HB5006 93RD GENERAL ASSEMBLY

LRB093 19466 RXD 45205 b

93RD GENERAL ASSEMBLY
State of Illinois
2003 and 2004
HB5006

Introduced 02/05/04, by Elaine Nekritz

SYNOPSIS AS INTRODUCED:

815 ILCS 505/2MM
815 ILCS 505/2QQ new

Amends the Consumer Fraud and Deceptive Business Practices Act. Provides that any person who uses a consumer credit report in connection with the approval of credit, may not lend money, extend credit, or complete the purchase, lease, or rental of goods or non-credit related services without taking reasonable steps to verify the consumer's identity. Provides that if a consumer places a statement with a security alert in his or her file requesting that his or her identity be verified by calling a specified telephone number, any person who receives that statement with the security alert in the consumer's file must take reasonable steps to verify his or her identity by contacting the consumer using the specified telephone number, prior to lending money, extending credit, or completing the purchase, lease, or rental of goods or non-credit related services, with certain exceptions. Provides that a consumer credit reporting agency is required to provide to a consumer information about security alerts and security freezes and their consequences. Prohibits a person or entity from publicly posting or displaying an individual's social security number or doing certain other acts that might compromise the security of an individual's social security number. Provides that a person or entity shall not encode or embed a social security number on a card or document, including a bar code, chip, or magnetic strip.

A BILL FOR

AN ACT concerning business transactions.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The Consumer Fraud and Deceptive Business Practices Act is amended by changing Section 2MM and adding Section 2QQ as follows:

(815 ILCS 505/2MM)

Sec. 2MM. Verification of accuracy of credit reporting information used to extend consumers credit; security alert notices.

(a) A credit card issuer who mails an offer or solicitation to apply for a credit card and who receives a completed application in response to the offer or solicitation which lists an address that is not substantially the same as the address on the offer or solicitation may not issue a credit card based on that application until reasonable steps have been taken to verify the applicant's change of address.

(b) Any person who uses a consumer credit report in connection with the approval of credit based on the application for an extension of credit, or with the purchase, lease, or rental of goods or non-credit related services, and who has received notification of a police report filed with a consumer reporting agency that the applicant has been a victim of financial identity theft, as defined in Section 16G-15 of the Criminal Code of 1961, or has received notification of a security alert, may not lend money or extend credit without taking reasonable steps to verify the consumer's identity and confirm that the application for an extension of credit is not the result of financial identity theft. If the consumer has placed a statement with a security alert in his or her file requesting that identity be verified by calling a specified telephone number, any person who receives that statement with the security alert in a consumer's file shall take reasonable steps to verify the identity of the consumer by contacting the consumer using the specified telephone number prior to lending money, extending credit, or completing the purchase, lease, or rental of goods or non-credit related services. If a person uses a consumer credit report to facilitate the extension of credit or for another permissible purpose on behalf of a subsidiary, affiliate, agent, assignee, or prospective assignee, that person may verify a consumer's identity under this subsection (b) instead of the subsidiary, affiliate, agent, assignee, or prospective assignee.

(b-1) If a consumer uses a consumer credit reporting agency he or she may elect to place a security alert in his or her credit report by making a request in writing or by telephone to a consumer credit report agency. A consumer credit reporting agency shall:

(1) Notify each person requesting consumer credit information with respect to a consumer of the existence of a security alert in the credit report of that consumer, regardless of whether a full credit report, credit score, or summary report is requested.

(2) Maintain a toll-free telephone number to accept security alert requests from consumers 24 hours a day, seven days a week. The toll-free telephone number shall be included in any written disclosure by a consumer credit reporting agency to any consumer and shall be printed in a clear and conspicuous manner.

(3) Place a security alert on a consumer's credit report no later than 5 business days after receiving a request from the consumer. The security alert shall remain in place for at least 90 days, and a consumer shall have the right to request a renewal of the security alert.

(4) Notify each consumer who has requested that a security alert be placed on his or her consumer credit report of the expiration date of the alert.

