127th General Assembly
(As Passed by the House)
Reps. J. Stewart and DeGeeter, Budish, Daniels, Gibbs, Hite, Koziura, Patton, Sayre, D. Stewart, S. Williams, Koziura, Sayre, Hite, Gibbs, Aslanides, Batchelder, Bolon, Book, Boyd, Brown, Bubp, Celeste, Chandler, Combs, DeBose, Distel, Domenick, Dyer, Evans, Flowers, Foley, Garrison, Goyal, R. Hagan, Harwood, Healy, Heard, Hughes, Latta, Letson, Luckie, Mallory, Miller, Oelslager, Okey, Otterman, Peterson, Strahorn, Sykes, Szollosi, Uecker, White, B. Williams, Yates
BILL SUMMARY
· Requires a consumer reporting agency to place a security freeze on a consumer's credit report upon the consumer's request.
· Requires a consumer reporting agency to allow a consumer to temporarily lift a security freeze from the consumer's account for a specific period of time.
· In addition to the more deliberate method available under the bill to temporarily remove a security freeze, requires consumer reporting agencies to choose and develop, by January 31, 2009, a method for receiving security freeze release requests electronically and responding to those requests within 15 minutes.
· Creates a list of entities to which a consumer reporting agency may release a consumer's credit report, while a security freeze is in place on that credit report.
· Establishes damages for which a consumer reporting agency is liable to a consumer when the consumer reporting agency willfully or negligently fails to comply with any requirement of the bill.
· Requires consumer reporting agencies to send a notice of Ohio consumer rights under the bill when certain disclosures are required by federal law.
· Delays for one year the bill's effective date.
CONTENT AND OPERATION
The bill establishes an Ohio security freeze law requiring consumer reporting agencies to honor security freeze requests from residents of Ohio. Under the bill, a consumer reporting agency must place a security freeze on a consumer's credit report, upon the consumer's request. The bill defines "security freeze" as a restriction placed in a consumer's credit report, at the request of the consumer, that prohibits the consumer reporting agency from releasing all or any part of the consumer's credit report or information derived from the consumer's credit report relating to the extension of credit without express authorization from the consumer. Any such freeze must adhere to the following procedures and conditions:
· A consumer reporting agency must place a security freeze on a consumer's credit report not later than five business days after receiving, from the consumer, a written request via certified mail, proper identification, and payment of any permitted fee (R.C. 1349.52(B)(1) and (B)(2)).
· The consumer reporting agency must send a written confirmation to the consumer within ten business days that a security freeze has been placed on the consumer's credit report, must provide the consumer with a unique personal identification number or password, or similar device to be used by the consumer when providing authorization for the release of the consumer's credit report for a specific period of time (R.C. 1349.52(B)(3)), and must disclose to the consumer the process for placing and temporarily lifting a security freeze and the process for allowing access to information from the consumer's credit report for a period of time while the freeze is in place (R.C. 1349.52(B)(9)).
· A consumer may allow the consumer's credit report, on which a security freeze has been placed, to be accessed for a specific period of time while a security freeze is in place by contacting the consumer reporting agency, using a point of contact designated by the consumer reporting agency, requesting that the security freeze be temporarily lifted, and providing the proper identification, the unique personal identification number or password provided by the consumer reporting agency, information regarding the time period for which the report must be available to users of the credit report, and payment of any permitted fee (R.C. 1349.52(B)(4)).
· A consumer reporting agency must temporarily lift a freeze on a credit report not later than three business days after receiving the request from the consumer (R.C. 1349.52(B)(5)), unless the request is submitted electronically after January 31, 2009, in which case the freeze must be lifted within 15 minutes of receipt (see "Expedited security freeze release request" below).
· A consumer reporting agency must remove or temporarily lift a freeze placed on a consumer's credit report only (1) upon the consumer's request, or (2) after prior written notification to the consumer, if the consumer's credit report was frozen due to a material misrepresentation of fact by the consumer (R.C. 1349.52(B)(7)).
· If a third party requests access to a consumer's credit report on which a security freeze is in effect and this request is in connection with an application for credit or any other use, and the consumer does not allow his or her credit report to be accessed for that period of time, the third party may treat the application as incomplete (R.C. 1349.52(B)(8)).
