Florida Senate - 2014 CS for SB 242
By the Committee on Commerce and Tourism; and Senator Detert
577-00605-14 2014242c1
1 A bill to be entitled
2 An act relating to the security of a protected
3 consumer’s information; providing a short title;
4 creating s. 501.0051, F.S.; providing definitions;
5 authorizing the representative of a protected consumer
6 to place a security freeze on a protected consumer’s
7 consumer report or record; specifying the procedure to
8 request a security freeze; requiring a consumer
9 reporting agency to establish a record if the
10 protected consumer does not have an existing consumer
11 report; prohibiting the use of a consumer record for
12 certain purposes; requiring a consumer reporting
13 agency to place, and to provide written confirmation
14 of, a security freeze within a specified period;
15 prohibiting a consumer reporting agency from stating
16 or implying that a security freeze reflects a negative
17 credit history or rating; requiring a consumer
18 reporting agency to provide a copy of a consumer
19 report or record to a protected consumer or his or her
20 representative upon request; authorizing a consumer
21 reporting agency to charge a fee for a copy of a
22 protected consumer’s consumer report or record;
23 specifying the procedure to request a copy of a
24 protected consumer’s consumer report or record;
25 requiring a consumer reporting agency to remove a
26 security freeze under specified conditions; specifying
27 the procedure to remove a security freeze; providing
28 applicability; authorizing a consumer reporting agency
29 to charge a fee for placing or removing a security
30 freeze and for reissuing a unique personal identifier;
31 prohibiting a fee under certain circumstances;
32 requiring written notification upon the change of
33 specified information in a protected consumer’s
34 consumer report or record; providing exceptions;
35 requiring a consumer reporting agency to notify a
36 representative and provide specified information if
37 the consumer reporting agency violates a security
38 freeze; providing penalties and civil remedies;
39 providing written disclosure requirements for consumer
40 reporting agencies relating to a protected consumer’s
41 security freeze; providing an effective date.
42
43 Be It Enacted by the Legislature of the State of Florida:
44
45 Section 1. This act may be cited as the “Keeping I.D. Safe
46 (KIDS) Act.”
47 Section 2. Section 501.0051, Florida Statutes, is created
48 to read:
49 501.0051 Protected consumer report security freeze.—
50 (1) As used in this section, the term:
51 (a) “Consumer report” has the same meaning as provided in
52 15 U.S.C. s. 1681a(d).
53 (b) “Consumer reporting agency” has the same meaning as
54 provided in 15 U.S.C. s. 1681a(f).
55 (c) “Protected consumer” means a person younger than 16
56 years of age at the time a security freeze request is made or a
57 person represented by a guardian or other advocate pursuant to
58 chapter 39, chapter 393, chapter 744, or chapter 914.
59 (d) “Record” means a compilation of information that:
60 1. Identifies a protected consumer; and
61 2. Is created by a consumer reporting agency exclusively
62 for the purpose of complying with this section.
63 (e) “Representative” means the custodial parent or legal
64 guardian of a protected consumer, including a guardian appointed
65 pursuant to s. 914.17.
66 (f) “Security freeze” means:
67 1. A notice placed on a protected consumer’s consumer
68 report which prohibits a consumer reporting agency from
69 releasing the consumer report, the credit score, or any
70 information contained within the consumer report to a third
71 party without the express authorization of the representative;
72 or
73 2. If a consumer reporting agency does not have a consumer
74 report pertaining to the protected consumer, a notice placed on
75 the protected consumer’s record which prohibits the consumer
76 reporting agency from releasing the protected consumer’s record
77 except as provided in this section.
78 (g) “Sufficient proof of authority” means documentation
79 showing that a representative has authority to act on behalf of
80 a protected consumer. The term includes, but is not limited to,
81 a court order, a copy of a valid power of attorney, or a written
82 notarized statement signed by a representative which expressly
83 describes the authority of the representative to act on behalf
84 of the protected consumer.
85 (h) “Sufficient proof of identification” means
86 documentation identifying a protected consumer or a
87 representative of a protected consumer. The term includes, but
88 is not limited to, a copy of a social security card, a certified
89 or official copy of a birth certificate, a copy of a valid
90 driver license, or a copy of a government-issued photo
91 identification.
