0075: FIRST ANALYSIS (4-11-07) - CREDIT REPORT FREEZE

CREDIT REPORT FREEZE S.B. 75 (S-1) & 340 (S-2): FIRST ANALYSIS

[Please see the PDF version of this analysis, if available, to view this image.]

Senate Bill 75 (Substitute S-1 as reported)
Senate Bill 340 (Substitute S-2 as reported)
Sponsor: Senator Gilda Z. Jacobs (S.B. 75) Senator Cameron S. Brown (S.B. 340)
Committee: Banking and Financial Institutions

Date Completed: 4-11-07

RATIONALE

According to the Federal Trade Commission, 255,565 Americans were victims of identity theft in 2005. Of the 7,139 victims in Michigan, 27% experienced credit card fraud, 28% experienced phone or utilities fraud, and 16% experienced bank fraud. Evidently, identity thieves can use a person's creditworthiness to obtain credit cards, take out loans, buy a car, and more with as little personal information as a person's Social Security number, name, and date of birth. Correcting the damage resulting from having one's identity stolen has cost the State and citizens a significant amount of time and money.

In order to protect consumers and the State from identity theft, some have suggested that a consumer should be able to place and lift a freeze on his or her credit report at will using a personal ID number or password.

CONTENT

Senate Bill 340 (S-2) would create the "Consumer Credit Protection Act" to do the following:

-- Allow a consumer to place a security freeze on his or her credit report by making a request to a consumer reporting agency.
-- Prohibit a consumer reporting agency from releasing information from a credit report to a third party if a freeze were in place, without the consumer's authorization.
-- Require an agency that received a request for a security freeze to give the consumer confirmation of the freeze and a unique personal identification number or password.
-- Allow a consumer reporting agency to remove or temporarily lift a security freeze only under specific circumstances.
-- Permit a consumer to allow access to his or her credit report for a specific period of time while a freeze was in place.
-- Allow a consumer reporting agency to charge a fee of up to $10 per request for placing a security freeze, extending a security freeze (under certain circumstances), or issuing a replacement personal ID number, subject to exceptions for victims of identity theft and individuals at least 65 years old.
-- Establish deadlines for a consumer reporting agency to comply with the proposed requirements.
-- Specify entities that would not be required to place a security freeze on a credit report.
-- Provide that the Act would not apply to the use of a credit report by certain entities.
Senate Bill 75 (S-1) would create the "Consumer Credit Protection Remedies Act" to authorize a consumer, a consumer reporting agency, and the Attorney General to bring an action against a person who violated the proposed Consumer Credit Protection Act.

The bills are tie-barred and would take effect on January 1, 2008.

Senate Bill 340 (S-2)
Definitions

"Security freeze" would mean a notice placed on a consumer report at the request of the consumer that prohibits a consumer reporting agency from releasing the consumer's credit report or credit score related to the extension of credit without the express authorization of the consumer except in compliance with the proposed Consumer Credit Protection Act.

"Consumer" would mean an individual who resides in this State. "Credit report" would mean a consumer report, as defined in the Federal Fair Credit Reporting Act (15 USC 1681a), that is used or collected in whole or part for the purpose of serving as a factor in establishing a consumer's eligibility for credit for personal, family, or household purposes.

"Consumer reporting agency" would mean that term as defined in the Fair Credit Reporting Act (15 USC 1681a(f)). The term would not include a check acceptance service that provides check approval and guarantee services to merchants.

(The Federal definitions are described below under Federal Act.)

Placement of a Security Freeze

A consumer could place a security freeze on his or her credit report by making a written request to a consumer reporting agency. The request would have to be sent by certified mail to an address designated by that agency to receive such requests. It would have to include clear and proper identification of the consumer (information generally deemed sufficient to identify an individual). The consumer reporting agency would have to place a security freeze on the consumer report within 10 business days after receiving the written request.

If a security freeze were in place, a consumer reporting agency could not release information from a consumer report to a third party without prior express authorization from the consumer. This provision would not prevent a consumer reporting agency from advising a third party that a security freeze was in effect with respect to the consumer report.

Within 10 business days after a consumer reporting agency received a request for a security freeze, the agency would have to give the consumer a unique personal identification number or password that the consumer could use to authorize the release of his or her consumer report for a specific period of time. Simultaneously, the agency would have to give the consumer in writing the process for placing, removing, and temporarily lifting a security freeze and the process for allowing access to information from the consumer report while the freeze was in effect.

