1     
CONSUMER REPORTING AGENCY FEES

2     
2018 GENERAL SESSION

3     
STATE OF UTAH

4     
Chief Sponsor: James A. Dunnigan

5     
Senate Sponsor: Todd Weiler

6     

7     LONG TITLE
8     General Description:
9          This bill modifies and enacts provisions of the Consumer Credit Protection Act.
10     Highlighted Provisions:
11          This bill:
12          ▸     modifies the manner in which a consumer requests a placement or removal of a
13     security freeze;
14          ▸     addresses a consumer reporting agency's duties related to placing a security freeze;
15          ▸     prohibits a consumer reporting agency from charging a fee in connection with
16     placing or removing a security freeze; and
17          ▸     prohibits a consumer reporting agency from charging a fee to download or install a
18     mobile application through which a person places or removes a security freeze.
19     Money Appropriated in this Bill:
20          None
21     Other Special Clauses:
22          None
23     Utah Code Sections Affected:
24     AMENDS:
25          13-45-201, as last amended by Laws of Utah 2015, Chapter 191
26          13-45-202, as last amended by Laws of Utah 2015, Chapter 191
27          13-45-204, as enacted by Laws of Utah 2006, Chapter 344
28     

29     Be it enacted by the Legislature of the state of Utah:
30          Section 1. Section 13-45-201 is amended to read:
31          13-45-201. Security freeze.
32          (1) As used in this part[, "security]:
33          (a) "Security freeze" means a prohibition, consistent with the provisions of this section,
34     on a consumer reporting agency's furnishing of a consumer's credit report to a third party
35     intending to use the credit report to determine the consumer's eligibility for credit.
36          (b) "Unique personal identifier" means a personal identification number, password, or
37     other secure form of identity verification accepted by a consumer reporting agency and
38     intended for use by a consumer to place, remove, or temporarily remove a security freeze in
39     accordance with this chapter.
40          [(2) A consumer may place a security freeze on the consumer's credit report by:]
41          [(a) making a request to a consumer reporting agency in writing by certified mail;]
42          [(b) providing proper identification; and]
43          [(c) paying the fee required by the consumer reporting agency in accordance with
44     Section 13-45-204.]
45          (2) (a) A consumer may request a security freeze on a consumer's credit report by:
46          (i) submitting a request for a security freeze to the consumer reporting agency by:
47          (A) certified mail to the postal address identified by the consumer reporting agency in
48     accordance with Subsection (5); or
49          (B) electronic means developed by the consumer reporting agency in accordance with
50     Subsection (5); and
51          (ii) providing proper identification to the consumer reporting agency.
52          (b) Upon receipt of a request described in Subsection (2)(a), the consumer reporting
53     agency shall:
54          (i) place a security freeze on the consumer's credit report:
55          (A) if the consumer submits the request by certified mail, as soon as practicable but no
56     later than five business days after the business day on which the consumer reporting agency
57     receives the request and the consumer's proper identification;
58          (B) if the consumer submits the request by a contact method described in Subsection
59     (5)(a)(ii) or (iii) that is not a mobile application, as soon as practicable but no later than 24
60     hours after the consumer reporting agency receives the request and the consumer's proper
61     identification; or
62          (C) if the consumer submits the request by mobile application, within 15 minutes after
63     the consumer reporting agency receives the request and the consumer's proper identification;
64          (ii) provide the consumer a unique personal identifier, unless the consumer reporting
65     agency previously provided the consumer a unique personal identifier; and
66          (iii) within five business days after the business day on which the consumer reporting
67     agency places the security freeze, provide the consumer confirmation that the consumer
68     reporting agency placed the security freeze.
69          (3) If a security freeze is in place, a consumer reporting agency may not release a
70     consumer's credit report, or information from the credit report, to a third party that intends to
71     use the information to determine a consumer's eligibility for credit without prior authorization
72     from the consumer.
73          (4) (a) Notwithstanding Subsection (3), a consumer reporting agency may
74     communicate to a third party requesting a consumer's credit report that a security freeze is in
75     effect on the consumer's credit report.
76          (b) If a third party requesting a consumer's credit report in connection with the
77     consumer's application for credit is notified of the existence of a security freeze under
78     Subsection (4)(a), the third party may treat the consumer's application as incomplete.
79          [(5) Upon receiving a request from a consumer under Subsection (2), the consumer
80     reporting agency shall:]
81          [(a) place a security freeze on the consumer's credit report within five business days
82     after receiving the consumer's request;]
83          [(b) send a written confirmation of the security freeze to the consumer within 10
84     business days after placing the security freeze; and]
85          [(c) provide the consumer with a unique personal identification number or password to
86     be used by the consumer when providing authorizations for removal or temporary removal of
87     the security freeze under Section 13-45-202.]
88          [(6) A consumer reporting agency shall require proper identification of the consumer
89     requesting to place, remove, or temporarily remove a security freeze.]
90          [(7)] (5) (a) A consumer reporting agency shall develop a contact method to receive
91     and process a consumer's request to place, remove, or temporarily remove a security freeze.
92          (b) A contact method under Subsection [(7)] (5)(a) shall include:
93          (i) a postal address;
94          (ii) an electronic contact method chosen by the consumer reporting agency, which may
95     include the use of fax, Internet, or other electronic means; and
96          (iii) the use of telephone in a manner that is consistent with any federal requirements
97     placed on the consumer reporting agency.
98          [(8)] (6) A security freeze placed under this section may be removed only in
99     accordance with Section 13-45-202.
