Consumer ID Protection and Security Act

        [Congressional Bills 110th Congress]
[From the U.S. Government Publishing Office]
[S. 806 Introduced in Senate (IS)]

1st Session
S. 806

To give consumers tools to protect themselves from ID theft by allowing
them to prevent unauthorized access to their credit reports, and for
other purposes.

_______________________________________________________________________

IN THE SENATE OF THE UNITED STATES

March 7, 2007

Mr. Pryor introduced the following bill; which was read twice and
referred to the Committee on Banking, Housing, and Urban Affairs

_______________________________________________________________________

A BILL

To give consumers tools to protect themselves from ID theft by allowing
them to prevent unauthorized access to their credit reports, and for
other purposes.

Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

This Act may be cited as the ``Consumer ID Protection and Security
Act''.

SEC. 2. SECURITY FREEZE.

(a) In General.--
(1) Emplacement.--A consumer may place a security freeze on
the consumer's credit report by making a request to a consumer
credit reporting agency in writing, by telephone, or through a
secure electronic connection if such a connection is made
available by the consumer credit reporting agency.
(2) Consumer disclosure.--If a consumer requests a security
freeze, the consumer credit reporting agency shall disclose to
the consumer the process of placing and removing the security
freeze. A consumer credit reporting agency may not imply or
inform a consumer that the placement or presence of a security
freeze on the consumer's credit report may negatively affect
the consumer's credit score.
(b) Effect of Security Freeze.--
(1) Release of information blocked.--If a security freeze
is in place on a consumer's credit report, a consumer credit
reporting agency may not release the credit report for consumer
credit purposes to a third party without prior express
authorization from the consumer.
(2) Information provided to third parties.--Paragraph (1)
does not prevent a consumer credit reporting agency from
advising a third party that a security freeze is in effect with
respect to the consumer's credit report. If a third party, in
connection with a request for information in any circumstance
under which a consumer reporting agency may furnish a consumer
report under section 604(a) of the Fair Credit Reporting Act
(15 U.S.C. 1681b), requests access to a consumer credit report
on which a security freeze is in place, the third party may
treat any application associated with the request as
incomplete.
(3) Consumer credit score not affected.--The placement of a
security freeze on a credit report may not be taken into
account for any purpose in determining the credit score of the
consumer to whom the account relates.
(c) Removal; Temporary Suspension.--
(1) In general.--Except as provided in paragraph (2)(B), a
security freeze shall remain in place until the consumer
requests that the security freeze be removed. A consumer may
remove a security freeze on the consumer's credit report by
making a request to a consumer credit reporting agency in
writing, by telephone, or through a secure electronic
connection made available by the consumer credit reporting
agency.
(2) Conditions.--A consumer credit reporting agency may
remove a security freeze placed on a consumer's credit report
only--
(A) upon the consumer's request, pursuant to
paragraph (1); or
(B) if the agency determines that the consumer's
credit report was frozen due to a material
misrepresentation of fact by the consumer.
(3) Notification to consumer.--If a consumer credit
reporting agency intends to remove a freeze upon a consumer's
credit report pursuant to paragraph (2)(B), the consumer credit
reporting agency shall notify the consumer in writing prior to
removing the freeze on the consumer's credit report.
(4) Temporary suspension.--A consumer may have a security
freeze on the consumer's credit report temporarily suspended by
making a request to a consumer credit reporting agency in
writing or by telephone and--
(A) specifying beginning and ending dates for the
period during which the security freeze is not to apply
