| ||||||||||||||||||||
| ||||||||||||||||||||
| ||||||||||||||||||||
| ||||||||||||||||||||
| ||||||||||||||||||||
1 | AN ACT concerning business.
| |||||||||||||||||||
2 | Be it enacted by the People of the State of Illinois,
| |||||||||||||||||||
3 | represented in the General Assembly:
| |||||||||||||||||||
4 | Section 5. The Consumer Fraud and Deceptive Business | |||||||||||||||||||
5 | Practices Act is amended by changing Section 2MM as follows:
| |||||||||||||||||||
6 | (815 ILCS 505/2MM)
| |||||||||||||||||||
7 | Sec. 2MM. Verification of accuracy of consumer reporting | |||||||||||||||||||
8 | information used to
extend consumers credit and security freeze | |||||||||||||||||||
9 | on credit reports. | |||||||||||||||||||
10 | (a) A credit card issuer who mails an offer or solicitation | |||||||||||||||||||
11 | to apply for a
credit card and who receives a completed | |||||||||||||||||||
12 | application in response to the offer
or
solicitation which | |||||||||||||||||||
13 | lists an address that is not substantially the same as the
| |||||||||||||||||||
14 | address on the offer or solicitation may not issue a credit | |||||||||||||||||||
15 | card based on that
application until reasonable steps have been | |||||||||||||||||||
16 | taken to verify the applicant's
change of address.
| |||||||||||||||||||
17 | (b) Any person who uses a consumer credit report in | |||||||||||||||||||
18 | connection with the
approval of credit based on the application | |||||||||||||||||||
19 | for an extension of credit, and who
has received notification | |||||||||||||||||||
20 | of a police report filed with a consumer reporting
agency that | |||||||||||||||||||
21 | the applicant has been a victim of financial
identity theft, as | |||||||||||||||||||
22 | defined in Section 16-30 or 16G-15 of the Criminal Code of 1961 | |||||||||||||||||||
23 | or the Criminal Code of 2012, may
not lend money or extend |
| |||||||
| |||||||
1 | credit without taking reasonable steps to verify the
consumer's | ||||||
2 | identity and confirm that the application for an extension of
| ||||||
3 | credit
is not the result of financial identity theft.
| ||||||
4 | (c) A consumer may request that a security freeze be placed | ||||||
5 | on his or her credit report by sending a request in writing by | ||||||
6 | certified mail or by at least one of telephone or electronic | ||||||
7 | means to a consumer reporting agency at an address or telephone | ||||||
8 | or electronic location designated by the consumer reporting | ||||||
9 | agency to receive such requests. | ||||||
10 | The following persons may request that a security freeze be | ||||||
11 | placed on the credit report of a person with a disability: | ||||||
12 | (1) a guardian of the person with a disability who is | ||||||
13 | the subject of the request, appointed under Article XIa of | ||||||
14 | the Probate Act of 1975; and | ||||||
15 | (2) an agent of the person with a disability who is the | ||||||
16 | subject of the request, under a written durable power of | ||||||
17 | attorney that complies with the Illinois Power of Attorney | ||||||
18 | Act. | ||||||
19 | The following persons may request that a security freeze be | ||||||
20 | placed on the credit report of a minor: | ||||||
21 | (1) a guardian of the minor who is the subject of the | ||||||
22 | request, appointed under Article XI of the Probate Act of | ||||||
23 | 1975; | ||||||
24 | (2) a parent of the minor who is the subject of the | ||||||
25 | request; and | ||||||
26 | (3) a guardian appointed under the Juvenile Court Act |
| |||||||
| |||||||
1 | of 1987 for a minor under the age of 18 who is the subject | ||||||
2 | of the request or, with a court order authorizing the | ||||||
3 | guardian consent power, for a youth who is the subject of | ||||||
4 | the request who has attained the age of 18, but who is | ||||||
5 | under the age of 21. | ||||||
6 | This subsection (c) does not prevent a consumer reporting | ||||||
7 | agency from advising a third party that a security freeze is in | ||||||
8 | effect with respect to the consumer's credit report.
