Bill Amendment: FL S0566 | 2013 | Regular Session
NOTE: For additional amemendments please see the Bill Drafting List
Bill Title: Security of Protected Consumer Information
Status: 2013-05-03 - Died in Judiciary [S0566 Detail]
Download: Florida-2013-S0566-Commerce_and_Tourism_Committee_Amendment_Delete_All_845078.html
Bill Title: Security of Protected Consumer Information
Status: 2013-05-03 - Died in Judiciary [S0566 Detail]
Download: Florida-2013-S0566-Commerce_and_Tourism_Committee_Amendment_Delete_All_845078.html
Florida Senate - 2013 COMMITTEE AMENDMENT Bill No. SB 566 Barcode 845078 LEGISLATIVE ACTION Senate . House Comm: RCS . 04/01/2013 . . . . ————————————————————————————————————————————————————————————————— ————————————————————————————————————————————————————————————————— The Committee on Commerce and Tourism (Detert) recommended the following: 1 Senate Amendment (with title amendment) 2 Delete everything after the enacting clause 3 and insert: 4 Section 1. Section 501.0051, Florida Statutes, is created 5 to read: 6 501.0051 Protected consumer security freeze.— 7 (1) As used in this section, the term: 8 (a) “Consumer reporting agency” has the same meaning as 9 provided in 15 U.S.C. s. 1681a(f). 10 (b) “Consumer report” has the same meaning as provided in 11 15 U.S.C. s. 1681a(d). 12 (c) “Protected consumer” means a person younger than 16 13 years of age at the time a security freeze request is made or a 14 person represented by a guardian or other advocate pursuant to 15 chapter 39, chapter 393,chapter 744, or chapter 914. 16 (d) “Record” means a compilation of information that: 17 1. Identifies a protected consumer; 18 2. Is created by a consumer reporting agency exclusively 19 for the purpose of complying with this section; and 20 3. May not be created or used to consider the protected 21 consumer’s credit worthiness, credit standing, credit capacity, 22 character, general reputation, personal characteristics, or 23 eligibility for other financial services. 24 (e) “Representative” means the custodial parent or legal 25 guardian of a protected consumer, including a guardian appointed 26 pursuant to s. 914.17. 27 (f) “Security freeze” means: 28 1. A notice that is placed on the protected consumer’s 29 consumer report that prohibits a consumer reporting agency from 30 releasing the consumer report, credit score, or any information 31 contained within the consumer report to a third party without 32 the express authorization of the representative; or 33 2. A notice that is placed on the protected consumer’s 34 record that prohibits the consumer reporting agency from 35 releasing the protected consumer’s record except as provided in 36 this section, if a consumer reporting agency does not have a 37 file pertaining to the protected consumer. 38 (g) “Sufficient proof of authority” means documentation 39 that shows that a representative has authority to act on behalf 40 of a protected consumer. Sufficient proof of authority includes, 41 but is not limited to, a court order, valid power of attorney, 42 or a written notarized statement signed by a representative that 43 expressly describes the authority of the representative to act 44 on behalf of the protected consumer. 45 (h) “Sufficient proof of identification” means 46 documentation that identifies a protected consumer or a 47 representative of a protected consumer. Sufficient proof of 48 identification includes, but is not limited to, a copy of a 49 social security card, a certified or official copy of a birth 50 certificate, a copy of a valid driver license, or a government 51 issued photo identification. 52 (2) A representative may place a security freeze on a 53 protected consumer’s consumer record by: 54 (a) Submitting a request to a consumer reporting agency in 55 the manner prescribed by that agency; 56 (b) Providing the agency with sufficient proof of authority 57 and sufficient proof of identification; and 58 (c) Paying the agency a fee as authorized under this 59 section. 60 (3) If a consumer reporting agency does not have a consumer 61 report pertaining to a protected consumer when the consumer 62 reporting agency receives a request for a security freeze under 63 subsection (2), the consumer reporting agency shall create a 64 record for the protected consumer and place a security freeze on 65 the record. 66 (4) A consumer reporting agency shall place a security 67 freeze on a consumer record within 30 calendar days after 68 confirming the authenticity of a security freeze request made in 69 accordance with this section. 