MISSISSIPPI LEGISLATURE
2006 Regular Session
To: Business and Financial Institutions
By: Senator(s) Gollott
AN ACT TO AUTHORIZE CONSUMERS TO PLACE A SECURITY FREEZE IN CERTAIN FILES MAINTAINED BY A CREDIT REPORTING AGENCY; TO PROVIDE FOR CERTAIN REQUIREMENTS AND PROCEDURES RELATING TO A SECURITY FREEZE; TO REQUIRE A CREDIT REPORTING AGENCY TO MAKE CERTAIN DISCLOSURES RELATING TO A SECURITY FREEZE; AND FOR RELATED PURPOSES.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MISSISSIPPI:
SECTION 1. (1) As used in this section, the term "security freeze" means a notice that is placed in the file of a consumer at the request of the consumer under subsection (2).
(2) (a) A consumer may place a security freeze in his file with a credit reporting agency by making a request in writing by certified mail to the reporting agency. At the time of the request, the consumer must provide to the reporting agency sufficient identification to establish the identity of the consumer.
(b) A reporting agency shall place a security freeze in the file of a consumer not later than five (5) business days after the reporting agency receives a request from the consumer to place the security freeze in his file.
(c) Not later than ten (10) business days after the placement of the security freeze in the file of the consumer, the reporting agency shall send written confirmation to the consumer of the placement of the security freeze in his file and provide the consumer with:
(i) A unique personal identification number or password, which is not the social security number of the consumer, to be used by the consumer to authorize the temporary release of the consumer report pursuant to subsection (7) or the removal of a security freeze from the file pursuant to subsection (8);
(ii) Information explaining the procedures by which a consumer may contact the reporting agency to authorize the temporary release of his consumer report pursuant to subsection (7) or the removal of a security freeze from his file pursuant to subsection (8); and
(iii) The written disclosure required pursuant to subsection (3).
(d) A consumer may request in writing a replacement personal identification number or password. At the time of the request, the consumer must provide to the reporting agency sufficient identification to establish the identity of the consumer. Not later than ten (10) business days after receiving the request, the reporting agency shall provide the consumer with a new, unique personal identification number or password, which is not the social security number of the consumer, to be used by the consumer instead of the number or password that was provided pursuant to paragraph (c)(i).
(e) Except as otherwise provided in subsections (7), (8) and (9), a reporting agency shall not remove a security freeze placed in the file of a consumer.
(f) The presence of a security freeze in the file of a consumer must not be considered to be an adverse factor in the consumer's credit worthiness, credit standing or credit capacity.
(3) If a consumer requests that a security freeze be placed in his file, a reporting agency shall provide a written disclosure of the rights of the consumer. The written disclosure is sufficient if it is in substantially the following form:
"You have a right to place a security freeze in your file which will prohibit a reporting agency from releasing any information in your file without your express authorization.
A security freeze must be requested in writing by certified mail. The security freeze is designed to prevent a reporting agency from releasing your consumer report without your consent. However, you should be aware that using a security freeze to take control over who is allowed access to the personal and financial information in your file may delay, interfere with or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, insurance, government services or payments, rental housing, employment, investment, license, cellular telephone, utilities, digital signature, Internet credit card transaction or other services, including an extension of credit at point of sale. When you place a security freeze in your file, you will be provided a personal identification number or password to use if you choose to remove the security freeze from your file or to authorize the temporary release of your consumer report for a specific person or period after the security freeze is in place. To provide that authorization, you must contact the reporting agency and provide all the following:
(a) Sufficient identification to verify your identity.
(b) Your personal identification number or password provided by the reporting agency.
(c) A statement that you choose to remove the security freeze from your file or that you authorize the reporting agency to temporarily release your consumer report. If you authorize the temporary release of your consumer report, you must name the person who is to receive your consumer report or the period for which your consumer report must be available. A reporting agency must remove the security freeze from your file or authorize the temporary release of your consumer report not later than 3 business days after receiving the above information.