| ||||||
9 | (d) A consumer reporting agency shall place a security | ||||||
10 | freeze on a consumer's credit report no later than 5 business | ||||||
11 | days after receiving a written request from the consumer:
| ||||||
12 | (1) a written request described in subsection (c); and | ||||||
13 | (2) proper identification. | ||||||
14 | (e) Upon placing the security freeze on the consumer's | ||||||
15 | credit report, the consumer reporting agency shall send to the | ||||||
16 | consumer within 10 business days a written confirmation of the | ||||||
17 | placement of the security freeze and a unique personal | ||||||
18 | identification number or password or similar device, other than | ||||||
19 | the consumer's Social Security number, to be used by the | ||||||
20 | consumer when providing authorization for the release of his or | ||||||
21 | her credit report for a specific party or period of time.
| ||||||
22 | (f) If the consumer wishes to allow his or her credit | ||||||
23 | report to be accessed for a specific party or period of time | ||||||
24 | while a freeze is in place, he or she shall contact the | ||||||
25 | consumer reporting agency using a point of contact designated | ||||||
26 | by the consumer reporting agency, request that the freeze be |
| |||||||
| |||||||
1 | temporarily lifted, and provide the following:
| ||||||
2 | (1) proper identification;
| ||||||
3 | (2) the unique personal identification number or | ||||||
4 | password or similar device provided by the consumer | ||||||
5 | reporting agency;
and | ||||||
6 | (3) the proper information regarding the third party or | ||||||
7 | time period for which the report shall be available to | ||||||
8 | users of the credit report.
| ||||||
9 | A security freeze for a minor may not be temporarily | ||||||
10 | lifted. This Section does not require a consumer reporting | ||||||
11 | agency to provide to a minor or a parent or guardian of a minor | ||||||
12 | on behalf of the minor a unique personal identification number, | ||||||
13 | password, or similar device provided by the consumer reporting | ||||||
14 | agency for the minor, or parent or guardian of the minor, to | ||||||
15 | use to authorize the consumer reporting agency to release | ||||||
16 | information from a minor. | ||||||
17 | (f-5) The following persons may request that a security | ||||||
18 | freeze be placed on the credit file of a minor: | ||||||
19 | (1) a parent of the minor who is the subject of the | ||||||
20 | request; | ||||||
21 | (2) a guardian, appointed under Article XI of the | ||||||
22 | Probate Act of 1975, of the minor who is the subject of the | ||||||
23 | request; and | ||||||
24 | (3) a guardian, appointed under the Juvenile Court Act | ||||||
25 | of 1987, of a minor under the age of 18 who is the subject | ||||||
26 | of the request or, with a court order authorizing the |
| |||||||
| |||||||
1 | guardian's consent power, of a youth who is the subject of | ||||||
2 | the request who has attained the age of 18, but who is | ||||||
3 | under the age of 21. | ||||||
4 | (f-10) A request under subsection (f-5) must be in writing | ||||||
5 | and must contain: | ||||||
6 | (1) The following information with respect to the | ||||||
7 | parent or guardian: | ||||||
8 | (A) complete name, including any suffix; | ||||||
9 | (B) a complete address; | ||||||
10 | (C) a copy of the person's social security card or | ||||||
11 | a certified or official copy of the person's birth | ||||||
12 | certificate; and | ||||||
13 | (D) a copy of the person's driver's license, | ||||||
14 | identification card issued by the Secretary of State or | ||||||
15 | any other government-issued identification, or a copy | ||||||
16 | of a utility bill that shows name and home address. | ||||||
17 | (2) The following information with respect to the | ||||||
18 | protected consumer or minor who is
the subject of the | ||||||
19 | freeze: | ||||||
20 | (A) complete name, including any suffix; | ||||||
21 | (B) a complete address; | ||||||
22 | (C) a copy of a social security card; | ||||||
23 | (D) for a minor, a certified or official copy of | ||||||
24 | the minor's birth certificate; and | ||||||
25 | (E) for a person under guardianship or power of | ||||||
26 | attorney, an order issued by a court of law, a lawfully |
| |||||||
| |||||||
1 | executed and valid power of attorney, or a written, | ||||||
2 | signed, and notarized statement that expressly | ||||||
3 | describes the authority of the person making the | ||||||
4 | request to act on behalf of the protected consumer. | ||||||
5 | A security freeze on a credit file for a minor may not be | ||||||
6 | temporarily lifted. | ||||||
7 | (g) A consumer reporting agency shall develop a contact | ||||||
8 | method to receive and process a request from a consumer to | ||||||
9 | temporarily lift a freeze on a credit report pursuant to | ||||||
10 | subsection (f) in an expedited manner.
