Third Substitute S.B. 71

This document includes House Committee Amendments incorporated into the bill on Mon, Feb 20, 2006 at 11:37 AM by ddonat. -->

Senator Carlene M. Walker proposes the following substitute bill:

1 CONSUMER CREDIT PROTECTION
2 2006 GENERAL SESSION
3 STATE OF UTAH
4 Chief Sponsor: Carlene M. Walker
5 House Sponsor: David Clark
6
7 LONG TITLE
8 General Description:
9 This bill addresses consumer credit protections.
10 Highlighted Provisions:
11 This bill:
12 . defines terms;
13 . allows a consumer to place a security freeze on the consumer's credit report;
14 . outlines the method for placing and removing a security freeze;
15 . provides exceptions;
16 . prohibits the release of a credit report that is subject to a security freeze, except in
17 certain instances;
18 . allows certain fees to be charged in connection with a security freeze;
19 . governs changes to a credit report that is subject to a security freeze;
20 . prohibits some uses of a consumer's personal information; and
21 . provides for enforcement.
22 Monies Appropriated in this Bill:
23 None
24 Other Special Clauses:
25 This bill provides an effective date.

Text Box
- 2 - 26 Utah Code Sections Affected:
27 ENACTS:
28 13-42-101, Utah Code Annotated 1953
29 13-42-102, Utah Code Annotated 1953
30 13-42-201, Utah Code Annotated 1953
31 13-42-202, Utah Code Annotated 1953
32 13-42-203, Utah Code Annotated 1953
33 13-42-204, Utah Code Annotated 1953
34 13-42-205, Utah Code Annotated 1953
35 13-42-301, Utah Code Annotated 1953
36 13-42-401, Utah Code Annotated 1953
37
38 Be it enacted by the Legislature of the state of Utah:
39 Section 1. Section 13-42-101 is enacted to read:
40 CHAPTER 42. CONSUMER CREDIT PROTECTION ACT
41 Part 1. General Provisions
42 13-42-101. Title.
43 This chapter is known as the "Consumer Credit Protection Act."
44 Section 2. Section 13-42-102 is enacted to read:
45 13-42-102. Definitions.
46 As used in this chapter:
47 (1) "Consumer" means a natural person.
48 (2) "Consumer reporting agency" means a person who, for fees, dues, or on a
49 cooperative basis, regularly engages in whole or in part in the practice of assembling or
50 evaluating information concerning a consumer's credit or other information for the purpose of
51 furnishing a credit report to another person.
52 (3) "Credit report" means a consumer report, as defined in 15 U.S.C. Sec. 1681a, that is
53 used or collected in whole or part for the purpose of serving as a factor in establishing a
54 consumer's eligibility for credit for personal, family, or household purposes.
55 (4) "Normal business hours" means Sunday through Saturday, between the hours of
56 6:00 a.m. and 9:30 p.m., Mountain Standard or Mountain Daylight Time.

Text Box
- 3 - 57 (5) (a) "Personal information" means personally identifiable financial information:
58 (i) provided by a consumer to another person;
59 (ii) resulting from any transaction with the consumer or any service performed for the
60 consumer; or
61 (iii) otherwise obtained by another person.
62 (b) "Personal information" does not include:
63 (i) publicly available information, as that term is defined by the regulations prescribed
64 under 15 U.S.C. Sec. 6804; or
65 (ii) any list, description, or other grouping of consumers, and publicly available
66 information pertaining to the consumers, that is derived without using any nonpublic personal
67 information.
68 (c) Notwithstanding Subsection (5)(b), "personal information" includes any list,
69 description, or other grouping of consumers, and publicly available information pertaining to
70 the consumers, that is derived using any nonpublic personal information other than publicly
71 available information.
72 (6) "Proper identification" has the same meaning as in 15 U.S.C. Sec. 1681h(a)(1), and
73 includes:
74 (a) the consumer's full name, including first, last, and middle names and any suffix;
75 (b) any name the consumer previously used;
76 (c) the consumer's current and recent full addresses, including street address, any
77 apartment number, city, state, and ZIP code;
78 (d) the consumer's social security number; and
79 (e) the consumer's date of birth.
80 (7) "Security freeze" means a prohibition, consistent with Section 13-42-201 , on a
81 consumer reporting agency's furnishing of a consumer's credit report to a third party intending
82 to use the credit report to determine the consumer's eligibility for credit.
83 Section 3. Section 13-42-201 is enacted to read:
84 Part 2. Security Freeze
85 13-42-201. Security freeze.
86 (1) A consumer may place a security freeze on the consumer's credit report by:
87 (a) making a request to a consumer reporting agency in writing by certified mail;

