Introduced Version




SENATE BILL No. 261

_____


DIGEST OF INTRODUCED BILL



Citations Affected: IC 24-5-23; IC 34-11-2-13.

Synopsis: Security freeze for credit reports. Provides that a consumer may prohibit access to the consumer's credit report by requesting a credit bureau to issue a security freeze. Provides that a consumer may bring a civil action against a credit bureau for injury caused to the consumer by the credit bureau.

Effective: July 1, 2005.



Alting


    January 6, 2005, read first time and referred to Committee on Insurance and Financial Institutions.




Introduced

First Regular Session 114th General Assembly (2005)


PRINTING CODE. Amendments: Whenever an existing statute (or a section of the Indiana Constitution) is being amended, the text of the existing provision will appear in this style type, additions will appear in this style type, and deletions will appear in this style type.
Additions: Whenever a new statutory provision is being enacted (or a new constitutional provision adopted), the text of the new provision will appear in this style type. Also, the word NEW will appear in that style type in the introductory clause of each SECTION that adds a new provision to the Indiana Code or the Indiana Constitution.
Conflict reconciliation: Text in a statute in this style type or this style type reconciles conflicts between statutes enacted by the 2004 Regular Session of the General Assembly.

SENATE BILL No. 261


    A BILL FOR AN ACT to amend the Indiana Code concerning trade regulation.

Be it enacted by the General Assembly of the State of Indiana:

SOURCE: IC 24-5-23; (05)IN0261.1.1. -->     SECTION 1. IC 24-5-23 IS ADDED TO THE INDIANA CODE AS A NEW CHAPTER TO READ AS FOLLOWS [EFFECTIVE JULY 1, 2005]:
     Chapter 23. Security Freeze for Consumer Reports
    Sec. 1. As used in this chapter, "consumer" means a person whose credit information and history is recorded in a consumer report.
    Sec. 2. As used in this chapter, "consumer report" has the meaning set forth in 15 U.S.C. 1681a.
     Sec. 3. (a) As used in this chapter, "consumer reporting agency" means an entity that:
        (1) for a fee; or
        (2) on a cooperative nonprofit basis;
assembles or evaluates consumer credit information or other information regarding a consumer for the purpose of furnishing a consumer report to a third party.
     (b) The term does not include the following:
         (1) A check services or fraud prevention services organization that issues:
            (A) reports on incidents of fraud; or
            (B) authorizations to approve or process negotiable instruments, electronic funds transfers, or similar methods of payment.
         (2) A deposit account information service organization that issues:
            (A) reports on:
                (i) deposit account closures due to fraud;
                (ii) substantial overdrafts of deposit accounts; and
                (iii) abuse of automated teller machine services; or
            (B) other negative consumer information;
        to a financial institution for use by the financial institution in reviewing a consumer application for a deposit account.
         (3) A person or an organization that:
            (A) assembles or merges information contained in the data base of a consumer reporting agency;
            (B) resells the credit information assembled or merged from the data base of the consumer reporting agency; and
            (C) does not maintain a permanent data base of credit information from which a consumer report may be produced.
         (4) A person or an organization that owns a data base or file that consists solely of negative consumer information, including criminal history information, used for:
            (A) fraud prevention or detection;
            (B) tenant screening; or
            (C) employment screening.
    (c) A person or an organization described in subsection (b) is not excluded from the definition of consumer reporting agency if the person or organization assembles or evaluates consumer information in addition to the business activities described for the person or organization in subsection (b).
     Sec. 4. As used in this chapter, "security freeze" means a designation placed on a consumer report:
        (1) by a consumer reporting agency; and
        (2) at the request of a consumer;
that prohibits the consumer reporting agency from releasing the consumer report without the authorization of the consumer.
     Sec. 5. A security freeze does not prohibit a consumer reporting agency from providing a consumer report to the following without

the authorization of the consumer:
        (1) A state or local unit of government.
        (2) A law enforcement agency.
        (3) A creditor of a consumer, including an assignee or a purchaser of the consumer's debt, for use in recovering the outstanding debt of the consumer.
         (4) The consumer who requested the security freeze.
     Sec. 6. (a) A consumer may place a security freeze on the consumer's consumer report by:
        (1) sending a written request by certified mail; or
        (2) making a request by telephone, if that method of request is available;
to a consumer reporting agency.
    (b) A consumer reporting agency that receives a request under subsection (a) shall place a security freeze on the consumer's consumer report not later than ten (10) business days after receipt of the request.
     (c) A consumer reporting agency is not required to place a security freeze on a consumer report under this section if the consumer reporting agency determines that a request for a security freeze:
        (1) is incomplete;
        (2) is materially false; or
        (3) does not clearly identify the person making the request as the consumer.
     (d) A consumer reporting agency may develop:
        (1) forms to be used in submitting a written request for a security freeze; and
        (2) a process by which a consumer may request a security freeze by telephone.
    Sec. 7. If a security freeze has been placed on a consumer report, a consumer reporting agency may require a person or an entity described in section 5 of this chapter to provide information to the consumer reporting agency confirming the identity of the person or entity before a consumer report is released to the person or entity.
    Sec. 8. A consumer reporting agency that receives a truthful and complete request for a security freeze shall issue:
        (1) a unique personal identification number; and
        (2) written information explaining how to:
            (A) remove a security freeze; and
            (B) allow access to a consumer report for a specified

