Bill Text - SB334 (2006)

Authorizing the use of a credit freeze as a means of deterring identity theft.


Revision: Jan. 21, 2010, midnight

CHAPTER 208

SB 334 – FINAL VERSION

02/23/06 1066s

26Apr2006… 1590h

2006 SESSION

06-2430

05/09

SENATE BILL 334

AN ACT authorizing the use of a credit freeze as a means of deterring identity theft.

SPONSORS: Sen. Gottesman, Dist 12; Sen. Roberge, Dist 9; Sen. Gallus, Dist 1; Sen. Clegg, Dist 14; Sen. D'Allesandro, Dist 20; Sen. Fuller Clark, Dist 24; Rep. Hogancamp, Ches 4; Rep. Maxfield, Merr 6; Rep. Wall, Straf 7; Rep. Ulery, Hills 27

COMMITTEE: Judiciary

AMENDED ANALYSIS

This bill:

I. Permits consumers to establish a “credit freeze” on their consumer reports and requires consumer reporting agencies to provide notice of this right.

II. Permits victims of identity theft to request copies of their consumer reports.

III. Establishes a procedure to notify consumer reporting agencies when a person is deceased.

IV. Establishes a minimum penalty for negligent or willful violations of the consumer credit reporting law.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Explanation: Matter added to current law appears in bold italics.

Matter removed from current law appears [in brackets and struckthrough.]

Matter which is either (a) all new or (b) repealed and reenacted appears in regular type.

02/23/06 1066s

26Apr2006… 1590h

06-2430

05/09

STATE OF NEW HAMPSHIRE

In the Year of Our Lord Two Thousand Six

AN ACT authorizing the use of a credit freeze as a means of deterring identity theft.

Be it Enacted by the Senate and House of Representatives in General Court convened:

208:1 New Subdivision; Consumer Credit Reporting; Security Freeze. Amend RSA 359-B by inserting after section 21 the following new subdivision:

Security Freeze

359-B:22 Definitions. In this subdivision:

I. “Identity theft” means the unauthorized taking or use of an individual’s personal information to obtain credit, goods, services, money, or property, with the intent to commit fraud. In this paragraph, personal information includes, but is not limited to, an individual’s first name or initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:

(a) Social security number.

(b) Driver’s license number.

(c) Account number, credit card number, or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account.

II. “Proper identification” has the same meaning as in 15 U.S.C. section 1681h(a)(1), and includes:

(a) The consumer’s full name, including first, last, and middle names and any suffix.

(b) Any name the consumer previously used.

(c) The consumer’s current and recent full addresses, including street address, any apartment number, city, state, and zip code.

(d) The consumer’s social security number.

(e) The consumer’s date of birth.

III. “Security freeze” or “freeze” means a notice placed in a consumer report at the request of the consumer pursuant to RSA 359-B:24 that prohibits a consumer reporting agency from releasing the consumer report or credit score.

359-B:23 Notice to Consumers.

I. Any time a consumer reporting agency is required to make a written disclosure to consumers pursuant to 15 U.S.C. section 1681g, it shall disclose, in at least 12-point type, and in bold type as indicated, the following notice:

NOTICE TO NEW HAMPSHIRE CONSUMERS

Right to Security Freeze on Consumer Credit Report

You have the right to place a “security freeze” on your credit report pursuant to RSA 359-B:24. Under New Hampshire law, what is commonly known as a credit report is referred to as a “consumer report.” A security freeze will prohibit a consumer reporting agency from releasing any information in your consumer report without your express authorization. The security freeze must be requested in writing, by certified mail.

You may obtain a security freeze on your consumer report at no charge if you are a victim of identity theft and you submit a copy of the police report, investigative report, or complaint that you filed with a law enforcement agency about unlawful use of your personal information by another person.

The consumer reporting agency may charge you a fee for the security freeze if you are not a victim of identity theft.

The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gains access to the personal and financial information in your consumer report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding new loans, credit, mortgage, insurance, government services or payments, rental housing, employment, investment, license, cellular phone, utilities, digital signature, internet credit card transaction, or other services, including an extension of credit at point of sale.

When you place a security freeze on your consumer report, within 10 business days you will be provided a personal identification number or password to use if you choose to remove the freeze on your consumer report or authorize the release of your consumer report for a specific party or period of time after the freeze is in place. To provide that authorization, you must contact the consumer reporting agency and provide all of the following:

(1) The unique personal identification number or password provided by the consumer reporting agency.

(2) Proper identification to verify your identity.

(3) The proper information regarding the third party who will receive the credit report or the period of time for which the report shall be available to users of the credit report.

(4) Payment of the applicable fee, if any.

A consumer reporting agency that receives a request from a consumer to lift temporarily a freeze on a consumer report must comply with the request no later than 3 business days after receiving the request.

A security freeze does not apply to a person or entity, or its affiliates, or collection agencies acting on behalf of the person or entity with which you have an existing account that requests information in your consumer report for the purposes of reviewing or collecting the accounts, provided the use of your credit report is for a permissible purpose as provided by the federal Fair Credit Reporting Act. Reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.

