H. B. 2977
(By Delegates Sumner, Duke, Lane and Sobonya)
[Introduced February 9, 2007; referred to the
Committee on the Judiciary.]
A BILL to amend the Code of West Virginia, 1931, as amended, by
adding thereto a new article, designated §46A-6L-101,
§46A-6L-102, §46A-6L-103, §46A-6L-104 and §46A-6L-105, all
relating to consumer protection generally; defining certain
terms; providing a procedure for consumers to implement a
security freeze to prohibit a consumer reporting agency from
releasing all or any part of the consumer's credit report or
any information derived from it to entities with whom the
consumer has no existing relationship without the express
authorization of the consumer in certain circumstances;
providing for notice of consumer rights; providing civil
penalties for violations; making a violation an unfair or
deceptive act or practice; and providing for severability of
the provisions of the article under certain circumstances.
Be it enacted by the Legislature of West Virginia:
That the Code of West Virginia, 1931, as amended, be amended
by adding thereto a new article, designated §46A-6L-101,
§46A-6L-102, §46A-6L-103, §46A-6L-104 and §46A-6L-105, all to read
as follows:
ARTICLE 6L. THEFT OF CONSUMER IDENTITY PROTECTIONS.
§46A-6L-101. Definitions.
For the purposes of this article, the following terms have the
following meanings:
(1) "Person" means any individual, partnership, corporation,
trust, estate, cooperative, association, government or governmental
subdivision or agency, or other entity.
(2) "Consumer" means an individual.
(3) "Consumer reporting agency" means any entity which, for
monetary fees, dues, or on a cooperative nonprofit basis, regularly
engages, in whole or in part, in the practice of assembling or
evaluating consumer credit information or other information on
consumers for the purpose of furnishing consumer reports to third
parties.
(4) "Consumer report" or "credit report" means any written,
oral, or other communication of any information by a consumer
reporting agency bearing on a consumer's credit worthiness, credit
standing, credit capacity, character, general reputation, personal
characteristics, or mode of living which is used or expected to be
used or collected, in whole or in part, for the purpose of serving as a factor in establishing the consumer's eligibility for:
(A) Credit or insurance to be used primarily for personal,
family, or household purposes, except that nothing in this article
authorizes the use of credit evaluations, credit scoring or
insurance scoring in the underwriting of personal lines of property
or casualty insurance;
(B) Employment purposes; or
(C) Any other purpose authorized under section 15 U.S.C. §
1681b as in effect on the date of enactment of this article.
(5) "Security freeze" means a notice, at the request of the
consumer and subject to certain exceptions, that prohibits the
consumer reporting agency from releasing all or any part of the
consumer's credit report or any information derived from it without
the express authorization of the consumer.
(6) "Reviewing the account" or "account review" includes
activities related to account maintenance, monitoring, credit line
increases, and account upgrades and enhancements.
§46A-6L-102. Security freeze; timing, effect, covered entities,
cost.
(a) A consumer reporting agency shall permit a consumer to
place a security freeze on his or her consumer report by the
consumer selecting either of the following:
(1) A request in writing by regular mail to a consumer
reporting agency; or
(2) Making a request directly to the consumer reporting agency
through a secure electronic mail connection.
(b) A consumer reporting agency shall place a security freeze
on a consumer report no later than five business days after
receiving a written request from the consumer. If a security
freeze is in place, a report or information may not be distributed
to a third party without prior express authorization from the
consumer. This subdivision does not prevent a consumer reporting
agency from advising a third party that a security freeze is in
effect with respect to the consumer's credit report. A consumer
reporting agency may, regardless of the existence of a security
freeze, distribute information contained in a consumer file to the
extent otherwise permitted by law where if such information was
lawfully obtained by or for a consumer reporting agency from an
open public record, without respect to the existence of a security
freeze. Nothing herein prevents a consumer reporting agency from
choosing to apply the security freeze to the entire contents of the
consumer reporting file that is subject to the security freeze.
(c) The consumer reporting agency shall send a written
confirmation of the security freeze to the consumer within five
business days of placing the freeze and at the same time shall
provide the consumer with a unique personal identification number
or password to be used by the consumer when providing authorization
for the distribution of his or her credit notwithstanding the security freeze for a specific party or period of time.
