S.B. 71 Enrolled

1

CONSUMER CREDIT PROTECTION
2 2006 GENERAL SESSION
3 STATE OF UTAH
4 Chief Sponsor: Carlene M. Walker
5 House Sponsor: David Clark
6
7 LONG TITLE
8 General Description:
9 This bill addresses consumer credit protections.
10 Highlighted Provisions:
11 This bill:
12 . defines terms;
13 . allows a consumer to place a security freeze on the consumer's credit report;
14 . outlines the method for placing and removing a security freeze;
15 . provides exceptions;
16 . prohibits the release of a credit report that is subject to a security freeze, except in
17 certain instances;
18 . allows certain fees to be charged in connection with a security freeze;
19 . governs changes to a credit report that is subject to a security freeze;
20 . prohibits some uses of a consumer's personal information; and
21 . provides for enforcement.
22 Monies Appropriated in this Bill:
23 None
24 Other Special Clauses:
25 This bill provides an effective date.
26 Utah Code Sections Affected:
27 ENACTS:
28 13-42-101, Utah Code Annotated 1953
29 13-42-102, Utah Code Annotated 1953

30 13-42-201, Utah Code Annotated 1953
31 13-42-202, Utah Code Annotated 1953
32 13-42-203, Utah Code Annotated 1953
33 13-42-204, Utah Code Annotated 1953
34 13-42-205, Utah Code Annotated 1953
35 13-42-301, Utah Code Annotated 1953
36 13-42-401, Utah Code Annotated 1953
37
38 Be it enacted by the Legislature of the state of Utah:
39 Section 1. Section 13-42-101 is enacted to read:
40 CHAPTER 42. CONSUMER CREDIT PROTECTION ACT
41 Part 1. General Provisions
42 13-42-101. Title.
43 This chapter is known as the "Consumer Credit Protection Act."
44 Section 2. Section 13-42-102 is enacted to read:
45 13-42-102. Definitions.
46 As used in this chapter:
47 (1) "Consumer" means a natural person.
48 (2) "Consumer reporting agency" means a person who, for fees, dues, or on a
49 cooperative basis, regularly engages in whole or in part in the practice of assembling or
50 evaluating information concerning a consumer's credit or other information for the purpose of
51 furnishing a credit report to another person.
52 (3) "Credit report" means a consumer report, as defined in 15 U.S.C. Sec. 1681a, that is
53 used or collected in whole or part for the purpose of serving as a factor in establishing a
54 consumer's eligibility for credit for personal, family, or household purposes.
55 (4) "Normal business hours" means Sunday through Saturday, between the hours of
56 6:00 a.m. and 9:30 p.m., Mountain Standard or Mountain Daylight Time.
57 (5) (a) "Personal information" means personally identifiable financial information:

58 (i) provided by a consumer to another person;
59 (ii) resulting from any transaction with the consumer or any service performed for the
60 consumer; or
61 (iii) otherwise obtained by another person.
62 (b) "Personal information" does not include:
63 (i) publicly available information, as that term is defined by the regulations prescribed
64 under 15 U.S.C. Sec. 6804; or
65 (ii) any list, description, or other grouping of consumers, and publicly available
66 information pertaining to the consumers, that is derived without using any nonpublic personal
67 information.
68 (c) Notwithstanding Subsection (5)(b), "personal information" includes any list,
69 description, or other grouping of consumers, and publicly available information pertaining to
70 the consumers, that is derived using any nonpublic personal information other than publicly
71 available information.
72 (6) "Proper identification" has the same meaning as in 15 U.S.C. Sec. 1681h(a)(1), and
73 includes:
74 (a) the consumer's full name, including first, last, and middle names and any suffix;
75 (b) any name the consumer previously used;
76 (c) the consumer's current and recent full addresses, including street address, any
77 apartment number, city, state, and ZIP code;
78 (d) the consumer's social security number; and
79 (e) the consumer's date of birth.
80 (7) "Security freeze" means a prohibition, consistent with Section 13-42-201 , on a
81 consumer reporting agency's furnishing of a consumer's credit report to a third party intending
82 to use the credit report to determine the consumer's eligibility for credit.
83 Section 3. Section 13-42-201 is enacted to read:
84 Part 2. Security Freeze
85 13-42-201. Security freeze.