period;
to the consumer not later than ten (10) business days after receipt of the request.
    Sec. 9. (a) If a security freeze has been placed on a consumer report, the consumer reporting agency that placed the security freeze on the consumer report may not release the consumer report unless the consumer reporting agency receives authorization from the consumer.
     (b) A consumer gives authorization to release a consumer report if the unique personal identification number is provided to the consumer reporting agency:
        (1) in conjunction with a request by the consumer to allow access to the consumer's consumer report for a specified period; and
        (2) in the manner prescribed by the consumer reporting agency.
     Sec. 10. (a) A third party that requests a consumer report in connection with an application for credit shall treat the application for credit as incomplete if:
        (1) a security freeze has been placed on the consumer report;
        (2) the consumer has not allowed access to the consumer's consumer report for a specified period; and
        (3) the consumer reporting agency does not release the consumer report to the third party based on subdivisions (1) and (2).
     (b) A consumer reporting agency shall notify a third party of the existence of a security freeze as the basis for a refusal to issue a consumer report under subsection (a).
    Sec. 11. (a) A security freeze remains in effect until the consumer who requested the security freeze requests, in a manner prescribed by the consumer reporting agency, that the security freeze be removed.
    (b) A security freeze must be removed not later than three (3) business days after the consumer reporting agency receives a request under subsection (a).
    (c) A consumer reporting agency is not required to remove a security freeze under this section if the consumer reporting agency determines that a request to remove a security freeze:
        (1) is incomplete;
        (2) is materially false; or
        (3) does not clearly identify the person making the request as the consumer.

     Sec. 12. (a) A consumer for whose benefit a security freeze is placed under this chapter may be issued a replacement unique personal identification number by the consumer reporting agency that issued the original unique personal identification number.
     (b) A request for a replacement unique personal identification number must be made in a manner prescribed by the consumer reporting agency.
    (c) A replacement unique personal identification number must be issued not later than seven (7) business days after the consumer reporting agency receives a request under subsection (b).
    (d) A consumer reporting agency is not required to issue a replacement unique personal identification number under this section if the consumer reporting agency determines that a request for a unique personal identification number:
        (1) is incomplete;
        (2) is materially false; or
        (3) does not clearly identify the person making the request as the consumer.
     Sec. 13. (a) A consumer reporting agency may remove a security freeze if the consumer reporting agency determines that the placement of the security freeze was based on a material misrepresentation of fact.
     (b) A consumer reporting agency must provide written notice to a consumer before the security freeze is removed under this section.
    Sec. 14. (a) A consumer reporting agency may impose a charge not to exceed ten dollars ($10) for placing a security freeze on a consumer report.
    (b) The following persons are not required to pay a charge under subsection (a):
        (1) A person who is a victim of identify deception under IC 35-43-5-3.5.
        (2) A person who is at least sixty-two (62) years of age at the time a charge is imposed under subsection (a).
     Sec. 15. (a) Except as provided in subsection (b), a consumer reporting agency may not amend the following information in a consumer report if a security freeze is placed on the consumer report:
        (1) The name of the consumer.
        (2) The date of birth of the consumer.
        (3) The Social Security number of the consumer.
        (4) The address of the consumer.
    (b) A consumer reporting agency may amend the information described in subsection (a) if the consumer reporting agency receives prior written approval from the consumer.
    Sec. 16. (a) A consumer injured by an act of a consumer reporting agency that violates this chapter may bring a civil action against the consumer reporting agency in a circuit or superior court in the county in which the consumer resides.
    (b) A civil action brought under this section must be commenced in accordance with IC 34-11-2-13.
    (c) A court may award fees, costs, and reasonable attorney's fees in a civil action brought under this section.
SOURCE: IC 34-11-2-13; (05)IN0261.1.2. -->     SECTION 2. IC 34-11-2-13 IS ADDED TO THE INDIANA CODE AS A NEW SECTION TO READ AS FOLLOWS [EFFECTIVE JULY 1, 2005]: Sec. 13. An action against a consumer reporting agency by a consumer under IC 24-5-23-16 (governing consumer credit reports) must be commenced not later than two (2) years after the date of the alleged violation of IC 24-5-23.