SENATE BILL NO. 1380
View Bill Status
View Bill Text
View Amendment
View Engrossed Bill (Original Bill with Amendment(s) Incorporated)
View Statement of Purpose / Fiscal Impact
Text to be added within a bill has been marked with Bold and
Underline. Text to be removed has been marked with
Strikethrough and Italic. How these codes are actually displayed will
vary based on the browser software you are using.
This sentence is marked with bold and underline to show added text.
This sentence is marked with strikethrough and italic, indicating
text to be removed.
S1380aa.....................................by COMMERCE AND HUMAN RESOURCES
CREDIT REPORTS - Adds to and repeals existing law relating to protection of
credit reports to provide a short title; to define terms; to provide a
security freeze on a consumer's credit report; to provide for removal of a
security freeze and for requirements and timing; to provide for changes to
information in a credit report subject to a security freeze; to provide for
protection of personal information; and to provide enforcement.
02/06 Senate intro - 1st rdg - to printing
02/07 Rpt prt - to Com/HuRes
02/13 Rpt out - rec d/p - to 2nd rdg
02/14 2nd rdg - to 3rd rdg
02/15 To 14th Ord
02/19 Rpt out amen - to engros
02/20 Rpt engros - 1st rdg - to 2nd rdg as amen
02/21 2nd rdg - to 3rd rdg as amen
02/25 3rd rdg as amen - PASSED - 33-0-2
AYES -- Andreason, Bair, Bastian, Bilyeu, Broadsword, Burkett,
Cameron, Corder, Darrington, Davis, Fulcher, Geddes, Goedde, Hammond,
Heinrich, Hill, Jorgenson, Kelly, Keough, Langhorst, Little, Lodge,
Malepeai(Sagness), McGee, McKague, McKenzie, Pearce, Richardson,
Schroeder, Siddoway, Stegner, Stennett, Werk
NAYS -- None
Absent and excused -- Coiner, Gannon
Floor Sponsor - Davis
Title apvd - to House
02/26 House intro - 1st rdg - to Bus
03/06 Rpt out - rec d/p - to 2nd rdg
03/07 2nd rdg - to 3rd rdg
03/12 3rd rdg - PASSED - 68-0-2
AYES -- Anderson, Andrus, Barrett, Bayer, Bedke, Bell, Bilbao, Black,
Block, Bock, Boe, Bolz, Bowers, Brackett, Bradford, Chadderdon,
Chavez, Chew, Clark, Collins, Crane, Durst, Eskridge, Hagedorn, Hart,
Harwood, Henbest, Henderson, Jaquet, Killen, King, Kren, Labrador,
Lake, LeFavour, Loertscher, Luker, Marriott, Mathews, Mortimer,
Moyle, Nielsen, Nonini, Pasley-Stuart, Patrick, Pence, Raybould,
Ringo, Roberts, Rusche, Sayler, Schaefer, Shepherd(02), Shepherd(08),
Shirley, Shively, Smith(30), Smith(24), Snodgrass, Stevenson, Thayn,
Thomas, Trail, Vander Woude, Wills, Wood(27), Wood(35), Mr. Speaker
NAYS -- None
Absent and excused -- McGeachin, Ruchti
Floor Sponsor - Black
Title apvd - to Senate
03/13 To enrol - Rpt enrol - Pres signed
03/14 Sp signed
03/17 To Governor
03/18 Governor signed
Session Law Chapter 177
Effective: 07/01/08
]]]] LEGISLATURE OF THE STATE OF IDAHO ]]]]
Fifty-ninth Legislature Second Regular Session - 2008
IN THE SENATE
SENATE BILL NO. 1380
BY COMMERCE AND HUMAN RESOURCES COMMITTEE
1 AN ACT
2 RELATING TO PROTECTION OF CREDIT REPORTS; REPEALING SECTION 28-51-101, IDAHO
3 CODE, RELATING TO DEFINITIONS AND SECTION 28-51-102, IDAHO CODE, RELATING
4 TO A BLOCK OF INFORMATION APPEARING AS A RESULT OF A VIOLATION OF A CRIM-
5 INAL CODE PROVISION PROHIBITING MISAPPROPRIATION OF PERSONAL INFORMATION;
6 AMENDING TITLE 28, IDAHO CODE, BY THE ADDITION OF A NEW CHAPTER 52, TITLE
7 28, IDAHO CODE, TO PROVIDE A SHORT TITLE, TO DEFINE TERMS, TO PROVIDE FOR
8 A SECURITY FREEZE ON A CONSUMER'S CREDIT REPORT, TO PROVIDE FOR REMOVAL OF
9 A SECURITY FREEZE AND FOR REQUIREMENTS AND TIMING, TO PROVIDE FOR EXCEP-
10 TIONS, TO PROVIDE FOR FEES FOR A SECURITY FREEZE, TO PROVIDE FOR CHANGES
11 TO INFORMATION IN A CREDIT REPORT SUBJECT TO A SECURITY FREEZE, TO PROVIDE
12 FOR PROTECTION OF PERSONAL INFORMATION AND TO PROVIDE ENFORCEMENT.
13 Be It Enacted by the Legislature of the State of Idaho:
14 SECTION 1. That Sections 28-51-101 and 28-51-102, Idaho Code, be, and the
15 same are hereby repealed.