86 (1) A consumer may place a security freeze on the consumer's credit report by:
87 (a) making a request to a consumer reporting agency in writing by certified mail;
88 (b) providing proper identification; and
89 (c) paying the fee required by the consumer reporting agency in accordance with
90 Section 13-42-204 .
91 (2) If a security freeze is in place, a consumer reporting agency may not release a
92 consumer's credit report, or information from the credit report, to a third party that intends to
93 use the information to determine a consumer's eligibility for credit without prior authorization
94 from the consumer.
95 (3) (a) Notwithstanding Subsection (2), a consumer reporting agency may
96 communicate to a third party requesting a consumer's credit report that a security freeze is in
97 effect on the consumer's credit report.
98 (b) If a third party requesting a consumer's credit report in connection with the
99 consumer's application for credit is notified of the existence of a security freeze under
100 Subsection (3)(a), the third party may treat the consumer's application as incomplete.
101 (4) Upon receiving a request from a consumer under Subsection (1), the consumer
102 reporting agency shall:
103 (a) place a security freeze on the consumer's credit report within five business days
104 after receiving the consumer's request;
105 (b) send a written confirmation of the security freeze to the consumer within ten
106 business days after placing the security freeze; and
107 (c) provide the consumer with a unique personal identification number or password to
108 be used by the consumer when providing authorizations for removal or temporary removal of
109 the security freeze under Section 13-42-202 .
110 (5) A consumer reporting agency shall require proper identification of the consumer
111 requesting to place, remove, or temporarily remove a security freeze.
112 (6) (a) A consumer reporting agency shall develop a contact method to receive and
113 process a consumer's request to place, remove, or temporarily remove a security freeze.

114 (b) A contact method under Subsection (6)(a) shall include:
115 (i) a postal address;
116 (ii) an electronic contact method chosen by the consumer reporting agency, which may
117 include the use of fax, Internet, or other electronic means; and
118 (iii) the use of telephone in a manner that is consistent with any federal requirements
119 placed on the consumer reporting agency.
120 (7) A security freeze placed under this section may be removed only in accordance
121 with Section 13-42-202 .
122 Section 4. Section 13-42-202 is enacted to read:
123 13-42-202. Removal of security freeze -- Requirements and timing.
124 (1) A consumer reporting agency may remove a security freeze from a consumer's
125 credit report only if:
126 (a) (i) the consumer reporting agency receives the consumer's request through a contact
127 method established and required in accordance with Subsection 13-42-201 (6); and
128 (ii) the consumer reporting agency receives the consumer's proper identification and:
129 (A) other information sufficient to identify the consumer; or
130 (B) the consumer provides the consumer's personal identification number or password;
131 or
132 (b) the consumer makes a material misrepresentation of fact in connection with the
133 placement of the security freeze and the consumer reporting agency notifies the consumer in
134 writing before removing the security freeze.
135 (2) (a) A consumer reporting agency shall temporarily remove a security freeze upon
136 receipt of:
137 (i) the consumer's request through the contact method established by the consumer
138 reporting agency in accordance with Subsection 13-42-201 (6);
139 (ii) the consumer's proper identification and:
140 (A) other information sufficient to identify the consumer; or
141 (B) personal identification number or password;

