Bill Text: FL S0242 | 2014 | Regular Session | Comm Sub

NOTE: There are more recent revisions of this legislation. Read Latest Draft

---

Bill Title: Security of a Protected Consumer's Information

Spectrum: Slight Partisan Bill (? 3-1)

Status: (Passed) 2014-06-13 - Chapter No. 2014-66 [S0242 Detail]

Download: Florida-2014-S0242-Comm_Sub.html

---

       Florida Senate - 2014                       CS for CS for SB 242
       
       
        
       By the Committees on Judiciary; and Commerce and Tourism; and
       Senator Detert
       
       
       
       
       590-01071-14                                           2014242c2
    1                        A bill to be entitled                      
    2         An act relating to the security of a protected
    3         consumer’s information; providing a short title;
    4         creating s. 501.0051, F.S.; providing definitions;
    5         authorizing the representative of a protected consumer
    6         to place a security freeze on a protected consumer’s
    7         consumer report or record; specifying the procedure to
    8         request a security freeze; requiring a consumer
    9         reporting agency to establish a record if the
   10         protected consumer does not have an existing consumer
   11         report; prohibiting the use of a consumer record for
   12         certain purposes; requiring a consumer reporting
   13         agency to place, and to provide written confirmation
   14         of, a security freeze within a specified period;
   15         prohibiting a consumer reporting agency from stating
   16         or implying that a security freeze reflects a negative
   17         credit history or rating; requiring a consumer
   18         reporting agency to remove a security freeze under
   19         specified conditions; specifying the procedure to
   20         remove a security freeze; providing applicability;
   21         authorizing a consumer reporting agency to charge a
   22         fee for placing or removing a security freeze and for
   23         reissuing a unique personal identifier; prohibiting a
   24         fee under certain circumstances; requiring written
   25         notification upon the change of specified information
   26         in a protected consumer’s consumer report or record;
   27         providing exceptions; requiring a consumer reporting
   28         agency to notify a representative and provide
   29         specified information if the consumer reporting agency
   30         violates a security freeze; providing penalties and
   31         civil remedies; providing written disclosure
   32         requirements for consumer reporting agencies relating
   33         to a protected consumer’s security freeze; providing
   34         an effective date.
   35          
   36  Be It Enacted by the Legislature of the State of Florida:
   37  
   38         Section 1. This act may be cited as the “Keeping I.D. Safe
   39  (KIDS) Act.”
   40         Section 2. Section 501.0051, Florida Statutes, is created
   41  to read:
   42         501.0051 Protected consumer report security freeze.—
   43         (1) As used in this section, the term:
   44         (a) “Consumer report” has the same meaning as provided in
   45  15 U.S.C. s. 1681a(d).
   46         (b) “Consumer reporting agency” has the same meaning as
   47  provided in 15 U.S.C. s. 1681a(f).
   48         (c) “Protected consumer” means a person younger than 16
   49  years of age at the time a security freeze request is made or a
   50  person represented by a guardian or other advocate pursuant to
   51  chapter 39, chapter 393, chapter 744, or chapter 914.
   52         (d) “Record” means a compilation of information that:
   53         1. Identifies a protected consumer; and
   54         2. Is created by a consumer reporting agency exclusively
   55  for the purpose of complying with this section.
   56         (e) “Representative” means the parent or legal guardian of
   57  a protected consumer, including a guardian appointed pursuant to
   58  s. 914.17.
   59         (f) “Security freeze” means:
   60         1. A notice placed on a protected consumer’s consumer
   61  report which prohibits a consumer reporting agency from
   62  releasing the consumer report, the credit score, or any
   63  information contained within the consumer report to a third
   64  party without the express authorization of the representative;
   65  or
   66         2. If a consumer reporting agency does not have a consumer
   67  report pertaining to a protected consumer, a notice placed on a
   68  protected consumer’s record which prohibits the consumer
   69  reporting agency from releasing the protected consumer’s record
   70  except as provided in this section.
   71         (g) “Sufficient proof of authority” means documentation
   72  showing that a representative has authority to act on behalf of
   73  a protected consumer. The term includes, but is not limited to,
   74  a court order, a copy of a valid power of attorney, or a written
   75  notarized statement signed by the representative which expressly
