Download Zipped Introduced WordPerfect SB0071S03.ZIP
[Status][Bill Documents][Fiscal Note][Bills Directory]

Third Substitute S.B. 71

Senator Carlene M. Walker proposes the following substitute bill:


             1     
CONSUMER CREDIT PROTECTION

             2     
2006 GENERAL SESSION

             3     
STATE OF UTAH

             4     
Chief Sponsor: Carlene M. Walker

             5     
House Sponsor: David Clark

             6     
             7      LONG TITLE
             8      General Description:
             9          This bill addresses consumer credit protections.
             10      Highlighted Provisions:
             11          This bill:
             12          .    defines terms;
             13          .    allows a consumer to place a security freeze on the consumer's credit report;
             14          .    outlines the method for placing and removing a security freeze;
             15          .    provides exceptions;
             16          .    prohibits the release of a credit report that is subject to a security freeze, except in
             17      certain instances;
             18          .    allows certain fees to be charged in connection with a security freeze;
             19          .    governs changes to a credit report that is subject to a security freeze;
             20          .    prohibits some uses of a consumer's personal information; and
             21          .    provides for enforcement.
             22      Monies Appropriated in this Bill:
             23          None
             24      Other Special Clauses:
             25          This bill provides an effective date.


             26      Utah Code Sections Affected:
             27      ENACTS:
             28          13-42-101, Utah Code Annotated 1953
             29          13-42-102, Utah Code Annotated 1953
             30          13-42-201, Utah Code Annotated 1953
             31          13-42-202, Utah Code Annotated 1953
             32          13-42-203, Utah Code Annotated 1953
             33          13-42-204, Utah Code Annotated 1953
             34          13-42-205, Utah Code Annotated 1953
             35          13-42-301, Utah Code Annotated 1953
             36          13-42-401, Utah Code Annotated 1953
             37     
             38      Be it enacted by the Legislature of the state of Utah:
             39          Section 1. Section 13-42-101 is enacted to read:
             40     
CHAPTER 42. CONSUMER CREDIT PROTECTION ACT

             41     
Part 1. General Provisions

             42          13-42-101. Title.
             43          This chapter is known as the "Consumer Credit Protection Act."
             44          Section 2. Section 13-42-102 is enacted to read:
             45          13-42-102. Definitions.
             46          As used in this chapter:
             47          (1) "Consumer" means a natural person.
             48          (2) "Consumer reporting agency" means a person who, for fees, dues, or on a
             49      cooperative basis, regularly engages in whole or in part in the practice of assembling or
             50      evaluating information concerning a consumer's credit or other information for the purpose of
             51      furnishing a credit report to another person.
             52          (3) "Credit report" means a consumer report, as defined in 15 U.S.C. Sec. 1681a, that is
             53      used or collected in whole or part for the purpose of serving as a factor in establishing a
             54      consumer's eligibility for credit for personal, family, or household purposes.
             55          (4) "Normal business hours" means Sunday through Saturday, between the hours of
             56      6:00 a.m. and 9:30 p.m., Mountain Standard or Mountain Daylight Time.


             57          (5) (a) "Personal information" means personally identifiable financial information:
             58          (i) provided by a consumer to another person;
             59          (ii) resulting from any transaction with the consumer or any service performed for the
             60      consumer; or
             61          (iii) otherwise obtained by another person.
             62          (b) "Personal information" does not include:
             63          (i) publicly available information, as that term is defined by the regulations prescribed
             64      under 15 U.S.C. Sec. 6804; or
             65          (ii) any list, description, or other grouping of consumers, and publicly available
             66      information pertaining to the consumers, that is derived without using any nonpublic personal
             67      information.
             68          (c) Notwithstanding Subsection (5)(b), "personal information" includes any list,
             69      description, or other grouping of consumers, and publicly available information pertaining to
             70      the consumers, that is derived using any nonpublic personal information other than publicly
             71      available information.
             72          (6) "Proper identification" has the same meaning as in 15 U.S.C. Sec. 1681h(a)(1), and
             73      includes:
             74          (a) the consumer's full name, including first, last, and middle names and any suffix;
             75          (b) any name the consumer previously used;
             76          (c) the consumer's current and recent full addresses, including street address, any
             77      apartment number, city, state, and ZIP code;
             78          (d) the consumer's social security number; and
             79          (e) the consumer's date of birth.
             80          (7) "Security freeze" means a prohibition, consistent with Section 13-42-201 , on a
             81      consumer reporting agency's furnishing of a consumer's credit report to a third party intending
             82      to use the credit report to determine the consumer's eligibility for credit.
             83          Section 3. Section 13-42-201 is enacted to read:
             84     
Part 2. Security Freeze

