HSB 622 (LSB 6148YC (4) 87)

HOUSE FILE _____ 

BY  (PROPOSED COMMITTEE ON JUDICIARY BILL BY CHAIRPERSON NUNN)

A BILL FOR

An Act relating to consumer protection modifying provisions applicable to consumer security freezes and personal information security breach protection. 
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA:

    Section 1.  Section 714G.2, Code 2018, is amended to read as follows:
   714G.2  Security freeze.

   1.  A consumer may submit by certified mail to a consumer reporting agency a written request for a security freeze to a consumer reporting agency by first-class mail, telephone, facsimile, secure internet connection, secure electronic mail, or other secure electronic contact method. The consumer must submit proper identification and the applicable fee with the request. Within five three business days after receiving the request, the consumer reporting agency shall commence the security freeze. Within ten three business days after commencing the security freeze, the consumer reporting agency shall send a written confirmation to the consumer of the security freeze, a personal identification number or password, other than the consumer’s social security number, for the consumer to use in authorizing the suspension or removal of the security freeze, including information on how the security freeze may be temporarily suspended.
   2.  a.  If a consumer requests a security freeze from a consumer reporting agency that compiles and maintains files on a nationwide basis, the consumer may request to have the security freeze applied to any other consumer reporting agency that compiles and maintains files on consumers on a nationwide basis.
   b.  For purposes of this subsection, “consumer reporting agency that compiles and maintains files on a nationwide basis” means the same as defined in 15 U.S.C. §1681a(p).
    Sec. 2.  Section 714G.3, subsection 1, Code 2018, is amended to read as follows:
   1.  A consumer may request that a security freeze be temporarily suspended to allow the consumer reporting agency to release the consumer credit report for a specific time period. The consumer reporting agency may shall develop procedures to expedite the receipt and processing of requests which may involve the use of telephones by first-class mail, telephone, facsimile transmissions, the secure internet connection, secure electronic mail, or other secure electronic media contact method. The consumer reporting agency shall comply with the request within three business days after receiving the consumer’s written request, or within fifteen minutes after the consumer’s request is received by the consumer reporting agency through facsimile, the secure internet connection, secure electronic mail, or other secure electronic contact method chosen by the consumer reporting agency, or the use of a telephone, during normal business hours. The consumer’s request shall include all of the following:
   a.  Proper identification.
   b.  The personal identification number or password provided by the consumer reporting agency.
   c.  Explicit instructions of the specific time period designated for suspension of the security freeze.
   d.  Payment of the applicable fee.
    Sec. 3.  Section 714G.4, unnumbered paragraph 1, Code 2018, is amended to read as follows:
   A security freeze remains in effect until the consumer requests that the security freeze be removed. A consumer reporting agency shall remove a security freeze within three business days after receiving a request for removal that includes proper identification of the consumer, and the personal identification number or password provided by the consumer reporting agency, and payment of the applicable fee.
    Sec. 4.  Section 714G.5, Code 2018, is amended to read as follows:
   714G.5  Fees prohibited.
   1.  A consumer reporting agency shall not charge any fee to a consumer who is the victim of identity theft for commencing a security freeze, temporary suspension, or removal if with the initial security freeze request, the consumer submits a valid copy of the police report concerning the unlawful use of identification information by another person.
   2.  A consumer reporting agency may charge a fee not to exceed ten dollars to a consumer who is not the victim of identity theft for each security freeze, removal, or for reissuing a personal identification number or password if the consumer fails to retain the original number. The consumer reporting agency may charge a fee not to exceed twelve dollars for each temporary suspension of a security freeze.
   A consumer reporting agency shall not charge a fee to a consumer for providing any service pursuant to this chapter, including but not limited to placing, removing, temporarily suspending, or reinstating a security freeze.
    Sec. 5.  Section 714G.8A, subsection 1, paragraph d, Code 2018, is amended by striking the paragraph.
    Sec. 6.  Section 714G.8A, subsection 3, paragraph d, Code 2018, is amended by striking the paragraph.
    Sec. 7.  Section 714G.8A, subsection 5, Code 2018, is amended to read as follows:
   5.  a.  A consumer reporting agency may shall not charge a reasonable fee, not to exceed five dollars, for each the placement, or removal, or reinstatement of a protected consumer security freeze. A consumer reporting agency may not charge any other fee for a service performed pursuant to this section.
   b.  Notwithstanding paragraph “a”, a fee may not be charged by a consumer reporting agency pursuant to either of the following:
   (1)  If the protected consumer’s representative has obtained a police report or affidavit of alleged identity theft under section 715A.8 and submits a copy of the report or affidavit to the consumer reporting agency.
   (2)  A request for the commencement or removal of a protected consumer security freeze is for a protected consumer who is under the age of sixteen years at the time of the request and the consumer reporting agency has a consumer credit report pertaining to the protected consumer.
    Sec. 8.  Section 715C.1, subsections 1 and 5, Code 2018, are amended to read as follows:
