Rep. Norm Thurston — Voting Record

Bill

Number

S.B. 54 First Substitute (2015GS)

Sponsor

Sen. Osmond, A.

Final action

Governor Signed 3/25/2015

Outcome

Became law — signed by Gov. Gary R. Herbert

Summary

What it does

• This bill:
• defines terms;
• upon request and in accordance with the provisions of this bill, requires a credit reporting agency to place a security freeze for:
• an individual who is less than 16 years of age;
• an incapacitated adult; or
• a protected person;
• provides a procedure by which an individual or an individual's representative may remove a security freeze;
• allows, under certain circumstances, a credit reporting agency to charge a reasonable fee for the placement or removal of a security freeze;
• provides that the attorney general may enforce the provisions of this bill; and
• makes technical and conforming changes.

Every vote on this bill

Bill text

CREDIT MONITORING FOR MINORS
GENERAL SESSION
STATE OF UTAH
Chief Sponsor: Aaron Osmond
House Sponsor: 
Rich Cunningham
LONG TITLE
General Description:
This bill modifies and enacts provisions of the Consumer Credit Protection Act relating
to certain minors, incapacitated adults, and protected persons.
Highlighted Provisions:
This bill:
▸ defines terms;
▸ upon request and in accordance with the provisions of this bill, requires a credit
reporting agency to place a security freeze for:
• an individual who is less than 16 years of age;
• an incapacitated adult; or
• a protected person;
▸ provides a procedure by which an individual or an individual's representative may
remove a security freeze;
▸ allows, under certain circumstances, a credit reporting agency to charge a reasonable
fee for the placement or removal of a security freeze;
▸ provides that the attorney general may enforce the provisions of this bill; and
▸ makes technical and conforming changes.
Money Appropriated in this Bill:
None
Other Special Clauses:
This bill provides a special effective date.
Utah Code Sections Affected:
AMENDS:
13-45-102
, as enacted by Laws of Utah 2006, Chapter 344
13-45-201
, as enacted by Laws of Utah 2006, Chapter 344
13-45-202
, as enacted by Laws of Utah 2006, Chapter 344
13-45-401
, as enacted by Laws of Utah 2006, Chapter 344
ENACTS:
13-45-501
, Utah Code Annotated 1953
13-45-502
, Utah Code Annotated 1953
13-45-503
, Utah Code Annotated 1953
13-45-504
, Utah Code Annotated 1953
13-45-505
, Utah Code Annotated 1953
13-45-506
, Utah Code Annotated 1953
Be it enacted by the Legislature of the state of Utah:
Section 1. Section 
13-45-102
 is amended to read:
13-45-102.
Definitions.
As used in this chapter:
(1) "Consumer" means [
a natural person
] 
an individual who is not a protected
consumer
.
(2) "Consumer reporting agency" means a person who, for fees, dues, or on a
cooperative basis, regularly engages in whole or in part in the practice of assembling or
evaluating information concerning a consumer's credit or other information for the purpose of
furnishing a credit report to another person.
(3) "Consumer who is subject to a protected consumer security freeze" means an
individual:
(a) for whom a credit reporting agency placed a security freeze under Section
13-45-503
; and
(b) who, on the day on which a request for the removal of the security freeze is
submitted under Section 
13-45-504
, is not a protected consumer.
[
(3)
] 
(4)
 "Credit report" means a consumer report, as defined in 15 U.S.C. Sec. 1681a,
that is used or collected in whole or part for the purpose of serving as a factor in establishing a
consumer's eligibility for credit for personal, family, or household purposes.
(5) "File" is as defined in 15 U.S.C. Sec. 1681a.
(6) "Incapacitated person" means an individual who is incapacitated, as defined in
Section 
75-1-201
.
[
(4)
] 
(7)
 "Normal business hours" means Sunday through Saturday, between the hours
of 6:00 a.m. and 9:30 p.m., Mountain Standard or Mountain Daylight Time.
[
(5)
] 
(8)
 (a) "Personal information" means personally identifiable financial
information:
(i) provided by a consumer to another person;
(ii) resulting from any transaction with the consumer or any service performed for the
consumer; or
(iii) otherwise obtained by another person.
(b) "Personal information" does not include:
(i) publicly available information, as that term is defined by the regulations prescribed
under 15 U.S.C. Sec. 6804; or
(ii) any list, description, or other grouping of consumers, and publicly available
information pertaining to the consumers, that is derived without using any nonpublic personal