to that consumer's credit report; or
(B) specifying a specific third party to which
access to the credit report may be granted
notwithstanding the freeze.
(d) Response Times; Notification of Other Entities.--
(1) In general.--A consumer credit reporting agency shall--
(A) place a security freeze on a consumer's credit
report under subsection (a) no later than 3 business
days after receiving a request from the consumer under
subsection (a)(1);
(B) remove a security freeze within 3 business days
after receiving a request for removal from the consumer
under subsection (c); and
(C) temporarily suspend a security freeze within 1
business day after receiving a request under subsection
(c)(4).
(2) Notification of other covered entities.--If the
consumer requests in writing, by telephone, or by secure
electronic connection that other covered entities be notified
of the request, the consumer credit reporting agency shall
notify all other consumer credit reporting agencies described
in section 603(p)(1) of the Fair Credit Reporting Act (15
U.S.C. 1681a(p)(1)) of the request within 3 days after placing
or removing a security freeze on the consumer's credit report
under subsection (a) or (c)(2)(A), or within 1 day after
temporarily suspending a security freeze on the consumer's
credit report under subsection (c)(4).
(3) Implementation by other covered entities.--A consumer
credit reporting agency that is notified of a request under
paragraph (2) to place, remove, or temporarily suspend a
security freeze on a consumer's credit report shall--
(A) request proper identification from the
consumer, in accordance with subsection (f), within 3
business days after receiving the notification; and
(B) place, remove, or temporarily suspend the
security freeze on that credit report within 3 business
days after receiving proper identification.
(e) Confirmation.--Except as provided in subsection (c)(3),
whenever a consumer credit reporting agency places, removes, or
temporarily suspends a security freeze on a consumer's credit report at
the request of that consumer under subsection (a) or (c), respectively,
it shall send a written confirmation thereof to the consumer within 10
business days after placing, removing, or temporarily suspending the
security freeze on the credit report. This subsection does not apply to
the placement, removal, or temporary suspension of a security freeze by
a consumer credit reporting agency because of a notification received
under subsection (d)(2).
(f) ID Required.--A consumer credit reporting agency may not place,
remove, or temporarily suspend a security freeze on a consumer's credit
report at the consumer's request unless the consumer provides proper
identification (within the meaning of section 610(a)(1) of the Fair
Credit Reporting Act (15 U.S.C. 1681h) and the regulations thereunder.
(g) Exceptions.--This section does not apply to the use of a
consumer credit report by any of the following:
(1) A person or entity, or a subsidiary, affiliate, or
agent of that person or entity, or an assignee of a financial
obligation owing by the consumer to that person or entity, or a
prospective assignee of a financial obligation owing by the
consumer to that person or entity in conjunction with the
proposed purchase of the financial obligation, with which the
consumer has or had prior to assignment an account or contract,
including a demand deposit account, or to whom the consumer
issued a negotiable instrument, for the purposes of reviewing
the account or collecting the financial obligation owing for
the account, contract, or negotiable instrument.
(2) Any Federal, State or local agency, law enforcement
agency, trial court, or private collection agency acting
pursuant to a court order, warrant, subpoena, or other
compulsory process.
(3) A child support agency or its agents or assigns acting
pursuant to subtitle D of title IV of the Social Security Act
(42 U.S.C. et seq.) or similar State law.
(4) The Department of Health and Human Services, a similar
State agency, or the agents or assigns of the Federal or State
agency acting to investigate medicare or medicaid fraud.
(5) The Internal Revenue Service or a State or municipal
taxing authority, or a State department of motor vehicles, or
