Rep. Norm Thurston — Voting Record

Bill

Number

H.B. 45 Third Substitute (2018GS)

Sponsor

Rep. Dunnigan, J.

Final action

Governor Signed 3/15/2018

Outcome

Became law — signed by Gov. Gary R. Herbert

Summary

What it does

• This bill:
• modifies the manner in which a consumer requests a placement or removal of a security freeze;
• addresses a consumer reporting agency's duties related to placing a security freeze;
• prohibits a consumer reporting agency from charging a fee in connection with placing or removing a security freeze; and
• prohibits a consumer reporting agency from charging a fee to download or install a mobile application through which a person places or removes a security freeze.

Every vote on this bill

Bill text

CONSUMER REPORTING AGENCY FEES
GENERAL SESSION
STATE OF UTAH
Chief Sponsor: James A. Dunnigan
Senate Sponsor: 
Todd Weiler
LONG TITLE
General Description:
This bill modifies and enacts provisions of the Consumer Credit Protection Act.
Highlighted Provisions:
This bill:
▸ modifies the manner in which a consumer requests a placement or removal of a
security freeze;
▸ addresses a consumer reporting agency's duties related to placing a security freeze;
▸ prohibits a consumer reporting agency from charging a fee in connection with
placing or removing a security freeze; and
▸ prohibits a consumer reporting agency from charging a fee to download or install a
mobile application through which a person places or removes a security freeze.
Money Appropriated in this Bill:
None
Other Special Clauses:
None
Utah Code Sections Affected:
AMENDS:
13-45-201
, as last amended by Laws of Utah 2015, Chapter 191
13-45-202
, as last amended by Laws of Utah 2015, Chapter 191
13-45-204
, as enacted by Laws of Utah 2006, Chapter 344
Be it enacted by the Legislature of the state of Utah:
Section 1. Section 
13-45-201
 is amended to read:
13-45-201.
Security freeze.
(1) As used in this part[
, "security
]
:
(a) "Security
 freeze" means a prohibition, consistent with the provisions of this section,
on a consumer reporting agency's furnishing of a consumer's credit report to a third party
intending to use the credit report to determine the consumer's eligibility for credit.
(b) "Unique personal identifier" means a personal identification number, password, or
other secure form of identity verification accepted by a consumer reporting agency and
intended for use by a consumer to place, remove, or temporarily remove a security freeze in
accordance with this chapter.
[
(2) A consumer may place a security freeze on the consumer's credit report by:
]
[
(a) making a request to a consumer reporting agency in writing by certified mail;
]
[
(b) providing proper identification; and
]
[
(c) paying the fee required by the consumer reporting agency in accordance with
Section 
13-45-204
.
]
(2) (a) A consumer may request a security freeze on a consumer's credit report by:
(i) submitting a request for a security freeze to the consumer reporting agency by:
(A) certified mail to the postal address identified by the consumer reporting agency in
accordance with Subsection (5); or
(B) electronic means developed by the consumer reporting agency in accordance with
Subsection (5); and
(ii) providing proper identification to the consumer reporting agency.
(b) Upon receipt of a request described in Subsection (2)(a), the consumer reporting
agency shall:
(i) place a security freeze on the consumer's credit report:
(A) if the consumer submits the request by certified mail, as soon as practicable but no
later than five business days after the business day on which the consumer reporting agency
receives the request and the consumer's proper identification;
(B) if the consumer submits the request by a contact method described in Subsection
(5)(a)(ii) or (iii) that is not a mobile application, as soon as practicable but no later than 24
hours after the consumer reporting agency receives the request and the consumer's proper
identification; or 
(C) if the consumer submits the request by mobile application, within 15 minutes after
the consumer reporting agency receives the request and the consumer's proper identification;
(ii) provide the consumer a unique personal identifier, unless the consumer reporting
agency previously provided the consumer a unique personal identifier; and
(iii) within five business days after the business day on which the consumer reporting
agency places the security freeze, provide the consumer confirmation that the consumer
reporting agency placed the security freeze.
(3) If a security freeze is in place, a consumer reporting agency may not release a
consumer's credit report, or information from the credit report, to a third party that intends to
use the information to determine a consumer's eligibility for credit without prior authorization
from the consumer.
(4) (a) Notwithstanding Subsection (3), a consumer reporting agency may
communicate to a third party requesting a consumer's credit report that a security freeze is in
effect on the consumer's credit report.
(b) If a third party requesting a consumer's credit report in connection with the
consumer's application for credit is notified of the existence of a security freeze under
Subsection (4)(a), the third party may treat the consumer's application as incomplete.
[
(5) Upon receiving a request from a consumer under Subsection (2), the consumer
reporting agency shall:
]
[
(a) place a security freeze on the consumer's credit report within five business days
after receiving the consumer's request;
]
[
(b) send a written confirmation of the security freeze to the consumer within 10
business days after placing the security freeze; and
]
[
(c) provide the consumer with a unique personal identification number or password to
be used by the consumer when providing authorizations for removal or temporary removal of
the security freeze under Section 
13-45-202
.
]
[
(6) A consumer reporting agency shall require proper identification of the consumer
requesting to place, remove, or temporarily remove a security freeze.
]
[
(7)
] 
(5)
 (a) A consumer reporting agency shall develop a contact method to receive
and process a consumer's request to place, remove, or temporarily remove a security freeze.
(b) A contact method under Subsection [
(7)
] 
(5)
(a) shall include:
(i) a postal address;
(ii) an electronic contact method chosen by the consumer reporting agency, which may
