| Date: | 10/19/2017 |
|---|---|
| Organization: | Office of Consumer Affairs and Business Regulation |
| Regulatory Authority: | Office of Consumer Affairs and Business Regulation (OCABR) |
| Official Version: | Published by the Massachusetts Register |
This is an unofficial version of Commonwealth regulations and is posted here for the convenience of the public. It is not an official statement of the regulations.
(a) Purpose
This regulation implements the provisions of M.G.L. c. 93, § 62A relative to the methods of requesting, lifting and removing security freezes for the benefit of consumers. The regulation establishes standards for expediting the methods of placing, temporary lifting and removing security freezes, including how certain information in connection therewith should be provided.
(b) Scope
The provisions of this regulation relating to security freezes apply to all persons subject to M.G.L. c. 93, §§50, 55, 56, 58, 62A, 63 and 64.
The following words as used herein shall, unless the context requires otherwise, have the following meanings:
" Consumer report", any written, oral or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing or credit capacity which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for (1) credit or insurance to be used primarily for personal, family, or household purposes, or (2) employment purposes, or (3) other purposes authorized under M.G.L. c. 93, §51. The term does not include any report containing information solely as to transactions or experiences between the consumer and the person making the report, any authorization or approval of a specific extension of credit directly or indirectly by the issuer of a credit card or similar device, or any report in which a person who has been requested by a third party to make a specific extension of credit directly or indirectly to a consumer conveys his decision with respect to such request, if the third party advises the consumer of the name and address of the person to whom the request was made and such person makes the disclosures to the consumer required under M.G.L. c. 93, §62.
" Consumer reporting agency", means any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties.
" Electronic," relating to technology having electrical, digital, magnetic, wireless, optical, electromagnetic or similar capabilities.
" Identity theft report," a report that alleges a violation of M.G.L. c. 266, §37E, 18 USC §1028, or a similar statute in any other jurisdiction, or a copy of a report filed by a consumer with an appropriate federal, state or local law enforcement agency, and the filing of which subjects the person filing the report to criminal penalties pursuant to M.G.L. c. 266, §67B or M.G.L. c. 269, §13A.
" Lift," to suspend a security freeze for the purpose of releasing a consumer's credit information to a specific party or for a specified period of time, as authorized by the consumer.
" Official information," a consumer's name, date of birth, Social Security number, and address .
" Password" or " Personal identification number," a unique and random number or a unique and random combination of numbers, letters or symbols, which cannot contain a consumer's social security number or any sequence of 3 or more numbers of a consumer's social security number, or other personal identifying information.
" Person," a natural person, corporation, association, partnership or other legal entity.
" Proper identification," information sufficient to identify a person. Proper identification includes, but is not limited to: name, address, social security number and date of birth. Proper identification does not include information concerning a consumer's employment and personal or family history unless the consumer is unable to reasonably identify himself with the above information.
" Remove," to permanently terminate a security freeze.
" Security freeze," a notice placed on a person's consumer report by a consumer reporting agency at the request of the consumer and subject to certain exceptions. A security freeze prohibits the consumer reporting agency from releasing the consumer report or any information derived from the consumer report without the express prior authorization of the consumer.
Each consumer reporting agency shall provide to consumers, by posting on its website (including an obvious link to the information on its home page), complete easily accessible information, in plain language, concerning the steps necessary and documents and information required to place, lift and remove a security freeze on a consumer report. Such information shall include (i) all identifying information that the consumer reporting agency requires from a consumer in order to place, temporarily lift or remove a security freeze on a consumer report, as set forth in M.G.L. c. 93, §50; (ii) the methods by which a consumer can make a request to the consumer reporting agency to place, temporarily lift or remove a security freeze on a consumer report which may be a written request by certified or overnight mail or regular stamped mail or other form of approved, encrypted electronic communication (as and when available) to a postal or electronic address designated by the consumer reporting agency to receive such requests; (iii) a notice that the consumer must place a security freeze with each consumer reporting agency separately; (iv) the amount of any permitted fee to temporarily lift or remove a security freeze and the methods of payment accepted by the consumer reporting agency; and (v) information on the procedures to replace a lost personal identification number or password. In addition, each consumer reporting agency shall provide to consumers a toll-free number that affords the consumer, during regular business hours, Eastern Standard Time, access to a live representative of the consumer reporting agency who can supply any additional information reasonably needed by the consumer in connection with placing, temporary lifting or removing a security freeze.
