Florida Senate - 2014 SB 242
By Senator Detert
28-00307-14 2014242__
1 A bill to be entitled
2 An act relating to the security of a protected
3 consumer’s information; creating s. 501.0051, F.S.;
4 providing definitions; authorizing the representative
5 of a protected consumer to place a security freeze on
6 a protected consumer’s consumer report or record;
7 specifying the procedure to request a security freeze;
8 requiring a consumer reporting agency to establish a
9 record if the protected consumer does not have an
10 existing consumer report; prohibiting the use of a
11 consumer record for certain purposes; providing that a
12 security freeze on a consumer record applies to a
13 subsequently created consumer report; requiring a
14 consumer reporting agency to place, and to provide
15 written confirmation of, a security freeze within a
16 specified period; prohibiting a consumer reporting
17 agency from stating or implying that a security freeze
18 reflects a negative credit history or rating;
19 requiring a consumer reporting agency to provide a
20 copy of a consumer report or record to a protected
21 consumer or his or her representative upon request;
22 authorizing a consumer reporting agency to charge a
23 fee for a copy of a protected consumer’s consumer
24 report or record; specifying the procedure to request
25 a copy of a protected consumer’s consumer report or
26 record; requiring a consumer reporting agency to
27 remove a security freeze under specified conditions;
28 specifying the procedure to remove a security freeze;
29 providing applicability; authorizing a consumer
30 reporting agency to charge a fee for placing or
31 removing a security freeze and for reissuing a unique
32 personal identifier; prohibiting a fee under certain
33 circumstances; requiring written notification upon the
34 change of specified information in a protected
35 consumer’s consumer report or record; providing
36 exceptions; requiring a consumer reporting agency to
37 notify a representative and provide specified
38 information if the consumer reporting agency violates
39 a security freeze; providing penalties and civil
40 remedies; providing written disclosure requirements
41 for consumer reporting agencies relating to a
42 protected consumer’s security freeze; providing an
43 effective date.
44
45 Be It Enacted by the Legislature of the State of Florida:
46
47 Section 1. Section 501.0051, Florida Statutes, is created
48 to read:
49 501.0051 Protected consumer report security freeze.—
50 (1) As used in this section, the term:
51 (a) “Consumer report” has the same meaning as provided in
52 15 U.S.C. s. 1681a(d).
53 (b) “Consumer reporting agency” has the same meaning as
54 provided in 15 U.S.C. s. 1681a(f).
55 (c) “Protected consumer” means a person younger than 16
56 years of age at the time a security freeze request is made or a
57 person represented by a guardian or other advocate pursuant to
58 chapter 39, chapter 393, chapter 744, or chapter 914.
59 (d) “Record” means a compilation of information that:
60 1. Identifies a protected consumer; and
61 2. Is created by a consumer reporting agency exclusively
62 for the purpose of complying with this section.
63 (e) “Representative” means the custodial parent or legal
64 guardian of a protected consumer, including a guardian appointed
65 pursuant to s. 914.17.
66 (f) “Security freeze” means:
67 1. A notice placed on a protected consumer’s consumer
68 report which prohibits a consumer reporting agency from
69 releasing the consumer report, the credit score, or any
70 information contained within the consumer report to a third
71 party without the express authorization of the representative;
72 or
73 2. If a consumer reporting agency does not have a consumer
74 report pertaining to the protected consumer, a notice placed on
75 the protected consumer’s record which prohibits the consumer
76 reporting agency from releasing the protected consumer’s record
77 except as provided in this section.
78 (g) “Sufficient proof of authority” means documentation
79 showing that a representative has authority to act on behalf of
80 a protected consumer. The term includes, but is not limited to,
81 a court order, a copy of a valid power of attorney, or a written
82 notarized statement signed by a representative which expressly
83 describes the authority of the representative to act on behalf
84 of the protected consumer.
85 (h) “Sufficient proof of identification” means
86 documentation identifying a protected consumer or a
87 representative of a protected consumer. The term includes, but
88 is not limited to, a copy of a social security card, a certified
89 or official copy of a birth certificate, a copy of a valid
90 driver license, or a copy of a government-issued photo
91 identification.
