View Bill Status
View Bill Text
View Amendment
View Engrossed Bill (Original Bill with Amendment(s) Incorporated)
View Statement of Purpose / Fiscal Impact
S1380aa.....................................by COMMERCE AND HUMAN RESOURCES
CREDIT REPORTS - Adds to and repeals existing law relating to protection of
credit reports to provide a short title; to define terms; to provide a
security freeze on a consumer's credit report; to provide for removal of a
security freeze and for requirements and timing; to provide for changes to
information in a credit report subject to a security freeze; to provide for
protection of personal information; and to provide enforcement.
02/06 Senate intro - 1st rdg - to printing
02/07 Rpt prt - to Com/HuRes
02/13 Rpt out - rec d/p - to 2nd rdg
02/14 2nd rdg - to 3rd rdg
02/15 To 14th Ord
02/19 Rpt out amen - to engros
02/20 Rpt engros - 1st rdg - to 2nd rdg as amen
02/21 2nd rdg - to 3rd rdg as amen
02/25 3rd rdg as amen - PASSED - 33-0-2
AYES -- Andreason, Bair, Bastian, Bilyeu, Broadsword, Burkett,
Cameron, Corder, Darrington, Davis, Fulcher, Geddes, Goedde, Hammond,
Heinrich, Hill, Jorgenson, Kelly, Keough, Langhorst, Little, Lodge,
Malepeai(Sagness), McGee, McKague, McKenzie, Pearce, Richardson,
Schroeder, Siddoway, Stegner, Stennett, Werk
NAYS -- None
Absent and excused -- Coiner, Gannon
Floor Sponsor - Davis
Title apvd - to House
02/26 House intro - 1st rdg - to Bus
03/06 Rpt out - rec d/p - to 2nd rdg
03/07 2nd rdg - to 3rd rdg
03/12 3rd rdg - PASSED - 68-0-2
AYES -- Anderson, Andrus, Barrett, Bayer, Bedke, Bell, Bilbao, Black,
Block, Bock, Boe, Bolz, Bowers, Brackett, Bradford, Chadderdon,
Chavez, Chew, Clark, Collins, Crane, Durst, Eskridge, Hagedorn, Hart,
Harwood, Henbest, Henderson, Jaquet, Killen, King, Kren, Labrador,
Lake, LeFavour, Loertscher, Luker, Marriott, Mathews, Mortimer,
Moyle, Nielsen, Nonini, Pasley-Stuart, Patrick, Pence, Raybould,
Ringo, Roberts, Rusche, Sayler, Schaefer, Shepherd(02), Shepherd(08),
Shirley, Shively, Smith(30), Smith(24), Snodgrass, Stevenson, Thayn,
Thomas, Trail, Vander Woude, Wills, Wood(27), Wood(35), Mr. Speaker
NAYS -- None
Absent and excused -- McGeachin, Ruchti
Floor Sponsor - Black
Title apvd - to Senate
03/13 To enrol - Rpt enrol - Pres signed
03/14 Sp signed
03/17 To Governor
03/18 Governor signed
Session Law Chapter 177
Effective: 07/01/08
]]]] LEGISLATURE OF THE STATE OF IDAHO ]]]] Fifty-ninth Legislature Second Regular Session - 2008IN THE SENATE SENATE BILL NO. 1380 BY COMMERCE AND HUMAN RESOURCES COMMITTEE 1 AN ACT 2 RELATING TO PROTECTION OF CREDIT REPORTS; REPEALING SECTION 28-51-101, IDAHO 3 CODE, RELATING TO DEFINITIONS AND SECTION 28-51-102, IDAHO CODE, RELATING 4 TO A BLOCK OF INFORMATION APPEARING AS A RESULT OF A VIOLATION OF A CRIM- 5 INAL CODE PROVISION PROHIBITING MISAPPROPRIATION OF PERSONAL INFORMATION; 6 AMENDING TITLE 28, IDAHO CODE, BY THE ADDITION OF A NEW CHAPTER 52, TITLE 7 28, IDAHO CODE, TO PROVIDE A SHORT TITLE, TO DEFINE TERMS, TO PROVIDE FOR 8 A SECURITY FREEZE ON A CONSUMER'S CREDIT REPORT, TO PROVIDE FOR REMOVAL OF 9 A SECURITY FREEZE AND FOR REQUIREMENTS AND TIMING, TO PROVIDE FOR EXCEP- 10 TIONS, TO PROVIDE FOR FEES FOR A SECURITY FREEZE, TO PROVIDE FOR CHANGES 11 TO INFORMATION IN A CREDIT REPORT SUBJECT TO A SECURITY FREEZE, TO PROVIDE 12 FOR PROTECTION OF PERSONAL INFORMATION AND TO PROVIDE ENFORCEMENT. 13 Be It Enacted by the Legislature of the State of Idaho: 14 SECTION 1. That Sections 28-51-101 and 28-51-102, Idaho Code, be, and the 15 same are hereby repealed. 16 SECTION 2. That Title 28, Idaho Code, be, and the same is hereby amended 17 by the addition thereto of a NEW CHAPTER, to be known and designated as Chap- 18 ter 52, Title 28, Idaho Code, and to read as follows: 19 CHAPTER 52 20 CREDIT REPORT PROTECTION ACT 21 28-52-101. SHORT TITLE. This chapter shall be known and cited as the 22 "Credit Report Protection Act." 23 28-52-102. DEFINITIONS. In this chapter: 24 (1) "Consumer" means a natural person. 25 (2) "Consumer reporting agency" means a person who, for fees, dues or on 26 a cooperative basis, regularly engages in whole or in part in the practice of 27 assembling or evaluating information concerning a consumer's credit or other 28 information for the purpose of furnishing a credit report to another person. 29 (3) "Credit report" means a consumer report, as defined in 15 U.S.C. sec- 30 tion 1681a, that is used or collected, in whole or in part, for the purpose of 31 serving as a factor in establishing a consumer's eligibility for credit for 32 personal, family or household purposes. 33 (4) "Personal information" means personally identifiable financial infor- 34 mation provided by a consumer to another person, resulting from any transac- 35 tion with the consumer or any service performed for the consumer or otherwise 36 obtained by another person. Personal information does not include publicly 37 available information, as that term is defined by regulations prescribed under 38 15 U.S.C. section 6804, or any list, description or other grouping of con- 39 sumers, and publicly available information pertaining to consumers that is 40 derived without using any nonpublic personal information. Notwithstanding the 2 1 foregoing, "personal information" includes any list, description or other 2 grouping of consumers, and publicly available information pertaining to the 3 consumers, that is derived using any nonpublic personal information other than 4 publicly available information. 5 (5) "Proper identification" has the same meaning as in 15 U.S.C. section 6 1681h(a)(1) and includes: 7 (a) The consumer's full name, including first, middle and last names and 8 any suffix; 9 (b) Any name the consumer previously used; 10 (c) The consumer's current and recent full addresses, including street 11 address, any apartment number, city, state and zip code; 12 (d) The consumer's social security number; and 13 (e) The consumer's date of birth. 