(d) If the consumer wishes to allow his or her consumer report
to be accessed for a specific party or period of time while a
freeze is in place, he or she shall contact the consumer reporting
agency via regular mail, secure electronic mail, or a method
developed under subsection (f) of this section, and request that
the freeze be temporarily lifted, and provide all of the following:
(1) Information generally deemed sufficient to identify a
person;
(2) The unique personal identification number or password
provided by the consumer reporting agency pursuant to subsection
(c) of this section; and
(3) The proper information regarding the third party who is to
receive the consumer report or the time period for which the
consumer report shall be available to users of the consumer report.
(e) A consumer reporting agency that receives a request from
a consumer to temporarily lift a freeze on a consumer report
pursuant to subsection (d) of this section shall comply with the
request no later than three business days after receiving the
request and at such earlier time as described in subsection (g),
below.
(f) A consumer reporting agency shall develop procedures
involving the use of telephone, fax, the Internet, or other
electronic media to receive and process a request from a consumer to temporarily lift a freeze on a consumer report pursuant to
subsection (d) of this section in an expedited manner.
(g)(1) Starting on the first day of September 2008, a consumer
reporting agency shall remove a security freeze from a consumer's
credit report submitted by a method described in subsection (f) of
this section within fifteen minutes after the consumer's request is
received by the consumer reporting agency.
(2) A consumer reporting agency need not remove a security
freeze within the time provided in subsection (g)(1) of this
section if:
(A) The consumer fails to meet the requirements of subsection
(d) of this section; or
(B) The consumer reporting agency's ability to remove the
security freeze within fifteen minutes is prevented by:
(i) An act of God, including fire, earthquakes, hurricanes,
storms, or similar natural disaster or phenomena;
(ii) Unauthorized or illegal acts by a third party, including
terrorism, sabotage, riot, vandalism, labor strikes or disputes
disrupting operations, or similar occurrence;
(iii) Operational interruption, including electrical failure,
unanticipated delay in equipment or replacement part delivery,
computer hardware or software failures inhibiting response time,
or similar disruption;
(iv) Governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar
directives;
(v) Regularly scheduled maintenance, during other than normal
business hours, of, or updates to, the consumer reporting agency's
systems; or
(vi) Commercially reasonable maintenance of, or repair to, the
consumer reporting agency's systems that is unexpected or
unscheduled.
(h) A consumer reporting agency shall remove or temporarily
lift a freeze placed on a consumer report only upon consumer
request, pursuant to subsection (d) of this section.
(i) If a third party requests access to a consumer report on
which a security freeze is in effect, and this request is in
connection with an application for credit or any other use, and the
consumer does not allow his or her consumer report to be accessed
for that specific party or period of time, the third party may
treat the application as incomplete.
(j) A security freeze shall remain in place until the consumer
requests that the security freeze be removed. A consumer reporting
agency shall remove a security freeze within three business days of
receiving a request for removal from the consumer, who provides the
following:
(1) Proper identification; and
(2) The unique personal identification number or password provided by the consumer reporting agency pursuant to subsection
(c) of this section.
(k) A consumer reporting agency shall require proper
identification of the person making a request to place or remove a
security freeze.
(l) The provisions of this section do not apply to the
distribution of a consumer credit report to any of the following:
(1) A person, or the person's subsidiary, affiliate, agent, or
assignee with which the consumer has or, prior to assignment, had
an account, contract, or debtor-creditor relationship for the
purposes of reviewing the account or collecting the financial
obligation owing for the account, contract, or debt.
(2) A subsidiary, affiliate, agent, assignee, or prospective
assignee of a person to whom access has been granted under the
provisions of this article for purposes of facilitating the
extension of credit or other permissible use.
(3) A person acting pursuant to a court order, warrant, or subpoena.
(4) A state or local agency that administers a program for
establishing and enforcing child support obligations.
(5) The West Virginia Department of Health and Human
Resources, its agents or assigns acting to investigate fraud.
(6) The West Virginia Department of Revenue or its agents or
assigns acting to investigate or collect delinquent taxes or unpaid
court orders or to fulfill any of its other statutory responsibilities.
(7) A person for the purposes of prescreening as defined by
the Federal Fair Credit Reporting Act.
(8) A person or entity administering a credit file monitoring
subscription service to which the consumer has subscribed.