(5) Promptly disclose files maintained on a consumer as follows:

(A) In person, if the consumer appears and furnishes proper identification at the location where the consumer credit reporting agency maintains trained personnel.

(B) By mail, if the consumer makes a written request with proper identification for a copy of the file or a decoded written version of that file to be sent to the consumer at a specified address. A disclosure under this subparagraph (B) shall be deposited in the United States mail, postage prepaid, within 5 business days after the consumer's written request for the disclosure is received by the consumer credit reporting agency. Consumer credit reporting agencies complying with requests for mailings under this subparagraph (B) shall not be liable for disclosures to third parties caused by mishandling of mail after the mailings leave the consumer credit reporting agencies.

(C) By telephone, if the consumer has made a written request, with proper identification for telephone disclosure.

Information in a consumer's file required to be provided in writing under this paragraph (5) may also be disclosed in another form if authorized by the consumer and if available from the consumer credit reporting agency. A consumer may request disclosure by telephone upon disclosure of proper identification by the consumer, by electronic means if available from the consumer credit reporting agency, or by any other reasonable means that is available from the consumer credit reporting agency.

(6) Provide a consumer with a written summary of all of his or her rights with any written disclosure in the following form:

"You have a right to obtain a copy of your credit file from a consumer credit reporting agency. You may be charged a reasonable fee not to exceed $8. There is no fee, if you have been turned down for credit, employment, insurance, or a rental dwelling because of information in your credit report within the preceding 60 days. The consumer credit reporting agency must provide trained personnel to help you interpret the information in your credit file.

You have a right to dispute inaccurate information by contacting the consumer credit reporting agency directly. However, neither you or any credit repair company or credit service organization has the right to have accurate, current, and verifiable information removed from your credit report. Under the Federal Fair Credit Reporting Act, the consumer credit reporting agency must remove accurate, negative information from your report only if it is over 7 years old. Bankruptcy information can be reported for 10 years.

If you have notified a consumer credit reporting agency in writing that you dispute the accuracy of information in your file, the consumer credit reporting agency must then, within 30 business days, reinvestigate and modify or remove inaccurate information. The consumer credit reporting agency may not charge a fee for this service. Any pertinent information and copies of all documents you have concerning an error should be given to the consumer credit reporting agency.

If reinvestigation does not resolve the dispute to your satisfaction, you may send a brief statement to the consumer credit reporting agency to keep in your file, explaining why you think the record is inaccurate. The consumer credit reporting agency must include your statement about disputed information in a report it issues about you.

You have a right to receive a record of all inquiries relating to a credit transaction initiated in 12 months preceding your request. This record shall include the recipients of any consumer credit report. You may request in writing that the information contained in your file not be provided to a third party for marketing purposes.

You have a right to place a "security alert" in your credit report, which will warn anyone who receives information in your credit report that your identity may have been used without your consent. Recipients of your credit report are required to take reasonable steps, including contacting you at the telephone number you may provide with your security alert, to verify your identity prior to lending money, extending credit, or completing the purchase, lease, or rental of goods or services. The security alert may prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that taking advantage of this right may delay or interfere with the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, insurance, rental housing, employment, investment, license, cellular phone, utilities, digital signature, Internet credit card transaction, or other services, including an extension of credit at point of sale. If you place a security alert on your credit report, you have a right to obtain a free copy of your credit report at the time the 90-day security alert period expires. A security alert may be requested by calling the following toll-free telephone number: (Insert applicable toll-free telephone number).

You have a right to place a "security freeze" on your credit report, which will prohibit a consumer credit reporting agency from releasing any information in your credit report without your express authorization. A security freeze must be requested in writing by certified mail. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, insurance, government services or payments, rental housing, employment, investment, license, cellular phone, utilities, digital signature, Internet credit card transaction, or other services, including an extension of credit at point of sale. When you place a security freeze on your credit report, you will be provided a personal identification number or password to use if you choose to remove the freeze on your credit report or authorize the release of your credit report for a specific party or period of time after the freeze is in place. To provide that authorization you must contact the consumer credit reporting agency and provide all of the following:

(1) the personal identification number or password;

(2) proper identification to verify your identity; and

(3) the proper information regarding the third party who is to receive the credit report or the period of time for which the report shall be available.

