130th Ohio General Assembly
The online versions of legislation provided on this website are not official. Enrolled bills are the final version passed by the Ohio General Assembly and presented to the Governor for signature. The official version of acts signed by the Governor are available from the Secretary of State's Office in the Continental Plaza, 180 East Broad St., Columbus.

Sub. H. B. No. 46  As Reported by the House Financial Institutions, Real Estate and Securities Committee
As Reported by the House Financial Institutions, Real Estate and Securities Committee

127th General Assembly
Regular Session
2007-2008
Sub. H. B. No. 46


Representatives Stewart, J., DeGeeter 

Cosponsors: Representatives Stewart, D., Daniels, Patton, Budish, Williams, S., Koziura, Sayre, Hite, Gibbs 



A BILL
To enact section 1349.52 of the Revised Code to require a consumer reporting agency to place a security freeze on a consumer's credit report in response to a consumer's request.

BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF OHIO:
Section 1.  That section 1349.52 of the Revised Code be enacted to read as follows:
Sec. 1349.52.  (A) As used in this section:
(1) "Consumer" means an individual who is also a resident of this state.
(2) "Consumer reporting agency" means any person who, for monetary fees, or dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of maintaining consumers' credit information for the purpose of furnishing credit reports to third parties.
(3) "Credit report" means any written, oral, or other communication of any credit information by a credit reporting agency that operates or maintains a database of consumer credit information bearing on a consumer's credit worthiness, credit standing, or credit capacity.
(4) "Proper identification" means information generally deemed sufficient to identify a person. Proper identification does not include information concerning the consumer's employment, personal, or family history unless the consumer is unable to reasonably identify himself or herself with information generally deemed sufficient to identify a person.
(5) "Security freeze" means a restriction placed in a consumer's credit report, at the request of the consumer, that prohibits the consumer reporting agency from releasing all or any part of the consumer's credit report or information derived from the consumer's credit report relating to the extension of credit without the express authorization of the consumer.
(B)(1) A consumer may request that a security freeze be placed on the consumer's credit report by sending a request in writing by certified mail to a consumer reporting agency at an address designated by the consumer reporting agency to receive such requests. Nothing in this section prohibits a consumer reporting agency from advising a third party that a security freeze is in effect with respect to the consumer's credit report.
(2) A consumer reporting agency shall place a security freeze on a consumer's credit report not later than five business days after receiving from the consumer:
(a) A written request pursuant to division (B)(1) of this section;
(b) Proper identification;
(c) Payment of any fee permitted by this section.
(3) The consumer reporting agency shall send a written confirmation of the placement of the security freeze to the consumer within ten business days. Upon placing the security freeze on the consumer's credit report, the consumer reporting agency shall provide the consumer with a unique personal identification number or password, or similar device to be used by the consumer when providing authorization for the release of his or her credit report for a specific period of time.
(4) A consumer may allow the consumer's credit report, on which a security freeze has been placed, to be accessed for a specific period of time while a security freeze is in place by contacting the consumer reporting agency, using a point of contact designated by the consumer reporting agency, requesting that the security freeze be temporarily lifted, and providing the following:
(a) Proper identification;
(b) The unique personal identification number or password provided by the consumer reporting agency pursuant to division (B)(3) of this section;
(c) The proper information regarding the time period for which the report shall be available to users of the credit report;
(d) Payment of any fee permitted by this section.
(5) A consumer reporting agency that receives a request from a consumer to temporarily lift a security freeze on a credit report pursuant to division (B)(4) of this section, shall comply with the request not later than three business days after receiving the request, unless the request is submitted electronically pursuant to division (B)(6) of this section after January 31, 2009, in which case the consumer reporting agency shall comply with the request within fifteen minutes of receipt.
(6) A consumer reporting agency shall choose and develop a contact method to receive and process a consumer's request to temporarily remove a security freeze from a consumer's credit report within fifteen minutes of receipt. The contact method chosen by the consumer reporting agency may include the use of fax, internet, other electronic means, or telephone and shall be made available to consumers not later than January 31, 2009, after which a consumer reporting agency shall comply with any such request, that is received by a consumer reporting agency between 6:00 a.m. and 9:30 p.m. eastern time, within fifteen minutes unless any of the following applies:
(a) The consumer fails to meet the requirements of division (B)(4) of this section.