14 (6) "Security freeze" means a prohibition, consistent with section 15 28-52-103, Idaho Code, on a consumer reporting agency's furnishing of a 16 consumer's credit report to a third party intending to use the credit report 17 to determine the consumer's eligibility for credit. 18 28-52-103. SECURITY FREEZE. (1) A consumer may place a security freeze on 19 the consumer's credit report by: 20 (a) Making a request to a consumer reporting agency in writing by regular 21 or certified mail at an address designated by the consumer reporting 22 agency to receive the request; 23 (b) Providing proper identification; and 24 (c) Paying the fee required by the consumer reporting agency in accor- 25 dance with section 28-52-106, Idaho Code. 26 (2) Upon receiving a request from a consumer under subsection (1) of this 27 section, the consumer reporting agency shall: 28 (a) Place a security freeze on the consumer's credit report within three 29 (3) business days after receiving the consumer's request; and 30 (b) Within five (5) business days after placing the security freeze, send 31 a written confirmation of the security freeze to the consumer and provide 32 the consumer with a unique personal identification number or password to 33 be used by the consumer when providing authorizations for removal or tem- 34 porary lifts of the security freeze under section 28-52-104, Idaho Code. 35 (3) If a security freeze is in place, a consumer reporting agency may not 36 release a consumer's credit report, or information from the credit report, to 37 a third party that intends to use the information to determine a consumer's 38 eligibility for credit without prior authorization from the consumer. 39 (4) Notwithstanding subsection (3) of this section, a consumer reporting 40 agency may communicate to a third party requesting a consumer's credit report 41 that a security freeze is in effect on the consumer's credit report. If a 42 third party requesting a consumer's credit report in connection with the 43 consumer's application for credit is notified of the existence of a security 44 freeze under this section, the third party may treat the consumer's applica- 45 tion as incomplete. 46 (5) A consumer reporting agency shall require proper identification of 47 the consumer requesting to place, remove or temporarily remove a security 48 freeze. 49 (6) A consumer reporting agency shall develop a contact method to receive 50 and process a consumer's request to permanently remove or temporarily lift a 51 security freeze. The contact method may include: a postal address; an elec- 52 tronic contact method chosen by the consumer reporting agency, which may 53 include the use of fax, internet or other electronic means; or the use of 54 telephone in a manner that is consistent with any federal requirements placed 3 1 on the consumer reporting agency. By no later than September 1, 2008, a con- 2 sumer reporting agency shall develop a secure electronic means for a consumer 3 to request the temporary lift of a security freeze. 4 (7) A security freeze placed under this section may be removed only in 5 accordance with section 28-52-104, Idaho Code. 6 28-52-104. REMOVAL OF SECURITY FREEZE -- REQUIREMENTS AND TIMING. (1) A 7 consumer reporting agency may remove a security freeze from a consumer's 8 credit report only if the consumer reporting agency receives the consumer's 9 request through a contact method established and required in accordance with 10 subsection (6) of section 28-52-103, Idaho Code, and the consumer reporting 11 agency receives the consumer's proper identification and other information 12 sufficient to identify the consumer, including the consumer's personal identi- 13 fication number or password; or the consumer makes a material misrepresenta- 14 tion of fact in connection with the placement of the security freeze and the 15 consumer reporting agency notifies the consumer in writing before removing the 16 security freeze. 17 (2) A consumer reporting agency shall temporarily lift a security freeze 18 upon receipt of the consumer's request through the contact method established 19 by the consumer reporting agency in accordance with subsection (6) of section 20 28-52-103, Idaho Code, along with: 21 (a) The consumer's proper identification and other information sufficient 22 to identify the consumer; 23 (b) The consumer's personal identification number or password; 24 (c) The proper information regarding the third party who is to receive 25 the credit report or the time period for which the credit report is to be 26 available to users of the credit report; and 27 (d) A fee, if applicable. 28 (3) A consumer reporting agency shall remove or temporarily lift a secu- 29 rity freeze from a consumer's credit report as follows: 30 (a) Except as provided in paragraph (b) of this subsection regarding tem- 31 porary lifts, within three (3) business days after the business day on 32 which the consumer's written request to remove or temporarily lift the 33 security freeze is received by the consumer reporting agency using a con- 34 tact method chosen by the consumer reporting agency in accordance with 35 subsection (6) of section 28-52-103, Idaho Code; and 36 (b) On and after September 1, 2008, within fifteen (15) minutes after the 37 consumer's request to temporarily lift the security freeze is received by 38 the consumer reporting agency through the electronic contact method chosen 39 by the consumer reporting agency in accordance with subsection (6) of sec- 40 tion 28-52-103, Idaho Code, if such request is received between 6:00 a.m. 41 and 9:30 p.m. mountain time. 42 (4) A consumer reporting agency need not remove or temporarily lift a 43 security freeze within the