OLR Bill Analysis

sSB 472 (File 341, as amended by Senate "A")*

AN ACT CONCERNING SECURITY FREEZES ON CREDIT REPORTS, IDENTITY THEFT PREVENTION SERVICES, EMPLOYER CREDIT INQUIRIES AND REGULATIONS OF CREDIT RATING AGENCIES.

SUMMARY

This bill prohibits credit rating agencies from (1) charging a fee to place or remove a credit security freeze and (2) requiring, as a condition of placing the freeze, a consumer to enter into an agreement limiting claims he or she may have against the agency. It also requires that agencies place or remove the freezes as soon as practicable after receiving a request, but no later than the deadline specified in existing law.

The bill increases, from 12 to 24 months, the length of time certain businesses must provide identity theft mitigation services to customers in the event of a data breach. The provision applies to any business that, in the course of ordinary business, owns or licenses electronic data that includes personal information.

It also requires the banking commissioner to adopt regulations requiring credit rating agencies to provide a dedicated point of contact following a data breach through which the department may assist consumers.

Lastly, the bill makes minor and conforming changes.

*Senate Amendment “A” eliminates provisions that would have (1) required a credit rating agency contacted by a consumer to offer to notify the other credit rating agencies on his or her behalf, (2) limited when certain employers can require an employee or applicant to undergo a credit check and changed the credit check requirements for other employees, and (3) required the banking commissioner to adopt regulations requiring credit rating agencies to respond to department requests within 10 days and disclose to the department a description of identity theft protection services and fees, among other things.

EFFECTIVE DATE: October 1, 2018

1 — SECURITY FREEZES

By law, a “security freeze” is a notice placed in a consumer's credit report, at the consumer's request, that bars a credit rating agency from releasing the report, or any information in it, without the consumer's express authorization (CGS 36a-701).

Time Frame

The bill requires a credit rating agency to place and remove security freezes as soon as practicable after receiving a request to do so, but no later than the deadline specified in existing law. The deadline is (1) for placing a security freeze, including for a minor child, five business days after the request, and (2) for removing a security freeze, three business days after the request.

Fees and Limiting Claims

The bill prohibits credit rating agencies from charging a fee to place, remove, or temporarily lift a credit security freeze. Under current law, credit rating agencies may charge consumers up to $10 to place, remove, or temporarily lift a credit freeze and up to $12 to temporarily lift a freeze for a specific party. But they are prohibited from charging fees to certain consumers, including children and identity theft or domestic violence victims.

The bill also prohibits credit rating agencies from (1) requiring, as a condition of placing a security freeze, that consumers agree to limit their claims against the agency and (2) charging fees for any personal identification numbers (PINs), instead of for first-time replacement PINs, as under current law.

COMMITTEE ACTION

Banking Committee

Joint Favorable Substitute

Yea

10

Nay

9

(03/20/2018)