S.B. 239

1

CREDIT REPORT PROTECTION FOR MINORS
2 2014 GENERAL SESSION
3 STATE OF UTAH
4 Chief Sponsor: Curtis S. Bramble
5 House Sponsor: ____________
6
7 LONG TITLE
8 General Description:
9 This bill modifies and enacts provisions of the Consumer Credit Protection Act relating
10 to certain minors, incapacitated adults, and protected persons.
11 Highlighted Provisions:
12 This bill:
13 . defines terms;
14 . upon request and in accordance with the provisions of this bill, requires a credit
15 reporting agency to place a security freeze for:
16 . an individual who is less than 16 years of age;
17 . an incapacitated adult; or
18 . a protected person;
19 . provides a procedure by which an individual or an individual's representative may
20 remove a security freeze;
21 . allows, under certain circumstances, a credit reporting agency to charge a reasonable
22 fee of $5 or less for the placement or removal of a security freeze;
23 . provides that the attorney general may enforce the provisions of this bill; and
24 . makes technical and conforming changes.
25 Money Appropriated in this Bill:
26 None
27 Other Special Clauses:

28 This bill takes effect on January 1, 2015.
29 Utah Code Sections Affected:
30 AMENDS:
31 13-45-102 , as enacted by Laws of Utah 2006, Chapter 344
32 13-45-201 , as enacted by Laws of Utah 2006, Chapter 344
33 13-45-202 , as enacted by Laws of Utah 2006, Chapter 344
34 13-45-401 , as enacted by Laws of Utah 2006, Chapter 344
35 ENACTS:
36 13-45-503 , Utah Code Annotated 1953
37 13-45-504 , Utah Code Annotated 1953
38 13-45-505 , Utah Code Annotated 1953
39 13-45-506 , Utah Code Annotated 1953
40 38-45-501 , Utah Code Annotated 1953
41 38-45-502 , Utah Code Annotated 1953
42
43 Be it enacted by the Legislature of the state of Utah:
44 Section 1. Section 13-45-102 is amended to read:
45 13-45-102. Definitions.
46 As used in this chapter:
47 (1) "Consumer" means [a natural person] an individual who is not a protected
48 consumer.
49 (2) "Consumer reporting agency" means a person who, for fees, dues, or on a
50 cooperative basis, regularly engages in whole or in part in the practice of assembling or
51 evaluating information concerning a consumer's credit or other information for the purpose of
52 furnishing a credit report to another person.
53 (3) "Consumer who is subject to a protected consumer security freeze" means an
54 individual:
55 (a) for whom a credit reporting agency placed a security freeze under Section
56 13-45-503 ; and
57 (b) who, on the day on which a request for the removal of the security freeze is
58 submitted under Section 13-45-504 , is not a protected consumer.

59 [(3)] (4) "Credit report" means a consumer report, as defined in 15 U.S.C. Sec. 1681a,
60 that is used or collected in whole or part for the purpose of serving as a factor in establishing a
61 consumer's eligibility for credit for personal, family, or household purposes.
62 (5) "File" is as defined in 15 U.S.C. Sec. 1681a.
63 (6) "Incapacitated person" means an individual who is incapacitated, as defined in
64 Section 75-1-201 .
65 [(4)] (7) "Normal business hours" means Sunday through Saturday, between the hours
66 of 6:00 a.m. and 9:30 p.m., Mountain Standard or Mountain Daylight Time.
67 [(5)] (8) (a) "Personal information" means personally identifiable financial
68 information:
69 (i) provided by a consumer to another person;
70 (ii) resulting from any transaction with the consumer or any service performed for the
71 consumer; or
72 (iii) otherwise obtained by another person.
73 (b) "Personal information" does not include:
74 (i) publicly available information, as that term is defined by the regulations prescribed
75 under 15 U.S.C. Sec. 6804; or
76 (ii) any list, description, or other grouping of consumers, and publicly available
77 information pertaining to the consumers, that is derived without using any nonpublic personal
78 information.
79 (c) Notwithstanding Subsection [(5)] (8)(b), "personal information" includes any list,
80 description, or other grouping of consumers, and publicly available information pertaining to
81 the consumers, that is derived using any nonpublic personal information other than publicly
82 available information.
83 [(6)] (9) "Proper identification" has the same meaning as in 15 U.S.C. Sec.
84 1681h(a)(1), and includes:
85 (a) the consumer's full name, including first, last, and middle names and any suffix;
86 (b) any name the consumer previously used;
87 (c) the consumer's current and recent full addresses, including street address, any
88 apartment number, city, state, and ZIP code;
89 (d) the consumer's social security number; and

