As Reported by the House Financial Institutions, Real Estate and Securities Committee

127th General Assembly
Regular Session
2007-2008
Sub. H. B. No. 46


Representatives Stewart, J., DeGeeter 

Cosponsors: Representatives Stewart, D., Daniels, Patton, Budish, Williams, S., Koziura, Sayre, Hite, Gibbs 

A BILL
To enact section 1349.52 of the Revised Code to 1
require a consumer reporting agency to place a 2
security freeze on a consumer's credit report in 3
response to a consumer's request.4


BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF OHIO:

       Section 1.  That section 1349.52 of the Revised Code be 5
enacted to read as follows:6

       Sec. 1349.52.  (A) As used in this section:7

       (1) "Consumer" means an individual who is also a resident of 8
this state.9

       (2) "Consumer reporting agency" means any person who, for 10
monetary fees, or dues, or on a cooperative nonprofit basis, 11
regularly engages in whole or in part in the practice of 12
maintaining consumers' credit information for the purpose of 13
furnishing credit reports to third parties.14

       (3) "Credit report" means any written, oral, or other 15
communication of any credit information by a credit reporting 16
agency that operates or maintains a database of consumer credit 17
information bearing on a consumer's credit worthiness, credit 18
standing, or credit capacity.19

       (4) "Proper identification" means information generally 20
deemed sufficient to identify a person. Proper identification does 21
not include information concerning the consumer's employment, 22
personal, or family history unless the consumer is unable to 23
reasonably identify himself or herself with information generally 24
deemed sufficient to identify a person.25

       (5) "Security freeze" means a restriction placed in a 26
consumer's credit report, at the request of the consumer, that 27
prohibits the consumer reporting agency from releasing all or any 28
part of the consumer's credit report or information derived from 29
the consumer's credit report relating to the extension of credit 30
without the express authorization of the consumer.31

       (B)(1) A consumer may request that a security freeze be 32
placed on the consumer's credit report by sending a request in 33
writing by certified mail to a consumer reporting agency at an 34
address designated by the consumer reporting agency to receive 35
such requests. Nothing in this section prohibits a consumer 36
reporting agency from advising a third party that a security 37
freeze is in effect with respect to the consumer's credit report.38

       (2) A consumer reporting agency shall place a security freeze 39
on a consumer's credit report not later than five business days 40
after receiving from the consumer:41

       (a) A written request pursuant to division (B)(1) of this 42
section;43

       (b) Proper identification;44

       (c) Payment of any fee permitted by this section.45

       (3) The consumer reporting agency shall send a written 46
confirmation of the placement of the security freeze to the 47
consumer within ten business days. Upon placing the security 48
freeze on the consumer's credit report, the consumer reporting 49
agency shall provide the consumer with a unique personal 50
identification number or password, or similar device to be used by 51
the consumer when providing authorization for the release of his 52
or her credit report for a specific period of time.53

       (4) A consumer may allow the consumer's credit report, on 54
which a security freeze has been placed, to be accessed for a 55
specific period of time while a security freeze is in place by 56
contacting the consumer reporting agency, using a point of contact 57
designated by the consumer reporting agency, requesting that the 58
security freeze be temporarily lifted, and providing the 59
following:60

       (a) Proper identification;61

       (b) The unique personal identification number or password 62
provided by the consumer reporting agency pursuant to division 63
(B)(3) of this section;64

       (c) The proper information regarding the time period for 65
which the report shall be available to users of the credit report;66

       (d) Payment of any fee permitted by this section.67

       (5) A consumer reporting agency that receives a request from 68
a consumer to temporarily lift a security freeze on a credit 69
report pursuant to division (B)(4) of this section, shall comply 70
with the request not later than three business days after 71
receiving the request, unless the request is submitted 72
electronically pursuant to division (B)(6) of this section after 73
January 31, 2009, in which case the consumer reporting agency 74
shall comply with the request within fifteen minutes of receipt.75

       (6) A consumer reporting agency shall choose and develop a 76
contact method to receive and process a consumer's request to 77
temporarily remove a security freeze from a consumer's credit 78
report within fifteen minutes of receipt. The contact method 79
chosen by the consumer reporting agency may include the use of 80
fax, internet, other electronic means, or telephone and shall be 81
made available to consumers not later than January 31, 2009, after 82
which a consumer reporting agency shall comply with any such 83
request, that is received by a consumer reporting agency between 84
6:00 a.m. and 9:30 p.m. eastern time, within fifteen minutes 85
unless any of the following applies:86

        (a) The consumer fails to meet the requirements of division 87
(B)(4) of this section.88

        (b) The consumer reporting agency's ability to temporarily 89
lift the security freeze within fifteen minutes is prevented by an 90
act of God, including fire, earthquakes, hurricanes, storms, or 91
similar natural disaster or phenomena; unauthorized or illegal 92
acts by a third party, including terrorism, sabotage, riot, 93
vandalism, labor strikes or disputes disrupting operations, or 94
similar occurrence; operational interruption, including electrical 95
failure, unanticipated delay in equipment or replacement part 96
delivery, computer hardware or software failures inhibiting 97
response time, or similar disruption; governmental action, 98
including emergency orders or regulations, judicial or law 99
enforcement action, or similar directives; regularly scheduled 100
maintenance, during other than normal business hours of, or 101
updates to, the consumer reporting agency's systems; or 102
commercially reasonable maintenance of, or repair to, the consumer 103
reporting agency's systems that is unexpected or unscheduled.104

       (7) A consumer reporting agency shall remove or temporarily 105
lift a freeze placed on a consumer's credit report only in the 106
following cases:107

       (a) Upon a consumer request pursuant to this section;108

       (b) When the consumer's credit report was frozen due to a 109
material misrepresentation of fact by the consumer. A consumer 110
reporting agency shall notify the consumer in writing prior to 111
removing a freeze on the consumer's credit report pursuant to 112
division (B)(7)(b) of this section.113

       (8) If a third party requests access to a consumer credit 114
report on which a security freeze is in effect, and this request 115
is in connection with an application for credit or any other use, 116
and the consumer does not allow his or her credit report to be 117
accessed for that period of time, the third party may treat the 118
application as incomplete.119

       (9) If a consumer requests a security freeze, the consumer 120
reporting agency shall disclose to the consumer the process of 121
placing and temporarily lifting a freeze, and the process for 122
allowing access to information from the consumer's credit report 123
for a period of time while the freeze is in place.124

       (10)(a) A security freeze shall remain in place until the 125
consumer requests, using a point of contact designated by the 126
consumer reporting agency, that the security freeze be removed, 127
and provides the following:128

       (i) Proper identification;129

       (ii) The unique personal identification number or password 130
provided by the consumer reporting agency pursuant to division 131
(B)(3) of this section;132

       (iii) Payment of any fee permitted by this section.133

       (b) A consumer reporting agency that receives a request from 134
a consumer to remove the security freeze on the consumer's credit 135
report pursuant to division (B)(10)(a) of this section, shall 136
comply with the request not later than three business days after 137
receiving the request.138

       (11) A consumer reporting agency shall require proper 139
identification from a consumer making a request to place, 140
temporarily release, or remove a security freeze from a consumer's 141
credit report.142

       (12) A consumer reporting agency may release a consumer 143
credit report on which a security freeze has been placed to any of 144
the following:145

       (a) A person or entity, or a subsidiary, affiliate, or agent 146
of that person or entity, or an assignee of a financial obligation 147
owing by the consumer to that person or entity, or a prospective 148
assignee of a financial obligation owing by the consumer to that 149
person or entity in conjunction with the proposed purchase of the 150
financial obligation, with which the consumer has or had prior to 151
assignment an account or contract, including a demand deposit 152
account, or to whom the consumer issued a negotiable instrument, 153
for the purposes of reviewing the account or collecting the 154
financial obligation owing for the account, contract, or 155
negotiable instrument. For purposes of division (B)(12)(a) of this 156
section, "reviewing the account" includes activities related to 157
account maintenance, monitoring, credit line increases, and 158
account upgrades and enhancements.159