16 SECTION 2. That Title 28, Idaho Code, be, and the same is hereby amended
17 by the addition thereto of a NEW CHAPTER, to be known and designated as Chap-
18 ter 52, Title 28, Idaho Code, and to read as follows:
19 CHAPTER 52
20 CREDIT REPORT PROTECTION ACT
21 28-52-101. SHORT TITLE. This chapter shall be known and cited as the
22 "Credit Report Protection Act."
23 28-52-102. DEFINITIONS. In this chapter:
24 (1) "Consumer" means a natural person.
25 (2) "Consumer reporting agency" means a person who, for fees, dues or on
26 a cooperative basis, regularly engages in whole or in part in the practice of
27 assembling or evaluating information concerning a consumer's credit or other
28 information for the purpose of furnishing a credit report to another person.
29 (3) "Credit report" means a consumer report, as defined in 15 U.S.C. sec-
30 tion 1681a, that is used or collected, in whole or in part, for the purpose of
31 serving as a factor in establishing a consumer's eligibility for credit for
32 personal, family or household purposes.
33 (4) "Personal information" means personally identifiable financial infor-
34 mation provided by a consumer to another person, resulting from any transac-
35 tion with the consumer or any service performed for the consumer or otherwise
36 obtained by another person. Personal information does not include publicly
37 available information, as that term is defined by regulations prescribed under
38 15 U.S.C. section 6804, or any list, description or other grouping of con-
39 sumers, and publicly available information pertaining to consumers that is
40 derived without using any nonpublic personal information. Notwithstanding the
2
1 foregoing, "personal information" includes any list, description or other
2 grouping of consumers, and publicly available information pertaining to the
3 consumers, that is derived using any nonpublic personal information other than
4 publicly available information.
5 (5) "Proper identification" has the same meaning as in 15 U.S.C. section
6 1681h(a)(1) and includes:
7 (a) The consumer's full name, including first, middle and last names and
8 any suffix;
9 (b) Any name the consumer previously used;
10 (c) The consumer's current and recent full addresses, including street
11 address, any apartment number, city, state and zip code;
12 (d) The consumer's social security number; and
13 (e) The consumer's date of birth.
14 (6) "Security freeze" means a prohibition, consistent with section
15 28-52-103, Idaho Code, on a consumer reporting agency's furnishing of a
16 consumer's credit report to a third party intending to use the credit report
17 to determine the consumer's eligibility for credit.
18 28-52-103. SECURITY FREEZE. (1) A consumer may place a security freeze on
19 the consumer's credit report by:
20 (a) Making a request to a consumer reporting agency in writing by regular
21 or certified mail at an address designated by the consumer reporting
22 agency to receive the request;
23 (b) Providing proper identification; and
24 (c) Paying the fee required by the consumer reporting agency in accor-
25 dance with section 28-52-106, Idaho Code.
26 (2) Upon receiving a request from a consumer under subsection (1) of this
27 section, the consumer reporting agency shall:
28 (a) Place a security freeze on the consumer's credit report within three
29 (3) business days after receiving the consumer's request; and
30 (b) Within five (5) business days after placing the security freeze, send
31 a written confirmation of the security freeze to the consumer and provide
32 the consumer with a unique personal identification number or password to
33 be used by the consumer when providing authorizations for removal or tem-
34 porary lifts of the security freeze under section 28-52-104, Idaho Code.
35 (3) If a security freeze is in place, a consumer reporting agency may not
36 release a consumer's credit report, or information from the credit report, to
37 a third party that intends to use the information to determine a consumer's
38 eligibility for credit without prior authorization from the consumer.
39 (4) Notwithstanding subsection (3) of this section, a consumer reporting
40 agency may communicate to a third party requesting a consumer's credit report
41 that a security freeze is in effect on the consumer's credit report. If a
42 third party requesting a consumer's credit report in connection with the
43 consumer's application for credit is notified of the existence of a security
44 freeze under this section, the third party may treat the consumer's applica-
45 tion as incomplete.
46 (5) A consumer reporting agency shall require proper identification of
47 the consumer requesting to place, remove or temporarily remove a security
48 freeze.
49 (6) A consumer reporting agency shall develop a contact method to receive
50 and process a consumer's request to permanently remove or temporarily lift a
51 security freeze. The contact method may include: a postal address; an elec-
52 tronic contact method chosen by the consumer reporting agency, which may
53 include the use of fax, internet or other electronic means; or the use of
54 telephone in a manner that is consistent with any federal requirements placed
3
1 on the consumer reporting agency. By no later than September 1, 2008, a con-
2 sumer reporting agency shall develop a secure electronic means for a consumer
3 to request the temporary lift of a security freeze.
4 (7) A security freeze placed under this section may be removed only in
5 accordance with section 28-52-104, Idaho Code.
6 28-52-104. REMOVAL OF SECURITY FREEZE -- REQUIREMENTS AND TIMING. (1) A
7 consumer reporting agency may remove a security freeze from a consumer's
8 credit report only if the consumer reporting agency receives the consumer's
9 request through a contact method established and required in accordance with
10 subsection (6) of section 28-52-103, Idaho Code, and the consumer reporting
11 agency receives the consumer's proper identification and other information
12 sufficient to identify the consumer, including the consumer's personal identi-
13 fication number or password; or the consumer makes a material misrepresenta-
14 tion of fact in connection with the placement of the security freeze and the
15 consumer reporting agency notifies the consumer in writing before removing the
16 security freeze.