Text Box
- 4 - 88 (b) providing proper identification; and
89 (c) paying the fee required by the consumer reporting agency in accordance with
90 Section 13-42-204 .
91 (2) If a security freeze is in place, a consumer reporting agency may not release a
92 consumer's credit report, or information from the credit report, to a third party that intends to
93 use the information to determine a consumer's eligibility for credit without prior authorization
94 from the consumer.
95 (3) (a) Notwithstanding Subsection (2), a consumer reporting agency may
96 communicate to a third party requesting a consumer's credit report that a security freeze is in
97 effect on the consumer's credit report.
98 (b) If a third party requesting a consumer's credit report in connection with the
99 consumer's application for credit is notified of the existence of a security freeze under
100 Subsection (3)(a), the third party may treat the consumer's application as incomplete.
101 (4) Upon receiving a request from a consumer under Subsection (1), the consumer
102 reporting agency shall:
103 (a) place a security freeze on the consumer's credit report within five business days
104 after receiving the consumer's request;
105 (b) send a written confirmation of the security freeze to the consumer within ten
106 business days after placing the security freeze; and
107 (c) provide the consumer with a unique personal identification number or password to
108 be used by the consumer when providing authorizations for removal or temporary removal of
109 the security freeze under Section 13-42-202 .
110 (5) A consumer reporting agency shall require proper identification of the consumer
111 requesting to place, remove, or temporarily remove a security freeze.
112 (6) (a) A consumer reporting agency shall develop a contact method to receive and
113 process a consumer's request to place, remove, or temporarily remove a security freeze.
114 (b) A contact method under Subsection (6)(a) shall include:
115 (i) a postal address;
116 (ii) an electronic contact method chosen by the consumer reporting agency, which may
117 include the use of fax, Internet, or other electronic means; and
118 (iii) the use of telephone in a manner that is consistent with any federal requirements

Text Box
- 5 -

House Committee Amendments 2-20-2006 dd/crp 119

placed on the consumer reporting agency.
120 (7) A security freeze placed under this section may be removed only in accordance
121 with Section 13-42-202 .
122 Section 4. Section 13-42-202 is enacted to read:
123 13-42-202. Removal of security freeze -- Requirements and timing.
124 (1) A consumer reporting agency may remove a security freeze from a consumer's
125 credit report only if:
126 (a) (i) the consumer reporting agency receives the consumer's request through a contact
127 method established and required in accordance with Subsection 13-42-201 (6); and
128 (ii) the consumer reporting agency receives the consumer's proper identification and:
129 (A) other information sufficient to identify the consumer; or
130 (B) the consumer provides the H. [ customer's ] consumer's .H personal identification
130a number or password;
131 or
132 (b) the consumer makes a material misrepresentation of fact in connection with the
133 placement of the security freeze and the consumer reporting agency notifies the consumer in
134 writing before removing the security freeze.
135 H. [ (2) Within ten business days after the day on which a consumer reporting agency
136 permanently removes a security freeze from a consumer's credit report, the consumer reporting
137 agency shall send a written confirmation of the removal of the security freeze to the consumer.
138 (3) ] (2) .H (a) A consumer reporting agency shall temporarily remove a security
138a freeze upon
139 receipt of:
140 (i) the consumer's request through the contact method established by the consumer
141 reporting agency in accordance with Subsection 13-42-201 (6);
142 (ii) the consumer's proper identification and:
143 (A) other information sufficient to identify the consumer; or
144 (B) personal identification number or password;
145 (iii) a specific designation of the period of time for which the security freeze is to be
146 removed; and
147 (iv) the consumer reporting agency receives the payment of any fee required under
148 Section 13-42-204 .
149 (b) A consumer reporting agency shall remove a security freeze from a consumer's