(9) A person or entity for the purpose of providing a consumer
with a copy of his or her credit report upon the consumer's
request.
(m) No fees except those authorized by this subsection and
subsection (o) and (p) may be charged in connection with the
security freeze.
(n) A consumer reporting agency may not charge a fee for
security freeze services to a consumer who is a victim of identity
theft and who provides a copy of a police report, investigative
report, or written complaint to a law-enforcement agency concerning
the identity theft.
(o) A consumer may be charged a reasonable fee, not to exceed
five dollars, if the consumer fails to retain the original personal
identification number provided by the consumer reporting agency and
must be reissued the same or a new personal identification number.
§46A-6L-103. Notice of rights.
(a) At any time that a consumer is required to receive a
summary of rights required under section 609 of the federal "Fair
Credit Reporting Act," 15 U.S.C. §1681g, as in effect on the date of enactment of this article, the following notice shall be
included:
"West Virginia Consumers Have the Right to Obtain a Security
Freeze."
You may obtain a security freeze on your credit report to
protect your privacy and ensure that credit is not granted in your
name without your knowledge. You have a right to place a security
freeze on your credit report pursuant to West Virginia law.
The security freeze will prohibit a consumer reporting agency
from releasing any information in your credit report without your
express authorization or approval.
The security freeze is designed to prevent credit, loans, and
services from being approved in your name without your consent.
When you place a security freeze on your credit report, within five
business days you will be provided a personal identification number
or password to use if you choose to remove the freeze on your
credit report or to temporarily authorize the distribution of your
credit report for a specific party, parties or period of time after
the freeze is in place. To provide that authorization, you must
contact the consumer reporting agency and provide all of the
following:
(1) The unique personal identification number or password
provided by the consumer reporting agency;
(2) Proper identification to verify your identity; and (3) The proper information regarding the third party or
parties who are to receive the credit report or the period of time
for which the report shall be available to users of the credit
report.
A consumer reporting agency that receives a request from a
consumer to lift temporarily a freeze on a credit report shall
comply with the request no later than three business days or less
after receiving the request.
A security freeze does not apply to circumstances in which you
have an existing account relationship and a copy of your report is
requested by your existing creditor or its agents or affiliates for
certain types of account review, collection, fraud control or
similar activities.
If you are actively seeking credit, you should understand that
the procedures involved in lifting a security freeze may slow your
own applications for credit. You should plan ahead and lift a
freeze, either completely if you are shopping around, or
specifically for a certain creditor, a few days before actually
applying for new credit.
You have a right to bring a civil action against someone who
violates your rights under the credit reporting laws. The action
can be brought against a consumer reporting agency or a user of
your credit report.
(b) If a consumer requests information about a security freeze, he or she shall be provided with the notice provided in
this section, about how to place, temporarily lift and remove a
security freeze.
§46A-6L-104. Violations; penalties.
If a consumer reporting agency erroneously, whether by
accident or design, violates the security freeze by releasing
credit information that has been placed under a security freeze,
the affected consumer is entitled to:
(1) Notification within five business days of the distribution
of the information, including specificity as to the information
distributed and the third party recipient of the information.
(2) File a complaint with the Federal Trade Commission and the
State Attorney General.
(3) File a civil action against the consumer reporting agency
seeking:
(A) Injunctive relief to prevent or restrain further violation
of the security freeze; and
(B) A civil penalty in an amount not to exceed ten thousand
dollars for each violation plus any damages available under other
civil laws; and
(C) Reasonable expenses, court costs, investigative costs, and
attorney's fees.
(4) Each violation of the security freeze is a separate
incident for purposes of imposing penalties under this section.
§46A-6L-105. Unfair or deceptive acts or practices.
Any violation of the provisions of this article is an unfair
or deceptive act or practice, as defined in article six, section
one hundred two of this chapter.
NOTE: The purpose of this bill is to establish a procedure
whereby a consumer may implement a security freeze to prohibit a
consumer reporting agency from releasing all or any part of the
consumer's credit report, other than those from open public
records, or any information derived from it to entities with whom
the consumer has no existing relationship without the express
authorization of the consumer. Civil penalties are provided for
violations.
Strike-throughs indicate language that would be stricken from
the present law, and underscoring indicates new language that would
be added.