17 (2) A consumer reporting agency shall temporarily lift a security freeze
18 upon receipt of the consumer's request through the contact method established
19 by the consumer reporting agency in accordance with subsection (6) of section
20 28-52-103, Idaho Code, along with:
21 (a) The consumer's proper identification and other information sufficient
22 to identify the consumer;
23 (b) The consumer's personal identification number or password;
24 (c) The proper information regarding the third party who is to receive
25 the credit report or the time period for which the credit report is to be
26 available to users of the credit report; and
27 (d) A fee, if applicable.
28 (3) A consumer reporting agency shall remove or temporarily lift a secu-
29 rity freeze from a consumer's credit report as follows:
30 (a) Except as provided in paragraph (b) of this subsection regarding tem-
31 porary lifts, within three (3) business days after the business day on
32 which the consumer's written request to remove or temporarily lift the
33 security freeze is received by the consumer reporting agency using a con-
34 tact method chosen by the consumer reporting agency in accordance with
35 subsection (6) of section 28-52-103, Idaho Code; and
36 (b) On and after September 1, 2008, within fifteen (15) minutes after the
37 consumer's request to temporarily lift the security freeze is received by
38 the consumer reporting agency through the electronic contact method chosen
39 by the consumer reporting agency in accordance with subsection (6) of sec-
40 tion 28-52-103, Idaho Code, if such request is received between 6:00 a.m.
41 and 9:30 p.m. mountain time.
42 (4) A consumer reporting agency need not remove or temporarily lift a
43 security freeze within the time specified in subsection (3) of this section if
44 the consumer fails to meet the requirements of subsection (1) or (2) of this
45 section, as applicable, or the consumer reporting agency's ability to remove
46 the security freeze within such time is prevented by:
47 (a) An act of God, including fire, earthquake, hurricane, storm or simi-
48 lar natural disaster or phenomenon;
49 (b) Unauthorized or illegal acts by a third party, including terrorism,
50 sabotage, riot, vandalism, labor strikes or disputes disrupting opera-
51 tions, or similar occurrence;
52 (c) Operation interruption, including electrical failure, unanticipated
53 delay in equipment or replacement part delivery, computer hardware or
54 software failures inhibiting response time, or similar disruption;
4
1 (d) Governmental action, including emergency order or regulation, judi-
2 cial or law enforcement action or similar directive;
3 (e) Regularly scheduled maintenance, during other than normal business
4 hours, of, or updates to, the consumer reporting agency's systems;
5 (f) Commercially reasonable maintenance of, or repair to, the consumer
6 reporting agency's systems that is unexpected or unscheduled; or
7 (g) Receipt of a removal request outside of normal business hours.
8 28-52-105. EXCEPTIONS. (1) Notwithstanding subsection (1) of section
9 28-52-103, Idaho Code, a consumer reporting agency may furnish a consumer's
10 credit report to a third party if the purpose of the credit report is to:
11 (a) Use the credit report for purposes permitted under 15 U.S.C. section
12 1681b(c);
13 (b) Review the consumer's account with the third party, including for
14 account maintenance or monitoring credit line increases or other upgrades
15 or enhancements;
16 (c) Collect on a financial obligation owed by the consumer to the third
17 party requesting the credit report; or
18 (d) Review the consumer's account with another person, or collect on a
19 financial obligation owed by the consumer to another person and the credit
20 report request is for purposes permitted under 15 U.S.C. section 1681b(c)
21 or the third party requesting the credit report is a subsidiary, affili-
22 ate, agent, assignee or prospective assignee of the person holding the
23 consumer's account or to whom the consumer owes a financial obligation.
24 (2) The consumer's request for a security freeze does not prohibit the
25 consumer reporting agency from disclosing the consumer's credit report for
26 other than credit related purposes consistent with the definition of credit
27 report in section 28-52-102, Idaho Code. The following list identifies the
28 types of credit report disclosures by consumer reporting agencies to third
29 parties that are not prohibited by a security freeze:
30 (a) The third party does not use the credit report for the purpose of
31 serving as a factor in establishing a consumer's eligibility for credit;
32 (b) The third party is acting under a court order, warrant or subpoena
33 requiring release of the credit report;
34 (c) The third party is a child support agency, or its agent or assignee
35 acting under part D, title IV, of the social security act or a similar
36 state law;
37 (d) The third party is the federal department of health and human ser-
38 vices or a similar state agency, or its agent or assignee, investigating
39 medicare or medicaid fraud;
40 (e) The purpose of the credit report is to investigate or collect delin-
41 quent taxes, assessments or unpaid court orders and the third party is the
42 federal internal revenue service; a state taxing authority; the division
43 of motor vehicles of the Idaho transportation department; a county, munic-
44 ipality or other taxing district; a federal, state or local law enforce-
45 ment agency; or the agent or assignee listed in subsection (1) or (2) of
46 this section;
47 (f) The third party is using the information solely for criminal record
48 information, tenant screening, employment screening, fraud prevention or
49 detection, or personal loss history information;
50 (g) The third party is a person or entity regulated under title 41, Idaho
51 Code;
52 (h) The third party is administering a credit file monitoring service to
53 which the consumer has subscribed; or
54 (i) The third party requests the credit report for the sole purpose of
5
1 providing the consumer with a copy of the consumer's credit report or
2 credit score upon the consumer's request.