You have the right to bring a civil action against anyone who violates your rights under the credit reporting laws.

359-B:24 Security Freeze by Consumer Reporting Agency; Time in Effect.

I. A consumer may place a security freeze on his or her consumer report as follows:

(a) A consumer who has been the victim of identity theft may place a security freeze on his or her consumer report by making a request in writing, by certified mail to a consumer reporting agency with a valid copy of the police report, investigative report, or complaint the consumer has filed with a law enforcement agency about unlawful use of personal information by another person. In the case of a victim of identity theft, a consumer reporting agency shall not charge a fee for placing, removing, or temporarily lifting for a specific party or period of time a security freeze on a consumer report.

(b) A consumer who has not been the victim of identity theft may place a security freeze on his or her consumer report by making a request in writing, by certified mail to a consumer reporting agency. A consumer reporting agency may charge a fee of no more than $10 to a consumer for each freeze, removal of a freeze, or temporary lift of a freeze for a period of time or specific party or for reissuing the same or a new personal identification number if the consumer fails to retain the original personal identification number provided by the agency.

II. Subject to the exceptions in paragraph XIII, when a security freeze has been placed on a consumer report, the consumer reporting agency shall not release the consumer report or any information from it without the express authorization of the consumer. This subparagraph shall not prevent a consumer reporting agency from advising a third party that a security freeze is in effect with respect to the consumer report.

III. A consumer reporting agency shall place a security freeze on a consumer report no later than 5 business days after receiving a written request from the consumer.

IV. The consumer reporting agency shall send a written confirmation of the security freeze to the consumer within 10 business days after placing the security freeze and shall provide the consumer with a personal identification number or password, other than the consumer’s social security number, to be used by the consumer when providing authorization for the release of a consumer report to a specific party or for a period of time.

V. If the consumer wishes to allow access to the consumer report by a specific party or for a certain period of time while a freeze is in place, the consumer may contact the consumer reporting agency, request that the freeze be temporarily lifted, and provide each of the following:

(a) Proper identification.

(b) The personal identification number or password provided by the consumer reporting agency pursuant to paragraph IV.

(c) The proper information regarding the specific party granted access or the time period for which the report is to be available to users.

(d) Payment of the applicable fee, if any, pursuant to subparagraph I(b).

VI. A consumer reporting agency may develop procedures involving use of phone, fax, internet, or other electronic media to receive and process requests.

VII. A consumer reporting agency that receives a request from a consumer to temporarily lift a freeze on a consumer report pursuant to paragraph V shall comply with the request no later than 3 business days after receiving the request.

VIII. A consumer reporting agency shall remove or temporarily lift a freeze placed on a consumer report only:

(a) Upon consumer request, pursuant to paragraph V or XI; or

(b) If the consumer report was frozen due to a material misrepresentation of fact by the consumer. If a consumer reporting agency intends to remove a freeze upon a consumer report pursuant to this subparagraph, the consumer reporting agency shall notify the consumer in writing prior to removing the freeze on the consumer report.

IX. If a third party requests access to a consumer report on which a security freeze is in effect and this request is in connection with an application for credit or any other use and the consumer does not allow access to the consumer report for that specific party or period of time, the third party may treat the application as incomplete.

X. If a consumer requests a security freeze pursuant to this section, the consumer reporting agency shall disclose to the consumer the processes of placing and temporarily lifting a security freeze and the process for allowing access to information from the consumer report for a specific party or period of time while the security freeze is in place.

XI. A security freeze shall remain in place until the consumer requests that the security freeze be removed. A consumer reporting agency shall remove a security freeze within 3 business days of receiving a request for removal from a consumer who provides:

(a) Proper identification.

(b) The personal identification number or password provided by the consumer reporting agency pursuant to paragraph IV.

(c) Payment of the applicable fee, if any, pursuant to subparagraph I(b).

XII. A consumer reporting agency shall require proper identification of the person making a request to place or remove a security freeze.

XIII. This section, including the security freeze, shall not apply to the use of a consumer report by the following:

(a) A person or person’s subsidiary, affiliate, agent, or assignee with which the consumer has or, prior to assignment, had an account, contract, or debtor-creditor relationship for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or debt or extending credit to a consumer with a prior or existing account, contract, or debtor-creditor relationship, subject to the requirements of RSA 359-B:4. For purposes of this subparagraph, “reviewing the account” includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.

(b) A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under paragraph V for the purpose of facilitating the extension of credit or another permissible use.

(c) A person acting pursuant to a court order, warrant, or subpoena.

(d) Child support enforcement officials when investigating a child support case pursuant to Title IV-D of the Social Security Act.

(e) The department of health and human services, the department of justice, or any of their agents or assignees, acting to investigate Medicaid fraud.