70 (5) The consumer reporting agency shall send a written 71 confirmation of the security freeze to the representative within 72 10 business days after instituting the security freeze and shall 73 provide the representative with instructions for removing the 74 security freeze and a unique personal identifier to be used by 75 the representative when providing authorization for removal of a 76 security freeze. 77 (6) A consumer reporting agency may not state or imply to 78 any person that a security freeze on a protected consumer’s 79 consumer record reflects a negative credit score, negative 80 credit history, or a negative credit rating. 81 (7) A consumer reporting agency shall remove a security 82 freeze placed on a consumer record of a protected consumer only 83 in the following instances: 84 (a) Upon request of a representative pursuant to paragraph 85 (8)(a). 86 (b) Upon request of a protected consumer pursuant to 87 paragraph (8)(b). 88 (c) If the security freeze was instituted due to a material 89 misrepresentation of fact by a representative. If a consumer 90 reporting agency intends to remove a security freeze pursuant to 91 this paragraph, the consumer reporting agency shall notify the 92 representative in writing before removing the security freeze. 93 (8) A security freeze placed in accordance with this 94 section shall remain in place until a representative or 95 protected consumer requests that it be removed. A consumer 96 reporting agency shall remove a security freeze within 30 97 calendar days after receiving a request for removal from a 98 protected consumer or representative. 99 (a) A representative submitting a request for removal must 100 provide the following: 101 1. Sufficient proof of identification and sufficient proof 102 of authority as determined by the consumer reporting agency. 103 2. The unique personal identifier provided by the consumer 104 reporting agency pursuant to subsection (5). 105 3. Payment of a fee as authorized by this section. 106 (b) A protected consumer submitting a request for removal 107 must provide the following: 108 1. Sufficient proof of identification as determined by the 109 consumer reporting agency. 110 2. Documentation that the sufficient proof of authority for 111 the protected consumer’s representative to act on behalf of the 112 protected consumer is no longer valid. 113 (9) This section does not apply to use of a consumer record 114 by the following persons or for the following reasons: 115 (a) A state agency acting within its lawful investigative 116 or regulatory authority. 117 (b) A state or local law enforcement agency investigating a 118 crime or conducting a criminal background check. 119 (c) Any person administering a credit file monitoring 120 subscription service to which the protected consumer has 121 subscribed. 122 (d) Any person for the purpose of providing the protected 123 consumer’s consumer report upon the representative’s request. 124 (e) Any person with a court order lawfully entered. 125 (f) Any insurance company for use in setting or adjusting a 126 rate, adjusting a claim, or underwriting for insurance purposes. 127 (g) A consumer reporting agency’s database or file which 128 consists entirely of information concerning, and is used 129 exclusively for, one or more of the following: 130 1. Criminal record information. 131 2. Personal loss history information. 132 3. Fraud prevention or detection. 133 4. Tenant screening. 134 5. Employment screening. 135 6. Personal insurance policy information. 136 7. Noncredit information used for insurance purposes. 137 (h) A check services company that issues authorizations for 138 the purpose of approving or processing negotiable instruments, 139 electronic funds transfers, or similar methods of payment. 140 (i) A deposit account information service company that 141 issues reports regarding account closures due to fraud, 142 substantial overdrafts, automatic teller machine abuse, or 143 similar negative information regarding a protected consumer to 144 an inquiring financial institution, as defined in s. 655.005 or 145 in federal law, for use only in reviewing a representative’s 146 request for a deposit account for the protected consumer at the 147 inquiring financial institution. 148 (j) A consumer reporting agency that acts only as a 149 reseller of credit information by assembling and merging 150 information contained in the database of another consumer 151 reporting agency or multiple consumer reporting agencies and 152 does not maintain a permanent database of credit information 153 from which new consumer reports are produced. However, a 154 consumer reporting agency shall honor any security freeze placed 155 or removed by another consumer reporting agency. 