90 (e) the consumer's date of birth.
91 [(7) "Security freeze" means a prohibition, consistent with Section 13-45-201 , on a
92 consumer reporting agency's furnishing of a consumer's credit report to a third party intending
93 to use the credit report to determine the consumer's eligibility for credit.]
94 (10) "Protected consumer" means an individual who, at the time a request for a security
95 freeze is made, is:
96 (a) less than 16 years of age;
97 (b) an incapacitated person; or
98 (c) a protected person.
99 (11) "Protected person" is as defined in Section 75-5b-102 .
100 (12) "Record" means a compilation of information that:
101 (a) identifies a protected consumer;
102 (b) is created by a consumer reporting agency solely for the purpose of complying with
103 this section; and
104 (c) may not be created or used to consider the protected consumer's credit worthiness,
105 credit standing, credit capacity, character, general reputation, personal characteristics, or mode
106 of living.
107 (13) "Representative" means a person who provides to a consumer reporting agency
108 sufficient proof of authority to act on behalf of a protected consumer.
109 (14) (a) "Sufficient proof of authority" means documentation that shows that a person
110 has authority to act on behalf of a protected consumer.
111 (b) "Sufficient proof of authority" includes:
112 (i) a court order;
113 (ii) a lawfully executed power of attorney; or
114 (iii) a written, notarized statement signed by the person that expressly describes the
115 person's authority to act on behalf of the protected consumer.
116 (15) (a) "Sufficient proof of identification" means information or documentation that
117 identifies a protected consumer or a representative.
118 (b) "Sufficient proof of identification" includes:
119 (i) a Social Security number or a copy of a Social Security card issued by the United
120 States Social Security Administration;

121 (ii) a certified or official copy of a birth certificate; or
122 (iii) a copy of a government issued driver license or identification card.
123 Section 2. Section 13-45-201 is amended to read:
124 13-45-201. Security freeze.
125 (1) As used in this part, "security freeze" means a prohibition, consistent with the
126 provisions of this section, on a consumer reporting agency's furnishing of a consumer's credit
127 report to a third party intending to use the credit report to determine the consumer's eligibility
128 for credit.
129 [(1)] (2) A consumer may place a security freeze on the consumer's credit report by:
130 (a) making a request to a consumer reporting agency in writing by certified mail;
131 (b) providing proper identification; and
132 (c) paying the fee required by the consumer reporting agency in accordance with
133 Section 13-45-204 .
134 [(2)] (3) If a security freeze is in place, a consumer reporting agency may not release a
135 consumer's credit report, or information from the credit report, to a third party that intends to
136 use the information to determine a consumer's eligibility for credit without prior authorization
137 from the consumer.
138 [(3)] (4) (a) Notwithstanding Subsection [(2)] (3), a consumer reporting agency may
139 communicate to a third party requesting a consumer's credit report that a security freeze is in
140 effect on the consumer's credit report.
141 (b) If a third party requesting a consumer's credit report in connection with the
142 consumer's application for credit is notified of the existence of a security freeze under
143 Subsection [(3)] (4)(a), the third party may treat the consumer's application as incomplete.
144 [(4)] (5) Upon receiving a request from a consumer under Subsection [(1)] (2), the
145 consumer reporting agency shall:
146 (a) place a security freeze on the consumer's credit report within five business days
147 after receiving the consumer's request;
148 (b) send a written confirmation of the security freeze to the consumer within 10
149 business days after placing the security freeze; and
150 (c) provide the consumer with a unique personal identification number or password to
151 be used by the consumer when providing authorizations for removal or temporary removal of