(f) The department of revenue administration, municipal taxing authorities, the secretary of state, the division of motor vehicles in the department of safety, or any of their agents or assignees, acting to investigate or collect delinquent taxes or assessments, including interest and penalties and unpaid court orders, or to fulfill any of their other statutory or charter responsibilities.

(g) A person’s use of credit information for prescreening as provided by the federal Fair Credit Reporting Act.

(h) A person for the sole purpose of providing a credit file monitoring subscription service to which the consumer has subscribed.

(i) Any person or entity, including but not limited to a consumer reporting agency, for the purpose of providing a consumer with a copy of his or her consumer report or credit score upon the consumer’s request.

(j) Any person or entity for use in setting or adjusting an insurance rate or claim or underwriting for insurance purposes.

359-B:25 Duties of Consumer Reporting Agency if Security Freeze Is In Effect. If a security freeze is in place, a consumer reporting agency shall not change any of the following official information in a consumer report without sending written confirmation of the change to the consumer within 30 days of the change being posted to the consumer’s file: name, date of birth, social security number, and address. Written confirmation is not required for technical modifications of a consumer’s official information, including name and street abbreviations, complete spellings, and transposition of numbers or letters. In the case of an address change, the written confirmation shall be sent to the new address and the former address.

359-B:26 Persons Not Required to Place Security Freeze. The following persons are not required to place a security freeze on a consumer report pursuant to RSA 359-B:24, except that any person that is not required to place a security freeze on a consumer report under paragraph III is subject to a security freeze placed on a consumer report by another consumer reporting agency from which it obtains information:

I. A check services or fraud prevention services company that reports on incidents of fraud or issues authorizations for the purpose of approving or processing negotiable instruments, electronic fund transfers, or similar methods of payment.

II. A deposit account information service company that issues reports regarding account closures due to fraud, overdrafts, automated teller machine abuse, or similar negative information regarding a consumer to inquiring financial institutions for use only in reviewing that consumer’s request for a deposit account at the inquiring financial institution.

III. A consumer reporting agency that:

(a) Acts only to resell credit information by assembling and merging information contained in a database of one or more consumer reporting agencies; and

(b) Does not maintain a permanent database of credit information from which new consumer reports are produced.

359-B:27 Victim of Identity Theft; Access to Consumer Report. Every consumer credit reporting agency shall, upon the receipt from a victim of identity theft of a police report, investigative report, or complaint the consumer has filed with a law enforcement agency about unlawful use of personal information by another person, provide the victim, free of charge and upon request, a copy of his or her consumer report and such additional copies of the consumer report as he or she may be entitled to under the Fair Credit Reporting Act, 15 U.S.C. section 1681 et seq.

359-B:28 Consumer Report Files of Deceased Persons.

I. An executor, administrator, or other person authorized to act on behalf of an estate of a deceased person may request that a consumer reporting agency indicate on the deceased person’s consumer report that the person is deceased. The consumer reporting agency shall indicate on the deceased person’s consumer report that the person is deceased within 5 business days of receipt of the following documentation from the executor, administrator, or other person authorized to act on behalf of the estate of the deceased person:

(a) A certificate of death, a certificate of appointment, letters testamentary, or other order from the probate court authorizing the executor, administrator, or other person to act on behalf of the estate of the deceased person; and

(b) A request to indicate on the deceased person’s consumer report that the person is deceased.

II. The consumer reporting agency may remove the indication placed on the person’s consumer report pursuant to paragraph I if the consumer reporting agency finds that the indication was placed on the person’s consumer report through material misrepresentation of fact. If the consumer reporting agency intends to remove the indication pursuant to this section, the consumer reporting agency shall notify the person or the executor, administrator, or other person authorized to act on behalf of the estate in writing prior to removing the indication.

359-B:29 Police Report Regarding Identity Theft.

I. A person who has learned or reasonably suspects that he or she has been the victim of identify theft may contact the local law enforcement agency that has jurisdiction over his or her place of residence, which shall take a police report of the matter, and provide the complainant with a copy of that report. Notwithstanding the fact that jurisdiction may lie elsewhere for investigation and prosecution of a crime of identity fraud, the local law enforcement agency shall take the complaint and provide the complainant with a copy of the complaint and may refer the complaint to a law enforcement agency in a different jurisdiction.

II. Nothing in this section shall interfere with the discretion of a local law enforcement agency to allocate resources for investigations of crimes. A complaint filed under this section is not required to be counted as an open case for purposes such as compiling open case statistics.

208:2 Consumer Credit Reporting; Civil Liability for Willful Noncompliance. Amend RSA 359-B:16, I to read as follows:

I. Any actual damages sustained by the consumer as a result of the failure or $1,000, whichever is greater;

208:3 Consumer Credit Reporting; Civil Liability for Negligent Noncompliance. Amend RSA 359-B:17, I to read as follows:

I. Any actual damages sustained by the consumer as a result of the failure or $1,000, whichever is greater;

208:4 Effective Date. This act shall take effect January 1, 2007.

Approved: May 31, 2006

Effective: January 1, 2007