S. 6886--D 2
to offer information, to process requests and deliver the services
provided for under this section.
(b) A consumer credit reporting agency that receives from a consumer a
request in accordance with subdivision (a) of this section shall,
provided such request is accompanied by proper identification [and
payment of any applicable fee], place a security freeze on the consumer
credit report of or relating to such consumer no later than four busi-
ness days after receiving such request, provided further, however, that
for requests received on or after January first, two thousand nine, such
consumer credit reporting agency shall place a security freeze on the
consumer credit report of or relating to such consumer no later than
three business days after receiving such request and for requests
received on or after January first, two thousand ten, such consumer
credit reporting agency shall place a security freeze on the consumer
credit report of or relating to such consumer no later than one business
day after receiving such request. Nothing in this subdivision shall be
construed to prevent a consumer credit reporting agency from advising a
third party that a security freeze is in effect with respect to the
consumer credit report of or relating to such consumer. No consumer
credit reporting agency shall advise in any manner a third party, of the
fact that the consumer requesting the freeze is alleging to be the
victim of domestic violence or identity theft, without the written
authorization of the consumer.
(c) The consumer credit reporting agency shall send a written confir-
mation of the placement of a security freeze to the consumer within five
business days of placing such freeze. Upon placing the security freeze
on the consumer credit report of or relating to such consumer, the
consumer credit reporting agency shall provide the consumer with a
unique personal identification number or password, or other device which
shall only be used by the consumer when providing authorization for the
release of his or her consumer credit report for a specific party or
specific period of time. The unique personal identification number or
password, or other device to be used by the consumer shall not be a
social security number or a sequential portion thereof. Any use of the
unique personal identification number or password or other device other
than provided for in this section is prohibited.
(d) If the consumer wishes to allow his or her consumer credit report
to be accessed for a specific party or a specific period of time while a
freeze is in place, he or she shall contact the consumer credit report-
ing agency via mail with confirmation of delivery, telephone, secure
electronic means or other method developed by such consumer credit
reporting agency pursuant to subdivision (f) of this section using a
point of contact designated by such consumer credit reporting agency,
request that the freeze be temporarily lifted, and provide the follow-
ing:
(1) proper identification;
(2) the unique personal identification number or password provided by
the consumer credit reporting agency pursuant to subdivision (c) of this
section; AND
(3) the proper information regarding the party to which the consumer
credit report should be available or the time period for which the
consumer credit report shall be available to users of such report[; and
(4) payment of any applicable fee].
(e) (1) A consumer credit reporting agency that receives a request
from a consumer to temporarily lift a freeze on a consumer credit report
pursuant to subdivision (d) of this section, shall comply with the
S. 6886--D 3
request: (i) no later than three business days after receiving such
request; (ii) as of September first, two thousand nine, a consumer cred-
it reporting agency that receives a request via the use of a telephone
or secure electronic method provided by the agency, pursuant to subdivi-
sion (d) of this section, shall release a consumer's credit report as
requested by the consumer within fifteen minutes after the request is
received by the consumer credit reporting agency.
(2) A consumer credit reporting agency is not required to temporarily
lift a security freeze within the time provided in subparagraph (ii) of
paragraph one of this subdivision if:
(i) the consumer fails to meet the requirements of subdivision (b) of
this section; or
(ii) the consumer credit reporting agency's ability to temporarily
lift the security freeze within fifteen minutes is prevented by:
(A) an act of God, including fire, earthquakes, hurricanes, storms, or
similar natural disaster or phenomena;
(B) unauthorized or illegal acts by a third party, including terror-
ism, sabotage, riot, vandalism, labor strikes or disputes disrupting
operations, or similar occurrence;
(C) operational interruption, including electrical failure, unantic-
ipated delay in equipment or replacement part delivery, computer hard-
ware or software failures inhibiting response time, or similar
disruption;
(D) governmental action, including emergency orders or regulations,
judicial or law enforcement action, or similar directives;
(E) regularly scheduled maintenance, during other than normal business
hours, of, or updates to, the consumer reporting agency's systems; or
(F) commercially reasonable maintenance of, or repair to, the consumer
reporting agency's systems that is unexpected or unscheduled.