| ||||||
11 | A contact method under this subsection shall include:
(i) a | ||||||
12 | postal address; and (ii) an electronic contact method chosen by | ||||||
13 | the consumer reporting agency, which may include the use of | ||||||
14 | telephone, fax, Internet, or other electronic means.
| ||||||
15 | (h) A consumer reporting agency that receives a request | ||||||
16 | from a consumer to temporarily lift a freeze on a credit report | ||||||
17 | pursuant to subsection (f), shall comply with the request no | ||||||
18 | later than 3 business days after receiving the request.
| ||||||
19 | (i) A consumer reporting agency shall remove or temporarily | ||||||
20 | lift a freeze placed on a consumer's credit report only in the | ||||||
21 | following cases:
| ||||||
22 | (1) upon consumer request, pursuant to subsection (f) | ||||||
23 | or subsection (l) of this Section; or
| ||||||
24 | (2) if the consumer's credit report was frozen due to a | ||||||
25 | material misrepresentation of fact by the consumer.
| ||||||
26 | If a consumer reporting agency intends to remove a freeze |
| |||||||
| |||||||
1 | upon a consumer's credit report pursuant to this subsection, | ||||||
2 | the consumer reporting agency shall notify the consumer in | ||||||
3 | writing prior to removing the freeze on the consumer's credit | ||||||
4 | report.
| ||||||
5 | (j) If a third party requests access to a credit report on | ||||||
6 | which a security freeze is in effect, and this request is in | ||||||
7 | connection with an application for credit or any other use, and | ||||||
8 | the consumer does not allow his or her credit report to be | ||||||
9 | accessed for that specific party or period of time, the third | ||||||
10 | party may treat the application as incomplete.
| ||||||
11 | (k) If a consumer requests a security freeze, the credit | ||||||
12 | reporting agency shall disclose to the consumer the process of | ||||||
13 | placing and temporarily lifting a security freeze, and the | ||||||
14 | process for allowing access to information from the consumer's | ||||||
15 | credit report for a specific party or period of time while the | ||||||
16 | freeze is in place.
| ||||||
17 | (l) A security freeze shall remain in place until the | ||||||
18 | consumer or person authorized under subsection (c) to act on | ||||||
19 | behalf of the minor or person with a disability who is the | ||||||
20 | subject of the security freeze requests, using a point of | ||||||
21 | contact designated by the consumer reporting agency, that the | ||||||
22 | security freeze be removed. A credit reporting agency shall | ||||||
23 | remove a security freeze within 3 business days of receiving a | ||||||
24 | request for removal from the consumer, who provides:
| ||||||
25 | (1) proper identification;
and | ||||||
26 | (2) the unique personal identification number or |
| |||||||
| |||||||
1 | password or similar device provided by the consumer | ||||||
2 | reporting agency.
| ||||||
3 | (m) A consumer reporting agency shall require proper | ||||||
4 | identification of the person making a request to place or | ||||||
5 | remove a security freeze and may require proper identification | ||||||
6 | and proper authority from the person making the request to | ||||||
7 | place or remove a freeze on behalf of the person with a | ||||||
8 | disability or minor.
