As Introduced

127th General Assembly
Regular Session
2007-2008
H. B. No. 46


Representatives Stewart, J., DeGeeter 


A BILL
To enact section 1349.52 of the Revised Code to 1
require a consumer reporting agency to place a 2
security freeze on a consumer's credit report in 3
response to a consumer's request.4


BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF OHIO:

       Section 1.  That section 1349.52 of the Revised Code be 5
enacted to read as follows:6

       Sec. 1349.52.  (A) As used in this section:7

       (1) "Consumer" means an individual who is also a resident of 8
this state.9

       (2) "Consumer reporting agency" has the same meaning as in 10
the "Fair Credit Reporting Act," (1970) 84 Stat. 1128, 15 U.S.C. 11
1681a, as amended.12

       (3) "Consumer report" has the same meaning as in the "Fair 13
Credit Reporting Act," (1970) 84 Stat. 1128, 15 U.S.C. 1681a, as 14
amended.15

       (4) "Proper identification" means information generally 16
deemed sufficient to identify a person. Proper identification does 17
not include information concerning the consumer's employment, 18
personal, or family history unless the consumer is unable to 19
reasonably identify himself or herself with information generally 20
deemed sufficient to identify a person.21

       (5) "Security freeze" means a notice placed in a consumer's 22
credit report, at the request of the consumer, that prohibits the 23
consumer reporting agency from releasing the consumer's credit 24
report or information contained in the consumer's credit report 25
without authorization from the consumer.26

       (B)(1) A consumer may request that a security freeze be 27
placed on the consumer's credit report by sending a request in 28
writing by certified mail to a consumer reporting agency at an 29
address designated by the consumer reporting agency to receive 30
such requests. Nothing in this section prohibits a consumer 31
reporting agency from advising a third party that a security 32
freeze is in effect with respect to the consumer's credit report.33

       (2) A consumer reporting agency shall place a security freeze 34
on a consumer's credit report not later than five business days 35
after receiving from the consumer:36

       (a) A written request pursuant to division (B)(1) of this 37
section;38

       (b) Proper identification;39

       (c) Payment of any fee permitted by this section.40

       (3) The consumer reporting agency shall send a written 41
confirmation of the placement of the security freeze to the 42
consumer within ten business days. Upon placing the security 43
freeze on the consumer's credit report, the consumer reporting 44
agency shall provide the consumer with a unique personal 45
identification number or password, or similar device to be used by 46
the consumer when providing authorization for the release of his 47
or her credit report for a specific period of time.48

       (4) A consumer may allow the consumer's credit report, on 49
which a security freeze has been placed, to be accessed for a 50
specific period of time while a security freeze is in place by 51
contacting the consumer reporting agency, using a point of contact 52
designated by the consumer reporting agency, requesting that the 53
security freeze be temporarily lifted, and providing the 54
following:55

       (a) Proper identification;56

       (b) The unique personal identification number or password 57
provided by the consumer reporting agency pursuant to division 58
(B)(3) of this section;59

       (c) The proper information regarding the time period for 60
which the report shall be available to users of the credit report;61

       (d) Payment of any fee permitted by this section.62

       (5) A consumer reporting agency that receives a request from 63
a consumer to temporarily lift a freeze on a credit report 64
pursuant to division (B)(4) of this section, shall comply with the 65
request not later than three business days after receiving the 66
request.67

       (6) A consumer reporting agency may develop procedures 68
involving the use of telephone, fax, the internet, or other 69
electronic media to receive and process a request from a consumer 70
to temporarily lift a freeze on a credit report pursuant to 71
division (B)(4) of this section in an expedited manner.72

       (7) A consumer reporting agency shall remove or temporarily 73
lift a freeze placed on a consumer's credit report only in the 74
following cases:75

       (a) Upon a consumer request pursuant to this section;76

       (b) When the consumer's credit report was frozen due to a 77
material misrepresentation of fact by the consumer. A consumer 78
reporting agency shall notify the consumer in writing prior to 79
removing a freeze on the consumer's credit report pursuant to 80
division (B)(7)(b) of this section.81

       (8) If a third party requests access to a consumer credit 82
report on which a security freeze is in effect, and this request 83
is in connection with an application for credit or any other use, 84
and the consumer does not allow his or her credit report to be 85
accessed for that period of time, the third party may treat the 86
application as incomplete.87

       (9) If a consumer requests a security freeze, the consumer 88
reporting agency shall disclose to the consumer the process of 89
placing and temporarily lifting a freeze, and the process for 90
allowing access to information from the consumer's credit report 91
for a period of time while the freeze is in place.92

