Senate File 2277 - Enrolled PAG LIN 1 1 SENATE FILE 2277 1 2 1 3 AN ACT 1 4 RELATING TO OFFENSES AGAINST IDENTITY BY ESTABLISHING A 1 5 PROCEDURE TO SECURE CREDIT INFORMATION AND PROVIDING A 1 6 PENALTY. 1 7 1 8 BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA: 1 9 1 10 Section 1. NEW SECTION. 714F.1 DEFINITIONS. 1 11 For the purposes of this chapter, unless the context 1 12 otherwise requires: 1 13 1. "Consumer" means an individual who is a resident of 1 14 this state. 1 15 2. "Consumer credit report" means a consumer report, as 1 16 defined in 15 U.S.C. } 1681a, that is used or collected in 1 17 whole or in part for the purpose of serving as a factor in 1 18 establishing a consumer's eligibility for credit for personal, 1 19 family, or household purposes. 1 20 3. "Consumer reporting agency" means the same as defined 1 21 in 15 U.S.C. } 1681a(f). A consumer reporting agency does not 1 22 include any of the following: 1 23 a. A check service or fraud prevention service company 1 24 that reports on incidents of fraud or issues authorizations 1 25 for the purpose of approving or processing negotiable 1 26 instruments, electronic fund transfers, or similar methods of 1 27 payment. 1 28 b. A deposit account information service company that 1 29 issues reports regarding account closures due to fraud, 1 30 overdrafts, automated teller machine abuse, or similar 1 31 negative information regarding a consumer to inquiring 1 32 financial institutions for use only in reviewing the 1 33 consumer's request for a deposit account at the inquiring 1 34 financial institution. 1 35 c. Any person or entity engaged in the practice of 2 1 assembling and merging information contained in a database of 2 2 one or more consumer reporting agencies and does not maintain 2 3 a permanent database of credit information from which new 2 4 consumer reports are produced. 2 5 4. "Identification information" means as defined in 2 6 section 715A.8. 2 7 5. "Identity theft" means as used in section 715A.8. 2 8 6. "Normal business hours" means Sunday through Saturday, 2 9 between the hours of 6:00 a.m. and 9:30 p.m., central standard 2 10 time or central daylight saving time. 2 11 7. "Proper identification" means the same as defined in 15 2 12 U.S.C. } 1681h(a)(1). 2 13 8. "Security freeze" means a notice placed in a consumer 2 14 credit report, at the request of the consumer and subject to 2 15 certain exceptions, that prohibits a consumer reporting agency 2 16 from releasing the consumer credit report or score relating to 2 17 the extension of credit. 2 18 Sec. 2. NEW SECTION. 714F.2 SECURITY FREEZE. 2 19 A consumer may submit by certified mail to a consumer 2 20 reporting agency a written request for a security freeze. The 2 21 consumer must submit proper identification and the applicable 2 22 fee with the request. Within five business days after 2 23 receiving the request, the consumer reporting agency shall 2 24 commence the security freeze. Within ten business days after 2 25 commencing the security freeze, the consumer reporting agency 2 26 shall send a written confirmation to the consumer of the 2 27 security freeze, a personal identification number or password, 2 28 other than the consumer's social security number, for the 2 29 consumer to use in authorizing the suspension or removal of 2 30 the security freeze, including information on how the security 2 31 freeze may be temporarily suspended. 2 32 Sec. 3. NEW SECTION. 714F.3 TEMPORARY SUSPENSION. 2 33 1. A consumer may request that a security freeze be 2 34 temporarily suspended to allow the consumer reporting agency 2 35 to release the consumer credit report for a specific time 3 1 period. The consumer reporting agency may develop procedures 3 2 to expedite the receipt and processing of requests which may 3 3 involve the use of telephones, facsimile transmissions, the 3 4 internet, or other electronic media. The consumer reporting 3 5 agency shall comply with the request within three business 3 6 days after receiving the consumer's written request, or within 3 7 fifteen minutes after the consumer's request is received by 3 8 the consumer reporting agency through facsimile, the internet, 3 9 or other electronic contact method chosen by the consumer 3 10 reporting agency, or the use of a telephone, during normal 3 11 business hours. The consumer's request shall include all of 3 12 the following: 3 13 a. Proper identification. 