Pennsylvania Act 2006-163 — CREDIT REPORTING AGENCY ACT

Act text

CREDIT REPORTING AGENCY ACT
                 Act of Nov. 29, 2006, P.L. 1463, No. 163             Cl. 13
                                  AN ACT

     Providing for protection from identity theft, for security
        freezes, for procedures for access after imposition and
        removal of security freezes and for related matters.

        The General Assembly of the Commonwealth of Pennsylvania
     hereby enacts as follows:

     Section 1.  Short title.
        This act shall be known and may be cited as the Credit
     Reporting Agency Act.
     Section 2.  Definitions.
        The following words and phrases when used in this act shall
     have the meanings given to them in this section unless the
     context clearly indicates otherwise:
        "Consumer."  An individual.
        "Consumer report."  A written, oral or other communication of
     any information by a consumer reporting agency bearing on a
     consumer's creditworthiness, credit standing or credit capacity.
        "Consumer reporting agency."  Any person who, for monetary
     fees, dues or on a cooperative basis, regularly engages in whole
     or in part in the practice of assembling or evaluating consumer
     credit information or other information on consumers for the
     purpose of furnishing consumer reports to third parties.
        "Security freeze."  A notice placed on a consumer report, at
     the request of the consumer and subject to certain exceptions,
     that prohibits a consumer reporting agency from releasing the
     consumer report without the express authorization of the
     consumer.
     Section 3.  Security freeze.
        (a)  Request for freeze.--
            (1)  A consumer may elect to place a security freeze on
        his consumer report by providing proper identification to a
        consumer reporting agency. The consumer may make the request
        directly to a consumer reporting agency:
                (i)  by certified mail using an address designated by
            the consumer reporting agency; or
                (ii)  through a secure Internet connection if the
            connection is made available by the consumer reporting
            agency.
            (2)  Each consumer reporting agency covered by this act
        shall have a toll-free telephone number available to allow a
        consumer to receive information about how to request a
        security freeze, which the consumer must return by certified
        mail.
            (3)  A consumer reporting agency shall place a security
        freeze on a consumer report no later than five business days
        after receiving a request for the security freeze from the
        consumer.
            (4)  The following entities are not required to place a
        security freeze in a consumer report:
                (i)  A credit reporting agency that acts only as a
            reseller of credit information by assembling and merging
            information contained in the database of another credit
            reporting agency or multiple credit reporting agencies
            and does not maintain a permanent database of credit
            information from which new credit reports are produced;
            however, a credit reporting agency acting as a reseller
            shall honor any security freeze placed on a credit report
            by another credit reporting agency.
                (ii)  A check services or fraud prevention services
            company which issues reports on incidents of fraud or
            authorizations for the purpose of approving or processing
            negotiable instruments, electronic funds transfers or
            similar methods of payments.
                (iii)  A deposit account information service company
            which issues reports regarding account closures due to
            fraud, substantial overdrafts, automated teller machine
            (ATM) abuse or similar negative information regarding a
            consumer to inquiring banks or other financial
            institutions for use only in reviewing a consumer request
            for a deposit account at the inquiring bank or financial
            institution.
        (b)  Effect of security freeze.--Except as provided in
     subsection (e), when a security freeze is in place, information
     from a consumer report shall not be released to a third party
     without prior express authorization from the consumer. This
     subsection shall not prevent a consumer reporting agency from
     advising a third party that a security freeze is in effect with
     respect to a consumer report.
        (c)  Third-party request.--If a third party requests access
     to a consumer report on which a security freeze is in effect and
     the consumer does not allow his or her consumer report to be
     accessed for that specific party or for a period of time, the
     third party shall treat the application as incomplete.
        (d)  Duration of freeze.--A security freeze shall remain in
     place until the earlier of the date the consumer reporting
     agency receives a request from the consumer to remove the
     security freeze or until seven years from the date that the
