Florida Senate - 2013                              CS for SB 566
       
       
       
       By the Committee on Commerce and Tourism; and Senator Detert
       
       
       
       
       577-03305-13                                           2013566c1
    1                        A bill to be entitled                      
    2         An act relating to security of protected consumer
    3         information; creating s. 501.0051, F.S.; providing
    4         definitions; authorizing the representative of a
    5         protected consumer to place a security freeze on the
    6         protected consumer’s consumer record; requiring a
    7         consumer reporting agency to establish a record if the
    8         protected consumer does not have an existing consumer
    9         report; requiring a consumer reporting agency to
   10         provide written confirmation of a security freeze
   11         within a specified period; prohibiting a consumer
   12         reporting agency from stating or implying that a
   13         security freeze reflects a negative credit history or
   14         rating; requiring a consumer reporting agency to
   15         remove a security freeze under specified conditions;
   16         providing for applicability; authorizing a consumer
   17         reporting agency to charge a fee for placing or
   18         removing a security freeze and for reissuing personal
   19         identification information; prohibiting a fee under
   20         certain circumstances; requiring written notification
   21         to change specified information in a protected
   22         consumer’s record; providing exemptions; requiring a
   23         consumer reporting agency to notify a representative
   24         and provide specified information if the consumer
   25         reporting agency violates a security freeze; providing
   26         penalties and civil remedies; providing written
   27         disclosure requirements for consumer reporting
   28         agencies pertaining to protected consumer security
   29         freezes; providing an effective date.
   30  
   31  Be It Enacted by the Legislature of the State of Florida:
   32  
   33         Section 1. Section 501.0051, Florida Statutes, is created
   34  to read:
   35         501.0051 Protected consumer security freeze.—
   36         (1) As used in this section, the term:
   37         (a) “Consumer reporting agency” has the same meaning as
   38  provided in 15 U.S.C. s. 1681a(f).
   39         (b) “Consumer report” has the same meaning as provided in
   40  15 U.S.C. s. 1681a(d).
   41         (c) “Protected consumer” means a person younger than 16
   42  years of age at the time a security freeze request is made or a
   43  person represented by a guardian or other advocate pursuant to
   44  chapter 39, chapter 393,chapter 744, or chapter 914.
   45         (d) “Record” means a compilation of information that:
   46         1. Identifies a protected consumer;
   47         2. Is created by a consumer reporting agency exclusively
   48  for the purpose of complying with this section; and
   49         3. May not be created or used to consider the protected
   50  consumer’s credit worthiness, credit standing, credit capacity,
   51  character, general reputation, personal characteristics, or
   52  eligibility for other financial services.
   53         (e) “Representative” means the custodial parent or legal
   54  guardian of a protected consumer, including a guardian appointed
   55  pursuant to s. 914.17.
   56         (f) “Security freeze” means:
   57         1. A notice that is placed on the protected consumer’s
   58  consumer report that prohibits a consumer reporting agency from
   59  releasing the consumer report, credit score, or any information
   60  contained within the consumer report to a third party without
   61  the express authorization of the representative; or
   62         2. A notice that is placed on the protected consumer’s
   63  record that prohibits the consumer reporting agency from
   64  releasing the protected consumer’s record except as provided in
   65  this section, if a consumer reporting agency does not have a
   66  file pertaining to the protected consumer.
   67         (g) “Sufficient proof of authority” means documentation
   68  that shows that a representative has authority to act on behalf
   69  of a protected consumer. Sufficient proof of authority includes,
   70  but is not limited to, a court order, valid power of attorney,
   71  or a written notarized statement signed by a representative that
   72  expressly describes the authority of the representative to act
   73  on behalf of the protected consumer.
   74         (h) “Sufficient proof of identification” means
   75  documentation that identifies a protected consumer or a
   76  representative of a protected consumer. Sufficient proof of
   77  identification includes, but is not limited to, a copy of a
   78  social security card, a certified or official copy of a birth
   79  certificate, a copy of a valid driver license, or a government
   80  issued photo identification.
   81         (2) A representative may place a security freeze on a
   82  protected consumer’s consumer record by:
   83         (a) Submitting a request to a consumer reporting agency in
   84  the manner prescribed by that agency;
   85         (b) Providing the agency with sufficient proof of authority
   86  and sufficient proof of identification; and
   87         (c) Paying the agency a fee as authorized under this
   88  section.
   89         (3) If a consumer reporting agency does not have a consumer
   90  report pertaining to a protected consumer when the consumer
   91  reporting agency receives a request for a security freeze under
   92  subsection (2), the consumer reporting agency shall create a
   93  record for the protected consumer and place a security freeze on
   94  the record.
   95         (4) A consumer reporting agency shall place a security
   96  freeze on a consumer record within 30 calendar days after
   97  confirming the authenticity of a security freeze request made in
   98  accordance with this section.
   99         (5) The consumer reporting agency shall send a written
  100  confirmation of the security freeze to the representative within
  101  10 business days after instituting the security freeze and shall
  102  provide the representative with instructions for removing the
  103  security freeze and a unique personal identifier to be used by
  104  the representative when providing authorization for removal of a
  105  security freeze.