any of the agents or assigns of these Federal, State, or
municipal agencies acting to investigate or collect delinquent
taxes or unpaid court orders or to fulfill any of their other
statutory responsibilities.
(6) Any person or entity administering a credit file
monitoring subscription to which the consumer has subscribed.
(7) Any person or entity for the purpose of providing a
consumer with a copy of the consumer's credit report or credit
score upon the consumer's request.
(8) Except when access is restricted to a specific third
party during a temporary suspension of a security freeze under
subsection (c)(4)(B), any person who seeks access during the
time period that a security freeze is temporarily suspended for
the purpose of facilitating the extension of credit or another
permissable use.
(h) Fees.--
(1) In general.--Except as provided in paragraph (2), a
consumer credit reporting agency may charge a fee, not in
excess of $15, for placing, removing, or temporarily suspending
a security freeze on a consumer's credit report.
(2) Fees prohibited.--
(A) ID theft victims and notified consumers.--A
consumer credit reporting agency may not charge a fee
for placing, removing, or temporarily suspending a
security freeze on a consumer's credit report if--
(i) the consumer is a victim of identity
theft or has received a notice under section
3(c) of this Act;
(ii) the consumer requests the security
freeze in writing;
(iii) the consumer has filed a police
report with respect to the theft, or an
identity theft report (as defined in section
603(q)(4) of the Fair Credit Reporting Act (15
U.S.C. 1681a(q)(4))), within 90 days after the
theft occurred or was discovered by the
consumer; and
(iv) the consumer provides a copy of the
report to the credit reporting agency.
(B) Categorical classes.--A consumer credit
reporting agency may not charge a fee for placing,
removing, or temporarily suspending a security freeze
on a consumer's credit report if the consumer
requesting it--
(i) has attained the age of 65 years;
(ii) is a on active duty or in the ready
reserve component of an armed force of the
United States; or
(iii) is the spouse of an individual
described in clause (ii).
(i) Limitation on Information Changes in Frozen Reports.--
(1) In general.--If a security freeze is in place on a
consumer's credit report, a consumer credit reporting agency
may not change any of the following official information in
that credit report without sending a written confirmation of
the change to the consumer within 30 days after the change is
made:
(A) Name.
(B) Date of birth.
(C) Social Security number.
(D) Address.
(2) Confirmation.--Paragraph (1) does not require written
confirmation for technical modifications of a consumer's
official information, including name and street abbreviations,
complete spellings, or transposition of numbers or letters. In
the case of an address change, the written confirmation shall
be sent to both the new address and to the former address.
(j) Certain Entity Exemptions.--
(1) Resellers and other agencies.--The provisions of this
Act do not apply to a consumer credit reporting agency that
acts only as a reseller of credit information by assembling and
merging information contained in the data base of another
consumer credit reporting agency or multiple consumer credit
reporting agencies, and does not maintain a permanent data base
of credit information from which new consumer credit reports
are produced.
(2) Other exempted entities.--The following entities are
not required to place a security freeze in a credit report:
(A) A check services or fraud prevention services
company, which issues reports on incidents of fraud or
authorizations for the purpose of approving or
processing negotiable instruments, electronic funds
transfers, or similar methods of payments.
(B) A deposit account information service company,
which issues reports regarding account closures due to
fraud, substantial overdrafts, ATM abuse, or similar
negative information regarding a consumer, to inquiring
banks or other financial institutions for use only in
reviewing a consumer request for a deposit account at
the inquiring bank or financial institution.