time specified in subsection (3) of this section if 44 the consumer fails to meet the requirements of subsection (1) or (2) of this 45 section, as applicable, or the consumer reporting agency's ability to remove 46 the security freeze within such time is prevented by: 47 (a) An act of God, including fire, earthquake, hurricane, storm or simi- 48 lar natural disaster or phenomenon; 49 (b) Unauthorized or illegal acts by a third party, including terrorism, 50 sabotage, riot, vandalism, labor strikes or disputes disrupting opera- 51 tions, or similar occurrence; 52 (c) Operation interruption, including electrical failure, unanticipated 53 delay in equipment or replacement part delivery, computer hardware or 54 software failures inhibiting response time, or similar disruption; 4 1 (d) Governmental action, including emergency order or regulation, judi- 2 cial or law enforcement action or similar directive; 3 (e) Regularly scheduled maintenance, during other than normal business 4 hours, of, or updates to, the consumer reporting agency's systems; 5 (f) Commercially reasonable maintenance of, or repair to, the consumer 6 reporting agency's systems that is unexpected or unscheduled; or 7 (g) Receipt of a removal request outside of normal business hours. 8 28-52-105. EXCEPTIONS. (1) Notwithstanding subsection (1) of section 9 28-52-103, Idaho Code, a consumer reporting agency may furnish a consumer's 10 credit report to a third party if the purpose of the credit report is to: 11 (a) Use the credit report for purposes permitted under 15 U.S.C. section 12 1681b(c); 13 (b) Review the consumer's account with the third party, including for 14 account maintenance or monitoring credit line increases or other upgrades 15 or enhancements; 16 (c) Collect on a financial obligation owed by the consumer to the third 17 party requesting the credit report; or 18 (d) Review the consumer's account with another person, or collect on a 19 financial obligation owed by the consumer to another person and the credit 20 report request is for purposes permitted under 15 U.S.C. section 1681b(c) 21 or the third party requesting the credit report is a subsidiary, affili- 22 ate, agent, assignee or prospective assignee of the person holding the 23 consumer's account or to whom the consumer owes a financial obligation. 24 (2) The consumer's request for a security freeze does not prohibit the 25 consumer reporting agency from disclosing the consumer's credit report for 26 other than credit related purposes consistent with the definition of credit 27 report in section 28-52-102, Idaho Code. The following list identifies the 28 types of credit report disclosures by consumer reporting agencies to third 29 parties that are not prohibited by a security freeze: 30 (a) The third party does not use the credit report for the purpose of 31 serving as a factor in establishing a consumer's eligibility for credit; 32 (b) The third party is acting under a court order, warrant or subpoena 33 requiring release of the credit report; 34 (c) The third party is a child support agency, or its agent or assignee 35 acting under part D, title IV, of the social security act or a similar 36 state law; 37 (d) The third party is the federal department of health and human ser- 38 vices or a similar state agency, or its agent or assignee, investigating 39 medicare or medicaid fraud; 40 (e) The purpose of the credit report is to investigate or collect delin- 41 quent taxes, assessments or unpaid court orders and the third party is the 42 federal internal revenue service; a state taxing authority; the division 43 of motor vehicles of the Idaho transportation department; a county, munic- 44 ipality or other taxing district; a federal, state or local law enforce- 45 ment agency; or the agent or assignee listed in subsection (1) or (2) of 46 this section; 47 (f) The third party is using the information solely for criminal record 48 information, tenant screening, employment screening, fraud prevention or 49 detection, or personal loss history information; 50 (g) The third party is a person or entity regulated under title 41, Idaho 51 Code; 52 (h) The third party is administering a credit file monitoring service to 53 which the consumer has subscribed; or 54 (i) The third party requests the credit report for the sole purpose of 5 1 providing the consumer with a copy of the consumer's credit report or 2 credit score upon the consumer's request. 3 (3) Section 28-52-103, Idaho Code, does not apply to: 4 (a) A consumer reporting agency, the sole purpose of which is to resell 5 credit information by assembling and merging information contained in the 6 database of another consumer reporting agency and that does not maintain a 7 permanent database of credit information from which a consumer's credit 8 report is produced; 9 (b) A check services or fraud prevention services company that issues 10 reports on incidents of fraud or authorizations for the purpose of approv- 11 ing or processing negotiable instruments, electronic fund transfers or 12 similar methods of payment; or 13 (c) A deposit account information service company that issues reports 14 concerning account closures based on fraud, substantial overdrafts, auto- 15 mated teller machine abuse or similar information concerning a consumer to 16 a requesting financial institution for the purpose of evaluating a 17 consumer's request to create a deposit account. 18 (4) Nothing in this chapter prohibits a person from obtaining, aggregat- 19 ing or using information lawfully obtained from public records in a manner 20 that does not otherwise violate the provisions of this chapter. 