SENATE, No. 232

By Mr. Tisei, a petition (accompanied by bill, Senate, No. 232) of Richard R. Tisei, Bradley H. Jones, Jr., Bruce E. Tarr, Paul J.Loscocco and other members of the General Court for legislation relative to identity theft and consumer report security freezes. Consumer Protection and Professional Licensure.
Version with line numberspdf logo

The Commonwealth of Massachusetts

Seal of the Commonwealth of Massachusetts

In the Year Two Thousand and Seven.


AN ACT relative to identity theft and consumer report security freezes

Be it enacted by the Senate and House of Representatives in General Court assembled, and by the authority of the same, as follows:

SECTION 1. Section 50 of chapter 93 of the General Laws, as appearing in the 2004 Official Edition, is hereby amended by adding the following definitions:-

“Identity theft report”, means a report that alleges identity theft; is a copy of an official, valid report filed by a consumer with an appropriate Federal, State, or local law enforcement agency; and the filing of which subjects the person filing the report to criminal penalties relating to the filing of false information.

“Personal identification number or password”, means a unique and random number or combination of numbers and letters, but shall not contain a consumer’s social security number or other personal identifying information.

“Proper identification”, means that information generally deemed sufficient to identify a person.  This does not include information concerning the consumer’s employment and personal or family history unless the consumer is unable to reasonably identify himself or herself with the information described above.

“Security freeze”, means a notice placed in a consumer’s report, at the request of the consumer and subject to certain exceptions, that prohibits the consumer reporting agency from releasing the consumer’s credit report or any information from it without the express authorization of the consumer.

SECTION 2.  Said chapter 93 is hereby amended by inserting after section 62 the following section:-

Section 62A.  Consumer election to place security freeze on consumer report

(a) A consumer may elect to place a security freeze on his or her consumer report by making a request in writing by mail to a consumer reporting agency.  If a security freeze is in place, information from a consumer’s report may not be released to a third party without prior express authorization from the consumer.  This provision does not prevent a consumer reporting agency from advising a third party that a security freeze is in effect with respect to the consumer’s report.

(b) A consumer reporting agency shall:

(1)  place a security freeze on a consumer’s report no later than twenty-four (24) hours after receiving a written request from the consumer;

(2)  within five (5) business days after receiving a written request from the consumer to place a security freeze on the consumer’s report:

(i)  send a written confirmation of the security freeze to the consumer;

(ii)  provide the consumer with a personal identification number or password to be used by the consumer when providing authorization for the removal of the security freeze, or the lift or release of the security freeze for a specific party or period of time; and

(iii)  require proper identification of the person making a request to place, temporarily lift or release, or remove a security freeze.

(c) A security freeze shall remain in place until the consumer requests that the security freeze be removed.  A consumer reporting agency shall remove a security freeze within twenty-four (24) hours of receiving a request for removal from the consumer, who provides both of the following:

(1)  Proper identification; and

(2)  The personal identification number or password provided by the credit reporting agency pursuant to subdivision (b)(2)(ii).

(d) If the consumer wishes to allow his or her consumer report to be accessed by a specific party while a freeze is in place or lift the freeze for a period of time, he or she shall:

(1)  contact the consumer reporting agency and request that the freeze be temporarily lifted;

(2)  provide the proper identification and unique personal identification number or password provided by the consumer reporting agency as set forth in (c) (1) and (2) above; and

(3)  provide the proper information regarding the third party who is to receive the consumer report or the time period for which the report shall be available to users of the consumer report.

A consumer reporting agency that receives a request from a consumer to temporarily lift or release a freeze on a credit report pursuant to this provision, shall comply with the request no later than twenty-four (24) hours after receiving the request.

(e) If a consumer requests a security freeze, the consumer reporting agency shall disclose the process of placing and removing a freeze, and the process for allowing access to information from the consumer’s report for a specific party or period of time while the freeze is in place.

(f) A consumer reporting agency may develop procedures involving the use of a toll-free telephone number, fax, the Internet, or other electronic media to receive and process a request from a consumer to remove a security freeze or temporarily lift a security freeze in an expedited manner.

(g) A consumer reporting agency shall remove or temporarily lift a security freeze only in the following cases:

(1)  Upon consumer request, pursuant to subdivision (c) or (d); or

(2)  If a consumer’s report was frozen due to a material misrepresentation of fact by a consumer.  If a consumer reporting agency intends to remove a freeze upon a consumer’s report pursuant to this paragraph, the consumer reporting agency shall notify the consumer in writing prior to removing the freeze on the consumer’s report.

(h) If a security freeze is in place, a consumer reporting agency shall not change any of the following official information in a consumer report without sending a written confirmation of the change to the consumer within thirty (30) days of the change being posted to the consumer’s file: name, date of birth, social security number, and address.  Written confirmation is not required for technical modifications of a consumer’s official information, including name and street abbreviations, complete spellings, or transposition of numbers or letters.  In the case of an address change, the written confirmation shall be sent to both the new address and to the former address.

(i) A consumer reporting agency shall honor any security freeze placed on a consumer credit report by another consumer reporting agency.

(j) If a third party requests access to a consumer report on which a security freeze is in effect, and this request is in connection with an application for credit or any other use, and the consumer does not allow his or her consumer report to be accessed for that specific party or period of time, the third party may treat the application as incomplete.