| ||||||
9 | (n) The provisions of subsections (c) through (m) of this | ||||||
10 | Section do not apply to the use of a consumer credit report by | ||||||
11 | any of the following:
| ||||||
12 | (1) A person or entity, or a subsidiary, affiliate, or | ||||||
13 | agent of that person or entity, or an assignee of a | ||||||
14 | financial obligation owing by the consumer to that person | ||||||
15 | or entity, or a prospective assignee of a financial | ||||||
16 | obligation owing by the consumer to that person or entity | ||||||
17 | in conjunction with the proposed purchase of the financial | ||||||
18 | obligation, with which the consumer has or had prior to | ||||||
19 | assignment an account or contract, including a demand | ||||||
20 | deposit account, or to whom the consumer issued a | ||||||
21 | negotiable instrument, for the purposes of reviewing the | ||||||
22 | account or collecting the financial obligation owing for | ||||||
23 | the account, contract, or negotiable instrument. For | ||||||
24 | purposes of this subsection, "reviewing the account" | ||||||
25 | includes activities related to account maintenance, | ||||||
26 | monitoring, credit line increases, and account upgrades |
| |||||||
| |||||||
1 | and enhancements.
| ||||||
2 | (2) A subsidiary, affiliate, agent, assignee, or | ||||||
3 | prospective assignee of a person to whom access has been | ||||||
4 | granted under subsection (f) of this Section for purposes | ||||||
5 | of facilitating the extension of credit or other | ||||||
6 | permissible use.
| ||||||
7 | (3) Any state or local agency, law enforcement agency, | ||||||
8 | trial court, or private collection agency acting pursuant | ||||||
9 | to a court order, warrant, or subpoena.
| ||||||
10 | (4) A child support agency acting pursuant to Title | ||||||
11 | IV-D of the Social Security Act.
| ||||||
12 | (5) The State or its agents or assigns acting to | ||||||
13 | investigate fraud.
| ||||||
14 | (6) The Department of Revenue or its agents or assigns | ||||||
15 | acting to investigate or collect delinquent taxes or unpaid | ||||||
16 | court orders or to fulfill any of its other statutory | ||||||
17 | responsibilities.
| ||||||
18 | (7) The use of credit information for the purposes of | ||||||
19 | prescreening as provided for by the federal Fair Credit | ||||||
20 | Reporting Act.
| ||||||
21 | (8) Any person or entity administering a credit file | ||||||
22 | monitoring subscription or similar service to which the | ||||||
23 | consumer has subscribed.
| ||||||
24 | (9) Any person or entity for the purpose of providing a | ||||||
25 | consumer with a copy of his or her credit report or score | ||||||
26 | upon the consumer's request.
|
| |||||||
| |||||||
1 | (10) Any person using the information in connection | ||||||
2 | with the underwriting of insurance.
| ||||||
3 | (n-5) A consumer reporting agency may not impose a charge | ||||||
4 | on a consumer for placing a freeze, removing a freeze, or | ||||||
5 | temporarily lifting a freeze.
| ||||||
6 | (o) If a security freeze is in place, a consumer reporting | ||||||
7 | agency shall not change any of the following official | ||||||
8 | information in a credit report without sending a written | ||||||
9 | confirmation of the change to the consumer within 30 days of | ||||||
10 | the change being posted to the consumer's file: (i) name, (ii) | ||||||
11 | date of birth, (iii) Social Security number, and (iv) address. | ||||||
12 | Written confirmation is not required for technical | ||||||
13 | modifications of a consumer's official information, including | ||||||
14 | name and street abbreviations, complete spellings, or | ||||||
15 | transposition of numbers or letters. In the case of an address | ||||||
16 | change, the written confirmation shall be sent to both the new | ||||||
17 | address and to the former address.