     security freeze was put in place by the consumer reporting
     agency.
        (e)  Applicability of freeze.--Notwithstanding a security
     freeze, the following entities may receive a consumer report:
            (1)  A Federal, State or local government entity,
        including a law enforcement agency or court, or their agents
        or assigns.
            (2)  A private collection agency for the sole purpose of
        assisting in the collection of an existing debt of the
        consumer who is the subject of the consumer report requested.
            (3)  A person or entity or a subsidiary, affiliate or
        agent of that person or entity, or an assignee of a financial
        obligation owed by the consumer to that person or entity, or
        a prospective assignee of a financial obligation owed by the
        consumer to that person or entity in conjunction with the
        proposed purchase of the financial obligation, with which the
        consumer has or had prior to assignment an account or
        contract, including a demand deposit account, or to whom the
        consumer issued a negotiable instrument, for the purposes of
        reviewing the account or collecting the financial obligation
        owing for the account, contract or negotiable instrument. For
        purposes of this paragraph, "reviewing the account" includes
        activities related to account maintenance, monitoring, credit
        line increases and account upgrades and enhancements.
            (4)  A subsidiary, affiliate, agent, assignee or
        prospective assignee of a person to whom access has been
        granted under this section for the purposes of facilitating
        the extension of credit.
            (5)  A person, for the purposes of prescreening as
        provided by the Fair Credit Reporting Act (Public Law 91-508,
        15 U.S.C. § 1681 et seq.).
            (6)  A consumer reporting agency for the purposes of
        providing a consumer with a copy of his own consumer report
        on his request.
            (7)  A child support enforcement agency.
            (8)  A consumer reporting agency that acts only as a
        reseller of credit information by assembling and merging
        information contained in the database of another consumer
        reporting agency or multiple consumer reporting agencies and
        does not maintain a permanent database of credit information
        from which new consumer reports are produced. However, a
        consumer reporting agency acting as a reseller shall honor
        any security freeze placed on a consumer report by another
        consumer reporting agency.
            (9)  A check services or fraud prevention services
        company which issues reports on incidents of fraud or
        authorizations for the purpose of approving or processing
        negotiable instruments, electronic funds transfers or similar
        methods of payments.
            (10)  A deposit account information service company which
        issues reports regarding account closures due to fraud,
        substantial overdrafts, automated teller machine (ATM) abuse
        or similar negative information regarding a consumer to
        inquiring banks or other financial institutions for use only
        in reviewing a consumer request for a deposit account at the
        inquiring bank or financial institution.
            (11)  Any person or entity for use in setting or
        adjusting a rate, issuing or underwriting a policy, adjusting
        a claim or servicing a policy for underwriting for property
        and casualty insurance purposes.
            (12)  A person or entity administering a credit file
        monitoring subscription service or similar service to which
        the consumer has subscribed.
     Section 4.  Consumer reporting agency.
        The consumer reporting agency shall, no later than ten
     business days after the date the agency receives a request from
     a consumer for a security freeze, send the consumer a written
     confirmation that provides the consumer with a unique personal
     identification number or password to be used by the consumer
     when providing authorization for the access to his consumer
     report for a specific period of time or for a specific third
     party or removing the security freeze. In addition, the consumer
     reporting agency shall simultaneously provide to the consumer in
     writing notification of the process of removing a security
     freeze and the process of temporarily lifting a security freeze
     and the process for allowing access to information from the
     consumer report for a specific party or for a specific period
     while the security freeze is in effect.
     Section 5.  Personal identification.
        A consumer may request in writing a replacement personal
     identification number or password. The request must comply with
     the requirements for requesting a security freeze under section
     3. The consumer reporting agency shall, no later than ten
     business days after the date the agency receives the request for
     a replacement personal identification number or password,
     provide the consumer with a new, unique personal identification
