SB1942 94TH GENERAL ASSEMBLY

LRB094 11230 RXD 41957 b

94TH GENERAL ASSEMBLY
State of Illinois
2005 and 2006
SB1942

Introduced 2/25/2005, by Sen. Carole Pankau

SYNOPSIS AS INTRODUCED:

New Act

Creates the Credit Report Protection Act. Provides that a consumer may place a security alert in his or her credit report by making a request to a consumer credit reporting agency. Provides that a consumer credit reporting agency shall notify each person requesting consumer credit information, with respect to a consumer, of the existence of a security alert in the credit report of that consumer. Provides that a consumer may place a security freeze on his or her credit report by making a request to a consumer credit reporting agency. Provides that if a security alert or security freeze is in place, a consumer credit reporting agency shall not modify certain information in a consumer credit report without sending a written confirmation of the change to the consumer within 30 days of the change being posted to the consumer's file. Provides that a consumer credit reporting agency may charge a reasonable fee to a consumer that elects to freeze, remove the freeze, or temporarily lift the freeze, except that a consumer credit reporting agency shall not charge a fee to a victim of identity theft that has submitted a valid police report. Provides that a consumer credit reporting agency shall supply files and credit report information to a consumer during normal business hours and on reasonable notice, subject to certain conditions. Provides certain exemptions.

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Credit Report Protection Act.

Section 5. Definitions. In this Act:

"Security alert" means a notice placed in a consumer's credit report, at the request of the consumer, that notifies a recipient of the credit report that the consumer's identity may have been used without the consumer's consent to fraudulently obtain goods or services in the consumer's name.

"Security freeze" means a notice placed in a consumer's credit report, at the request of the consumer and subject to certain exceptions, that prohibits the consumer credit reporting agency from releasing the consumer's credit report or any information from it without the express authorization of the consumer.

Section 10. Credit report security alert.

(a) A consumer may elect to place a security alert in his or her credit report by making a request in writing or by telephone to a consumer credit reporting agency.

(b) A consumer credit reporting agency shall notify each person requesting consumer credit information, with respect to a consumer, of the existence of a security alert in the credit report of that consumer, regardless of whether a full credit report, credit score, or summary report is requested.

(c) A consumer credit reporting agency shall maintain a toll-free telephone number to accept security alert requests from consumers 24 hours a day, 7 days a week.

(d) The toll-free telephone number shall be included in any written disclosure by a consumer credit reporting agency to any consumer pursuant to Section 30 of this Act and shall be printed in a clear and conspicuous manner.

(e) A consumer credit reporting agency shall place a security alert on a consumer's credit report no later than 5 business days after receiving a request from the consumer.

(f) The security alert shall remain in place for at least 90 days and a consumer shall have the right to request a renewal of the security alert.

Section 15. Credit report security freeze.

(a) A consumer may elect to place a security freeze on his or her credit report by making a request in writing by certified mail to a consumer credit reporting agency. When a security freeze is in place, information from a consumer's credit report may not be released to a third party without prior express authorization from the consumer. This subsection (a) shall not prevent a consumer credit reporting agency from advising a third party that a security freeze is in effect with respect to the consumer's credit report.

(b) If a consumer requests a security freeze, the consumer credit reporting agency shall disclose the process of placing and lifting a freeze and the process for allowing access to information from the consumer's credit report for a specific purpose while the freeze is in place.

(c) A consumer credit reporting agency shall place a security freeze on a consumer's credit report no later than 5 business days after receiving a written request from the consumer.

(d) The consumer credit reporting agency shall send a written confirmation of the security freeze to the consumer within 10 business days after receiving the request and shall provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of his or her credit for a specific purpose.

(e) If the consumer wishes to allow his or her credit report to be accessed for a specific party or period of time while a freeze is in place, he or she shall contact the credit reporting agency, request that the freeze be temporarily lifted, and provide all of the following:

(1) Proper identification, as defined in subsection (c) of Section 30 of this Act.

(2) The unique personal identification number or password provided by the credit reporting agency pursuant to subsection (d) of this Section.

(3) The proper information regarding the third party who is to receive the credit report or the time period for which the report shall be available to users of the credit report.

A consumer credit reporting agency that receives a request from a consumer to temporarily lift a freeze on a credit report pursuant to this subsection (e), shall comply with the request no later than 3 business days after receiving the request.

A consumer credit reporting agency may develop procedures involving the use of telephone, fax, the Internet, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze on a credit report pursuant to this subsection (e) in an expedited manner.