3 (3) Section 28-52-103, Idaho Code, does not apply to:
4 (a) A consumer reporting agency, the sole purpose of which is to resell
5 credit information by assembling and merging information contained in the
6 database of another consumer reporting agency and that does not maintain a
7 permanent database of credit information from which a consumer's credit
8 report is produced;
9 (b) A check services or fraud prevention services company that issues
10 reports on incidents of fraud or authorizations for the purpose of approv-
11 ing or processing negotiable instruments, electronic fund transfers or
12 similar methods of payment; or
13 (c) A deposit account information service company that issues reports
14 concerning account closures based on fraud, substantial overdrafts, auto-
15 mated teller machine abuse or similar information concerning a consumer to
16 a requesting financial institution for the purpose of evaluating a
17 consumer's request to create a deposit account.
18 (4) Nothing in this chapter prohibits a person from obtaining, aggregat-
19 ing or using information lawfully obtained from public records in a manner
20 that does not otherwise violate the provisions of this chapter.
21 28-52-106. FEES FOR SECURITY FREEZE. (1) Except as provided in subsection
22 (2) of this section, a consumer reporting agency may charge an administrative
23 fee, not to exceed six dollars ($6.00), to a consumer for each placement of a
24 security freeze, and six dollars ($6.00) for each temporary lift of a security
25 freeze. A consumer reporting agency may not charge an administrative fee for a
26 removal of a security freeze.
27 (2) A consumer reporting agency may not charge a fee under section
28 28-52-103(1)(c), Idaho Code, to a consumer who has been the victim of identity
29 theft and who has submitted to the consumer reporting agency a valid police
30 report, an investigative report or complaint that the consumer has filed with
31 a law enforcement agency.
32 (3) A consumer may be charged a reasonable fee, not to exceed ten dollars
33 ($10.00), if the consumer fails to retain the original personal identification
34 number, password or other device provided by the consumer reporting agency and
35 if the consumer asks the consumer reporting agency to reissue the same or a
36 new personal identification number, password or other device.
37 28-52-107. CHANGES TO INFORMATION IN A CREDIT REPORT SUBJECT TO A SECU-
38 RITY FREEZE. (1) If a credit report is subject to a security freeze, a con-
39 sumer reporting agency shall notify the consumer who is the subject of the
40 credit report within thirty (30) days if the consumer reporting agency
41 changes the consumer's name, date of birth, social security number or address.
42 (2) Notwithstanding subsection (1) of this section, a consumer reporting
43 agency may make technical modifications to information in a credit report that
44 is subject to a security freeze without providing notification to the con-
45 sumer. Technical modifications include the addition or subtraction of abbrevi-
46 ations to names and addresses and transpositions or corrections of incorrect
47 numbering or spelling.
48 (3) When providing notice of a change of address under subsection (1) of
49 this section, the consumer reporting agency shall provide notice to the con-
50 sumer at both the new address and the former address.
51 28-52-108. PROTECTION OF PERSONAL INFORMATION. (1) Except as allowed by
52 other law, a person may not display a social security number in a manner or
6
1 location that is likely to be open to public view.
2 (2) The state of Idaho, a department, agency, board, commission or other
3 political subdivision may not employ or contract for the employment of an
4 inmate in any facility operated by the department of correction or private
5 correctional facility contracted with the department of correction or county
6 jail in any capacity that would allow any inmate access to any other person's
7 personal information.
8 28-52-109. ENFORCEMENT. (1) Except as otherwise specified in this sec-
9 tion, any credit reporting agency that willfully fails to comply with any
10 requirement imposed under this chapter with respect to any consumer is liable
11 to that consumer in an amount equal to the sum of:
12 (a) Any actual damages sustained by the consumer as a result of the fail-
13 ure or damages of not less than one hundred dollars ($100) and not more
14 than one thousand dollars ($1,000); or
15 (b) Such amount of punitive damages as the court may allow; and
16 (c) In the case of any successful action to enforce any liability under
17 this section, the costs of the action together with reasonable attorney's
18 fees as determined by the court.
19 (2) Any person who obtains a consumer report, requests a security freeze,
20 requests the temporary lifting of a freeze or requests the removal of a secu-
21 rity freeze from a consumer reporting agency under false pretenses or in an
22 attempt to violate federal or state law shall be liable to the consumer
23 reporting agency for actual damages sustained by the consumer reporting agency
24 or one thousand dollars ($1,000), whichever is greater.
25 (3) Any credit reporting agency who is negligent in failing to comply
26 with any requirement imposed under this chapter with respect to any consumer
27 is liable to that consumer in an amount equal to the sum of:
28 (a) Any actual damages sustained by the consumer as a result of the fail-
29 ure; and
30 (b) In the case of any successful action to enforce any liability under
31 this section, the costs of the action together with reasonable attorney's
32 fees as determined by the court.
33 (4) Upon a finding by the court that an unsuccessful pleading, motion or
34 other paper filed in connection with an action under this chapter was filed in
35 bad faith or for purposes of harassment, the court shall award to the prevail-
36 ing party attorney's fees reasonable in relation to the work expended in
37 responding to the pleading, motion, or other paper.
38 (5) The attorney general may enforce this chapter's provisions and, not-
39 withstanding any other provision of law, the attorney general has exclusive
40 authority to bring an action against a credit reporting agency for violation
41 of section 28-52-104(3)(b), Idaho Code, concerning the requirement that a
42 credit reporting agency temporarily lift a freeze within fifteen (15) minutes.