             85          13-42-201. Security freeze.
             86          (1) A consumer may place a security freeze on the consumer's credit report by:
             87          (a) making a request to a consumer reporting agency in writing by certified mail;


             88          (b) providing proper identification; and
             89          (c) paying the fee required by the consumer reporting agency in accordance with
             90      Section 13-42-204 .
             91          (2) If a security freeze is in place, a consumer reporting agency may not release a
             92      consumer's credit report, or information from the credit report, to a third party that intends to
             93      use the information to determine a consumer's eligibility for credit without prior authorization
             94      from the consumer.
             95          (3) (a) Notwithstanding Subsection (2), a consumer reporting agency may
             96      communicate to a third party requesting a consumer's credit report that a security freeze is in
             97      effect on the consumer's credit report.
             98          (b) If a third party requesting a consumer's credit report in connection with the
             99      consumer's application for credit is notified of the existence of a security freeze under
             100      Subsection (3)(a), the third party may treat the consumer's application as incomplete.
             101          (4) Upon receiving a request from a consumer under Subsection (1), the consumer
             102      reporting agency shall:
             103          (a) place a security freeze on the consumer's credit report within five business days
             104      after receiving the consumer's request;
             105          (b) send a written confirmation of the security freeze to the consumer within ten
             106      business days after placing the security freeze; and
             107          (c) provide the consumer with a unique personal identification number or password to
             108      be used by the consumer when providing authorizations for removal or temporary removal of
             109      the security freeze under Section 13-42-202 .
             110          (5) A consumer reporting agency shall require proper identification of the consumer
             111      requesting to place, remove, or temporarily remove a security freeze.
             112          (6) (a) A consumer reporting agency shall develop a contact method to receive and
             113      process a consumer's request to place, remove, or temporarily remove a security freeze.
             114          (b) A contact method under Subsection (6)(a) shall include:
             115          (i) a postal address;
             116          (ii) an electronic contact method chosen by the consumer reporting agency, which may
             117      include the use of fax, Internet, or other electronic means; and
             118          (iii) the use of telephone in a manner that is consistent with any federal requirements


             119      placed on the consumer reporting agency.
             120          (7) A security freeze placed under this section may be removed only in accordance
             121      with Section 13-42-202 .
             122          Section 4. Section 13-42-202 is enacted to read:
             123          13-42-202. Removal of security freeze -- Requirements and timing.
             124          (1) A consumer reporting agency may remove a security freeze from a consumer's
             125      credit report only if:
             126          (a) (i) the consumer reporting agency receives the consumer's request through a contact
             127      method established and required in accordance with Subsection 13-42-201 (6); and
             128          (ii) the consumer reporting agency receives the consumer's proper identification and:
             129          (A) other information sufficient to identify the consumer; or
             130          (B) the consumer provides the customer's personal identification number or password;
             131      or
             132          (b) the consumer makes a material misrepresentation of fact in connection with the
             133      placement of the security freeze and the consumer reporting agency notifies the consumer in
             134      writing before removing the security freeze.
             135          (2) Within ten business days after the day on which a consumer reporting agency
             136      permanently removes a security freeze from a consumer's credit report, the consumer reporting
             137      agency shall send a written confirmation of the removal of the security freeze to the consumer.
             138          (3) (a) A consumer reporting agency shall temporarily remove a security freeze upon
             139      receipt of:
             140          (i) the consumer's request through the contact method established by the consumer
             141      reporting agency in accordance with Subsection 13-42-201 (6);
             142          (ii) the consumer's proper identification and:
             143          (A) other information sufficient to identify the consumer; or
             144          (B) personal identification number or password;
             145          (iii) a specific designation of the period of time for which the security freeze is to be
             146      removed; and
             147          (iv) the consumer reporting agency receives the payment of any fee required under
             148      Section 13-42-204 .
             149          (b) A consumer reporting agency shall remove a security freeze from a consumer's


