2007 Montana Legislature

SENATE BILL NO. 116

INTRODUCED BY J. BRUEGGEMAN, J. KEANE, D. GALLIK, D. STEINBEISSER, K. HANSEN, M. MILBURN, T. MCGILLVRAY, V. COCCHIARELLA, LIND

BY REQUEST OF THE ECONOMIC AFFAIRS INTERIM COMMITTEE

AN ACT PROVIDING IDENTITY THEFT PROTECTION; ALLOWING CONSUMERS TO LIMIT ACCESS TO THEIR OWN CREDIT REPORTS; REQUIRING IMPLEMENTATION PROCEDURES FOR CONSUMER REPORTING AGENCIES; PROVIDING FOR TEMPORARY LIFTING OF SECURITY FREEZES; REQUIRING NOTICES TO CONSUMERS ABOUT THE OPTION FOR A SECURITY FREEZE; PROVIDING EXEMPTIONS AND EXCEPTIONS; SETTING FEES; PROVIDING PENALTIES; AND PROVIDING AN EFFECTIVE DATE.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MONTANA:

Section 1. Definitions. As used in [sections 1 through 11], the following definitions apply:

(1) "Consumer" means an individual.

(2) "Consumer reporting agency" means any person that, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information on consumers for the purpose of furnishing credit reports to a third party and that uses any means or facility of interstate commerce for the purpose of preparing or furnishing credit reports.

(3) "Credit report" means any written, oral, or other communication of any information by a consumer reporting agency:

(a) bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living; and

(b) that is used or expected to be used in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for:

(i) credit to be used primarily for personal, family, or household purposes;

(ii) employment purposes; or

(iii) any other purpose authorized under 15 U.S.C. 1681(b).

(4) "Person" means an individual, partnership, corporation, trust, estate, cooperative, association, government or governmental subdivision or agency, or other entity.

(5) "Proper identification" means information sufficient to verify identity.

(6) "Reviewing the account" or "account review" includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.

(7) (a) "Security freeze" means a notice that:

(i) is placed in a consumer's credit report at the request of the consumer;

(ii) is subject to exceptions and exemptions provided in [section 9];

(iii) prohibits the consumer reporting agency from releasing all or any part of the consumer's credit report or credit score without the express authorization of the consumer, as provided in [section 4].

(b) A security freeze does not prevent a consumer reporting agency from advising a third party that a security freeze is in effect with respect to the consumer's credit report.

Section 2. Placement of security freeze. A consumer may elect to place a security freeze on the consumer's own credit report by making a request:

(1) in writing by regular or certified mail to a consumer reporting agency at an address designated by the consumer reporting agency to receive the request; or

(2) directly to the consumer reporting agency through a secure electronic connection specified by the consumer reporting agency by January 31, 2009.

Section 3. Consumer reporting agency requirements. (1) Except as provided in subsection (2), a consumer reporting agency shall place a security freeze on a consumer's credit report no later than 5 business days after receiving from the consumer:

(a) a written or electronic request, as provided in [section 2];

(b) proper identification; and

(2) If a consumer who has been the victim of identity theft, as prescribed by 45-6-332, requests a security freeze, the consumer reporting agency shall place a security freeze on the consumer's credit report no later than 24 hours after receiving notice as provided in [section 2] and a valid police report, investigative report, or complaint that the consumer has filed with a law enforcement agency.

(3) The consumer reporting agency shall send a written confirmation of the security freeze to the consumer within 5 business days of placing the security freeze and at the same time shall provide the consumer with a unique personal identification number, password, or similar device to be used by the consumer when providing authorization for a release of the consumer's credit for a specific party or period of time, as provided in [section 4].

(4) A consumer reporting agency may not suggest or otherwise state or imply to a third party that the consumer's security freeze reflects a negative credit score, history, report, or rating.

Section 4. Temporary lifting of security freeze -- consumer requirements -- consumer reporting agency duties -- notification. (1) A consumer who wishes to allow access to the consumer's own credit report by a specific party or for a specific period of time while a security freeze is in place shall contact each consumer reporting agency, using a point of contact designated by the consumer reporting agency by regular or certified mail, telephone, or a secure electronic connection, request that the security freeze be temporarily lifted, and provide all of the following:

(a) proper identification;

(b) the unique personal identification number, password, or device provided by the consumer reporting agency pursuant to [section 3(3)];

(c) the proper information regarding the third party who is to receive the credit report or the time period for which the credit report is to be available to users of the credit report; and

(d) a fee, if applicable.

(2) (a) Except as provided in subsection (2)(b), a consumer reporting agency that receives a request from a consumer to temporarily lift a security freeze on a credit report as provided in subsection (1) shall comply with the request no later than 3 business days after receiving the request.

