127th General Assembly

BILL SUMMARY

· Requires a consumer reporting agency to place a security freeze on a consumer's credit report upon the consumer's request.

· Requires a consumer reporting agency to allow a consumer to temporarily lift a security freeze from the consumer's account for a specific period of time.

· Creates a list of entities to which a consumer reporting agency may release a consumer's credit report, while a security freeze is in place on that credit report.

· Establishes damages for which a consumer reporting agency is liable to a consumer when the consumer reporting agency willfully or negligently fails to comply with any requirement of the bill.

· Requires consumer reporting agencies to send a notice of Ohio consumer rights under the bill when certain disclosures are required by federal law.

· Delays for one year the bill's effective date.

CONTENT AND OPERATION

Background

The federal "Fair Credit Reporting Act" (FCRA) (82 Stat. 146 (1974), 15 U.S.C. 1681 et seq.), requires that consumer credit reporting agencies permit a consumer to place various types of fraud alerts on the consumer's credit report. Essentially, these alerts are notices placed in a consumer's credit report that warn a creditor or potential creditor of possible identity theft, and often includes the consumer's phone number for the creditor to call for verification. An additional identity theft protection available to residents of numerous states, but not required by federal law, is commonly referred to as a "security freeze." Consumer reporting agencies, in the states with security freeze laws, must honor a consumer's request to freeze the consumer's credit report, which prevents a consumer credit reporting agency from releasing the consumer's credit report to a creditor.

Security freeze requests

The bill establishes an Ohio security freeze law requiring consumer reporting agencies to honor security freeze requests from residents of Ohio. Under the bill, a consumer reporting agency must place a security freeze on a consumer's credit report, upon the consumer's request. The bill defines "security freeze" as a notice placed in a consumer's credit report, at the request of the consumer, that prohibits the consumer reporting agency from releasing the consumer's credit report or information contained in the consumer's credit report without authorization from the consumer. Any such freeze must adhere to the following procedures and conditions:

· A consumer reporting agency must place a security freeze on a consumer's credit report not later than five business days after receiving, from the consumer, a written request via certified mail, proper identification, and payment of any permitted fee (R.C. 1349.52(B)(1) and (B)(2)).

· The consumer reporting agency must confirm in writing to the consumer within ten business days thereafter that a security freeze has been placed on the consumer's credit report, must provide the consumer with a unique personal identification number or password, or similar device to be used by the consumer when providing authorization for the release of the consumer's credit report for a specific period of time (R.C. 1349.52(B)(3)), and must disclose to the consumer the process for placing and temporarily lifting a security freeze (R.C. 1349.52(B)(9)).

· A consumer may contact a consumer reporting agency and request the consumer reporting agency to temporarily lift a security freeze to allow the credit report to be accessed for a specific period of time. To be effective, the consumer's request must provide the proper identification, the unique personal identification number or password assigned by the consumer reporting agency, information regarding the time period for the release, and payment of any fee permitted (R.C. 1349.52(B)(4)).

· A consumer reporting agency must temporarily lift a freeze on a credit report not later than three business days after receiving the request from the consumer (R.C. 1349.52(B)(5)).

· A consumer reporting agency may develop procedures involving the use of telephone, fax, the Internet, or other electronic media to receive and process, in an expedited manner, a request from a consumer to temporarily lift a freeze on a credit report (R.C. 1349.52(B)(6)).

· A consumer reporting agency only may remove or temporarily lift a freeze placed on a consumer's credit report (1) upon the consumer's request, or (2) after prior notification to the consumer, if the consumer's credit report was frozen due to a material misrepresentation of fact by the consumer (R.C. 1349.52(B)(7)).

· A third party that cannot access a consumer's credit report due to a security freeze being in effect may treat an application for credit as incomplete (R.C. 1349.52(B)(8)).

· A security freeze must be maintained in place by a consumer reporting agency until the consumer requests that it be removed and provides proper identification, the unique personal identification number or password, and payment of any permitted fee (R.C. 1349.52(B)(10) and (B)(11)).

· A consumer reporting agency is prohibited from changing certain personal information in a consumer's credit report, when a security freeze is in place, without sending a written confirmation of the change to the consumer within 30 days of the change. A written confirmation is not required for various "technical" modifications (R.C. 1349.52(B)(14)).

Release of consumer credit report--exceptions

A consumer reporting agency may release a consumer credit report on which a security freeze has been placed to any of the following entities:

· A person, or an entity, subsidiary, affiliate, agent, or assignee of a person to whom the consumer has or had an existing account or financial obligation, when the report will be used for the purposes of "reviewing the account" (i.e. account maintenance, monitoring, credit line increases, and account upgrades and enhancements) or collecting the financial obligation owed (R.C. 1349.52(B)(12)(a)).