Upon receipt of a consumer's request to place a security freeze on his or her consumer report made in accordance with the procedures set forth herein, a consumer reporting agency shall: (i) disclose to the consumer the process of placing a security freeze; (ii) place the security freeze on the consumer report as soon as practicable and without unreasonable delay, but under no circumstances any later than 3 business days after receiving a request from the consumer; (iii) send a written confirmation of the security freeze to the consumer as soon as practicable and without unreasonable delay, but in any event within 5 business days after receiving the request, together with instructions on the procedures for temporarily lifting or removing a security freeze, and a toll-free number that a consumer may use for any further questions; (iv) provide the consumer at the time of the written confirmation with a unique and random personal identification number or a unique and random combination of numbers, letters or symbols, which shall not contain the consumer's Social Security Number or any sequence of three or more numbers of the consumer's Social Security Number, or other personal identifying information, to be used by the consumer for the purpose of providing authorization for the removal or temporary lifting of the security freeze or for other communications with the consumer reporting agency; and (v) provide a copy of the notice relevant to security freezes set forth in MGL c. 93, § 56(b).
Upon receipt of a consumer's request to temporarily lift a security freeze, the consumer reporting agency shall lift the security freeze as soon as practicable and without unreasonable delay, but under no circumstances any later than 3 business days after receiving the request, provided that the consumer has properly supplied the following: (i) the information necessary for proper identification specified in the information given to the consumer pursuant to 201 CMR 16.04(iv); and (ii) the identity of the third party who is to receive the consumer report or the specified period of time for which the report shall be available to authorized users of the consumer report.
Where a consumer reporting agency has received a request from the consumer to remove a security freeze it shall remove the security freeze as soon as practicable and without unreasonable delay, but in any event within 3 business days of receiving a request, provided that the consumer has supplied the information necessary for proper identification specified in the information given to the consumer pursuant to 201 CMR 16.04(iv).
If a consumer reporting agency intends to remove a security freeze based on a material misrepresentation of fact by a consumer, the consumer reporting agency shall notify the consumer in writing at least 5 business days prior to removing the freeze on the consumer report. Notification shall not be deemed to have occurred until receipt by the consumer of the notice from the reporting agency. The notification to the consumer shall (i) state the basis upon which the consumer reporting agency has concluded that there was a material misrepresentation of fact; (ii) state the action that the consumer reporting agency intends to take and the effective date of that action; and (iii) provide information for contacting the consumer reporting agency, including a telephone number, to dispute its findings, pursuant to MGL c. 93 § 56(b).
Until a security freeze placed on a consumer report is removed, a consumer reporting agency shall not change any of the official information in a consumer report without sending a written confirmation of the change to the consumer as soon as practicable and without unreasonable delay, but under no circumstances any later than within 30 days of the change being posted to the consumer report. Written confirmation shall not be required for technical modifications of information contained in a consumer report, such as name and street abbreviations, complete spellings, or corrective transposition of numbers or letters. The written confirmation shall: (i) state the official information that is being changed; (ii) advise the consumer that he or she must contact the consumer reporting agency within 7 days of the date of the notice if the change in the official information is disputed; and (iv) in the case of an address change, the written confirmation shall be sent to both the new address and to the former address.
Within 24 hours of receipt of notification, conforming to the procedures referenced in 201 CMR 16.03(v), that a resident has lost his or her personal identification number or password, the consumer reporting agency shall cancel the lost personal identification number or password and issue a new personal identification number or password, provided that the resident has supplied the information necessary for proper identification given pursuant to 201CMR 16.03(i). The new personal identification number or password shall not contain the resident's Social Security Number or any sequence of three or more numbers of the resident's Social Security Number.
A consumer reporting agency may charge up to $5.00 for placing, temporarily lifting or removing a security freeze. No fee may be charged to a victim of identity theft or his spouse if a copy of a valid identity theft report relating to the identity theft has been submitted to the consumer reporting agency.
REGULATORY AUTHORITY
201 CMR 16.00: M.G.L. c. 93, §62A.
