Representative Rich Cunningham proposes the following substitute bill:


1     
CREDIT MONITORING FOR MINORS

2     
2015 GENERAL SESSION

3     
STATE OF UTAH

4     
Chief Sponsor: Aaron Osmond

5     
House Sponsor: Rich Cunningham

6     

7     LONG TITLE
8     General Description:
9          This bill modifies and enacts provisions of the Consumer Credit Protection Act relating
10     to certain minors, incapacitated adults, and protected persons.
11     Highlighted Provisions:
12          This bill:
13          ▸     defines terms;
14          ▸     upon request and in accordance with the provisions of this bill, requires a credit
15     reporting agency to place a security freeze for:
16               •     an individual who is less than 16 years of age;
17               •     an incapacitated adult; or
18               •     a protected person;
19          ▸     provides a procedure by which an individual or an individual's representative may
20     remove a security freeze;
21          ▸     allows, under certain circumstances, a credit reporting agency to charge a reasonable
22     fee for the placement or removal of a security freeze;
23          ▸     provides that the attorney general may enforce the provisions of this bill; and
24          ▸     makes technical and conforming changes.
25     Money Appropriated in this Bill:

26          None
27     Other Special Clauses:
28          This bill provides a special effective date.
29     Utah Code Sections Affected:
30     AMENDS:
31          13-45-102, as enacted by Laws of Utah 2006, Chapter 344
32          13-45-201, as enacted by Laws of Utah 2006, Chapter 344
33          13-45-202, as enacted by Laws of Utah 2006, Chapter 344
34          13-45-401, as enacted by Laws of Utah 2006, Chapter 344
35     ENACTS:
36          13-45-501, Utah Code Annotated 1953
37          13-45-502, Utah Code Annotated 1953
38          13-45-503, Utah Code Annotated 1953
39          13-45-504, Utah Code Annotated 1953
40          13-45-505, Utah Code Annotated 1953
41          13-45-506, Utah Code Annotated 1953
42     

43     Be it enacted by the Legislature of the state of Utah:
44          Section 1. Section 13-45-102 is amended to read:
45          13-45-102. Definitions.
46          As used in this chapter:
47          (1) "Consumer" means [a natural person] an individual who is not a protected
48     consumer.
49          (2) "Consumer reporting agency" means a person who, for fees, dues, or on a
50     cooperative basis, regularly engages in whole or in part in the practice of assembling or
51     evaluating information concerning a consumer's credit or other information for the purpose of
52     furnishing a credit report to another person.
53          (3) "Consumer who is subject to a protected consumer security freeze" means an
54     individual:
55          (a) for whom a credit reporting agency placed a security freeze under Section
56     13-45-503; and

57          (b) who, on the day on which a request for the removal of the security freeze is
58     submitted under Section 13-45-504, is not a protected consumer.
59          [(3)] (4) "Credit report" means a consumer report, as defined in 15 U.S.C. Sec. 1681a,
60     that is used or collected in whole or part for the purpose of serving as a factor in establishing a
61     consumer's eligibility for credit for personal, family, or household purposes.
62          (5) "File" is as defined in 15 U.S.C. Sec. 1681a.
63          (6) "Incapacitated person" means an individual who is incapacitated, as defined in
64     Section 75-1-201.
65          [(4)] (7) "Normal business hours" means Sunday through Saturday, between the hours
66     of 6:00 a.m. and 9:30 p.m., Mountain Standard or Mountain Daylight Time.
67          [(5)] (8) (a) "Personal information" means personally identifiable financial
68     information:
69          (i) provided by a consumer to another person;
70          (ii) resulting from any transaction with the consumer or any service performed for the
71     consumer; or
72          (iii) otherwise obtained by another person.
73          (b) "Personal information" does not include:
74          (i) publicly available information, as that term is defined by the regulations prescribed
75     under 15 U.S.C. Sec. 6804; or
76          (ii) any list, description, or other grouping of consumers, and publicly available
77     information pertaining to the consumers, that is derived without using any nonpublic personal
78     information.
79          (c) Notwithstanding Subsection [(5)] (8)(b), "personal information" includes any list,
80     description, or other grouping of consumers, and publicly available information pertaining to
81     the consumers, that is derived using any nonpublic personal information other than publicly
82     available information.
83          [(6)] (9) "Proper identification" has the same meaning as in 15 U.S.C. Sec.
84     1681h(a)(1), and includes:
85          (a) the consumer's full name, including first, last, and middle names and any suffix;
86          (b) any name the consumer previously used;
87          (c) the consumer's current and recent full addresses, including street address, any