142 (iii) a specific designation of the period of time for which the security freeze is to be
143 removed; and
144 (iv) the consumer reporting agency receives the payment of any fee required under
145 Section 13-42-204 .
146 (b) A consumer reporting agency shall remove a security freeze from a consumer's
147 credit report within:
148 (i) three business days after the business day on which the consumer's written request
149 to remove the security freeze is received by the consumer reporting agency at the postal address
150 chosen by the consumer reporting agency in accordance with Subsection 13-42-201 (6); or
151 (ii) 15 minutes after the consumer's request is received by the consumer reporting
152 agency through the electronic contact method chosen by the consumer reporting agency in
153 accordance with Subsection 13-42-201 (6), or the use of telephone, during normal business
154 hours and includes the consumer's proper identification and correct personal identification
155 number or password.
156 (3) A consumer reporting agency need not remove a security freeze within the time
157 provided in Subsection (2)(b)(ii) if:
158 (a) the consumer fails to meet the requirements of Subsection 13-42-202 (1); or
159 (b) the consumer reporting agency's ability to remove the security freeze within 15
160 minutes is prevented by:
161 (i) an act of God, including fire, earthquakes, hurricanes, storms, or similar natural
162 disaster or phenomena;
163 (ii) unauthorized or illegal acts by a third party, including terrorism, sabotage, riot,
164 vandalism, labor strikes or disputes disrupting operations, or similar occurrence;
165 (iii) operational interruption, including electrical failure, unanticipated delay in
166 equipment or replacement part delivery, computer hardware or software failures inhibiting
167 response time, or similar disruption;
168 (iv) governmental action, including emergency orders or regulations, judicial or law
169 enforcement action, or similar directives;

170 (v) regularly scheduled maintenance, during other than normal business hours, of, or
171 updates to, the consumer reporting agency's systems;
172 (vi) commercially reasonable maintenance of, or repair to, the consumer reporting
173 agency's systems that is unexpected or unscheduled; or
174 (vii) receipt of a removal request outside of normal business hours.
175 Section 5. Section 13-42-203 is enacted to read:
176 13-42-203. Exceptions.
177 (1) Notwithstanding Section 13-42-201 , a consumer reporting agency may furnish a
178 consumer's credit report to a third party if:
179 (a) (i) the purpose of the credit report is to:
180 (A) use the credit report for purposes permitted under 15 U.S.C. Sec. 1681b(c); or
181 (B) review the consumer's account with the third party, including for account
182 maintenance or monitoring, credit line increases, or other upgrades or enhancements; or
183 (C) collect on a financial obligation owed by the consumer to the third party requesting
184 the credit report; or
185 (ii) (A) the purpose of the credit report is to:
186 (I) review the consumer's account with another person; or
187 (II) collect on a financial obligation owed by the consumer to another person; and
188 (B) use the credit report for purposes permitted under 15 U.S.C. Sec. 1681b(c); or
189 (b) the third party requesting the credit report is a subsidiary, affiliate, agent, assignee,
190 or prospective assignee of the person holding the consumer's account or to whom the consumer
191 owes a financial obligation;
192 (2) (a) The consumer's request for a security freeze does not prohibit the consumer
193 reporting agency from disclosing the consumer's credit report for other than credit related
194 purposes consistent with the definition of credit report found in Section 13-42-102 .
195 (b) The following list identifies the types of credit report disclosures by consumer
196 reporting agencies to third parties that are not prohibited by a security freeze:
197 (i) the third party does not use the credit report for the purpose of serving as a factor in

198 establishing a consumer's eligibility for credit;
199 (ii) the third party is acting under a court order, warrant, or subpoena requiring release
200 of the credit report;
201 (iii) the third party is a child support agency, or its agent or assignee, acting under Part
202 D, Title IV of the Social Security Act or a similar state law;
203 (iv) the federal Department of Health and Human Services or a similar state agency, or
204 its agent or assignee, investigating Medicare or Medicaid fraud;
205 (v) (A) the purpose of the credit report is to investigate or collect delinquent taxes,
206 assessments, or unpaid court orders; and
207 (B) the third party is:
208 (I) the federal Internal Revenue Service;
209 (II) a state taxing authority;
210 (III) the Department of Motor Vehicles;
211 (IV) a county, municipality, or other entity with taxing authority;
212 (V) a federal, state, or local law enforcement agency; or
213 (VI) the agent or assignee of any entity listed in Subsections (1)(b) and (2)(b)(v)(B);
214 (vi) the third party is administering a credit file monitoring subscription to which the
215 consumer has subscribed; or
216 (vii) the third party requests the credit report for the sole purpose of providing the
217 consumer with a copy of the consumer's credit report or credit score upon the consumer's
218 request.
219 (3) Section 13-42-201 does not apply to:
220 (a) a consumer reporting agency, the sole purpose of which is to resell credit
221 information by assembling and merging information contained in the database of another
222 consumer reporting agency and that does not maintain a permanent database of credit
223 information from which a consumer's credit report is produced;
224 (b) a check services or fraud prevention services company that issues:
225 (i) reports on incidents of fraud; or