92 (2) A representative may place a security freeze on a
93 protected consumer’s consumer report by:
94 (a) Submitting a request to a consumer reporting agency in
95 the manner prescribed by that agency;
96 (b) Providing the agency with sufficient proof of authority
97 and sufficient proof of identification of the representative;
98 and
99 (c) Paying the agency a fee as authorized under this
100 section.
101 (3) If a consumer reporting agency does not have a consumer
102 report pertaining to a protected consumer when the consumer
103 reporting agency receives a request for a security freeze under
104 subsection (2), the consumer reporting agency shall create a
105 record for the protected consumer and place a security freeze on
106 the record. A record may not be created or used to consider the
107 protected consumer’s credit worthiness, credit standing, credit
108 capacity, character, general reputation, personal
109 characteristics, or eligibility for other financial services.
110 (4) A consumer reporting agency shall place a security
111 freeze on a consumer report or record within 30 days after
112 confirming the authenticity of a security freeze request made in
113 accordance with this section.
114 (5) The consumer reporting agency shall send a written
115 confirmation of the security freeze to the representative within
116 10 business days after instituting the security freeze on the
117 consumer report or record and shall provide the representative
118 with instructions for removing the security freeze and a unique
119 personal identifier to be used by the representative when
120 providing authorization for removal of the security freeze.
121 (6) A consumer reporting agency may not state or imply to
122 any person that a security freeze reflects a negative credit
123 score, a negative credit history, or a negative credit rating.
124 (7) During any period that a security freeze is in effect,
125 a consumer reporting agency shall provide a copy of a protected
126 consumer’s consumer report or record to the protected consumer
127 or his or her representative upon request. A consumer reporting
128 agency may charge the representative or protected consumer a fee
129 for the copy, not to exceed the amount normally charged by such
130 agency to provide a copy of a consumer report.
131 (a) A representative submitting a request for a copy of a
132 protected consumer’s consumer report or record must provide all
133 of the following:
134 1. Sufficient proof of identification of the representative
135 and sufficient proof of authority as determined by the consumer
136 reporting agency.
137 2. The unique personal identifier provided by the consumer
138 reporting agency pursuant to subsection (5).
139 3. A fee as authorized under this section.
140 (b) A protected consumer submitting a request for a copy of
141 his or her consumer report or record must provide sufficient
142 proof of identification of the protected consumer as determined
143 by the consumer reporting agency and pay a fee as authorized
144 under this section.
145 (8) A consumer reporting agency shall remove a security
146 freeze from a protected consumer’s consumer report or record
147 only under either of the following circumstances:
148 (a) Upon the request of a representative or a protected
149 consumer. A consumer reporting agency shall remove a security
150 freeze within 30 days after receiving such a request for removal
151 from a protected consumer or his or her representative.
152 1. A representative submitting a request for removal must
153 provide all of the following:
154 a. Sufficient proof of identification of the representative
155 and sufficient proof of authority as determined by the consumer
156 reporting agency.
157 b. The unique personal identifier provided by the consumer
158 reporting agency pursuant to subsection (5).
159 c. A fee as authorized under this section.
160 2. A protected consumer submitting a request for removal
161 must provide all of the following:
162 a. Sufficient proof of identification of the protected
163 consumer as determined by the consumer reporting agency.
164 b. Documentation that the sufficient proof of authority of
165 the protected consumer’s representative to act on behalf of the
166 protected consumer is no longer valid.
167 c. A fee as authorized under this section.
168 (b) If the security freeze was instituted due to a material
169 misrepresentation of fact. If a consumer reporting agency
170 intends to remove a security freeze under this paragraph, the
171 consumer reporting agency must notify the representative and
172 protected consumer in writing before removing the security
173 freeze.
174 (9) This section does not apply to the use of a protected
175 consumer’s consumer report or record by the following persons or
176 for the following reasons:
177 (a) A state agency acting within its lawful investigative
178 or regulatory authority.
179 (b) A state or local law enforcement agency investigating a
180 crime or conducting a criminal background check.
