Bill Text: MI SB0174 | 2013-2014 | 97th Legislature | Engrossed
Bill Title: Consumer credit; credit reports and reporting agencies; security freeze on credit reports concerning other children and consumers; allow under certain circumstance. Creates new act.
Spectrum: Slight Partisan Bill (Republican 22-10)
Status: (Passed) 2013-12-31 - Assigned Pa 0229'13 With Immediate Effect [SB0174 Detail]
Download: Michigan-2013-SB0174-Engrossed.html
SB-0174, As Passed House, November 14, 2013
SUBSTITUTE FOR
SENATE BILL NO. 174
A bill to require certain consumer reporting agencies to place
security freezes for consumers under certain circumstances; to
provide for the removal of those security freezes; to authorize and
limit fees; to prescribe the powers and duties of certain state
agencies and officials; and to provide remedies.
THE PEOPLE OF THE STATE OF MICHIGAN ENACT:
ARTICLE 1
Sec. 1. This act shall be known and may be cited as the
"security freeze act".
Sec. 2. As used in this act:
(a) "Consumer" means an individual who resides in this state.
(b) "Consumer reporting agency" means any person that, for
monetary fees or dues or on a cooperative nonprofit basis,
regularly engages in whole or in part in the practice of assembling
or evaluating consumer credit information or other information on
consumers for the purpose of furnishing credit reports to third
parties and that uses any means or facility of interstate commerce
for the purpose of preparing or furnishing credit reports.
(c) "Credit report" means any written, oral, or other
communication of any information by a consumer reporting agency
that is related to a consumer's creditworthiness, credit standing,
or credit capacity, and is issued or expected to be used or
collected in whole or in part for the purpose of serving as a
factor in establishing the consumer's eligibility for credit.
(d) "File" means all of the information about a consumer that
is recorded and retained by a consumer reporting agency regardless
of how the information is stored.
(e) "Protected consumer" means either of the following:
(i) An individual who is under 16 years of age at the time a
request for the placement of a security freeze is made.
(ii) An incapacitated person or a protected person for whom a
guardian or conservator has been appointed has been appointed under
article V of the estates and protected individuals code, 1998 PA
386, MCL 700.5101 to 700.5520.
(f) "Record" means a compilation of information that meets all
of the following:
(i) Identifies a protected consumer.
(ii) Is created by a consumer reporting agency solely for the
purpose of complying with article 3.
(iii) May not be created or used to consider the protected
consumer's creditworthiness, credit standing, credit capacity,
character, general reputation, personal characteristics, or mode of
living for any purpose authorized under section 604 of the fair
credit reporting act, 15 USC 1681b.
(g) "Representative" means an individual who provides to a
consumer reporting agency sufficient proof of authority to act on
behalf of a protected consumer.
(h) "Security freeze" means a restriction placed on a
consumer's credit report at the request of the consumer that
prohibits a consumer reporting agency from releasing the consumer's
credit report or any information derived from the consumer's credit
report without the express authorization of or on behalf of the
consumer.
(i) "Security freeze for a protected consumer" means any of
the following:
(i) If a consumer reporting agency does not have a file
pertaining to a protected consumer, a security freeze that meets
both of the following:
(A) Is placed on the protected consumer's record under this
act.
(B) Prohibits the consumer reporting agency from releasing the
protected consumer's record except as provided in this act.
(ii) If a consumer reporting agency has a file pertaining to
the protected consumer, a security freeze that meets both of the
following:
(A) Is placed on the protected consumer's credit report under
this act.
(B) Prohibits the consumer reporting agency from releasing the
protected consumer's credit report or any information derived from
the protected consumer's credit report except as provided in this
act.
(j) "Sufficient proof of authority" means documentation that
shows that a representative has authority to act on behalf of a
protected consumer, including, but not limited to, any of the
following:
(i) An order issued by a court of law.
(ii) A lawfully executed and valid power of attorney.
(iii) A written, notarized statement signed by a representative
that expressly describes the authority of the representative to act
on behalf of a protected consumer.
(k) "Sufficient proof of identification" means information or
documentation that identifies a consumer, a protected consumer, or
a representative of a protected consumer, including, but not
limited to, any of the following:
(i) A social security number or a copy of a social security
card issued by the social security administration.
(ii) A certified or official copy of a birth certificate issued
by the entity authorized to issue the birth certificate.
(iii) A copy of an operator's license or chauffeur's license
issued under the Michigan vehicle code, 1949 PA 300, MCL 257.1 to
257.923, an official state personal identification card issued
under 1972 PA 222, MCL 28.291 to 28.300, or any other government–
issued identification.