226 (ii) authorizations for the purpose of approving or processing negotiable instruments,
227 electronic funds transfers, or similar methods of payment; or
228 (c) a deposit account information service company that issues reports concerning
229 account closures based on fraud, substantial overdrafts, automated teller machine abuse, or
230 similar information concerning a consumer to a requesting financial institution for the purpose
231 of evaluating a consumer's request to create a deposit account.
232 (4) Nothing in this chapter prohibits a person from obtaining, aggregating, or using
233 information lawfully obtained from public records in a manner that does not otherwise violate
234 this chapter.
235 Section 6. Section 13-42-204 is enacted to read:
236 13-42-204. Fees for security freeze.
237 (1) Except as provided in Subsection (2), a consumer reporting agency may charge a
238 reasonable fee to a consumer for placing and temporarily removing a security freeze.
239 (2) A consumer reporting agency may not charge a fee for placing or removing a
240 security freeze if:
241 (a) the consumer is a victim of identity fraud under Section 76-6-1102 ; and
242 (b) the consumer provides the consumer reporting agency with a valid copy of a police
243 report or police case number documenting the identity fraud.
244 Section 7. Section 13-42-205 is enacted to read:
245 13-42-205. Changes to information in a credit report subject to a security freeze.
246 (1) If a credit report is subject to a security freeze, a consumer reporting agency shall
247 notify the consumer who is the subject of the credit report within 30 days if the consumer
248 reporting agency changes the consumer's:
249 (a) name;
250 (b) date of birth;
251 (c) Social Security number; or
252 (d) address.
253 (2) (a) Notwithstanding Subsection (1), a consumer reporting agency may make

254 technical modifications to information in a credit report that is subject to a security freeze
255 without providing notification to the consumer.
256 (b) Technical modifications under Subsection (2)(a) include:
257 (i) the addition or subtraction of abbreviations to names and addresses; and
258 (ii) transpositions or corrections of incorrect numbering or spelling.
259 (3) When providing notice of a change of address under Subsection (1), the consumer
260 reporting agency shall provide notice to the consumer at both the new address and the former
261 address.
262 Section 8. Section 13-42-301 is enacted to read:
263 Part 3. Protection of Personal Information
264 13-42-301. Protection of personal information.
265 (1) Except as allowed by other law, a person may not display a Social Security number
266 in a manner or location that is likely to be open to public view.
267 (2) The state, or a branch, agency, or political subdivision of the state, may not employ
268 or contract for the employment of an inmate in any Department of Corrections facility or
269 county jail in any capacity that would allow any inmate access to any other person's personal
270 information.
271 Section 9. Section 13-42-401 is enacted to read:
272 Part 4. Enforcement
273 13-42-401. Enforcement.
274 (1) The attorney general may enforce this chapter's provisions.
275 (2) A person who violates this chapter's provisions is subject to a civil fine of:
276 (a) no greater than $2,500 for a violation or series of violations concerning a specific
277 consumer; and
278 (b) no greater than $100,000 in the aggregate for related violations concerning more
279 than one consumer.
280 (3) In addition to the penalties provided in Subsection (2), the attorney general may
281 seek injunctive relief to prevent future violations of this chapter in:

282 (a) the district court located in Salt Lake City; or
283 (b) the district court for the district in which resides a consumer who is the subject of a
284 credit report on which a violation occurs.
285 Section 10. Effective date.
286 This bill takes effect on September 1, 2008.