SB581: Bill Text

The bill allows an individual to prohibit, with certain exceptions, a credit reporting agency from releasing the individual's credit report to third parties without the individual's authorization. Under the bill, if an individual provides the notice by certified mail or telephone to a credit reporting agency, then, no later than five business days after receipt of the notice, the credit reporting agency may not, with certain exceptions, release the individual's credit report to third parties without first obtaining the individual's authorization. The bill also allows, but does not require, a credit reporting agency to accept notices by electronic mail. If such notice is allowed, the credit reporting agency's deadline for not releasing credit reports is three business days after receipt of the notice. The bill also requires a credit reporting agency, within five business days after receipt of a notice, to provide an individual a unique personal identification number or password for authorizing the release of credit reports as described below.

As an alternative to giving prior authorization, the bill allows an individual who provides the notice described above to request the credit reporting agency to release a credit report to a third party identified by the individual. In addition, the bill allows an individual to request a credit reporting agency to release credit reports, for a period of time specified by the individual, to persons eligible to obtain them under federal law. An individual must provide the identification number or password described above to request release of a credit report under such circumstances. The bill requires a credit reporting agency to establish procedures for making such requests. The procedures must allow the requests to be made by certified mail or telephone and may allow the requests to be made by electronic mail. The bill requires a credit reporting agency to comply with a request within three business days after receipt of the request.

The bill contains exceptions to the prohibition on releasing credit reports without an individual's prior authorization. If an individual makes a material misrepresentation of fact in the notice describe above, the credit reporting agency may release a credit report, but only if the credit reporting agency first notifies the individual in writing about the misrepresentation at least five business days before releasing the credit report.

Also, the bill allows a credit reporting agency to release an individual's credit report to a person, or subsidiary, affiliate, agent, or assignee of a person, with whom the individual has an account, contract, or debtor-creditor relationship, provided that the release is for certain account review activities. In addition, the bill allows a credit reporting agency to release a credit report to any of the following: 1) a court, state or local governmental agency, or law enforcement agency; 2) a person acting pursuant to a court order, warrant, or subpoena; 3) the Department of Workforce Development (DWD) or a county child support agency for the purpose of enforcing support or maintenance obligations; 4) DWD or the Department of Health and Family Services for the purpose of investigating suspected fraudulent activity regarding specified benefits programs; 5) the Department of Revenue for the purpose of collecting delinquent taxes; 6) a person administering a credit file monitoring service to which the individual has subscribed; or 7) a person who provides the individual with a copy of a credit report at the individual's request. In addition, a credit reporting agency may release reports for the purpose of prescreening that is allowed under the federal Fair Credit Reporting Act. (Prescreening is a process in which credit reporting agencies compile lists of consumers who meet specific criteria and provide the lists to third parties for credit or insurance solicitation purposes.)

The bill also does all of the following:

1. Allows an individual to rescind a notice described above.

2. Allows a credit reporting agency to advise a third party that the credit reporting agency must obtain an individual's authorization before releasing a credit report to the third party.

3. Allows a third party to treat an individual's application for credit or any other purpose as incomplete if the bill prohibits a credit reporting agency from releasing the individual's credit report to the third party.

4. If a credit reporting agency releases an individual's credit report in violation of the bill's requirements, requires a credit reporting agency to notify the individual within 5 business days after releasing the credit report.

5. Prohibits a credit reporting agency from charging fees for taking actions required under the bill, except for reissuing personal identification numbers and passwords under certain circumstances.

6. Allows an individual to bring an action against a credit reporting agency that violates the bill's requirements regarding credit reports and recover damages or $10,000 per violation, whichever is greater.

7. Requires credit reporting agencies to provide individuals with a notice describing their rights under the bill whenever the credit reporting agency is required to provide a notice under federal law regarding consumer rights with respect to credit reports.

Finally, the bill requires the Division of Banking in the Department of Financial Institutions to enforce the foregoing requirements.

Because this bill creates a new crime or revises a penalty for an existing crime, the Joint Review Committee on Criminal Penalties may be requested to prepare a report concerning the proposed penalty and the costs or savings that are likely to result if the bill is enacted.

For further information see the state and local fiscal estimate, which will be printed as an appendix to this bill.

The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:

SB581, s. 1 Section 1. 100.54 of the statutes is created to read:

SB581,5,6 100.54 Refusals to disclose social security number; discrimination prohibited. (1) No person that conducts business in this state may discriminate with respect to the terms or conditions of the sale or purchase of goods or services against an individual who refuses to disclose the individual's social security number, unless the person is required or specifically authorized by state or federal law to obtain the individual's social security number.