  106         (6) A consumer reporting agency may not state or imply to
  107  any person that a security freeze on a protected consumer’s
  108  consumer record reflects a negative credit score, negative
  109  credit history, or a negative credit rating.
  110         (7) A consumer reporting agency shall remove a security
  111  freeze placed on a consumer record of a protected consumer only
  112  in the following instances:
  113         (a) Upon request of a representative pursuant to paragraph
  114  (8)(a).
  115         (b) Upon request of a protected consumer pursuant to
  116  paragraph (8)(b).
  117         (c) If the security freeze was instituted due to a material
  118  misrepresentation of fact by a representative. If a consumer
  119  reporting agency intends to remove a security freeze pursuant to
  120  this paragraph, the consumer reporting agency shall notify the
  121  representative in writing before removing the security freeze.
  122         (8) A security freeze placed in accordance with this
  123  section shall remain in place until a representative or
  124  protected consumer requests that it be removed. A consumer
  125  reporting agency shall remove a security freeze within 30
  126  calendar days after receiving a request for removal from a
  127  protected consumer or representative.
  128         (a) A representative submitting a request for removal must
  129  provide the following:
  130         1. Sufficient proof of identification and sufficient proof
  131  of authority as determined by the consumer reporting agency.
  132         2. The unique personal identifier provided by the consumer
  133  reporting agency pursuant to subsection (5).
  134         3. Payment of a fee as authorized by this section.
  135         (b) A protected consumer submitting a request for removal
  136  must provide the following:
  137         1. Sufficient proof of identification as determined by the
  138  consumer reporting agency.
  139         2. Documentation that the sufficient proof of authority for
  140  the protected consumer’s representative to act on behalf of the
  141  protected consumer is no longer valid.
  142         (9) This section does not apply to use of a consumer record
  143  by the following persons or for the following reasons:
  144         (a) A state agency acting within its lawful investigative
  145  or regulatory authority.
  146         (b) A state or local law enforcement agency investigating a
  147  crime or conducting a criminal background check.
  148         (c) Any person administering a credit file monitoring
  149  subscription service to which the protected consumer has
  150  subscribed.
  151         (d) Any person for the purpose of providing the protected
  152  consumer’s consumer report upon the representative’s request.
  153         (e) Any person with a court order lawfully entered.
  154         (f) Any insurance company for use in setting or adjusting a
  155  rate, adjusting a claim, or underwriting for insurance purposes.
  156         (g) A consumer reporting agency’s database or file which
  157  consists entirely of information concerning, and is used
  158  exclusively for, one or more of the following:
  159         1. Criminal record information.
  160         2. Personal loss history information.
  161         3. Fraud prevention or detection.
  162         4. Tenant screening.
  163         5. Employment screening.
  164         6. Personal insurance policy information.
  165         7. Noncredit information used for insurance purposes.
  166         (h) A check services company that issues authorizations for
  167  the purpose of approving or processing negotiable instruments,
  168  electronic funds transfers, or similar methods of payment.
  169         (i) A deposit account information service company that
  170  issues reports regarding account closures due to fraud,
  171  substantial overdrafts, automatic teller machine abuse, or
  172  similar negative information regarding a protected consumer to
  173  an inquiring financial institution, as defined in s. 655.005 or
  174  in federal law, for use only in reviewing a representative’s
  175  request for a deposit account for the protected consumer at the
  176  inquiring financial institution.
  177         (j) A consumer reporting agency that acts only as a
  178  reseller of credit information by assembling and merging
  179  information contained in the database of another consumer
  180  reporting agency or multiple consumer reporting agencies and
  181  does not maintain a permanent database of credit information
  182  from which new consumer reports are produced. However, a
  183  consumer reporting agency shall honor any security freeze placed
  184  or removed by another consumer reporting agency.
  185         (k) A fraud prevention services company issuing reports to
  186  prevent or investigate fraud.
  187         (10)(a) A consumer reporting agency may charge a reasonable
  188  fee, not to exceed $10, to a representative who elects to place
  189  or remove a security freeze.
  190         (b) A consumer reporting agency may charge a reasonable
  191  fee, not to exceed $10, if the representative fails to retain
  192  the original personal identifier provided by the consumer
  193  reporting agency and the agency must reissue the personal
  194  identifier or provide a new personal identifier to the
  195  representative.
  196         (c) A consumer reporting agency may not charge any fee
  197  under this section to a representative of a protected consumer
  198  who is a victim of identity theft if the representative submits,
  199  at the time the security freeze is requested, a copy of a valid
  200  investigative report or incident report or complaint with a law
  201  enforcement agency about the unlawful use of the protected
  202  consumer’s identifying information by another person.
  203         (11) If a security freeze is in effect, a consumer
  204  reporting agency may not change any of the following official
  205  information in the consumer record without sending a written
  206  confirmation of the change to the representative within 30
  207  calendar days after the change is posted to the protected
  208  consumer’s record:
  209         (a) The protected consumer’s name.
  210         (b) The protected consumer’s address.
  211         (c) The protected consumer’s date of birth.