181 (c) A person administering a credit file monitoring
182 subscription service to which the protected consumer or the
183 representative, on behalf of the protected consumer, has
184 subscribed.
185 (d) A person providing the protected consumer’s consumer
186 report or record to the protected consumer or the representative
187 upon the request of the protected consumer or representative.
188 (e) Pursuant to a court order lawfully entered.
189 (f) An insurance company for use in setting or adjusting a
190 rate, adjusting a claim, or underwriting for insurance purposes.
191 (g) A consumer reporting agency’s database or file that
192 consists entirely of information concerning, and used
193 exclusively for, one or more of the following:
194 1. Criminal record information.
195 2. Personal loss history information.
196 3. Fraud prevention or detection.
197 4. Tenant screening.
198 5. Employment screening.
199 6. Personal insurance policy information.
200 7. Noncredit information used for insurance purposes.
201 (h) A check services company issuing authorizations for the
202 purpose of approving or processing negotiable instruments,
203 electronic funds transfers, or similar methods of payment.
204 (i) A deposit account information service company issuing
205 reports regarding account closures due to fraud, substantial
206 overdrafts, automatic teller machine abuse, or similar negative
207 information regarding a protected consumer to an inquiring
208 financial institution, as defined in s. 655.005 or in federal
209 law, for use only in reviewing a representative’s request for a
210 deposit account for the protected consumer at the inquiring
211 financial institution.
212 (j) A consumer reporting agency that acts only as a
213 reseller of credit information by assembling and merging
214 information contained in the database of another consumer
215 reporting agency or multiple consumer reporting agencies and
216 that does not maintain a permanent database of credit
217 information from which new consumer reports are produced.
218 However, such consumer reporting agency shall honor any security
219 freeze placed or removed by another consumer reporting agency.
220 (k) A fraud prevention services company issuing reports to
221 prevent or investigate fraud.
222 (l) A person or entity, or its affiliates, or a collection
223 agency acting on behalf of the person or entity and with which
224 the protected consumer has an existing account, requesting
225 information in the protected consumer’s consumer report or
226 record for the purposes of reviewing or collecting the account.
227 Reviewing the account includes activities related to account
228 maintenance, monitoring, credit line increases, and account
229 upgrades and enhancements.
230 (10)(a) A consumer reporting agency may charge a reasonable
231 fee, not to exceed $10, to place or remove a security freeze.
232 (b) A consumer reporting agency may charge a reasonable
233 fee, not to exceed $10, if the representative fails to retain
234 the original unique personal identifier provided by the consumer
235 reporting agency and the agency must reissue the unique personal
236 identifier or provide a new unique personal identifier to the
237 representative.
238 (c) A consumer reporting agency may not charge a fee under
239 this section to the representative of a protected consumer who
240 is a victim of identity theft if the representative submits, at
241 the time the security freeze is requested, a copy of a valid
242 investigative report, an incident report, or a complaint with a
243 law enforcement agency about the unlawful use of the protected
244 consumer’s identifying information by another person.
245 (11) If a security freeze is in effect, a consumer
246 reporting agency must send written confirmation to a protected
247 consumer’s representative of a change to any of the following
248 official information in the protected consumer’s consumer report
249 or record within 30 days after the change is posted:
250 (a) The protected consumer’s name.
251 (b) The protected consumer’s address.
252 (c) The protected consumer’s date of birth.
253 (d) The protected consumer’s social security number.
254
255 Written confirmation is not required for technical corrections
256 of a protected consumer’s official information, including name
257 and street abbreviations, complete spellings, or transposition
258 of numbers or letters. In the case of an address change, the
259 written confirmation must be sent to the representative and to
260 the protected consumer’s new address and former address.
261 (12) If a consumer reporting agency violates a security
262 freeze placed in accordance with this section by releasing
263 information subject to a security freeze without proper
264 authorization, the consumer reporting agency shall, within 5
265 business days after discovering or being notified of the release
266 of information, notify the representative of the protected
267 consumer in writing. The notice shall state the specific
268 information released and provide the name, address, and other
269 contact information of the recipient of the information.
270 (13) A consumer reporting agency that willfully fails to
271 comply with any requirement imposed under this section is
272 subject to an administrative fine in the amount of $500, imposed
273 by the Department of Agriculture and Consumer Services pursuant
274 to the administrative procedures established in chapter 120.