21 28-52-106. FEES FOR SECURITY FREEZE. (1) Except as provided in subsection 22 (2) of this section, a consumer reporting agency may charge an administrative 23 fee, not to exceed six dollars ($6.00), to a consumer for each placement of a 24 security freeze, and six dollars ($6.00) for each temporary lift of a security 25 freeze. A consumer reporting agency may not charge an administrative fee for a 26 removal of a security freeze. 27 (2) A consumer reporting agency may not charge a fee under section 28 28-52-103(1)(c), Idaho Code, to a consumer who has been the victim of identity 29 theft and who has submitted to the consumer reporting agency a valid police 30 report, an investigative report or complaint that the consumer has filed with 31 a law enforcement agency. 32 (3) A consumer may be charged a reasonable fee, not to exceed ten dollars 33 ($10.00), if the consumer fails to retain the original personal identification 34 number, password or other device provided by the consumer reporting agency and 35 if the consumer asks the consumer reporting agency to reissue the same or a 36 new personal identification number, password or other device. 37 28-52-107. CHANGES TO INFORMATION IN A CREDIT REPORT SUBJECT TO A SECU- 38 RITY FREEZE. (1) If a credit report is subject to a security freeze, a con- 39 sumer reporting agency shall notify the consumer who is the subject of the 40 credit report within thirty (30) days if the consumer reporting agency 41 changes the consumer's name, date of birth, social security number or address. 42 (2) Notwithstanding subsection (1) of this section, a consumer reporting 43 agency may make technical modifications to information in a credit report that 44 is subject to a security freeze without providing notification to the con- 45 sumer. Technical modifications include the addition or subtraction of abbrevi- 46 ations to names and addresses and transpositions or corrections of incorrect 47 numbering or spelling. 48 (3) When providing notice of a change of address under subsection (1) of 49 this section, the consumer reporting agency shall provide notice to the con- 50 sumer at both the new address and the former address. 51 28-52-108. PROTECTION OF PERSONAL INFORMATION. (1) Except as allowed by 52 other law, a person may not display a social security number in a manner or 6 1 location that is likely to be open to public view. 2 (2) The state of Idaho, a department, agency, board, commission or other 3 political subdivision may not employ or contract for the employment of an 4 inmate in any facility operated by the department of correction or private 5 correctional facility contracted with the department of correction or county 6 jail in any capacity that would allow any inmate access to any other person's 7 personal information. 8 28-52-109. ENFORCEMENT. (1) Except as otherwise specified in this sec- 9 tion, any credit reporting agency that willfully fails to comply with any 10 requirement imposed under this chapter with respect to any consumer is liable 11 to that consumer in an amount equal to the sum of: 12 (a) Any actual damages sustained by the consumer as a result of the fail- 13 ure or damages of not less than one hundred dollars ($100) and not more 14 than one thousand dollars ($1,000); or 15 (b) Such amount of punitive damages as the court may allow; and 16 (c) In the case of any successful action to enforce any liability under 17 this section, the costs of the action together with reasonable attorney's 18 fees as determined by the court. 19 (2) Any person who obtains a consumer report, requests a security freeze, 20 requests the temporary lifting of a freeze or requests the removal of a secu- 21 rity freeze from a consumer reporting agency under false pretenses or in an 22 attempt to violate federal or state law shall be liable to the consumer 23 reporting agency for actual damages sustained by the consumer reporting agency 24 or one thousand dollars ($1,000), whichever is greater. 25 (3) Any credit reporting agency who is negligent in failing to comply 26 with any requirement imposed under this chapter with respect to any consumer 27 is liable to that consumer in an amount equal to the sum of: 28 (a) Any actual damages sustained by the consumer as a result of the fail- 29 ure; and 30 (b) In the case of any successful action to enforce any liability under 31 this section, the costs of the action together with reasonable attorney's 32 fees as determined by the court. 33 (4) Upon a finding by the court that an unsuccessful pleading, motion or 34 other paper filed in connection with an action under this chapter was filed in 35 bad faith or for purposes of harassment, the court shall award to the prevail- 36 ing party attorney's fees reasonable in relation to the work expended in 37 responding to the pleading, motion, or other paper. 38 (5) The attorney general may enforce this chapter's provisions and, not- 39 withstanding any other provision of law, the attorney general has exclusive 40 authority to bring an action against a credit reporting agency for violation 41 of section 28-52-104(3)(b), Idaho Code, concerning the requirement that a 42 credit reporting agency temporarily lift a freeze within fifteen (15) minutes. 43 In an action by the attorney general, a credit reporting agency that violates 44 this chapter's provisions is subject to a civil penalty not less than one hun- 45 dred dollars ($100) or greater than one thousand dollars ($1,000) for a viola- 46 tion or series of violations concerning a specific consumer and no greater 47 than one hundred thousand dollars ($100,000) in the aggregate for related 48 violations concerning more than one (1) consumer. In addition to the penalties 49 provided in this section, the attorney general may seek injunctive relief to 50 prevent future violations of this chapter in the district court in Ada county 51 or in the district court for the district in which a consumer resides who is 52 the subject of a credit report on which a violation occurs.