information.
(c) Notwithstanding Subsection [
(5)
] 
(8)
(b), "personal information" includes any list,
description, or other grouping of consumers, and publicly available information pertaining to
the consumers, that is derived using any nonpublic personal information other than publicly
available information.
[
(6)
] 
(9)
 "Proper identification" has the same meaning as in 15 U.S.C. Sec.
1681h(a)(1), and includes:
(a) the consumer's full name, including first, last, and middle names and any suffix;
(b) any name the consumer previously used;
(c) the consumer's current and recent full addresses, including street address, any
apartment number, city, state, and ZIP code;
(d) the consumer's Social Security number; and
(e) the consumer's date of birth.
[
(7) "Security freeze" means a prohibition, consistent with Section 
13-45-201
, on a
consumer reporting agency's furnishing of a consumer's credit report to a third party intending
to use the credit report to determine the consumer's eligibility for credit.
]
(10) "Protected consumer" means an individual who, at the time a request for a security
freeze is made, is:
(a) less than 16 years of age;
(b) an incapacitated person; or
(c) a protected person.
(11) "Protected person" means the same as that term is defined in Section 
75-5b-102
.
(12) "Record" means a compilation of information that:
(a) identifies a protected consumer;
(b) is created by a consumer reporting agency solely for the purpose of complying with
this section; and
(c) may not be created or used to consider the protected consumer's credit worthiness,
credit standing, credit capacity, character, general reputation, personal characteristics, or mode
of living.
(13) "Representative" means a person who provides to a consumer reporting agency
sufficient proof of authority to act on behalf of a protected consumer.
(14) (a) "Sufficient proof of authority" means documentation that shows that a person
has authority to act on behalf of a protected consumer.
(b) "Sufficient proof of authority" includes:
(i) a court order;
(ii) a lawfully executed power of attorney; or
(iii) a written, notarized statement signed by the person that expressly describes the
person's authority to act on behalf of the protected consumer.
(15) (a) "Sufficient proof of identification" means information or documentation that
identifies a protected consumer or a representative.
(b) "Sufficient proof of identification" includes:
(i) a Social Security number or a copy of a Social Security card issued by the United
States Social Security Administration;
(ii) a certified or official copy of a birth certificate; or
(iii) a copy of a government issued driver license or identification card.
Section 2. Section 
13-45-201
 is amended to read:
13-45-201.
Security freeze.
(1) As used in this part, "security freeze" means a prohibition, consistent with the
provisions of this section, on a consumer reporting agency's furnishing of a consumer's credit
report to a third party intending to use the credit report to determine the consumer's eligibility
for credit.
[
(1)
] 
(2)
 A consumer may place a security freeze on the consumer's credit report by:
(a) making a request to a consumer reporting agency in writing by certified mail;
(b) providing proper identification; and
(c) paying the fee required by the consumer reporting agency in accordance with
Section 
13-45-204
.
[
(2)
] 
(3)
 If a security freeze is in place, a consumer reporting agency may not release a
consumer's credit report, or information from the credit report, to a third party that intends to
use the information to determine a consumer's eligibility for credit without prior authorization
from the consumer.
[
(3)
] 
(4)
 (a) Notwithstanding Subsection [
(2)
] 
(3)
, a consumer reporting agency may
communicate to a third party requesting a consumer's credit report that a security freeze is in
effect on the consumer's credit report.
(b) If a third party requesting a consumer's credit report in connection with the
consumer's application for credit is notified of the existence of a security freeze under
Subsection [
(3)
] 
(4)
(a), the third party may treat the consumer's application as incomplete.
[
(4)
] 
(5)
 Upon receiving a request from a consumer under Subsection [
(1)
] 
(2)
, the
consumer reporting agency shall:
(a) place a security freeze on the consumer's credit report within five business days
after receiving the consumer's request;
(b) send a written confirmation of the security freeze to the consumer within 10