92 (2) A representative may place a security freeze on a
93 protected consumer’s consumer report by:
94 (a) Submitting a request to a consumer reporting agency in
95 the manner prescribed by that agency;
96 (b) Providing the agency with sufficient proof of authority
97 and sufficient proof of identification of the representative;
98 and
99 (c) Paying the agency a fee as authorized under this
100 section.
101 (3) If a consumer reporting agency does not have a consumer
102 report pertaining to a protected consumer when the consumer
103 reporting agency receives a request for a security freeze under
104 subsection (2), the consumer reporting agency shall create a
105 record for the protected consumer and place a security freeze on
106 the record. A record may not be created or used to consider the
107 protected consumer’s credit worthiness, credit standing, credit
108 capacity, character, general reputation, personal
109 characteristics, or eligibility for other financial services. If
110 a consumer report is subsequently created for a protected
111 consumer with a security freeze on his or her consumer record,
112 the consumer report is also subject to a security freeze until
113 the security freeze is removed from the consumer report pursuant
114 to subsection (8).
115 (4) A consumer reporting agency shall place a security
116 freeze on a consumer report or record within 30 days after
117 confirming the authenticity of a security freeze request made in
118 accordance with this section.
119 (5) The consumer reporting agency shall send a written
120 confirmation of the security freeze to the representative within
121 10 business days after instituting the security freeze on the
122 consumer report or record and shall provide the representative
123 with instructions for removing the security freeze and a unique
124 personal identifier to be used by the representative when
125 providing authorization for removal of the security freeze.
126 (6) A consumer reporting agency may not state or imply to
127 any person that a security freeze reflects a negative credit
128 score, a negative credit history, or a negative credit rating.
129 (7) During any period that a security freeze is in effect,
130 a consumer reporting agency shall provide a copy of a protected
131 consumer’s consumer report or record to the protected consumer
132 or his or her representative upon request. A consumer reporting
133 agency may charge the representative or protected consumer a fee
134 for the copy, not to exceed the amount normally charged by such
135 agency to provide a copy of a consumer report.
136 (a) A representative submitting a request for a copy of a
137 protected consumer’s consumer report or record must provide all
138 of the following:
139 1. Sufficient proof of identification of the representative
140 and sufficient proof of authority as determined by the consumer
141 reporting agency.
142 2. The unique personal identifier provided by the consumer
143 reporting agency pursuant to subsection (5).
144 3. A fee as authorized under this section.
145 (b) A protected consumer submitting a request for a copy of
146 his or her consumer report or record must provide sufficient
147 proof of identification of the protected consumer as determined
148 by the consumer reporting agency and pay a fee as authorized
149 under this section.
150 (8) A consumer reporting agency shall remove a security
151 freeze from a protected consumer’s consumer report or record
152 only under either of the following circumstances:
153 (a) Upon the request of a representative or a protected
154 consumer. A consumer reporting agency shall remove a security
155 freeze within 30 days after receiving such a request for removal
156 from a protected consumer or his or her representative.
157 1. A representative submitting a request for removal must
158 provide all of the following:
159 a. Sufficient proof of identification of the representative
160 and sufficient proof of authority as determined by the consumer
161 reporting agency.
162 b. The unique personal identifier provided by the consumer
163 reporting agency pursuant to subsection (5).
164 c. A fee as authorized under this section.
165 2. A protected consumer submitting a request for removal
166 must provide all of the following:
167 a. Sufficient proof of identification of the protected
168 consumer as determined by the consumer reporting agency.
169 b. Documentation that the sufficient proof of authority of
170 the protected consumer’s representative to act on behalf of the
171 protected consumer is no longer valid.
172 (b) If the security freeze was instituted due to a material
173 misrepresentation of fact. If a consumer reporting agency
174 intends to remove a security freeze under this paragraph, the
175 consumer reporting agency must notify the representative and
176 protected consumer in writing before removing the security
177 freeze.
178 (9) This section does not apply to the use of a protected
179 consumer’s consumer report or record by the following persons or
180 for the following reasons:
181 (a) A state agency acting within its lawful investigative
182 or regulatory authority.
183 (b) A state or local law enforcement agency investigating a
184 crime or conducting a criminal background check.