(b) The consumer reporting agency's ability to temporarily lift the security freeze within fifteen minutes is prevented by an act of God, including fire, earthquakes, hurricanes, storms, or similar natural disaster or phenomena; unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrence; operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruption; governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar directives; regularly scheduled maintenance, during other than normal business hours of, or updates to, the consumer reporting agency's systems; or commercially reasonable maintenance of, or repair to, the consumer reporting agency's systems that is unexpected or unscheduled.
(7) A consumer reporting agency shall remove or temporarily lift a freeze placed on a consumer's credit report only in the following cases:
(a) Upon a consumer request pursuant to this section;
(b) When the consumer's credit report was frozen due to a material misrepresentation of fact by the consumer. A consumer reporting agency shall notify the consumer in writing prior to removing a freeze on the consumer's credit report pursuant to division (B)(7)(b) of this section.
(8) If a third party requests access to a consumer credit report on which a security freeze is in effect, and this request is in connection with an application for credit or any other use, and the consumer does not allow his or her credit report to be accessed for that period of time, the third party may treat the application as incomplete.
(9) If a consumer requests a security freeze, the consumer reporting agency shall disclose to the consumer the process of placing and temporarily lifting a freeze, and the process for allowing access to information from the consumer's credit report for a period of time while the freeze is in place.
(10)(a) A security freeze shall remain in place until the consumer requests, using a point of contact designated by the consumer reporting agency, that the security freeze be removed, and provides the following:
(i) Proper identification;
(ii) The unique personal identification number or password provided by the consumer reporting agency pursuant to division (B)(3) of this section;
(iii) Payment of any fee permitted by this section.
(b) A consumer reporting agency that receives a request from a consumer to remove the security freeze on the consumer's credit report pursuant to division (B)(10)(a) of this section, shall comply with the request not later than three business days after receiving the request.
(11) A consumer reporting agency shall require proper identification from a consumer making a request to place, temporarily release, or remove a security freeze from a consumer's credit report.
(12) A consumer reporting agency may release a consumer credit report on which a security freeze has been placed to any of the following:
(a) A person or entity, or a subsidiary, affiliate, or agent of that person or entity, or an assignee of a financial obligation owing by the consumer to that person or entity, or a prospective assignee of a financial obligation owing by the consumer to that person or entity in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment an account or contract, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument. For purposes of division (B)(12)(a) of this section, "reviewing the account" includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.
(b) A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted for purposes of facilitating the extension of credit or other permissible use;
(c) Any state or local agency, law enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena;
(d) A child support agency acting pursuant to state law or Title IV-D of the "Social Security Act," 42 U.S.C. 651 et seq.;
(e) The state or its agents or assigns acting to investigate fraud or acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities provided such responsibilities are consistent with section 1681b of the "Fair Credit Reporting Act," (1970) 84 Stat. 1128, 15 U.S.C. 1681 et seq.;
(f) Any person or entity for the purpose of prescreening in connection with credit or insurance transactions that are not initiated by the consumer, pursuant to section 1681b(c) of the "Fair Credit Reporting Act," (1970) 84 Stat. 1128, 15 U.S.C. 1681 et seq.;
(g) Any person or entity administering a credit file monitoring subscription or similar service to which the consumer has subscribed;
(h) Any person or entity for the purpose of providing a consumer with a copy of his or her credit report or score upon the consumer's request;
(i) Any person or entity using the information for setting or adjusting a rate, adjusting a claim, or underwriting for insurance purposes.
(13) A consumer reporting agency may charge a consumer a fee of not more than ten dollars to place a security freeze on that consumer's credit report and a fee of not more than five dollars each to temporarily lift, or remove a security freeze on that consumer's credit report. Notwithstanding any charges authorized pursuant to this section, a consumer reporting agency shall not charge a fee to a victim of identity theft who has submitted a valid police report to the consumer reporting agency.
(14) If a security freeze is in place, a consumer reporting agency shall not change any of the following official information in a consumer credit report without sending a written confirmation of the change to the consumer within thirty days of the change being posted to the consumer's file: name, date of birth, social security number, and address. Written confirmation is not required for technical modifications of a consumer's official information, including name and street abbreviations, complete spellings, or transposition of numbers or letters. In the case of an address change, the written confirmation shall be sent to both the new address and to the former address.
(15) The following entities are not required to place a security freeze on a credit report:
