January 25, 2007, Introduced by Senators JACOBS, ANDERSON, HUNTER, BRATER, PRUSI, SCOTT and JELINEK and referred to the Committee on Banking and Financial Institutions.
A bill to require certain consumer reporting agencies to place
security freezes on certain consumer information; to authorize and
limit fees; and to provide remedies.
THE PEOPLE OF THE STATE OF MICHIGAN ENACT:
Sec. 1. This act shall be known and may be cited as the
"consumer security act of 2007".
Sec. 3. As used in this act:
(a) "Clear and proper identification" means information
generally deemed sufficient to identify an individual.
(b) "Consumer" means an individual who resides in this state.
(c) "Consumer file" means all of the information on a consumer
recorded and retained by a consumer reporting agency regardless of
how the information is stored.
(d) "Consumer report" means any written, oral, or other
communication of any information by a consumer reporting agency
bearing on a consumer's creditworthiness, credit standing, credit
capacity, character, general reputation, personal characteristics,
or mode of living that is issued or expected to be used or
collected in whole or in part for the purpose of serving as a
factor in establishing the consumer's eligibility for any of the
following:
(i) Credit or insurance to be used primarily for personal,
family, or household purposes.
(ii) Employment purposes.
(iii) Any other purpose authorized under section 604 of the fair
credit reporting act, 15 USC 1681b.
(e) "Consumer reporting agency" means any person who, for
monetary fees or dues or on a cooperative nonprofit basis,
regularly engages in whole or in part in the practice of assembling
or evaluating consumer credit information or other information on
consumers for the purpose of furnishing consumer reports to third
parties and who uses any means or facility of interstate commerce
for the purpose of preparing or furnishing consumer reports.
(f) "Security freeze" means a notice that is placed on a
consumer report or consumer file at the request of the consumer and
that prohibits a consumer reporting agency from releasing the
consumer's consumer report, any information from the consumer
report, or the consumer's credit score, without the express
authorization of the consumer except in compliance with this act.
(g) "Written request" means either of the following:
(i) A request in writing sent by certified mail, overnight
mail, or ordinary mail to a consumer reporting agency.
(ii) A direct request sent to a consumer reporting agency
through a secure electronic connection, if the consumer reporting
agency provides a secure electronic connection.
Sec. 5. (1) A consumer may place a security freeze on his or
her consumer file by making a written request to a consumer
reporting agency that includes clear and proper identification of
the consumer.
(2) A consumer reporting agency shall place a security freeze
on a consumer's consumer file within 5 business days after
receiving a written request for the security freeze from the
consumer under subsection (1).
(3) If a security freeze is in place, a consumer reporting
agency shall not release information from a consumer file to a
third party without prior express authorization from the consumer.
This subsection does not prevent a consumer reporting agency from
advising a third party that a security freeze is in effect with
respect to the consumer's consumer file.
Sec. 7. (1) Within 5 business days after a consumer reporting
agency places a security freeze on a consumer's consumer file under
section 5, the consumer reporting agency shall send a written
confirmation of the security freeze to the consumer that includes a
unique personal identification number or password that the consumer
may use to provide authorization for the release of his or her
consumer report, consumer file, or credit information to a specific
person or for a specific period of time. In addition, the consumer
reporting agency shall simultaneously provide to the consumer in
writing the process for placing, removing, and temporarily lifting
a security freeze and the process for allowing access to
information from the consumer file while the security freeze is in
effect.
(2) A consumer may request in writing a replacement personal
identification number or password for purposes of subsection (1).
The request must comply with the requirements for requesting a
security freeze under section 5. Within 5 business days after a
consumer reporting agency receives a request for a replacement
personal identification number or password, the consumer reporting
agency shall provide the consumer with a new, unique personal
identification number or password to be used by the consumer
instead of the number or password that was provided under
subsection (1).
Sec. 9. A consumer reporting agency shall notify a person who
requests a consumer report if a security freeze is in effect for
the consumer file involved in that consumer report.
Sec. 11. (1) If a consumer wishes to allow access to his or
her consumer file to a specific person or for a specific period of
time while a security freeze is in place, he or she shall contact
the consumer reporting agency, request that the consumer reporting
agency allow access to his or her consumer file, and provide all of
the following to the consumer reporting agency:
(a) Clear and proper identification.
(b) The unique personal identification number or password
provided by the consumer reporting agency under section 5.
(c) Information sufficient to identify the person who is to
receive information from the consumer file or a consumer report or
the specific time period that the consumer reporting agency should
allow users access to the consumer's consumer file.
(2) A consumer reporting agency that receives a request from a
consumer to temporarily lift a security freeze on his or her
consumer file under subsection (1) shall comply with the request
within 3 business days after receiving the request. A consumer
reporting agency may develop procedures involving the use of
telephone, facsimile, the internet, or other electronic media to
receive and process a request from a consumer to temporarily lift a
security freeze on a consumer file in an expedited manner.
(3) A security freeze shall remain in place until the consumer
requests that the consumer reporting agency remove the security
freeze. A consumer reporting agency shall remove a security freeze
within 3 business days after receiving a request for removal from
the consumer and all of the following information from the
consumer:
(a) Clear and proper identification.
(b) The unique personal identification number or password
provided by the consumer reporting agency under section 7.
Sec. 13. (1) A consumer reporting agency may impose a
reasonable fee on a consumer for initially placing a security
freeze on a consumer file. The amount of the fee may not exceed
$10.00.
(2) A consumer reporting agency may impose a reasonable fee on
a consumer for a request to allow limited access to a consumer file
under section 11(1). The amount of the fee may not exceed $8.00 per
request.
(3) A consumer reporting agency may not charge a consumer a
fee for removing a security freeze under section 11(3).
Sec. 15. A consumer damaged by an intentional or negligent
violation of this act by a consumer reporting agency may bring an
action for that violation and is entitled to recover his or her
actual damages, plus reasonable attorney fees and court costs.