C.S.S.B. 473 78(R) BILL ANALYSIS
C.S.S.B. 473
By: Ellis, Rodney
Business & Industry
Committee Report (Substituted)
BACKGROUND AND PURPOSE
Currently, consumer reporting agencies allow individuals who are or
suspect that they are victims of identity theft to place a security alert
on their credit reports. However, security alerts are only advisory in
nature and are not always followed by merchants and credit grantors.
Moreover, a victim of identity theft is often embroiled in the long
process of clearing credit history, financial affairs, or even criminal
records. C.S.S.B. 473 allows a victim of identity theft to place a freeze
on his or her credit report and provides for the confidentiality of social
security numbers. This bill seeks to prevent identity theft, which is one
of the fastest growing crimes in the United States, as well as in Texas
RULEMAKING AUTHORITY
It is the committee's opinion that this bill does not expressly grant any
additional rulemaking authority to a state officer, department, agency, or
institution.
ANALYSIS
SECTION 1. Amends Section 20.01, Business & Commerce Code, by adding
subsections (7) and (8), to define "security alert" and "security
freeze." Amends subsection (8) by adding "relating to the extension of
credit."
SECTION 2. Amends Section 20.03, Business & Commerce Code, by adding
subsection (d), to
requires any written disclosure by the consumer reporting agency (agency)
to include a clear and simple statement that explains to the consumer the
consumer's right under this subchapter and includes certain information.
SECTION 3. Amends Chapter 20, Business & Commerce Code, by adding
Sections 20.031-20.038, as follows:
Sec. 20.031. REQUESTING SECURITY ALERT. Requires an agency, not later
than 24 hours after receiving a request in writing or by telephone and
with proper identification by a consumer, to place a security alert on the
consumer's file. Prohibits the security alert from exceeding 45 days
after the date the agency enacted the alert on the files. Provides that
there is no limit on the number of security alerts a consumer may request.
Requires the agency, on request in writing or by telephone and with proper
identification provided by the consumer, to provide a copy of their
consumer's file, at the end of a 45-day security alert. Authorizes a
consumer to include with the security alert request a telephone number to
be used by persons to verify the consumer's identity before entering into
a transaction with the consumer.
Sec. 20.032. NOTIFICATION OF SECURITY ALERT. Requires an agency to
notify a person who requests a consumer report if a security alert is in
effect for the consumer file involved in that report and include a
verification telephone number for the consumer if the consumer has
provided a number under Section 20.031.
Sec. 20.033. TOLL-FREE SECURITY ALERT REQUEST NUMBER. Requires an
agency to maintain a toll-free telephone number that is answered at a
minimum during normal business hours to accept security alert requests
from consumers. Also requires an agency to have an automated answering
system to take consumer requests if calls are not answered after normal
business hours and requires an agency to return calls not later than two
hours after the time the normal business day begins on the next business
day.
Sec. 20.034. REQUESTING SECURITY FREEZE.
(a) Requires an agency, by the fifth business day after receiving a
written request sent by certified mail that includes proper identification
provided by a consumer and a copy of a valid police report, investigative
report, or complaint made under Section 32.51, Penal Code, to place a
security freeze on the consumer's file.
(b) Requires an agency, upon request for a security freeze provided by a
consumer under subsection (a), to disclose to the consumer the process of
placing, removing, and temporarily lifting a security freeze and the
process for allowing access to information from the consumer's file for a
specific requester or period while the security freeze is in effect.
(c) Requires an agency, by the 10th business day after receiving the
request for a security freeze, to send certain information to the
consumer.
(d) Requires an agency, by the 3rd business day after receiving the
request for a replacement personal identification number or password and
the consumer has complied with the requirements for requesting a security
freeze under subsection (a), provide the consumer with a new unique
personal identification number or password.
Sec. 20.035. NOTIFICATION OF CHANGE. Requires an agency, if a security
alert is enacted, to notify the consumer in writing regarding a change of
name, date of birth, social security number, or address by the 30th
calendar day after the date the change occurred. Requires the agency to
send notification of a change of address to the new address and former
address. Provides that this section does not require notice of an
immaterial change, including a street abbreviation change or correction of
a transposition of letters or misspelling of a word.
Sec. 20.036. NOTIFICATION OF SECURITY FREEZE. Requires an agency to
notify a person who requests a consumer report if a security freeze is in
effect for the consumer file involved in that report.
Sec. 20.037. REMOVAL OR TEMPORARY LIFTING OF SECURITY FREEZE.