(f) A consumer credit reporting agency shall remove or temporarily lift a security freeze placed on a consumer's credit report only in the following cases:

(1) upon the consumer's request; or

(2) if the consumer's credit report was frozen due to a material misrepresentation of fact by the consumer. If a consumer credit reporting agency intends to remove a security freeze upon a consumer's credit report pursuant to this paragraph (2), the consumer credit reporting agency shall notify the consumer in writing before removing the security freeze on the consumer's credit report.

(g) A consumer credit reporting agency shall require proper identification, as defined in subsection (c) of Section 30, of the person making a request to place or remove a security freeze.

(h) If a third party requests access to a consumer credit report on which a security freeze is in effect, and this request is in connection with an application for credit or any other use, and the consumer does not allow his or her credit report to be accessed for that specific purpose, the third party may treat the application as incomplete.

(i) The provisions of this Section shall not apply to the use of a consumer report by any of the following:

(1) A person or entity, or a subsidiary, affiliate, or agent of that person or entity, or an assignee of a financial obligation owing by the consumer to that person or entity, or a prospective assignee of a financial obligation owing by the consumer to that person or entity in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment an account or contract, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument. For purposes of this paragraph, "reviewing the account" includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.

(2) A law enforcement agency acting pursuant to a court order, warrant, or subpoena.

(3) A child support agency acting pursuant to the Illinois Public Aid Code or Title IV-D of the Social Security Act (42 U.S.C. et seq.).

(4) The Department of Public Aid or its agents or assigns acting to investigate Medicaid fraud.

(5) The Department of Revenue or the Internal Revenue Service, or their agents or assigns, acting to investigate or collect delinquent taxes.

(6) The use of credit information for the purposes of prescreening as provided for by the federal Fair Credit Reporting Act.

Section 20. Modification of information; notice. If a security alert or security freeze is in place, a consumer credit reporting agency shall not modify any of the following information in a consumer credit report without sending a written confirmation of the change to the consumer within 30 days of the change being posted to the consumer's file: name, date of birth, age, Social Security number, and address. Written confirmation is not required for technical modifications of a consumer's official information, including name and street abbreviations, complete spellings, or transposition of numbers or letters.

In the case of an address change, the written confirmation shall be sent to both the new address and to the former address.

Section 25. Fees; copy of credit report.

(a) Nothing in this Act shall prevent a consumer credit reporting agency from charging a reasonable fee to a consumer that elects to freeze, remove the freeze, or temporarily lift the freeze regarding access to a consumer credit report, except that a consumer credit reporting agency shall not charge a fee to a victim of identity theft that has submitted a valid police report.

(b) If a consumer has placed a security alert on his or her credit report, a consumer credit reporting agency shall provide the consumer, upon request, with a free copy of his or her credit report at the time the 90-day security alert period expires.

Section 30. Disclosure of credit information.

(a) A consumer credit reporting agency shall supply files and credit report information during normal business hours and on reasonable notice. A consumer has the right to request and receive all of the following:

(1) Either a decoded written version of the file or a written copy of the file, including all information in the file at the time of the request, with an explanation of any code used.

(2) A credit score for the consumer, the key factors, and the related information.

(3) A record of all inquiries, by recipient, which result in the provision of information concerning the consumer in connection with a credit transaction that is not initiated by the consumer and which were received by the consumer credit reporting agency in the 12-month period immediately preceding the request for disclosure under this Section.

(4) The recipients, including end users, of any consumer credit report on the consumer which the consumer credit reporting agency has furnished:

(A) for employment purposes within the 2-year period preceding the request; or

(B) for any other purpose within the 12-month period preceding the request.

Identification for purposes of this subsection (a) shall include the name of the recipient or, if applicable, the fictitious business name under which the recipient does business disclosed in full. If requested by the consumer, the identification shall also include the address of the recipient.

(b) Files maintained on a consumer shall be disclosed promptly as follows:

(1) In person, at the location where the consumer credit reporting agency maintains the trained personnel required by subsection (d) of this Section, if he or she appears in person and furnishes proper identification.

(2) By mail, if the consumer makes a written request with proper identification for a copy of the file or a decoded written version of that file to be sent to the consumer at a specified address. A disclosure pursuant to this paragraph (2) shall be deposited in the United States mail, postage prepaid, within 5 business days after the consumer's written request for the disclosure is received by the consumer credit reporting agency. Consumer credit reporting agencies complying with requests for mailings under this Section shall not be liable for disclosures to third parties caused by mishandling of mail after the mailings leave the consumer reporting agencies.

(3) A summary of all information contained in files on a consumer shall be provided by telephone, if the consumer has made a written request, with proper identification for telephone disclosure.