A consumer who had forgotten or could not locate his or her personal ID number or password could make a written request for a replacement number or password. The request would have to comply with the requirements for requesting a security freeze. Within 10 business days after a consumer reporting agency received a request for a replacement, the agency would have to provide the consumer with a new, unique personal ID number or password.

A consumer also could make a written request for a specific personal ID number or password. The request would have to comply with the requirements for requesting a security freeze, and include the personal ID number or password assigned by the agency as well as the specific number or password requested. Within 10 days after receiving the request, the consumer reporting agency would have to provide the consumer with the specific requested personal ID number or password, to be used instead of the one that was originally provided, or notify the consumer that the specific requested number or password was unavailable for use by the consumer.

If a security freeze were in effect, a consumer reporting agency could not change a consumer's name, address, date of birth, or Social Security number in a credit report without sending a written confirmation of the change to the consumer within 30 days after the change was posted on the credit report. If the change were an address change, the agency would have to send a confirmation to both the new address and the former address. Written confirmation would not be required for a technical modification of information in a credit report.

Temporary Lifting & Removal of a Freeze

A consumer reporting agency could remove or temporarily lift a security freeze placed on a consumer report only if one of the following applied:

-- The consumer made a request and paid any applicable fees to the agency at a point of contact it designated. -- The report was frozen due to a material misrepresentation of a fact by the consumer. -- The security freeze was in place for a period of one year.

If an agency intended to remove a freeze due to material misrepresentation, it would have to notify the consumer in writing before doing so.

A consumer could extend a security freeze for additional one-year periods by making a request for an extension to the consumer reporting agency.

If a consumer wished to allow access to his or her credit report for a specific period of time while a security freeze was in place, he or she would have to contact the consumer reporting agency, request that it temporarily lift the freeze, and provide all of the following to the agency:

-- Clear and proper identification.
-- The unique personal ID number or password provided by the agency.
-- The specific time period that the consumer was requesting the agency to allow users access to the report.

An agency that received a request sent by first-class or certified mail, from a consumer to lift a security freeze temporarily would have to comply with the request within three days after receiving it. A consumer reporting agency could develop procedures involving the use of telephone, facsimile, the internet, or other electronic media to receive and process a request from a consumer to lift a security freeze temporarily in an expedited manner.

A consumer could make, and a consumer reporting agency would have to accept, a request for a temporary lift of a security freeze if that request were made by electronic mail, secure internet website, telephone, facsimile, or other similar means of telephonic or electronic communication as selected by the agency, and sent to an electronic mail address, internet website, telephone number, or facsimile number designated by the agency to receive these requests. The consumer reporting agency would have to comply with the request within 15 minutes after receiving it unless the consumer did not provide the required information, the request was received after 9:30 p.m. and before 6 a.m. eastern standard time, or the agency was prevented from lifting the freeze within 15 minutes by any of the following:

-- An act of God, including fire, earthquake, hurricane, storm, or similar natural disaster or phenomena.
-- An unauthorized or illegal act by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrence.
-- An operation interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruption.
-- Governmental action, including an emergency order or regulation, judicial or law enforcement action, or similar directive.
-- Regularly scheduled maintenance of or updates to the consumer reporting agency's computer systems that occurred outside of normal business hours.
-- Commercially reasonable maintenance of or repair to the agency's computer systems that was unexpected or unscheduled.

A security freeze would have to remain in place until the consumer requested that the agency remove it. The agency would have to remove the security freeze within three business days after receiving the request, clear and proper identification, and the unique personal ID number or password provided by the agency.

Fees

A consumer reporting agency could impose a reasonable fee, not to exceed $10 per request, on a consumer for placing a security freeze on a consumer report. An agency could not charge either of the following a fee for placing a security freeze: -- A consumer who was a victim of identity theft and who provided the agency upon request with a police report that confirmed that he or she was an identity theft victim.
-- A consumer who was 65 years old or older.

A consumer reporting agency also could impose a reasonable fee, not to exceed $10 per request, for issuing a replacement personal ID or password. A consumer reporting agency could not, however, charge a fee for issuing a personal ID or password specifically requested by a consumer.

A consumer reporting agency could not charge a fee for removing or temporarily lifting a security freeze.

If a consumer requested an extension of a security freeze within the original one-year period or an extension period of the freeze, a consumer reporting agency could not charge a fee for the extension. After the original and any extension periods expired, the agency could charge a fee, not to exceed $10 per request, to extend the security freeze.

