ENROLLED
       2014 Legislature                     CS for CS for CS for SB 242
       
       
       
       
       
       
                                                              2014242er
    1  
    2         An act relating to the security of a protected
    3         consumer’s information; providing a short title;
    4         creating s. 501.0051, F.S.; providing definitions;
    5         authorizing the representative of a protected consumer
    6         to place a security freeze on a protected consumer’s
    7         consumer report or record; specifying the procedure to
    8         request a security freeze; requiring a consumer
    9         reporting agency to establish a record if the
   10         protected consumer does not have an existing consumer
   11         report; prohibiting the use of a consumer record for
   12         certain purposes; requiring a consumer reporting
   13         agency to place, and to provide written confirmation
   14         of, a security freeze within a specified period;
   15         prohibiting a consumer reporting agency from stating
   16         or implying that a security freeze reflects a negative
   17         credit history or rating; requiring a consumer
   18         reporting agency to remove a security freeze under
   19         specified conditions; specifying the procedure to
   20         remove a security freeze; providing applicability;
   21         authorizing a consumer reporting agency to charge a
   22         fee for placing or removing a security freeze and for
   23         reissuing a unique personal identifier; prohibiting a
   24         fee under certain circumstances; requiring written
   25         notification upon the change of specified information
   26         in a protected consumer’s consumer report or record;
   27         providing exceptions; requiring a consumer reporting
   28         agency to notify a representative and provide
   29         specified information if the consumer reporting agency
   30         violates a security freeze; requiring the Department
   31         of Agriculture and Consumer Services to investigate
   32         complaints regarding the violation of a security
   33         freeze; providing penalties and civil remedies for the
   34         violation of a security freeze; providing written
   35         disclosure requirements for consumer reporting
   36         agencies relating to a protected consumer’s security
   37         freeze; providing an effective date.
   38          
   39  Be It Enacted by the Legislature of the State of Florida:
   40  
   41         Section 1. This act may be cited as the “Keeping I.D. Safe
   42  (KIDS) Act.”
   43         Section 2. Section 501.0051, Florida Statutes, is created
   44  to read:
   45         501.0051 Protected consumer report security freeze.—
   46         (1) As used in this section, the term:
   47         (a) “Consumer report” has the same meaning as provided in
   48  15 U.S.C. s. 1681a(d).
   49         (b) “Consumer reporting agency” has the same meaning as
   50  provided in 15 U.S.C. s. 1681a(f).
   51         (c) “Protected consumer” means a person younger than 16
   52  years of age at the time a security freeze request is made or a
   53  person represented by a guardian or other advocate pursuant to
   54  chapter 39, chapter 393, chapter 744, or chapter 914.
   55         (d) “Record” means a compilation of information that:
   56         1. Identifies a protected consumer; and
   57         2. Is created by a consumer reporting agency exclusively
   58  for the purpose of complying with this section.
   59         (e) “Representative” means the parent or legal guardian of
   60  a protected consumer, including a guardian appointed pursuant to
   61  s. 914.17.
   62         (f) “Security freeze” means:
   63         1. A notice placed on a protected consumer’s consumer
   64  report which prohibits a consumer reporting agency from
   65  releasing the consumer report, the credit score, or any
   66  information contained within the consumer report to a third
   67  party without the express authorization of the representative;
   68  or
   69         2. If a consumer reporting agency does not have a consumer
   70  report pertaining to a protected consumer, a notice placed on a
   71  protected consumer’s record which prohibits the consumer
   72  reporting agency from releasing the protected consumer’s record
   73  except as provided in this section.
   74         (g) “Sufficient proof of authority” means documentation
   75  showing that a representative has authority to act on behalf of
   76  a protected consumer. The term includes, but is not limited to,
   77  a court order, a copy of a valid power of attorney, or a written
   78  notarized statement signed by the representative which expressly
   79  describes the authority of the representative to act on behalf
   80  of the protected consumer. A representative who is a parent may
   81  establish sufficient proof of authority by providing a certified
   82  or official copy of the protected consumer’s birth certificate.
