Connecticut Seal

General Assembly

 

Raised Bill No. 6645

January Session, 2003

 

LCO No. 4168

   

Referred to Committee on General Law

 

Introduced by:

 

(GL )

 

AN ACT CONCERNING IDENTITY THEFT AND CONSUMER CREDIT REPORTS.

Be it enacted by the Senate and House of Representatives in General Assembly convened:

Section 1. (NEW) (Effective October 1, 2003) (a) For the purposes of sections 1 to 3, inclusive, of this act, "security alert" means a notice that a consumer's identity may have been used without the consumer's consent to fraudulently obtain goods or services in the consumer's name.

(b) A credit rating agency shall notify each person requesting consumer credit information with respect to a consumer of the existence of a security alert in the credit report of such consumer, regardless of whether a full credit report, credit score, or summary report is requested. (1) Each credit rating agency shall maintain a toll-free telephone number to accept security alert requests from consumers twenty-four-hours-a-day, seven-days-a-week. (2) The toll-free telephone number shall be included in any written disclosure by a credit rating agency to any consumer pursuant to section 36a-696 of the general statutes and shall be printed in a clear and conspicuous manner.

(c) A credit rating agency shall place a security alert on a consumer's credit report no later than five business days after receiving a request from the consumer.

(d) The security alert shall remain in place for at least ninety days and a consumer shall have the right to request a renewal of the security alert prior to the end of the ninety-day period.

(e) If a consumer has placed a security alert, a credit rating agency shall provide the consumer, upon request, with a copy of his or her credit report, without fee, at the time the ninety-day security alert period expires.

Sec. 2. (NEW) (Effective October 1, 2003) (a) A consumer may elect to place a security freeze on his or her credit report by making a request in writing by certified mail to a credit rating agency. For the purposes of sections 1 to 3, inclusive, of this act, "security freeze" means a notice placed in a consumer's credit report, that prohibits the credit rating agency from releasing the consumer's credit report or any information from it without the express authorization of the consumer. If a security freeze is in place, information from a consumer's credit report may not be disclosed to a third party without prior written authorization from the consumer. This subsection does not prohibit a credit rating agency from advising a third party that a security freeze is in effect with respect to the consumer's credit report.

(b) A credit rating agency shall place a security freeze on a consumer's credit report no later than five business days after receiving a written request from the consumer.

(c) The credit rating agency shall send a written confirmation of the security freeze to the consumer not later than ten business days and shall provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the disclosure of such consumer's credit to a specific person or for a period of time.

(d) If the consumer wishes to allow his or her credit report to be accessed by a specific person or for a period of time while a freeze is in place, such consumer shall submit a request to the credit rating agency, to temporarily lift the freeze, and provide the following:

(1) Identification, as determined by the credit rating agency, to positively identify the person contacting the agency;

(2) The unique personal identification number or password provided by the credit reporting agency pursuant to subsection (c) of this section; and

(3) Accurate information identifying the third party who is to receive the credit report or the time period for which the report shall be available.

(e) A credit rating agency that receives a request from a consumer to temporarily lift a freeze on a credit report pursuant to subsection (d) of this section shall comply with the request no later than three business days after receiving the request.

(f) A credit rating agency may develop procedures involving the use of telephone, facsimile devices, the Internet or other electronic media to receive and process a request from a consumer to temporarily lift a freeze on a credit report pursuant to subsection (d) of this section in an expedited manner.

(g) A credit rating agency shall remove or temporarily lift a freeze placed on a consumer's credit report if such agency determines that any of the following cases has occurred:

(1) Upon the consumer's request, pursuant to subsection (d) or (j) of this section; or

(2) If the consumer's credit report was frozen due to a material misrepresentation of fact by the consumer. If a credit rating agency intends to remove a freeze upon a consumer's credit report pursuant to this subsection, the credit rating agency shall notify the consumer, in writing, prior to removing the freeze on the consumer's credit report.

(h) If a person requests access to a consumer credit report on which a security freeze is in effect, and such request is in connection with an application for credit or any other use, and the consumer does not allow such consumer's credit report to be accessed by such person or period of time, such person may treat the application as incomplete.

(i) If a consumer requests a security freeze, the credit rating agency shall disclose to such consumer the process of placing and temporarily lifting a freeze and the process for allowing access to information from the consumer's credit report for a specific party or period of time while the freeze is in place.

(j) A security freeze shall remain in place until the consumer requests that the security freeze be removed. A credit rating agency shall remove a security freeze no later than three business days after receiving a request for removal from a consumer who provides the following:

(1) Identification, as specified in subdivision (1) of subsection (d) of this section; and

(2) The unique personal identification number or password provided by the credit reporting agency pursuant to subsection (c) of this section.

(k) A credit rating agency shall require identification, as specified in subdivision (1) of subsection (d) of this section, of the person making a request to place or remove a security freeze.

(l) This section does not prevent a credit rating agency from charging a reasonable fee to a consumer who elects to freeze, remove the freeze, or temporarily lift the freeze regarding access to a consumer credit report, except that a credit rating agency may not charge a fee to a victim of identity theft who has submitted a valid police report alleging a violation of section 53a-129 of the general statutes.

Sec. 3. (NEW) (Effective October 1, 2003) If a security freeze is in place, a credit rating agency shall not change any of the following information in a consumer credit report without sending a written confirmation of the change to the consumer no later than thirty days after the change has been posted to the consumer's file: (1) Name, (2) date of birth, (3) Social Security number, and (4) address. Written confirmation is not required for technical modifications of such information, including name and street abbreviations, complete spellings or transposition of numbers or letters. In the case of an address change, the written confirmation shall be sent to both the new address and to the former address of the consumer.

This act shall take effect as follows:

Section 1

October 1, 2003

Sec. 2

October 1, 2003

Sec. 3

October 1, 2003

Statement of Purpose:

To allow consumers to place security alerts and security freezes on their credit reports.

[Proposed deletions are enclosed in brackets. Proposed additions are indicated by underline, except that when the entire text of a bill or resolution or a section of a bill or resolution is new, it is not underlined.]