43 In an action by the attorney general, a credit reporting agency that violates
44 this chapter's provisions is subject to a civil penalty not less than one hun-
45 dred dollars ($100) or greater than one thousand dollars ($1,000) for a viola-
46 tion or series of violations concerning a specific consumer and no greater
47 than one hundred thousand dollars ($100,000) in the aggregate for related
48 violations concerning more than one (1) consumer. In addition to the penalties
49 provided in this section, the attorney general may seek injunctive relief to
50 prevent future violations of this chapter in the district court in Ada county
51 or in the district court for the district in which a consumer resides who is
52 the subject of a credit report on which a violation occurs.
]]]] LEGISLATURE OF THE STATE OF IDAHO ]]]]
Fifty-ninth Legislature Second Regular Session - 2008
Moved by Davis
Seconded by Stegner
IN THE SENATE
SENATE AMENDMENT TO S.B. NO. 1380
1 AMENDMENT TO SECTION 2
2 On page 5 of the printed bill, in line 51, delete "Except as allowed by"
3 and delete line 52 and insert: "Except as otherwise specifically provided by
4 law, a person shall not intentionally communicate an individual's social secu-
5 rity number to the general public."; and on page 6, delete line 1.
]]]] LEGISLATURE OF THE STATE OF IDAHO ]]]]
Fifty-ninth Legislature Second Regular Session - 2008
IN THE SENATE
SENATE BILL NO. 1380, As Amended
BY COMMERCE AND HUMAN RESOURCES COMMITTEE
1 AN ACT
2 RELATING TO PROTECTION OF CREDIT REPORTS; REPEALING SECTION 28-51-101, IDAHO
3 CODE, RELATING TO DEFINITIONS AND SECTION 28-51-102, IDAHO CODE, RELATING
4 TO A BLOCK OF INFORMATION APPEARING AS A RESULT OF A VIOLATION OF A CRIM-
5 INAL CODE PROVISION PROHIBITING MISAPPROPRIATION OF PERSONAL INFORMATION;
6 AMENDING TITLE 28, IDAHO CODE, BY THE ADDITION OF A NEW CHAPTER 52, TITLE
7 28, IDAHO CODE, TO PROVIDE A SHORT TITLE, TO DEFINE TERMS, TO PROVIDE FOR
8 A SECURITY FREEZE ON A CONSUMER'S CREDIT REPORT, TO PROVIDE FOR REMOVAL OF
9 A SECURITY FREEZE AND FOR REQUIREMENTS AND TIMING, TO PROVIDE FOR EXCEP-
10 TIONS, TO PROVIDE FOR FEES FOR A SECURITY FREEZE, TO PROVIDE FOR CHANGES
11 TO INFORMATION IN A CREDIT REPORT SUBJECT TO A SECURITY FREEZE, TO PROVIDE
12 FOR PROTECTION OF PERSONAL INFORMATION AND TO PROVIDE ENFORCEMENT.
13 Be It Enacted by the Legislature of the State of Idaho:
14 SECTION 1. That Sections 28-51-101 and 28-51-102, Idaho Code, be, and the
15 same are hereby repealed.
16 SECTION 2. That Title 28, Idaho Code, be, and the same is hereby amended
17 by the addition thereto of a NEW CHAPTER, to be known and designated as Chap-
18 ter 52, Title 28, Idaho Code, and to read as follows:
19 CHAPTER 52
20 CREDIT REPORT PROTECTION ACT
21 28-52-101. SHORT TITLE. This chapter shall be known and cited as the
22 "Credit Report Protection Act."
23 28-52-102. DEFINITIONS. In this chapter:
24 (1) "Consumer" means a natural person.
25 (2) "Consumer reporting agency" means a person who, for fees, dues or on
26 a cooperative basis, regularly engages in whole or in part in the practice of
27 assembling or evaluating information concerning a consumer's credit or other
28 information for the purpose of furnishing a credit report to another person.
29 (3) "Credit report" means a consumer report, as defined in 15 U.S.C. sec-
30 tion 1681a, that is used or collected, in whole or in part, for the purpose of
31 serving as a factor in establishing a consumer's eligibility for credit for
32 personal, family or household purposes.
33 (4) "Personal information" means personally identifiable financial infor-
34 mation provided by a consumer to another person, resulting from any transac-
35 tion with the consumer or any service performed for the consumer or otherwise
36 obtained by another person. Personal information does not include publicly
37 available information, as that term is defined by regulations prescribed under
38 15 U.S.C. section 6804, or any list, description or other grouping of con-
39 sumers, and publicly available information pertaining to consumers that is
40 derived without using any nonpublic personal information. Notwithstanding the
2
1 foregoing, "personal information" includes any list, description or other
2 grouping of consumers, and publicly available information pertaining to the
3 consumers, that is derived using any nonpublic personal information other than
4 publicly available information.
5 (5) "Proper identification" has the same meaning as in 15 U.S.C. section
6 1681h(a)(1) and includes:
7 (a) The consumer's full name, including first, middle and last names and
8 any suffix;
9 (b) Any name the consumer previously used;
10 (c) The consumer's current and recent full addresses, including street
11 address, any apartment number, city, state and zip code;
12 (d) The consumer's social security number; and
13 (e) The consumer's date of birth.
14 (6) "Security freeze" means a prohibition, consistent with section
15 28-52-103, Idaho Code, on a consumer reporting agency's furnishing of a
16 consumer's credit report to a third party intending to use the credit report
17 to determine the consumer's eligibility for credit.
18 28-52-103. SECURITY FREEZE. (1) A consumer may place a security freeze on
19 the consumer's credit report by:
20 (a) Making a request to a consumer reporting agency in writing by regular
21 or certified mail at an address designated by the consumer reporting
22 agency to receive the request;
23 (b) Providing proper identification; and
24 (c) Paying the fee required by the consumer reporting agency in accor-
25 dance with section 28-52-106, Idaho Code.