]]]] LEGISLATURE OF THE STATE OF IDAHO ]]]] Fifty-ninth Legislature Second Regular Session - 2008Moved by Davis Seconded by Stegner IN THE SENATE SENATE AMENDMENT TO S.B. NO. 1380 1 AMENDMENT TO SECTION 2 2 On page 5 of the printed bill, in line 51, delete "Except as allowed by" 3 and delete line 52 and insert: "Except as otherwise specifically provided by 4 law, a person shall not intentionally communicate an individual's social secu- 5 rity number to the general public."; and on page 6, delete line 1.
]]]] LEGISLATURE OF THE STATE OF IDAHO ]]]] Fifty-ninth Legislature Second Regular Session - 2008IN THE SENATE SENATE BILL NO. 1380, As Amended BY COMMERCE AND HUMAN RESOURCES COMMITTEE 1 AN ACT 2 RELATING TO PROTECTION OF CREDIT REPORTS; REPEALING SECTION 28-51-101, IDAHO 3 CODE, RELATING TO DEFINITIONS AND SECTION 28-51-102, IDAHO CODE, RELATING 4 TO A BLOCK OF INFORMATION APPEARING AS A RESULT OF A VIOLATION OF A CRIM- 5 INAL CODE PROVISION PROHIBITING MISAPPROPRIATION OF PERSONAL INFORMATION; 6 AMENDING TITLE 28, IDAHO CODE, BY THE ADDITION OF A NEW CHAPTER 52, TITLE 7 28, IDAHO CODE, TO PROVIDE A SHORT TITLE, TO DEFINE TERMS, TO PROVIDE FOR 8 A SECURITY FREEZE ON A CONSUMER'S CREDIT REPORT, TO PROVIDE FOR REMOVAL OF 9 A SECURITY FREEZE AND FOR REQUIREMENTS AND TIMING, TO PROVIDE FOR EXCEP- 10 TIONS, TO PROVIDE FOR FEES FOR A SECURITY FREEZE, TO PROVIDE FOR CHANGES 11 TO INFORMATION IN A CREDIT REPORT SUBJECT TO A SECURITY FREEZE, TO PROVIDE 12 FOR PROTECTION OF PERSONAL INFORMATION AND TO PROVIDE ENFORCEMENT. 13 Be It Enacted by the Legislature of the State of Idaho: 14 SECTION 1. That Sections 28-51-101 and 28-51-102, Idaho Code, be, and the 15 same are hereby repealed. 16 SECTION 2. That Title 28, Idaho Code, be, and the same is hereby amended 17 by the addition thereto of a NEW CHAPTER, to be known and designated as Chap- 18 ter 52, Title 28, Idaho Code, and to read as follows: 19 CHAPTER 52 20 CREDIT REPORT PROTECTION ACT 21 28-52-101. SHORT TITLE. This chapter shall be known and cited as the 22 "Credit Report Protection Act." 23 28-52-102. DEFINITIONS. In this chapter: 24 (1) "Consumer" means a natural person. 25 (2) "Consumer reporting agency" means a person who, for fees, dues or on 26 a cooperative basis, regularly engages in whole or in part in the practice of 27 assembling or evaluating information concerning a consumer's credit or other 28 information for the purpose of furnishing a credit report to another person. 29 (3) "Credit report" means a consumer report, as defined in 15 U.S.C. sec- 30 tion 1681a, that is used or collected, in whole or in part, for the purpose of 31 serving as a factor in establishing a consumer's eligibility for credit for 32 personal, family or household purposes. 33 (4) "Personal information" means personally identifiable financial infor- 34 mation provided by a consumer to another person, resulting from any transac- 35 tion with the consumer or any service performed for the consumer or otherwise 36 obtained by another person. Personal information does not include publicly 37 available information, as that term is defined by regulations prescribed under 38 15 U.S.C. section 6804, or any list, description or other grouping of con- 39 sumers, and publicly available information pertaining to consumers that is 40 derived without using any nonpublic personal information. Notwithstanding the 2 1 foregoing, "personal information" includes any list, description or other 2 grouping of consumers, and publicly available information pertaining to the 3 consumers, that is derived using any nonpublic personal information other than 4 publicly available information. 5 (5) "Proper identification" has the same meaning as in 15 U.S.C. section 6 1681h(a)(1) and includes: 7 (a) The consumer's full name, including first, middle and last names and 8 any suffix; 9 (b) Any name the consumer previously used; 10 (c) The consumer's current and recent full addresses, including street 11 address, any apartment number, city, state and zip code; 12 (d) The consumer's social security number; and 13 (e) The consumer's date of birth. 14 (6) "Security freeze" means a prohibition, consistent with section 15 28-52-103, Idaho Code, on a consumer reporting agency's furnishing of a 16 consumer's credit report to a third party intending to use the credit report 17 to determine the consumer's eligibility for credit. 18 28-52-103. SECURITY FREEZE. (1) A consumer may place a security freeze on 19 the consumer's credit report by: 20 (a) Making a request to a consumer reporting agency in writing by regular 21 or certified mail at an address designated by the consumer reporting 22 agency to receive the request; 23 (b) Providing proper identification; and 24 (c) Paying the fee required by the consumer reporting agency in accor- 25 dance with section 28-52-106, Idaho Code. 26 (2) Upon receiving a request from a consumer under subsection (1) of this 27 section, the consumer reporting agency shall: 28 (a) Place a security freeze on the consumer's credit report within three 29 (3) business days after receiving the consumer's request; and 30 (b) Within five (5) business days after placing the security freeze, send 31 a written confirmation of the security freeze to the consumer and provide 32 the consumer with a unique personal identification number or password to 33 be used by the consumer when providing authorizations for removal or tem- 34 porary lifts of the security freeze under section 28-52-104, Idaho Code. 35 (3) If a security freeze is in place, a consumer reporting agency may not 36 release a consumer's credit report, or information from the credit report, to 37 a third party that intends to use the information to determine a consumer's 38 eligibility for credit without prior authorization from the consumer. 