include the use of fax, Internet, or other electronic means; and
(iii) the use of telephone in a manner that is consistent with any federal requirements
placed on the consumer reporting agency.
[
(8)
] 
(6)
 A security freeze placed under this section may be removed only in
accordance with Section 
13-45-202
.
(7) (a) The time requirement described in Subsection (2)(b)(i)(B) or (C), as applicable,
does not apply if the consumer reporting agency's ability to place the security freeze is
prevented by:
(i) an act of God, including fire, earthquakes, hurricanes, storms, or similar natural
disaster or phenomena;
(ii) unauthorized or illegal acts by a third party, including terrorism, sabotage, riot,
vandalism, labor strikes or disputes disrupting operations, or similar occurrence;
(iii) operational interruption, including electrical failure, unanticipated delay in
equipment or replacement part delivery, computer hardware or software failures inhibiting
response time, or similar disruption;
(iv) governmental action, including emergency orders or regulations, judicial or law
enforcement action, or similar directives;
(v) regularly scheduled maintenance, during other than normal business hours, of, or
updates to, the consumer reporting agency's systems; or
(vi) commercially reasonable maintenance of, or repair to, the consumer reporting
agency's systems that is unexpected or unscheduled.
(b) In the event of a circumstance described in Subsection (7)(a), the consumer
reporting agency shall place the security freeze as soon as practicable.
Section 2. Section 
13-45-202
 is amended to read:
13-45-202.
Removal of security freeze -- Requirements and timing.
(1) A consumer reporting agency [
may
] 
shall
 remove a security freeze from a
consumer's credit report only if:
(a) (i) the consumer reporting agency receives the consumer's request through [
a
] 
the
contact method established and required in accordance with Subsection 
13-45-201
[
(7)
]
(5)
; and
(ii) the consumer reporting agency receives the consumer's proper identification [
and:
]
or unique personal identifier; or
[
(A) other information sufficient to identify the consumer; or
]
[
(B) the consumer provides the consumer's personal identification number or
password; or
]
(b) the consumer makes a material misrepresentation of fact in connection with the
placement of the security freeze and the consumer reporting agency notifies the consumer in
writing before removing the security freeze.
(2) [
(a)
] A consumer reporting agency shall temporarily remove a security freeze upon
receipt of:
[
(i)
] 
(a)
 the consumer's request through the contact method established by the consumer
reporting agency in accordance with Subsection 
13-45-201
[
(7)
]
(5)
;
[
(ii)
] 
(b)
 the consumer's proper identification [
and:
] 
or unique personal identifier; and
[
(A) other information sufficient to identify the consumer; or
]
[
(B) personal identification number or password;
]
[
(iii)
] 
(c)
 a specific designation of the period of time for which the security freeze is to
be removed[
; and
]
.
[
(iv) the consumer reporting agency receives the payment of any fee required under
Section 
13-45-204
.
]
[
(b)
] 
(3)
 A consumer reporting agency shall remove 
or temporarily remove
 a security
freeze from a consumer's credit report within:
[
(i)
] 
(a)
 three business days after the business day on which the consumer's written
request to remove the security freeze is received by the consumer reporting agency at the postal
address chosen by the consumer reporting agency in accordance with Subsection
13-45-201
[
(7)
]
(5)(b)(i)
; or
[
(ii)
] 
(b)
minutes after the consumer's request is received by the consumer reporting
agency through [
the electronic
] 
a
 contact method [
chosen by the consumer reporting agency in
accordance with
] 
described in
 Subsection 
13-45-201
[
(7), or the use of telephone, during
normal business hours
]
(5)(b)(ii) or (iii),
 and includes the consumer's [
proper identification and
correct personal identification number or password
] 
unique personal identifier
.
[
(3) A consumer reporting agency need not remove a security freeze within the time
provided in Subsection (2)(b)(ii) if:
]
[
(a) the consumer fails to meet the requirements of Subsection 
13-45-202
(1); or
]
[
(b) the consumer reporting agency's ability to remove the security freeze within 15
minutes is prevented by:
]
(4) (a) The time requirement described in Subsection (3)(b) does not apply if the
consumer reporting agency's ability to remove the security freeze is prevented by:
(i) an act of God, including fire, earthquakes, hurricanes, storms, or similar natural
disaster or phenomena;
(ii) unauthorized or illegal acts by a third party, including terrorism, sabotage, riot,
vandalism, labor strikes or disputes disrupting operations, or similar occurrence;
(iii) operational interruption, including electrical failure, unanticipated delay in
equipment or replacement part delivery, computer hardware or software failures inhibiting
response time, or similar disruption;
(iv) governmental action, including emergency orders or regulations, judicial or law
enforcement action, or similar directives;
(v) regularly scheduled maintenance, during other than normal business hours, of, or
updates to, the consumer reporting agency's systems; 
or
(vi) commercially reasonable maintenance of, or repair to, the consumer reporting
agency's systems that is unexpected or unscheduled[
; or
]
.
(b) In the event of a circumstance described in Subsection (4)(a), the consumer
reporting agency shall remove the security freeze as soon as practicable.
[
(vii) receipt of a removal request outside of normal business hours.
]
Section 3. Section 
13-45-204
 is amended to read:
13-45-204.
Fees for security freeze.
[
(1) Except as provided in Subsection (2), a consumer reporting agency may charge a
reasonable fee to a consumer for placing and temporarily removing a security freeze.
]
[
(2)
] 
(1)
 A consumer reporting agency may not charge a fee for placing
, removing,
 or
temporarily
 removing a security freeze [
if:
]
.
[
(a) the consumer is a victim of identity fraud under Section 
76-6-1102
; and
]
[
(b) the consumer provides the consumer reporting agency with a valid copy of a police
report or police case number documenting the identity fraud.
]
(2) A consumer reporting agency may not charge a fee to download or install a mobile
application through which a person places or removes a security freeze.