business days after placing the security freeze; and
(c) provide the consumer with a unique personal identification number or password to
be used by the consumer when providing authorizations for removal or temporary removal of
the security freeze under Section 
13-45-202
.
[
(5)
] 
(6)
 A consumer reporting agency shall require proper identification of the
consumer requesting to place, remove, or temporarily remove a security freeze.
[
(6)
] 
(7)
 (a) A consumer reporting agency shall develop a contact method to receive
and process a consumer's request to place, remove, or temporarily remove a security freeze.
(b) A contact method under Subsection [
(6)
] 
(7)
(a) shall include:
(i) a postal address;
(ii) an electronic contact method chosen by the consumer reporting agency, which may
include the use of fax, Internet, or other electronic means; and
(iii) the use of telephone in a manner that is consistent with any federal requirements
placed on the consumer reporting agency.
[
(7)
] 
(8)
 A security freeze placed under this section may be removed only in
accordance with Section 
13-45-202
.
Section 3. Section 
13-45-202
 is amended to read:
13-45-202.
Removal of security freeze -- Requirements and timing.
(1) A consumer reporting agency may remove a security freeze from a consumer's
credit report only if:
(a) (i) the consumer reporting agency receives the consumer's request through a contact
method established and required in accordance with Subsection 
13-45-201
[
(6)
]
(7)
; and
(ii) the consumer reporting agency receives the consumer's proper identification and:
(A) other information sufficient to identify the consumer; or
(B) the consumer provides the consumer's personal identification number or password;
or
(b) the consumer makes a material misrepresentation of fact in connection with the
placement of the security freeze and the consumer reporting agency notifies the consumer in
writing before removing the security freeze.
(2) (a) A consumer reporting agency shall temporarily remove a security freeze upon
receipt of:
(i) the consumer's request through the contact method established by the consumer
reporting agency in accordance with Subsection 
13-45-201
[
(6)
]
(7)
;
(ii) the consumer's proper identification and:
(A) other information sufficient to identify the consumer; or
(B) personal identification number or password;
(iii) a specific designation of the period of time for which the security freeze is to be
removed; and
(iv) the consumer reporting agency receives the payment of any fee required under
Section 
13-45-204
.
(b) A consumer reporting agency shall remove a security freeze from a consumer's
credit report within:
(i) three business days after the business day on which the consumer's written request
to remove the security freeze is received by the consumer reporting agency at the postal address
chosen by the consumer reporting agency in accordance with Subsection 
13-45-201
[
(6)
]
(7)
; or
(ii) 15 minutes after the consumer's request is received by the consumer reporting
agency through the electronic contact method chosen by the consumer reporting agency in
accordance with Subsection 
13-45-201
[
(6)
]
(7)
, or the use of telephone, during normal business
hours and includes the consumer's proper identification and correct personal identification
number or password.
(3) A consumer reporting agency need not remove a security freeze within the time
provided in Subsection (2)(b)(ii) if:
(a) the consumer fails to meet the requirements of Subsection 
13-45-202
(1); or
(b) the consumer reporting agency's ability to remove the security freeze within 15
minutes is prevented by:
(i) an act of God, including fire, earthquakes, hurricanes, storms, or similar natural
disaster or phenomena;
(ii) unauthorized or illegal acts by a third party, including terrorism, sabotage, riot,
vandalism, labor strikes or disputes disrupting operations, or similar occurrence;
(iii) operational interruption, including electrical failure, unanticipated delay in
equipment or replacement part delivery, computer hardware or software failures inhibiting
response time, or similar disruption;
(iv) governmental action, including emergency orders or regulations, judicial or law
enforcement action, or similar directives;
(v) regularly scheduled maintenance, during other than normal business hours, of, or
updates to, the consumer reporting agency's systems;
(vi) commercially reasonable maintenance of, or repair to, the consumer reporting