(f) A consumer credit reporting agency may develop procedures involv-
ing other secure methods of communication, including the use of the
internet, or other electronic media to receive and process a request
from a consumer to temporarily lift a freeze on a consumer credit report
pursuant to subdivision (d) of this section in an expedited manner.
(g) The department of state shall monitor the state of technology
relating to the means available to process requests for the lifting or
removal of a security freeze, and shall report to the legislature when
it is determined that the technology to process requests for the lifting
or removal of a security freeze in a shorter period of time than that
set forth in subdivision (e) of this section is available.
(h) A consumer credit reporting agency shall remove or temporarily
lift a freeze placed on the consumer credit report of or relating to a
consumer only in the following cases:
(1) upon consumer request, pursuant to subdivision (d) or (k) of this
section; or
(2) if the consumer credit report of or relating to such consumer was
frozen due to a material misrepresentation of fact by the consumer. If a
consumer credit reporting agency intends to remove a freeze upon a
consumer credit report pursuant to this paragraph, the consumer credit
reporting agency shall notify the consumer in writing, by first class
mail, within three business days prior to removing the freeze on such
consumer credit report.
(i) If a third party requests access to a consumer credit report on
which a security freeze is in effect, and this request is in connection
with an application for credit or any other use, and the consumer does
S. 6886--D 4
not allow his or her consumer credit report to be accessed for that
period of time, the third party may treat the application as incomplete.
(j) If a consumer requests a security freeze, the consumer credit
reporting agency shall disclose the process of placing and temporarily
lifting a freeze, and the process for allowing access to information
from such consumer credit report for a specific party or a period of
time while the freeze is in place.
(k) (1) A security freeze shall remain in place until the consumer
requests, using a point of contact designated by the consumer credit
reporting agency, that the security freeze be removed and provides the
following:
(i) proper identification; AND
(ii) the unique personal identification number or password or similar
device provided by the consumer credit reporting agency pursuant to
subdivision (c) of this section[; and
(iii) a fee, if applicable].
(2) A consumer credit reporting agency shall remove a security freeze
within three business days of receiving a request for removal from the
consumer pursuant to paragraph one of this subdivision.
(l) A consumer credit reporting agency shall require proper identifi-
cation of the person making a request to place or remove a security
freeze.
(m) The provisions of this section do not apply to the use of a
consumer credit report by any of the following:
(1) a person or entity, or a subsidiary, affiliate, or agent of that
person or entity, or an assignee of a financial obligation owing by the
consumer to that person or entity, or a prospective assignee of a finan-
cial obligation owing by the consumer to that person or entity in
conjunction with the proposed purchase of the financial obligation, with
which the consumer has or had prior to assignment an account or
contract, including a demand deposit account, or to whom the consumer
issued a negotiable instrument, for the purposes of reviewing the
account or collecting the financial obligation owing for the account,
contract, or negotiable instrument. For purposes of this paragraph,
"reviewing the account" includes activities related to account mainte-
nance, monitoring, credit line increases, and account upgrades and
enhancements;
(2) a subsidiary, affiliate, agent, assignee, or prospective assignee
of a person to whom access has been granted for purposes of facilitating
the extension of credit or other permissible use;
(3) any state or local agency, law enforcement agency, court, private
collection agency, or person acting pursuant to a court order, warrant,
or subpoena;
(4) a child support agency acting pursuant to title iv-d of the social
security act (42 U.S.C. et seq.);
(5) the state or its political subdivisions or its agents or assigns
acting to investigate fraud or acting to investigate or collect delin-
quent taxes or unpaid court orders or to fulfill any of its other statu-
tory responsibilities provided such responsibilities are consistent with
a permissible purpose under 15 U.S.C. section 1681b;
(6) the use of credit information for the purposes of prescreening as
provided for by the federal fair credit reporting act;
(7) any person or entity administering a credit file monitoring
subscription or similar service to which the consumer has subscribed; or
S. 6886--D 5
(8) any person or entity for the purpose of providing a consumer with
a copy of his or her consumer credit report or score upon the request of
such consumer.
(n) [(1) (i) No consumer credit reporting agency shall charge a fee to
a victim of identity theft who submits a copy of a signed federal trade
commission ID theft victim's affidavit, or a report of ID theft from a
law enforcement agency to such consumer credit reporting agency.
(ii) No consumer credit reporting agency shall charge a fee to a
domestic violence victim who has submitted to such consumer credit
reporting agency:
(A) a valid domestic violence incident report form as such term is
defined in subdivision fifteen of section eight hundred thirty-seven of
the executive law;
(B) a valid police report;
(C) a valid order of protection; or
(D) a signed affidavit from a licensed medical or mental health care
provider, employee of a court acting within the scope of his or her
employment, social worker, a rape crisis counselor as defined in section
forty-five hundred ten of the civil practice law and rules, or advocate
acting on behalf of an agency that assists domestic violence victims.
For the purposes of this subdivision, the term "domestic violence
victim" means an individual who is a victim of a family offense, as
described in subdivision one of section 530.11 of the criminal procedure
law, or an offense committed by a member of such individual's immediate
family, as defined in subdivision four of section 120.40 of the penal
law.
(2) No consumer credit reporting agency shall charge a fee to a
consumer requesting the placement of a security freeze when such consum-
er has not previously requested the placement of a security freeze from
such consumer credit reporting agency. Except as provided for in para-
graph one of this subdivision, a consumer credit reporting agency may
charge a consumer a fee not to exceed five dollars for the placement of
a second or subsequent freeze or for the removal of a freeze or the
temporary lift of a freeze for a specific party or period of time or for
the issuance of a replacement personal identification number or password
when the consumer fails to retain the personal identification number or
password provided to such consumer by such consumer credit reporting
agency pursuant to subdivision (c) of this section.] NO CONSUMER CREDIT
REPORTING AGENCY SHALL CHARGE A FEE TO ANY CONSUMER FOR THE PLACEMENT OF
ANY SECURITY FREEZE, THE REMOVAL OF ANY SECURITY FREEZE, THE TEMPORARY
LIFT OF ANY SECURITY FREEZE FOR A SPECIFIC PARTY OR PERIOD OF TIME, OR
THE ISSUANCE OF ANY REPLACEMENT PERSONAL IDENTIFICATION NUMBER OR PASS-
WORD WHEN THE CONSUMER FAILS TO RETAIN THE PERSONAL IDENTIFICATION
NUMBER OR PASSWORD PROVIDED TO SUCH CONSUMER BY SUCH CONSUMER CREDIT
REPORTING AGENCY PURSUANT TO SUBDIVISION (C) OF THIS SECTION.
(o) If a security freeze is in place, a consumer credit reporting
agency shall not change any of the following official information in a
consumer credit report without sending a written confirmation of the
change to the consumer within thirty days of the change being posted to
the file of or relating to such consumer: name, date of birth, social
security number, and address. Written confirmation is not required for
technical modifications of the official information of or relating to
such consumer, including name and street abbreviations, complete spell-
ings, or transposition of numbers or letters. In the case of an address
change, the written confirmation shall be sent to both the new address
and to the former address.
S. 6886--D 6
(p) The following entities are not required to place a security freeze
on a consumer credit report:
(1) a consumer credit reporting agency that acts only as a reseller of
credit information by assembling and merging information contained in
the data base of another consumer credit reporting agency or multiple
consumer credit reporting agencies, and does not maintain a permanent
data base of credit information from which new consumer credit reports
are produced. However, a consumer credit reporting agency acting as a
reseller shall honor any security freeze placed on a consumer credit
report by another consumer credit reporting agency;
(2) a check services or fraud prevention services company, which
issues reports on incidents of fraud or authorizations for the purpose
of approving or processing negotiable instruments, electronic funds
transfers, or similar methods of payments; or
(3) a deposit account information service company, which issues
reports regarding account closures due to fraud, substantial overdrafts,
ATM abuse, or similar negative information regarding a consumer, to
inquiring banks or other financial institutions for use only in review-
ing a consumer request for a deposit account at the inquiring bank or
financial institution.
(q) (1) Any time a consumer credit reporting agency is required to
send a summary of rights required under 15 U.S.C. section 1681g, to a
consumer residing in this state the following notice shall be included
with such summary of rights:
"NEW YORK CONSUMERS HAVE THE RIGHT TO OBTAIN A SECURITY FREEZE.
YOU HAVE A RIGHT TO PLACE A "SECURITY FREEZE" ON YOUR CREDIT REPORT,
WHICH WILL PROHIBIT A CONSUMER CREDIT REPORTING AGENCY FROM RELEASING
INFORMATION IN YOUR CREDIT REPORT WITHOUT YOUR EXPRESS AUTHORIZATION. A
CONSUMER CREDIT REPORTING AGENCY IS PROHIBITED FROM CHARGING YOU A FEE
FOR THE PLACEMENT, REMOVAL, OR TEMPORARY LIFT OF A SECURITY FREEZE, OR
FOR THE ISSUANCE OF A REPLACEMENT PERSONAL IDENTIFICATION NUMBER (PIN)
OR PASSWORD IN THE EVENT THAT YOU FAIL TO RETAIN THE ORIGINAL PIN OR
PASSWORD PROVIDED TO YOU BY SUCH CONSUMER CREDIT REPORTING AGENCY. A
SECURITY FREEZE MUST BE REQUESTED IN WRITING DELIVERY CONFIRMATION
REQUESTED OR VIA TELEPHONE, SECURE ELECTRONIC MEANS, OR OTHER METHODS
DEVELOPED BY THE CONSUMER CREDIT REPORTING AGENCY. THE SECURITY FREEZE
IS DESIGNED TO PREVENT CREDIT, LOANS, AND SERVICES FROM BEING APPROVED
IN YOUR NAME WITHOUT YOUR CONSENT. HOWEVER, YOU SHOULD BE AWARE THAT
USING A SECURITY FREEZE TO TAKE CONTROL OVER WHO GETS ACCESS TO THE
PERSONAL AND FINANCIAL INFORMATION IN YOUR CREDIT REPORT MAY DELAY,
INTERFERE WITH, OR PROHIBIT THE TIMELY APPROVAL OF ANY SUBSEQUENT
REQUEST OR APPLICATION YOU MAKE REGARDING A NEW LOAN, CREDIT, MORTGAGE,
GOVERNMENT SERVICES OR PAYMENTS, INSURANCE, RENTAL HOUSING, EMPLOYMENT,
INVESTMENT, LICENSE, CELLULAR PHONE, UTILITIES, DIGITAL SIGNATURE,
INTERNET CREDIT CARD TRANSACTION, OR OTHER SERVICES, INCLUDING AN EXTEN-
SION OF CREDIT AT POINT OF SALE. WHEN YOU PLACE A SECURITY FREEZE ON
YOUR CREDIT REPORT, YOU WILL BE PROVIDED A PERSONAL IDENTIFICATION
NUMBER OR PASSWORD TO USE IF YOU CHOOSE TO REMOVE THE FREEZE ON YOUR
CREDIT REPORT OR AUTHORIZE THE RELEASE OF YOUR CREDIT REPORT TO A
SPECIFIC PARTY OR FOR A PERIOD OF TIME AFTER THE FREEZE IS IN PLACE. TO
PROVIDE THAT AUTHORIZATION YOU MUST CONTACT THE CONSUMER CREDIT REPORT-
ING AGENCY AND PROVIDE ALL OF THE FOLLOWING:
(1) THE PERSONAL IDENTIFICATION NUMBER OR PASSWORD;
(2) PROPER IDENTIFICATION TO VERIFY YOUR IDENTITY; AND
S. 6886--D 7
(3) THE PROPER INFORMATION REGARDING THE PARTY OR PARTIES WHO ARE TO
RECEIVE THE CREDIT REPORT OR THE PERIOD OF TIME FOR WHICH THE REPORT
SHALL BE AVAILABLE TO USERS OF THE CREDIT REPORT[; AND
(4) PAYMENT OF ANY APPLICABLE FEE].
A CONSUMER CREDIT REPORTING AGENCY MUST AUTHORIZE THE RELEASE OF YOUR
CREDIT REPORT NO LATER THAN THREE BUSINESS DAYS AFTER RECEIVING THE
ABOVE INFORMATION. EFFECTIVE SEPTEMBER FIRST, TWO THOUSAND NINE, A
CONSUMER CREDIT REPORTING AGENCY THAT RECEIVES A REQUEST VIA TELEPHONE
OR SECURE ELECTRONIC METHOD SHALL RELEASE A CONSUMER'S CREDIT REPORT
WITHIN FIFTEEN MINUTES WHEN THE REQUEST IS RECEIVED.
A SECURITY FREEZE DOES NOT APPLY TO CIRCUMSTANCES IN WHICH YOU HAVE AN
EXISTING ACCOUNT RELATIONSHIP AND A COPY OF YOUR REPORT IS REQUESTED BY
YOUR EXISTING CREDITOR OR ITS AGENTS OR AFFILIATES FOR CERTAIN TYPES OF
ACCOUNT REVIEW, COLLECTION, FRAUD CONTROL OR SIMILAR ACTIVITIES.
IF YOU ARE ACTIVELY SEEKING CREDIT, YOU SHOULD UNDERSTAND THAT THE
PROCEDURES INVOLVED IN LIFTING A SECURITY FREEZE MAY SLOW YOUR APPLICA-
TION FOR CREDIT. YOU SHOULD PLAN AHEAD AND LIFT A FREEZE, EITHER
COMPLETELY IF YOU ARE SHOPPING AROUND, OR SPECIFICALLY FOR A CERTAIN
CREDITOR, BEFORE APPLYING FOR NEW CREDIT. WHEN SEEKING CREDIT OR PURSU-
ING ANOTHER TRANSACTION REQUIRING ACCESS TO YOUR CREDIT REPORT, IT IS
NOT NECESSARY TO RELINQUISH YOUR PIN OR PASSWORD TO THE CREDITOR OR
BUSINESS; YOU CAN CONTACT THE CONSUMER CREDIT REPORTING AGENCY DIRECTLY.
IF YOU CHOOSE TO GIVE OUT YOUR PIN OR PASSWORD TO THE CREDITOR OR BUSI-
NESS, IT IS RECOMMENDED THAT YOU OBTAIN A NEW PIN OR PASSWORD FROM THE
CONSUMER CREDIT REPORTING AGENCY."
(2) If a consumer requests information about a security freeze, such
consumer shall be provided with the notice set forth in paragraph one of
this subdivision and with any other information necessary to place,
temporarily lift or permanently lift a security freeze, including but
not limited to the address, telephone number or point of contact at
which the consumer credit reporting agency receives such requests.
(r) When a consumer credit reporting agency erroneously releases a
consumer credit report subject to a security freeze or any information
contained in such consumer credit report, the consumer credit reporting
agency shall send written notification to the affected consumer within
three business days following discovery or notification of such errone-
ous release. Such notification shall also inform the consumer of the
nature of the information released and identify and provide contact
information for the recipient of such information or consumer credit
report.
(s) Whenever there shall be a violation of this section, application
may be made by the attorney general in the name of the people of the
state of New York to a court or justice having jurisdiction by a special
proceeding to issue an injunction, and upon notice to the defendant of
not less than five days, to enjoin and restrain the continuance of such
violations; and if it shall appear to the satisfaction of the court or
justice that the defendant has, in fact, violated this section, an
injunction may be issued by such court or justice, enjoining and
restraining any further violation, without requiring proof that any
person has, in fact, been injured or damaged thereby. In any such
proceeding, the court may make allowances to the attorney general as
provided in paragraph six of subdivision (a) of section eighty-three
hundred three of the civil practice law and rules, and direct restitu-
tion. Whenever the court shall determine that a violation of this
section has occurred, the court may impose a civil penalty of not more
than five thousand dollars for each violation. In connection with any
S. 6886--D 8
such proposed application, the attorney general is authorized to take
proof and make a determination of the relevant facts and to issue
subpoenas in accordance with the civil practice law and rules.
§ 2. Paragraph (g-1) of subdivision 2 of section 65.10 of the penal
law is REPEALED.
§ 3. This act shall take effect on the one hundred eightieth day after
it shall have become a law.