275 (14) In addition to any other penalties or remedies
276 provided under law, the following persons who are aggrieved by a
277 violation of this section may bring a civil action as follows:
278 (a) A person who obtains a protected consumer’s consumer
279 report or record from a consumer reporting agency under false
280 pretenses or who knowingly obtains a protected consumer’s
281 consumer report or record without a permissible purpose is
282 liable to the representative and protected consumer for actual
283 damages sustained by the protected consumer or $1,000, whichever
284 is greater.
285 (b) A person who obtains a protected consumer’s consumer
286 report or record from a consumer reporting agency under false
287 pretenses or who knowingly obtains a protected consumer’s
288 consumer report or record without a permissible purpose is
289 liable to the consumer reporting agency for actual damages
290 sustained by the consumer reporting agency or $1,000, whichever
291 is greater.
292 (15) A written disclosure by a consumer reporting agency,
293 pursuant to 15 U.S.C. s. 1681g, to a representative and
294 protected consumer residing in this state must include a written
295 summary of all rights that the representative and protected
296 consumer have under this section and, in the case of a consumer
297 reporting agency that compiles and maintains records on a
298 nationwide basis, a toll-free telephone number that the
299 representative can use to communicate with the consumer
300 reporting agency. The information provided in paragraph (b) must
301 be in at least 12-point boldfaced type. The written summary of
302 rights required under this section is sufficient if it is
303 substantially in the following form:
304 (a) If you are the custodial parent or legal guardian of a
305 minor younger than 16 years of age or a guardian or advocate of
306 an incapacitated, disabled, or protected person under chapter
307 39, chapter 393, chapter 744, or chapter 914, Florida Statutes,
308 you have the right to place a security freeze on the consumer
309 report of the person you are legally authorized to care for. If
310 no consumer report exists, you have the right to request that a
311 record be created and a security freeze be placed on the record.
312 A record with a security freeze is intended to prevent the
313 opening of credit accounts until the security freeze is removed.
314 (b) YOU SHOULD BE AWARE THAT USING A SECURITY FREEZE TO
315 CONTROL ACCESS TO THE PERSONAL AND FINANCIAL INFORMATION IN A
316 CONSUMER REPORT OR RECORD MAY DELAY, INTERFERE WITH, OR PROHIBIT
317 THE TIMELY APPROVAL OF ANY SUBSEQUENT REQUEST OR APPLICATION
318 REGARDING A NEW LOAN, CREDIT, MORTGAGE, INSURANCE, GOVERNMENT
319 SERVICES OR PAYMENTS, RENTAL HOUSING, EMPLOYMENT, INVESTMENT,
320 LICENSE, CELLULAR PHONE, UTILITIES, DIGITAL SIGNATURE, INTERNET
321 CREDIT CARD TRANSACTION, OR OTHER SERVICES, INCLUDING AN
322 EXTENSION OF CREDIT AT POINT OF SALE.
323 (c) To remove the security freeze on the protected
324 consumer’s record or report, you must contact the consumer
325 reporting agency and provide all of the following:
326 1. Proof of identification as required by the consumer
327 reporting agency.
328 2. Proof of authority over the protected consumer as
329 required by the consumer reporting agency.
330 3. The unique personal identifier provided by the consumer
331 reporting agency.
332 4. Payment of a fee.
333 (d) A consumer reporting agency must, within 30 days after
334 receiving the above information, authorize the removal of the
335 security freeze.
336 (e) A security freeze does not apply to a person or entity,
337 or its affiliates, or a collection agency acting on behalf of
338 the person or entity and with which the protected consumer has
339 an existing account, which requests information in the protected
340 consumer’s consumer report or record for the purposes of
341 reviewing or collecting the account. Reviewing the account
342 includes activities related to account maintenance, monitoring,
343 credit line increases, and account upgrades and enhancements.
344 (f) You have the right to bring a civil action as
345 authorized by section 501.0051, Florida Statutes, which governs
346 the security of protected consumer information.
347 Section 3. This act shall take effect September 1, 2014.
348