SEC. 3. ENFORCEMENT.

(a) Enforcement by Commission.--Except as provided in subsection
(c), this Act shall be enforced by the Commission.
(b) Violation is Unfair or Deceptive Act or Practice.--The
violation of any provision of this Act shall be treated as an unfair or
deceptive act or practice proscribed under a rule issued under section
18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C.
57a(a)(1)(B)).
(c) Enforcement by Certain Other Agencies.--Compliance with this
Act shall be enforced under--
(1) section 8 of the Federal Deposit Insurance Act (12
U.S.C. 1818), in the case of--
(A) national banks, and Federal branches and
Federal agencies of foreign banks, by the Office of the
Comptroller of the Currency;
(B) member banks of the Federal Reserve System
(other than national banks), branches and agencies of
foreign banks (other than Federal branches, Federal
agencies, and insured State branches of foreign banks),
commercial lending companies owned or controlled by
foreign banks, and organizations operating under
section 25 or 25A of the Federal Reserve Act (12 U.S.C.
601 and 611), by the Board; and
(C) banks insured by the Federal Deposit Insurance
Corporation (other than members of the Federal Reserve
System) and insured State branches of foreign banks, by
the Board of Directors of the Federal Deposit Insurance
Corporation;
(2) section 8 of the Federal Deposit Insurance Act (12
U.S.C. 1818), by the Director of the Office of Thrift
Supervision, in the case of a savings association the deposits
of which are insured by the Federal Deposit Insurance
Corporation;
(3) the Federal Credit Union Act (12 U.S.C. 1751 et seq.)
by the National Credit Union Administration Board with respect
to any Federal credit union; and
(4) the Securities and Exchange Act of 1934 (15 U.S.C. 78a
et seq.) by the Securities and Exchange Commission with respect
to--
(A) a broker or dealer subject to that Act;
(B) an investment company subject to the Investment
Company Act of 1940 (15 U.S.C. 80a-1 et seq.); and
(C) an investment advisor subject to the Investment
Advisers Act of 1940 (15 U.S.C. 80b-1 et seq.).
(d) Exercise of Certain Powers.--For the purpose of the exercise by
any agency referred to in subsection (c) of its powers under any Act
referred to in that subsection, a violation of this Act is deemed to be
a violation of a requirement imposed under that Act. In addition to its
powers under any provision of law specifically referred to in
subsection (c), each of the agencies referred to in that subsection may
exercise, for the purpose of enforcing compliance with any requirement
imposed under this Act, any other authority conferred on it by law.
D23/

SEC. 4. DEFINITIONS.

In this Act:
(1) Commission.--The term ``Commission'' means the Federal
Trade Commission.
(2) Consumer credit reporting agency.--The term ``consumer
credit reporting agency'' means any person which, for monetary
fees, dues, or on a cooperative nonprofit basis, regularly
engages in whole or in part in the practice of assembling or
evaluating consumer credit information or other information on
consumers for the purpose of furnishing credit reports to third
parties, and which uses any means or facility of interstate
commerce for the purpose of preparing or furnishing credit
reports.
(3) Credit report.--The term ``credit report'' means a
consumer report, as defined in section 603(d) of the Fair
Credit Reporting Act (15 U.S.C. 1681a(d)), that is used or
expected to be used or collected in whole or in part for the
purpose of serving as a factor in establishing a consumer's
eligibility for credit for personal, family or household
purposes.
(4) Identity theft.--The term ``identity theft'' has the
meaning given that term by section 603(q)(3) of the Fair Credit
Reporting Act (15 U.S.C. 1681a(q)(3)).
(5) Reviewing the account.--The term ``reviewing the
account'' includes activities related to account maintenance,
monitoring, credit line increases, and account upgrades and
enhancements.
(6) Security freeze.--The term ``security freeze'' means a
notice that--
(A) a consumer credit reporting agency places at
the request of a consumer in the file on the consumer
at the consumer credit reporting agency; and
(B) prohibits the agency from releasing consumer
credit report information on the consumer for consumer
credit purposes without the express authorization of
the consumer, except as otherwise provided in this Act.
(7) Sensitive personal information.--
(A) In general.--Except as provided in
subparagraphs (B) and (C), the term ``sensitive
personal information'' means an individual's name,
address, or telephone number combined with 1 or more of
the following data elements related to that individual:
(i) Social security number, taxpayer
identification number, or an employer
identification number that is the same as or is
derived from the social security number of that
individual.
(ii) Financial account number, or credit
card or debit card number of such individual,
combined with any required security code,
access code, or password that would permit
access to such individual's account.
(iii) State driver's license identification
number or State resident identification number.
(B) FTC modifications.--The Commission may, through
a rulemaking proceeding in accordance with section 553
of title 5, United States Code, designate other
identifying information that may be used to effectuate
identity theft as sensitive personal information for
purposes of this Act and limit or exclude any
information described in subparagraph (A) from the
definition of sensitive personal information for
purposes of this Act.
<all>