88     apartment number, city, state, and ZIP code;
89          (d) the consumer's Social Security number; and
90          (e) the consumer's date of birth.
91          [(7) "Security freeze" means a prohibition, consistent with Section 13-45-201, on a
92     consumer reporting agency's furnishing of a consumer's credit report to a third party intending
93     to use the credit report to determine the consumer's eligibility for credit.]
94          (10) "Protected consumer" means an individual who, at the time a request for a security
95     freeze is made, is:
96          (a) less than 16 years of age;
97          (b) an incapacitated person; or
98          (c) a protected person.
99          (11) "Protected person" means the same as that term is defined in Section 75-5b-102.
100          (12) "Record" means a compilation of information that:
101          (a) identifies a protected consumer;
102          (b) is created by a consumer reporting agency solely for the purpose of complying with
103     this section; and
104          (c) may not be created or used to consider the protected consumer's credit worthiness,
105     credit standing, credit capacity, character, general reputation, personal characteristics, or mode
106     of living.
107          (13) "Representative" means a person who provides to a consumer reporting agency
108     sufficient proof of authority to act on behalf of a protected consumer.
109          (14) (a) "Sufficient proof of authority" means documentation that shows that a person
110     has authority to act on behalf of a protected consumer.
111          (b) "Sufficient proof of authority" includes:
112          (i) a court order;
113          (ii) a lawfully executed power of attorney; or
114          (iii) a written, notarized statement signed by the person that expressly describes the
115     person's authority to act on behalf of the protected consumer.
116          (15) (a) "Sufficient proof of identification" means information or documentation that
117     identifies a protected consumer or a representative.
118          (b) "Sufficient proof of identification" includes:

119          (i) a Social Security number or a copy of a Social Security card issued by the United
120     States Social Security Administration;
121          (ii) a certified or official copy of a birth certificate; or
122          (iii) a copy of a government issued driver license or identification card.
123          Section 2. Section 13-45-201 is amended to read:
124          13-45-201. Security freeze.
125          (1) As used in this part, "security freeze" means a prohibition, consistent with the
126     provisions of this section, on a consumer reporting agency's furnishing of a consumer's credit
127     report to a third party intending to use the credit report to determine the consumer's eligibility
128     for credit.
129          [(1)] (2) A consumer may place a security freeze on the consumer's credit report by:
130          (a) making a request to a consumer reporting agency in writing by certified mail;
131          (b) providing proper identification; and
132          (c) paying the fee required by the consumer reporting agency in accordance with
133     Section 13-45-204.
134          [(2)] (3) If a security freeze is in place, a consumer reporting agency may not release a
135     consumer's credit report, or information from the credit report, to a third party that intends to
136     use the information to determine a consumer's eligibility for credit without prior authorization
137     from the consumer.
138          [(3)] (4) (a) Notwithstanding Subsection [(2)] (3), a consumer reporting agency may
139     communicate to a third party requesting a consumer's credit report that a security freeze is in
140     effect on the consumer's credit report.
141          (b) If a third party requesting a consumer's credit report in connection with the
142     consumer's application for credit is notified of the existence of a security freeze under
143     Subsection [(3)] (4)(a), the third party may treat the consumer's application as incomplete.
144          [(4)] (5) Upon receiving a request from a consumer under Subsection [(1)] (2), the
145     consumer reporting agency shall:
146          (a) place a security freeze on the consumer's credit report within five business days
147     after receiving the consumer's request;
148          (b) send a written confirmation of the security freeze to the consumer within 10
149     business days after placing the security freeze; and

