08 LC 34
1559S
The
Senate Banking and Financial Institutions Committee offered the following
substitute to SB 361:
A
BILL TO BE ENTITLED
AN ACT
AN ACT
To
amend Article 34 of Chapter 1 of Title 10 of the Official Code of Georgia
Annotated, relating to protection from identity theft, so as to provide for
security freezes on consumer credit accounts; to provide for definitions; to
provide for procedures for placing, removing, and temporarily lifting a security
freeze; to provide for fees; to provide for a penalty for violations; to provide
for notice to consumers; to provide for related matters; to provide an effective
date; to repeal conflicting laws; and for other purposes.
BE
IT ENACTED BY THE GENERAL ASSEMBLY OF GEORGIA:
SECTION
1.
Article
34 of Chapter 1 of Title 10 of the Official Code of Georgia Annotated, relating
to identity theft, is revised by adding new Code sections to read as
follows:
"10-1-913.
As
used in this Code section and in Code Section 10-1-914, the term:
(1)
'Consumer' means a natural person residing in this state.
(2)
'Consumer credit report' means a 'consumer report' as defined in 15 U.S.C.
Section 1681a(d) that a consumer reporting agency furnishes to a person which it
has reason to believe intends to use the information as a factor in establishing
the consumer´s eligibility for credit to be used primarily for personal,
family, or household purposes.
(3)
'Consumer credit reporting agency' means any person who, for monetary fees,
dues, or on a cooperative nonprofit basis, regularly engages in whole or in part
in the practice of assembling or evaluating consumer credit information or other
information on consumers for the purpose of furnishing consumer credit reports
to third parties.
(4)
'Normal business hours' means any day, between the hours of 8:00 A.M. and 9:30
P.M., Eastern Standard Time.
(5)
'Person' means any individual, partnership, corporation, trust, estate,
cooperative, association, government, or governmental subdivision or agency, or
other entity.
(6)
'Proper identification' means information generally deemed sufficient to
identify a person for consumer reporting agency purposes under 15 U.S.C. Section
1681 et seq.
(7)
'Security freeze' means a restriction placed on a consumer credit report at the
request of the consumer that prohibits a consumer credit reporting agency from
releasing all or any part of the consumer´s consumer credit report or any
information derived from the consumer´s consumer credit report for a
purpose relating to the extension of credit without the express authorization of
the consumer.
10-1-914.
(a)
A consumer may place a security freeze on the consumer´s credit report by
making a request in writing by certified mail to a consumer credit reporting
agency. No later than August 1, 2008, a consumer credit reporting agency shall
make available to consumers an Internet based method of requesting a security
freeze and a toll-free telephone number for consumers to use to place a security
freeze, temporarily lift a security freeze, or completely remove a security
freeze. A security freeze shall prohibit, subject to exceptions in subsection
(m) of this Code section, the consumer credit reporting agency from releasing
the consumer´s credit report or credit score without the prior express
authorization of the consumer as provided in subsection (d) or (e) of this Code
section. Nothing in this subsection prevents a consumer credit reporting agency
from advising a third party that a security freeze is in effect with respect to
the consumer´s credit report.
(b)
A consumer credit reporting agency shall place a security freeze on a
consumer´s credit report no later than three business days after receiving
the consumer´s written request sent by certified mail.
(c)
The consumer credit reporting agency shall send a written confirmation of the
security freeze to the consumer within ten business days of placing the security
freeze and at the same time shall provide the consumer with a unique personal
identification number or password, other than the consumer´s social
security number, to be used by the consumer when providing authorization for the
release of the consumer´s credit report for a specific period of
time.
(d)
If the consumer wishes to allow the consumer´s credit report to be accessed
for a specific period of time while a security freeze is in place, the consumer
shall contact the consumer credit reporting agency through the contact method
established by the consumer credit reporting agency, request that the security
freeze be temporarily lifted, and provide all of the following:
(1)
Proper identification;
(2)
The unique personal identification number or password provided by the consumer
credit reporting agency pursuant to subsection (c) of this Code
section;
(3)
The proper information regarding the time period for which the report shall be
available to users of the consumer credit report; and
(4)
The proper payment as may be required by the consumer credit reporting
agency.
(e)
A consumer credit reporting agency shall develop procedures involving the use of
telephone, facsimile, the Internet, or other electronic media to receive and
process a request from a consumer to temporarily lift a security freeze on a
consumer credit report pursuant to subsection (d) of this Code
section.
(f)
A consumer credit reporting agency that receives a request from a consumer to
temporarily lift a security freeze on a consumer credit report pursuant to
subsection (d) or (e) of this Code section shall comply with the
request:
(1)
No later than three business days after receiving a written request;
or
(2)
Within 15 minutes after the request and payment are received by telephone or
electronically by the contact method chosen by the consumer reporting agency
during normal business hours and the request includes the consumer´s proper
identification, correct personal identification number or password, and the
proper payment as may be required by the consumer credit reporting
agency.