156 (k) A fraud prevention services company issuing reports to 157 prevent or investigate fraud. 158 (10)(a) A consumer reporting agency may charge a reasonable 159 fee, not to exceed $10, to a representative who elects to place 160 or remove a security freeze. 161 (b) A consumer reporting agency may charge a reasonable 162 fee, not to exceed $10, if the representative fails to retain 163 the original personal identifier provided by the consumer 164 reporting agency and the agency must reissue the personal 165 identifier or provide a new personal identifier to the 166 representative. 167 (c) A consumer reporting agency may not charge any fee 168 under this section to a representative of a protected consumer 169 who is a victim of identity theft if the representative submits, 170 at the time the security freeze is requested, a copy of a valid 171 investigative report or incident report or complaint with a law 172 enforcement agency about the unlawful use of the protected 173 consumer’s identifying information by another person. 174 (11) If a security freeze is in effect, a consumer 175 reporting agency may not change any of the following official 176 information in the consumer record without sending a written 177 confirmation of the change to the representative within 30 178 calendar days after the change is posted to the protected 179 consumer’s record: 180 (a) The protected consumer’s name. 181 (b) The protected consumer’s address. 182 (c) The protected consumer’s date of birth. 183 (d) The protected consumer’s social security number. 184 185 Written confirmation is not required for technical 186 corrections of a protected consumer’s official information, 187 including name and street abbreviations, complete spellings, or 188 transposition of numbers or letters. In the case of an address 189 change, the written confirmation must be sent to both the new 190 address and the former address. 191 (12) If a consumer reporting agency violates a security 192 freeze placed in accordance with this section by releasing 193 information subject to a security freeze without proper 194 authorization, the consumer reporting agency shall, within 5 195 business days after discovering or being notified of the release 196 of information, notify the representative of the protected 197 consumer in writing. The notice shall state the specific 198 information released, and provide the name, address, and other 199 contact information of the recipient of the information. 200 (13) A consumer reporting agency that willfully fails to 201 comply with any requirement imposed under this section with 202 respect to a representative or protected consumer is subject to 203 an administrative fine in the amount of $500 issued pursuant to 204 the administrative procedures established in chapter 120 by the 205 Department of Agriculture and Consumer Services. 206 (14) A person who is aggrieved by a violation of the 207 provisions of this section may bring a civil action as 208 authorized by this subsection. 209 (a) Any person who obtains a record under false pretenses 210 or knowingly without a permissible purpose is liable to the 211 representative and protected consumer for damages of at least 212 $1,000 or the actual damages sustained by the protected consumer 213 as a result of the violation, whichever is greater. 214 (b) Any person who obtains a record from a consumer 215 reporting agency under false pretenses or knowingly without a 216 permissible purpose is liable to the consumer reporting agency 217 for actual damages sustained by the consumer reporting agency or 218 $1,000, whichever is greater. 219 (15) Any written disclosure by a consumer reporting agency, 220 pursuant to 15 U.S.C. s. 1681g, to any representative and 221 protected consumer residing in this state must include a written 222 summary of all rights the representative and protected consumer 223 have under this section and, in the case of a consumer reporting 224 agency that compiles and maintains records on a nationwide 225 basis, a toll-free telephone number which the representative can 226 use to communicate with the consumer reporting agency. The 227 information set forth in paragraph (b) of the written summary of 228 rights must be in at least 12-point boldface type. The written 229 summary of rights required under this section is sufficient if 230 it is substantially in the following form: 231 (a) If you are the custodial parent or legal guardian of a 232 minor younger than 16 years of age or a guardian or advocate of 233 an incapacitated, disabled, or protected person under chapter 234 39, chapter 393, chapter 744, or chapter 914, Florida Statutes, 235 you have a right to place a security freeze on the consumer 236 report of the person you are legally authorized to care for. If 237 no consumer report exists, you have a right to request a record 238 to be created and a security freeze to be placed on the record. 