08 LC 36
0824ER
Senate
Bill 361
By:
Senators Rogers of the 21st, Hamrick of the 30th, Shafer of the 48th, Grant of
the 25th, Goggans of the 7th and others
A
BILL TO BE ENTITLED
AN ACT
AN ACT
To
amend Chapter 1 of Title 10 of the Official Code of Georgia Annotated, relating
to selling and other trade practices, so as to provide for definitions; to
permit a consumer to place a security freeze on his or her credit report; to
provide a method for placing and removing a security freeze; to provide
exceptions; to prohibit the release of a credit report that is subject to a
security freeze, except in certain instances; to allow certain fees to be
charged in connection with a security freeze; to regulate changes to a credit
report that is subject to a security freeze; to prohibit certain uses of a
consumer´s personal information; to provide for enforcement; to provide for
related matters; to provide an effective date; to repeal conflicting laws; and
for other purposes.
BE
IT ENACTED BY THE GENERAL ASSEMBLY OF GEORGIA:
SECTION
1.
This
Act shall be known and may be cited as the "Georgia Credit Protection
Act."
SECTION
2.
Chapter
1 of Title 10 of the Official Code of Georgia Annotated, relating to selling and
other trade practices, is amended by inserting at the end thereof a new article
to read as follows:
"Article
35
10-1-930.
As
used in this article, the term:
(1)
'Consumer' means a natural person.
(2)
'Consumer reporting agency' means a person who, for fees, dues, or on a
cooperative basis, regularly engages in whole or in part in the practice of
assembling or evaluating information concerning a consumer´s credit or
other information for the purpose of furnishing a credit report to another
person.
(3)
'Credit report' means a consumer report, as defined in 15 U.S.C. Section l681a,
that is used or collected in whole or in part for the purpose of serving as a
factor in establishing a consumer´s eligibility for credit for personal,
family, or household purposes.
(4)
'Normal business hours' means Sunday through Saturday, between the hours of 6:00
A.M. and 9:30 P.M., eastern standard or eastern daylight time.
(5)(A)
'Personal information' means personally identifiable financial
information:
(i)
Provided by a consumer to another person;
(ii)
Resulting from any transaction with the consumer or any service performed for
the consumer; or
(iii)
Otherwise obtained by another person.
(B)
'Personal information' does not include:
(i)
Publicly available information, as that term is defined by the regulations
prescribed under 15 U.S.C. Section 6804; or
(ii)
Any list, description, or other grouping of consumers, and publicly available
information pertaining to the consumers, that is derived without using any
nonpublic personal information.
(C)
Notwithstanding subparagraph (B) of this paragraph, 'personal information'
includes any list, description, or other grouping of consumers, and publicly
available information pertaining to the consumers, that is derived using any
nonpublic personal information other than publicly available
information.
(6)
'Proper identification' has the same meaning as in 15 U.S.C. Section 1681h(a)
(1), and includes:
(A)
The consumer´s full name, including first, last, and middle names and any
suffix;
(B)
Any name the consumer previously used;
(C)
The consumer´s current and recent full addresses, including street address,
any apartment number, city, state, and ZIP code;
(D)
The consumer´s social security number; and
(E)
The consumer´s date of birth.
(7)
'Security freeze' means a prohibition, consistent with Code Section 10-1-931, on
a consumer reporting agency´s furnishing of a consumer´s credit report
to a third party intending to use the credit report to determine the
consumer´s eligibility for credit.
10-1-931.
(a)
A consumer may place a security freeze on the consumer´s credit report
by:
(1)
Making a request to a consumer reporting agency in writing by certified mail,
return receipt requested;
(2)
Providing proper identification; and
(3)
Paying the fee required by the consumer reporting agency in accordance with Code
Section 10-1-934.
(b)
If a security freeze is in place, a consumer reporting agency shall not release
a consumer´s credit report, or information from the credit report, to a
third party that intends to use the information to determine a consumer´s
eligibility for credit without prior authorization from the
consumer.
(c)(1)
Notwithstanding subsection (b) of this Code section, a consumer reporting agency
may communicate to a third party requesting a consumer´s credit report that
a security freeze is in effect on the consumer´s credit
report.
(2)
If a third party requesting a consumer´s credit report in connection with
the consumer´s application for credit is notified of the existence of a
security freeze under paragraph (1) of this subsection, the third party may
treat the consumer´s application as incomplete.
(d)
Upon receiving a request from a consumer under subsection (a) of this Code
section, the consumer reporting agency shall:
(1)
Place a security freeze on the consumer´s credit report within five
business days after receiving the consumer´s request;
(2)
Send a written confirmation of the security freeze to the consumer within ten
business days after placing the security freeze; and
(3)
Provide the consumer with a unique personal identification number or password to
be used by the consumer when providing authorizations for removal or temporary
removal of the security freeze under Code Section 10-1-932.