3 14 b. The personal identification number or password provided 3 15 by the consumer reporting agency. 3 16 c. Explicit instructions of the specific time period 3 17 designated for suspension of the security freeze. 3 18 d. Payment of the applicable fee. 3 19 2. A consumer reporting agency need not remove a security 3 20 freeze within the timeframes provided in subsection 1 if the 3 21 consumer fails to meet the requirements of subsection 1, or 3 22 the ability of the consumer reporting agency to remove the 3 23 security freeze within fifteen minutes is prevented by one of 3 24 the following: 3 25 a. An act of God, including a fire, earthquake, hurricane, 3 26 storm, or similar natural disaster or phenomenon. 3 27 b. Unauthorized or illegal acts by a third party, 3 28 including terrorism, sabotage, riot, vandalism, labor strikes 3 29 or disputes disrupting operations, or similar occurrences. 3 30 c. Operational interruption, including electrical failure, 3 31 unanticipated delay in equipment or replacement part delivery, 3 32 computer hardware or software failures inhibiting response 3 33 time, or similar disruption. 3 34 d. Governmental action, including emergency orders or 3 35 regulations, judicial law enforcement action, or similar 4 1 directives. 4 2 e. Regularly scheduled maintenance, during other than 4 3 normal business hours, of the consumer reporting agency's 4 4 systems, or updates to the consumer reporting agency's 4 5 systems. 4 6 f. Commercially reasonable maintenance of, or repair to, 4 7 the consumer reporting agency's systems that is unexpected or 4 8 unscheduled. 4 9 g. Receipt of a removal request outside of normal business 4 10 hours. 4 11 Sec. 4. NEW SECTION. 714F.4 REMOVAL. 4 12 A security freeze remains in effect until the consumer 4 13 requests that the security freeze be removed. A consumer 4 14 reporting agency shall remove a security freeze within three 4 15 business days after receiving a request for removal that 4 16 includes proper identification of the consumer, the personal 4 17 identification number or password provided by the consumer 4 18 reporting agency, and payment of the applicable fee. 4 19 Sec. 5. NEW SECTION. 714F.5 FEES. 4 20 1. A consumer reporting agency shall not charge any fee to 4 21 a consumer who is the victim of identity theft for commencing 4 22 a security freeze, temporary suspension, or removal if with 4 23 the initial security freeze request, the consumer submits a 4 24 valid copy of the police report concerning the unlawful use of 4 25 identification information by another person. 4 26 2. A consumer reporting agency may charge a fee not to 4 27 exceed ten dollars to a consumer who is not the victim of 4 28 identity theft for each security freeze, removal, or for 4 29 reissuing a personal identification number or password if the 4 30 consumer fails to retain the original number. The consumer 4 31 reporting agency may charge a fee not to exceed twelve dollars 4 32 for each temporary suspension of a security freeze. 4 33 Sec. 6. NEW SECTION. 714F.6 THIRD PARTIES. 4 34 If a third party requests a consumer credit report that is 4 35 subject to a security freeze, the consumer reporting agency 5 1 may advise the third party that a security freeze is in 5 2 effect. If the consumer does not expressly authorize the 5 3 third party to have access to the consumer credit report 5 4 through a temporary suspension of the security freeze, the 5 5 third party shall not be given access to the consumer credit 5 6 report but may treat a credit application as incomplete. 5 7 Sec. 7. NEW SECTION. 714F.7 MISREPRESENTATION OF FACT. 5 8 A consumer reporting agency may suspend or remove a 5 9 security freeze upon a material misrepresentation of fact by 5 10 the consumer. However, the consumer reporting agency shall 5 11 send notice to the consumer in writing prior to suspending or 5 12 removing the security freeze. 