   76  describes the authority of the representative to act on behalf
   77  of the protected consumer. A representative who is a parent may
   78  establish sufficient proof of authority by providing a certified
   79  or official copy of the protected consumer’s birth certificate.
   80         (h) “Sufficient proof of identification” means
   81  documentation identifying a protected consumer or a
   82  representative. The term includes, but is not limited to, a copy
   83  of a social security card, a certified or official copy of a
   84  birth certificate, a copy of a valid driver license, or a copy
   85  of a government-issued photo identification.
   86         (2) A representative may place a security freeze on a
   87  protected consumer’s consumer report by:
   88         (a) Submitting a request to a consumer reporting agency in
   89  the manner prescribed by that agency;
   90         (b) Providing the agency with sufficient proof of authority
   91  and sufficient proof of identification of the representative;
   92  and
   93         (c) Paying the agency a fee as authorized under this
   94  section.
   95         (3) If a consumer reporting agency does not have a consumer
   96  report pertaining to a protected consumer when the consumer
   97  reporting agency receives a request for a security freeze under
   98  subsection (2), the consumer reporting agency shall create a
   99  record for the protected consumer and place a security freeze on
  100  the record. A record may not be created or used to consider the
  101  protected consumer’s credit worthiness, credit standing, credit
  102  capacity, character, general reputation, personal
  103  characteristics, or eligibility for other financial services.
  104         (4) A consumer reporting agency shall place a security
  105  freeze on a consumer report or record within 30 days after
  106  confirming the authenticity of a security freeze request made in
  107  accordance with this section.
  108         (5) The consumer reporting agency shall send a written
  109  confirmation of the security freeze to the representative within
  110  10 business days after instituting the security freeze on the
  111  consumer report or record and shall provide the representative
  112  with instructions for removing the security freeze and a unique
  113  personal identifier to be used by the representative when
  114  providing authorization for removal of the security freeze.
  115         (6) A consumer reporting agency may not state or imply to
  116  any person that a security freeze reflects a negative credit
  117  score, a negative credit history, or a negative credit rating.
  118         (7) A consumer reporting agency shall remove a security
  119  freeze from a protected consumer’s consumer report or record
  120  only under either of the following circumstances:
  121         (a) Upon the request of a representative or a protected
  122  consumer. A consumer reporting agency shall remove a security
  123  freeze within 30 days after receiving a request for removal from
  124  a protected consumer or his or her representative.
  125         1. A representative submitting a request for removal must
  126  provide all of the following:
  127         a. Sufficient proof of identification of the representative
  128  and sufficient proof of authority as determined by the consumer
  129  reporting agency.
  130         b. The unique personal identifier provided by the consumer
  131  reporting agency pursuant to subsection (5).
  132         c. A fee as authorized under this section.
  133         2. A protected consumer submitting a request for removal
  134  must provide all of the following:
  135         a. Sufficient proof of identification of the protected
  136  consumer as determined by the consumer reporting agency.
  137         b. Documentation that the sufficient proof of authority of
  138  the protected consumer’s representative to act on behalf of the
  139  protected consumer is no longer valid.
  140         c. A fee as authorized under this section.
  141         (b) If the security freeze was instituted due to a material
  142  misrepresentation of fact. A consumer reporting agency that
  143  intends to remove a security freeze under this paragraph shall
  144  notify the representative and protected consumer in writing
  145  before removing the security freeze.
  146         (8) This section does not apply to the use of a protected
  147  consumer’s consumer report or record by the following persons or
  148  for the following reasons:
  149         (a) A state agency acting within its lawful investigative
  150  or regulatory authority.
  151         (b) A state or local law enforcement agency investigating a
  152  crime or conducting a criminal background check.
  153         (c) A person administering a credit file monitoring
  154  subscription service to which the protected consumer or the
  155  representative, on behalf of the protected consumer, has
  156  subscribed.
  157         (d) A person providing the protected consumer’s consumer