SB581,5,8 (2) The department may exercise its authority under ss. 93.14 and 93.15 to investigate violations of this section.

SB581,5,12 (3) The department may commence an action in the name of the state to restrain by temporary or permanent injunction a violation of this section. Before entry of final judgment, the court may make any necessary orders to restore to any person any pecuniary loss suffered by the person because of the violation.

SB581, s. 2 Section 2. 103.135 of the statutes is created to read:

SB581,5,19 103.135 Employee social security number protection. (1) Definition. In this section, "employer" means any person engaging in any activity, enterprise, or business in this state employing at least one individual. "Employer" includes the state and any office, department, independent agency, authority, institution, association, society, or other body in state government created or authorized to be created by the constitution or any law, including the legislature and the courts.

SB581,5,25 (2) Unnecessary solicitation or use prohibited. No employer may solicit from any applicant for employment the social security number of the applicant until the employer makes an offer of employment to the applicant. No employer may use the social security number of any derivative of the social security number of an employee as an identifier unless that use is required or specifically authorized by state or federal law.

SB581,6,3 (3) Display prohibited. No employer may display the social security number or any derivative of a social security number of an employee on any identification card that is issued by the employer.

SB581, s. 3 Section 3. 138.25 of the statutes is created to read:

SB581,6,5 138.25 Access to credit reports. (1) Definitions. In this section:

SB581,6,7 (a) "Account review" includes review activities related to account maintenance or monitoring, credit line increases, or account upgrades or enhancements.

SB581,6,9 (b) "Business day" means a business day, as defined in s. 421.301 (6), that is not a legal holiday under s. 895.20 or a federal legal holiday.

SB581,6,14 (c) "Credit report" means any written, oral, or other communication of any information by a credit reporting agency bearing on a individual's credit worthiness, credit standing, or credit capacity, which is used or is expected to be used, or collected in whole or in part, for a purpose specified in 15 USC 1681b or for the purpose of serving as a factor in establishing the individual's eligibility for any of the following:

SB581,6,15 1. Credit to be used primarily for personal, family, or household purposes.

SB581,6,16 2. Employment, promotion, reassignment, or retention as an employee.

SB581,6,17 3. Rental of a residential dwelling unit.

SB581,6,23 (d) "Credit reporting agency" means any person who, for fees, dues, or other compensation, or on a cooperative nonprofit basis, regularly engages in whole or in part in the business of assembling or evaluating credit or other information on individuals for the purpose of furnishing credit reports to 3rd parties, but does not include any governmental agency whose records are maintained primarily for traffic safety, law enforcement, or licensing purposes.

SB581,6,25 (e) "Eligible user" means a person who is allowed under federal law to obtain an individual's credit report.

SB581,7,6 (2) Restriction of access. (a) Notice. 1. If an individual provides notice, as specified in subd. 2., to a credit reporting agency to restrict access to the individual's credit report, then, no later than the deadline specified in subd. 2., the credit reporting agency may not, except as provided in sub. (3), release the credit report, or any information included in the credit report, to a 3rd party without the individual's prior authorization.

SB581,7,14 2. An individual may provide the notice required under subd. 1. to a credit reporting agency by certified mail, telephone, or, if allowed by the credit reporting agency, electronic mail. The notice shall include information that allows the credit reporting agency to verify the identity of the individual providing the notice. If a notice includes such information, a credit reporting agency shall comply with subd. 1. no later than 5 business days after an individual provides notice by certified mail or telephone and no later than 3 business days after an individual provides notice by electronic mail.

SB581,7,18 3. No later than 5 business days after the deadline specified in subd. 2., the credit reporting agency shall provide the individual with a unique personal identification number or password for the individual to authorize release of the individual's credit report as described in par. (b).

SB581,7,25 (b) Access authorization. 1. An individual who has provided notice under par. (a) 1. to a credit reporting agency may request the credit reporting agency to release the individual's credit report to a 3rd party upon the 3rd party's request or to any eligible user who requests the credit report during a specified period of time. In making a request, an individual shall provide the credit reporting agency with the unique personal identification number or password described in par. (a) 3. and identify the 3rd party or specify the period of time.

SB581,8,5 2. A credit reporting agency shall establish procedures for individuals to make requests under subd. 1. The procedures shall allow an individual to make a request by certified mail or telephone. The procedures may allow an individual to make a request by electronic mail. A credit reporting agency shall disclose the procedures to individuals who provide notice under par. (a) 1.