· A security freeze must remain in place until the consumer requests, using a point of contact designated by the consumer reporting agency, that the security freeze be removed and provides (1) proper identification, (2) the unique personal identification number or password provided by the consumer reporting agency, and (3) payment of any permitted fee. A consumer reporting agency that receives a request from a consumer to remove the security freeze on the consumer's credit report must comply with the request not later than three business days after receiving the request. (R.C. 1349.52(B)(10).)
· A consumer reporting agency must require proper identification from a consumer making a request to place, temporarily release, or remove a security freeze from a consumer's credit report.
· A consumer reporting agency is prohibited from changing certain personal information in a consumer's credit report, when a security freeze is in place, without sending a written confirmation of the change to the consumer within 30 days of the change. A written confirmation is not required for various "technical" modifications. In the case of an address change, the written confirmation must be sent to both the new address and to the former address. (R.C. 1349.52(B)(14).)
A consumer reporting agency is required to choose and develop a method to receive and process a consumer's request to temporarily remove a security freeze from the consumer's credit report within 15 minutes after receiving the request. The contact method chosen by the consumer reporting agency may include the use of fax, internet, or other electronic means, or telephone and must be made available by January 31, 2009, after which a consumer reporting agency must comply with any such request that is made between 6 a.m. and 9:30 p.m. eastern time within 15 minutes of receipt of the request. A consumer reporting agency is not required to lift a security freeze within 15 minutes unless any of the following applies: (1) the consumer fails to meet the requirements under R.C. 1349.52(B)(4), described above, or (2) the consumer reporting agency's ability to temporarily lift the security freeze within 15 minutes is prevented by an act of God, including fire, earthquakes, hurricanes, storms, or similar natural disaster or phenomena; unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrence; operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruption; governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar directives; regularly scheduled maintenance, during other than normal business hours of, or updates to, the consumer reporting agency's systems; or commercially reasonable maintenance of, or repair to, the consumer reporting agency's systems that is unexpected or unscheduled (R.C. 1349.52(B)(6)).
A consumer reporting agency may release a consumer credit report on which a security freeze has been placed to any of the following entities:
· A person or entity, or a subsidiary, affiliate, or agent of that person or entity, or an assignee of a financial obligation owing by the consumer to that person or entity, or a prospective assignee of a financial obligation owing by the consumer to that person or entity in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment an account or contract, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of "reviewing the account" (i.e. account maintenance, monitoring, credit line increases, and account upgrades and enhancements) or collecting the financial obligation owing for the account, contract, or negotiable instrument (R.C. 1349.52(B)(12)(a)).
· A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted for purposes of facilitating the extension of credit or other permissible use (R.C. 1349.52(B)(12)(b)).
· A state or local agency, law enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena (R.C. 1349.52(B)(12)(c)).
· A child support agency acting pursuant to state law or Title IV-D of the Social Security Act (R.C. 1349.52(B)(12)(d)).
· The state or its agents or assigns acting to investigate fraud or acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities provided such responsibilities are consistent with section 1681b of the Fair Credit Reporting Act (R.C. 1349.52(B)(12)(e)).
· Any person or entity who is using the information for the purpose of prescreening the consumer for credit or insurance transactions that are not initiated by the consumer pursuant to the Fair Credit Reporting Act (note: Federal law permits a consumer reporting agency to provide credit reports for this purpose and would preempt any state law to the contrary, 15 U.S.C. 1681b(c) and 1681t(b)(1)(a)). (R.C. 1349.52(B)(12)(f).)
· Any person or entity administering a credit file monitoring subscription or similar service to which the consumer has subscribed (R.C. 1349.52(B)(12)(g)).
· Any person or entity for the purpose of providing a consumer with a copy of the consumer's credit report or score upon the consumer's request (R.C. 1349.52(B)(12)(h)).
· Any person or entity using the information for setting or adjusting a rate, adjusting a claim, or underwriting for insurance purposes (R.C. 1349.52(B)(12)(i)).
