SRC- TAG C.S.S.B. 473 78(R) BILL ANALYSIS
Senate Research CenterC.S.S.B. 473
By: Ellis, Rodney
Criminal Justice
3/21/2003
Committee Report (Substituted)
DIGEST AND PURPOSE
Currently, consumer reporting agencies allow individuals who are or
suspect that they are victims of identity theft to place security alert on
their credit reports. However, security alerts are only advisory in
nature and are not always followed by merchants and credit grantors.
Moreover, a victim of identity theft is often embroiled in long process of
clearing credit history, financial affairs, or even criminal records.
C.S.S.B. 473 allows a victim of identity theft to place a freeze, for a
modest fee, on his or her credit report and provides for confidentiality
of social security numbers. This bill seeks to prevent identity theft,
which is one of the fastest growing crimes in the United States as well as
in Texas.
RULEMAKING AUTHORITY
This bill does not expressly grant any additional rulemaking authority to
a state officer, institution, or agency.
SECTION BY SECTION ANALYSIS
SECTION 1. Amends Section 20.01, Business & Commerce Code, by adding
Sudivisions (7) and (8), to define "security alert" and "security
freeze."
SECTION 2. Amends Section 20.03, Business & Commerce Code, by adding
Subsection (d), to
requires any written disclosure by the consumer reporting agency (agency)
to include a clear and simple statement that explains to the consumer the
consumer's right under this subchapter and includes certain information.
SECTION 3. Amends Chapter 20, Business & Commerce Code, by adding
Sections 20.03120.038, as follows:
Sec. 20.031. REQUESTING SECURITY ALERT. Requires an agency, not later
than 24 hours after receiving a request in writing or by telephone and
with proper identification by a consumer, to place a security alert on the
consumer's file. Prohibits the security alert from exceeding 90 days
after the date the agency enacted the alert on the files. Provides that
there is no limit on the number of security alerts a consumer may request.
Requires the agency, on request in writing or by telephone and with proper
identification provided by the consumer, to provide a copy of their
consumer's file, at the end of a 90-day security alert. Authorizes a
consumer to include with the security alert request a telephone number to
be used by persons to verify the consumer's identity before entering into
a transaction with the consumer.
Sec. 20.032. NOTIFICATION OF SECURITY ALERT. Requires an agency to
notify a person who requests a consumer report if a security alert is in
effect for the consumer file involved in that report and include a
verification telephone number for the consumer if the consumer has
provided a number under Section 20.031.
Sec. 20.033. TOLL-FREE SECURITY ALERT REQUEST NUMBER. Requires an
agency to maintain a toll-free telephone number that is answered at all
times to accept security alert requests from consumers.
Sec. 20.034. REQUESTING SECURITY FREEZE. (a) Requires an agency, by
the fifth business day after receiving a written request sent by certified
mail that includes proper identification provided by a consumer, to place
a security freeze on the consumer's file.
(b) Requires an agency, upon request for a security freeze provided by a
consumer under Subsection (a), to disclose to the consumer the process of
placing, removing, and temporarily lifting a security freeze and the
process for allowing access to information from the consumer's file for a
specific requester or period while the security freeze is in effect.
(c) Requires an agency, by the 10th business day after receiving the
request for a security freeze, to send certain information to the
consumer.
Sec. 20.035. NOTIFICATION OF CHANGE. Requires an agency, if a security
alert is enacted, to notify the consumer in writing regarding a change of
name, date of birth, social security number, or address by the 30th
calendar day after the date the change occurred. Requires the agency to
send notification of a change of address to the new address and former
address. Provides that this section does not require notice of an
immaterial change, including a street abbreviation change or correction of
a transposition of letters or misspelling of a word.
Sec. 20.036. NOTIFICATION OF SECURITY FREEZE. Requires an agency to
notify a person who requests a consumer report if a security freeze is in
effect for the consumer file involved in that report.
Sec. 20.037. REMOVAL OR TEMPORARY LIFTING OF SECURITY FREEZE. (a)
Requires an agency to remove a security freeze by the third business day
after receiving a request in writing or by telephone and with proper
identification provided by a consumer, including the consumer personal
identification number or password provided under Section 20.034.
(b) Requires an agency, under certain circumstances, to temporarily lift
the security freeze, by the third business day after receiving a request
in writing or by telephone and with proper identification provided by a
consumer, including the consumer's personal identification number or
password provided under Section 20.034.
(c) Authorizes an agency to develop procedures involving the use of a
telephone, a facsimile machine, the Internet, or another electronic medium
to receive and process a request from a consumer under this section.
(d) Requires an agency to remove a security freeze placed on the consumer
file if the security was placed due to a material misrepresentation of
fact by the consumer. Requires the agency to notify the consumer in
writing before removing the security freeze under this subsection.
Sec. 20.038. EXEMPTION FROM SECURITY FREEZE. Provides that, under
certain circumstances, a security freeze does not apply to a consumer
report.
SECTION 4. Amends Section 20.04, Business & Commerce Code, as follows:
Sec. 20.04. New heading: CHARGES FOR CERTAIN DISCLOSURES OR SERVICES.