39 (4) Notwithstanding subsection (3) of this section, a consumer reporting 40 agency may communicate to a third party requesting a consumer's credit report 41 that a security freeze is in effect on the consumer's credit report. If a 42 third party requesting a consumer's credit report in connection with the 43 consumer's application for credit is notified of the existence of a security 44 freeze under this section, the third party may treat the consumer's applica- 45 tion as incomplete. 46 (5) A consumer reporting agency shall require proper identification of 47 the consumer requesting to place, remove or temporarily remove a security 48 freeze. 49 (6) A consumer reporting agency shall develop a contact method to receive 50 and process a consumer's request to permanently remove or temporarily lift a 51 security freeze. The contact method may include: a postal address; an elec- 52 tronic contact method chosen by the consumer reporting agency, which may 53 include the use of fax, internet or other electronic means; or the use of 54 telephone in a manner that is consistent with any federal requirements placed 3 1 on the consumer reporting agency. By no later than September 1, 2008, a con- 2 sumer reporting agency shall develop a secure electronic means for a consumer 3 to request the temporary lift of a security freeze. 4 (7) A security freeze placed under this section may be removed only in 5 accordance with section 28-52-104, Idaho Code. 6 28-52-104. REMOVAL OF SECURITY FREEZE -- REQUIREMENTS AND TIMING. (1) A 7 consumer reporting agency may remove a security freeze from a consumer's 8 credit report only if the consumer reporting agency receives the consumer's 9 request through a contact method established and required in accordance with 10 subsection (6) of section 28-52-103, Idaho Code, and the consumer reporting 11 agency receives the consumer's proper identification and other information 12 sufficient to identify the consumer, including the consumer's personal identi- 13 fication number or password; or the consumer makes a material misrepresenta- 14 tion of fact in connection with the placement of the security freeze and the 15 consumer reporting agency notifies the consumer in writing before removing the 16 security freeze. 17 (2) A consumer reporting agency shall temporarily lift a security freeze 18 upon receipt of the consumer's request through the contact method established 19 by the consumer reporting agency in accordance with subsection (6) of section 20 28-52-103, Idaho Code, along with: 21 (a) The consumer's proper identification and other information sufficient 22 to identify the consumer; 23 (b) The consumer's personal identification number or password; 24 (c) The proper information regarding the third party who is to receive 25 the credit report or the time period for which the credit report is to be 26 available to users of the credit report; and 27 (d) A fee, if applicable. 28 (3) A consumer reporting agency shall remove or temporarily lift a secu- 29 rity freeze from a consumer's credit report as follows: 30 (a) Except as provided in paragraph (b) of this subsection regarding tem- 31 porary lifts, within three (3) business days after the business day on 32 which the consumer's written request to remove or temporarily lift the 33 security freeze is received by the consumer reporting agency using a con- 34 tact method chosen by the consumer reporting agency in accordance with 35 subsection (6) of section 28-52-103, Idaho Code; and 36 (b) On and after September 1, 2008, within fifteen (15) minutes after the 37 consumer's request to temporarily lift the security freeze is received by 38 the consumer reporting agency through the electronic contact method chosen 39 by the consumer reporting agency in accordance with subsection (6) of sec- 40 tion 28-52-103, Idaho Code, if such request is received between 6:00 a.m. 41 and 9:30 p.m. mountain time. 42 (4) A consumer reporting agency need not remove or temporarily lift a 43 security freeze within the time specified in subsection (3) of this section if 44 the consumer fails to meet the requirements of subsection (1) or (2) of this 45 section, as applicable, or the consumer reporting agency's ability to remove 46 the security freeze within such time is prevented by: 47 (a) An act of God, including fire, earthquake, hurricane, storm or simi- 48 lar natural disaster or phenomenon; 49 (b) Unauthorized or illegal acts by a third party, including terrorism, 50 sabotage, riot, vandalism, labor strikes or disputes disrupting opera- 51 tions, or similar occurrence; 52 (c) Operation interruption, including electrical failure, unanticipated 53 delay in equipment or replacement part delivery, computer hardware or 54 software failures inhibiting response time, or similar disruption; 4 1 (d) Governmental action, including emergency order or regulation, judi- 2 cial or law enforcement action or similar directive; 3 (e) Regularly scheduled maintenance, during other than normal business 4 hours, of, or updates to, the consumer reporting agency's systems; 5 (f) Commercially reasonable maintenance of, or repair to, the consumer 6 reporting agency's systems that is unexpected or unscheduled; or 7 (g) Receipt of a removal request outside of normal business hours. 8 28-52-105. EXCEPTIONS. (1) Notwithstanding subsection (1) of section 9 28-52-103, Idaho Code, a consumer reporting agency may furnish a consumer's 10 credit report to a third party if the purpose of the credit report is to: 11 (a) Use the credit report for purposes permitted under 15 U.S.C. section 12 1681b(c); 13 (b) Review the consumer's account with the third party, including for 14 account maintenance or monitoring credit line increases or other upgrades 15 or enhancements; 16 (c) Collect on a financial obligation owed by the consumer to the third 17 party requesting the credit report; or 18 (d) Review the consumer's account with another person, or collect on a 19 financial obligation owed by the consumer to another person and the credit 20 report request is for purposes permitted under 15 U.S.C. section 1681b(c) 21 or the third party requesting the credit report is a subsidiary, affili- 22 ate, agent, assignee or prospective assignee of the person holding the 23 consumer's account or to whom the consumer owes a financial obligation. 