             150      credit report within:
             151          (i) three business days after the business day on which the consumer's written request
             152      to remove the security freeze is received by the consumer reporting agency at the postal address
             153      chosen by the consumer reporting agency in accordance with Subsection 13-42-201 (6); or
             154          (ii) 15 minutes after the consumer's request is received by the consumer reporting
             155      agency through the electronic contact method chosen by the consumer reporting agency in
             156      accordance with Subsection 13-42-201 (6), or the use of telephone, during normal business
             157      hours and includes the consumer's proper identification and correct personal identification
             158      number or password.
             159          (4) A consumer reporting agency need not remove a security freeze within the time
             160      provided in Subsection (3)(b)(ii) if:
             161          (a) the consumer fails to meet the requirements of Subsection 13-42-202 (1); or
             162          (b) the consumer reporting agency's ability to remove the security freeze within 15
             163      minutes is prevented by:
             164          (i) an act of God, including fire, earthquakes, hurricanes, storms, or similar natural
             165      disaster or phenomena;
             166          (ii) unauthorized or illegal acts by a third party, including terrorism, sabotage, riot,
             167      vandalism, labor strikes or disputes disrupting operations, or similar occurrence;
             168          (iii) operational interruption, including electrical failure, unanticipated delay in
             169      equipment or replacement part delivery, computer hardware or software failures inhibiting
             170      response time, or similar disruption;
             171          (iv) governmental action, including emergency orders or regulations, judicial or law
             172      enforcement action, or similar directives;
             173          (v) regularly scheduled maintenance, during other than normal business hours, of, or
             174      updates to, the consumer reporting agency's systems;
             175          (vi) commercially reasonable maintenance of, or repair to, the consumer reporting
             176      agency's systems that is unexpected or unscheduled; or
             177          (vii) receipt of a removal request outside of normal business hours.
             178          Section 5. Section 13-42-203 is enacted to read:
             179          13-42-203. Exceptions.
             180          (1) Notwithstanding Section 13-42-201 , a consumer reporting agency may furnish a


             181      consumer's credit report to a third party if:
             182          (a) (i) the purpose of the credit report is to:
             183          (A) use the credit report for purposes permitted under 15 U.S.C. Sec. 1681b(c); or
             184          (B) review the consumer's account with the third party, including for account
             185      maintenance or monitoring, credit line increases, or other upgrades or enhancements; or
             186          (C) collect on a financial obligation owed by the consumer to the third party requesting
             187      the credit report; or
             188          (ii) (A) the purpose of the credit report is to:
             189          (I) review the consumer's account with another person; or
             190          (II) collect on a financial obligation owed by the consumer to another person; and
             191          (B) use the credit report for purposes permitted under 15 U.S.C. Sec. 1681b(c); or
             192          (b) the third party requesting the credit report is a subsidiary, affiliate, agent, assignee,
             193      or prospective assignee of the person holding the consumer's account or to whom the consumer
             194      owes a financial obligation;
             195          (2) (a) The consumer's request for a security freeze does not prohibit the consumer
             196      reporting agency from disclosing the consumer's credit report for other than credit related
             197      purposes consistent with the definition of credit report found in Section 13-42-102 .
             198          (b) The following list identifies the types of credit report disclosures by consumer
             199      reporting agencies to third parties that are not prohibited by a security freeze:
             200          (i) the third party does not use the credit report for the purpose of serving as a factor in
             201      establishing a consumer's eligibility for credit;
             202          (ii) the third party is acting under a court order, warrant, or subpoena requiring release
             203      of the credit report;
             204          (iii) the third party is a child support agency, or its agent or assignee, acting under Part
             205      D, Title IV of the Social Security Act or a similar state law;
             206          (iv) the federal Department of Health and Human Services or a similar state agency, or
             207      its agent or assignee, investigating Medicare or Medicaid fraud;
             208          (v) (A) the purpose of the credit report is to investigate or collect delinquent taxes,
             209      assessments, or unpaid court orders; and
             210          (B) the third party is:
             211          (I) the federal Internal Revenue Service;