   83         (h) “Sufficient proof of identification” means
   84  documentation identifying a protected consumer or a
   85  representative. The term includes, but is not limited to, a copy
   86  of a social security card, a certified or official copy of a
   87  birth certificate, a copy of a valid driver license, or a copy
   88  of a government-issued photo identification.
   89         (2) A representative may place a security freeze on a
   90  protected consumer’s consumer report by:
   91         (a) Submitting a request to a consumer reporting agency in
   92  the manner prescribed by that agency;
   93         (b) Providing the agency with sufficient proof of authority
   94  and sufficient proof of identification of the representative;
   95  and
   96         (c) Paying the agency a fee as authorized under this
   97  section.
   98         (3) If a consumer reporting agency does not have a consumer
   99  report pertaining to a protected consumer when the consumer
  100  reporting agency receives a request for a security freeze under
  101  subsection (2), the consumer reporting agency shall create a
  102  record for the protected consumer and place a security freeze on
  103  the record. A record may not be created or used to consider the
  104  protected consumer’s credit worthiness, credit standing, credit
  105  capacity, character, general reputation, personal
  106  characteristics, or eligibility for other financial services.
  107         (4) A consumer reporting agency shall place a security
  108  freeze on a consumer report or record within 30 days after
  109  confirming the authenticity of a security freeze request made in
  110  accordance with this section.
  111         (5) The consumer reporting agency shall send a written
  112  confirmation of the security freeze to the representative within
  113  10 business days after instituting the security freeze on the
  114  consumer report or record and shall provide the representative
  115  with instructions for removing the security freeze and a unique
  116  personal identifier to be used by the representative when
  117  providing authorization for removal of the security freeze.
  118         (6) A consumer reporting agency may not state or imply to
  119  any person that a security freeze reflects a negative credit
  120  score, a negative credit history, or a negative credit rating.
  121         (7) A consumer reporting agency shall remove a security
  122  freeze from a protected consumer’s consumer report or record
  123  only under either of the following circumstances:
  124         (a) Upon the request of a representative or a protected
  125  consumer. A consumer reporting agency shall remove a security
  126  freeze within 30 days after receiving a request for removal from
  127  a protected consumer or his or her representative.
  128         1. A representative submitting a request for removal must
  129  provide all of the following:
  130         a. Sufficient proof of identification of the representative
  131  and sufficient proof of authority as determined by the consumer
  132  reporting agency.
  133         b. The unique personal identifier provided by the consumer
  134  reporting agency pursuant to subsection (5).
  135         c. A fee as authorized under this section.
  136         2. A protected consumer submitting a request for removal
  137  must provide all of the following:
  138         a. Sufficient proof of identification of the protected
  139  consumer as determined by the consumer reporting agency.
  140         b. Documentation that the sufficient proof of authority of
  141  the protected consumer’s representative to act on behalf of the
  142  protected consumer is no longer valid.
  143         c. A fee as authorized under this section.
  144         (b) If the security freeze was instituted due to a material
  145  misrepresentation of fact. A consumer reporting agency that
  146  intends to remove a security freeze under this paragraph shall
  147  notify the representative and protected consumer in writing
  148  before removing the security freeze.
  149         (8) This section does not apply to the use of a protected
  150  consumer’s consumer report or record by the following persons or
  151  for the following reasons:
  152         (a) A state agency acting within its lawful investigative
  153  or regulatory authority.
  154         (b) A state or local law enforcement agency investigating a
  155  crime or conducting a criminal background check.
  156         (c) A person administering a credit file monitoring
  157  subscription service to which the protected consumer or the
  158  representative, on behalf of the protected consumer, has
  159  subscribed.
  160         (d) A person providing the protected consumer’s consumer
  161  report or record to the protected consumer or representative
  162  upon the request of the protected consumer or representative.
  163         (e) Pursuant to a court order lawfully entered.
  164         (f) An insurance company for use in setting or adjusting a
  165  rate, adjusting a claim, or underwriting for insurance purposes.
  166         (g) A consumer reporting agency’s database or file that
  167  consists entirely of information concerning, and used
  168  exclusively for, one or more of the following:
  169         1. Criminal record information.
  170         2. Personal loss history information.
  171         3. Fraud prevention or detection.
  172         4. Tenant screening.
  173         5. Employment screening.