(k) The provisions of this section do not apply to the use of a consumer report by any of the following:

(1)  A person or entity, or the person’s or entity’s subsidiary, affiliate, agent or assignee with which the consumer has or, prior to assignment, had an account, contract, or debtor-creditor relationship for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or debt, or extending credit to a consumer with a prior existing account, contract, or debtor-creditor relationship, on the condition that the person or entity obtains, or has previously obtained, the consent of the consumer consistent with section fifty-one of this chapter, and the consumer report is used for the purpose consented to by the consumer.  For purposes of this paragraph, “reviewing the account” includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.

(2)  A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under subdivision (d) above for purposes of facilitating the extension of credit or other permissible use.

(3)  Any state or local agency, law enforcement agency, trial court, or private collection agency, or person acting pursuant to a court order, warrant, or subpoena.

(4)  A child support agency acting pursuant to statute.

(5)  The state department of health or its agents or assigns acting to investigate Medicaid fraud.

(6)  The state tax board or its agents or assigns acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities.

(7)  The use of credit information for the purposes of prescreening as provided for by the federal Fair Credit Reporting Act, unless the consumer elects to exclude the consumer’s name from the consumer report agency list consistent with section fifty-one A of this chapter.

(8)  Any person or entity administering a credit file monitoring subscription service to which the consumer has subscribed.

(9)  Any person or entity for the purpose of providing a consumer with a copy of his or her consumer report upon the consumer’s request.

(l) The following entities or persons are not required to place in a consumer report a security freeze; provided however, that any entity or person that is not required to place a security freeze on a consumer report under the provisions of paragraph (3) of this subdivision shall be subject to any security freeze placed on a consumer report by another consumer reporting agency from which it obtains information:

(1)  A check services or fraud prevention services company, which issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments.

(2)  A deposit account information service company, which issues reports regarding account closures due to fraud, substantial overdrafts, ATM abuse, or similar negative information regarding a consumer, to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution.

(3)  A consumer reporting agency or person that (i) acts only to resell credit information by assembling and merging information contained in the data base of one or more consumer reporting agencies; and (ii) does not maintain a permanent data base of credit information from which new consumer reports are produced.

(m) Fees may be imposed by a consumer reporting agency for each security freeze or temporary lift of the security freeze for a period of time or for a specific party as set forth in paragraph (f) of section fifty-nine of this chapter.

SECTION 3.  Clause (b) of section 56 of chapter 93 of the General Laws, as appearing in the 2004 Official Edition, is hereby amended by adding the following paragraphs to the text enclosed in quotation marks (informing consumers of their rights), at the end thereof:-

You have a right to place a “security freeze” on your credit report.  The security freeze will prohibit a credit reporting agency from releasing any information in your credit report without your express authorization.  A security freeze must be requested in writing by mail.

The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent.  However, you should be aware that using a security freeze to take control over who gains access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding new loans, credit, mortgage, insurance, government services or payments, rental housing, employment, investment, license, cellular phone, utilities, digital signature, internet credit card transaction, or other services, including an extension of credit at point of sale.

When you place a security freeze on your credit report, within five business days you will be provided a personal identification number or password to use if you choose to remove the freeze on your credit report or authorize the release of your credit report for a specific party, parties or period of time after the freeze is in place.  To provide that authorization, you must contact the credit reporting agency and provide all of the following:

(1) The personal identification number or password provided by the credit reporting agency.

(2) Proper identification to verify your identity.

(3) The proper information regarding the third party or parties who are to receive the credit report or the period of time for which the report shall be available to users of the credit report.

A credit reporting agency that receives a request from a consumer to lift temporarily a freeze on a credit report shall comply with the request no later than twenty-four (24) hours after receiving the request.

A security freeze does not apply to a person or entity, or its affiliates, or collection agencies acting on behalf of the person or entity with which you have an existing account that requests information in your credit report for the purposes of reviewing or collecting the account, provided you have previously given your consent to use of your credit reports.  Reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.

SECTION 4. Section 55 of said chapter 93, as so appearing, is hereby amended by inserting after the word “fifty-one” in line 1 the following words:- and section sixty-two A

SECTION 5.  Subsection (e) of section 57 of said chapter 93, as so appearing, is hereby amended by striking out the words “fifty-seven or sixty-two” and inserting in place thereof the following words:- fifty-seven, sixty-two or sixty-two A

SECTION 6.  Section 59 of said chapter 93, as so appearing, is hereby amended by:-

(a) striking out the title and inserting in place thereof the following words:-  “Charges to Consumer for Certain Disclosures, Reports and Security Freezes”; and

(b) inserting at the end thereof the following paragraph:-

(f) A consumer reporting agency may charge a reasonable fee not to exceed ten dollars to a consumer for each security freeze or temporary lift of the security freeze for a period of time or for a specific party regarding access to a consumer report pursuant to section sixty-two-A, and may charge a reasonable fee not to exceed ten dollars to a consumer for the removal of each security freeze.

SECTION 7.  Section 63 of said chapter 93, as so appearing, is hereby amended by striking out the words “sixty-two” and inserting in place thereof the following word:- sixty-two A

SECTION 8.  Section 64 of said chapter 93, as so appearing, is hereby amended by striking out the word “sixty-two”, in the first sentence, and inserting in place thereof the following word:- sixty-two A