       (10)(a) A security freeze shall remain in place until the 93
consumer requests, using a point of contact designated by the 94
consumer reporting agency, that the security freeze be removed, 95
and provides the following:96

       (i) Proper identification;97

       (ii) The unique personal identification number or password 98
provided by the consumer reporting agency pursuant to division 99
(B)(3) of this section;100

       (iii) Payment of any fee permitted by this section.101

       (b) A consumer reporting agency that receives a request from 102
a consumer to remove the security freeze on the consumer's credit 103
report pursuant to division (B)(10)(a) of this section, shall 104
comply with the request not later than three business days after 105
receiving the request.106

       (11) A consumer reporting agency shall require proper 107
identification from a consumer making a request to place, 108
temporarily release, or remove a security freeze from a consumer's 109
credit report.110

       (12) A consumer reporting agency may release a consumer 111
credit report on which a security freeze has been placed to any of 112
the following:113

       (a) A person or entity, or a subsidiary, affiliate, or agent 114
of that person or entity, or an assignee of a financial obligation 115
owing by the consumer to that person or entity, or a prospective 116
assignee of a financial obligation owing by the consumer to that 117
person or entity in conjunction with the proposed purchase of the 118
financial obligation, with which the consumer has or had prior to 119
assignment an account or contract, including a demand deposit 120
account, or to whom the consumer issued a negotiable instrument, 121
for the purposes of reviewing the account or collecting the 122
financial obligation owing for the account, contract, or 123
negotiable instrument. For purposes of division (B)(12)(a) of this 124
section, "reviewing the account" includes activities related to 125
account maintenance, monitoring, credit line increases, and 126
account upgrades and enhancements.127

       (b) A subsidiary, affiliate, agent, assignee, or prospective 128
assignee of a person to whom access has been granted for purposes 129
of facilitating the extension of credit or other permissible use;130

       (c) Any state or local agency, law enforcement agency, trial 131
court, or private collection agency acting pursuant to a court 132
order, warrant, or subpoena;133

       (d) A child support agency acting pursuant to state law or 134
Title IV-D of the "Social Security Act," 42 U.S.C. 651 et seq.;135

       (e) The state or its agents or assigns acting to investigate 136
fraud or acting to investigate or collect delinquent taxes or 137
unpaid court orders or to fulfill any of its other statutory 138
responsibilities provided such responsibilities are consistent 139
with section 1681b of the "Fair Credit Reporting Act," (1970) 84 140
Stat. 1128, 15 U.S.C. 1681 et seq.;141

       (f) Any person or entity for the purpose of prescreening in 142
connection with credit or insurance transactions that are not 143
initiated by the consumer, pursuant to section 1681b(c) of the 144
"Fair Credit Reporting Act," (1970) 84 Stat. 1128, 15 U.S.C. 1681 145
et seq.;146

       (g) Any person or entity administering a credit file 147
monitoring subscription or similar service to which the consumer 148
has subscribed;149

       (h) Any person or entity for the purpose of providing a 150
consumer with a copy of his or her credit report or score upon the 151
consumer's request;152

       (i) Any person using the information in connection with the 153
underwriting of insurance.154

       (13) A consumer reporting agency may charge a consumer a fee 155
of not more than ten dollars each to place, temporarily lift, or 156
remove a security freeze, except that a consumer reporting agency 157
may not charge a fee to a victim of identity theft who has 158
submitted a valid police report to the consumer reporting agency.159

       (14) If a security freeze is in place, a consumer reporting 160
agency shall not change any of the following official information 161
in a consumer credit report without sending a written confirmation 162
of the change to the consumer within thirty days of the change 163
being posted to the consumer's file: name, date of birth, social 164
security number, and address. Written confirmation is not required 165
for technical modifications of a consumer's official information, 166
including name and street abbreviations, complete spellings, or 167
transposition of numbers or letters. In the case of an address 168
change, the written confirmation shall be sent to both the new 169
address and to the former address.170

       (15) The following entities are not required to place a 171
security freeze on a credit report:172

       (a) A consumer reporting agency that acts only as a reseller 173
of credit information by assembling and merging information 174
contained in the data base of another consumer reporting agency or 175
multiple consumer credit reporting agencies, and does not maintain 176
a permanent data base of credit information from which new 177
consumer credit reports are produced. A consumer reporting agency 178
acting as a reseller shall honor any security freeze placed on a 179
consumer credit report by another consumer reporting agency.180

       (b) A check services or fraud prevention services company, 181
that issues reports on incidents of fraud or authorizations for 182
the purpose of approving or processing negotiable instruments, 183
electronic funds transfers, or similar methods of payments;184