  212         (d) The protected consumer’s social security number.
  213  
  214  Written confirmation is not required for technical corrections
  215  of a protected consumer’s official information, including name
  216  and street abbreviations, complete spellings, or transposition
  217  of numbers or letters. In the case of an address change, the
  218  written confirmation must be sent to both the new address and
  219  the former address.
  220         (12) If a consumer reporting agency violates a security
  221  freeze placed in accordance with this section by releasing
  222  information subject to a security freeze without proper
  223  authorization, the consumer reporting agency shall, within 5
  224  business days after discovering or being notified of the release
  225  of information, notify the representative of the protected
  226  consumer in writing. The notice shall state the specific
  227  information released, and provide the name, address, and other
  228  contact information of the recipient of the information.
  229         (13) A consumer reporting agency that willfully fails to
  230  comply with any requirement imposed under this section with
  231  respect to a representative or protected consumer is subject to
  232  an administrative fine in the amount of $500 issued pursuant to
  233  the administrative procedures established in chapter 120 by the
  234  Department of Agriculture and Consumer Services.
  235         (14) A person who is aggrieved by a violation of the
  236  provisions of this section may bring a civil action as
  237  authorized by this subsection.
  238         (a) Any person who obtains a record under false pretenses
  239  or knowingly without a permissible purpose is liable to the
  240  representative and protected consumer for damages of at least
  241  $1,000 or the actual damages sustained by the protected consumer
  242  as a result of the violation, whichever is greater.
  243         (b) Any person who obtains a record from a consumer
  244  reporting agency under false pretenses or knowingly without a
  245  permissible purpose is liable to the consumer reporting agency
  246  for actual damages sustained by the consumer reporting agency or
  247  $1,000, whichever is greater.
  248         (15) Any written disclosure by a consumer reporting agency,
  249  pursuant to 15 U.S.C. s. 1681g, to any representative and
  250  protected consumer residing in this state must include a written
  251  summary of all rights the representative and protected consumer
  252  have under this section and, in the case of a consumer reporting
  253  agency that compiles and maintains records on a nationwide
  254  basis, a toll-free telephone number which the representative can
  255  use to communicate with the consumer reporting agency. The
  256  information set forth in paragraph (b) of the written summary of
  257  rights must be in at least 12-point boldface type. The written
  258  summary of rights required under this section is sufficient if
  259  it is substantially in the following form:
  260         (a) If you are the custodial parent or legal guardian of a
  261  minor younger than 16 years of age or a guardian or advocate of
  262  an incapacitated, disabled, or protected person under chapter
  263  39, chapter 393, chapter 744, or chapter 914, Florida Statutes,
  264  you have a right to place a security freeze on the consumer
  265  report of the person you are legally authorized to care for. If
  266  no consumer report exists, you have a right to request a record
  267  to be created and a security freeze to be placed on the record.
  268  A record with a security freeze is intended to prevent the
  269  opening of credit accounts until the security freeze is removed.
  270         (b) YOU SHOULD BE AWARE THAT USING A SECURITY FREEZE TO
  271  CONTROL ACCESS TO THE PERSONAL AND FINANCIAL INFORMATION IN THE
  272  CONSUMER RECORD MAY DELAY, INTERFERE WITH, OR PROHIBIT THE
  273  TIMELY APPROVAL OF ANY SUBSEQUENT REQUEST OR APPLICATION
  274  REGARDING A NEW LOAN, CREDIT, MORTGAGE, INSURANCE, GOVERNMENT
  275  SERVICES OR PAYMENTS, RENTAL HOUSING, EMPLOYMENT, INVESTMENT,
  276  LICENSE, CELLULAR PHONE, UTILITIES, DIGITAL SIGNATURE, INTERNET
  277  CREDIT CARD TRANSACTION, OR OTHER SERVICES, INCLUDING AN
  278  EXTENSION OF CREDIT AT POINT OF SALE.
  279         (c) When you place a security freeze on the protected
  280  consumer’s record you will be provided a process to use if you
  281  choose to remove the freeze on the record or authorize the
  282  release of the record. To provide that authorization, you must
  283  contact the consumer reporting agency and provide all of the
  284  following:
  285         1. The personal identification required by the consumer
  286  reporting agency.
  287         2. Sufficient proof of authority over the protected
  288  consumer.
  289         3. Payment of a fee.
  290         (d) A consumer reporting agency must authorize the release
  291  of the record no later than 30 calendar days after receiving the
  292  above information, or the consumer report no later than 3
  293  business days after receiving the above information.
  294         (e) A security freeze does not apply to a person or entity,
  295  or its affiliates, or collection agencies acting on behalf of
  296  the person or entity with which the protected consumer has an
  297  existing account that requests information in the protected
  298  consumer’s consumer report for the purposes of reviewing or
  299  collecting the account. Reviewing the account includes
  300  activities related to account maintenance, monitoring, credit
  301  line increases, and account upgrades and enhancements.
  302         (f) You have the right to bring a civil action as
  303  authorized by s. 501.0051, Florida Statutes, which governs the
  304  security of protected consumer information.
  305         Section 2. This act shall take effect September 1, 2013.