Text Box
- 6 -

House Committee Amendments 2-20-2006 dd/crp 150

credit report within:
151 (i) three business days after the business day on which the consumer's written request
152 to remove the security freeze is received by the consumer reporting agency at the postal address
153 chosen by the consumer reporting agency in accordance with Subsection 13-42-201 (6); or
154 (ii) 15 minutes after the consumer's request is received by the consumer reporting
155 agency through the electronic contact method chosen by the consumer reporting agency in
156 accordance with Subsection 13-42-201 (6), or the use of telephone, during normal business
157 hours and includes the consumer's proper identification and correct personal identification
158 number or password.
159 (4) A consumer reporting agency need not remove a security freeze within the time
160 provided in Subsection H. [ (3) ] (2) .H (b)(ii) if:
161 (a) the consumer fails to meet the requirements of Subsection 13-42-202 (1); or
162 (b) the consumer reporting agency's ability to remove the security freeze within 15
163 minutes is prevented by:
164 (i) an act of God, including fire, earthquakes, hurricanes, storms, or similar natural
165 disaster or phenomena;
166 (ii) unauthorized or illegal acts by a third party, including terrorism, sabotage, riot,
167 vandalism, labor strikes or disputes disrupting operations, or similar occurrence;
168 (iii) operational interruption, including electrical failure, unanticipated delay in
169 equipment or replacement part delivery, computer hardware or software failures inhibiting
170 response time, or similar disruption;
171 (iv) governmental action, including emergency orders or regulations, judicial or law
172 enforcement action, or similar directives;
173 (v) regularly scheduled maintenance, during other than normal business hours, of, or
174 updates to, the consumer reporting agency's systems;
175 (vi) commercially reasonable maintenance of, or repair to, the consumer reporting
176 agency's systems that is unexpected or unscheduled; or
177 (vii) receipt of a removal request outside of normal business hours.
178 Section 5. Section 13-42-203 is enacted to read:
179 13-42-203. Exceptions.
180 (1) Notwithstanding Section 13-42-201 , a consumer reporting agency may furnish a

Text Box
- 7 - 181 consumer's credit report to a third party if:
182 (a) (i) the purpose of the credit report is to:
183 (A) use the credit report for purposes permitted under 15 U.S.C. Sec. 1681b(c); or
184 (B) review the consumer's account with the third party, including for account
185 maintenance or monitoring, credit line increases, or other upgrades or enhancements; or
186 (C) collect on a financial obligation owed by the consumer to the third party requesting
187 the credit report; or
188 (ii) (A) the purpose of the credit report is to:
189 (I) review the consumer's account with another person; or
190 (II) collect on a financial obligation owed by the consumer to another person; and
191 (B) use the credit report for purposes permitted under 15 U.S.C. Sec. 1681b(c); or
192 (b) the third party requesting the credit report is a subsidiary, affiliate, agent, assignee,
193 or prospective assignee of the person holding the consumer's account or to whom the consumer
194 owes a financial obligation;
195 (2) (a) The consumer's request for a security freeze does not prohibit the consumer
196 reporting agency from disclosing the consumer's credit report for other than credit related
197 purposes consistent with the definition of credit report found in Section 13-42-102 .
198 (b) The following list identifies the types of credit report disclosures by consumer
199 reporting agencies to third parties that are not prohibited by a security freeze:
200 (i) the third party does not use the credit report for the purpose of serving as a factor in
201 establishing a consumer's eligibility for credit;
202 (ii) the third party is acting under a court order, warrant, or subpoena requiring release
203 of the credit report;
204 (iii) the third party is a child support agency, or its agent or assignee, acting under Part
205 D, Title IV of the Social Security Act or a similar state law;
206 (iv) the federal Department of Health and Human Services or a similar state agency, or
207 its agent or assignee, investigating Medicare or Medicaid fraud;
208 (v) (A) the purpose of the credit report is to investigate or collect delinquent taxes,
209 assessments, or unpaid court orders; and
210 (B) the third party is:
211 (I) the federal Internal Revenue Service;