26 (2) Upon receiving a request from a consumer under subsection (1) of this
27 section, the consumer reporting agency shall:
28 (a) Place a security freeze on the consumer's credit report within three
29 (3) business days after receiving the consumer's request; and
30 (b) Within five (5) business days after placing the security freeze, send
31 a written confirmation of the security freeze to the consumer and provide
32 the consumer with a unique personal identification number or password to
33 be used by the consumer when providing authorizations for removal or tem-
34 porary lifts of the security freeze under section 28-52-104, Idaho Code.
35 (3) If a security freeze is in place, a consumer reporting agency may not
36 release a consumer's credit report, or information from the credit report, to
37 a third party that intends to use the information to determine a consumer's
38 eligibility for credit without prior authorization from the consumer.
39 (4) Notwithstanding subsection (3) of this section, a consumer reporting
40 agency may communicate to a third party requesting a consumer's credit report
41 that a security freeze is in effect on the consumer's credit report. If a
42 third party requesting a consumer's credit report in connection with the
43 consumer's application for credit is notified of the existence of a security
44 freeze under this section, the third party may treat the consumer's applica-
45 tion as incomplete.
46 (5) A consumer reporting agency shall require proper identification of
47 the consumer requesting to place, remove or temporarily remove a security
48 freeze.
49 (6) A consumer reporting agency shall develop a contact method to receive
50 and process a consumer's request to permanently remove or temporarily lift a
51 security freeze. The contact method may include: a postal address; an elec-
52 tronic contact method chosen by the consumer reporting agency, which may
53 include the use of fax, internet or other electronic means; or the use of
54 telephone in a manner that is consistent with any federal requirements placed
3
1 on the consumer reporting agency. By no later than September 1, 2008, a con-
2 sumer reporting agency shall develop a secure electronic means for a consumer
3 to request the temporary lift of a security freeze.
4 (7) A security freeze placed under this section may be removed only in
5 accordance with section 28-52-104, Idaho Code.
6 28-52-104. REMOVAL OF SECURITY FREEZE -- REQUIREMENTS AND TIMING. (1) A
7 consumer reporting agency may remove a security freeze from a consumer's
8 credit report only if the consumer reporting agency receives the consumer's
9 request through a contact method established and required in accordance with
10 subsection (6) of section 28-52-103, Idaho Code, and the consumer reporting
11 agency receives the consumer's proper identification and other information
12 sufficient to identify the consumer, including the consumer's personal identi-
13 fication number or password; or the consumer makes a material misrepresenta-
14 tion of fact in connection with the placement of the security freeze and the
15 consumer reporting agency notifies the consumer in writing before removing the
16 security freeze.
17 (2) A consumer reporting agency shall temporarily lift a security freeze
18 upon receipt of the consumer's request through the contact method established
19 by the consumer reporting agency in accordance with subsection (6) of section
20 28-52-103, Idaho Code, along with:
21 (a) The consumer's proper identification and other information sufficient
22 to identify the consumer;
23 (b) The consumer's personal identification number or password;
24 (c) The proper information regarding the third party who is to receive
25 the credit report or the time period for which the credit report is to be
26 available to users of the credit report; and
27 (d) A fee, if applicable.
28 (3) A consumer reporting agency shall remove or temporarily lift a secu-
29 rity freeze from a consumer's credit report as follows:
30 (a) Except as provided in paragraph (b) of this subsection regarding tem-
31 porary lifts, within three (3) business days after the business day on
32 which the consumer's written request to remove or temporarily lift the
33 security freeze is received by the consumer reporting agency using a con-
34 tact method chosen by the consumer reporting agency in accordance with
35 subsection (6) of section 28-52-103, Idaho Code; and
36 (b) On and after September 1, 2008, within fifteen (15) minutes after the
37 consumer's request to temporarily lift the security freeze is received by
38 the consumer reporting agency through the electronic contact method chosen
39 by the consumer reporting agency in accordance with subsection (6) of sec-
40 tion 28-52-103, Idaho Code, if such request is received between 6:00 a.m.
41 and 9:30 p.m. mountain time.
42 (4) A consumer reporting agency need not remove or temporarily lift a
43 security freeze within the time specified in subsection (3) of this section if
44 the consumer fails to meet the requirements of subsection (1) or (2) of this
45 section, as applicable, or the consumer reporting agency's ability to remove
46 the security freeze within such time is prevented by:
47 (a) An act of God, including fire, earthquake, hurricane, storm or simi-
48 lar natural disaster or phenomenon;
49 (b) Unauthorized or illegal acts by a third party, including terrorism,
50 sabotage, riot, vandalism, labor strikes or disputes disrupting opera-
51 tions, or similar occurrence;
52 (c) Operation interruption, including electrical failure, unanticipated
53 delay in equipment or replacement part delivery, computer hardware or
54 software failures inhibiting response time, or similar disruption;
4
1 (d) Governmental action, including emergency order or regulation, judi-
2 cial or law enforcement action or similar directive;
3 (e) Regularly scheduled maintenance, during other than normal business
4 hours, of, or updates to, the consumer reporting agency's systems;
5 (f) Commercially reasonable maintenance of, or repair to, the consumer
6 reporting agency's systems that is unexpected or unscheduled; or
7 (g) Receipt of a removal request outside of normal business hours.