150          (c) provide the consumer with a unique personal identification number or password to
151     be used by the consumer when providing authorizations for removal or temporary removal of
152     the security freeze under Section 13-45-202.
153          [(5)] (6) A consumer reporting agency shall require proper identification of the
154     consumer requesting to place, remove, or temporarily remove a security freeze.
155          [(6)] (7) (a) A consumer reporting agency shall develop a contact method to receive
156     and process a consumer's request to place, remove, or temporarily remove a security freeze.
157          (b) A contact method under Subsection [(6)] (7)(a) shall include:
158          (i) a postal address;
159          (ii) an electronic contact method chosen by the consumer reporting agency, which may
160     include the use of fax, Internet, or other electronic means; and
161          (iii) the use of telephone in a manner that is consistent with any federal requirements
162     placed on the consumer reporting agency.
163          [(7)] (8) A security freeze placed under this section may be removed only in
164     accordance with Section 13-45-202.
165          Section 3. Section 13-45-202 is amended to read:
166          13-45-202. Removal of security freeze -- Requirements and timing.
167          (1) A consumer reporting agency may remove a security freeze from a consumer's
168     credit report only if:
169          (a) (i) the consumer reporting agency receives the consumer's request through a contact
170     method established and required in accordance with Subsection 13-45-201[(6)](7); and
171          (ii) the consumer reporting agency receives the consumer's proper identification and:
172          (A) other information sufficient to identify the consumer; or
173          (B) the consumer provides the consumer's personal identification number or password;
174     or
175          (b) the consumer makes a material misrepresentation of fact in connection with the
176     placement of the security freeze and the consumer reporting agency notifies the consumer in
177     writing before removing the security freeze.
178          (2) (a) A consumer reporting agency shall temporarily remove a security freeze upon
179     receipt of:
180          (i) the consumer's request through the contact method established by the consumer

181     reporting agency in accordance with Subsection 13-45-201[(6)](7);
182          (ii) the consumer's proper identification and:
183          (A) other information sufficient to identify the consumer; or
184          (B) personal identification number or password;
185          (iii) a specific designation of the period of time for which the security freeze is to be
186     removed; and
187          (iv) the consumer reporting agency receives the payment of any fee required under
188     Section 13-45-204.
189          (b) A consumer reporting agency shall remove a security freeze from a consumer's
190     credit report within:
191          (i) three business days after the business day on which the consumer's written request
192     to remove the security freeze is received by the consumer reporting agency at the postal address
193     chosen by the consumer reporting agency in accordance with Subsection 13-45-201[(6)](7); or
194          (ii) 15 minutes after the consumer's request is received by the consumer reporting
195     agency through the electronic contact method chosen by the consumer reporting agency in
196     accordance with Subsection 13-45-201[(6)](7), or the use of telephone, during normal business
197     hours and includes the consumer's proper identification and correct personal identification
198     number or password.
199          (3) A consumer reporting agency need not remove a security freeze within the time
200     provided in Subsection (2)(b)(ii) if:
201          (a) the consumer fails to meet the requirements of Subsection 13-45-202(1); or
202          (b) the consumer reporting agency's ability to remove the security freeze within 15
203     minutes is prevented by:
204          (i) an act of God, including fire, earthquakes, hurricanes, storms, or similar natural
205     disaster or phenomena;
206          (ii) unauthorized or illegal acts by a third party, including terrorism, sabotage, riot,
207     vandalism, labor strikes or disputes disrupting operations, or similar occurrence;
208          (iii) operational interruption, including electrical failure, unanticipated delay in
209     equipment or replacement part delivery, computer hardware or software failures inhibiting
210     response time, or similar disruption;
211          (iv) governmental action, including emergency orders or regulations, judicial or law