152 the security freeze under Section 13-45-202 .
153 [(5)] (6) A consumer reporting agency shall require proper identification of the
154 consumer requesting to place, remove, or temporarily remove a security freeze.
155 [(6)] (7) (a) A consumer reporting agency shall develop a contact method to receive
156 and process a consumer's request to place, remove, or temporarily remove a security freeze.
157 (b) A contact method under Subsection [(6)] (7)(a) shall include:
158 (i) a postal address;
159 (ii) an electronic contact method chosen by the consumer reporting agency, which may
160 include the use of fax, Internet, or other electronic means; and
161 (iii) the use of telephone in a manner that is consistent with any federal requirements
162 placed on the consumer reporting agency.
163 [(7)] (8) A security freeze placed under this section may be removed only in
164 accordance with Section 13-45-202 .
165 Section 3. Section 13-45-202 is amended to read:
166 13-45-202. Removal of security freeze -- Requirements and timing.
167 (1) A consumer reporting agency may remove a security freeze from a consumer's
168 credit report only if:
169 (a) (i) the consumer reporting agency receives the consumer's request through a contact
170 method established and required in accordance with Subsection 13-45-201 [(6)](7); and
171 (ii) the consumer reporting agency receives the consumer's proper identification and:
172 (A) other information sufficient to identify the consumer; or
173 (B) the consumer provides the consumer's personal identification number or password;
174 or
175 (b) the consumer makes a material misrepresentation of fact in connection with the
176 placement of the security freeze and the consumer reporting agency notifies the consumer in
177 writing before removing the security freeze.
178 (2) (a) A consumer reporting agency shall temporarily remove a security freeze upon
179 receipt of:
180 (i) the consumer's request through the contact method established by the consumer
181 reporting agency in accordance with Subsection 13-45-201 [(6)](7);
182 (ii) the consumer's proper identification and:

183 (A) other information sufficient to identify the consumer; or
184 (B) personal identification number or password;
185 (iii) a specific designation of the period of time for which the security freeze is to be
186 removed; and
187 (iv) the consumer reporting agency receives the payment of any fee required under
188 Section 13-45-204 .
189 (b) A consumer reporting agency shall remove a security freeze from a consumer's
190 credit report within:
191 (i) three business days after the business day on which the consumer's written request
192 to remove the security freeze is received by the consumer reporting agency at the postal address
193 chosen by the consumer reporting agency in accordance with Subsection 13-45-201 [(6)](7); or
194 (ii) 15 minutes after the consumer's request is received by the consumer reporting
195 agency through the electronic contact method chosen by the consumer reporting agency in
196 accordance with Subsection 13-45-201 [(6)](7), or the use of telephone, during normal business
197 hours and includes the consumer's proper identification and correct personal identification
198 number or password.
199 (3) A consumer reporting agency need not remove a security freeze within the time
200 provided in Subsection (2)(b)(ii) if:
201 (a) the consumer fails to meet the requirements of Subsection 13-45-202 (1); or
202 (b) the consumer reporting agency's ability to remove the security freeze within 15
203 minutes is prevented by:
204 (i) an act of God, including fire, earthquakes, hurricanes, storms, or similar natural
205 disaster or phenomena;
206 (ii) unauthorized or illegal acts by a third party, including terrorism, sabotage, riot,
207 vandalism, labor strikes or disputes disrupting operations, or similar occurrence;
208 (iii) operational interruption, including electrical failure, unanticipated delay in
209 equipment or replacement part delivery, computer hardware or software failures inhibiting
210 response time, or similar disruption;
211 (iv) governmental action, including emergency orders or regulations, judicial or law
212 enforcement action, or similar directives;
213 (v) regularly scheduled maintenance, during other than normal business hours, of, or