8 28-52-105. EXCEPTIONS. (1) Notwithstanding subsection (1) of section
9 28-52-103, Idaho Code, a consumer reporting agency may furnish a consumer's
10 credit report to a third party if the purpose of the credit report is to:
11 (a) Use the credit report for purposes permitted under 15 U.S.C. section
12 1681b(c);
13 (b) Review the consumer's account with the third party, including for
14 account maintenance or monitoring credit line increases or other upgrades
15 or enhancements;
16 (c) Collect on a financial obligation owed by the consumer to the third
17 party requesting the credit report; or
18 (d) Review the consumer's account with another person, or collect on a
19 financial obligation owed by the consumer to another person and the credit
20 report request is for purposes permitted under 15 U.S.C. section 1681b(c)
21 or the third party requesting the credit report is a subsidiary, affili-
22 ate, agent, assignee or prospective assignee of the person holding the
23 consumer's account or to whom the consumer owes a financial obligation.
24 (2) The consumer's request for a security freeze does not prohibit the
25 consumer reporting agency from disclosing the consumer's credit report for
26 other than credit related purposes consistent with the definition of credit
27 report in section 28-52-102, Idaho Code. The following list identifies the
28 types of credit report disclosures by consumer reporting agencies to third
29 parties that are not prohibited by a security freeze:
30 (a) The third party does not use the credit report for the purpose of
31 serving as a factor in establishing a consumer's eligibility for credit;
32 (b) The third party is acting under a court order, warrant or subpoena
33 requiring release of the credit report;
34 (c) The third party is a child support agency, or its agent or assignee
35 acting under part D, title IV, of the social security act or a similar
36 state law;
37 (d) The third party is the federal department of health and human ser-
38 vices or a similar state agency, or its agent or assignee, investigating
39 medicare or medicaid fraud;
40 (e) The purpose of the credit report is to investigate or collect delin-
41 quent taxes, assessments or unpaid court orders and the third party is the
42 federal internal revenue service; a state taxing authority; the division
43 of motor vehicles of the Idaho transportation department; a county, munic-
44 ipality or other taxing district; a federal, state or local law enforce-
45 ment agency; or the agent or assignee listed in subsection (1) or (2) of
46 this section;
47 (f) The third party is using the information solely for criminal record
48 information, tenant screening, employment screening, fraud prevention or
49 detection, or personal loss history information;
50 (g) The third party is a person or entity regulated under title 41, Idaho
51 Code;
52 (h) The third party is administering a credit file monitoring service to
53 which the consumer has subscribed; or
54 (i) The third party requests the credit report for the sole purpose of
5
1 providing the consumer with a copy of the consumer's credit report or
2 credit score upon the consumer's request.
3 (3) Section 28-52-103, Idaho Code, does not apply to:
4 (a) A consumer reporting agency, the sole purpose of which is to resell
5 credit information by assembling and merging information contained in the
6 database of another consumer reporting agency and that does not maintain a
7 permanent database of credit information from which a consumer's credit
8 report is produced;
9 (b) A check services or fraud prevention services company that issues
10 reports on incidents of fraud or authorizations for the purpose of approv-
11 ing or processing negotiable instruments, electronic fund transfers or
12 similar methods of payment; or
13 (c) A deposit account information service company that issues reports
14 concerning account closures based on fraud, substantial overdrafts, auto-
15 mated teller machine abuse or similar information concerning a consumer to
16 a requesting financial institution for the purpose of evaluating a
17 consumer's request to create a deposit account.
18 (4) Nothing in this chapter prohibits a person from obtaining, aggregat-
19 ing or using information lawfully obtained from public records in a manner
20 that does not otherwise violate the provisions of this chapter.
21 28-52-106. FEES FOR SECURITY FREEZE. (1) Except as provided in subsection
22 (2) of this section, a consumer reporting agency may charge an administrative
23 fee, not to exceed six dollars ($6.00), to a consumer for each placement of a
24 security freeze, and six dollars ($6.00) for each temporary lift of a security
25 freeze. A consumer reporting agency may not charge an administrative fee for a
26 removal of a security freeze.
27 (2) A consumer reporting agency may not charge a fee under section
28 28-52-103(1)(c), Idaho Code, to a consumer who has been the victim of identity
29 theft and who has submitted to the consumer reporting agency a valid police
30 report, an investigative report or complaint that the consumer has filed with
31 a law enforcement agency.
32 (3) A consumer may be charged a reasonable fee, not to exceed ten dollars
33 ($10.00), if the consumer fails to retain the original personal identification
34 number, password or other device provided by the consumer reporting agency and
35 if the consumer asks the consumer reporting agency to reissue the same or a
36 new personal identification number, password or other device.
37 28-52-107. CHANGES TO INFORMATION IN A CREDIT REPORT SUBJECT TO A SECU-
38 RITY FREEZE. (1) If a credit report is subject to a security freeze, a con-
39 sumer reporting agency shall notify the consumer who is the subject of the
40 credit report within thirty (30) days if the consumer reporting agency
41 changes the consumer's name, date of birth, social security number or address.
42 (2) Notwithstanding subsection (1) of this section, a consumer reporting
43 agency may make technical modifications to information in a credit report that
44 is subject to a security freeze without providing notification to the con-
45 sumer. Technical modifications include the addition or subtraction of abbrevi-
46 ations to names and addresses and transpositions or corrections of incorrect
47 numbering or spelling.