(g)
A consumer credit reporting agency shall only remove or temporarily lift a
security freeze placed on a consumer´s credit report:
(1)
Upon the consumer´s request, in compliance with the requirements of this
Code section; or
(2)
If the consumer´s credit report was frozen due to a material
misrepresentation of fact by the consumer. If a consumer credit reporting
agency intends to remove a security freeze upon a consumer´s credit report
pursuant to this paragraph, the consumer credit reporting agency shall notify
the consumer in writing prior to removing the security freeze on the
consumer´s credit report.
(h)
If a third party requests access to a consumer credit report on which a security
freeze is in effect and this request is in connection with an application for
credit or any other use related to the extension of credit and the consumer does
not allow the consumer´s credit report to be accessed for that specific
period of time, the third party may treat the application as
incomplete.
(i)
If a consumer requests a security freeze pursuant to this Code section, the
consumer credit reporting agency shall disclose to the consumer the process of
placing and temporarily lifting a security freeze and the process for allowing
access to information from the consumer´s credit report for a specific
period of time while the security freeze is in place.
(j)
A security freeze shall remain in place until the consumer requests that the
security freeze be removed. A consumer credit reporting agency shall remove a
security freeze within three business days of receiving a request for removal
from the consumer. The consumer shall provide all of the
following:
(1)
Proper identification;
(2)
The unique personal identification number or password provided by the consumer
credit reporting agency pursuant to subsection (c) of this Code section; and
(3)
The proper fee as may be required by the consumer credit reporting
agency.
(k)
A consumer credit reporting agency shall require proper identification of the
person making a request to place, temporarily lift, or remove a security
freeze.
(l)
By way of example only, and not intending to be exclusive, the provisions of
this Code section shall not apply to the use of a consumer credit report by any
of the following:
(1)
A person, or the person´s subsidiary, affiliate, agent, subcontractor, or
assignee with whom the consumer has, or prior to assignment had, an account,
contract, or debtor-creditor relationship for the purposes of reviewing the
active account or collecting the financial obligation owing for the account,
contract, or debt;
(2)
A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to
whom access has been granted under subsection (d) of this Code section for
purposes of facilitating the extension of credit or other permissible
use;
(3)
Any person acting pursuant to a court order, warrant, or subpoena;
(4)
A state or local agency, or its agents or assigns, which administers a program
for establishing and enforcing child support obligations;
(5)
A state or local agency, or its agents or assigns, acting to investigate fraud,
including Medicaid fraud; acting to investigate or collect delinquent taxes or
assessments, including interest, penalties, and unpaid court orders; or acting
to fulfill any of its other statutory responsibilities;
(6)
A federal, state, or local governmental entity, including a law enforcement
agency, court, or its agents or assigns;
(7)
Any person for the use of a credit report for purposes permitted under 15 U.S.C.
Section 1681b(c);
(8)
Any person for the sole purpose of providing a credit file monitoring
subscription service to which the consumer has subscribed;
(9)
Any person for the purpose of providing a consumer with a copy of the
consumer´s credit report or credit score upon the consumer´s
request;
(10)
Any depository financial institution for checking, savings, and investment
accounts; or
(11)
Any person or entity for insurance purposes, including use in setting or
adjusting a rate, adjusting a claim, or underwriting.
(m)
If a security freeze is in place, a consumer credit reporting agency shall not
change any of the following official information in a credit report without
providing at least 30 days prior written notice to the consumer at his or her
last known address: name, date of birth, social security number, and address.
Written notice is not required for technical modifications of a consumer´s
official information, including name and street abbreviations, complete
spellings, or transposition of numbers or letters. In the case of an address
change, the written notice shall be sent to both the new address and the former
address.
(n)
The following persons shall not be required to place a security freeze in a
consumer credit report pursuant to this Code section; provided, however, that
any person that shall not be required to place a security freeze on a consumer
credit report under the provisions of paragraph (3) of this subsection shall be
subject to any security freeze placed on a consumer credit report by another
consumer credit reporting agency from which it obtains information:
(1)
A check services or fraud prevention services company, including reports on
incidents of fraud, or authorizations for the purpose of approving or processing
negotiable instruments, electronic funds transfers, or similar methods of
payment;
(2)
A deposit account information service company, which issues reports regarding
account closures due to fraud, substantial overdrafts, automated teller machine
abuse, or other similar negative information regarding a consumer to inquiring
banks or other financial institutions for use only in reviewing a consumer
request for a deposit account at the inquiring bank or financial
institution;
(3)
Resellers of consumer credit report information that assemble and merge
information contained in a data base of one or more consumer credit reporting
agencies and do not maintain a permanent data base of consumer credit
information from which new consumer credit reports are produced; or
(4)
A consumer credit reporting agency´s data base or file which consists of
information concerning, and used for, one or more of the following: criminal
record information, fraud prevention or detection, personal claim loss history
information, and employment, tenant, or individual background
screening.
