|
|
Public Act 094-0074
|
| HB1058 Enrolled |
LRB094 06009 RXD 36069 b |
|
|
AN ACT concerning business.
|
Be it enacted by the People of the State of Illinois,
|
represented in the General Assembly:
|
Section 5. The Consumer Fraud and Deceptive Business |
Practices Act is amended by changing Section 2MM as follows:
|
(815 ILCS 505/2MM)
|
Sec. 2MM. Verification of accuracy of credit reporting |
information used to
extend consumers credit and security freeze |
on credit report for identity theft victims.
|
(a) A credit card issuer who mails an offer or solicitation |
to apply for a
credit card and who receives a completed |
application in response to the offer
or
solicitation which |
lists an address that is not substantially the same as the
|
address on the offer or solicitation may not issue a credit |
card based on that
application until reasonable steps have been |
taken to verify the applicant's
change of address.
|
(b) Any person who uses a consumer credit report in |
connection with the
approval of credit based on the application |
for an extension of credit, and who
has received notification |
of a police report filed with a consumer reporting
agency that |
the applicant has been a victim of financial
identity theft, as |
defined in Section 16G-15 of the Criminal Code of 1961, may
not |
lend money or extend credit without taking reasonable steps to |
verify the
consumer's identity and confirm that the application |
for an extension of
credit
is not the result of financial |
identity theft.
|
(c) A consumer who has been the victim of identity theft |
may place a security freeze on his or her credit report by |
making a request in writing by certified mail to a consumer |
credit reporting agency with a valid copy of a police report, |
investigative report, or complaint that the consumer has filed |
with a law enforcement agency about unlawful use of his or her |
|
personal information by another person. A credit reporting |
agency shall not charge a fee for placing, removing, or |
removing for a specific party or period of time a security |
freeze on a credit report. A security freeze shall prohibit, |
subject to the exceptions under subsection (i) of this Section, |
the credit reporting agency from releasing the consumer's |
credit report or any information from it without the express |
authorization of the consumer. When a security freeze is in |
place, information from a consumer's credit report shall not be |
released to a third party without prior express authorization |
from the consumer. This subsection does not prevent a credit |
reporting agency from advising a third party that a security |
freeze is in effect with respect to the consumer's credit |
report.
|
(d) A credit reporting agency shall place a security freeze |
on a consumer's credit report no later than 5 business days |
after receiving a written request from the consumer.
|
(e) The credit reporting agency shall send a written |
confirmation of the security freeze to the consumer within 10 |
business days and shall provide the consumer with a unique |
personal identification number or password, other than the |
consumer's Social Security number, to be used by the consumer |
when providing authorization for the release of his or her |
credit for a specific party or period of time.
|
(f) If the consumer wishes to allow his or her credit |
report to be accessed for a specific party or period of time |
while a freeze is in place, he or she shall contact the |
consumer credit reporting agency, request that the freeze be |
temporarily lifted, and provide the following:
|
(1) Proper identification;
|
(2) The unique personal identification number or |
password provided by the credit reporting agency; and
|
(3) The proper information regarding the third party or |
time period for which the report shall be available to |
users of the credit report.
|
(g) A credit reporting agency may develop procedures |
|
involving the use of telephone, fax, the Internet, or other |
electronic media to receive and process a request from a |
consumer to temporarily lift a freeze on a credit report |
pursuant to subsection (f) in an expedited manner.
|
(h) A credit reporting agency that receives a request from |
a consumer to temporarily lift a freeze on a credit report |
pursuant to subsection (f), shall comply with the request no |
later than 3 business days after receiving the request.
|
(i) A credit reporting agency shall remove or temporarily |
lift a freeze placed on a consumer's credit report only in the |
following cases:
|
(1) upon consumer request, pursuant to subsection (f) |
or subsection (l) of this Section; or
|
(2) if the consumer's credit report was frozen due to a |
material misrepresentation of fact by the consumer.
|
If a consumer credit reporting agency intends to remove a |
freeze upon a consumer's credit report pursuant to this |
subsection, the consumer credit reporting agency shall notify |
the consumer in writing prior to removing the freeze on the |
consumer's credit report.
|
(j) If a third party requests access to a credit report on |
which a security freeze is in effect, and this request is in |
connection with an application for credit or any other use, and |
the consumer does not allow his or her credit report to be |
accessed for that specific party or period of time, the third |
party may treat the application as incomplete.
|
(k) If a consumer requests a security freeze, the credit |
reporting agency shall disclose to the consumer the process of |
placing and temporarily lifting a security freeze, and the |
process for allowing access to information from the consumer's |
credit report for a specific party or period of time while the |
freeze is in place.
