SB283: Bill Text

Analysis by the Legislative Reference Bureau

Current law, with certain exceptions, allows an individual to prohibit a consumer reporting agency (credit reporting agency) from releasing the individual's consumer report (credit report) for any purpose related to the extension of credit without the individual's prior authorization. If an individual makes a proper request to a credit reporting agency, provides proper identification, and pays any applicable fee, the credit reporting agency must include a "security freeze" on the individual's credit report. A credit reporting agency may not release an individual's credit report for an extension of credit if the report includes a security freeze. There are various exceptions to these requirements, including credit reporting agencies to which the requirements do not apply and exceptions allowing a credit reporting agency to release an individual's credit report that includes a security freeze for specified purposes or under specified circumstances. Current law also includes procedures for an individual to authorize release of a credit report that includes a security freeze.

Under current law, if a credit report includes a security freeze, the credit reporting agency may not make changes in the report to the individual's name, date of birth, social security number, or address without providing written notice of the change to the individual. A credit reporting agency must remove a security freeze upon an individual's request, but may charge a fee to do so.

This bill allows a "representative" of a "protected individual" to obtain a security freeze on the protected individual's credit report. A "protected individual" is an individual: 1) who is less than 18 years of age (minor); 2) for whom a guardian of the estate or a conservator has been appointed; or 3) who has executed a durable power of attorney. A "representative" is: 1) a parent who has legal custody of a minor, the guardian or legal custodian of a minor, or a person delegated care and custody of a minor; 2) a guardian of the estate or conservator appointed for a protected individual; or 3) an agent of an individual under a durable power of attorney. In general, the same procedures and requirements apply to a representative acting on behalf of a protected individual as apply when an individual acts on his or her own behalf.

Under the bill, if a protected individual does not have a credit report, the representative may request that a credit reporting agency create a record for the protected individual and treat that record in the same manner as a credit report for purposes of placing a security freeze. If a representative of a minor requests a security freeze for the minor, when the minor reaches age 18, the credit reporting agency must remove the security freeze and may thereafter honor requests only from the individual who was formerly a minor, not from the representative. If any other representative makes a request for a security freeze for a protected individual, and the guardianship, conservatorship, or durable power of attorney with respect to the protected individual is terminated, the representative must notify the credit reporting agency. Upon receiving this notice, or if the credit reporting agency's own records show such a termination, the credit reporting agency may not honor requests from the representative and any further requests or actions with respect to the individual who was formerly a protected individual must be made by that individual or, if there is a successor representative, by the successor representative. If there is no successor guardianship, conservatorship, or durable power of attorney, the credit reporting agency must remove the security freeze when the credit reporting agency has information that the guardianship, conservatorship, or durable power of attorney is terminated.

The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:

SB283,1 Section 1. 100.54 (1) (cs), (cv) and (f) of the statutes are created to read:

SB283,3,1 100.54 (1) (cs) "Protected individual" means any of the following:

SB283,3,2 1. An individual who is less than 18 years of age.

SB283,3,4 2. An individual for whom a guardian of the estate, as defined in s. 54.01 (11), or a conservator, as defined in s. 54.01 (3), has been appointed.

SB283,3,6 3. An individual who has executed a durable power of attorney, as defined in s. 244.02 (3).

SB283,3,7 (cv) "Representative" means any of the following:

SB283,3,10 1. A parent who has legal custody of a protected individual described in par. (cs) 1., the guardian or legal custodian of such a protected individual, or a person delegated care and custody of such a protected individual under s. 48.979.

SB283,3,12 2. A guardian of the estate or conservator of a protected individual described in par. (cs) 2.

SB283,3,14 3. An agent of a protected individual described in par. (cs) 3. under a durable power of attorney.

SB283,3,15 (f) "Sufficient proof of a representative's authority" means any of the following:

SB283,3,21 1. A court order granting guardianship or legal custody of a protected individual described in par. (cs) 1. to the representative, a power of attorney under s. 48.979 delegating care and custody of such a protected individual to the representative, or a written, notarized statement signed by the representative that expressly describes the authority of the representative to act on behalf of such a protected individual.

SB283,3,24 2. Letters of guardianship or letters of conservatorship issued to the representative naming the representative as the guardian of the estate or conservator of a protected individual described in par. (cs) 2.

SB283,4,2 3. A durable power of attorney designating the representative as the agent of a protected individual described in par. (cs) 3.

SB283,2 Section 2. 100.54 (2) (a) (intro.) and 2. of the statutes are amended to read:

SB283,4,6 100.54 (2) (a) (intro.) Except as provided in par. (c), a consumer reporting agency shall include a security freeze with an individual's consumer report if the individual or the individual's representative does all of the following:

SB283,4,10 2. Provides the consumer reporting agency with proper identification. If the individual is a protected individual, proper identification is required for both the representative and the protected individual, along with sufficient proof of the representative's authority to act for the protected individual under this section.

SB283,3 Section 3. 100.54 (2) (b) (intro.) and 2. of the statutes are amended to read:

SB283,4,18 100.54 (2) (b) (intro.) No later than 5 business days after an individual or the individual's representative satisfies the requirements under par. (a) 1. to 3., a consumer reporting agency shall include a security freeze with the individual's consumer report. No later than 10 business days after including the security freeze with the consumer report, the consumer reporting agency shall send the individual and, if the individual is a protected individual, the individual's representative a notice that does all of the following:

SB283,4,21 2. Includes a unique personal identification number, password, or other device for the individual or the individual's representative to authorize release of the consumer report.

SB283,4 Section 4. 100.54 (2m) of the statutes is created to read:

SB283,5,10 100.54 (2m) Representative request for creation of record. (a) If a protected individual does not have a consumer report, the individual's representative may request that a consumer reporting agency create a record for the protected individual. Upon receiving the request, the consumer reporting agency shall verify that no consumer report exists for the protected individual by checking for existing files relating to the protected individual's name and social security number and for existing files relating only to the protected individual's social security number. If the request satisfies the requirements in par. (b), the consumer reporting agency shall create the record no later than 5 business days after these requirements are satisfied. For purposes of this section, the consumer reporting agency shall treat the record in the same manner as a consumer report and, after the record is created or simultaneously with the request under this paragraph, the representative may request a security freeze as provided under sub. (2).

SB283,5,12 (b) A representative that makes a request under par. (a) shall do all of the following:

SB283,5,15 1. Send the request by certified mail to an address designated by the consumer reporting agency, or send the request directly to the consumer reporting agency by any other means that the consumer reporting agency may provide.

SB283,5,18 2. Provide the consumer reporting agency with proper identification for both the representative and the protected individual, along with sufficient proof of the representative's authority to act for the protected individual under this section.

SB283,5,20 (c) Paragraph (a) does not apply to a reseller or to any consumer reporting agency identified in sub. (2) (c) 2. or 3.

SB283,5,23 (d) 1. Subject to subd. 2., a consumer reporting agency may not sell or otherwise furnish to any 3rd party information received in connection with a request to create a record under par. (a).

SB283,6,3 2. A consumer reporting agency may use information received in connection with a request to create a record under par. (a) only for security freeze purposes under this section.

SB283,5 Section 5. 100.54 (3) of the statutes is amended to read:

SB283,6,9 100.54 (3) Prohibition. Except as provided in sub. (8), if an individual's consumer report includes a security freeze, a consumer reporting agency may not release the consumer report to any person for any purpose related to the extension of credit unless the individual or the individual's representative gives prior authorization for the release under sub. (4).

SB283,6 Section 6. 100.54 (4) (a) (intro.) and (b) of the statutes are amended to read:

SB283,6,13 100.54 (4) (a) (intro.) An individual whose consumer report includes a security freeze, or the individual's representative, may authorize a consumer reporting agency to release the report by doing all of the following:

SB283,6,23 (b) If an individual or the individual's representative satisfies the requirements under par. (a) 1. to 4., the consumer reporting agency shall release the individual consumer report during the time period specified by the individual or the individual's representative, except that a consumer reporting agency is not required to release a consumer report sooner than 3 business days after the individual or the individual's representative contacts the consumer reporting agency under par. (a) 1. A consumer reporting agency may establish procedures for releasing consumer reports sooner than 3 business days for individuals who satisfy, or whose representatives satisfy, the requirements under par. (a) 1. to 4. by telephone, facsimile, or the Internet, or by use of other electronic media.

SB283,7 Section 7. 100.54 (5) (a), (b) and (c) of the statutes are amended to read:

SB283,7,2 100.54 (5) (a) The individual or the individual's representative authorizes the release under sub. (4).

SB283,7,4 (b) The individual or the individual's representative requests removal of the security freeze under sub. (6).

SB283,7,9 (c) The consumer reporting agency included a security freeze with the consumer report due to a material misrepresentation of fact by the individual or the individual's representative, if the consumer reporting agency notifies the individual or the individual's representative in writing about the misrepresentation before the consumer reporting agency releases the consumer report.

SB283,8 Section 8. 100.54 (6) (a) (intro.) and (b) of the statutes are amended to read:

SB283,7,13 100.54 (6) (a) (intro.) An individual or the individual's representative may request removal of a security freeze included with the individual's consumer report by doing all of the following:

SB283,7,19 (b) If an individual or the individual's representative requests removal of a security freeze under par. (a), the consumer reporting agency shall remove the security freeze from the individual's consumer report no later than 3 business days after the individual or the individual's representative satisfies the requirements under par. (a) 1. to 3. and the consumer reporting agency's release of the report is no longer subject to this section.

SB283,9 Section 9. 100.54 (6) (c) of the statutes is created to read:

SB283,7,25 100.54 (6) (c) 1. When a protected individual described in sub. (1) (cs) 1. attains the age of 18 years according to the consumer reporting agency's records, the consumer reporting agency shall remove from the individual's consumer report any security freeze previously requested by the individual's representative, as described in sub. (1) (cv) 1.

SB283,8,6 2. When a consumer reporting agency has information that the guardianship, conservatorship, or durable power of attorney for a protected individual described in sub. (1) (cs) 2. or 3. is terminated and there is no successor guardianship, conservatorship, or durable power of attorney, the consumer reporting agency shall remove from the individual's consumer report any security freeze previously requested by the individual's representative, as described in sub. (1) (cv) 2. or 3.

SB283,10 Section 10. 100.54 (7) (b) of the statutes is amended to read:

SB283,8,12 100.54 (7) (b) This section does not prohibit a consumer reporting agency from advising a 3rd party that an individual's consumer report includes a security freeze and that the consumer reporting agency must obtain the individual's authorization, or the authorization of the individual's representative, before releasing the individual's consumer report.

SB283,11 Section 11. 100.54 (8) (a) 1. a., (b), (g) and (h) of the statutes are amended to read:

SB283,8,23 100.54 (8) (a) 1. a. A person with whom the individual has, or had prior to assignment, an account or contract, including a demand deposit account; a person to whom the individual issued or is otherwise personally liable on a negotiable instrument; or a person who otherwise has a legitimate business need for the information in connection with a business transaction initiated by the individual or the individual's representative; for the purpose of preventing or investigating potential fraud or theft of identity, reviewing the account, collecting the financial obligation owing for the account, contract, or negotiable instrument, or conducting the business transaction.

SB283,9,2 (b) A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom the consumer reporting agency has released the consumer report during the time period authorized by the individual or the individual's representative under sub. (4).

SB283,9,5 (g) A person administering a credit file monitoring subscription service or similar service to which the individual or the individual's representative has subscribed.

SB283,9,8 (h) A person for the purpose of providing an individual or the individual's representative with a copy of his or her the individual's consumer report upon the individual's request of the individual or the individual's representative.

SB283,12 Section 12. 100.54 (9) of the statutes is amended to read:

SB283,9,14 100.54 (9) Fees. (a) Except as provided in par. (b), a consumer reporting agency may charge an individual or the individual's representative a fee of no more than $10 each time that the individual or the individual's representative requests a security freeze under sub. (2), authorizes release of a consumer report under sub. (4), or requests removal of a security freeze under sub. (6).

SB283,9,21 (b) A consumer reporting agency may not charge a fee to an individual or the individual's representative who submits evidence satisfactory to the consumer reporting agency that the individual or the individual's representative made a report to a law enforcement agency under s. 943.201 (4) regarding the individual's personal identifying information or a personal identifying document. A copy of a law enforcement agency's report under s. 943.201 (4) is considered satisfactory evidence for purposes of this paragraph.

SB283,13 Section 13. 100.54 (9) (c) of the statutes is created to read:

SB283,9,24 100.54 (9) (c) A consumer reporting agency may not charge an individual or the individual's representative a fee in connection with any request under sub. (2m).

SB283,14 Section 14. 100.54 (10) (a) of the statutes is amended to read:

SB283,10,8 100.54 (10) (a) Except as provided in par. (b), if a consumer reporting agency includes a security freeze in an individual's consumer report, the consumer reporting agency may not change the individual's name, date of birth, social security number, or address in the report unless, within 30 business days of changing the information, the consumer reporting agency sends written notice of the change to the individual and, if the individual is a protected individual, to the individual's representative. If the notice concerns a change of address, the consumer reporting agency shall send the notice to both the new and former address.

SB283,15 Section 15. 100.54 (10) (c) of the statutes is created to read:

SB283,10,16 100.54 (10) (c) 1. If a representative described in sub. (1) (cv) 1. makes a request for a security freeze under sub. (2), or a request to create a record under sub. (2m), with respect to a protected individual described in sub. (1) (cs) 1., when the protected individual attains the age of 18 years according to the consumer reporting agency's records, the consumer reporting agency may not honor requests from the representative and any further requests or actions under this section with respect to the individual shall be made by the individual.

SB283,11,2 2. If a representative described in sub. (1) (cv) 2. or 3. makes a request for a security freeze under sub. (2), or a request to create a record under sub. (2m), with respect to a protected individual described in sub. (1) (cs) 2. or 3., and the guardianship, conservatorship, or durable power of attorney is terminated, the representative shall notify the consumer reporting agency. Upon receiving this notice, or if the consumer reporting agency's own records show that the guardianship, conservatorship, or durable power of attorney is terminated, the consumer reporting agency may not honor requests from the representative and any further requests or actions under this section with respect to the protected individual shall be made by the individual or by a successor representative.

SB283,16 Section 16. 100.54 (12) of the statutes is amended to read:

SB283,11,7 100.54 (12) Rules. The department shall promulgate rules specifying what constitutes proper identification for purposes of subs. (2) (a) 2., (2m) (b) 2., (4) (a) 2., and (6) (a) 2. The rules shall be consistent with any requirements under federal credit reporting law pertaining to proper identification.

SB283,17 Section 17 . Nonstatutory provisions.

SB283,11,13 (1) Proposed permanent rules. The department of agriculture, trade and consumer protection shall submit in proposed form the rules required under section 100.54 (12) of the statutes, as affected by this act, to the legislative council staff under section 227.15 (1) of the statutes no later than the first day of the 4th month beginning after the effective date of this subsection.

SB283,11,14 (2) Rule-making exceptions for permanent rules.

SB283,11,18 (a) Notwithstanding section 227.135 (2) of the statutes, the department of agriculture, trade and consumer protection is not required to present the statement of the scope of the rules required under section 100.54 (12) of the statutes, as affected by this act, to the governor for approval.

SB283,11,22 (b) Notwithstanding section 227.185 of the statutes, the department of agriculture, trade and consumer protection is not required to present the rules required under section 100.54 (12) of the statutes, as affected by this act, in final draft form to the governor for approval.

SB283,12,2 (c) Notwithstanding section 227.137 (2) of the statutes, the department of agriculture, trade and consumer protection is not required to prepare an economic impact analysis for the rules required under section 100.54 (12) of the statutes, as affected by this act.

SB283,12,7 (d) Notwithstanding sections 227.14 (2g) and 227.19 (3) (e) of the statutes, the department of agriculture, trade and consumer protection is not required to submit the proposed rules required under section 100.54 (12) of the statutes, as affected by this act, to the small business regulatory review board and is not required to prepare a final regulatory flexibility analysis for those rules.

SB283,12,21 (3) Emergency rules. Using the procedure under section 227.24 of the statutes, the department of agriculture, trade and consumer protection shall promulgate the rules required under section 100.54 (12) of the statutes, as affected by this act, for the period before the effective date of the permanent rules promulgated under section 100.54 (12) of the statutes, as affected by this act, but not to exceed the period authorized under section 227.24 (1) (c) of the statutes, subject to extension under section 227.24 (2) of the statutes. Notwithstanding section 227.24 (1) (a), (2) (b), and (3) of the statutes, the department is not required to provide evidence that promulgating a rule under this subsection as an emergency rule is necessary for the preservation of public peace, health, safety, or welfare and is not required to provide a finding of an emergency for a rule promulgated under this subsection. Notwithstanding section 227.24 (1) (e) 1d. and 1g. of the statutes, the department is not required to prepare a statement of the scope of the rules promulgated under this subsection or present the rules to the governor for approval.

SB283,18 Section 18. Effective dates. This act takes effect on the first day of the 4th month beginning after publication, except as follows:

SB283,12,24 (1) Section 17 of this act takes effect on the day after publication.

SB283,12,25 (End)