185 (c) A person administering a credit file monitoring
186 subscription service to which the protected consumer or the
187 representative, on behalf of the protected consumer, has
188 subscribed.
189 (d) A person providing the protected consumer’s consumer
190 report or record to the protected consumer or the representative
191 upon the request of the protected consumer or representative.
192 (e) Pursuant to a court order lawfully entered.
193 (f) An insurance company for use in setting or adjusting a
194 rate, adjusting a claim, or underwriting for insurance purposes.
195 (g) A consumer reporting agency’s database or file that
196 consists entirely of information concerning, and used
197 exclusively for, one or more of the following:
198 1. Criminal record information.
199 2. Personal loss history information.
200 3. Fraud prevention or detection.
201 4. Tenant screening.
202 5. Employment screening.
203 6. Personal insurance policy information.
204 7. Noncredit information used for insurance purposes.
205 (h) A check services company issuing authorizations for the
206 purpose of approving or processing negotiable instruments,
207 electronic funds transfers, or similar methods of payment.
208 (i) A deposit account information service company issuing
209 reports regarding account closures due to fraud, substantial
210 overdrafts, automatic teller machine abuse, or similar negative
211 information regarding a protected consumer to an inquiring
212 financial institution, as defined in s. 655.005 or in federal
213 law, for use only in reviewing a representative’s request for a
214 deposit account for the protected consumer at the inquiring
215 financial institution.
216 (j) A consumer reporting agency that acts only as a
217 reseller of credit information by assembling and merging
218 information contained in the database of another consumer
219 reporting agency or multiple consumer reporting agencies and
220 that does not maintain a permanent database of credit
221 information from which new consumer reports are produced.
222 However, such consumer reporting agency shall honor any security
223 freeze placed or removed by another consumer reporting agency.
224 (k) A fraud prevention services company issuing reports to
225 prevent or investigate fraud.
226 (l) A person or entity, or its affiliates, or a collection
227 agency acting on behalf of the person or entity and with which
228 the protected consumer has an existing account, requesting
229 information in the protected consumer’s consumer report or
230 record for the purposes of reviewing or collecting the account.
231 Reviewing the account includes activities related to account
232 maintenance, monitoring, credit line increases, and account
233 upgrades and enhancements.
234 (10)(a) A consumer reporting agency may charge a reasonable
235 fee, not to exceed $10, to a representative who elects to place
236 or remove a security freeze.
237 (b) A consumer reporting agency may charge a reasonable
238 fee, not to exceed $10, if the representative fails to retain
239 the original unique personal identifier provided by the consumer
240 reporting agency and the agency must reissue the unique personal
241 identifier or provide a new unique personal identifier to the
242 representative.
243 (c) A consumer reporting agency may not charge a fee under
244 this section to the representative of a protected consumer who
245 is a victim of identity theft if the representative submits, at
246 the time the security freeze is requested, a copy of a valid
247 investigative report, an incident report, or a complaint with a
248 law enforcement agency about the unlawful use of the protected
249 consumer’s identifying information by another person.
250 (11) If a security freeze is in effect, a consumer
251 reporting agency must send written confirmation to a protected
252 consumer’s representative of a change to any of the following
253 official information in the protected consumer’s consumer report
254 or record within 30 days after the change is posted:
255 (a) The protected consumer’s name.
256 (b) The protected consumer’s address.
257 (c) The protected consumer’s date of birth.
258 (d) The protected consumer’s social security number.
259
260 Written confirmation is not required for technical corrections
261 of a protected consumer’s official information, including name
262 and street abbreviations, complete spellings, or transposition
263 of numbers or letters. In the case of an address change, the
264 written confirmation must be sent to the representative and to
265 the protected consumer’s new address and former address.
266 (12) If a consumer reporting agency violates a security
267 freeze placed in accordance with this section by releasing
268 information subject to a security freeze without proper
269 authorization, the consumer reporting agency shall, within 5
270 business days after discovering or being notified of the release
271 of information, notify the representative of the protected
272 consumer in writing. The notice shall state the specific
273 information released and provide the name, address, and other
274 contact information of the recipient of the information.
275 (13) A consumer reporting agency that willfully fails to
276 comply with any requirement imposed under this section is
277 subject to an administrative fine in the amount of $500, imposed
278 by the Department of Agriculture and Consumer Services pursuant
279 to the administrative procedures established in chapter 120.