       (b) A subsidiary, affiliate, agent, assignee, or prospective 160
assignee of a person to whom access has been granted for purposes 161
of facilitating the extension of credit or other permissible use;162

       (c) Any state or local agency, law enforcement agency, trial 163
court, or private collection agency acting pursuant to a court 164
order, warrant, or subpoena;165

       (d) A child support agency acting pursuant to state law or 166
Title IV-D of the "Social Security Act," 42 U.S.C. 651 et seq.;167

       (e) The state or its agents or assigns acting to investigate 168
fraud or acting to investigate or collect delinquent taxes or 169
unpaid court orders or to fulfill any of its other statutory 170
responsibilities provided such responsibilities are consistent 171
with section 1681b of the "Fair Credit Reporting Act," (1970) 84 172
Stat. 1128, 15 U.S.C. 1681 et seq.;173

       (f) Any person or entity for the purpose of prescreening in 174
connection with credit or insurance transactions that are not 175
initiated by the consumer, pursuant to section 1681b(c) of the 176
"Fair Credit Reporting Act," (1970) 84 Stat. 1128, 15 U.S.C. 1681 177
et seq.;178

       (g) Any person or entity administering a credit file 179
monitoring subscription or similar service to which the consumer 180
has subscribed;181

       (h) Any person or entity for the purpose of providing a 182
consumer with a copy of his or her credit report or score upon the 183
consumer's request;184

       (i) Any person or entity using the information for setting or 185
adjusting a rate, adjusting a claim, or underwriting for insurance 186
purposes.187

       (13) A consumer reporting agency may charge a consumer a fee 188
of not more than ten dollars to place a security freeze on that 189
consumer's credit report and a fee of not more than five dollars 190
each to temporarily lift, or remove a security freeze on that 191
consumer's credit report. Notwithstanding any charges authorized 192
pursuant to this section, a consumer reporting agency shall not 193
charge a fee to a victim of identity theft who has submitted a 194
valid police report to the consumer reporting agency.195

       (14) If a security freeze is in place, a consumer reporting 196
agency shall not change any of the following official information 197
in a consumer credit report without sending a written confirmation 198
of the change to the consumer within thirty days of the change 199
being posted to the consumer's file: name, date of birth, social 200
security number, and address. Written confirmation is not required 201
for technical modifications of a consumer's official information, 202
including name and street abbreviations, complete spellings, or 203
transposition of numbers or letters. In the case of an address 204
change, the written confirmation shall be sent to both the new 205
address and to the former address.206

       (15) The following entities are not required to place a 207
security freeze on a credit report:208

       (a) A consumer reporting agency that acts only as a reseller 209
of credit information by assembling and merging information 210
contained in the data base of another consumer reporting agency or 211
multiple consumer credit reporting agencies, and does not maintain 212
a permanent data base of credit information from which new 213
consumer credit reports are produced. A consumer reporting agency 214
acting as a reseller shall honor any security freeze placed on a 215
consumer credit report by another consumer reporting agency.216

       (b) A check services or fraud prevention services company, 217
that issues reports on incidents of fraud or authorizations for 218
the purpose of approving or processing negotiable instruments, 219
electronic funds transfers, or similar methods of payments;220

       (c) A deposit account information service company, that 221
issues reports regarding account closures due to fraud, 222
substantial overdrafts, automated teller machine abuse, or similar 223
negative information regarding a consumer, to inquiring banks or 224
other financial institutions for use only in reviewing a consumer 225
request for a deposit account at the inquiring bank or financial 226
institution;227

       (d) A consumer reporting agency when acting as a provider of 228
information concerning, and used for, one or more of the 229
following: criminal record information, fraud prevention or 230
detection, personal loss history information, and employment, 231
tenant, or background screening.232

       (16) At any time a consumer is required to receive a summary 233
of rights required under 15 U.S.C. 1681g(a), the following notice 234
shall be included:235