  158  report or record to the protected consumer or representative
  159  upon the request of the protected consumer or representative.
  160         (e) Pursuant to a court order lawfully entered.
  161         (f) An insurance company for use in setting or adjusting a
  162  rate, adjusting a claim, or underwriting for insurance purposes.
  163         (g) A consumer reporting agency’s database or file that
  164  consists entirely of information concerning, and used
  165  exclusively for, one or more of the following:
  166         1. Criminal record information.
  167         2. Personal loss history information.
  168         3. Fraud prevention or detection.
  169         4. Tenant screening.
  170         5. Employment screening.
  171         6. Personal insurance policy information.
  172         7. Noncredit information used for insurance purposes.
  173         (h) A check services company issuing authorizations for the
  174  purpose of approving or processing negotiable instruments,
  175  electronic funds transfers, or similar methods of payment.
  176         (i) A deposit account information service company issuing
  177  reports regarding account closures due to fraud, substantial
  178  overdrafts, automatic teller machine abuse, or similar negative
  179  information regarding a protected consumer to an inquiring
  180  financial institution, as defined in s. 655.005 or in federal
  181  law, for use only in reviewing a representative’s request for a
  182  deposit account for the protected consumer at the inquiring
  183  financial institution.
  184         (j) A consumer reporting agency that acts only as a
  185  reseller of credit information by assembling and merging
  186  information contained in the database of another consumer
  187  reporting agency or multiple consumer reporting agencies and
  188  that does not maintain a permanent database of credit
  189  information from which new consumer reports are produced.
  190  However, such consumer reporting agency shall honor any security
  191  freeze placed or removed by another consumer reporting agency.
  192         (k) A fraud prevention services company issuing reports to
  193  prevent or investigate fraud.
  194         (l) A person or entity, or its affiliates, or a collection
  195  agency acting on behalf of the person or entity, with which the
  196  protected consumer has an existing account, requesting
  197  information in the protected consumer’s consumer report or
  198  record for the purposes of reviewing or collecting the account.
  199  Reviewing the account includes activities related to account
  200  maintenance, monitoring, credit line increases, and account
  201  upgrades and enhancements.
  202         (9)(a) A consumer reporting agency may charge a reasonable
  203  fee, not to exceed $10, to place or remove a security freeze.
  204         (b) A consumer reporting agency may also charge a
  205  reasonable fee, not to exceed $10, if the representative fails
  206  to retain the original unique personal identifier provided by
  207  the consumer reporting agency and the agency must reissue the
  208  unique personal identifier or provide a new unique personal
  209  identifier to the representative.
  210         (c) A consumer reporting agency may not charge a fee under
  211  this section to the representative of a protected consumer who
  212  is a victim of identity theft if the representative submits, at
  213  the time the security freeze is requested, a copy of a valid
  214  investigative report, an incident report, or a complaint with a
  215  law enforcement agency about the unlawful use of the protected
  216  consumer’s identifying information by another person.
  217         (10) If a security freeze is in effect, a consumer
  218  reporting agency must send written confirmation to a protected
  219  consumer’s representative of a change to any of the following
  220  official information in the protected consumer’s consumer report
  221  or record within 30 days after the change is posted:
  222         (a) The protected consumer’s name.
  223         (b) The protected consumer’s address.
  224         (c) The protected consumer’s date of birth.
  225         (d) The protected consumer’s social security number.
  226  
  227  Written confirmation is not required for technical corrections
  228  of a protected consumer’s official information, including name
  229  and street abbreviations, complete spellings, or transposition
  230  of numbers or letters. In the case of an address change, the
  231  written confirmation must be sent to the representative and to
  232  the protected consumer’s new address and former address.
  233         (11) If a consumer reporting agency violates a security
  234  freeze placed in accordance with this section by releasing
  235  information subject to a security freeze without proper
  236  authorization, the consumer reporting agency shall, within 5
  237  business days after discovering or being notified of the release
  238  of information, notify the representative of the protected
  239  consumer in writing. The notice must state the specific