Under the bill, consumer reporting agencies may charge a consumer a fee of not more than $10 to place a security freeze on that consumer's credit report and a fee of not more than $5 each to temporarily lift, or remove a security freeze from that consumer's credit report, except that a consumer reporting agency may not charge a fee to a victim of identity theft who has submitted a valid police report to the consumer reporting agency (R.C. 1349.52(B)(13)).
Under the bill, the security freeze law does not apply to consumer reporting agencies acting in certain capacities, and certain other entities, as follows (R.C. 1349.52(B)(15)):
· A consumer reporting agency acting only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or multiple consumer credit reporting agencies, and does not maintain a permanent database of credit information from which new consumer credit reports are produced. A consumer reporting agency acting as a reseller must honor any security freeze placed on a consumer credit report by another consumer reporting agency.
· A check services or fraud prevention services company that issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments.
· A deposit account information service company that issues certain reports to banks or other financial institutions for use in reviewing a consumer request for a deposit account.
· A consumer reporting agency when acting as a provider of information concerning, and used for, criminal record information, fraud prevention or detection, personal loss history information, and employment tenant, or background screening.
The bill establishes that a consumer reporting agency that fails to comply with the security freeze law is liable to the consumer as follows:
· For a negligent failure to comply: actual damages sustained by the consumer as a result of the failure plus the cost of the action and reasonable attorney's fees as determined by the court (R.C. 1349.52(B)(19)).
· For a willful failure to comply: actual damages sustained by the consumer of not less than $100 and not more than $1,000 plus an amount of punitive damages as the court may allow, and the cost of the action and reasonable attorney's fees as determined by the court (R.C. 1349.52(B)(17)).
Any person who obtains a consumer report, requests a security freeze, requests the temporary lift of a freeze, or requests the removal of a security freeze from a consumer reporting agency under false pretenses or in an attempt to violate federal or state law is liable to the consumer reporting agency for actual damages sustained by the consumer reporting agency or $1,000 whichever is greater (R.C. 1349.52(B)(18)).
Upon a finding by the court that an unsuccessful pleading, motion, or other paper filed in connection with an action was filed in bad faith or for purposes of harassment, the bill requires the court to award to the prevailing party attorney's fees reasonable in relation to the work expended in responding to pleading, motion, or other paper (R.C. 1349.52(B)(20)).
Notwithstanding the authority provided by the bill for consumers to bring an action to seek damages from a consumer reporting agency as described above, the bill stipulates that the Attorney General has exclusive authority to bring an action against a consumer reporting agency that fails to comply with the expedited electronic request to release a security freeze from a consumer's report within 15 minutes of the request (R.C. 1349.52(B)(21)).
Under the federal "Fair Credit Reporting Act" 15 U.S.C. 1681g(c), a consumer reporting agency must provide to the consumer with each written disclosure, a summary of rights that the consumer has under the federal law. The bill requires that a consumer reporting agency, whenever a consumer is required to receive a summary of rights under the federal act, to also provide a notice of the Ohio consumer's rights under the Ohio security freeze law. The bill includes the specific language of the required notice covering such matters as the procedure to impose or lift a security freeze, the consequences to the consumer of utilizing a freeze, the maximum charge for a freeze, and the consumer's legal recourse for injury caused by an improper release of a consumer credit report (R.C. 1349.52(B)(16)).
The bill also defines the following terms in connection with its provisions (R.C. 1349.52(A)):
"Consumer" means an individual who is also a resident of this state.
"Consumer reporting agency" means any person who, for monetary fees, or dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of maintaining consumers' credit information for the purpose of furnishing credit reports to third parties.
"Credit report" means any written, oral, or other communication of any credit information by a credit reporting agency that operates or maintains a database of consumer credit information bearing on a consumer's credit worthiness, credit standing, or credit capacity.
"Proper identification" means information generally deemed sufficient to identify a person. Proper identification does not include information concerning the consumer's employment, personal, or family history unless the consumer is unable to reasonably identify him or herself with information generally deemed sufficient to identify a person.
The bill delays the effective date of its provisions to one year after the Governor files the bill with the Secretary of State.
HISTORY
|
ACTION |
DATE |
|
|
|
|
Introduced |
02-20-07 |
|
Reported,
H. Financial Institutions, Real |
|
|
Passed House (94-4) |
05-22-07 |
h0046-ph-127.doc/kl