(e)
A consumer reporting agency shall require proper identification of the consumer
requesting to place, remove, or temporarily remove a security
freeze.
(f)(1)
A consumer reporting agency shall develop a contact method to receive and
process a consumer´s request to place, remove, or temporarily remove a
security freeze.
(2)
A contact method under paragraph (1) of this subsection shall
include:
(A)
A postal address;
(B)
An electronic contact method chosen by the consumer reporting agency, which may
include the use of fax, Internet, or other electronic means; and
(C)
The use of telephone in a manner that is consistent with any federal
requirements placed on the consumer reporting agency.
(g)
A security freeze placed under this Code section shall be removed only in
accordance with Code Section 10-1-932.
10-1-932.
(a)
A consumer reporting agency shall remove a security freeze from a
consumer´s credit report only if:
(1)(A)
The consumer reporting agency receives the consumer´s request through a
contact method established and required in accordance with subsection (f) of
Code Section 10-1-931; and
(B)
The consumer reporting agency receives the consumer´s proper identification
and:
(i)
Other information sufficient to identify the consumer; or
(ii)
The consumer provides the consumer´s personal identification number or
password; or
(2)
The consumer makes a material misrepresentation of fact in connection with the
placement of the security freeze and the consumer reporting agency notifies the
consumer in writing before removing the security freeze.
(b)(1)
A consumer reporting agency shall temporarily remove a security freeze upon
receipt of:
(A)
The consumer´s request through the contact method established by the
consumer reporting agency in accordance with subsection (f) of Code Section
10-1-931;
(B)
The consumer´s proper identification and:
(i)
Other information sufficient to identify the consumer; or
(ii)
Personal identification number or password;
(C)
A specific designation of the period of time for which the security freeze is to
be removed; and
(D)
The consumer reporting agency receives the payment of any fee required under
Code Section 10-1-934.
(2)
A consumer reporting agency shall remove a security freeze from a
consumer´s credit report within:
(A)
Three business days after the business day on which the consumer´s written
request to remove the security freeze is received by the consumer reporting
agency at the postal address chosen by the consumer reporting agency in
accordance with subsection (f) of Code Section 10-1-931; or
(B) Fifteen
minutes after the consumer´s request is received by the consumer reporting
agency through the electronic contact method chosen by the consumer reporting
agency in accordance with subsection (f) of Code Section 10-1-931 or after the
use of telephone, during normal business hours, and includes the consumer´s
proper identification and correct personal identification number or
password.
(c)
A consumer reporting agency need not remove a security freeze within the time
provided in subparagraph (b)(2)(B) of this Code section if:
(1)
The consumer fails to meet the requirements of subsection (a) of this Code
section; or
(2)
The consumer reporting agency´s ability to remove the security freeze
within 15 minutes is prevented by:
(A)
An act of God, including fire, earthquakes, hurricanes, storms, or similar
natural disaster or phenomena;
(B) Unauthorized
or illegal acts by a third party, including terrorism, sabotage, riot,
vandalism, labor strikes or disputes disrupting operations, or similar
occurrence;
(C)
Operational interruption, including electrical failure, unanticipated delay in
equipment or replacement part delivery, computer hardware or software failures
inhibiting response time, or similar disruption;
(D)
Governmental action, including emergency orders or regulations, judicial or law
enforcement action, or similar directives;
(E)
Regularly scheduled maintenance, during other than normal business hours, of, or
updates to, the consumer reporting agency´s systems;
(F)
Commercially reasonable maintenance of, or repair to, the consumer reporting
agency´s systems that is unexpected or unscheduled; or
(G)
Receipt of a removal request outside of normal business hours.
10-1-933.
(a)
Notwithstanding Code Section 10-1-931, a consumer reporting agency may furnish a
consumer´s credit report to a third party if:
(1)(A)
The purpose of the credit report is to:
(i)
Use the credit report for purposes permitted under 15 U.S.C. Section
1681b(c);
(ii)
Review the consumer´s account with the third party, including for account
maintenance or monitoring, credit line increases, or other upgrades or
enhancements; or
(iii)
Collect on a financial obligation owed by the consumer to the third party
requesting the credit report; or
(B)
The purpose of the credit report is to use the credit report for purposes
permitted under 15 U.S.C. Section 1681b(c) and to:
(i)
Review the consumer´s account with another person; or
(ii)
Collect on a financial obligation owed by the consumer to another person;
or
(2)
The third party requesting the credit report is a subsidiary, affiliate, agent,
assignee, or prospective assignee of the person holding the consumer´s
account or to whom the consumer owes a financial obligation.
(b)(1)
The consumer´s request for a security freeze does not prohibit the consumer
reporting agency from disclosing the consumer´s credit report for other
than credit related purposes consistent with the definition of credit report
found in Code Section 10-1-930.