239 A record with a security freeze is intended to prevent the 240 opening of credit accounts until the security freeze is removed. 241 (b) YOU SHOULD BE AWARE THAT USING A SECURITY FREEZE TO 242 CONTROL ACCESS TO THE PERSONAL AND FINANCIAL INFORMATION IN THE 243 CONSUMER RECORD MAY DELAY, INTERFERE WITH, OR PROHIBIT THE 244 TIMELY APPROVAL OF ANY SUBSEQUENT REQUEST OR APPLICATION 245 REGARDING A NEW LOAN, CREDIT, MORTGAGE, INSURANCE, GOVERNMENT 246 SERVICES OR PAYMENTS, RENTAL HOUSING, EMPLOYMENT, INVESTMENT, 247 LICENSE, CELLULAR PHONE, UTILITIES, DIGITAL SIGNATURE, INTERNET 248 CREDIT CARD TRANSACTION, OR OTHER SERVICES, INCLUDING AN 249 EXTENSION OF CREDIT AT POINT OF SALE. 250 (c) When you place a security freeze on the protected 251 consumer’s record you will be provided a process to use if you 252 choose to remove the freeze on the record or authorize the 253 release of the record. To provide that authorization, you must 254 contact the consumer reporting agency and provide all of the 255 following: 256 1. The personal identification required by the consumer 257 reporting agency. 258 2. Sufficient proof of authority over the protected 259 consumer. 260 3. Payment of a fee. 261 (d) A consumer reporting agency must authorize the release 262 of the record no later than 30 calendar days after receiving the 263 above information, or the consumer report no later than 3 264 business days after receiving the above information. 265 (e) A security freeze does not apply to a person or entity, 266 or its affiliates, or collection agencies acting on behalf of 267 the person or entity with which the protected consumer has an 268 existing account that requests information in the protected 269 consumer’s consumer report for the purposes of reviewing or 270 collecting the account. Reviewing the account includes 271 activities related to account maintenance, monitoring, credit 272 line increases, and account upgrades and enhancements. 273 (f) You have the right to bring a civil action as 274 authorized by s. 501.0051, Florida Statutes, which governs the 275 security of protected consumer information. 276 Section 2. This act shall take effect September 1, 2013. 277 278 279 ================= T I T L E A M E N D M E N T ================ 280 And the title is amended as follows: 281 Delete everything before the enacting clause 282 and insert: 283 A bill to be entitled 284 An act relating to security of protected consumer 285 information; creating s. 501.0051, F.S.; providing definitions; 286 authorizing the representative of a protected consumer to place 287 a security freeze on the protected consumer’s consumer record; 288 requiring a consumer reporting agency to establish a record if 289 the protected consumer does not have an existing consumer 290 report; requiring a consumer reporting agency to provide written 291 confirmation of a security freeze within a specified period; 292 prohibiting a consumer reporting agency from stating or implying 293 that a security freeze reflects a negative credit history or 294 rating; requiring a consumer reporting agency to remove a 295 security freeze under specified conditions; providing for 296 applicability; authorizing a consumer reporting agency to charge 297 a fee for placing or removing a security freeze and for 298 reissuing personal identification information; prohibiting a fee 299 under certain circumstances; requiring written notification to 300 change specified information in a protected consumer’s record; 301 providing exemptions; requiring a consumer reporting agency to 302 notify a representative and provide specified information if the 303 consumer reporting agency violates a security freeze; providing 304 penalties and civil remedies; providing written disclosure 305 requirements for consumer reporting agencies pertaining to 306 protected consumer security freezes; providing an effective 307 date. 308