             212          (II) a state taxing authority;
             213          (III) the Department of Motor Vehicles;
             214          (IV) a county, municipality, or other entity with taxing authority;
             215          (V) a federal, state, or local law enforcement agency; or
             216          (VI) the agent or assignee of any entity listed in Subsections (1)(b) and (2)(b)(v)(B);
             217          (vi) the third party is administering a credit file monitoring subscription to which the
             218      consumer has subscribed; or
             219          (vii) the third party requests the credit report for the sole purpose of providing the
             220      consumer with a copy of the consumer's credit report or credit score upon the consumer's
             221      request.
             222          (3) Section 13-42-201 does not apply to:
             223          (a) a consumer reporting agency, the sole purpose of which is to resell credit
             224      information by assembling and merging information contained in the database of another
             225      consumer reporting agency and that does not maintain a permanent database of credit
             226      information from which a consumer's credit report is produced;
             227          (b) a check services or fraud prevention services company that issues:
             228          (i) reports on incidents of fraud; or
             229          (ii) authorizations for the purpose of approving or processing negotiable instruments,
             230      electronic funds transfers, or similar methods of payment; or
             231          (c) a deposit account information service company that issues reports concerning
             232      account closures based on fraud, substantial overdrafts, automated teller machine abuse, or
             233      similar information concerning a consumer to a requesting financial institution for the purpose
             234      of evaluating a consumer's request to create a deposit account.
             235          (4) Nothing in this chapter prohibits a person from obtaining, aggregating, or using
             236      information lawfully obtained from public records in a manner that does not otherwise violate
             237      this chapter.
             238          Section 6. Section 13-42-204 is enacted to read:
             239          13-42-204. Fees for security freeze.
             240          (1) (a) Except as provided in Subsection (2), a consumer reporting agency may charge
             241      a reasonable fee to a consumer for placing a security freeze.
             242          (b) The fee paid under Subsection (1)(a) allows the consumer to place the security


             243      freeze and to either permanently or temporarily remove the security freeze one time.
             244          (c) Except as provided in Subsections (1)(b) and (2), a consumer reporting agency may
             245      charge a fee for removal or temporary removal of a security freeze.
             246          (2) A consumer reporting agency may not charge a fee for placing or removing a
             247      security freeze if:
             248          (a) the consumer is a victim of identity fraud under Section 76-6-1102 ; and
             249          (b) the consumer provides the consumer reporting agency with a valid copy of a police
             250      report or police case number documenting the identity fraud.
             251          Section 7. Section 13-42-205 is enacted to read:
             252          13-42-205. Changes to information in a credit report subject to a security freeze.
             253          (1) If a credit report is subject to a security freeze, a consumer reporting agency shall
             254      notify the consumer who is the subject of the credit report within 30 days if the consumer
             255      reporting agency changes the consumer's:
             256          (a) name;
             257          (b) date of birth;
             258          (c) Social Security number; or
             259          (d) address.
             260          (2) (a) Notwithstanding Subsection (1), a consumer reporting agency may make
             261      technical modifications to information in a credit report that is subject to a security freeze
             262      without providing notification to the consumer.
             263          (b) Technical modifications under Subsection (2)(a) include:
             264          (i) the addition or subtraction of abbreviations to names and addresses; and
             265          (ii) transpositions or corrections of incorrect numbering or spelling.
             266          (3) When providing notice of a change of address under Subsection (1), the consumer
             267      reporting agency shall provide notice to the consumer at both the new address and the former
             268      address.
             269          Section 8. Section 13-42-301 is enacted to read:
             270     
Part 3. Protection of Personal Information

             271          13-42-301. Protection of personal information.
             272          (1) Except as allowed by other law, a person may not display a Social Security number
             273      in a manner or location that is likely to be open to public view.


             274          (2) The state, or a branch, agency, or political subdivision of the state, may not employ
             275      or contract for the employment of an inmate in any Department of Corrections facility or
             276      county jail in any capacity that would allow any inmate access to any other person's personal
             277      information.
             278          Section 9. Section 13-42-401 is enacted to read:
             279     
Part 4. Enforcement

             280          13-42-401. Enforcement.
             281          (1) The attorney general may enforce this chapter's provisions.
             282          (2) A person who violates this chapter's provisions is subject to a civil fine of:
             283          (a) no greater than $2,500 for a violation or series of violations concerning a specific
             284      consumer; and
             285          (b) no greater than $100,000 in the aggregate for related violations concerning more
             286      than one consumer.
             287          (3) In addition to the penalties provided in Subsection (3), the attorney general may
             288      seek injunctive relief to prevent future violations of this chapter in:
             289          (a) the district court located in Salt Lake City; or
             290          (b) the district court for the district in which resides a consumer who is the subject of a
             291      credit report on which a violation occurs.
             292          Section 10. Effective date.
             293          This bill takes effect on September 1, 2008.


[Bill Documents][Bills Directory]