  174         6. Personal insurance policy information.
  175         7. Noncredit information used for insurance purposes.
  176         (h) A check services company issuing authorizations for the
  177  purpose of approving or processing negotiable instruments,
  178  electronic funds transfers, or similar methods of payment.
  179         (i) A deposit account information service company issuing
  180  reports regarding account closures due to fraud, substantial
  181  overdrafts, automatic teller machine abuse, or similar negative
  182  information regarding a protected consumer to an inquiring
  183  financial institution, as defined in s. 655.005 or in federal
  184  law, for use only in reviewing a representative’s request for a
  185  deposit account for the protected consumer at the inquiring
  186  financial institution.
  187         (j) A consumer reporting agency that acts only as a
  188  reseller of credit information by assembling and merging
  189  information contained in the database of another consumer
  190  reporting agency or multiple consumer reporting agencies and
  191  that does not maintain a permanent database of credit
  192  information from which new consumer reports are produced.
  193  However, such consumer reporting agency shall honor any security
  194  freeze placed or removed by another consumer reporting agency.
  195         (k) A fraud prevention services company issuing reports to
  196  prevent or investigate fraud.
  197         (l) A person or entity, or its affiliates, or a collection
  198  agency acting on behalf of the person or entity, with which the
  199  protected consumer has an existing account, requesting
  200  information in the protected consumer’s consumer report or
  201  record for the purposes of reviewing or collecting the account.
  202  Reviewing the account includes activities related to account
  203  maintenance, monitoring, credit line increases, and account
  204  upgrades and enhancements.
  205         (9)(a) A consumer reporting agency may charge a reasonable
  206  fee, not to exceed $10, to place or remove a security freeze.
  207         (b) A consumer reporting agency may also charge a
  208  reasonable fee, not to exceed $10, if the representative fails
  209  to retain the original unique personal identifier provided by
  210  the consumer reporting agency and the agency must reissue the
  211  unique personal identifier or provide a new unique personal
  212  identifier to the representative.
  213         (c) A consumer reporting agency may not charge a fee under
  214  this section to the representative of a protected consumer who
  215  is a victim of identity theft if the representative submits, at
  216  the time the security freeze is requested, a copy of a valid
  217  investigative report, an incident report, or a complaint with a
  218  law enforcement agency about the unlawful use of the protected
  219  consumer’s identifying information by another person.
  220         (10) If a security freeze is in effect, a consumer
  221  reporting agency must send written confirmation to a protected
  222  consumer’s representative of a change to any of the following
  223  official information in the protected consumer’s consumer report
  224  or record within 30 days after the change is posted:
  225         (a) The protected consumer’s name.
  226         (b) The protected consumer’s address.
  227         (c) The protected consumer’s date of birth.
  228         (d) The protected consumer’s social security number.
  229  
  230  Written confirmation is not required for technical corrections
  231  of a protected consumer’s official information, including name
  232  and street abbreviations, complete spellings, or transposition
  233  of numbers or letters. In the case of an address change, the
  234  written confirmation must be sent to the representative and to
  235  the protected consumer’s new address and former address.
  236         (11) If a consumer reporting agency violates a security
  237  freeze placed in accordance with this section by releasing
  238  information subject to a security freeze without proper
  239  authorization, the consumer reporting agency shall, within 5
  240  business days after discovering or being notified of the release
  241  of information, notify the representative of the protected
  242  consumer in writing. The notice must state the specific
  243  information released and provide the name, address, and other
  244  contact information of the recipient of the information.
  245         (12) The Department of Agriculture and Consumer Services
  246  shall investigate any complaints received concerning violations
  247  of this section. If, after investigating any complaint, the
  248  department finds that there has been a violation of this
  249  section, the department may bring an action to impose an
  250  administrative penalty. A consumer reporting agency that
  251  willfully fails to comply with any requirement imposed under
  252  this section is subject to an administrative penalty in the
  253  amount of $500 for each violation, imposed by the department. An
  254  administrative proceeding that could result in the entry of an
  255  order imposing an administrative penalty must be conducted in
  256  accordance with chapter 120. The administrative penalty shall be
  257  deposited in the General Inspection Trust Fund.