212     enforcement action, or similar directives;
213          (v) regularly scheduled maintenance, during other than normal business hours, of, or
214     updates to, the consumer reporting agency's systems;
215          (vi) commercially reasonable maintenance of, or repair to, the consumer reporting
216     agency's systems that is unexpected or unscheduled; or
217          (vii) receipt of a removal request outside of normal business hours.
218          Section 4. Section 13-45-401 is amended to read:
219          13-45-401. Enforcement.
220          (1) The attorney general may enforce [this chapter's provisions] the provisions of this
221     chapter.
222          (2) A person who violates [this chapter's provisions] a provision of Section 13-45-201,
223     13-45-202, 13-45-203, 13-45-204, 13-45-205, or 13-45-301 is subject to a civil fine of:
224          (a) no greater than $2,500 for a violation or series of violations concerning a specific
225     consumer; and
226          (b) no greater than $100,000 in the aggregate for related violations concerning more
227     than one consumer.
228          (3) In addition to the penalties provided in Subsection (2), the attorney general may
229     seek injunctive relief to prevent future violations of this chapter in:
230          (a) the district court located in Salt Lake City; or
231          (b) the district court for the district in which resides a consumer who is the subject of a
232     credit report on which a violation occurs.
233          Section 5. Section 13-45-501 is enacted to read:
234     
Part 5. Credit Report Protection for Minors

235          13-45-501. Title.
236          This part is known as "Credit Report Protection for Minors."
237          Section 6. Section 13-45-502 is enacted to read:
238          13-45-502. Definition.
239          As used in this part, "security freeze" means:
240          (1) if a consumer reporting agency does not have a file that pertains to a protected
241     consumer, a restriction that:
242          (a) is placed on the protected consumer's record in accordance with this part; and

243          (b) except as otherwise provided in this part, prohibits the consumer reporting agency
244     from releasing the protected consumer's record; or
245          (2) if a consumer reporting agency has a file that pertains to the protected consumer, a
246     restriction that:
247          (a) is placed on the protected consumer's credit report in accordance with this part; and
248          (b) except as otherwise provided in this part, prohibits the consumer reporting agency
249     from releasing the protected consumer's credit report or any information derived from the
250     protected consumer's credit report.
251          Section 7. Section 13-45-503 is enacted to read:
252          13-45-503. Applicability.
253          This part does not apply to the use of a protected consumer's credit report or record by:
254          (1) a person administering a credit file monitoring subscription service to which:
255          (a) the protected consumer has subscribed; or
256          (b) the protected consumer's representative has subscribed on the protected consumer's
257     behalf;
258          (2) a person who, upon request from the protected consumer or the protected
259     consumer's representative, provides the protected consumer or the protected consumer's
260     representative with a copy of the protected consumer's credit report;
261          (3) a check services or fraud prevention services company that issues:
262          (a) reports on incidents of fraud; or
263          (b) authorizations for the purpose of approving or processing negotiable instruments,
264     electronic funds transfers, or similar payment methods;
265          (4) a deposit account information service company that issues reports regarding
266     account closures due to fraud, substantial overdrafts, automated teller machine abuse, or
267     similar information regarding an individual to inquiring banks or other financial institutions for
268     use only in reviewing an individual's request for a deposit account at the inquiring bank or
269     financial institution;
270          (5) an insurance company for the purpose of conducting the insurance company's
271     ordinary business;
272          (6) a consumer reporting agency that:
273          (a) only resells credit information by assembling and merging information contained in

