STATE OF NEW YORK
________________________________________________________________________
2746
2019-2020 Regular Sessions
IN ASSEMBLY
January 25, 2019
___________
Introduced by M. of A. SOLAGES -- read once and referred to the Commit-
tee on Consumer Affairs and Protection
AN ACT to amend the general business law, in relation to implementing
provisions to protect credit reports of certain consumers
The People of the State of New York, represented in Senate and Assem-
bly, do enact as follows:
1 Section 1. Subdivision (m) of section 380-a of the general business
2 law, as added by chapter 63 of the laws of 2006, is amended to read as
3 follows:
4 (m) The term "security freeze" or "freeze" means:
5 1. a notice placed in the consumer credit report of or relating to a
6 consumer, at the request of such consumer and subject to certain
7 exceptions, that prohibits the consumer credit reporting agency from
8 releasing the consumer credit report, the contents of such report or the
9 credit score of such consumer[.];
10 2. if a consumer credit reporting agency does not have a file pertain-
11 ing to a protected consumer, a restriction that:
12 a. is placed on the protected consumer's record in accordance with the
13 provisions of this section; and
14 b. prohibits the consumer credit reporting agency from releasing to
15 protected consumer's record except as provided in section three hundred
16 eighty-v of this article; or
17 3. if a consumer credit reporting agency has a file pertaining to the
18 protected consumer, a restriction that:
19 a. is placed on the protected consumer's consumer report in accordance
20 with section three hundred eighty-v of this article; and
21 b. prohibits the consumer credit reporting agency from releasing the
22 protected consumer's consumer credit report or any information derived
23 from the protected consumer's consumer credit report except as provided
24 in section three hundred eighty-v of this article.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD05051-01-9
A. 2746 2
1 § 2. Section 380-a of the general business law is amended by adding
2 five new subdivisions (u), (v), (w), (x) and (y) to read as follows:
3 (u) The term "protected consumer" means an individual who is:
4 1. under the age of sixteen years at the time a request for the place-
5 ment of a security freeze is made; or
6 2. an incapacitated person or a protected person for whom a guardian
7 or conservator has been appointed.
8 (v) The term "record" means a compilation of information that:
9 1. identifies a protected consumer;
10 2. is created by a consumer credit reporting agency solely for the
11 purpose of complying with section three hundred eighty-v of this arti-
12 cle; and
13 3. may not be created or used to consider the protected consumer's
14 credit worthiness, credit standing, credit capacity, character, general
15 reputation, personal characteristics, or mode of living.
16 (w) The term "representative" means a person who provides to a consum-
17 er credit reporting agency sufficient proof of authority to act on
18 behalf of a protected consumer; includes, but is not limited to, a
19 parent or legal guardian.
20 (x) The term "sufficient proof of authority" means documentation that
21 shows a representative has authority to act on behalf of a protected
22 consumer; includes:
23 1. an order issued by a court of law; or
24 2. a lawfully executive and valid power of attorney; or
25 3. a written, notarized statement signed by a representative that
26 expressly describes the authority of the representative to act on behalf
27 of a protected consumer.
28 (y) The term "sufficient proof of identification" means information or
29 documentation that identifies a protected consumer or a representative
30 of a protected consumer; includes:
31 1. a social security number or a copy of a social security card issued
32 by the social security administration;
33 2. a certified or official copy of a birth certificate issued by the
34 entity authorized to issue the birth certificate; or
35 3. a copy of a driver's license, an identification card issued by the
36 department of motor vehicles, or any other government-issued identifica-
37 tion.
38 § 3. Section 380-v of the general business law, as relettered by chap-
39 ter 441 of the laws of 2014, is relettered section 380-w and a new
40 section 380-v is added to read as follows:
41 § 380-v. Protected consumer credit reporting. (a) This section does
42 not apply to the use of a protected consumer's consumer credit report or
43 record by:
44 1. a person administering a credit file monitoring subscription
45 service to which:
46 (i) the protected consumer has subscribed; or
47 (ii) the representative of the protected consumer has subscribed on
48 behalf of the protected consumer;
49 2. a person providing the protected consumer or the protected consum-
50 er's representative with a copy of the protected consumer's consumer
51 credit report on request of the protected consumer or the protected
52 consumer's representative; or
53 3. an entity listed in paragraph one, two, three, four, five or six of
54 subdivision (m) of section three hundred eighty-t of this article.
55 (b) 1. A consumer reporting agency shall place a security freeze for a
56 protected consumer if:
A. 2746 3
1 (i) the consumer credit reporting agency receives a request from the
2 protected consumer's representative for the placement of the security
3 freeze under this section; and
4 (ii) the protected consumer's representative:
5 (A) submits the request to the consumer credit reporting agency at the
6 address or other point of contact and in the manner specified under
7 subdivision (a) of this section;
8 (B) provides to the consumer credit reporting agency sufficient proof
9 of identification of the consumer and the representative;
10 (C) provides to the consumer credit reporting agency sufficient proof
11 of authority to act on behalf of the protected consumer; and
12 (D) pays to the consumer credit reporting agency a fee as provided in
13 subdivision (h) of this section.