(2)
The following types of credit report disclosures by consumer reporting agencies
to third parties shall not be prohibited by a security freeze:
(A)
The third party does not use the credit report for the purpose of serving as a
factor in establishing a consumer´s eligibility for credit;
(B)
The third party is acting under a court order, warrant, or subpoena requiring
release of the credit report;
(C)
The third party is a child support agency, or its agent or assignee, acting
under Part D, Title IV of the federal Social Security Act or a similar state
law;
(D)
The third party is the federal Department of Health and Human Services or a
similar state agency, or its agent or assignee, investigating medicare or
Medicaid fraud;
(E)
The purpose of the credit report is to investigate or collect delinquent taxes,
assessments, or unpaid court orders and the third party is:
(i)
The federal Internal Revenue Service;
(ii)
A state taxing authority;
(iii)
The Department of Driver Services;
(iv)
A county, municipality, or other entity with taxing authority;
(v)
A federal, state, or local law enforcement agency; or
(vi)
The agent or assignee of any entity listed in paragraph (2) of subsection (a) of
this Code section or divisions (i) through (v) of this division;
(F)
The third party is administering a credit file monitoring subscription to which
the consumer has subscribed; or
(G)
The third party requests the credit report for the sole purpose of providing the
consumer with a copy of the consumer´s credit report or credit score upon
the consumer´s request.
(c)
Code Section 10-1-931 shall not apply to:
(1) A
consumer reporting agency, the sole purpose of which is to resell credit
information by assembling and merging information contained in the data base of
another consumer reporting agency and does not maintain a permanent data base of
credit information from which a consumer´s credit report is
produced;
(2)
A check services or fraud prevention services company that issues reports on
incidents of fraud or authorizations for the purpose of approving or processing
negotiable instruments, electronic funds transfers, or similar methods of
payment; or
(3)
A deposit account information service company that issues reports concerning
account closures based on fraud, substantial overdrafts, automated teller
machine abuse, or similar information concerning a consumer to a requesting
financial institution for the purpose of evaluating a consumer´s request to
create a deposit account.
(d)
Nothing in this article shall prohibit a person from obtaining, aggregating, or
using information lawfully obtained from public records in a manner that does
not otherwise violate this article.
10-1-934.
(a)
Except as provided in subsection (b) of this Code section, a consumer reporting
agency may charge a reasonable fee to a consumer for placing and temporarily
removing a security freeze.
(b)
A consumer reporting agency shall not charge a fee for placing or removing a
security freeze if:
(1)
The consumer is a victim of identity fraud as defined in Code Section 16-9-121;
and
(2)
The consumer provides the consumer reporting agency with a valid copy of a
police report or police case number documenting the identity fraud.
10-1-935.
(a)
If a credit report is subject to a security freeze, a consumer reporting agency
shall notify the consumer who is the subject of the credit report within 30 days
if the consumer reporting agency changes the consumer´s:
(1)
Name;
(2)
Date of birth;
(3)
Social Security number; or
(4)
Address.
(b)(1)
Notwithstanding subsection (a) of this Code section, a consumer reporting agency
may make technical modifications to information in a credit report that is
subject to a security freeze without providing notification to the
consumer.
(2)
Technical modifications under paragraph (1) of this subsection shall
include:
(A)
The addition or subtraction of abbreviations to names and addresses;
and
(B)
Transpositions or corrections of incorrect numbering or spelling.
(c)
When providing notice of a change of address under subsection (a) of this Code
section, the consumer reporting agency shall provide notice to the consumer at
both the new address and the former address.
10-1-936.
(1)
Except as otherwise allowed by other law, a person shall not display a Social
Security number in a manner or location that is likely to be open to public
view.
(2)
The state, or a branch, agency, or political subdivision of the state, may not
employ or contract for the employment of an inmate in any Department of
Corrections facility or county jail in any capacity that would allow any inmate
access to any other person´s personal information.
10-1-937.
(a)
The Attorney General shall enforce the provisions of this article.
(b)
A person who violates the provisions of this article shall be subject to a civil
fine of:
(1)
Not more than $2,500.00 for a violation or series of violations concerning a
specific consumer; and
(2)
Not more than $100,000.00 in the aggregate for related violations concerning
more than one consumer.
(c)
In addition to the penalties provided in subsection (b) of this Code section,
the Attorney General may seek injunctive relief to prevent future violations of
this article in the Superior Court of Fulton County or the superior court of the
county of residence of a consumer who is the subject of a credit report on which
a violation occurs."
SECTION
2.
This
Act shall become effective upon its approval by the Governor or upon its
becoming law without such approval and shall apply to all offenses occurring on
or after such date.
SECTION
3.
All
laws and parts of laws in conflict with this Act are repealed.