| ||||||
18 | (p) The following entities are not required to place a | ||||||
19 | security freeze in a consumer report, however, pursuant to | ||||||
20 | paragraph (3) of this subsection, a consumer reporting agency | ||||||
21 | acting as a reseller shall honor any security freeze placed on | ||||||
22 | a consumer credit report by another consumer reporting agency:
| ||||||
23 | (1) A check services or fraud prevention services | ||||||
24 | company, which issues reports on incidents of fraud or | ||||||
25 | authorizations for the purpose of approving or processing | ||||||
26 | negotiable instruments, electronic funds transfers, or |
| |||||||
| |||||||
1 | similar methods of payment.
| ||||||
2 | (2) A deposit account information service company, | ||||||
3 | which issues reports regarding account closures due to | ||||||
4 | fraud, substantial overdrafts, ATM abuse, or similar | ||||||
5 | negative information regarding a consumer to inquiring | ||||||
6 | banks or other financial institutions for use only in | ||||||
7 | reviewing a consumer request for a deposit account at the | ||||||
8 | inquiring bank or financial institution.
| ||||||
9 | (3) A consumer reporting agency that:
| ||||||
10 | (A) acts only to resell credit information by | ||||||
11 | assembling and merging information contained in a | ||||||
12 | database of one or more consumer reporting agencies; | ||||||
13 | and
| ||||||
14 | (B) does not maintain a permanent database of | ||||||
15 | credit information from which new credit reports are | ||||||
16 | produced.
| ||||||
17 | (q) For purposes of this Section: | ||||||
18 | "Credit file" has the same meaning as provided for "file" | ||||||
19 | in 15 U.S.C. 1681a(g). | ||||||
20 | "Credit report" has the same meaning as "consumer report", | ||||||
21 | as ascribed to it in 15 U.S.C. Sec. 1681a(d). | ||||||
22 | "Consumer reporting agency" has the meaning ascribed to it | ||||||
23 | in 15 U.S.C. Sec. 1681a(f). | ||||||
24 | "Security freeze" means
a notice placed in a consumer's | ||||||
25 | credit report, at the request of the consumer and subject to | ||||||
26 | certain exceptions, that prohibits the consumer reporting |
| |||||||
| |||||||
1 | agency from releasing the consumer's credit report or score | ||||||
2 | relating to an extension of credit, without the express | ||||||
3 | authorization of the consumer.
| ||||||
4 | "Extension of credit" does not include
an increase in an | ||||||
5 | existing open-end credit plan, as defined in Regulation Z of
| ||||||
6 | the Federal Reserve System (12 C.F.R. 226.2), or any change to | ||||||
7 | or review of an
existing credit account.
| ||||||
8 | "Proper authority" means documentation that shows that a | ||||||
9 | parent, guardian, or agent has authority to act on behalf of a | ||||||
10 | minor or person with a disability. "Proper authority" includes | ||||||
11 | (1) an order issued by a court of law that shows that a | ||||||
12 | guardian has authority to act on behalf of a minor or person | ||||||
13 | with a disability, (2) a written, notarized statement signed by | ||||||
14 | a parent that expressly describes the authority of the parent | ||||||
15 | to act on behalf of the minor, or (3) a durable power of | ||||||
16 | attorney that complies with the Illinois Power of Attorney Act. | ||||||
17 | "Proper identification" means information generally deemed | ||||||
18 | sufficient to identify a person. Only if the consumer is unable | ||||||
19 | to reasonably identify himself or herself with the information | ||||||
20 | described above, may a consumer reporting agency require | ||||||
21 | additional information concerning the consumer's employment | ||||||
22 | and personal or family history in order to verify his or her | ||||||
23 | identity.
| ||||||
24 | (r) Any person who violates this Section commits an
| ||||||
25 | unlawful practice within the meaning of this Act.
| ||||||
26 | (Source: P.A. 99-143, eff. 7-27-15; 99-373, eff. 1-1-16; |
| |||||||
| |||||||
1 | 99-642, eff. 7-28-16; 100-589, eff. 6-8-18.)
|