(o)
This Code section shall not prevent a consumer credit reporting agency from
charging a fee of no more than $3.00 to a consumer for each security freeze
placement or for temporarily lifting a security freeze more than twice in a
calendar year. A consumer reporting agency may not charge a consumer to
temporarily lift a security freeze twice in each calendar year or permanently
remove a security freeze. However, a consumer credit reporting agency may not
charge any fee to a victim of identity theft who has submitted a copy of a valid
investigative or incident report or complaint with a law enforcement agency
about the unlawful use of the victim´s identifying information by another
person that was filed with the law enforcement agency. A consumer credit
reporting agency may charge a fee of no more than $5.00 to a consumer for each
replacement of a unique personal identification number or password.
(p)
Exclusive of all other remedies that may be imposed, any person who willfully
fails to comply with any requirement imposed under this Code section with
respect to any consumer is liable to that consumer in an amount equal to the sum
of:
(1)(A)
Any actual damages sustained by the consumer as a result of the failure or
damages of not less than $100.00 and not more than $1,000.00; or
(B)
In the case of liability of a natural person for obtaining a consumer report
under false pretenses or knowingly without a permissible purpose, actual damages
sustained by the consumer as a result of the failure or $1,000.00, whichever is
greater;
(2)
Such amount of punitive damages as the court may allow; and
(3)
In the case of any successful action to enforce any liability under this Code
section, the costs of the action together with reasonable attorney´s fees
as determined by the court.
(q)
Any person who is negligent in failing to comply with any requirement imposed
under this Code section with respect to any consumer is liable to that consumer
in an amount equal to the sum of:
(1)
Any actual damages sustained by the consumer as a result of the failure;
and
(2)
In the case of any successful action to enforce any liability under this Code
section, the costs of the action together with reasonable attorney´s fees
as determined by the court.
(r)
Upon a finding by the court that an unsuccessful pleading, motion, or other
paper filed in connection with an action under this Code section was filed in
bad faith or for purposes of harassment, the court shall award to the prevailing
party attorney´s fees reasonable in relation to the work expended in
responding to the pleading, motion, or other paper.
10-1-915.
At
any time that a consumer is required to receive a summary of rights required by
15 U.S.C. Section 1681g(d) of the federal Fair Credit Reporting Act, the
consumer shall also be provided with the following notice:
'Georgia
Consumers Have the Right to Obtain a Security Freeze.
You
have a right to place a "security freeze" on your credit report, which will
prohibit a consumer reporting agency from releasing information in your credit
report without your express authorization. A security freeze must be requested
in writing by certified mail or by electronic means as provided by a consumer
reporting agency. The security freeze is designed to prevent credit, loans, and
services from being approved in your name without your consent. If you are
actively seeking a new credit, loan, utility, telephone, or insurance account,
you should understand that the procedures involved in lifting a security freeze
may slow your applications for credit. You should plan ahead and lift a freeze
in advance of actually applying for new credit. When you place a security
freeze on your credit report, you will be provided a personal identification
number or password to use if you choose to remove the freeze on your credit
report or authorize the release of your credit report for a period of time after
the freeze is in place.
To
provide that authorization you must contact the consumer reporting agency and
provide all of the following:
(1)
The personal identification number or password.
(2)
Proper identification to verify your identity.
(3)
The proper information regarding the period of time for which the report shall
be available.
A
consumer reporting agency must authorize the release of your credit report no
later than fifteen (15) minutes after receiving the above
information.
A
security freeze does not apply to a person or entity, or its affiliates, or
collection agencies acting on behalf of the person or entity, with which you
have an existing account, that requests information in your credit report for
the purposes of reviewing or collecting the account. Reviewing the account
includes activities related to account maintenance. You have a right to bring
civil action against anyone, including a consumer reporting agency, who
improperly obtains access to a file, knowingly or willfully misuses file data,
or fails to correct inaccurate file data. Unless you are a victim of identity
theft with a police report or other official document acceptable to a consumer
reporting agency to verify the crimes, a consumer reporting agency has the right
to charge you up to three dollars ($3.00) to place a freeze on your credit
report, but may not charge you to temporarily lift a freeze on your credit
report twice each year or to remove a freeze from your credit
report.'"
SECTION
2.
This
Act shall become effective on August 1, 2008.
SECTION
3.
All
laws and parts of laws in conflict with this Act are repealed.