100          (7) (a) The time requirement described in Subsection (2)(b)(i)(B) or (C), as applicable,
101     does not apply if the consumer reporting agency's ability to place the security freeze is
102     prevented by:
103          (i) an act of God, including fire, earthquakes, hurricanes, storms, or similar natural
104     disaster or phenomena;
105          (ii) unauthorized or illegal acts by a third party, including terrorism, sabotage, riot,
106     vandalism, labor strikes or disputes disrupting operations, or similar occurrence;
107          (iii) operational interruption, including electrical failure, unanticipated delay in
108     equipment or replacement part delivery, computer hardware or software failures inhibiting
109     response time, or similar disruption;
110          (iv) governmental action, including emergency orders or regulations, judicial or law
111     enforcement action, or similar directives;
112          (v) regularly scheduled maintenance, during other than normal business hours, of, or
113     updates to, the consumer reporting agency's systems; or
114          (vi) commercially reasonable maintenance of, or repair to, the consumer reporting
115     agency's systems that is unexpected or unscheduled.
116          (b) In the event of a circumstance described in Subsection (7)(a), the consumer
117     reporting agency shall place the security freeze as soon as practicable.
118          Section 2. Section 13-45-202 is amended to read:
119          13-45-202. Removal of security freeze -- Requirements and timing.
120          (1) A consumer reporting agency [may] shall remove a security freeze from a
121     consumer's credit report only if:
122          (a) (i) the consumer reporting agency receives the consumer's request through [a] the
123     contact method established and required in accordance with Subsection 13-45-201[(7)](5); and
124          (ii) the consumer reporting agency receives the consumer's proper identification [and:]
125     or unique personal identifier; or
126          [(A) other information sufficient to identify the consumer; or]
127          [(B) the consumer provides the consumer's personal identification number or
128     password; or]
129          (b) the consumer makes a material misrepresentation of fact in connection with the
130     placement of the security freeze and the consumer reporting agency notifies the consumer in
131     writing before removing the security freeze.
132          (2) [(a)] A consumer reporting agency shall temporarily remove a security freeze upon
133     receipt of:
134          [(i)] (a) the consumer's request through the contact method established by the consumer
135     reporting agency in accordance with Subsection 13-45-201[(7)](5);
136          [(ii)] (b) the consumer's proper identification [and:] or unique personal identifier; and
137          [(A) other information sufficient to identify the consumer; or]
138          [(B) personal identification number or password;]
139          [(iii)] (c) a specific designation of the period of time for which the security freeze is to
140     be removed[; and].
141          [(iv) the consumer reporting agency receives the payment of any fee required under
142     Section 13-45-204.]
143          [(b)] (3) A consumer reporting agency shall remove or temporarily remove a security
144     freeze from a consumer's credit report within:
145          [(i)] (a) three business days after the business day on which the consumer's written
146     request to remove the security freeze is received by the consumer reporting agency at the postal
147     address chosen by the consumer reporting agency in accordance with Subsection
148     13-45-201[(7)](5)(b)(i); or
149          [(ii)] (b) 15 minutes after the consumer's request is received by the consumer reporting
150     agency through [the electronic] a contact method [chosen by the consumer reporting agency in
151     accordance with] described in Subsection 13-45-201[(7), or the use of telephone, during
152     normal business hours](5)(b)(ii) or (iii), and includes the consumer's [proper identification and
153     correct personal identification number or password] unique personal identifier.
154          [(3) A consumer reporting agency need not remove a security freeze within the time
155     provided in Subsection (2)(b)(ii) if:]
156          [(a) the consumer fails to meet the requirements of Subsection 13-45-202(1); or]
157          [(b) the consumer reporting agency's ability to remove the security freeze within 15
158     minutes is prevented by:]
159          (4) (a) The time requirement described in Subsection (3)(b) does not apply if the
160     consumer reporting agency's ability to remove the security freeze is prevented by:
161          (i) an act of God, including fire, earthquakes, hurricanes, storms, or similar natural
162     disaster or phenomena;
163          (ii) unauthorized or illegal acts by a third party, including terrorism, sabotage, riot,
164     vandalism, labor strikes or disputes disrupting operations, or similar occurrence;
165          (iii) operational interruption, including electrical failure, unanticipated delay in
166     equipment or replacement part delivery, computer hardware or software failures inhibiting
167     response time, or similar disruption;
168          (iv) governmental action, including emergency orders or regulations, judicial or law
169     enforcement action, or similar directives;
170          (v) regularly scheduled maintenance, during other than normal business hours, of, or
171     updates to, the consumer reporting agency's systems; or
172          (vi) commercially reasonable maintenance of, or repair to, the consumer reporting
173     agency's systems that is unexpected or unscheduled[; or].
174          (b) In the event of a circumstance described in Subsection (4)(a), the consumer
175     reporting agency shall remove the security freeze as soon as practicable.
176          [(vii) receipt of a removal request outside of normal business hours.]
177          Section 3. Section 13-45-204 is amended to read:
178          13-45-204. Fees for security freeze.
179          [(1) Except as provided in Subsection (2), a consumer reporting agency may charge a
180     reasonable fee to a consumer for placing and temporarily removing a security freeze.]
181          [(2)] (1) A consumer reporting agency may not charge a fee for placing, removing, or
182     temporarily removing a security freeze [if:].
183          [(a) the consumer is a victim of identity fraud under Section 76-6-1102; and]
184          [(b) the consumer provides the consumer reporting agency with a valid copy of a police
185     report or police case number documenting the identity fraud.]
186          (2) A consumer reporting agency may not charge a fee to download or install a mobile
187     application through which a person places or removes a security freeze.