AB912: Bill Text

LRB-3364/3

MDK:kjf&jld:pg

2005 - 2006 LEGISLATURE

2005 Assembly BILL 912

January 13, 2006 - Introduced by Representatives J. Fitzgerald, Davis, M. Williams, Nerison, Moulton, Lothian, Kerkman, Hahn, Van Roy, Musser, Ainsworth, Freese, LeMahieu, Hines, Vos, Wood, Ott, McCormick, Krawczyk, Gottlieb and Albers, cosponsored by Senators Olsen, S. Fitzgerald, Harsdorf, Lazich and Erpenbach. Referred to Committee on State Affairs.

AB912,1,2 An Act to create 138.25 of the statutes; relating to: allowing individuals to restrict release of credit reports and granting rule-making authority.

Analysis by the Legislative Reference Bureau

Subject to certain exceptions, this bill allows an individual to prohibit a consumer reporting agency from releasing the individual's consumer report for any purpose related to the extension of credit without the individual's prior authorization.

Under the bill, "consumer report" has the same meaning as "consumer report" under the federal Fair Credit Reporting Act (FCRA), which defines "consumer report" as any written, oral, or other communication by a consumer reporting agency bearing on an individual's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living, which is used or expected to be used as a factor in establishing the individual's eligibility for credit or insurance, employment, or any other purpose allowed under federal law. Although a "consumer report" includes communications for purposes other than extensions of credit, the bill allows an individual to prohibit releases of his or her consumer report only for extensions of credit. The bill does not allow an individual to prohibit releases for any of the other purposes included in the definition of "consumer report."

Also under the bill, "consumer reporting agency" has the same meaning as under the FCRA, which defines "consumer reporting agency" as any person who, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on individuals for the purpose of furnishing consumer reports to third parties, and who uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.

The bill prohibits a consumer reporting agency from releasing an individual's report for an extension of credit if the report includes a "security freeze," which the bill defines as a notice indicating that release of the report is subject to the bill. If an individual makes a request by certified mail, provides proper identification, and, subject to certain exceptions, pays a fee, a consumer reporting agency must include a security freeze with the individual's consumer report no later than five business days after receiving the request. No later than ten business days after including the security freeze, the consumer reporting agency must send the individual a notice confirming the security freeze. The notice must include a personal identification number (PIN), password, or other device for the individual to use to authorize release of the consumer report. Also, the notice must describe the procedures for an individual to authorize the release.

To authorize release of a consumer report that includes a security freeze, an individual must contact the consumer reporting agency, provide proper identification and the PIN, password, or other device described above, and specify the time period for which the consumer reporting agency is allowed to release the report. Subject to certain exceptions, the individual must also pay a fee to the consumer reporting agency. The bill requires a consumer reporting agency to release the consumer report for purposes of extensions of credit during the time period specified by the individual, except that a consumer reporting agency is not required to release the report sooner than three business days after the individual contacts the consumer reporting agency. However, a consumer reporting agency may, but is not required, to release a report sooner than three business days if the consumer reporting agency establishes procedures for individuals to contact the consumer reporting agency by telephone, facsimile, the Internet, or other electronic media.

The bill contains exceptions to the above requirements. The following consumer reporting agencies are not required to include a security freeze with a consumer report: 1) check services or fraud prevention services companies; 2) deposit account information service companies; and 3) certain resellers of consumer credit information. However, if a reseller obtains a consumer report about an individual that includes a security freeze included by another consumer reporting agency, the reseller must include the security freeze in any consumer report regarding the individual that the reseller maintains.

The bill also allows a consumer reporting agency to release an individual's consumer report that includes a security freeze to any of the following for the following purposes, even if the individual has not authorized release of the report: 1) certain persons with whom the individual has an account or contract or to whom the individual has issued, or is otherwise personally liable on, a negotiable instrument, for the purpose of reviewing the account or collecting a financial obligation owing for the account, contract, or negotiable instrument or for the purpose of preventing or investigating potential fraud or identity theft; 2) a person who has a legitimate business need for the information in connection with a business transaction initiated by the individual; 3) subsidiaries, affiliates, agents, assignees, and prospective assignees of the foregoing persons; 4) state or local agencies, law enforcement agencies, courts, or private collection agencies acting pursuant to court orders, warrants, or subpoenas; 5) child support agencies acting to enforce child support obligations; 6) the state or its agents or assigns acting to investigate fraud or collect delinquent taxes or unpaid court orders, or to fulfill any other statutory responsibilities; 7) persons administering a credit file monitoring service to which the individual has subscribed; 8) persons who provide the individual with a copy of a consumer report at the individual's request; or 9) insurers authorized to do business in this state who use consumer reports for underwriting insurance; or 10) persons who intend to use the information for employment purposes.

In addition, if an individual has authorized release of a consumer report to a person during a time period specified by the individual, the consumer reporting agency may release the report to any subsidiary, affiliate, agent, assignee, and prospective assignee of that person. Also, a consumer reporting agency may release reports for the purpose of prescreening that is allowed under the FCRA. (Prescreening is a process in which consumer reporting agencies compile lists of consumers who meet specific criteria and provide the lists to third parties for credit or insurance solicitation purposes.)