SB581,8,8 3. A credit reporting agency shall comply with a request made under subd. 1. no later than 3 business days after the credit reporting agency's receipt of the request.

SB581,8,11 (3) Release of reports. (a) A credit reporting agency may release to 3rd parties and eligible users the credit report of an individual who provides notice under sub. (2) (a) 1. if any of the following apply:

SB581,8,13 1. The individual requests the credit reporting agency to release the credit report to the 3rd party or eligible user under sub. (2) (b).

SB581,8,19 2. The individual provides the credit reporting agency a subsequent written notice by certified mail that rescinds the notice provided under sub. (2) (a) 1. and includes with the notice the unique personal identification number or password described in sub. (2) (a) 3. No later than 3 business days after receipt of the notice, the credit reporting agency shall eliminate the restrictions on access to the individual's credit report that are otherwise required under sub. (2) (a) 1.

SB581,8,23 3. The individual makes a material misrepresentation of fact in a notice under sub. (2) (a) 1., provided that the credit reporting agency notifies the individual in writing about the misrepresentation at least 5 business days before the credit reporting agency releases the credit report to 3rd parties.

SB581,9,3 (b) If a credit reporting agency releases an individual's credit report to a 3rd party to whom the credit reporting agency is not authorized to release the report under par. (a), the credit reporting agency shall, no later than 5 business days after releasing report, notify the individual about the release. The notification shall identify the 3rd party and the information released to the 3rd party.

SB581,9,5 (4) Exceptions. This section does not apply to the credit reports of an individual that a credit reporting agency releases to, or for, any of the following:

SB581,9,9 (a) A person, or subsidiary, affiliate, agent, or assignee of a person, with whom the individual has or, prior to assignment, had an account, contract, or debtor-creditor relationship, for the purpose of account review or collection of a financial obligation owing on the account, contract, or debt.

SB581,9,12 (b) A subsidiary, affiliate, agent, assignee, or prospective assignee of a 3rd party or eligible user to whom the credit reporting agency is allowed to release a credit report under sub. (3) (a).

SB581,9,13 (c) A court, state or local governmental agency, or law enforcement agency.

SB581,9,14 (d) A person acting pursuant to a court order, warrant, or subpoena.

SB581,9,17 (e) The department of workforce development or a county child support agency for the purpose of enforcing support or maintenance obligations owed by the individual.

SB581,9,25 (f) The department of health and family services or the department of workforce development for the purpose of investigating suspected fraudulent activity regarding the Wisconsin works program under ss. 49.141 to 49.161, medical assistance under subch. IV of ch. 49, food stamp benefits under the food stamp program under 7 USC 2011 to 2036, supplemental security income payments under s. 49.77, payments for the support of children of supplemental security income recipients under s. 49.775, or health care benefits under the Badger Care health care program under s. 49.665.

SB581,10,1 (g) The department of revenue for the purpose of collecting delinquent taxes.

SB581,10,3 (h) The use of credit information for the purposes of prescreening as provided under 15 USC 1681b (c).

SB581,10,5 (i) A person administering a credit file monitoring subscription service to which the individual has subscribed.

SB581,10,7 (j) A person for the purpose of providing an individual with a copy of his or her credit report upon the individual's request.

SB581,10,10 (5) Third parties. (a) If a 3rd party requests access to a credit report that a credit reporting agency may not release to the 3rd party under this section, then all of the following apply:

SB581,10,13 1. If the 3rd party's request is in connection with the individual's application to the 3rd party for credit or any other purpose, the 3rd party may treat the application as incomplete.

SB581,10,14 2. The credit reporting agency shall notify the individual about the request.

SB581,10,18 (b) This section does not prohibit a credit reporting agency from advising a 3rd party that an individual has provided a notice under sub. (2) (a) and that the credit reporting agency must obtain the individual's authorization before releasing the individual's credit report.

SB581,10,22 (6) Fees. (a) Except as provided in par. (b), a credit reporting agency may not charge a fee to an individual for providing notice under sub. (2) (a), making a request under sub. (2) (b), rescinding a notice under sub. (3) (a) 2., or taking any other action allowed under this section.

SB581,11,3 (b) If an individual fails to retain the personal identification number or password specified in sub. (2) (a) 3., a credit reporting agency may not charge the individual a fee for reissuing the personal identification number or password or issuing a new personal identification number or password, but the credit reporting agency may charge the individual a fee of no more than $5 for each subsequent reissuance or issuance.