       (c) A deposit account information service company, that 185
issues reports regarding account closures due to fraud, 186
substantial overdrafts, automated teller machine abuse, or similar 187
negative information regarding a consumer, to inquiring banks or 188
other financial institutions for use only in reviewing a consumer 189
request for a deposit account at the inquiring bank or financial 190
institution;191

       (d) A consumer reporting agency that acts only as a provider 192
of information concerning, and used for, one or more of the 193
following: criminal record information, fraud prevention or 194
detection, personal loss history information, and employment, 195
tenant, or background screening.196

       (16) At any time a consumer is required to receive a summary 197
of rights required under 15 U.S.C. 1681g(a), the following notice 198
shall be included:199

       "Ohio Consumers Have the Right to Obtain a Security Freeze.200

       You have a right to place a "security freeze" on your credit 201
report, which will prohibit a consumer reporting agency from 202
releasing information in your credit report without your express 203
authorization. A security freeze must be requested in writing by 204
certified mail. The security freeze is designed to prevent credit, 205
loans, and services from being approved in your name without your 206
consent. However, you should be aware that using a security freeze 207
to take control over who gets access to the personal and financial 208
information in your credit report may delay, interfere with, or 209
prohibit the timely approval of any subsequent request or 210
application you make regarding a new loan, credit, mortgage, 211
government services or payments, rental housing, employment, 212
investment, license, cellular phone, utilities, digital signature, 213
internet credit card transaction, or other services, including an 214
extension of credit at point of sale. When you place a security 215
freeze on your credit report, you will be provided a personal 216
identification number or password to use if you choose to remove 217
the freeze on your credit report or authorize the release of your 218
credit report for a period of time after the freeze is in place. 219
To provide that authorization you must contact the consumer 220
reporting agency and provide all of the following:221

       (1) The personal identification number or password;222

       (2) Proper identification to verify your identity;223

       (3) The proper information regarding the period of time for 224
which the report shall be available;225

       (4) Payment of the appropriate fee.226

       A consumer reporting agency must authorize the release of 227
your credit report not later than three business days after 228
receiving the above information. A security freeze does not apply 229
to a person or entity, or its affiliates, or collection agencies 230
acting on behalf of the person or entity, with which you have an 231
existing account, that requests information in your credit report 232
for the purposes of reviewing or collecting the account. Reviewing 233
the account includes activities related to account maintenance, 234
monitoring, credit line increases, and account upgrades and 235
enhancements.236

       You have a right to bring civil action against anyone, 237
including a consumer reporting agency, who improperly obtains 238
access to a file, knowingly or willfully misuses file data, or 239
fails to correct inaccurate file data. Unless you are a victim of 240
identity theft with a police report to verify the crimes, a 241
consumer reporting agency has the right to charge you up to $10 to 242
place a freeze on your credit report, up to $10 to temporarily 243
lift a freeze on your credit report and up to $10 to remove a 244
freeze from your credit report."245

       (17) Any person who willfully fails to comply with any 246
requirement imposed under this section with respect to any 247
consumer is liable to that consumer for actual damages sustained 248
by the consumer as a result of the failure for damages of not less 249
than one hundred dollars and not more than one thousand dollars, 250
such amount of punitive damages as the court may allow; and in the 251
case of any successful action to enforce any liability under this 252
section, the costs of the action together with reasonable 253
attorney's fees as determined by the court.254

       (18) Any person who obtains a consumer report, requests a 255
security freeze, requests the temporary lift of a freeze, or 256
requests the removal of a security freeze from a consumer 257
reporting agency under false pretenses or in an attempt to violate 258
federal or state law is liable to the consumer reporting agency 259
for actual damages sustained by the consumer reporting agency or 260
one thousand dollars whichever is greater.261

       (19) Any person who is negligent in failing to comply with 262
any requirement imposed under this section with respect to any 263
consumer is liable for actual damages sustained by the consumer as 264
a result of the failure and, in the case of any successful action 265
to enforce any liability under this section, the costs of the 266
action together with reasonable attorney's fees as determined by 267
the court.268

       (20) Upon a finding by the court that an unsuccessful 269
pleading, motion, or other paper filed in connection with an 270
action under this section was filed in bad faith or for purposes 271
of harassment, the court shall award, to the prevailing party, 272
attorney's fees reasonable in relation to the work expended in 273
responding to the pleading, motion, or other paper.274

       Section 2. Section 1 of this act shall take effect one year 275
after it is filed by the Governor in the office of the Secretary 276
of State.277