280 (14) In addition to any other penalties or remedies
281 provided under law, the following persons who are aggrieved by a
282 violation of this section may bring a civil action as follows:
283 (a) A person who obtains a protected consumer’s consumer
284 report or record from a consumer reporting agency under false
285 pretenses or who knowingly obtains a protected consumer’s
286 consumer report or record without a permissible purpose is
287 liable to the representative and protected consumer for actual
288 damages sustained by the protected consumer or $1,000, whichever
289 is greater.
290 (b) A person who obtains a protected consumer’s consumer
291 report or record from a consumer reporting agency under false
292 pretenses or who knowingly obtains a protected consumer’s
293 consumer report or record without a permissible purpose is
294 liable to the consumer reporting agency for actual damages
295 sustained by the consumer reporting agency or $1,000, whichever
296 is greater.
297 (15) A written disclosure by a consumer reporting agency,
298 pursuant to 15 U.S.C. s. 1681g, to a representative and
299 protected consumer residing in this state must include a written
300 summary of all rights that the representative and protected
301 consumer have under this section and, in the case of a consumer
302 reporting agency that compiles and maintains records on a
303 nationwide basis, a toll-free telephone number that the
304 representative can use to communicate with the consumer
305 reporting agency. The information provided in paragraph (b) must
306 be in at least 12-point boldfaced type. The written summary of
307 rights required under this section is sufficient if it is
308 substantially in the following form:
309 (a) If you are the custodial parent or legal guardian of a
310 minor younger than 16 years of age or a guardian or advocate of
311 an incapacitated, disabled, or protected person under chapter
312 39, chapter 393, chapter 744, or chapter 914, Florida Statutes,
313 you have the right to place a security freeze on the consumer
314 report of the person you are legally authorized to care for. If
315 no consumer report exists, you have the right to request that a
316 record be created and a security freeze be placed on the record.
317 A record with a security freeze is intended to prevent the
318 opening of credit accounts until the security freeze is removed.
319 (b) YOU SHOULD BE AWARE THAT USING A SECURITY FREEZE TO
320 CONTROL ACCESS TO THE PERSONAL AND FINANCIAL INFORMATION IN A
321 CONSUMER REPORT OR RECORD MAY DELAY, INTERFERE WITH, OR PROHIBIT
322 THE TIMELY APPROVAL OF ANY SUBSEQUENT REQUEST OR APPLICATION
323 REGARDING A NEW LOAN, CREDIT, MORTGAGE, INSURANCE, GOVERNMENT
324 SERVICES OR PAYMENTS, RENTAL HOUSING, EMPLOYMENT, INVESTMENT,
325 LICENSE, CELLULAR PHONE, UTILITIES, DIGITAL SIGNATURE, INTERNET
326 CREDIT CARD TRANSACTION, OR OTHER SERVICES, INCLUDING AN
327 EXTENSION OF CREDIT AT POINT OF SALE.
328 (c) To remove the security freeze on the protected
329 consumer’s record or report, you must contact the consumer
330 reporting agency and provide all of the following:
331 1. Proof of identification as required by the consumer
332 reporting agency.
333 2. Proof of authority over the protected consumer as
334 required by the consumer reporting agency.
335 3. The unique personal identifier provided by the consumer
336 reporting agency.
337 4. Payment of a fee.
338 (d) A consumer reporting agency must, within 30 days after
339 receiving the above information, authorize the removal of the
340 security freeze.
341 (e) A security freeze does not apply to a person or entity,
342 or its affiliates, or a collection agency acting on behalf of
343 the person or entity and with which the protected consumer has
344 an existing account, which requests information in the protected
345 consumer’s consumer report or record for the purposes of
346 reviewing or collecting the account. Reviewing the account
347 includes activities related to account maintenance, monitoring,
348 credit line increases, and account upgrades and enhancements.
349 (f) You have the right to bring a civil action against
350 anyone, including a consumer reporting agency, who fails to
351 comply with section 501.0051, Florida Statutes, which governs
352 the placement and removal of a security freeze on a protected
353 consumer’s consumer report or record.
354 Section 2. This act shall take effect September 1, 2014.