Sec. 3. Article 2 does not apply to any of the following
entities or uses:
(a) A person, or a subsidiary, affiliate, agent, or assignee
of a person, with which the consumer has, or before assignment had,
an account, contract, or debtor-creditor relationship, for the
purpose of account review or collecting the financial obligation
owing for the account, contract, or debt.
(b) A person that was given access to a consumer's credit
report for the purpose of facilitating an extension of credit to
the consumer or another permissible use.
(c) A person that is acting under a court order, warrant, or
subpoena.
(d) A unit of state or local government that administers a
program for establishing and enforcing child support obligations.
(e) The department of human services in connection with a
fraud investigation conducted by that department.
(f) Any state or local taxing authority in connection with any
of the following:
(i) An investigation conducted by that taxing authority.
(ii) The collection of delinquent taxes or unpaid court orders
by the taxing authority.
(iii) The performance of any other duty provided for by law.
(g) A person that furnishes a credit report, or requests that
a credit report be furnished, that relates to a consumer in
connection with a credit or insurance transaction not initiated by
a consumer, if the requirements of 15 USC 1681b(c) are met
(h) A person that administers a credit file monitoring
subscription service to which a consumer or protected consumer has
subscribed.
(i) A person that provides a consumer or the consumer's
representative with a copy of the consumer's credit report on
request of the consumer or the representative.
(j) To the extent not prohibited by another law of this state,
a person engaged solely in setting or adjusting an insurance rate,
adjusting an insurance claim, or underwriting an insurance risk.
(k) A check services or fraud prevention services company that
issues any of the following:
(i) Reports on incidents of fraud.
(ii) Authorizations for the purpose of approving or processing
negotiable instruments, electronic funds transfers, or similar
payment methods.
(l) A deposit account information service company that issues
reports regarding account closures due to fraud, substantial
overdrafts, or automated teller machine abuse or provides similar
information regarding a consumer to inquiring banks or other
financial institutions for use only in reviewing a consumer request
for a deposit account at the inquiring bank or financial
institution.
(m) A consumer reporting agency database or file that consists
entirely of consumer information concerning, and used solely for, 1
or more of the following:
(i) Criminal record information.
(ii) Personal loss history information.
(iii) Fraud prevention or detection.
(iv) Employment screening.
(v) Tenant screening.
(n) A consumer reporting agency that meets both of the
following:
(i) It is only engaged in reselling resell credit information
by assembling and merging information contained in a database of 1
or more consumer reporting agencies.
(ii) It does not maintain a permanent database of credit
information it obtains for purposes of subparagraph (i).
Sec. 4. Article 3 does not apply to any of the following
entities or uses:
(a) A person that is acting under a court order, warrant, or
subpoena.
(b) A person that administers a credit file monitoring
subscription service to which a consumer or protected consumer has
subscribed.
(c) A person that provides a consumer or the consumer's
representative with a copy of the consumer's credit report on
request of the consumer or the representative.
(d) A check services or fraud prevention services company that
issues any of the following:
(i) Reports on incidents of fraud.
(ii) Authorizations for the purpose of approving or processing
negotiable instruments, electronic funds transfers, or similar
payment methods.
(e) A deposit account information service company that issues
reports regarding account closures due to fraud, substantial
overdrafts, or automated teller machine abuse or provides similar
information regarding a consumer to inquiring banks or other
financial institutions for use only in reviewing a consumer request
for a deposit account at the inquiring bank or financial
institution.
(f) A consumer reporting agency database or file that consists
entirely of consumer information concerning, and used solely for, 1
or more of the following:
(i) Criminal record information.
(ii) Personal loss history information.
(iii) Fraud prevention or detection.
(iv) Employment screening.
(v) Tenant screening.
(g) A consumer reporting agency that meets both of the
following:
(i) It is only engaged in reselling resell credit information
by assembling and merging information contained in a database of 1
or more consumer reporting agencies.
(ii) It does not maintain a permanent database of credit
information it obtains for purposes of subparagraph (i).
ARTICLE 2
Sec. 11. (1) A consumer reporting agency shall place a
security freeze on a consumer's credit report if all of the
following are met:
(a) The consumer reporting agency receives a request from the
consumer for the placement of the security freeze under this act.
(b) The consumer does all of the following:
(i) Submits the request described in subdivision (a) to the
consumer reporting agency at the address or other point of contact
and in the manner specified by the consumer reporting agency.
(ii) Provides to the consumer reporting agency sufficient proof
of identification of the consumer.
(iii) Pays to the consumer reporting agency the appropriate fee
under section 31.