214 updates to, the consumer reporting agency's systems;
215 (vi) commercially reasonable maintenance of, or repair to, the consumer reporting
216 agency's systems that is unexpected or unscheduled; or
217 (vii) receipt of a removal request outside of normal business hours.
218 Section 4. Section 13-45-401 is amended to read:
219 13-45-401. Enforcement.
220 (1) The attorney general may enforce [this chapter's provisions] the provisions of this
221 chapter.
222 (2) A person who violates [this chapter's provisions] a provision of Section 13-45-201 ,
223 13-45-202 , 13-45-203 , 13-45-204 , 13-45-205 , or 13-45-301 is subject to a civil fine of:
224 (a) no greater than $2,500 for a violation or series of violations concerning a specific
225 consumer; and
226 (b) no greater than $100,000 in the aggregate for related violations concerning more
227 than one consumer.
228 (3) In addition to the penalties provided in Subsection (2), the attorney general may
229 seek injunctive relief to prevent future violations of this chapter in:
230 (a) the district court located in Salt Lake City; or
231 (b) the district court for the district in which resides a consumer who is the subject of a
232 credit report on which a violation occurs.
233 Section 5. Section 38-45-501 is enacted to read:
234 Part 5. Credit Report Protection for Minors
235 38-45-501. Title.
236 This part is known as "Credit Report Protection for Minors."
237 Section 6. Section 38-45-502 is enacted to read:
238 38-45-502. Definition.
239 As used in this part, "security freeze" means:
240 (1) if a consumer reporting agency does not have a file that pertains to a protected
241 consumer, a restriction that:
242 (a) is placed on the protected consumer's record in accordance with this part; and
243 (b) except as otherwise provided in this part, prohibits the consumer reporting agency
244 from releasing the protected consumer's record; or

245 (2) if a consumer reporting agency has a file that pertains to the protected consumer, a
246 restriction that:
247 (a) is placed on the protected consumer's credit report in accordance with this part; and
248 (b) except as otherwise provided in this part, prohibits the consumer reporting agency
249 from releasing the protected consumer's credit report or any information derived from the
250 protected consumer's credit report.
251 Section 7. Section 13-45-503 is enacted to read:
252 13-45-503. Applicability.
253 This part does not apply to the use of a protected consumer's credit report or record by:
254 (1) a person administering a credit file monitoring subscription service to which:
255 (a) the protected consumer has subscribed; or
256 (b) the protected consumer's representative has subscribed on the protected consumer's
257 behalf;
258 (2) a person who, upon request from the protected consumer or the protected
259 consumer's representative, provides the protected consumer or the protected consumer's
260 representative with a copy of the protected consumer's credit report;
261 (3) a check services or fraud prevention services company that issues:
262 (a) reports on incidents of fraud; or
263 (b) authorizations for the purpose of approving or processing negotiable instruments,
264 electronic funds transfers, or similar payment methods;
265 (4) a deposit account information service company that issues reports regarding
266 account closures due to fraud, substantial overdrafts, automated teller machine abuse, or
267 similar information regarding an individual to inquiring banks or other financial institutions for
268 use only in reviewing an individual's request for a deposit account at the inquiring bank or
269 financial institution;
270 (5) an insurance company for the purpose of conducting the insurance company's
271 ordinary business;
272 (6) a consumer reporting agency that:
273 (a) only resells credit information by assembling and merging information contained in
274 a database of another consumer reporting agency or multiple consumer reporting agencies; and
275 (b) does not maintain a permanent database of credit information from which new