A security freeze does not apply to certain persons, including a person, or collection agencies acting on behalf of a person, with whom you have an existing account that requests information in your consumer report for the purposes of reviewing or collecting the account."
(4) (a) Except as otherwise provided in this subsection:
(i) A reporting agency may charge a consumer a reasonable fee, not to exceed $10, to place a security freeze in his file.
(ii) After a security freeze has been placed in the file of a consumer, a reporting agency may charge the consumer a reasonable fee:
1. Not to exceed $10, to remove the security freeze from his file pursuant to subsection (8).
2. Not to exceed $10, to temporarily release his consumer report for a specific period pursuant to subsection (7).
3. Not to exceed $10, to temporarily release his consumer report to a specific person pursuant to subsection (7).
(b) A reporting agency may not charge a consumer the fees set forth in paragraph (a) to place a security freeze in his file, to temporarily release his consumer report for a specific period or to a specific person, or to remove a security freeze from his file if the consumer is a victim of identity theft and the consumer submits, at the time the security freeze is requested, a valid copy of a police report, investigative report or complaint which the consumer has filed with a law enforcement agency regarding the unlawful use of the personal information of the consumer by another person.
(c) On January 1 of each year, a reporting agency may increase the fees set forth in paragraph (a) based proportionally on changes to the Consumer Price Index of All Urban Consumers, as determined by the United States Department of Labor, with fractional changes rounded to the nearest 25 cents.
(5) (a) After a security freeze has been placed in the file of a consumer, a reporting agency shall not make any changes to the file of the consumer relating to:
(i) The name of the consumer;
(ii) The date of birth of the consumer;
(iii) The social security number of the consumer; or
(iv) The address of the consumer,
unless the reporting agency sends written confirmation of the change to the consumer not later than 30 calendar days after the change is posted to the file of the consumer.
(b) If the reporting agency changes the address of the consumer, the reporting agency must send written confirmation of the change of address to both the new address and the former address of the consumer.
(c) The provisions of this subsection do not require a reporting agency to send written confirmation to a consumer concerning technical corrections made by the reporting agency to information in the file of the consumer, including, without limitation, technical corrections involving the abbreviation of a name or street, the transposition of numbers or letters, or the misspelling of a word.
(6) (a) Except as otherwise provided in subsections (7) through (10), if a security freeze has been placed in the file of a consumer, a reporting agency shall not provide a consumer report of that consumer to any person.
(b) If, in connection with an application for credit or any other use, a third party requests access to a consumer report on which a security freeze is in effect and the consumer does not allow his consumer report to be accessed for that specific third party or period of time, the third party may treat the application as incomplete.
(7) (a) To authorize the temporary release of a consumer report after a security freeze has been placed in the file of the consumer, the consumer must contact the reporting agency and request that his consumer report be temporarily released to a specific person or for a specific period. At the time of the request, the consumer must provide to the reporting agency:
(i) Sufficient identification to establish the identity of the consumer;
(ii) The personal identification number or password provided by the reporting agency pursuant to subsection (2)(c)(i); and
(iii) Information regarding the specific person or the specific period for which the consumer report must be temporarily released.
(b) A reporting agency that receives a request from a consumer pursuant to paragraph (a) shall, not later than 3 business days after receiving the request, temporarily release the consumer report to the specific person or for the specific period requested by the consumer.
(c) A reporting agency shall develop procedures for a consumer to contact the reporting agency to authorize the temporary release of his consumer report pursuant to paragraph (a). These procedures may include, without limitation, the use of the telephone, facsimile machine, the Internet or other electronic media by a consumer to authorize the temporary release of his consumer report in an expedited manner.
(8) (a) To authorize the removal of a security freeze that has been placed in the file of a consumer, the consumer must contact the reporting agency and request that the security freeze be removed. At the time of the request, the consumer must provide to the reporting agency:
(i) Sufficient identification to establish the identity of the consumer; and
(ii) The personal identification number or password provided by the reporting agency pursuant to subsection (2)(c)(i).
(b) A reporting agency that receives a request from a consumer pursuant to paragraph (a) shall, not later than 3 business days after receiving the request:
(i) Remove the security freeze from the file of the consumer; and
(ii) Send written notice to the consumer that the security freeze has been removed from the file of the consumer.
(c) A reporting agency shall develop procedures for a consumer to contact the reporting agency to authorize the removal of a security freeze pursuant to paragraph (a). These procedures may include, without limitation, the use of a telephone, a facsimile machine, the Internet or other electronic media by a consumer to authorize the removal of a security freeze in an expedited manner.
(9) (a) A reporting agency may remove a security freeze from the file of a consumer if the reporting agency has a reasonable belief that:
(i) The security freeze was placed in the file of the consumer because of a material misrepresentation of fact by the consumer; or
(ii) The consumer placed the security freeze in his file for the purposes of:
1. Committing fraud;
2. Committing any other act prohibited by law; or
3. Aiding and abetting any act prohibited by law.
(b) If a reporting agency intends to remove a security freeze from the file of a consumer pursuant to paragraph (a), the reporting agency shall send written notice to the consumer before removing the security freeze.
(10) Notwithstanding that a security freeze has been placed in the file of a consumer, a reporting agency may release the consumer report of the consumer to:
(a) A person with whom the consumer has an existing business relationship, or the subsidiary, affiliate or agent of that person, for any purpose relating to that business relationship.
(b) A licensed collection agency to which an account of the consumer has been assigned for the purposes of collection.
(c) A person with whom the consumer has an account or contract or to whom the consumer has issued a negotiable instrument, or the subsidiary, affiliate, agent, assignee or prospective assignee of that person, for purposes relating to that account, contract or negotiable instrument.
(d) A person seeking to use information in the file of the consumer for the purposes of prescreening pursuant to the Fair Credit Reporting Act, 15 USCS Sections 1681 et seq.
(e) A subsidiary, affiliate, agent, assignee or prospective assignee of a person to whom access has been granted pursuant to subsection (7) for the purposes of facilitating the extension of credit.
(f) A person seeking to provide the consumer with a copy of the consumer report or the credit score of the consumer upon the request of the consumer.
(g) A person administering a credit file monitoring subscription service to which the consumer has subscribed.
(h) A person requesting the consumer report pursuant to a court order, warrant or subpoena.
(i) A federal, state or local governmental entity, agency or instrumentality that is acting within the scope of its authority, including, without limitation, an agency which is seeking to collect child support payments pursuant to Part D of Title IV of the Social Security Act, 42 USCS Section 651 et seq.
(j) A person holding a license issued by the Mississippi Gaming Commission, or the subsidiary, affiliate, agent, assignee or prospective assignee of that person, for purposes relating to any activities conducted pursuant to the license.
(k) An employer, or the subsidiary, affiliate, agent, assignee or prospective assignee of that employer, for purposes of:
(i) Preemployment screenings relating to the consumer; or
(ii) Decisions or investigations relating to the consumer's current or former employment with the employer.
(11) The following companies are not required to place a security freeze in the file of a consumer:
(a) A check services or fraud prevention services company which issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers or similar methods of payments.
(b) A deposit account information service company which issues reports regarding account closures because of fraud, substantial overdrafts, abuse of automatic teller machines or similar negative information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution.
(c) A reporting agency which acts only as a reseller of credit information by assembling and merging information contained in the database of another reporting agency or in the databases of multiple reporting agencies and which does not maintain a permanent database of consumer credit information from which new consumer reports are produced. Such a reporting agency shall honor any security freeze placed on a consumer report by another reporting agency.
SECTION 2. This act shall take effect and be in force from and after July 1, 2006.