14 2. If a consumer credit reporting agency does not have a file pertain-
15 ing to a protected consumer when the consumer credit reporting agency
16 receives a request under paragraph one of this subdivision, the consumer
17 credit reporting agency shall create a record for the protected consum-
18 er.
19 (c) 1. Within thirty days after receiving a request that meets the
20 requirements of paragraph one of subdivision (b) of this section, a
21 consumer credit reporting agency shall place a security freeze for the
22 protected consumer.
23 2. The consumer credit reporting agency shall send a written confirma-
24 tion of the placement of the security freeze to a protected customer's
25 representative within five business days of placing such freeze.
26 (d) Unless a security freeze for a protected consumer is removed in
27 accordance with subdivision (f) or (i) of this section, a consumer cred-
28 it reporting agency may not release the protected consumer's consumer
29 credit report, any information derived from the protected consumer's
30 consumer credit report, or any record created for the protected consum-
31 er.
32 (e) A security freeze for a protected consumer placed under subdivi-
33 sion (c) of this section shall remain in effect until:
34 1. the protected consumer or the protected consumer's representative
35 requests the consumer credit reporting agency to remove the security
36 freeze in accordance with subdivision (f) of this section; or
37 2. the security freeze is removed in accordance with subdivision (i)
38 of this section.
39 (f) If a protected consumer or a protected consumer's representative
40 wishes to remove a security freeze for the protected consumer, the
41 protected consumer or the protected consumer's representative shall:
42 1. submit a request for the removal of the security freeze to the
43 consumer credit reporting agency at the address or other point of
44 contact and in the manner specified by the consumer credit reporting
45 agency;
46 2. provide to the consumer credit reporting agency:
47 (i) in the case of a request by the protected consumer:
48 (A) proof that the sufficient proof of authority for the protected
49 consumer's representative to act on behalf of the protected consumer is
50 no longer valid; and
51 (B) sufficient proof of identification of the protected consumer; or
52 (ii) in the case of a request by the representative of a protected
53 consumer:
54 (A) sufficient proof of identification of the protected consumer and
55 the representative; and
A. 2746 4
1 (B) sufficient proof of authority to act on behalf of the protected
2 consumer; and
3 (C) pay to the consumer credit reporting agency a fee as provided in
4 subdivision (h) of this section.
5 (g) Within thirty days after receiving a request that meets the
6 requirements of subdivision (f) of this section, the consumer credit
7 reporting agency shall remove the security freeze for the protected
8 consumer.
9 (h) 1. Except as provided in paragraph two of this subdivision, a
10 consumer credit reporting agency may not charge a fee for any service
11 performed under this section.
12 2. A consumer credit reporting agency may charge a reasonable fee, not
13 exceeding five dollars, for each placement or removal of a security
14 freeze for a protected consumer.
15 3. Notwithstanding the provisions of paragraph two of this subdivi-
16 sion, a consumer credit reporting agency may not charge any fee under
17 this section if the protected consumer's representative:
18 (i) has obtained a report of alleged identity fraud against the
19 protected consumer; and
20 (ii) provides a copy of the report to the consumer credit reporting
21 agency.
22 (i) A consumer credit reporting agency may remove a security freeze
23 for a protected consumer or delete a record of a protected consumer if
24 the security freeze was placed or the record was created based on a
25 material misrepresentation of fact by the protected consumer or the
26 protected consumer's representative.
27 (j) When a consumer credit reporting agency erroneously releases a
28 protected consumer's consumer credit report subject to a security freeze
29 or any information contained in such consumer credit report, the consum-
30 er credit reporting agency shall send written notification to the
31 affected protected consumer's representative within three business days
32 following discovery or notification of such erroneous release. Such
33 notification shall also inform the protected consumer of the nature of
34 the information released and identify and provide contact information
35 for the recipient of such information or consumer credit report.
36 (k) Whenever there shall be a violation of this section, application
37 may be made by the attorney general in the name of the people of the
38 state of New York to a court or justice having jurisdiction by a special
39 proceeding to issue an injunction, and upon notice to the defendant of
40 not less than five days, to enjoin and restrain the continuance of such
41 violations; and if it shall appear to the satisfaction of the court or
42 justice that the defendant has, in fact, violated this section, an
43 injunction may be issued by such court or justice, enjoining and
44 restraining any further violation, without requiring proof that any
45 person has, in fact, been injured or damaged thereby. In any such
46 proceeding, the court may make allowances to the attorney general as
47 provided in paragraph six of subdivision (a) of section eighty-three
48 hundred three of the civil practice law and rules, and direct restitu-
49 tion. Whenever the court shall determine that a violation of this
50 section has occurred, the court may impose a civil penalty of not more
51 than five thousand dollars for each violation. In connection with any
52 such proposed application, the attorney general is authorized to take
53 proof and make a determination of the relevant facts and to issue
54 subpoenas in accordance with the civil practice law and rules.
55 § 4. This act shall take effect on the ninetieth day after it shall
56 have become a law.