276 credit reports are produced; or
277 (7) a consumer reporting agency's database or file that consists of information that:
278 (a) concerns and is used for:
279 (i) criminal record information;
280 (ii) fraud prevention or detection;
281 (iii) personal loss history information; or
282 (iv) employment, tenant, or individual background screening; and
283 (b) is not used for credit granting purposes.
284 Section 8. Section 13-45-504 is enacted to read:
285 13-45-504. Security freeze for protected consumer.
286 (1) A consumer reporting agency shall place a security freeze for a protected consumer
287 if:
288 (a) the consumer reporting agency receives a request from the protected consumer's
289 representative for the placement of the security freeze; and
290 (b) the protected consumer's representative:
291 (i) submits the request described in Subsection (1)(a):
292 (A) to the address or other point of contact provided by the consumer reporting agency;
293 and
294 (B) in the manner specified by the consumer reporting agency;
295 (ii) submits to the consumer reporting agency:
296 (A) sufficient proof of identification of the protected consumer;
297 (B) sufficient proof of identification of the protected consumer's representative; and
298 (C) sufficient proof of authority to act on behalf of the protected consumer; and
299 (iii) if applicable, pays the consumer reporting agency a fee described in Subsection
300 13-45-506 (2).
301 (2) If a consumer reporting agency does not have a file that pertains to a protected
302 consumer when the consumer reporting agency receives a request described in Subsection (1),
303 the consumer reporting agency shall create a record for the protected consumer.
304 (3) A consumer reporting agency shall place a security freeze for a protected consumer
305 within 30 days after the day on which the consumer reporting agency receives a request
306 described in Subsection (1).

307 (4) After a consumer reporting agency places a security freeze under this section, the
308 consumer reporting agency may not release the protected consumer's credit report, any
309 information derived from the protected consumer's credit report, or any record created for the
310 protected consumer, unless the security freeze for the protected consumer is removed in
311 accordance with Section 13-45-505 .
312 (5) A security freeze that is placed in accordance with this section shall remain in effect
313 until:
314 (a) the protected consumer's representative or the consumer who is subject to a
315 protected consumer security freeze requests the consumer reporting agency remove the security
316 freeze in accordance with Subsection 13-45-505 (1); or
317 (b) the security freeze is removed in accordance with Subsection 13-45-505 (3).
318 Section 9. Section 13-45-505 is enacted to read:
319 13-45-505. Removal of security freeze for protected consumer.
320 (1) To remove a security freeze that is placed under this part, the protected consumer's
321 representative or the consumer who is subject to a protected consumer security freeze shall:
322 (a) submit a request for the removal of the security freeze to the consumer reporting
323 agency:
324 (i) at the address or other point of contact provided by the consumer reporting agency;
325 and
326 (ii) in the manner specified by the consumer reporting agency;
327 (b) provide to the consumer reporting agency:
328 (i) in the case of a request by a protected consumer's representative:
329 (A) sufficient proof of identification of the protected consumer;
330 (B) sufficient proof of identification of the protected consumer's representative; and
331 (C) sufficient proof of authority to act on behalf of the protected consumer; or
332 (ii) in the case of a request by the consumer who is subject to a protected consumer
333 security freeze:
334 (A) sufficient proof of identification of the consumer who is subject to a protected
335 consumer security freeze; and
336 (B) proof that the consumer who is subject to a protected consumer security freeze is
337 not a protected consumer; and

338 (c) if applicable, pay the consumer reporting agency a fee described in Subsection
339 13-45-506 (2).
340 (2) Within 30 days after the day on which a consumer reporting agency receives a
341 request under Subsection (1), the consumer reporting agency shall remove the security freeze.
342 (3) A consumer reporting agency may remove a security freeze for a protected
343 consumer or delete a record of a protected consumer if the security freeze was placed or the
344 record was created based on a material misrepresentation of fact by the protected consumer or
345 the protected consumer's representative.
346 Section 10. Section 13-45-506 is enacted to read:
347 13-45-506. Fees.
348 (1) Except as provided in Subsection (2), a consumer reporting agency may not charge
349 a fee for any service performed under this part.
350 (2) A consumer reporting agency may charge a reasonable fee, which does not exceed
351 $5, for each placement or removal of a security freeze under this part, unless:
352 (a) the protected consumer's representative:
353 (i) has obtained a police report that states the protected consumer is the alleged victim
354 of identity fraud; and
355 (ii) provides a copy of the report to the consumer reporting agency; or
356 (b) (i) the protected consumer is less than 16 years of age at the time the request is
357 submitted to the consumer reporting agency; and
358 (ii) the consumer reporting agency has a file that pertains to the protected consumer.
359 Section 11. Effective date.
360 This bill takes effect on January 1, 2015.




Legislative Review Note
as of 2-24-14 10:04 AM

Office of Legislative Research and General Counsel