agency's systems that is unexpected or unscheduled; or
(vii) receipt of a removal request outside of normal business hours.
Section 4. Section 
13-45-401
 is amended to read:
13-45-401.
Enforcement.
(1) The attorney general may enforce [
this chapter's provisions
] 
the provisions of this
chapter
.
(2) A person who violates [
this chapter's provisions
] 
a provision of Section 
13-45-201
,
13-45-202
, 
13-45-203
, 
13-45-204
, 
13-45-205
, or 
13-45-301
 is subject to a civil fine of:
(a) no greater than $2,500 for a violation or series of violations concerning a specific
consumer; and
(b) no greater than $100,000 in the aggregate for related violations concerning more
than one consumer.
(3) In addition to the penalties provided in Subsection (2), the attorney general may
seek injunctive relief to prevent future violations of this chapter in:
(a) the district court located in Salt Lake City; or
(b) the district court for the district in which resides a consumer who is the subject of a
credit report on which a violation occurs.
Section 5. Section 
13-45-501
 is enacted to read:
Part 5. Credit Report Protection for Minors
 13-45-501.
Title.
This part is known as "Credit Report Protection for Minors."
Section 6. Section 
13-45-502
 is enacted to read:
 13-45-502.
Definitions.
As used in this part, "security freeze" means:
(1) if a consumer reporting agency does not have a file that pertains to a protected
consumer, a restriction that:
(a) is placed on the protected consumer's record in accordance with this part; and
(b) except as otherwise provided in this part, prohibits the consumer reporting agency
from releasing the protected consumer's record; or
(2) if a consumer reporting agency has a file that pertains to the protected consumer, a
restriction that:
(a) is placed on the protected consumer's credit report in accordance with this part; and
(b) except as otherwise provided in this part, prohibits the consumer reporting agency
from releasing the protected consumer's credit report or any information derived from the
protected consumer's credit report.
Section 7. Section 
13-45-503
 is enacted to read:
 13-45-503.
Applicability.
This part does not apply to the use of a protected consumer's credit report or record by:
(1) a person administering a credit file monitoring subscription service to which:
(a) the protected consumer has subscribed; or
(b) the protected consumer's representative has subscribed on the protected consumer's
behalf;
(2) a person who, upon request from the protected consumer or the protected
consumer's representative, provides the protected consumer or the protected consumer's
representative with a copy of the protected consumer's credit report;
(3) a check services or fraud prevention services company that issues:
(a) reports on incidents of fraud; or
(b) authorizations for the purpose of approving or processing negotiable instruments,
electronic funds transfers, or similar payment methods;
(4) a deposit account information service company that issues reports regarding
account closures due to fraud, substantial overdrafts, automated teller machine abuse, or
similar information regarding an individual to inquiring banks or other financial institutions for
use only in reviewing an individual's request for a deposit account at the inquiring bank or
financial institution;
(5) an insurance company for the purpose of conducting the insurance company's
ordinary business;
(6) a consumer reporting agency that:
(a) only resells credit information by assembling and merging information contained in
a database of another consumer reporting agency or multiple consumer reporting agencies; and
(b) does not maintain a permanent database of credit information from which new
credit reports are produced; or
(7) a consumer reporting agency's database or file that consists of information that:
(a) concerns and is used for:
(i) criminal record information;
(ii) fraud prevention or detection;
(iii) personal loss history information; or
(iv) employment, tenant, or individual background screening; and
(b) is not used for credit granting purposes.
Section 8. Section 
13-45-504
 is enacted to read:
 13-45-504.
Security freeze for protected consumer.
(1) A consumer reporting agency shall place a security freeze for a protected consumer
if:
(a) the consumer reporting agency receives a request from the protected consumer's
representative for the placement of the security freeze; and
(b) the protected consumer's representative:
(i) submits the request described in Subsection (1)(a):
(A) to the address or other point of contact provided by the consumer reporting agency;
and
(B) in the manner specified by the consumer reporting agency;
(ii) submits to the consumer reporting agency:
(A) sufficient proof of identification of the protected consumer;
(B) sufficient proof of identification of the protected consumer's representative; and
(C) sufficient proof of authority to act on behalf of the protected consumer; and
(iii) if applicable, pays the consumer reporting agency a fee described in Subsection
13-45-506
(2).
(2) If a consumer reporting agency does not have a file that pertains to a protected
consumer when the consumer reporting agency receives a request described in Subsection (1),
the consumer reporting agency shall create a record for the protected consumer.
(3) A consumer reporting agency shall place a security freeze for a protected consumer
within 30 days after the day on which the consumer reporting agency receives a request
described in Subsection (1).
(4) After a consumer reporting agency places a security freeze under this section, the
consumer reporting agency may not release the protected consumer's credit report, any
information derived from the protected consumer's credit report, or any record created for the
protected consumer, unless the security freeze for the protected consumer is removed in
accordance with Section 
13-45-505
.
(5) A security freeze that is placed in accordance with this section shall remain in effect
until:
(a) the protected consumer's representative or the consumer who is subject to a
protected consumer security freeze requests the consumer reporting agency remove the security
freeze in accordance with Subsection 
13-45-505
(1); or
(b) the security freeze is removed in accordance with Subsection 
13-45-505
(3).
Section 9. Section 
13-45-505
 is enacted to read:
 13-45-505.
Removal of security freeze for protected consumer.
(1) To remove a security freeze that is placed under this part, the protected consumer's
representative or the consumer who is subject to a protected consumer security freeze shall:
(a) submit a request for the removal of the security freeze to the consumer reporting
agency:
(i) at the address or other point of contact provided by the consumer reporting agency;
and
(ii) in the manner specified by the consumer reporting agency;
(b) provide to the consumer reporting agency:
(i) in the case of a request by a protected consumer's representative:
(A) sufficient proof of identification of the protected consumer;
(B) sufficient proof of identification of the protected consumer's representative; and
(C) sufficient proof of authority to act on behalf of the protected consumer; or
(ii) in the case of a request by the consumer who is subject to a protected consumer
security freeze:
(A) sufficient proof of identification of the consumer who is subject to a protected
consumer security freeze; and
(B) proof that the consumer who is subject to a protected consumer security freeze is
not a protected consumer; and
(c) if applicable, pay the consumer reporting agency a fee described in Subsection
13-45-506
(2).
(2) Within 30 days after the day on which a consumer reporting agency receives a
request under Subsection (1), the consumer reporting agency shall remove the security freeze.
(3) A consumer reporting agency may remove a security freeze for a protected
consumer or delete a record of a protected consumer if the security freeze was placed or the
record was created based on a material misrepresentation of fact by the protected consumer or
the protected consumer's representative.
Section 10. Section 
13-45-506
 is enacted to read:
 13-45-506.
Fees.
(1) Except as provided in Subsection (2), a consumer reporting agency may not charge
a fee for any service performed under this part.
(2) A consumer reporting agency may charge a reasonable fee, which does not exceed
$5, for each placement or removal of a security freeze under this part, unless:
(a) the protected consumer's representative:
(i) has obtained a police report that states the protected consumer is the alleged victim
of identity fraud; and
(ii) provides a copy of the report to the consumer reporting agency; or
(b) (i) the protected consumer is less than 16 years of age at the time the request is
submitted to the consumer reporting agency; and
(ii) the consumer reporting agency has a file that pertains to the protected consumer.
Section 11. 
Effective date.
This bill takes effect on January 1, 2016.