A consumer credit reporting agency must authorize the release of your credit report no later than 3 business days after receiving the above information.

A security freeze does not apply to a person or entity, or its affiliates, or collection agencies acting on behalf of the person or entity with which you have an existing account, that requests information in your credit report for the purposes of reviewing or collecting the account. Reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.

You have a right to bring civil action against anyone, including a consumer credit reporting agency, who improperly obtains access to a file, knowingly or willfully misuses file data, or fails to correct inaccurate file data.

If you are a victim of identity theft and provide to a consumer credit reporting agency a copy of a valid police report or a valid investigative report made by a Department of Motor Vehicles investigator with peace officer status describing your circumstances, the following shall apply:

(1) You have a right to have any information you list on the report as allegedly fraudulent promptly blocked so that the information cannot be reported. The information will be unblocked only if (1) the information you provide is a material misrepresentation of the facts, (2) you agree that the information is blocked in error, or (3) you knowingly obtained possession of goods, services, or moneys as result of the blocked transactions. If blocked information is unblocked you will be promptly notified.

(2) By the effective date of this amendatory Act of the 93rd General Assembly, you have a right to receive, free of charge and upon request, one copy of your credit report each month for up to 12 consecutive months.".

(b-2) The following entities are not required to place a security alert in a consumer credit report:

(1) A check services or fraud prevention services company, which issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments.

(2) A deposit account information service company, which issues reports regarding account closures due to fraud, substantial overdrafts, ATM abuse, or similar negative information regarding a consumer, to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution.

(b-3) The consumer has the right to request and receive all of the following:

(1) Either a decoded written version of the file or a written copy of the file, including all information in the file at the time of the request, with an explanation of any code used.

(2) A credit score for the consumer, the key factors, and the related information.

(3) A record of all inquiries, by recipient, which result in the provision of information concerning the consumer in connection with a credit transaction that is not initiated by the consumer and which were received by the consumer credit reporting agency in the 12-month period immediately preceding the request for disclosure.

(4) The recipients, of any consumer credit report on the consumer which the consumer credit reporting agency has furnished for employment purposes within the 12-month period preceeding the request or any other purpose within the 12-month period preceding the request.

(c) For purposes of this Section, "extension of credit" does not include an increase in an existing open-end credit plan, as defined in Regulation Z of the Federal Reserve System (12 C.F.R. 226.2), or any change to or review of an existing credit account.

(c-1) For purposes of this Section, "security alert" means a notice placed in a consumer's credit report, at the request of the consumer, which notifies a recipient of the credit report that the consumer's identity may have been used without the consumer's consent to fraudulently obtain goods or services in the consumer's name.

(c-2) For purposes of this Section, "proper identification" means that information generally deemed sufficient to identify a person. Only if the consumer is unable to reasonably identify himself or herself, may a consumer credit reporting agency require additional information concerning the consumer's employment and personal or family history in order to verify his or her identity.

(d) Any person who violates the provisions of this Section subsection (a) or subsection (b) commits an unlawful practice within the meaning of this Act. If a consumer reporting agency recklessly, willfully, or intentionally fails to place a security alert notice in a consumer's credit report it shall be guilty of a business offense and subject to a fine in an amount not to exceed $2,500 plus the cost of reasonable attorney's fees.

(Source: P.A. 93-195, eff. 1-1-04.)

(815 ILCS 505/2QQ new)

Sec. 2QQ. Social security number protection.

(a) Notwithstanding subsection (b), any financial institution may print the social security number of an individual on any account statement or similar document mailed to that individual, if the social security number is provided in connection with a transaction governed by the rules of the National Automated Clearing House Association, or a transaction initiated by a federal governmental entity through an automated clearing house network.