(a) Requires an agency to remove a security freeze by the third business
day after receiving a request in writing or by telephone and with proper
identification provided by a consumer, including the consumer personal
identification number or password provided under Section 20.034.
(b) Requires an agency, under certain circumstances, to temporarily lift
the security freeze, by the third business day after receiving a request
in writing or by telephone and with proper identification provided by a
consumer, including the consumer's personal identification number or
password provided under Section 20.034.
(c) Authorizes an agency to develop procedures involving the use of a
telephone, a facsimile machine, the Internet, or another electronic medium
to receive and process a request from a consumer under this section.
(d) Requires an agency to remove a security freeze placed on the consumer
file if the security was placed due to a material misrepresentation of
fact by the consumer. Requires the agency to notify the consumer in
writing before removing the security freeze under this subsection.
(e) Provides that a consumer reporting agency may not charge a fee for a
request under (a) or (b) above.
Sec. 20.038. EXEMPTION FROM SECURITY FREEZE. Provides that, under
certain circumstances, a security freeze does not apply to certain
consumer reports.
Sec. 200.039. RESPECT OF SECURITY FREEZE. Requires a consumer reporting
agency to honor a security freeze placed on a consumer file by another
consumer agency.
SECTION 4. Amends Section 20.04, Business & Commerce Code, as follows:
Sec. 20.04. CHARGES FOR CERTAIN DISCLOSURES OR SERVICES.
(a) Authorizes an agency to impose a reasonable charge on a consumer
for placing a security freeze on a consumer file, except as provided by
subsection (b). Authorizes an agency, on January 1 of each year, to
increase the charge for disclosure to a consumer or for placing a security
freeze.
(b) Prohibits an agency from charging a fee for a request for a copy of
consumer's file made on the expiration of the 45-day security alert; a
toll-free telephone number that consumers may call to obtain additional
assistance concerning their report or to request a security alert; or a
request for a security alert.
SECTION 5. Amends Chapter 20, Business & Commerce Code, by adding
Sections 20.11 and 20.12, as follows:
Sec. 20.11. INJUNCTIVE RELIEF; CIVIL PENALTY.
(a) Authorizes the attorney general to file a suit against a person for
injunctive relief to prevent or restrain a violation of this chapter or a
civil penalty in amount not exceeding $2,000 for each violation of this
chapter.
(b) Authorizes the attorney general, if the attorney general brings an
action against a person under subsection (a) and an injunction is granted
against the person or the person is found liable for a civil penalty, to
recover reasonable expenses, court costs, investigative costs, and
attorney's fees.
(c) Provides that each day a violation continues or occurs is a separate
violation for purposes of imposing a penalty under this section.
Sec. 20.12. DECEPTIVE TRADE PRACTICE. Provides that a violation of this
chapter is a false, misleading, or deceptive act or practice under Chapter
17E.
SECTION 6. Amends Chapter 35D, Business & Commerce Code, by adding
Section 35.58, as follows:
Sec. 35.58. CONFIDENTIALITY OF SOCIAL SECURITY NUMBER.
(a) Prohibits a person other than government or governmental subdivision
or agency from taking certain actions.
(b) Provides that a person that is using an individual's social security
number before January 1, 2005, in a manner prohibited by subsection (a)
may continue that use if certain requirements are meet.
(c) Prohibits a person, other than government or governmental subdivision
or agency, from denying services to an individual because the individual
makes a written request under subsection (b).
(d) Provides that this section does not apply to the collection, use, or
release of a social security number that is required by state or federal
law, including Chapter 552 (Public Information), Government Code; or the
use of social security number for internal verification or administrative
purposes; or documents that are recorded or required to be open to the
public under Chapter 552, (Public Information), Government Code; or court
records.
SECTION 7. Amends Chapter 35D, Business & Commerce Code, by adding
Section 35.59, as follows:
Sec. 35.59. VERIFICATION OF CONSUMER IDENTITY.
(a) Defines "consumer report," "extension of credit," and "security
alert."
(b) Provides that a person who receives notification of a security alert
under Section 20.032 in connection with a request for a consumer report
for the approval of a credit-based application, including an application
for an extension of credit, a purchase, lease, or rental agreement for
goods, or for an application for a noncredit- related service, may not
lend money, extend credit, or authorize an application without taking
reasonable steps to verify the consumer's identity.
(c) Provides that if a consumer has included with a security alert a
specified telephone number to be used for identity verification purposes,
a person who receives that number with a security alert must take
reasonable steps to connect the consumer using that number before lending
money, extending credit, or completing any purchase, lease, or rental
goods, or approving any noncredit- related services.