Entities Exempt from Placing Freeze

The following entities would not be required to place a security freeze on a consumer report:

-- A consumer reporting agency that acted only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or multiple consumer reporting agencies, and that did not maintain a permanent database of credit information from which new credit reports were produced, although a consumer reporting agency acting as a reseller would have to honor any freeze placed on a consumer credit report by another consumer reporting agency.
-- A check services or fraud prevention services company that issued reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payment.
-- A deposit account information service company that issued reports regarding account closures due to fraud, substantial overdrafts, automatic teller machine abuse, or similar negative information regarding a consumer to inquiring financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring financial institution.

Exceptions to the Act

The proposed Act would not apply to the use of a credit report by any of the following:

-- A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to which access had been granted for purposes of facilitating an extension of credit or other permissible use.
-- A State or local agency, law enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena.
-- A child support agency acting pursuant to Part D of Title IV of the Social Security Act (which pertains to child support and establishment of paternity).
-- The State or its agents or assigns acting to investigate fraud, to investigate or collect delinquent taxes or unpaid court orders, or to fulfill any of its other statutory responsibilities if they were consistent with a permissible purpose under Section 604 of the Fair Credit Reporting Act (described below).
-- A person setting or adjusting a rate, adjusting a claim, or underwriting for insurance purposes.
-- A person using credit information for the purpose of prescreening, as provided for by the Fair Credit Reporting Act.
-- A person administering a consumer report monitoring subscription service to which the consumer had subscribed.
-- A person providing a consumer with a copy of his or her consumer report in response to the consumer's request.

If a credit report were used for the purpose of reviewing an account or collecting the financial obligation owing for an account, contract, or negotiable instrument, the proposed Act would not apply to the use of a credit report by a person with which a consumer presently had or had prior to assignment an account or contract or to which the consumer had issued a negotiable instrument; a subsidiary, affiliate, or agent of that person; an assignee of a financial obligation owed by the consumer to that person; or a prospective assignee of a financial obligation owed by the consumer to that person in conjunction with the proposed purchase of the obligation.

Federal Act

The Fair Credit Reporting Act defines "consumer reporting agency" as any person that, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and that uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.

The Act defines "consumer report" as any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living that is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for:

-- Credit or insurance to be used primarily for personal, family, or household purposes.
-- Employment purposes.
-- Any other purpose authorized under Section 604 of the Act.

Section 604 of the Fair Credit Reporting Act (42 USC 1681b) prescribes permissible purposes of consumer reports. In general, a consumer reporting agency may furnish a consumer report under the following circumstances:

-- In response to a court order or a Federal grand jury subpoena.
-- According to the written instructions of the consumer.
-- In response to a request by the head of a state or local child support enforcement agency, if certain conditions are met.
-- To an agency administering a state plan for child or spousal support, to set an initial or modified child support award.

A consumer reporting agency also may furnish a consumer report to a person whom the agency has reason to believe intends to use the information as follows: -- In connection with a credit transaction involving the consumer and the extension of credit to, or review or collection of an account of, the consumer.
-- For employment purposes (subject to specific conditions).
-- In connection with the underwriting of insurance involving the consumer.
-- In connection with a determination of the consumer's eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider the applicant's financial responsibility or status.
-- As a potential investor or servicer, or current insurer, in connection with a valuation of, or an assessment of the credit or prepayment risks associated with, an existing credit obligation.

In addition, a consumer reporting agency may furnish a consumer report to a person whom the agency has reason to believe otherwise has a legitimate business need for the information in connection with a business transaction initiated by the consumer, or to review an account to determine whether the consumer continues to meet the terms of the account.

Senate Bill 75 (S-1)

Under the bill, a consumer could bring an action against a person who failed to comply with a requirement imposed under the Consumer Credit Protection Act with respect to the consumer (except the requirement to lift a freeze within 15 minutes). The consumer could sue to recover actual damages if the person's failure to comply were negligent, or either actual damages or damages of $100 to $1,000, whichever was greater, if the failure were willful; plus reasonable attorney fees and court costs.

A consumer reporting agency could bring an action against a person who obtained a credit report or requested a security freeze, the temporary lifting of a freeze, or the removal of a freeze under the Consumer Credit Protection Act from the consumer reporting agency under false pretenses or in an attempt to violate Federal or State law. The agency could sue to recover actual damages or $1,000, whichever was greater.

In an action brought by a consumer or a consumer reporting agency, if the court found that an unsuccessful pleading, motion, or other paper filed in connection with the action were filed in bad faith or for purposes of harassment, the court would have to award attorney fees to the prevailing party in an amount the court found reasonable in relation to the work performed in responding to the pleading, motion, or paper.

The Attorney General could bring an action against a consumer reporting agency that failed to lift a security freeze temporarily within 15 minutes, as the Consumer Credit Protection Act would require under certain circumstances. The Attorney General could sue to recover a maximum civil fine of $2,500 for a violation or series of violations concerning a specific consumer, or $100,000 in the aggregate for related violations concerning more than one consumer. The Attorney General also could sue to enjoin a person who was violating or about to violate this requirement, and could sue to recover reasonable attorney fees and costs.

BACKGROUND

According to information supplied by PIRGIM, the Michigan Consumer Federation, AARP, and the Consumers Union, 27 or 28 states and the District of Columbia have security freeze laws to protect the credit of citizens. These laws differ in application, range of protections, and compliance requirements for credit reporting agencies. Five states allow only people who have been victims of identity theft to freeze their credit reports. Twenty-four states require a consumer reporting agency to freeze a credit report within five days of receiving a request. Fees for placing, temporarily lifting, and removing a freeze vary by state and range from $0 to $20, with several states prohibiting fees on victims of identity theft or citizens over 62 or 65 years old.

Generally, requests for freezes, lifts, and removals of security freezes must be submitted by certified mail. Temporary lifts may be requested by telephone or other secure electronic or telephonic means as provided for by a consumer reporting agency. States have often encouraged consumer reporting agencies to develop expedited means for requesting temporary lifts and a few states require (or set as a goal) that a consumer reporting agency comply with a temporary request for a lift within 15 minutes.

ARGUMENTS (Please note: The arguments contained in this analysis originate from sources outside the Senate Fiscal Agency. The Senate Fiscal Agency neither supports nor opposes legislation.)

Supporting Argument Identity theft is a serious problem in the State and around the country. While Michigan has made efforts to stop this large and growing problem, more needs to be done to keep consumers safe. The ability of a person to lock or freeze his or her credit report is one of the best ways to protect a person from identity theft. The bills would prevent a person from opening a line of credit under someone else's name without his or her personal ID or password.

Opposing Argument Security freezes would harm consumer transactions in Michigan as credit report freezing is the opposite of free flowing commerce. Quick credit checks are required for immediate transactions such as cell phone plans, emergency loans, and credit extensions. Even with the 15-minute deadline to lift a freeze, there is the likelihood that consumers often would forget their personal IDs or passwords, bringing such transactions to a halt. The problems this would create outweigh the potential benefits of credit report security freezes.

Opposing Argument The ability to freeze credit reports should be a right. The proposed fees, however, would limit the ability of a person to place a freeze on his or her credit report. This would discourage a consumer with a tight budget from protecting himself or herself. Response: Placing freezes would not be without cost and consumers should be required to pay a reasonable fee to receive these new services. If a business were not allowed to charge a fee for the services, it would pass on the cost to all consumers indirectly. Fees would be a more transparent and fair way to pay for the costs of credit freezes. Opposing Argument It is said that the technology required to freeze or temporarily lift a freeze on a credit report within 15 minutes does not exist. If the bills took effect on January 1, 2008, consumer reporting agencies would not be able to comply effectively and the technology that would be used would likely have many flaws. The effective date should be in 2009 or later to allow problems with the new technology to be fixed.
Response: Consumer reporting agencies, banks, and other institutions are able to grant and report credit in only a few minutes and they should be able to lift freezes just as quickly. The January 1, 2008, effective date could spur the development of necessary technology. Although lifting a security freeze in 15 minutes could be inconvenient to consumer reporting agencies, that concern should come second to protecting consumers' credit.

Opposing Argument
The proposed Consumer Credit Protection Act would not apply to a person who was setting or adjusting a rate, adjusting a claim, or underwriting for insurance purposes. This exemption for credit scoring should be eliminated. Rules promulgated by the Commissioner of the Office of Financial and Insurance Services ban the use of insurance credit scoring in the rating and underwriting of automobile, home, and other personal lines of insurance. Although enforcement of the rules has been judicially enjoined, the matter still is being litigated. Senate Bill 340 (S-2) should not endorse insurance credit scoring.

Legislative Analyst: Craig Laurie
FISCAL IMPACT

Senate Bill 75 (S-1)
The bill would have a minimal fiscal impact on State and local government. To the extent that there would be an increase in civil actions as a result of this bill, the courts could incur increased costs, but these would be absorbed by the existing court system.

Senate Bill 340 (S-2)

The bill would have no fiscal impact on State or local government.

Fiscal Analyst: Stephanie Yu

Analysis was prepared by nonpartisan Senate staff for use by the Senate in its deliberations and does not constitute an official statement of legislative intent. sb75&340/0708