PETITION OF:

SECTION 1. Section 50 of chapter 93 of the General Laws, as so appearing, is hereby amended by inserting after the definition “Prescreening” the following definition:—

“Security freeze”, a notice placed on a consumer report at the request of a consumer that prohibits the consumer reporting agency from releasing a report, or any information therein, without the expressed authorization of said consumer.

SECTION 2. Chapter 93 of the General Laws, as so appearing, is hereby amended by inserting after section 51A the following section:—

Section 51B. (a) A consumer may place a security freeze on his consumer report by sending a written request to a consumer reporting agency that will be delivered by Certified Mail. Said security freeze shall be in place for 5 years unless the consumer requests the temporary removal of the security freeze pursuant to subsection (c) or the permanent removal of the security freeze pursuant to subsection (d).

(b) The consumer reporting agency shall place a security freeze on a consumer report no later than 24 hours after receiving the request. Within 8 business days of receiving the request, the consumer reporting agency shall send a written confirmation of the security freeze to the consumer and shall provide the consumer with a unique personal identification number or a password to be used by the consumer when providing authorization for the release of his consumer report for a specific party or period of time or for the permanent removal of the security freeze.

(c) The consumer may authorize the temporary removal of the security freeze for a specific third party or for a specific period of time. The consumer reporting agency shall comply with a request to temporarily remove a security freeze within 24 hours of receiving the request; provided, however, that said request includes the personal identification number or password and has sufficient detail to identify the consumer, the third party, and the time period.

(d) The consumer may authorize the permanent removal of the security freeze by sending a written request to the consumer reporting agency. The consumer reporting agency shall comply with a request to permanently remove a security freeze within 24 hours of receiving the request; provided, however, that said request includes the personal identification number or password and has sufficient detail to identify the consumer.

(e) A consumer may request a security freeze only his own credit; provided, however, that a parent or legal guardian may request a security freeze for a minor.

(f) If a security freeze is in place, a third party requesting a consumer report may treat the application as incomplete.

(g) If a security freeze is in place, a consumer reporting agency shall not change a name, date of birth, Social Security number, or address in a consumer report without sending a written confirmation of the change to the consumer within 30 days of the change being posted to the consumer's file. Written confirmation is not required for technical modifications of a name and street abbreviations, complete spellings, or transposition of numbers or letters. In the case of an address change, the written confirmation shall be sent to both the new address and to the former address.

(h) If a consumer is required to receive a summary of rights under the federal Fair Credit Reporting Act, 15 U.S.C. 1681g, he shall also receive a notice about the procedures for security freezes under this section.

(i) This section shall not apply to the request for a consumer report by the following:—

(1) a person, or subsidiary, affiliate, or agent of that person, or an assignee of a financial obligation owed by the consumer to that person, or a prospective assignee of a financial obligation owed by the consumer to that person in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment an account or contract, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument. For purposes of this paragraph, "reviewing the account" includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements;

(2) a subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted for purposes of facilitating the extension of credit or other permissible use;

(3) a state or local governmental agency, law enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena;

(4) the department of revenue;

(5) whoever is prescreening under the federal Fair Credit Reporting Act, 15 U.S.C. 1681 et seq.; or

(6) whoever is administering a credit file monitoring subscription service to which the consumer has subscribed.

(j) A consumer reporting agency shall not charge a consumer any fee to place a security freeze on a consumer report. A consumer reporting agency may charge up to $5 for temporary or permanent removal of the security freeze or for a replacement of the personal identification number or password provided by the consumer reporting agency when the security freeze was requested. There shall be no such fees if a consumer:—

(1) provides the consumer reporting agency with a copy of a police incident report or criminal complaint alleging identity theft;

(2) is 62 years or older; or

(3) is a person with a disability, as defined in section 1 of chapter 123B, or who is otherwise mentally or physically disabled and as a result of such mental or physical disability is wholly or partially dependent on another person or persons to meet his daily living needs.

(k) This section shall not apply to a request for a security freeze as applied to:—

(1) a check services company, or a fraud prevention services company, which issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments;

(2) a demand deposit account information service company, which issues reports regarding account closures due to fraud, substantial overdrafts, automatic teller machine abuse, or similar negative information regarding a consumer, to inquiring banks or other financial institutions for use only in reviewing a consumer request for a demand deposit account at the inquiring bank or financial institution; or

(3) a consumer reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or multiple consumer reporting agencies and does not maintain a permanent database of credit information from which new consumer reports are produced, except that such a reseller of credit information shall honor any security freeze placed on a consumer report by another consumer reporting agency.

(l) The director of consumer affairs and business regulation shall promulgate rules and regulations to effectuate the purposes of this section and to encourage the temporary removal of a security freeze within 15 minutes of a consumer request.