       "Ohio Consumers Have the Right to Obtain a Security Freeze.236

       You have a right to place a "security freeze" on your credit 237
report, which will prohibit a consumer reporting agency from 238
releasing information in your credit report without your express 239
authorization. A security freeze must be requested in writing by 240
certified mail. The security freeze is designed to prevent credit, 241
loans, and services from being approved in your name without your 242
consent. However, you should be aware that using a security freeze 243
to take control over who gets access to the personal and financial 244
information in your credit report may delay, interfere with, or 245
prohibit the timely approval of any subsequent request or 246
application you make regarding a new loan, credit, mortgage, 247
government services or payments, rental housing, employment, 248
investment, license, cellular phone, utilities, digital signature, 249
internet credit card transaction, or other services, including an 250
extension of credit at point of sale. When you place a security 251
freeze on your credit report, you will be provided a personal 252
identification number or password to use if you choose to remove 253
the freeze on your credit report or authorize the release of your 254
credit report for a period of time after the freeze is in place. 255
To provide that authorization you must contact the consumer 256
reporting agency and provide all of the following:257

       (1) The personal identification number or password;258

       (2) Proper identification to verify your identity;259

       (3) The proper information regarding the period of time for 260
which the report shall be available;261

       (4) Payment of the appropriate fee.262

       A consumer reporting agency must authorize the release of 263
your credit report not later than three business days after 264
receiving the above information. A consumer reporting agency must 265
choose and develop a contact method to receive and process a 266
consumer's request to temporarily remove a security freeze from a 267
consumer's credit report within fifteen minutes of receipt. The 268
contact method chosen by the consumer reporting agency may include 269
the use of fax, internet, other electronic means, or telephone and 270
must be made available to consumers not later than January 31, 271
2009. A security freeze does not apply to a person or entity, or 272
its affiliates, or collection agencies acting on behalf of the 273
person or entity, with which you have an existing account, that 274
requests information in your credit report for the purposes of 275
reviewing or collecting the account. Reviewing the account 276
includes activities related to account maintenance, monitoring, 277
credit line increases, and account upgrades and enhancements.278

       You have a right to bring civil action against anyone, 279
including a consumer reporting agency, who improperly obtains 280
access to a file, knowingly or willfully misuses file data, or 281
fails to correct inaccurate file data. Unless you are a victim of 282
identity theft with a police report to verify the crimes, a 283
consumer reporting agency has the right to charge you up to $10 to 284
place a freeze on your credit report, up to $5 to temporarily lift 285
a freeze on your credit report and up to $5 to remove a freeze 286
from your credit report."287

       (17) Any person who willfully fails to comply with any 288
requirement imposed under this section with respect to any 289
consumer is liable to that consumer for actual damages sustained 290
by the consumer as a result of the failure for damages of not less 291
than one hundred dollars and not more than one thousand dollars, 292
such amount of punitive damages as the court may allow; and in the 293
case of any successful action to enforce any liability under this 294
section, the costs of the action together with reasonable 295
attorney's fees as determined by the court.296

       (18) Any person who obtains a consumer report, requests a 297
security freeze, requests the temporary lift of a freeze, or 298
requests the removal of a security freeze from a consumer 299
reporting agency under false pretenses or in an attempt to violate 300
federal or state law is liable to the consumer reporting agency 301
for actual damages sustained by the consumer reporting agency or 302
one thousand dollars whichever is greater.303

       (19) Any person who is negligent in failing to comply with 304
any requirement imposed under this section with respect to any 305
consumer is liable for actual damages sustained by the consumer as 306
a result of the failure and, in the case of any successful action 307
to enforce any liability under this section, the costs of the 308
action together with reasonable attorney's fees as determined by 309
the court.310

       (20) Upon a finding by the court that an unsuccessful 311
pleading, motion, or other paper filed in connection with an 312
action under this section was filed in bad faith or for purposes 313
of harassment, the court shall award, to the prevailing party, 314
attorney's fees reasonable in relation to the work expended in 315
responding to the pleading, motion, or other paper.316

       (21) Notwithstanding divisions (B)(17) to (20) of this 317
section, the attorney general has exclusive authority to bring an 318
action for any violation of division (B)(6) of this section.319

       Section 2. Section 1 of this act shall take effect one year 320
after it is filed by the Governor in the office of the Secretary 321
of State.322