   1.  “Breach of security” means unauthorized acquisition, or reasonable belief of unauthorized acquisition, of personal information maintained in computerized any form, including but not limited to electronic or paper form, by a person that compromises the security, confidentiality, or integrity of the personal information. “Breach of security” also means unauthorized acquisition of personal information maintained by a person in any medium, including on paper, that was transferred by the person to that medium from computerized form and that compromises the security, confidentiality, or integrity of the personal information. Good faith acquisition of personal information by a person or that person’s employee or agent for a legitimate purpose of that person is not a breach of security, provided that the personal information is not used in violation of applicable law or in a manner that harms or poses an actual threat to the security, confidentiality, or integrity of the personal information.
   5.  “Encryption” means the use of an one-hundred-twenty-
eight-bit or higher algorithmic process to transform data into a form in which the data is rendered unreadable or unusable without the use of a confidential process or key.
    Sec. 9.  Section 715C.2, subsections 7 and 8, Code 2018, are amended to read as follows:
   7.  This section does Subsections 1 through 6 shall not apply to any of the following:
   a.  A person who complies with notification requirements or breach of security procedures that provide greater protection to personal information and at least as thorough disclosure requirements than that provided by this section pursuant to the rules, regulations, procedures, guidance, or guidelines established by the person’s primary or functional federal regulator.
   b.  A person who complies with a state or federal law that provides greater protection to personal information and at least as thorough disclosure requirements for breach of security or personal information than that provided by this section.
   c.  A person who is subject to and complies with regulations promulgated pursuant to Tit. V of the federalGramm-Leach-Bliley Act of 1999, 15 U.S.C. §6801 – 6809.
   d.  A person who is subject to and complies with regulations promulgated pursuant to Tit. II, subtit. F of the federal Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. §1320d – 1320d-9, and Tit. XIII, subtit. D of the federal Health Information Technology for Economic and Clinical Health Act of 2009, 42 U.S.C. §17921 – 17954.
   8.  Any person who owns or licenses computerized data that includes a consumer’s personal information that is used in the course of the person’s business, vocation, occupation, or volunteer activities and that was subject to a breach of security requiring notification to more than five hundred residents of this state consumers pursuant to this section subsection 1 or any of the laws, rules, regulations, procedures, guidance, or guidelines set forth in subsection 7 shall give written notice of the breach of security following discovery of such breach of security, or receipt of notification under subsection 2, to the director of the consumer protection division of the office of the attorney general within five business days after giving notice of the breach of security to any consumer pursuant to this section.
EXPLANATION
The inclusion of this explanation does not constitute agreement with
the explanation’s substance by the members of the general assembly.
   This bill relates to consumer security freezes and personal information security breach protection.
   Current law permits a consumer to submit a request for a security freeze via certified mail. The bill expands the methods permitted for a consumer to submit a request for a security freeze to allow such requests to be submitted via first-class mail, telephone, facsimile, secure internet connection, secure electronic mail, or other secure electronic contact method. 
   The bill reduces the number of days by which a consumer reporting agency must commence a security freeze after receiving a request from five to three business days. The bill also reduces the number of days by which a consumer reporting agency must send written confirmation to a consumer after commencing a security freeze from ten to three business days.
   The bill provides that if a consumer requests a security freeze from a consumer reporting agency that compiles and maintains files on a nationwide basis, as defined in the bill, the consumer may request to have the security freeze applied to any other similar consumer reporting agency.
   The bill requires consumer reporting agencies to develop procedures to expedite the receipt and processing of security freeze suspension requests received via the same methods permitted for consumers to submit such requests. The bill requires a consumer reporting agency to commence a security freeze suspension within 15 minutes after receiving a request through telephone, facsimile, secure internet connection, secure electronic mail, or other secure electronic contact method.
   The bill prohibits consumer reporting agencies from charging fees to consumers for providing any service pursuant to Code chapter 714G, including but not limited to placing, removing, temporarily suspending, or reinstating a security freeze. The bill also prohibits consumer reporting agencies from charging fees for placing or removing a protected consumer security freeze pursuant to Code section 714G.8A. The bill removes several references to payment of fees in Code chapter 714G. 
   The bill also modifies various provisions relating to personal information security breach protection in Code chapter 715C. The bill expands the definition of “breach of security” to include the reasonable belief of unauthorized acquisition of personal information, which may be in any form, including electronic or paper form. However, the bill removes the unauthorized acquisition of personal information that was transferred from computerized form to another medium from the definition of “breach of security”. The definition of “encryption” is modified to mean the use of an 128-bit or higher algorithmic process.
   The bill exempts from the consumer notification requirements persons who are subject to and comply with specified federal health information laws.
   Current law requires a person who owns or licenses personal information that is subject to a breach of security requiring notification to more than 500 consumers in the state, as required by Code section 715C.2, to give written notice of the breach of security to the director of the consumer protection division of the office of the attorney general. The bill provides that written notification to the attorney general is also required for breaches of security where written notification to more than 500 consumers in the state is required by a person’s primary or functional federal regulator, a state or federal law that gives greater protection to personal information than provided in Code section 715C.2, or certain federal law.