48 (3) When providing notice of a change of address under subsection (1) of
49 this section, the consumer reporting agency shall provide notice to the con-
50 sumer at both the new address and the former address.
51 28-52-108. PROTECTION OF PERSONAL INFORMATION. (1) Except as otherwise
52 specifically provided by law, a person shall not intentionally communicate an
6
1 individual's social security number to the general public.
2 (2) The state of Idaho, a department, agency, board, commission or other
3 political subdivision may not employ or contract for the employment of an
4 inmate in any facility operated by the department of correction or private
5 correctional facility contracted with the department of correction or county
6 jail in any capacity that would allow any inmate access to any other person's
7 personal information.
8 28-52-109. ENFORCEMENT. (1) Except as otherwise specified in this sec-
9 tion, any credit reporting agency that willfully fails to comply with any
10 requirement imposed under this chapter with respect to any consumer is liable
11 to that consumer in an amount equal to the sum of:
12 (a) Any actual damages sustained by the consumer as a result of the fail-
13 ure or damages of not less than one hundred dollars ($100) and not more
14 than one thousand dollars ($1,000); or
15 (b) Such amount of punitive damages as the court may allow; and
16 (c) In the case of any successful action to enforce any liability under
17 this section, the costs of the action together with reasonable attorney's
18 fees as determined by the court.
19 (2) Any person who obtains a consumer report, requests a security freeze,
20 requests the temporary lifting of a freeze or requests the removal of a secu-
21 rity freeze from a consumer reporting agency under false pretenses or in an
22 attempt to violate federal or state law shall be liable to the consumer
23 reporting agency for actual damages sustained by the consumer reporting agency
24 or one thousand dollars ($1,000), whichever is greater.
25 (3) Any credit reporting agency who is negligent in failing to comply
26 with any requirement imposed under this chapter with respect to any consumer
27 is liable to that consumer in an amount equal to the sum of:
28 (a) Any actual damages sustained by the consumer as a result of the fail-
29 ure; and
30 (b) In the case of any successful action to enforce any liability under
31 this section, the costs of the action together with reasonable attorney's
32 fees as determined by the court.
33 (4) Upon a finding by the court that an unsuccessful pleading, motion or
34 other paper filed in connection with an action under this chapter was filed in
35 bad faith or for purposes of harassment, the court shall award to the prevail-
36 ing party attorney's fees reasonable in relation to the work expended in
37 responding to the pleading, motion, or other paper.
38 (5) The attorney general may enforce this chapter's provisions and, not-
39 withstanding any other provision of law, the attorney general has exclusive
40 authority to bring an action against a credit reporting agency for violation
41 of section 28-52-104(3)(b), Idaho Code, concerning the requirement that a
42 credit reporting agency temporarily lift a freeze within fifteen (15) minutes.
43 In an action by the attorney general, a credit reporting agency that violates
44 this chapter's provisions is subject to a civil penalty not less than one hun-
45 dred dollars ($100) or greater than one thousand dollars ($1,000) for a viola-
46 tion or series of violations concerning a specific consumer and no greater
47 than one hundred thousand dollars ($100,000) in the aggregate for related
48 violations concerning more than one (1) consumer. In addition to the penalties
49 provided in this section, the attorney general may seek injunctive relief to
50 prevent future violations of this chapter in the district court in Ada county
51 or in the district court for the district in which a consumer resides who is
52 the subject of a credit report on which a violation occurs.
STATEMENT OF PURPOSE
RS 17641
The purpose of this bill is to allow consumers to "freeze" access to their
credit reports, as a means to help prevent fraud and identity theft. A "freeze"
means that anyone attempting to obtain a credit report on a consumer will be
unable to get one, and will simply be told that the credit report is frozen.
Because most creditors and merchants won't extend significant credit without
reviewing the consumer's credit report first, it will be more difficult for
fraudsters to obtain credit using someone else's stolen identity. If, having
frozen his credit report, the consumer himself needs to obtain credit, he can
temporarily lift, or permanently remove, the freeze on his own account.
The bill specifies how a consumer can place a freeze with a credit reporting
agency, how the consumer can temporarily lift the freeze so that the consumer may
engage in a credit transaction, and how a consumer can permanently remove a
freeze. It also sets out a number of exceptions to the freeze, to allow creditors
to use credit reports to monitor, service and collect their existing credit
accounts, to allow the credit reporting agency to comply with subpoenas and court
orders, to allow screening by potential landlords and employers, and to allow
other legitimate non-credit related uses of credit reports. In order to defray
the costs associated with placing and lifting a freeze, the bill allows a credit
reporting agency to charge a fee of up to $6 to place a freeze or to temporarily
lift a freeze. No fee may be charged for permanently removing a freeze. A
consumer who has been a victim of identity theft may not be charged a fee
for placing or removing a freeze. Credit reporting agencies who fail to comply
with this bill's requirements are subject to suit for damages, punitive damages
and injunctive relief by consumers and by the Attorney General.
FISCAL NOTE
This bill will have no impact on the general fund.
Contact
Name: Pat Collins and Dawn Justice, Idaho Bankers Association
Phone: 208- 388-4828 and 208-342-8282
Name: Joe Gallegos, AARP
Phone: 208-855-4005
Name: Alan Cameron, Idaho Credit Union League
Phone: 208-343-4841
Name: Mike Brassey, Idaho Financial Services Association
Phone: 208-336-7930
Name: Pam Eaton, Idaho Retailers Association
Phone: 208-342-0010
S 1380