238          38-45-502. Definition.
             239          As used in this part, "security freeze" means:
             240          (1) if a consumer reporting agency does not have a file that pertains to a protected
             241      consumer, a restriction that:
             242          (a) is placed on the protected consumer's record in accordance with this part; and
             243          (b) except as otherwise provided in this part, prohibits the consumer reporting agency
             244      from releasing the protected consumer's record; or


             245          (2) if a consumer reporting agency has a file that pertains to the protected consumer, a
             246      restriction that:
             247          (a) is placed on the protected consumer's credit report in accordance with this part; and
             248          (b) except as otherwise provided in this part, prohibits the consumer reporting agency
             249      from releasing the protected consumer's credit report or any information derived from the
             250      protected consumer's credit report.
             251          Section 7. Section 13-45-503 is enacted to read:
             252          13-45-503. Applicability.
             253          This part does not apply to the use of a protected consumer's credit report or record by:
             254          (1) a person administering a credit file monitoring subscription service to which:
             255          (a) the protected consumer has subscribed; or
             256          (b) the protected consumer's representative has subscribed on the protected consumer's
             257      behalf;
             258          (2) a person who, upon request from the protected consumer or the protected
             259      consumer's representative, provides the protected consumer or the protected consumer's
             260      representative with a copy of the protected consumer's credit report;
             261          (3) a check services or fraud prevention services company that issues:
             262          (a) reports on incidents of fraud; or
             263          (b) authorizations for the purpose of approving or processing negotiable instruments,
             264      electronic funds transfers, or similar payment methods;
             265          (4) a deposit account information service company that issues reports regarding
             266      account closures due to fraud, substantial overdrafts, automated teller machine abuse, or
             267      similar information regarding an individual to inquiring banks or other financial institutions for
             268      use only in reviewing an individual's request for a deposit account at the inquiring bank or
             269      financial institution;
             270          (5) an insurance company for the purpose of conducting the insurance company's
             271      ordinary business;
             272          (6) a consumer reporting agency that:
             273          (a) only resells credit information by assembling and merging information contained in
             274      a database of another consumer reporting agency or multiple consumer reporting agencies; and
             275          (b) does not maintain a permanent database of credit information from which new


             276      credit reports are produced; or
             277          (7) a consumer reporting agency's database or file that consists of information that:
             278          (a) concerns and is used for:
             279          (i) criminal record information;
             280          (ii) fraud prevention or detection;
             281          (iii) personal loss history information; or
             282          (iv) employment, tenant, or individual background screening; and
             283          (b) is not used for credit granting purposes.
             284          Section 8. Section 13-45-504 is enacted to read:
             285          13-45-504. Security freeze for protected consumer.
             286          (1) A consumer reporting agency shall place a security freeze for a protected consumer
             287      if:
             288          (a) the consumer reporting agency receives a request from the protected consumer's
             289      representative for the placement of the security freeze; and
             290          (b) the protected consumer's representative:
             291          (i) submits the request described in Subsection (1)(a):
             292          (A) to the address or other point of contact provided by the consumer reporting agency;
             293      and
             294          (B) in the manner specified by the consumer reporting agency;
             295          (ii) submits to the consumer reporting agency:
             296          (A) sufficient proof of identification of the protected consumer;
             297          (B) sufficient proof of identification of the protected consumer's representative; and
             298          (C) sufficient proof of authority to act on behalf of the protected consumer; and
             299          (iii) if applicable, pays the consumer reporting agency a fee described in Subsection
             300      13-45-506 (2).
             301          (2) If a consumer reporting agency does not have a file that pertains to a protected
             302      consumer when the consumer reporting agency receives a request described in Subsection (1),
             303      the consumer reporting agency shall create a record for the protected consumer.
             304          (3) A consumer reporting agency shall place a security freeze for a protected consumer
             305      within 30 days after the day on which the consumer reporting agency receives a request
             306      described in Subsection (1).


             307          (4) After a consumer reporting agency places a security freeze under this section, the
             308      consumer reporting agency may not release the protected consumer's credit report, any
             309      information derived from the protected consumer's credit report, or any record created for the
             310      protected consumer, unless the security freeze for the protected consumer is removed in
             311      accordance with Section 13-45-505 .
             312          (5) A security freeze that is placed in accordance with this section shall remain in effect
             313      until:
             314          (a) the protected consumer's representative or the consumer who is subject to a
             315      protected consumer security freeze requests the consumer reporting agency remove the security
             316      freeze in accordance with Subsection 13-45-505 (1); or
             317          (b) the security freeze is removed in accordance with Subsection 13-45-505 (3).
             318          Section 9. Section 13-45-505 is enacted to read:
             319          13-45-505. Removal of security freeze for protected consumer.
             320          (1) To remove a security freeze that is placed under this part, the protected consumer's
             321      representative or the consumer who is subject to a protected consumer security freeze shall:
             322          (a) submit a request for the removal of the security freeze to the consumer reporting
             323      agency:
             324          (i) at the address or other point of contact provided by the consumer reporting agency;
             325      and
             326          (ii) in the manner specified by the consumer reporting agency;
             327          (b) provide to the consumer reporting agency:
             328          (i) in the case of a request by a protected consumer's representative:
             329          (A) sufficient proof of identification of the protected consumer;
             330          (B) sufficient proof of identification of the protected consumer's representative; and
             331          (C) sufficient proof of authority to act on behalf of the protected consumer; or
             332          (ii) in the case of a request by the consumer who is subject to a protected consumer
             333      security freeze:
             334          (A) sufficient proof of identification of the consumer who is subject to a protected
             335      consumer security freeze; and
             336          (B) proof that the consumer who is subject to a protected consumer security freeze is
             337      not a protected consumer; and


             338          (c) if applicable, pay the consumer reporting agency a fee described in Subsection
             339      13-45-506 (2).
             340          (2) Within 30 days after the day on which a consumer reporting agency receives a
             341      request under Subsection (1), the consumer reporting agency shall remove the security freeze.
             342          (3) A consumer reporting agency may remove a security freeze for a protected
             343      consumer or delete a record of a protected consumer if the security freeze was placed or the
             344      record was created based on a material misrepresentation of fact by the protected consumer or
             345      the protected consumer's representative.
             346          Section 10. Section 13-45-506 is enacted to read:
             347          13-45-506. Fees.
             348          (1) Except as provided in Subsection (2), a consumer reporting agency may not charge
             349      a fee for any service performed under this part.
             350          (2) A consumer reporting agency may charge a reasonable fee, which does not exceed
             351      $5, for each placement or removal of a security freeze under this part, unless:
             352          (a) the protected consumer's representative:
             353          (i) has obtained a police report that states the protected consumer is the alleged victim
             354      of identity fraud; and
             355          (ii) provides a copy of the report to the consumer reporting agency; or
             356          (b) (i) the protected consumer is less than 16 years of age at the time the request is
             357      submitted to the consumer reporting agency; and
             358          (ii) the consumer reporting agency has a file that pertains to the protected consumer.
             359          Section 11. Effective date.
             360          This bill takes effect on January 1, 2015.




Legislative Review Note
    as of 2-24-14 10:04 AM


Office of Legislative Research and General Counsel


[Bill Documents][Bills Directory]