(b) By no later than January 31, 2009, a consumer reporting agency shall honor a request for the temporary lifting of a security freeze made by telephone or through a secure electronic connection designated by the consumer reporting agency within 15 minutes of receiving the request unless one of the following circumstances applies:

(i) the consumer fails to meet the requirements of subsections (1)(a) through (1)(c); or

(ii) the consumer reporting agency's ability to remove the security freeze within 15 minutes is prevented by:

(A) a natural disaster or act of God, including fire, earthquake, or hurricane;

(B) unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, or a labor strike or similar labor dispute disrupting operations;

(C) operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, or computer hardware or software failures inhibiting response time;

(D) governmental action, including emergency orders or regulations or judicial or law enforcement action;

(E) receipt of a removal request outside of normal business hours; or

(F) maintenance of, updates to, or repair of the consumer reporting agency's systems, whether regularly scheduled or unexpected or unscheduled.

(c) For the purposes of this section, "normal business hours" means from 6 a.m. to 9:30 p.m., mountain standard time or mountain daylight time, seven days a week, excluding holidays.

(3) A consumer reporting agency shall:

(a) designate the contact address and telephone number along with a telefax number or appropriate electronic access address when providing the unique personal identification number, password, or other device as provided in [section 3(3)]; and

(b) develop procedures to implement this section by January 31, 2009, involving the use of telephone, telefax, or electronic connection, using a process for legally required notices provided for in the Electronic Signatures in Global and National Commerce Act, 15 U.S.C. 7001.

(4) Only the attorney general may enforce the provisions of this section related to a failure to comply with the 15-minute requirement for the temporary lifting of a security freeze.

Section 5. Consumer reporting agency security freeze removal procedures -- notification. (1) A consumer reporting agency shall remove or temporarily lift a security freeze placed on a credit report:

(a) upon the consumer's request pursuant to [section 4] or [section 7]; or

(b) if the consumer reporting agency determines that the consumer made a material misrepresentation of fact when requesting the security freeze.

(2) When a consumer reporting agency removes a security freeze as provided in subsection (1)(b), the consumer reporting agency shall notify the consumer in writing at least 5 business days prior to removing the security freeze on the credit report.

Section 6. Third-party contacts. If a third party not enumerated in [section 9(1)] requests for the purpose of an application access to a credit report on which a security freeze is in effect and the consumer has not provided a temporary lifting of a security freeze for that specific party or a period of time, the third party may treat the application as incomplete.

Section 7. Security freeze removal procedure. (1) A security freeze must remain in place until the consumer requests that the security freeze be removed or temporarily lifted as provided in [section 4].

(2) After receiving a request from the consumer to remove a security freeze, a consumer reporting agency shall remove the security freeze within 3 business days of receiving a removal request at the point of contact designated by the consumer reporting agency if the consumer provides the following:

(a) proper identification; and

(b) the unique personal identification number, password, or other device provided by the consumer reporting agency pursuant to [section 3(3)].

Section 8. Notice of rights. A consumer reporting agency shall provide a notice of rights as stated below at any time that a consumer is required to receive a summary of rights required under 15 U.S.C. 1681(g) of the Fair Credit Reporting Act.

NOTICE OF RIGHTS: Montana Consumers Have the Right to Obtain a Security Freeze

You may obtain a security freeze on your credit report to protect your privacy and ensure that credit is not granted in your name without your knowledge. You have a right to place a security freeze on your credit report pursuant to Montana law.

The security freeze will prohibit a consumer reporting agency from releasing any information in your credit report without your express authorization or approval.

The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. When you place a security freeze on your credit report, within 5 business days you will be provided a personal identification number, password, or other device to use if you choose to remove the security freeze on your credit report or to temporarily authorize the release of your credit report for a specific party, parties, or period of time after the security freeze is in place. To provide that authorization, you shall contact the consumer reporting agency and provide all of the following:

(1) the unique personal identification number, password, or other device provided by the consumer reporting agency;

(2) the proper identification to verify your identity;

(3) the proper information regarding the third party or parties who are to receive the credit report or the period of time for which the credit report is to be available to users of the credit report; and

(4) a fee, if applicable.

A consumer reporting agency that receives a request from a consumer to temporarily lift a security freeze on a credit report shall comply no later than 3 business days after receiving the request or, after January 31, 2009, within 15 minutes of receiving a request by telephone or through a secure electronic connection.

A security freeze does not apply to circumstances in which you have an existing account relationship and a copy of your credit report is requested by your existing creditor or its agents or affiliates for certain types of account review, collection, fraud control, or similar activities.

You have a right to bring a civil action against someone who violates your rights under the credit reporting laws. The action may be brought against a consumer reporting agency or a user of your credit report.