(a) A consumer reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the data base of another consumer reporting agency or multiple consumer credit reporting agencies, and does not maintain a permanent data base of credit information from which new consumer credit reports are produced. A consumer reporting agency acting as a reseller shall honor any security freeze placed on a consumer credit report by another consumer reporting agency.
(b) A check services or fraud prevention services company, that issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments;
(c) A deposit account information service company, that issues reports regarding account closures due to fraud, substantial overdrafts, automated teller machine abuse, or similar negative information regarding a consumer, to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution;
(d) A consumer reporting agency when acting as a provider of information concerning, and used for, one or more of the following: criminal record information, fraud prevention or detection, personal loss history information, and employment, tenant, or background screening.
(16) At any time a consumer is required to receive a summary of rights required under 15 U.S.C. 1681g(a), the following notice shall be included:
"Ohio Consumers Have the Right to Obtain a Security Freeze.
You have a right to place a "security freeze" on your credit report, which will prohibit a consumer reporting agency from releasing information in your credit report without your express authorization. A security freeze must be requested in writing by certified mail. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, government services or payments, rental housing, employment, investment, license, cellular phone, utilities, digital signature, internet credit card transaction, or other services, including an extension of credit at point of sale. When you place a security freeze on your credit report, you will be provided a personal identification number or password to use if you choose to remove the freeze on your credit report or authorize the release of your credit report for a period of time after the freeze is in place. To provide that authorization you must contact the consumer reporting agency and provide all of the following:
(1) The personal identification number or password;
(2) Proper identification to verify your identity;
(3) The proper information regarding the period of time for which the report shall be available;
(4) Payment of the appropriate fee.
A consumer reporting agency must authorize the release of your credit report not later than three business days after receiving the above information. A consumer reporting agency must choose and develop a contact method to receive and process a consumer's request to temporarily remove a security freeze from a consumer's credit report within fifteen minutes of receipt. The contact method chosen by the consumer reporting agency may include the use of fax, internet, other electronic means, or telephone and must be made available to consumers not later than January 31, 2009. A security freeze does not apply to a person or entity, or its affiliates, or collection agencies acting on behalf of the person or entity, with which you have an existing account, that requests information in your credit report for the purposes of reviewing or collecting the account. Reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.
You have a right to bring civil action against anyone, including a consumer reporting agency, who improperly obtains access to a file, knowingly or willfully misuses file data, or fails to correct inaccurate file data. Unless you are a victim of identity theft with a police report to verify the crimes, a consumer reporting agency has the right to charge you up to $10 to place a freeze on your credit report, up to $5 to temporarily lift a freeze on your credit report and up to $5 to remove a freeze from your credit report."
(17) Any person who willfully fails to comply with any requirement imposed under this section with respect to any consumer is liable to that consumer for actual damages sustained by the consumer as a result of the failure for damages of not less than one hundred dollars and not more than one thousand dollars, such amount of punitive damages as the court may allow; and in the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney's fees as determined by the court.
(18) Any person who obtains a consumer report, requests a security freeze, requests the temporary lift of a freeze, or requests the removal of a security freeze from a consumer reporting agency under false pretenses or in an attempt to violate federal or state law is liable to the consumer reporting agency for actual damages sustained by the consumer reporting agency or one thousand dollars whichever is greater.
(19) Any person who is negligent in failing to comply with any requirement imposed under this section with respect to any consumer is liable for actual damages sustained by the consumer as a result of the failure and, in the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney's fees as determined by the court.
(20) Upon a finding by the court that an unsuccessful pleading, motion, or other paper filed in connection with an action under this section was filed in bad faith or for purposes of harassment, the court shall award, to the prevailing party, attorney's fees reasonable in relation to the work expended in responding to the pleading, motion, or other paper.
(21) Notwithstanding divisions (B)(17) to (20) of this section, the attorney general has exclusive authority to bring an action for any violation of division (B)(6) of this section.
Section 2. Section 1 of this act shall take effect one year after it is filed by the Governor in the office of the Secretary of State.
Please send questions and comments to the Webmaster.
© 2024 Legislative Information Systems | Disclaimer