Text Box
- 8 -

House Committee Amendments 2-20-2006 dd/crp 212

(II) a state taxing authority;
213 (III) the Department of Motor Vehicles;
214 (IV) a county, municipality, or other entity with taxing authority;
215 (V) a federal, state, or local law enforcement agency; or
216 (VI) the agent or assignee of any entity listed in Subsections (1)(b) and (2)(b)(v)(B);
217 (vi) the third party is administering a credit file monitoring subscription to which the
218 consumer has subscribed; or
219 (vii) the third party requests the credit report for the sole purpose of providing the
220 consumer with a copy of the consumer's credit report or credit score upon the consumer's
221 request.
222 (3) Section 13-42-201 does not apply to:
223 (a) a consumer reporting agency, the sole purpose of which is to resell credit
224 information by assembling and merging information contained in the database of another
225 consumer reporting agency and that does not maintain a permanent database of credit
226 information from which a consumer's credit report is produced;
227 (b) a check services or fraud prevention services company that issues:
228 (i) reports on incidents of fraud; or
229 (ii) authorizations for the purpose of approving or processing negotiable instruments,
230 electronic funds transfers, or similar methods of payment; or
231 (c) a deposit account information service company that issues reports concerning
232 account closures based on fraud, substantial overdrafts, automated teller machine abuse, or
233 similar information concerning a consumer to a requesting financial institution for the purpose
234 of evaluating a consumer's request to create a deposit account.
235 (4) Nothing in this chapter prohibits a person from obtaining, aggregating, or using
236 information lawfully obtained from public records in a manner that does not otherwise violate
237 this chapter.
238 Section 6. Section 13-42-204 is enacted to read:
239 13-42-204. Fees for security freeze.
240 (1) H. [ (a) ] .H Except as provided in Subsection (2), a consumer reporting agency may
240a charge
241 a reasonable fee to a consumer for placing H. and temporarily removing .H a security freeze.
242 H. [ (b) The fee paid under Subsection (1)(a) allows the consumer to place the security

Text Box
- 9 -

House Committee Amendments 2-20-2006 dd/crp 243

freeze and to either permanently or temporarily remove the security freeze one time.
244 (c) Except as provided in Subsections (1)(b) and (2), a consumer reporting agency may
245 charge a fee for removal or temporary removal of a security freeze. ] .H
246 (2) A consumer reporting agency may not charge a fee for placing or removing a
247 security freeze if:
248 (a) the consumer is a victim of identity fraud under Section 76-6-1102 ; and
249 (b) the consumer provides the consumer reporting agency with a valid copy of a police
250 report or police case number documenting the identity fraud.
251 Section 7. Section 13-42-205 is enacted to read:
252 13-42-205. Changes to information in a credit report subject to a security freeze.
253 (1) If a credit report is subject to a security freeze, a consumer reporting agency shall
254 notify the consumer who is the subject of the credit report within 30 days if the consumer
255 reporting agency changes the consumer's:
256 (a) name;
257 (b) date of birth;
258 (c) Social Security number; or
259 (d) address.
260 (2) (a) Notwithstanding Subsection (1), a consumer reporting agency may make
261 technical modifications to information in a credit report that is subject to a security freeze
262 without providing notification to the consumer.
263 (b) Technical modifications under Subsection (2)(a) include:
264 (i) the addition or subtraction of abbreviations to names and addresses; and
265 (ii) transpositions or corrections of incorrect numbering or spelling.
266 (3) When providing notice of a change of address under Subsection (1), the consumer
267 reporting agency shall provide notice to the consumer at both the new address and the former
268 address.
269 Section 8. Section 13-42-301 is enacted to read:
270 Part 3. Protection of Personal Information
271 13-42-301. Protection of personal information.
272 (1) Except as allowed by other law, a person may not display a Social Security number
273 in a manner or location that is likely to be open to public view.

Text Box
- 10 - 274 (2) The state, or a branch, agency, or political subdivision of the state, may not employ
275 or contract for the employment of an inmate in any Department of Corrections facility or
276 county jail in any capacity that would allow any inmate access to any other person's personal
277 information.
278 Section 9. Section 13-42-401 is enacted to read:
279 Part 4. Enforcement
280 13-42-401. Enforcement.
281 (1) The attorney general may enforce this chapter's provisions.
282 (2) A person who violates this chapter's provisions is subject to a civil fine of:
283 (a) no greater than $2,500 for a violation or series of violations concerning a specific
284 consumer; and
285 (b) no greater than $100,000 in the aggregate for related violations concerning more
286 than one consumer.
287 (3) In addition to the penalties provided in Subsection (3), the attorney general may
288 seek injunctive relief to prevent future violations of this chapter in:
289 (a) the district court located in Salt Lake City; or
290 (b) the district court for the district in which resides a consumer who is the subject of a
291 credit report on which a violation occurs.
292 Section 10. Effective date.
293 This bill takes effect on September 1, 2008.