Section 9. Exceptions -- exemptions. (1) The provisions of [sections 1 through 8] and [section 10] do not apply to the following for the purposes of accessing or using a credit report:

(a) a person or the person's subsidiary, affiliate, agent, or assignee with which the consumer has, or prior to assignment had, an account, contract, or debtor-creditor relationship when using a credit report for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or debt;

(b) a subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted to a credit report under [section 4] for purposes of facilitating the extension of credit or other permissible use;

(d) any federal, state, or local agency that administers a program for establishing and enforcing child support obligations;

(e) any federal, state, or local agency or its agents or assigns acting to investigate fraud;

(f) any federal, state, or local agency or its agents or assigns acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities;

(g) a person for use of a credit report for the purpose of prescreening as described by the Fair Credit Reporting Act, 15 U.S.C. 1681, et seq.;

(h) a person or entity administering a credit file monitoring subscription or similar service to which the consumer has subscribed;

(i) a person or entity for the purpose of providing a consumer with a copy of the consumer's own credit report or score and upon the consumer's request;

(j) a person or entity regulated under Title 33; or

(k) a consumer reporting agency for its database or file that consists entirely of information concerning, and used solely for, one or more of the following: criminal record information, tenant screening, employment screening, fraud prevention or detection, or personal loss history information.

(2) The following entities are exempt from placing a security freeze on a credit report:

(a) a check services company or fraud prevention services company that issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic fund transfers, or similar methods of payments;

(b) a deposit account information service company that issues reports regarding account closures because of fraud, substantial overdrafts, ATM abuse, or similar negative information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution; or

(c) a consumer reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or multiple consumer reporting agencies and that does not maintain a permanent database of credit information from which new credit reports are produced. However, a consumer reporting agency acting as a reseller shall honor any security freeze placed on a credit report by another consumer reporting agency.

Section 10. Fees. (1) Except as provided in subsection (2), a consumer reporting agency may charge an administrative fee, not to exceed $3, to a consumer for each security freeze or temporary lifting of a security freeze as provided in [section 4], but not for removal of a security freeze as provided in [section 7].

(2) A consumer reporting agency may not charge a fee under [section 3] to a consumer who has been the victim of identity theft and who has submitted to the consumer reporting agency a valid police report, an investigative report, or complaint that the consumer has filed with a law enforcement agency.

(3) A consumer may be charged a reasonable fee, not to exceed $5, if the consumer fails to retain the original personal identification number, password, or other device provided by the consumer reporting agency and if the consumer asks the consumer reporting agency to reissue the same or a new personal identification number, password, or other device.

Section 11. Violations -- penalties. (1) A person who willfully fails to comply with any requirements imposed in [sections 2 through 10] with respect to a consumer is liable to that consumer in an amount equal to the sum of:

(a) any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000; or

(b) punitive damages in an amount that the court may allow; and

(c) the costs of the action together with reasonable attorney fees as determined by the court in the case of a successful action to enforce liability under this section.

(2) A person who obtains a credit report or requests a security freeze, the temporary lifting of a security freeze, or the removal of a security freeze from a consumer reporting agency under false pretenses or in an attempt to violate federal or state law is liable to the consumer reporting agency for actual damages sustained by the consumer reporting agency or $1,000, whichever is greater.

(3) A person who negligently fails to comply with any requirement imposed in [sections 2 through 10] with respect to any consumer is liable to that consumer in an amount equal to the sum of:

(a) any actual damages sustained by the consumer as a result of the failure; and

(b) the costs of the action together with reasonable attorney fees as determined by the court in the case of a successful action to enforce liability under this section.

(4) If a court finds that an unsuccessful pleading, motion, or other paper filed under this section was filed in bad faith or for purposes of harassment, the court shall award to the prevailing party reasonable attorney fees as determined by the court.

Section 12. Severability. If a part of [this act] is invalid, all valid parts that are severable from the invalid part remain in effect. If a part of [this act] is invalid in one or more of its applications, the part remains in effect in all valid applications that are severable from the invalid applications.

Section 13. Codification instruction. [Sections 1 through 11] are intended to be codified as an integral part of Title 30, chapter 14, part 17, and the provisions of Title 30, chapter 14, part 17, apply to [sections 1 through 11].

Section 14. Effective date. [This act] is effective July 1, 2007.

- END -

Latest Version of SB 116 (SB0116.ENR)
Processed for the Web on March 28, 2007 (3:52pm)

New language in a bill appears underlined, deleted material appears stricken.

Sponsor names are handwritten on introduced bills, hence do not appear on the bill until it is reprinted.

See the status of this bill for the bill's primary sponsor.

Status of this Bill | 2007 Legislature | Leg. Branch Home
All versions of this bill (PDF format)
Authorized print version w/line numbers (PDF format)
[ NEW SEARCH ]

Prepared by Montana Legislative Services
(406) 444-3064