(4) Information in a consumer's file required to be provided in writing under this Section may also be disclosed in another form if authorized by the consumer and if available from the consumer credit reporting agency. For this purpose a consumer may request disclosure in person, by telephone upon disclosure of proper identification by the consumer, by electronic means if available from the consumer credit reporting agency, or by any other reasonable means that is available from the consumer credit reporting agency.

(c) "Proper identification", as used in subsection (b), means that information generally deemed sufficient to identify a person. Only if the consumer is unable to reasonably identify himself or herself may a consumer credit reporting agency require additional information concerning the consumer's employment and personal or family history in order to verify his or her identity.

(d) The consumer credit reporting agency shall provide trained personnel to explain to the consumer any information furnished to him or her.

(e) The consumer shall be permitted to be accompanied by one other person of his or her choosing, who shall furnish reasonable identification. A consumer credit reporting agency may require the consumer to furnish a written statement granting permission to the consumer credit reporting agency to discuss the consumer's file in that person's presence.

(f) Any written disclosure by a consumer credit reporting agency to any consumer pursuant to this Section shall include a written summary of all rights the consumer has under this Act and in the case of a consumer credit reporting agency that compiles and maintains consumer credit reports on a nationwide basis, a toll-free telephone number that the consumer can use to communicate with the consumer credit reporting agency. The written summary of rights required under this Act is sufficient if in substantially the following form:

"You have a right to obtain a copy of your credit file from a consumer credit reporting agency. You may be charged a reasonable fee not exceeding $8. There is no fee, however, if you have been turned down for credit, employment, insurance, or a rental dwelling because of information in your credit report within the preceding 60 days. The consumer credit reporting agency must provide someone to help you interpret the information in your credit file.

You have a right to dispute inaccurate information by contacting the consumer credit reporting agency directly. However, neither you nor any credit repair company or credit service organization has the right to have accurate, current, and verifiable information removed from your credit report. Under the federal Fair Credit Reporting Act, the consumer credit reporting agency must remove accurate, negative information from your report only if it is over 7 years old. Bankruptcy information can be reported for 10 years.

If you have notified a credit reporting agency in writing that you dispute the accuracy of information in your file, the consumer credit reporting agency must then, within 30 business days, reinvestigate and modify or remove inaccurate information. The consumer credit reporting agency may not charge a fee for this service. Any pertinent information and copies of all documents you have concerning an error should be given to the consumer credit reporting agency.

If reinvestigation does not resolve the dispute to your satisfaction, you may send a brief statement to the consumer credit reporting agency to keep in your file explaining why you think the record is inaccurate. The consumer credit reporting agency must include your statement about disputed information in a report it issues about you.

You have a right to receive a record of all inquiries relating to a credit transaction initiated in 12 months preceding your request. This record shall include the recipients of any consumer credit report.

You may request in writing that the information contained in your file not be provided to a third party for marketing purposes.

You have a right to place a "security alert" in your credit report, which will warn anyone who receives information in your credit report that your identity may have been used without your consent and verification of identity is advised, but not required, to verify your identity prior to issuing credit.

You have a right to place a "security freeze" on your credit report, which will prohibit a consumer credit reporting agency from releasing any information in your credit report without your express authorization. A security freeze must be requested in writing by certified mail and may delay or interfere with the approval of any application you file for a new loan, credit, insurance, or service. When you place a security freeze on your credit report, you will be provided a personal identification number or password to use if you choose to authorize the release of your credit report for a specific purpose after the freeze is in place. To provide that authorization you must contact the consumer credit reporting agency and provide all of the following:

(1) The personal identification number or password.

(2) Proper identification to verify your identity.

(3) The proper information regarding the third party who is to receive the credit report or the period of time for which the report shall be available.

A security freeze does not apply to a person or entity, or its affiliates, or collection agencies acting on behalf of the person or entity, with which you have an existing account, that requests information in your credit report for the purposes of reviewing or collecting the account. Reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.

You have a right to bring civil action against anyone, including a consumer credit reporting agency that improperly obtains access to a file, knowingly or willfully misuses file data, or fails to correct inaccurate file data."

Section 35. Exemptions.

(a) This Act does not apply to a credit reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the data base of another consumer credit reporting agency or multiple consumer credit reporting agencies, and does not maintain a permanent data base of credit information from which new consumer credit reports are produced. A consumer credit reporting agency shall honor any security freeze placed on a consumer credit report by another consumer credit reporting agency.

(b) The following entities are not required to place a security alert or a security freeze in a credit report:

(1) A check services company that issues authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments.

(2) A demand deposit account information service company that issues reports regarding account closures due to fraud, substantial overdrafts, ATM abuse, or similar negative information regarding a consumer, to inquiring banks or other financial institutions for use only in reviewing a consumer request for a demand deposit account at the inquiring bank or financial institution.