· A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted for purposes of facilitating the extension of credit or other permissible use (R.C. 1349.52(B)(12)(b)).

· A state or local agency, law enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena (R.C. 1349.52(B)(12)(c)).

· A child support agency acting pursuant to state law or Title IV-D of the Social Security Act (R.C. 1349.52(B)(12)(d)).

· The state or its agents or assigns acting to investigate fraud or acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities provided such responsibilities (R.C. 1349.52(B)(12)(e)).

· Any person or entity who is using the information for the purpose of prescreening the consumer for credit or insurance transactions that are not initiated by the consumer pursuant to the Fair Credit Reporting Act (note: Federal law permits a consumer reporting agency to provide credit reports for this purpose and would preempt any state law to the contrary, 15 U.S.C. 1681b(c) and 1681t(b)(1)(a)). (R.C. 1349.52(B)(12)(f).)

· Any person or entity administering a credit file monitoring subscription or similar service to which the consumer has subscribed (R.C. 1349.52(B)(12)(g)).

· Any person or entity for the purpose of providing a consumer with a copy of the consumer's credit report or score upon the consumer's request (R.C. 1349.52(B)(12)(h)).

· Any person using the information in connection with the underwriting of insurance (R.C. 1349.52(B)(12)(i)).

Permissible fees

Under the bill, consumer reporting agencies may charge a consumer a fee of not more than $10 to place, temporarily lift, or remove a security freeze, except that a consumer reporting agency may not charge a fee to a victim of identity theft who has submitted a valid police report (R.C. 1349.52(B)(13)).

Entities not required to honor a security freeze request

Under the bill, the security freeze law does not apply to consumer reporting agencies acting in certain capacities, and certain other entities, as follows (R.C. 1349.52(B)(15)):

· A consumer reporting agency acting only as a reseller of credit information.

· A check services or fraud prevention services company that issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments.

· A deposit account information service company that issues certain reports to banks or other financial institutions for use in reviewing a consumer request for a deposit account.

· A consumer reporting agency acting as a provider of information concerning criminal record information, fraud prevention or detection, personal loss history information, and employment tenant, or background screening.

Damages

The bill establishes that a consumer reporting agency that fails to comply with the security freeze law is liable to the consumer as follows:

· For a negligent failure to comply: actual damages sustained plus the cost of the action and reasonable attorney fees as determined by the court (R.C. 1349.52(B)(19)).

· For a willful failure to comply: actual damages sustained of not less than $100 and not more than $1,000 plus an amount of punitive damages as the court may allow, and the cost of the action and reasonable attorney fees as determined by the court (R.C. 1349.52(B)(17)).

Any person who obtains a consumer report, requests a security freeze, requests the temporary lift of a freeze, or requests the removal of a security freeze from a consumer reporting agency under false pretenses or in an attempt to violate federal or state law is liable to the consumer reporting agency for actual damages sustained by the consumer reporting agency or $1,000 whichever is greater (R.C. 1349.52(B)(18)).

Upon a finding by the court that an unsuccessful pleading, motion, or other paper filed in connection with an action was filed in bad faith or for purposes of harassment, the bill instructs the court to award, to the prevailing party, attorney fees reasonable in relation to the work expended in responding to pleading, motion, or other paper (R.C. 1349.52(B)(20)).

Ohio consumer notice

Under the federal "Fair Credit Reporting Act" 15 U.S.C. 1681g(c), a consumer reporting agency must provide to the consumer with each written disclosure, a summary of rights that the consumer has under the federal law. The bill requires that a consumer reporting agency, whenever a consumer is required to receive a summary of rights under the federal act, to also provide a notice of the Ohio consumer's rights under the Ohio security freeze law. The bill includes the specific language of the required notice covering such matters as the procedure to impose or lift a security freeze, the consequences to the consumer of utilizing a freeze, the maximum charge for a freeze, and the consumer's legal recourse for injury caused by an improper release of a consumer credit report (R.C. 1349.52(B)(16)).

Definitions

The bill also defines the following terms in connection with its provisions (R.C. 1349.52(A)):

"Consumer" means an individual who is also a resident of this state.

"Consumer reporting agency" and "consumer report" have the same meaning as in the federal "Fair Credit Reporting Act," (1970), 84 Stat. 1128, 15 U.S.C. 1681a, as amended.

"Proper identification" means information generally deemed sufficient to identify a person. Proper identification does not include information concerning the consumer's employment, personal, or family history unless the consumer is unable to reasonably identify him or herself with information generally deemed sufficient to identify a person.

Delayed effective date

The bill delays the effective date of its provisions to one year after the Governor files the bill with the Secretary of State.

HISTORY

ACTION	DATE

Introduced	02-20-07

H0046-I-127.doc/jc