(2) Within 5 business days after receiving a request that
meets the requirements of subsection (1), a consumer reporting
agency shall place a security freeze for the consumer.
Sec. 12. Within 5 business days after placing a security
freeze on a consumer's credit report under section 11, the consumer
reporting agency shall do all of the following:
(a) Send a written confirmation of the security freeze to the
consumer.
(b) Provide the consumer with a unique personal identification
number or password to be used by the consumer when authorizing the
release of the consumer's credit report to a specific person or for
a specific period of time.
(c) Provide the consumer with a written statement of the
procedures for requesting the consumer reporting agency to remove
or temporarily lift a security freeze.
Sec. 13. Except as provided in section 14, if a security
freeze is in place, a consumer reporting agency may not release a
consumer's credit report or any information derived from a
consumer's credit report without the express prior authorization of
the consumer.
Sec. 14. (1) A consumer who does all of the following may
temporarily lift a security freeze to allow access to the
consumer's credit report by a specific person or for a specific
period of time while the security freeze is in place:
(a) Contacts the consumer reporting agency at the address or
other point of contact and in the manner specified by the consumer
reporting agency for making a request under subdivision (b).
(b) Requests that the consumer reporting agency temporarily
lift the security freeze.
(c) Provides to the consumer reporting agency sufficient proof
of identification of the consumer.
(d) Includes with the request under subdivision (b) the unique
personal identification number or password provided to the consumer
under section 12(b).
(e) Provides the proper information regarding the person that
is to receive the credit report or the time period during which the
credit report is to be available to users of the credit report.
(f) Pays the appropriate fee under section 31.
(2) Except as provided in subsection (3), a consumer reporting
agency that receives a request to temporarily lift a security
freeze under subsection (1) shall comply with the request within 3
business days after receiving the request.
(3) If a consumer reporting agency receives a request to
temporarily lift a security freeze under subsection (1) by
telephone, by electronic mail, or by secure connection on the
website of the consumer reporting agency, the consumer reporting
agency shall comply with the request within 15 minutes after
receiving the request. However, a consumer reporting agency is not
required to temporarily lift a security freeze within 15 minutes if
a delay in complying with the request is caused by any of the
following:
(a) An act of God, including, but not limited to, a fire,
earthquake, hurricane, storm, or similar natural disaster or
phenomena.
(b) An unauthorized or illegal act by a third party,
including, but not limited to, an act of terrorism, sabotage, riot,
or vandalism, a labor strike or other labor dispute that disrupts
the consumer reporting agency's operations, or a similar
occurrence.
(c) An interruption of the consumer reporting agency's
operations, including, but not limited to, an electrical failure,
an unanticipated delay in equipment or replacement part delivery, a
computer hardware or software failure that inhibits response time,
or a similar disruption.
(d) Governmental action, including, but not limited to, an
emergency order or regulation, judicial or law enforcement action,
or a similar directive.
(e) Regularly scheduled maintenance of, or updates to, the
consumer reporting agency's systems that occurs outside of normal
business hours.
(f) Commercially reasonable maintenance of, or repair to, the
consumer reporting agency's systems that is unexpected or
unscheduled.
Sec. 15. If, in connection with an application for credit or
for any other use, a person requests access to a consumer's credit
report while a security freeze is in place and the consumer does
not authorize access to the consumer's credit report, the person
may treat the application as incomplete.
Sec. 16. A security freeze on a consumer's credit report shall
remain in place until 1 of the following occurs:
(a) The freeze is temporarily lifted at the consumer's request
under section 14.
(b) The freeze is removed at the consumer's request under
section 17.
(c) The freeze is removed by the consumer reporting agency
because the freeze was placed based on a material misrepresentation
of fact by the consumer. However, if a consumer reporting agency
intends to remove a security freeze under this subdivision, the
consumer reporting agency must notify the consumer in writing of
its intent at least 5 business days before removing the security
freeze.
Sec. 17. (1) A consumer reporting agency shall remove a
security freeze on a consumer's credit report if the consumer does
all of the following:
(a) Contacts the consumer reporting agency at the address or
other point of contact and in the manner specified by the consumer
reporting agency for making a request to remove a security freeze.
(b) Requests the removal of the security freeze on his or her
credit report.
(c) Provides to the consumer reporting agency sufficient proof
of identification of the consumer.
(d) Includes with the request under subdivision (b) the unique
personal identification number or password provided to the consumer
under section 12(b).
(e) Pays the appropriate fee under section 31.
(2) A consumer reporting agency that receives a request for
removal of a security freeze under subsection (1) shall comply with
the request within 3 business days after receiving the request.