(a) Authorizes an agency to impose a reasonable charge on a consumer
for placing a security freeze on a consumer file, except as provided by
Subsection (b). Authorizes an agency, on January 1 of each year, to
increase the charge for disclosure to a consumer or for placing a security
freeze.
(b) Prohibits an agency from charging a fee for a request for a copy of
consumer's file made on the expiration of the 90-day security alert; a
toll-free telephone number that consumers may call to obtain additional
assistance concerning their report or to request a security alert; or a
request for a security freeze made by a consumer who has submitted to the
agency a copy of a valid police report, investigative report, or complaint
made under Section 32.51 (Fraudulent Use or Possession of Identifying
Information) Penal Code. Makes a nonsubstantive change.
SECTION 5. Amends Chapter 20, Business & Commerce Code, by adding
Sections 20.11 and 20.12, as follows:
Sec. 20.11. INJUNCTIVE RELIEF; CIVIL PENALTY. (a) Authorizes the
attorney general to file a suit against a person for injunctive relief to
prevent or restrain a violation of this chapter or a civil penalty in
amount not exceeding $2,000 for each violation of this chapter.
(b) Authorizes the attorney general, if the attorney general brings an
action against a person under Subsection (a) and an injunction is granted
against the person or the person is found liable for a civil penalty, to
recover reasonable expenses, court costs, investigative costs, and
attorney's fees.
(c) Provides that each day a violation continues or occurs is a separate
violation for purposes of imposing a penalty under this section.
Sec. 20.12. DECEPTIVE TRADE PRACTICE. Provides that a violation of this
chapter is a false, misleading, or deceptive act or practice under Chapter
17E.
SECTION 6. Amends Chapter 35D, Business & Commerce Code, by adding
Section 35.58, as follows:
Sec. 35.58. CONFIDENTIALITY OF SOCIAL SECURITY NUMBER. (a) Prohibits a
person other than government or governmental subdivision or agency from
taking certain actions.
(b) Provides that a person that is using an individual's social security
number before January 1, 2004, in a manner prohibited by Subsection (a)
may continue that use if certain requirements are meet.
(c) Prohibits a person, other than government or governmental subdivision
or agency, from denying services to an individual because the individual
makes a written request under Subsection (b).
(d) Provides that this section does not apply to the collection, use, or
release of a social security number that is required by state or federal
law, including Chapter 552 (Public Information), Government Code; or the
use of social security number for internal verification or administrative
purposes.
SECTION 7. Amends Chapter 35D, Business & Commerce Code, by adding
Section 35.59, as follows:
Sec. 35.59. VERIFICATION OF CONSUMER IDENTITY. (a) Defines "consumer
report," "extension of credit," and "security alert."
(b) Provides that a person who receives notification of a security alert
under Section 20.032 in connection with a request for a consumer report
for the approval of a creditbased application, including an application
for an extension of credit, a purchase, lease, or rental agreement for
goods, or for an application for a noncredit- related service, may not
lend money, extend credit, or authorize an application without taking
reasonable steps to verify the consumer's identity.
(c) Provides that if a consumer has included with a security alert a
specified telephone number to be used for identity verification purposes,
a person who receives that number with a security alert must take
reasonable steps to connect the consumer using that number before lending
money, extending credit, or completing any purchase, lease, or rental
goods, or approving any noncredit- related services.
(d) Provides that if a person uses a consumer report to facilitate the
extension of credit or for any other transaction on behalf of a
subsidiary, agent, assignee, or prospective assignee, that person, rather
than the subsidiary, affiliate, agent, assignee, or prospective assignee,
may verify the consumer's identity.
SECTION 8. (a) Provides that, except as provided by Subsection (b) of
this section, this Act takes effect September 1, 2003.
(b) Provides that Section 35.58, Business & Commerce Code, as added by
this Act, takes effect January 1, 2004.
SUMMARY OF COMMITTEE CHANGES
SECTION 3. Differs from the original bill in proposed Section 20.031 by
replacing "fifth business day" with "24 hours."
Differs from the original bill in proposed Section 20.031 by adding the
text authorizing a consumer to include with the security alert request a
telephone number to be used by persons to verify the consumer's identity
before entering into a transaction with the consumer.
Differs from the original bill in proposed Section 20.032 by adding the
phrase "and include a verification telephone number for the consumer if
the consumer has provided a number under Section 20.031," in regard to
notification of a security alert.
Differs from the original bill in proposed Section 20.038 by adding an
"administrative subpoena" Subdivision (6) and the provisions of
Subdivisions (9) and (10) to the list of items, situations, and persons to
which a security freeze does not apply.
SECTION 4. Differs from the original bill in proposed Section 20.04 by
adding a new heading: Charges for Certain Disclosures or Services.
Differs from the original bill in Section 20.04 by deleting previously
proposed new text.
Differs from the original bill in Section 20.04(b) by adding " a request
for a security alert made by a consumer" to the list of items for which a
consumer reporting agency may not charge a fee.
SECTION 5. Differs from original bill by creating a new SECTION 5 to
amend Chapter 20, Business & Commerce Code.
Differs from original bill by redesignating proposed SECTION 5 as SECTION
6.
SECTION 7. Differs from original bill by creating a new SECTION 7 to
amend Chapter 35D, Business & Commerce Code.
Differs from original bill by redesignating proposed SECTION 6 as
SECTION 8.