(b) A person or entity may not do any of the following:

(1) Publicly post or publicly display, in any manner, an individual's social security number. "Publicly post" or "publicly display" means to intentionally communicate or otherwise make available to the general public.

(2) Print an individual's social security number on any card required for the individual to access products or services provided by the person or entity.

(3) Require an individual to transmit his or her social security number over the Internet, unless the connection is secure or the social security number is encrypted.

(4) Require an individual to use his or her social security number to access an Internet Web site, unless a password or unique personal identification number or other authentication device is also required to access the Internet Web site.

(5) Print an individual's social security number on any materials that are mailed to the individual, unless State or federal law requires the social security number to be on the document to be mailed. Notwithstanding this subsection (a), social security numbers may be included in applications and forms sent by mail, including documents sent as part of an application or enrollment process, or to establish, amend or terminate an account, contract or policy, or to confirm the accuracy of the social security number.

(c) Except as provided in subsection (f), a person or entity that has used, prior to the effective date of this amendatory Act by the 93rd General Assembly, an individual's social security number in a manner inconsistent with subsection (b), may continue using that individual's social security number in that manner on or after the effective date of this amendatory Act by the 93rd General Assembly, and a State or local agency that has used, prior to the effective date of this amendatory Act by the 93rd General Assembly, an individual's social security number in a manner inconsistent with subsection (b), may continue using that individual's social security number in that manner on or after the effective date of this amendatory Act by the 93rd General Assembly, if all of the following conditions are met:

(1) The use of the social security number is continuous. If the use is stopped for any reason, subsection (b) shall apply.

(2) The individual is provided an annual disclosure that informs the individual that he or she has the right to stop the use of his or her social security number in a manner prohibited by subsection (b).

A written request by an individual to stop the use of his or her social security number in a manner prohibited by subsection (b) is implemented within 30 days of the receipt of the request. There may not be a fee or charge for implementing the request.

The person or entity may not deny services to an individual because the individual makes a written request pursuant to this subsection (c).

(d) This Section does not apply to documents that are recorded or required to be open to the public.

(e) In the case of a health care service plan, a provider of health care, an insurer or a pharmacy benefits manager, a contractor, or the provision by any person or entity of administrative or other services relative to health care or insurance products or services, including third-party administration or administrative services only, this Section shall become operative in the following manner:

(1) By the effective date of this amendatory Act by the 93rd General Assembly the entities listed in subsection (e) shall comply with paragraphs (1), (3), (4), and (5) of subsection (b), as these requirements pertain to individual policyholders or individual contract holders.

(2) By the effective date of this amendatory Act by the 93rd General Assembly the entities listed in subsection (1) shall comply with subsection (b) as these requirements pertain to new individual policyholders or new individual contract holders and new groups.

(f) A health care service plan, a provider of health care, an insurer or a pharmacy benefits manager, a contractor, or another person or entity as described in subsection (e) shall make reasonable efforts to cooperate, through systems testing and other means, to ensure that the requirements of this Section are implemented on or before the dates specified in this Section.

(1) Notwithstanding paragraph (2) of this Section, the Director of the Illinois Department of Public Aid, or the Director of the Department of Insurance, and upon a determination of good cause, may grant extensions not to exceed 6 months, for compliance with the requirements of this Section when requested by the health care service plan provider or insurer. Any extension granted shall apply to the health care service plan or insurer's affected providers, pharmacy benefits manager, and contractors.

(2) If a federal law takes effect requiring the United States Department of Health and Human Services to establish a national unique patient health identifier program, a provider of health care, a health care service plan, a licensed health care professional, or a contractor, that complies with the federal law shall be deemed in compliance with this Section.

(g) A person or entity may not encode or embed a social security number in or on a card or document, including, but not limited to, using a bar code, chip, magnetic strip, or other technology, in place of removing the social security number, as required by this Section.