ARTICLE 3
Sec. 21. (1) A consumer reporting agency shall place a
security freeze on a protected consumer's credit report if all of
the following are met:
(a) The consumer reporting agency receives a request from the
representative of the protected consumer for the placement of the
security freeze.
(b) The protected consumer's representative does all of the
following:
(i) Submits the request to the consumer reporting agency at the
address or other point of contact and in the manner specified by
the consumer reporting agency.
(ii) Provides to the consumer reporting agency sufficient proof
of identification for the protected consumer and the
representative.
(iii) Provides to the consumer reporting agency his or her
sufficient proof of authority.
(iv) Pays to the consumer reporting agency the appropriate fee
under section 31.
(2) If a consumer reporting agency does not have a file
pertaining to a protected consumer when the consumer reporting
agency receives a request under subsection (1), the consumer
reporting agency shall create a record for the protected consumer.
(3) Within 30 days after receiving a request that meets the
requirements of subsection (1), a consumer reporting agency shall
place a security freeze for the protected consumer.
Sec. 22. (1) If a security freeze is in place, a consumer
reporting agency may not release a protected consumer's credit
report, any information derived from the protected consumer's
credit report, or any record created for the protected consumer.
(2) A security freeze for a protected consumer shall remain in
effect until 1 of the following is met:
(a) The protected consumer or the protected consumer's
representative requests the consumer reporting agency to remove the
security freeze under section 23.
(b) The security freeze is removed under section 24.
Sec. 23. A consumer reporting agency shall remove a security
freeze for a protected consumer placed under section 21 within 30
days after the protected consumer or the protected consumer's
representative does all of the following:
(a) Submits a request for the removal of the security freeze
to the consumer reporting agency at the address or other point of
contact and in the manner specified by the consumer reporting
agency.
(b) Provides 1 of the following to the consumer reporting
agency:
(i) If the request for removal is submitted by the protected
consumer, all of the following:
(A) Proof that the sufficient proof of authority for the
protected consumer's representative to act on behalf of the
protected consumer is no longer valid.
(B) Sufficient proof of identification of the protected
consumer.
(ii) If the request for removal is submitted by the
representative of a protected consumer, all of the following:
(A) Sufficient proof of identification of the protected
consumer and the representative.
(B) Sufficient proof of authority to act on behalf of the
protected consumer.
(c) Pays the consumer reporting agency the appropriate fee
under section 31.
Sec. 24. Within 30 days after receiving a request that meets
the requirements of section 23, a consumer reporting agency shall
remove a security freeze for the protected consumer.
Sec. 25. A consumer reporting agency may remove a security
freeze for a protected consumer or delete a record of a protected
consumer if the security freeze was placed or the record was
created based on a material misrepresentation of fact by the
protected consumer or the protected consumer's representative.
ARTICLE 4
Sec. 31. (1) A consumer reporting agency may charge the
following fees:
(a) Subject to subsection (2), a fee that does not exceed
$10.00 for the placement, temporary lifting, or removal of a
security freeze for a consumer under article 2.
(b) Subject to subsection (3), a fee that does not exceed
$10.00 for the placement or removal of a security freeze for a
protected consumer under article 3, charged to a protected consumer
or his or her representative.
(2) A consumer reporting agency may not charge a fee
authorized under subsection (1)(a) to a consumer for the placement,
temporary lifting, or removal of a security freeze for a consumer
under article 2 if the consumer has filed a police report of
alleged identity theft against the consumer under section 4a, 33b,
or 64a of the William Van Regenmorter crime victim's rights act,
1985 PA 87, MCL 780.754a, 780.783b, and 780.814a, and provides a
copy of the report to the consumer reporting agency.
(3) A consumer reporting agency may not charge a fee
authorized under subsection (1)(b) if either of the following are
met:
(a) The protected consumer or his or her representative has
filed a police report of alleged identity theft against the
protected consumer under section 4a, 33b, or 64a of the William Van
Regenmorter crime victim's rights act, 1985 PA 87, MCL 780.754a,
780.783b, and 780.814a, and provides a copy of the report to the
consumer reporting agency.
(b) The request for the placement or removal of a security
freeze is for a protected consumer who is under the age of 16 years
at the time of the request and the consumer reporting agency has a
credit report pertaining to the protected consumer.
Sec. 32. The attorney general may apply to the circuit court
for Ingham county, or to the circuit court for the county in which
a violation of this act is alleged to have occurred or in which the
person that allegedly violated this act resides or is located, for
injunctive or other appropriate judicial relief or remedy. However,
this act does not create a private cause of action for a violation
of this act.
Enacting section 1. This act takes effect January 1, 2014.