24 (2) The consumer's request for a security freeze does not prohibit the 25 consumer reporting agency from disclosing the consumer's credit report for 26 other than credit related purposes consistent with the definition of credit 27 report in section 28-52-102, Idaho Code. The following list identifies the 28 types of credit report disclosures by consumer reporting agencies to third 29 parties that are not prohibited by a security freeze: 30 (a) The third party does not use the credit report for the purpose of 31 serving as a factor in establishing a consumer's eligibility for credit; 32 (b) The third party is acting under a court order, warrant or subpoena 33 requiring release of the credit report; 34 (c) The third party is a child support agency, or its agent or assignee 35 acting under part D, title IV, of the social security act or a similar 36 state law; 37 (d) The third party is the federal department of health and human ser- 38 vices or a similar state agency, or its agent or assignee, investigating 39 medicare or medicaid fraud; 40 (e) The purpose of the credit report is to investigate or collect delin- 41 quent taxes, assessments or unpaid court orders and the third party is the 42 federal internal revenue service; a state taxing authority; the division 43 of motor vehicles of the Idaho transportation department; a county, munic- 44 ipality or other taxing district; a federal, state or local law enforce- 45 ment agency; or the agent or assignee listed in subsection (1) or (2) of 46 this section; 47 (f) The third party is using the information solely for criminal record 48 information, tenant screening, employment screening, fraud prevention or 49 detection, or personal loss history information; 50 (g) The third party is a person or entity regulated under title 41, Idaho 51 Code; 52 (h) The third party is administering a credit file monitoring service to 53 which the consumer has subscribed; or 54 (i) The third party requests the credit report for the sole purpose of 5 1 providing the consumer with a copy of the consumer's credit report or 2 credit score upon the consumer's request. 3 (3) Section 28-52-103, Idaho Code, does not apply to: 4 (a) A consumer reporting agency, the sole purpose of which is to resell 5 credit information by assembling and merging information contained in the 6 database of another consumer reporting agency and that does not maintain a 7 permanent database of credit information from which a consumer's credit 8 report is produced; 9 (b) A check services or fraud prevention services company that issues 10 reports on incidents of fraud or authorizations for the purpose of approv- 11 ing or processing negotiable instruments, electronic fund transfers or 12 similar methods of payment; or 13 (c) A deposit account information service company that issues reports 14 concerning account closures based on fraud, substantial overdrafts, auto- 15 mated teller machine abuse or similar information concerning a consumer to 16 a requesting financial institution for the purpose of evaluating a 17 consumer's request to create a deposit account. 18 (4) Nothing in this chapter prohibits a person from obtaining, aggregat- 19 ing or using information lawfully obtained from public records in a manner 20 that does not otherwise violate the provisions of this chapter. 21 28-52-106. FEES FOR SECURITY FREEZE. (1) Except as provided in subsection 22 (2) of this section, a consumer reporting agency may charge an administrative 23 fee, not to exceed six dollars ($6.00), to a consumer for each placement of a 24 security freeze, and six dollars ($6.00) for each temporary lift of a security 25 freeze. A consumer reporting agency may not charge an administrative fee for a 26 removal of a security freeze. 27 (2) A consumer reporting agency may not charge a fee under section 28 28-52-103(1)(c), Idaho Code, to a consumer who has been the victim of identity 29 theft and who has submitted to the consumer reporting agency a valid police 30 report, an investigative report or complaint that the consumer has filed with 31 a law enforcement agency. 32 (3) A consumer may be charged a reasonable fee, not to exceed ten dollars 33 ($10.00), if the consumer fails to retain the original personal identification 34 number, password or other device provided by the consumer reporting agency and 35 if the consumer asks the consumer reporting agency to reissue the same or a 36 new personal identification number, password or other device. 37 28-52-107. CHANGES TO INFORMATION IN A CREDIT REPORT SUBJECT TO A SECU- 38 RITY FREEZE. (1) If a credit report is subject to a security freeze, a con- 39 sumer reporting agency shall notify the consumer who is the subject of the 40 credit report within thirty (30) days if the consumer reporting agency 41 changes the consumer's name, date of birth, social security number or address. 42 (2) Notwithstanding subsection (1) of this section, a consumer reporting 43 agency may make technical modifications to information in a credit report that 44 is subject to a security freeze without providing notification to the con- 45 sumer. Technical modifications include the addition or subtraction of abbrevi- 46 ations to names and addresses and transpositions or corrections of incorrect 47 numbering or spelling. 48 (3) When providing notice of a change of address under subsection (1) of 49 this section, the consumer reporting agency shall provide notice to the con- 50 sumer at both the new address and the former address. 51 28-52-108. PROTECTION OF PERSONAL INFORMATION. (1) Except as otherwise 52 specifically provided by law, a person shall not intentionally communicate an 6 1 individual's social security number to the general public. 