The bill also does all of the following:

1. Requires a consumer reporting agency to remove security freezes upon an individual's request.

2. Allows a consumer reporting agency to release a consumer report if an individual made a material misrepresentation of fact regarding a security freeze. Before releasing a report, the consumer reporting agency must notify the individual about the misrepresentation.

3. Allows a consumer reporting agency to advise a third party that the consumer reporting agency must obtain an individual's authorization before releasing a consumer report to the third party.

4. Allows a third party to treat an individual's application for an extension of credit as incomplete if the bill prohibits a consumer reporting agency from releasing the individual's consumer report to the third party.

5. Allows a consumer reporting agency to charge specified fees to individuals who request security freezes, authorize the release of consumer reports that include security freezes, or request removal of security freezes. However, the bill prohibits a consumer reporting agency from charging fees to victims of identity theft.

6. If a consumer report includes a freeze, prohibits a consumer reporting agency from making changes to certain information in the report without providing written notice.

7. Allows a consumer reporting agency to collect damages from persons who knowingly violate the bill or federal credit reporting law or who take certain actions regarding consumer reports or security freezes under false pretenses.

8. Requires a consumer reporting agency to provide individuals with a notice describing their rights under the bill whenever the consumer reporting agency is required to provide a notice under the FCRA regarding consumer rights with respect to consumer reports.

Finally, the bill requires the Division of Banking in the Department of Financial Institutions (division) to enforce the bill's requirements. The bill also requires the division to promulgate rules regarding the "proper identification" that individuals must provide to consumer reporting agencies when requesting a security freeze or removal of a security freeze or authorizing release of consumer reports.

For further information see the state fiscal estimate, which will be printed as an appendix to this bill.

The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:

AB912, s. 1 Section 1. 138.25 of the statutes is created to read:

AB912,4,2 138.25 Access to credit reports. (1) Definitions. In this section:

AB912,4,4 (a) "Business day" means a business day, as defined in s. 421.301 (6), that is not a legal holiday under s. 895.20 or a federal legal holiday.

AB912,4,5 (b) "Consumer report" has the meaning given in 15 USC 1681a (d).

AB912,4,6 (c) "Consumer reporting agency" has the meaning given in s. 15 USC 1681a (f).

AB912,4,11 (d) "Reseller" means a consumer reporting agency that acts only as a reseller of credit information by assembling and merging information contained in a database of another consumer reporting agency or multiple consumer credit reporting agencies, and does not maintain a permanent database of credit information from which new consumer reports are produced.

AB912,4,13 (e) "Security freeze" means a notice included with an individual's consumer report that indicates that releases of the consumer report are subject to this section.

AB912,4,16 (2) Security freezes. (a) Except as provided in par. (c), a consumer reporting agency shall include a security freeze with an individual's consumer report if the individual does all of the following:

AB912,5,2 1. Sends a request by certified mail to an address designated by the consumer reporting agency.

AB912,5,3 2. Provides the consumer reporting agency with proper identification.

AB912,5,4 3. If applicable, pays the fee specified in sub. (9).

AB912,5,9 (b) No later than 5 business days after an individual satisfies the requirements under par. (a) 1. to 3., a consumer reporting agency shall include a security freeze with the individual's consumer report. No later than 10 business days after including the security freeze with the consumer report, the consumer reporting agency shall send the individual a notice that does all of the following:

AB912,5,11 1. Confirms that a security freeze is included with the individual's consumer report.

AB912,5,13 2. Includes a unique personal identification number, password, or other device for the individual to authorize release of the consumer report.

AB912,5,14 3. Describes the procedure for authorizing release of the consumer report.

AB912,5,15 (c) Paragraph (a) does not apply to any of the following:

AB912,5,19 1. A reseller, except that if a reseller obtains from another consumer reporting agency an individual's consumer report that includes a security freeze, the reseller shall include the security freeze with any consumer report regarding the individual that the reseller maintains.

AB912,5,23 2. A consumer reporting agency that is a check services or fraud prevention services company which issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments.

AB912,6,3 3. A consumer reporting agency that is a deposit account information service company which issues reports regarding account closures due to fraud, substantial overdrafts, automated teller machine abuse, or similar negative information regarding an individual to inquiring financial institutions for use only in reviewing an individual's request for a deposit account at the inquiring financial institution.

AB912,6,7 (3) Prohibition. Except as provided in sub. (8), if an individual's consumer report includes a security freeze, a consumer reporting agency may not release the consumer report to any person for any purpose related to the extension of credit unless the individual gives prior authorization for the release under sub. (4).

AB912,6,10 (4) Release authorization. (a) An individual whose consumer report includes a security freeze may authorize a consumer reporting agency to release the report by doing all of the following:

AB912,6,12 1. Contacting the consumer reporting agency using a point of contact designated by the consumer reporting agency.