SB581,11,7 (7) Notice. Whenever a consumer reporting agency is required to provide an individual with a notice under 15 USC 1681g regarding consumer rights under the federal credit reporting law, the consumer reporting agency shall also provide the individual with a notice in 12-point type in substantially the following form:

SB581,11,8 RIght to restrict access to credit reports

SB581,11,14 Under Wisconsin law, you may restrict access to your credit report at no charge to protect your privacy and ensure that credit is not granted in your name without your knowledge. Wisconsin law provides this right so that you can prevent credit, loans, and services from being approved in your name without your consent. If you exercise this right, you can prohibit a consumer credit reporting agency from releasing any information in your credit report without your express authorization.

SB581,11,21 If you notify a credit reporting agency that you want to exercise this right, the credit reporting agency must, within 5 business days after receiving the notice, provide you with a personal identification number or password, which you may use for authorizing the release of your credit report to a specific party or to any party for a specified period of time. Within 3 business days after you authorize the release of your credit report, the credit reporting agency must make the report available to the party you specified or for the period of time you specified.

SB581,11,24 The right described above does not apply if a party with whom you have an existing account, contract, or debtor-creditor relationship requests your credit report for certain account review activities.

SB581,12,4 If you are actively seeking credit, you should understand that, if you exercise the right described above, you may delay your applications for credit. You should plan ahead and authorize release of your credit report a few days before you actually apply for credit.

SB581,12,7 If you exercise the right describe above, Wisconsin law allows you to bring a civil action against a credit reporting agency that releases your credit report without your authorization.

SB581,12,8 (8) Enforcement. The division of banking shall enforce this section.

SB581,12,14 (9) Private cause of action. Any person who suffers damages as the result of another person's violation of this section may bring an action against the violator for injunctive relief and to recover the amount of those damages or $10,000 for each violation, whichever is greater. Notwithstanding s. 814.04 (1), in an action under this subsection, the court shall award a prevailing plaintiff reasonable attorney fees and costs of the investigation and litigation.

SB581, s. 4 Section 4. 165.25 (4) (ar) of the statutes is amended to read:

SB581,12,21 165.25 (4) (ar) The department of justice shall furnish all legal services required by the department of agriculture, trade and consumer protection relating to the enforcement of ss. 100.171, 100.173, 100.174, 100.175, 100.177, 100.18, 100.182, 100.20, 100.205, 100.207, 100.209, 100.21, 100.28, 100.37, 100.42, 100.50 and, 100.51, and 100.54, and chs. 126, 136, 344, 704, 707, and 779, together with any other services as are necessarily connected to the legal services.

SB581, s. 5 Section 5. 343.17 (3) (a) 4. of the statutes is amended to read:

SB581,12,24 343.17 (3) (a) 4. A unique identifying driver number assigned by the department, which may not be the person's social security number.

SB581, s. 6 Section 6. 939.646 of the statutes is created to read:

SB581,13,3 939.646 Penalty; identity theft crimes committed against vulnerable persons. (1) If a person does all of the following, the penalties for the underlying crime are increased as provided in sub. (2):

SB581,13,4 (a) Commits a crime under s. 943.201 (2) (a) or (b).

SB581,13,9 (b) Intentionally selects the person against whom the crime under par. (a) is committed because the person is a vulnerable adult, as defined in s. 940.285 (1) (e), has a disability that makes him or her more vulnerable, or appear to be more vulnerable, to a crime under s. 943.201 (2) (a) or (b), is a person who is elderly, or is a person under the age of 18.

SB581,13,12 (2) The maximum fine prescribed by law for the crime is increased by $5,000 and the maximum term of imprisonment prescribed by law for the crime is increased by 5 years.

SB581,13,15 (3) This section provides for the enhancement of the penalties applicable for the underlying crime. The court shall direct that the trier of fact find a special verdict as to all of the issues specified in sub. (1).

SB581, s. 7 Section 7. 942.05 of the statutes is repealed and recreated to read:

SB581,13,17 942.05 Mail theft. (1) In this section:

SB581,13,19 (a) "Mail" means a letter, postal card, package, bag, or other sealed article that is being mailed.

SB581,13,21 (b) "Mail depository" means a mail box, letter box, mail receptacle, post office, a station of a post office, a mail route, or a postal service vehicle.

SB581,13,25 (c) "Person with a claim of right" means a person who owns or rents the mail depository, who has permission from the owner or renter of the mail depository, who is currently working in the line of duty for the postal service, or who is the sender of or the addressee on the mail.

SB581,14,2 (2) Whoever, without a claim of right, does any of the following is guilty of a Class I felony: