1.1 	A bill for an act
1.2 	relating to consumer protection; permitting consumers to "freeze" their credit 
1.3 	reports as a matter of security; proposing coding for new law in Minnesota 
1.4 	Statutes, chapter 13C.
1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. [13C.05] CONSUMER SECURITY FREEZE.
1.7 		Subdivision 1.Definitions. For the purposes of this section, the following terms 
1.8 	have the following meanings:
1.9 	(a) "Consumer" means an individual.
1.10 	(b) "Consumer reporting agency" means any person, for monetary fees, dues, or on 
1.11 	a cooperative nonprofit basis, regularly engages in whole or in part in the practice of 
1.12 	assembling or evaluating consumer credit information or other information on consumers 
1.13 	for the purpose of furnishing consumer reports to third parties.
1.14 	(c) "Consumer report" or "credit report" means any written, oral, or other 
1.15 	communication of any information by a consumer reporting agency bearing on a 
1.16 	consumer's credit worthiness, credit standing, credit capacity, character, general 
1.17 	reputation, personal characteristics, or mode of living which is used or expected to be used 
1.18 	or collected in whole or in part for the purpose of serving as a factor in establishing the 
1.19 	consumer's eligibility for: 
1.20 	(1) credit or insurance to be used primarily for personal, family, or household 
1.21 	purposes, except that nothing in this act authorizes the use of credit evaluations, credit 
1.22 	scoring, or insurance scoring in the underwriting of personal lines of property or casualty 
1.23 	insurance; 
1.24 	(2) employment purposes; or 
2.1 	(3) any other purpose authorized under United States Code, title 15, section 1681(b).
2.2 	(d) "Security freeze" means a notice, at the request of the consumer and subject to 
2.3 	certain exceptions, that prohibits the consumer reporting agency from releasing all or any 
2.4 	part of the consumer's credit report or any information derived from it without the express 
2.5 	authorization of the consumer. If a security freeze is in place, such a report or information 
2.6 	may not be released to a third party without prior express authorization from the consumer. 
2.7 	This subdivision does not prevent a consumer reporting agency from advising a third party 
2.8 	that a security freeze is in effect with respect to the consumer's credit report.
2.9 	(e) "Reviewing the account" or "account review" includes activities related to 
2.10 	account maintenance, monitoring, credit line increases, and account upgrades and 
2.11 	enhancements.
2.12 		Subd. 2.Security freeze; timing, covered entities, cost. (a) A consumer may place 
2.13 	a security freeze on his or her credit report by:
2.14 	(1) making a request by first class United States mail; 
2.15 	(2) making a request by telephone by providing certain personal identification; or 
2.16 	(3) making a request directly to the consumer reporting agency through a secure 
2.17 	electronic mail connection, which connection shall be made available by the agency.
2.18 	(b) A consumer reporting agency shall place a security freeze on a consumer's credit 
2.19 	report no later than three business days after receiving a request pursuant to paragraph (a).
2.20 	(c) The consumer reporting agency shall send a written confirmation of the security 
2.21 	freeze to the consumer within three business days of placing the freeze and at the same 
2.22 	time shall provide the consumer with a unique personal identification number or password 
2.23 	to be used by the consumer when providing authorization for the release of his or her credit 
2.24 	report for a specific party or specific period of time, or when permanently lifting the freeze.
2.25 	(d) If the consumer wishes to allow his or her credit report to be accessed by a 
2.26 	specific party or for a specific period of time while a freeze is in place, the consumer shall 
2.27 	contact the consumer reporting agency via telephone, first class United States mail, or 
2.28 	secure electronic mail, with a request that the freeze be temporarily lifted, and provide 
2.29 	the following: 
2.30 	(1) proper identification; 
2.31 	(2) the unique personal identification number or password provided by the consumer 
2.32 	reporting agency pursuant to paragraph (c); and 
2.33 	(3) the proper information regarding the third party who is to receive the credit 
2.34 	report or the time period for which the report is available to users of the credit report.
2.35 	(e) A consumer reporting agency that receives a request from a consumer to 
2.36 	temporarily lift a freeze on a credit report pursuant to paragraph (d) shall comply with 
3.1 	the request as quickly as possible, but in no event later than three business days after 
3.2 	receiving the request. 
3.3 	(f) A consumer reporting agency shall develop procedures involving the use of 
3.4 	telephone, fax, or, upon the consent of the consumer in the manner required by the federal 
3.5 	Electronic Signatures in Global and National Commerce Act, United States Code, title 15, 
3.6 	section 7001, et seq., for legally required notices, by the Internet, electronic mail, or other 
3.7 	electronic media to receive and process a request from a consumer to temporarily lift a 
3.8 	freeze on a credit report pursuant to paragraph (d) in an expedited manner. 
3.9 	(g) A consumer reporting agency shall remove or temporarily lift a freeze placed 
3.10 	on a consumer's credit report only in the following cases: 
3.11 	(1) upon consumer request, pursuant to paragraph (d) or (j); or 
3.12 	(2) if the consumer's credit report was frozen due to a material misrepresentation of 
3.13 	fact by the consumer. If a consumer reporting agency intends to remove a freeze upon 
3.14 	a consumer's credit report pursuant to this paragraph, the consumer reporting agency 
3.15 	shall notify the consumer in writing five business days before removing the freeze on the 
3.16 	consumer's credit report.
3.17 	(h) If a third party requests access to a consumer credit report on which a security 
3.18 	freeze is in effect, and this request is in connection with an application for credit or any 
3.19 	other use, and the consumer does not allow his or her credit report to be accessed for that 
3.20 	specific party or period of time, the third party may treat the application as incomplete.
3.21 	(i) If a third party requests access to a consumer credit report on which a security 
3.22 	freeze is in effect for the purpose of receiving, extending, or otherwise using the credit in 
3.23 	it, and not for the sole purpose of account review, the consumer credit reporting agency 
3.24 	must notify the consumer that an attempt has been made to access the credit report.
3.25 	(j) A security freeze remains in place until the consumer requests that the security 
3.26 	freeze be removed. A consumer reporting agency shall remove a security freeze as quickly 
3.27 	as possible, but in no event later than three business days after receipt of a request for 
3.28 	removal from a consumer who provides both of the following:
3.29 	(1) proper identification; and 
3.30 	(2) the unique personal identification number or password provided by the consumer 
3.31 	reporting agency pursuant to paragraph (c). 
3.32 	(k) A consumer reporting agency shall require proper identification of the person 
3.33 	making a request to remove a security freeze. 
3.34 	(l) A consumer reporting agency may not suggest or otherwise state or imply to a 
3.35 	third party that the consumer's security freeze reflects a negative credit score, history, 
3.36 	report, or rating. 
4.1 	(m) The provisions of this section do not apply to the use of a consumer credit 
4.2 	report by any of the following: 
4.3 	(1) a person, or the person's subsidiary, affiliate, agent, or assignee with which 
4.4 	the consumer has or, prior to assignment, had an account, contract, or debtor-creditor 
4.5 	relationship for the purposes of reviewing the account or collecting the financial obligation 
4.6 	owing for the account, contract, or debt; 
4.7 	(2) a subsidiary, affiliate, agent, assignee, or prospective assignee of a person to 
4.8 	whom access has been granted under subdivision 2, paragraph (d), for purposes of 
4.9 	facilitating the extension of credit or other permissible use; 
4.10 	(3) any person acting pursuant to a court order, warrant, or subpoena; 
4.11 	(4) a state or local agency which administers a program for establishing and 
4.12 	enforcing child support obligations; 
4.13 	(5) the Department of Health or its agents or assigns acting to investigate fraud; 
4.14 	(6) the Department of Revenue or its agents or assigns acting to investigate or 
4.15 	collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory 
4.16 	responsibilities; 
4.17 	(7) any person administering a credit file monitoring subscription service to which 
4.18 	the consumer has subscribed; or 
4.19 	(8) any person for the purpose of providing a consumer with a copy of his or her 
4.20 	credit report upon the consumer's request. 
4.21 	(n) A consumer may not be charged for any services related to the security freeze, 
4.22 	except that a consumer reporting agency may charge a consumer a fee of no more than $5 
4.23 	to reissue a personal identification number or password issued pursuant to paragraph (c).
4.24 		Subd. 3.Notice of rights. At any time that a consumer is required to receive a 
4.25 	summary of rights required under section 609 of the federal Fair Credit Reporting Act, 
4.26 	United States Code, title 15, section 1681(g), the following notice must be included:
4.27 	"Minnesota Consumers Have the Right to Obtain a Security Freeze
4.28 	You may obtain a security freeze on your credit report at no charge to protect your 
4.29 	privacy and ensure that credit is not granted in your name without your knowledge. You 
4.30 	have a right to place a security freeze on your credit report pursuant to Minnesota law.
4.31 	The security freeze will prohibit a consumer reporting agency from releasing any 
4.32 	information in your credit report without your express authorization or approval. 
4.33 	The security freeze is designed to prevent credit, loans, and services from being 
4.34 	approved in your name without your consent. When you place a security freeze on your 
4.35 	credit report, within three business days you will be provided a personal identification 
4.36 	number or password to use if you choose to remove the freeze on your credit report or to 
5.1 	temporarily authorize the release of your credit report for a specific party, parties, or for a 
5.2 	specific period of time after the freeze is in place. To provide that authorization, you must 
5.3 	contact the consumer reporting agency and provide all of the following:
5.4 	(1) The unique personal identification number or password provided by the 
5.5 	consumer reporting agency. 
5.6 	(2) Proper identification to verify your identity.
5.7 	(3) The proper information regarding the third party or parties who are to receive 
5.8 	the credit report or the period of time for which the report shall be available to users 
5.9 	of the credit report. 
5.10 	A consumer reporting agency that receives a request from a consumer to lift 
5.11 	temporarily a freeze on a credit report shall comply with the request as quickly as possible, 
5.12 	but no later than three business days after receiving the request. 
5.13 	A security freeze does not apply to circumstances where you have an existing 
5.14 	account relationship and a copy of your report is requested by your existing creditor 
5.15 	or its agents or affiliates for certain types of account review, collection, fraud control, 
5.16 	or similar activities. 
5.17 	If you are actively seeking a new credit, loan, utility, telephone, or insurance 
5.18 	account, you should understand that the procedures involved in lifting a security freeze 
5.19 	may slow your own applications for credit. You should plan ahead and lift a freeze, either 
5.20 	completely if you are shopping around or specifically for a certain creditor, with enough 
5.21 	advance notice before you apply for new credit for the lifting to take effect. You should 
5.22 	lift the freeze at least three business days before applying for a new account."
5.23 		Subd. 4.Penalties and remedies. A person violating this section is subject to 
5.24 	the penalties and remedies in section 8.31.