|
(l) A security freeze shall remain in place until the |
consumer requests that the security freeze be removed. A credit |
reporting agency shall remove a security freeze within 3 |
business days of receiving a request for removal from the |
|
consumer, who provides both of the following:
|
(1) Proper identification; and
|
(2) The unique personal identification number or |
password provided by the credit reporting agency.
|
(m) A consumer credit reporting agency shall require proper |
identification of the person making a request to place or |
remove a security freeze.
|
(n) The provisions of subsections (c) through (m) of this |
Section do not apply to the use of a consumer credit report by |
any of the following:
|
(1) A person or entity, or a subsidiary, affiliate, or |
agent of that person or entity, or an assignee of a |
financial obligation owing by the consumer to that person |
or entity, or a prospective assignee of a financial |
obligation owing by the consumer to that person or entity |
in conjunction with the proposed purchase of the financial |
obligation, with which the consumer has or had prior to |
assignment an account or contract, including a demand |
deposit account, or to whom the consumer issued a |
negotiable instrument, for the purposes of reviewing the |
account or collecting the financial obligation owing for |
the account, contract, or negotiable instrument. For |
purposes of this subsection, "reviewing the account" |
includes activities related to account maintenance, |
monitoring, credit line increases, and account upgrades |
and enhancements.
|
(2) A subsidiary, affiliate, agent, assignee, or |
prospective assignee of a person to whom access has been |
granted under subsection (f) of this Section for purposes |
of facilitating the extension of credit or other |
permissible use.
|
(3) Any state or local agency, law enforcement agency, |
trial court, or private collection agency acting pursuant |
to a court order, warrant, or subpoena.
|
(4) A child support agency acting pursuant to Title |
IV-D of the Social Security Act.
|
|
(5) The relevant state agency or its agents or assigns |
acting to investigate Medicaid fraud.
|
(6) The Department of Revenue or its agents or assigns |
acting to investigate or collect delinquent taxes or unpaid |
court orders or to fulfill any of its other statutory |
responsibilities.
|
(7) The use of credit information for the purposes of |
prescreening as provided for by the federal Fair Credit |
Reporting Act.
|
(8) Any person or entity administering a credit file |
monitoring subscription service to which the consumer has |
subscribed.
|
(9) Any person or entity for the purpose of providing a |
consumer with a copy of his or her credit report upon the |
consumer's request.
|
(o) If a security freeze is in place, a credit reporting |
agency shall not change any of the following official |
information in a credit report without sending a written |
confirmation of the change to the consumer within 30 days of |
the change being posted to the consumer's file: (i) name, (ii) |
date of birth, (iii) Social Security number, and (iv) address. |
Written confirmation is not required for technical |
modifications of a consumer's official information, including |
name and street abbreviations, complete spellings, or |
transposition of numbers or letters. In the case of an address |
change, the written confirmation shall be sent to both the new |
address and to the former address.
|
(p) The following entities are not required to place a |
security freeze in a credit report, provided, however, that any |
person that is not required to place a security freeze on a |
credit report under paragraph (3) of this subsection, shall be |
subject to any security freeze placed on a credit report by |
another credit reporting agency from which it obtains |
information:
|
(1) A check services or fraud prevention services |
company, which issues reports on incidents of fraud or |
|
authorizations for the purpose of approving or processing |
negotiable instruments, electronic funds transfers, or |
similar methods of payment.
|
(2) A deposit account information service company, |
which issues reports regarding account closures due to |
fraud, substantial overdrafts, ATM abuse, or similar |
negative information regarding a consumer to inquiring |
banks or other financial institutions for use only in |
reviewing a consumer request for a deposit account at the |
inquiring bank or financial institution.
|
(3) A credit reporting agency that:
|
(A) acts only to resell credit information by |
assembling and merging information contained in a |
database of one or more credit reporting agencies; and
|
(B) does not maintain a permanent database of |
credit information from which new credit reports are |
produced.
|
(q)
(c) For purposes of this Section:
, |
"Extension
extension of credit" does not include
an |
increase in an existing open-end credit plan, as defined in |
Regulation Z of
the Federal Reserve System (12 C.F.R. 226.2), |
or any change to or review of an
existing credit account.
|
"Proper identification" means information generally deemed |
sufficient to identify a person. Only if the consumer is unable |
to reasonably identify himself or herself with the information |
described above, may a consumer credit reporting agency require |
additional information concerning the consumer's employment |
and personal or family history in order to verify his or her |
identity.
|
(r)
(d) Any person who violates this Section
subsection (a) |
or subsection (b) commits an
unlawful practice within the |
meaning of this Act.
|
(Source: P.A. 93-195, eff. 1-1-04.)
|