5 13 Sec. 8. NEW SECTION. 714F.8 EXCEPTIONS. 5 14 A security freeze shall not apply to the following persons 5 15 or entities: 5 16 1. A person or person's subsidiary, affiliate, agent, or 5 17 assignee with which the consumer has or prior to assignment 5 18 had an account, contract, or debtor=creditor relationship for 5 19 the purposes of reviewing the account or collecting the 5 20 financial obligation owing for the account, contract, or debt, 5 21 or extending credit to a consumer with a prior or existing 5 22 account, contract, or debtor=creditor relationship. 5 23 "Reviewing the account" includes activities related to account 5 24 maintenance, monitoring, credit line increases, and account 5 25 upgrades and enhancements. 5 26 2. A subsidiary, affiliate, agent, assignee, or 5 27 prospective assignee of a person to whom access has been 5 28 granted under a temporary suspension for purposes of 5 29 facilitating the extension of credit or another permissible 5 30 use. 5 31 3. A person acting pursuant to a court order, warrant, or 5 32 subpoena. 5 33 4. Child support enforcement officials when investigating 5 34 a child support case pursuant to Title IV=D or Title XIX of 5 35 the federal Social Security Act. 6 1 5. The department of human services or its agents or 6 2 assignees acting to investigate fraud under the medical 6 3 assistance program. 6 4 6. The department of revenue or local taxing authorities; 6 5 or any of their agents or assignees, acting to investigate or 6 6 collect delinquent taxes or assessments, including interest 6 7 and penalties and unpaid court orders, or to fulfill any of 6 8 their other statutory or other responsibilities. 6 9 7. A person's use of credit information for prescreening 6 10 as provided by the federal Fair Credit Reporting Act. 6 11 8. A person for the sole purpose of providing a credit 6 12 file monitoring subscription service to which the consumer has 6 13 subscribed. 6 14 9. A consumer reporting agency for the sole purpose of 6 15 providing a customer with a copy of the consumer credit report 6 16 upon the consumer's request. 6 17 10. A person's use of a consumer credit report in 6 18 connection with the business of insurance. 6 19 Sec. 9. NEW SECTION. 714F.9 WRITTEN CONFIRMATION. 6 20 After a security freeze is in effect, a consumer reporting 6 21 agency may post a name, date of birth, social security number, 6 22 or address change in a consumer credit report provided written 6 23 confirmation is sent to the consumer within thirty days of 6 24 posting the change. For an address change, written 6 25 confirmation shall be sent to both the new and former 6 26 addresses. Written confirmation is not required to correct 6 27 spelling and typographical errors. 6 28 Sec. 10. NEW SECTION. 714F.10 WAIVER VOID. 6 29 A waiver by a consumer of the provisions of this chapter is 6 30 contrary to public policy, and is void and unenforceable. 6 31 Sec. 11. NEW SECTION. 714F.11 ENFORCEMENT. 6 32 A person who violates this chapter violates section 714.16, 6 33 subsection 2, paragraph "a". All powers conferred upon the 6 34 attorney general to accomplish the objectives and carry out 6 35 the duties prescribed in section 714.16 are also conferred 7 1 upon the attorney general to enforce this chapter, including 7 2 but not limited to the power to issue subpoenas, adopt rules, 7 3 and seek injunctive relief and a monetary award for civil 7 4 penalties, attorney fees, and costs. Additionally, the 7 5 attorney general may seek and recover the greater of five 7 6 hundred dollars or actual damages for each customer injured by 7 7 a violation of this chapter. 7 8 7 9 7 10 7 11 JOHN P. KIBBIE 7 12 President of the Senate 7 13 7 14 7 15 7 16 PATRICK J. MURPHY 7 17 Speaker of the House 7 18 7 19 I hereby certify that this bill originated in the Senate and 7 20 is known as Senate File 2277, Eighty=second General Assembly. 7 21 7 22 7 23 7 24 MICHAEL E. MARSHALL 7 25 Secretary of the Senate 7 26 Approved , 2008 7 27 7 28 7 29 7 30 CHESTER J. CULVER 7 31 Governor