(d) Provides that if a person uses a consumer report to facilitate the
extension of credit or for any other transaction on behalf of a
subsidiary, agent, assignee, or prospective assignee, that person, rather
than the subsidiary, affiliate, agent, assignee, or prospective assignee,
may verify the consumer's identity.
SECTION 8. (a) Provides that, except as provided by subsection (b) of
this section, this Act takes effect September 1, 2003.
(b) Provides that Section 35.58, Business & Commerce Code, as added by
this Act, takes effect January 1, 2005.
(c) Provisions of bill continue in effect until Sept. 1, 2005.
EFFECTIVE DATE
Except as provided by Section 8 subsection (b) this Act takes effect
September 1, 2003.
Section 8 subsection (b) Provides that Section 35.58, Business &
Commerce Code, as added by this Act, takes effect January 1, 2005.
Section 8 subsection (c) Provisions of bill continue in effect until Sept.
1, 2005.
COMPARISON OF ORIGINAL TO SUBSTITUTE
SECTION 1. Differs from the original bill in proposed Section 20.01 by
adding "relating to the extension of credit."
SECTION 3. Differs from the original bill in proposed Section 20.031 by
replacing "fifth business day" with "24 hours." Also changes "90" days to
"45" days.
Differs from the original bill in proposed Section 20.031 by adding the
text authorizing a consumer to include with the security alert request a
telephone number to be used by persons to verify the consumer's identity
before entering into a transaction with the consumer.
Differs from the original bill in proposed Section 20.032 by adding the
phrase "and include a verification telephone number for the consumer if
the consumer has provided a number under Section 20.031," in regard to
notification of a security alert.
Differs from the original bill in proposed Section 20.033 by striking "at
all times" and replacing with "at a minimum during normal business hours
to accept security alert requests from consumers. If calls are not
answered after normal business hours, an automated answering system shall
record requests and calls shall be returned to the consumer not later
than two hours after the time the normal business day begins on the next
business day after the date the call was received.
Differs from the original bill in proposed Section 20.034 by adding " a
copy of a valid police report, investigative report, or complaint made
under Section 32.51, Penal Code."
Differs from the original bill in proposed Section 20.033 by adding (d)
and the text "A consumer may request in writing a replacement personal
identification number or password. The request must comply with the
requirements for requesting a security freeze under subsection (a). The
consumer reporting agency shall not later than the third business day
after the date the agency receives the request for a replacement personal
identification number or password provide the consumer with a new unique
personal identification number or password to be used by the consumer
instead of the number or password that was provided under subsection (c)."
Adds a new subsection (e) in Section 20.037, providing that a consumer
reporting agency may not charge a fee for lifting a security freeze in
certain circumstances.
Differs from the original bill in proposed Section 20.038 by adding an
"administrative subpoena" Subdivision (6), "or private collections agency"
subsection (7) and the provisions of subsections (9), (10), (11), (12)
and (13) to the list of items, situations, and persons to which a security
freeze does not apply.
Differs from the original bill by adding a new Section 20.039. RESPECT OF
SECURITY FREEZE. A consumer reporting agency shall honor a security freeze
placed on a consumer file by another consumer reporting agency.
SECTION 4.
Differs from the original bill in Section 20.04 by deleting previously
proposed new text.
Differs from the original bill in Section 20.04(b) by adding " a request
for a security alert made by a consumer" to the list of items for which a
consumer reporting agency may not charge a fee.
SECTION 5. Differs from original bill by creating a new SECTION 5 to
amend Chapter 20, Business & Commerce Code.
Differs from original bill by redesignating proposed SECTION 5 as SECTION
6.
SECTION 6. Differs from original bill in proposed Section 35.58 (1) by
adding "general."
Differs from the original bill in proposed Section 35.58 (5) (b) by
changing "January 1, 2004" to January 1, 2005."
Differs from the original bill in proposed Section 35.58 (d) by adding
subsection "(3) documents that are recorded or required to be open to the
public under Chapter 552, Government code; or (4) court records."
SECTION 7. Differs from original bill by creating a new SECTION 7 to
amend Chapter 35D, Business & Commerce Code.
Differs from original bill by redesignating proposed SECTION 6 as
SECTION 8.
SECTION 8. Differs from original bill in proposed subsection (b) by
changing "January 1, 2004" to January 1, 2005." Adds new subsection (c)
providing that provisions continue in effect until Sept. 1, 2005.