274     a database of another consumer reporting agency or multiple consumer reporting agencies; and
275          (b) does not maintain a permanent database of credit information from which new
276     credit reports are produced; or
277          (7) a consumer reporting agency's database or file that consists of information that:
278          (a) concerns and is used for:
279          (i) criminal record information;
280          (ii) fraud prevention or detection;
281          (iii) personal loss history information; or
282          (iv) employment, tenant, or individual background screening; and
283          (b) is not used for credit granting purposes.
284          Section 8. Section 13-45-504 is enacted to read:
285          13-45-504. Security freeze for protected consumer.
286          (1) A consumer reporting agency shall place a security freeze for a protected consumer
287     if:
288          (a) the consumer reporting agency receives a request from the protected consumer's
289     representative for the placement of the security freeze; and
290          (b) the protected consumer's representative:
291          (i) submits the request described in Subsection (1)(a):
292          (A) to the address or other point of contact provided by the consumer reporting agency;
293     and
294          (B) in the manner specified by the consumer reporting agency;
295          (ii) submits to the consumer reporting agency:
296          (A) sufficient proof of identification of the protected consumer;
297          (B) sufficient proof of identification of the protected consumer's representative; and
298          (C) sufficient proof of authority to act on behalf of the protected consumer; and
299          (iii) if applicable, pays the consumer reporting agency a fee described in Subsection
300     13-45-506(2).
301          (2) If a consumer reporting agency does not have a file that pertains to a protected
302     consumer when the consumer reporting agency receives a request described in Subsection (1),
303     the consumer reporting agency shall create a record for the protected consumer.
304          (3) A consumer reporting agency shall place a security freeze for a protected consumer

305     within 30 days after the day on which the consumer reporting agency receives a request
306     described in Subsection (1).
307          (4) After a consumer reporting agency places a security freeze under this section, the
308     consumer reporting agency may not release the protected consumer's credit report, any
309     information derived from the protected consumer's credit report, or any record created for the
310     protected consumer, unless the security freeze for the protected consumer is removed in
311     accordance with Section 13-45-505.
312          (5) A security freeze that is placed in accordance with this section shall remain in effect
313     until:
314          (a) the protected consumer's representative or the consumer who is subject to a
315     protected consumer security freeze requests the consumer reporting agency remove the security
316     freeze in accordance with Subsection 13-45-505(1); or
317          (b) the security freeze is removed in accordance with Subsection 13-45-505(3).
318          Section 9. Section 13-45-505 is enacted to read:
319          13-45-505. Removal of security freeze for protected consumer.
320          (1) To remove a security freeze that is placed under this part, the protected consumer's
321     representative or the consumer who is subject to a protected consumer security freeze shall:
322          (a) submit a request for the removal of the security freeze to the consumer reporting
323     agency:
324          (i) at the address or other point of contact provided by the consumer reporting agency;
325     and
326          (ii) in the manner specified by the consumer reporting agency;
327          (b) provide to the consumer reporting agency:
328          (i) in the case of a request by a protected consumer's representative:
329          (A) sufficient proof of identification of the protected consumer;
330          (B) sufficient proof of identification of the protected consumer's representative; and
331          (C) sufficient proof of authority to act on behalf of the protected consumer; or
332          (ii) in the case of a request by the consumer who is subject to a protected consumer
333     security freeze:
334          (A) sufficient proof of identification of the consumer who is subject to a protected
335     consumer security freeze; and

336          (B) proof that the consumer who is subject to a protected consumer security freeze is
337     not a protected consumer; and
338          (c) if applicable, pay the consumer reporting agency a fee described in Subsection
339     13-45-506(2).
340          (2) Within 30 days after the day on which a consumer reporting agency receives a
341     request under Subsection (1), the consumer reporting agency shall remove the security freeze.
342          (3) A consumer reporting agency may remove a security freeze for a protected
343     consumer or delete a record of a protected consumer if the security freeze was placed or the
344     record was created based on a material misrepresentation of fact by the protected consumer or
345     the protected consumer's representative.
346          Section 10. Section 13-45-506 is enacted to read:
347          13-45-506. Fees.
348          (1) Except as provided in Subsection (2), a consumer reporting agency may not charge
349     a fee for any service performed under this part.
350          (2) A consumer reporting agency may charge a reasonable fee, which does not exceed
351     $5, for each placement or removal of a security freeze under this part, unless:
352          (a) the protected consumer's representative:
353          (i) has obtained a police report that states the protected consumer is the alleged victim
354     of identity fraud; and
355          (ii) provides a copy of the report to the consumer reporting agency; or
356          (b) (i) the protected consumer is less than 16 years of age at the time the request is
357     submitted to the consumer reporting agency; and
358          (ii) the consumer reporting agency has a file that pertains to the protected consumer.
359          Section 11. Effective date.
360          This bill takes effect on January 1, 2016.