  240  information released and provide the name, address, and other
  241  contact information of the recipient of the information.
  242         (12) A consumer reporting agency that willfully fails to
  243  comply with any requirement imposed under this section is
  244  subject to an administrative fine in the amount of $500, imposed
  245  by the Department of Agriculture and Consumer Services pursuant
  246  to the administrative procedures established in chapter 120.
  247         (13) In addition to any other penalties or remedies
  248  provided under law, the following persons who are aggrieved by a
  249  violation of this section may bring a civil action as follows:
  250         (a) A person who obtains a protected consumer’s consumer
  251  report or record from a consumer reporting agency under false
  252  pretenses or who knowingly obtains a protected consumer’s
  253  consumer report or record without a permissible purpose is
  254  liable to the representative and protected consumer for actual
  255  damages sustained by the protected consumer or $1,000, whichever
  256  is greater.
  257         (b) A person who obtains a protected consumer’s consumer
  258  report or record from a consumer reporting agency under false
  259  pretenses or who knowingly obtains a protected consumer’s
  260  consumer report or record without a permissible purpose is
  261  liable to the consumer reporting agency for actual damages
  262  sustained by the consumer reporting agency or $1,000, whichever
  263  is greater.
  264         (14) A written disclosure by a consumer reporting agency,
  265  pursuant to 15 U.S.C. s. 1681g, to a representative and
  266  protected consumer residing in this state must include a written
  267  summary of all rights that the representative and protected
  268  consumer have under this section and, in the case of a consumer
  269  reporting agency that compiles and maintains records on a
  270  nationwide basis, a toll-free telephone number that the
  271  representative can use to communicate with the consumer
  272  reporting agency. The information provided in paragraph (b) must
  273  be in at least 12-point boldfaced type. The written summary of
  274  rights required under this section is sufficient if it is
  275  substantially in the following form:
  276         (a) If you are the parent or legal guardian of a minor
  277  younger than 16 years of age or a guardian or advocate of an
  278  incapacitated, disabled, or protected person under chapter 39,
  279  chapter 393, chapter 744, or chapter 914, Florida Statutes, you
  280  have the right to place a security freeze on the consumer report
  281  of the person you are legally authorized to care for. If no
  282  consumer report exists, you have the right to request that a
  283  record be created and a security freeze be placed on the record.
  284  A record with a security freeze is intended to prevent the
  285  opening of credit accounts until the security freeze is removed.
  286         (b) YOU SHOULD BE AWARE THAT USING A SECURITY FREEZE TO
  287  CONTROL ACCESS TO THE PERSONAL AND FINANCIAL INFORMATION IN A
  288  CONSUMER REPORT OR RECORD MAY DELAY, INTERFERE WITH, OR PROHIBIT
  289  THE TIMELY APPROVAL OF ANY SUBSEQUENT REQUEST OR APPLICATION
  290  REGARDING A NEW LOAN, CREDIT, MORTGAGE, INSURANCE, GOVERNMENT
  291  SERVICES OR PAYMENTS, RENTAL HOUSING, EMPLOYMENT, INVESTMENT,
  292  LICENSE, CELLULAR PHONE, UTILITIES, DIGITAL SIGNATURE, INTERNET
  293  CREDIT CARD TRANSACTION, OR OTHER SERVICES, INCLUDING AN
  294  EXTENSION OF CREDIT AT POINT OF SALE.
  295         (c) To remove the security freeze on the protected
  296  consumer’s record or report, you must contact the consumer
  297  reporting agency and provide all of the following:
  298         1. Proof of identification as required by the consumer
  299  reporting agency.
  300         2. Proof of authority over the protected consumer as
  301  required by the consumer reporting agency.
  302         3. The unique personal identifier provided by the consumer
  303  reporting agency.
  304         4. Payment of a fee.
  305         (d) A consumer reporting agency must, within 30 days after
  306  receiving the above information, authorize the removal of the
  307  security freeze.
  308         (e) A security freeze does not apply to a person or entity,
  309  or its affiliates, or a collection agency acting on behalf of
  310  the person or entity, with which the protected consumer has an
  311  existing account, which requests information in the protected
  312  consumer’s consumer report or record for the purposes of
  313  reviewing or collecting the account. Reviewing the account
  314  includes activities related to account maintenance, monitoring,
  315  credit line increases, and account upgrades and enhancements.
  316         (f) You have the right to bring a civil action as
  317  authorized by section 501.0051, Florida Statutes, which governs
  318  the security of protected consumer information.
  319         Section 3. This act shall take effect September 1, 2014.