     number or password to be used by the consumer instead of the
     number or password that was provided under section 4.
     Section 6.  Notification of freeze.
        A consumer reporting agency shall notify a person who
     requests a consumer report if a security freeze is in effect for
     the consumer report requested.
     Section 7.  Temporary access or removal of security freeze.
        (a)  Request.--If the consumer wishes to allow his consumer
     report to be accessed for a specific period of time or by a
     specific third party while a security freeze is in place or to
     remove a security freeze, he shall be able to contact the
     consumer reporting agency by certified mail or by a toll-free
     telephone number which shall be provided by the consumer
     reporting agency and may be able to contact the consumer
     reporting agency through a secure Internet connection which may
     be established by the consumer reporting agency and request that
     the security freeze be temporarily lifted or removed and provide
     all of the following:
            (1)  Proper identification.
            (2)  The unique personal identification number or
        password provided by the consumer reporting agency pursuant
        to this act.
            (3)  One of the following:
                (i)  The proper information regarding the time period
            for which the consumer report shall be available to any
            person.
                (ii)  The proper information regarding the third
            party who is to receive the consumer report.
                (iii)  A request that the security freeze be removed.
        (b)  Agency requirement.--A consumer reporting agency that
     receives a request from a consumer pursuant to subsection (a)
     shall comply with the request no later than three business days
     after receiving the request.
        (c)  Removal of security freeze.--A consumer reporting agency
     shall temporarily lift or remove a security freeze placed on a
     consumer report only in the following cases:
            (1)  Upon the consumer's request as provided for in this
        section.
            (2)  If the consumer report was frozen due to a material
        misrepresentation of fact by the consumer or other person. If
        a consumer reporting agency intends to remove a freeze upon a
        consumer report pursuant to this paragraph, the consumer
        reporting agency shall notify the consumer in writing prior
        to removing the freeze on the consumer report.
     Section 8.  Secure procedures.
        In addition to the requirements of this act, a consumer
     reporting agency may develop secure procedures, including, but
     not limited to, the use of the telephone, facsimile, Internet or
     other electronic media, to receive and process a request from a
     consumer to place a security freeze, temporarily lift a security
     freeze or remove a security freeze on a consumer report pursuant
     to this act in an expedited manner.
     Section 9.  Fees.
        (a)  General rule.--A consumer reporting agency may impose a
     reasonable charge on a consumer for initially placing a security
     freeze on a consumer report. The amount of the charge may not
     exceed $10. The charge to temporarily lift the security freeze
     may not exceed $10 per request. At no time shall the consumer be
     charged for removing the freeze.
        (b)  Exceptions.--
            (1)  A consumer will not be charged by a consumer
        reporting agency for placing a security freeze or temporarily
        lifting a security freeze if the consumer is a victim of
        identity theft and provides, or has provided, the consumer
        reporting agency with a copy of a police report.
            (2)  A consumer will not be charged by a consumer
        reporting agency for placing a security freeze if the
        consumer is 65 years of age or older.
        (c)  Confirmation required.--If a security freeze is in
     place, a consumer reporting agency shall not change any of the
     following information regarding a consumer without sending a
     written confirmation of the change to the consumer within 30
     days of the change being posted:
            (1)  Name.
            (2)  Date of birth.
            (3)  Social Security number.
            (4)  Address.
     Written confirmation is not required for technical modifications
     of a consumer's official information, including name and street
     abbreviations, complete spellings or transposition of numbers or
     letters. In the case of an address change, the written
     confirmation shall be sent to both the new address and to the
     former address.
     Section 10.  Civil relief.
        A violation of this act shall be deemed to be an unfair or
     deceptive act or practice in violation of the act of December
     17, 1968 (P.L.1224, No.387), known as the Unfair Trade Practices
     and Consumer Protection Law. The Office of Attorney General
     shall have exclusive authority to bring an action under the
     Unfair Trade Practices and Consumer Protection Law for a
     violation of this act.
     Section 11.  Effective date.
        This act shall take effect January 1, 2007.