2 (2) The state of Idaho, a department, agency, board, commission or other 3 political subdivision may not employ or contract for the employment of an 4 inmate in any facility operated by the department of correction or private 5 correctional facility contracted with the department of correction or county 6 jail in any capacity that would allow any inmate access to any other person's 7 personal information. 8 28-52-109. ENFORCEMENT. (1) Except as otherwise specified in this sec- 9 tion, any credit reporting agency that willfully fails to comply with any 10 requirement imposed under this chapter with respect to any consumer is liable 11 to that consumer in an amount equal to the sum of: 12 (a) Any actual damages sustained by the consumer as a result of the fail- 13 ure or damages of not less than one hundred dollars ($100) and not more 14 than one thousand dollars ($1,000); or 15 (b) Such amount of punitive damages as the court may allow; and 16 (c) In the case of any successful action to enforce any liability under 17 this section, the costs of the action together with reasonable attorney's 18 fees as determined by the court. 19 (2) Any person who obtains a consumer report, requests a security freeze, 20 requests the temporary lifting of a freeze or requests the removal of a secu- 21 rity freeze from a consumer reporting agency under false pretenses or in an 22 attempt to violate federal or state law shall be liable to the consumer 23 reporting agency for actual damages sustained by the consumer reporting agency 24 or one thousand dollars ($1,000), whichever is greater. 25 (3) Any credit reporting agency who is negligent in failing to comply 26 with any requirement imposed under this chapter with respect to any consumer 27 is liable to that consumer in an amount equal to the sum of: 28 (a) Any actual damages sustained by the consumer as a result of the fail- 29 ure; and 30 (b) In the case of any successful action to enforce any liability under 31 this section, the costs of the action together with reasonable attorney's 32 fees as determined by the court. 33 (4) Upon a finding by the court that an unsuccessful pleading, motion or 34 other paper filed in connection with an action under this chapter was filed in 35 bad faith or for purposes of harassment, the court shall award to the prevail- 36 ing party attorney's fees reasonable in relation to the work expended in 37 responding to the pleading, motion, or other paper. 38 (5) The attorney general may enforce this chapter's provisions and, not- 39 withstanding any other provision of law, the attorney general has exclusive 40 authority to bring an action against a credit reporting agency for violation 41 of section 28-52-104(3)(b), Idaho Code, concerning the requirement that a 42 credit reporting agency temporarily lift a freeze within fifteen (15) minutes. 43 In an action by the attorney general, a credit reporting agency that violates 44 this chapter's provisions is subject to a civil penalty not less than one hun- 45 dred dollars ($100) or greater than one thousand dollars ($1,000) for a viola- 46 tion or series of violations concerning a specific consumer and no greater 47 than one hundred thousand dollars ($100,000) in the aggregate for related 48 violations concerning more than one (1) consumer. In addition to the penalties 49 provided in this section, the attorney general may seek injunctive relief to 50 prevent future violations of this chapter in the district court in Ada county 51 or in the district court for the district in which a consumer resides who is 52 the subject of a credit report on which a violation occurs.
STATEMENT OF PURPOSE
RS 17641
The purpose of this bill is to allow consumers to "freeze" access to their
credit reports, as a means to help prevent fraud and identity theft. A "freeze"
means that anyone attempting to obtain a credit report on a consumer will be
unable to get one, and will simply be told that the credit report is frozen.
Because most creditors and merchants won't extend significant credit without
reviewing the consumer's credit report first, it will be more difficult for
fraudsters to obtain credit using someone else's stolen identity. If, having
frozen his credit report, the consumer himself needs to obtain credit, he can
temporarily lift, or permanently remove, the freeze on his own account.
The bill specifies how a consumer can place a freeze with a credit reporting
agency, how the consumer can temporarily lift the freeze so that the consumer may
engage in a credit transaction, and how a consumer can permanently remove a
freeze. It also sets out a number of exceptions to the freeze, to allow creditors
to use credit reports to monitor, service and collect their existing credit
accounts, to allow the credit reporting agency to comply with subpoenas and court
orders, to allow screening by potential landlords and employers, and to allow
other legitimate non-credit related uses of credit reports. In order to defray
the costs associated with placing and lifting a freeze, the bill allows a credit
reporting agency to charge a fee of up to $6 to place a freeze or to temporarily
lift a freeze. No fee may be charged for permanently removing a freeze. A
consumer who has been a victim of identity theft may not be charged a fee
for placing or removing a freeze. Credit reporting agencies who fail to comply
with this bill's requirements are subject to suit for damages, punitive damages
and injunctive relief by consumers and by the Attorney General.
FISCAL NOTE
This bill will have no impact on the general fund.
Contact
Name: Pat Collins and Dawn Justice, Idaho Bankers Association
Phone: 208- 388-4828 and 208-342-8282
Name: Joe Gallegos, AARP
Phone: 208-855-4005
Name: Alan Cameron, Idaho Credit Union League
Phone: 208-343-4841
Name: Mike Brassey, Idaho Financial Services Association
Phone: 208-336-7930
Name: Pam Eaton, Idaho Retailers Association
Phone: 208-342-0010
S 1380