  258         (13) In addition to any other penalties or remedies
  259  provided under law, persons who are aggrieved by a violation of
  260  this section may bring a civil action as follows:
  261         (a) A person who obtains a protected consumer’s consumer
  262  report or record from a consumer reporting agency under false
  263  pretenses or who knowingly obtains a protected consumer’s
  264  consumer report or record without a permissible purpose is
  265  liable to the representative and protected consumer for actual
  266  damages sustained by the protected consumer or $1,000, whichever
  267  is greater.
  268         (b) A person who obtains a protected consumer’s consumer
  269  report or record from a consumer reporting agency under false
  270  pretenses or who knowingly obtains a protected consumer’s
  271  consumer report or record without a permissible purpose is
  272  liable to the consumer reporting agency for actual damages
  273  sustained by the consumer reporting agency or $1,000, whichever
  274  is greater.
  275         (14) A written disclosure by a consumer reporting agency,
  276  pursuant to 15 U.S.C. s. 1681g, to a representative and
  277  protected consumer residing in this state must include a written
  278  summary of all rights that the representative and protected
  279  consumer have under this section and, in the case of a consumer
  280  reporting agency that compiles and maintains records on a
  281  nationwide basis, a toll-free telephone number that the
  282  representative can use to communicate with the consumer
  283  reporting agency. The information provided in paragraph (b) must
  284  be in at least 12-point boldfaced type. The written summary of
  285  rights required under this section is sufficient if it is
  286  substantially in the following form:
  287         (a) If you are the parent or legal guardian of a minor
  288  younger than 16 years of age or a guardian or advocate of an
  289  incapacitated, disabled, or protected person under chapter 39,
  290  chapter 393, chapter 744, or chapter 914, Florida Statutes, you
  291  have the right to place a security freeze on the consumer report
  292  of the person you are legally authorized to care for. If no
  293  consumer report exists, you have the right to request that a
  294  record be created and a security freeze be placed on the record.
  295  A record with a security freeze is intended to prevent the
  296  opening of credit accounts until the security freeze is removed.
  297         (b) YOU SHOULD BE AWARE THAT USING A SECURITY FREEZE TO
  298  CONTROL ACCESS TO THE PERSONAL AND FINANCIAL INFORMATION IN A
  299  CONSUMER REPORT OR RECORD MAY DELAY, INTERFERE WITH, OR PROHIBIT
  300  THE TIMELY APPROVAL OF ANY SUBSEQUENT REQUEST OR APPLICATION
  301  REGARDING A NEW LOAN, CREDIT, MORTGAGE, INSURANCE, GOVERNMENT
  302  SERVICES OR PAYMENTS, RENTAL HOUSING, EMPLOYMENT, INVESTMENT,
  303  LICENSE, CELLULAR PHONE, UTILITIES, DIGITAL SIGNATURE, INTERNET
  304  CREDIT CARD TRANSACTION, OR OTHER SERVICES, INCLUDING AN
  305  EXTENSION OF CREDIT AT POINT OF SALE.
  306         (c) To remove the security freeze on the protected
  307  consumer’s record or report, you must contact the consumer
  308  reporting agency and provide all of the following:
  309         1. Proof of identification as required by the consumer
  310  reporting agency.
  311         2. Proof of authority over the protected consumer as
  312  required by the consumer reporting agency.
  313         3. The unique personal identifier provided by the consumer
  314  reporting agency.
  315         4. Payment of a fee.
  316         (d) A consumer reporting agency must, within 30 days after
  317  receiving the above information, authorize the removal of the
  318  security freeze.
  319         (e) A security freeze does not apply to a person or entity,
  320  or its affiliates, or a collection agency acting on behalf of
  321  the person or entity, with which the protected consumer has an
  322  existing account, which requests information in the protected
  323  consumer’s consumer report or record for the purposes of
  324  reviewing or collecting the account. Reviewing the account
  325  includes activities related to account maintenance, monitoring,
  326  credit line increases, and account upgrades and enhancements.
  327         (f) You have the right to bring a civil action as
  328  authorized by section 501.0051, Florida Statutes, which governs
  329  the security of protected consumer information.
  330         Section 3. This act shall take effect September 1, 2014.