Implements provisions to protect credit reports of certain consumers

This bill authorizes specified representatives to request a security freeze on the consumer credit report of children under the age of 16 and individuals under guardianship; requires a consumer credit reporting agency to place a security freeze for a specified protected consumer under specified circumstances and within a specified period of time; authorizes consumer credit reporting agency to create a credit report for a protected consumer who does not have a credit report.

Summary of provisions

Section 1 of the bill amends Section 380-a, subsection (m) of the General Business Law by adding definitions:

Section 3 amends the general business law by adding a new section, Section 380-u, to read as follows:

Subsection A excludes various entities from the provisions of this bill

Subsection B requires:

1. a consumer credit reporting agency to place a freeze on a protected consumer's account if said protected consumer's representative requests a security freeze on the account; and provides sufficient identification that they are authorized to do so on behalf of the protected consumer

2. a consumer credit reporting agency to create a credit report for the protected consumer if he or she does not already have one.

Subsection C sets the time requirements for a consumer credit reporting agency to place a security freeze once a request has been received; requires a consumer credit reporting agency to send a written confirmation of the placement of a security freeze to the protected consumer's representative

Subsection D relates to the release of a protected consumer's credit report.

Subsection E relates to specific instances under which a security freeze on a protected consumer's credit report may be removed.

Subsection F relates to the procedure by which a security freeze can be removed.

Subsection G required a consumer credit reporting agency to remove a security freeze within 30 days of receiving an authorized request to do so.

Subsection H prohibits a consumer credit reporting agency from charging a fee for any services performed under this section except for the placement or removal of a security freeze; allows for a charge not to exceed $5.

Subsection I allows a consumer credit reporting agency to remove a security freeze for a protected consumer or delete a record of a protected consumer if the security freeze was placed or the record was created based on a material misrepresentation of fact by the protected consumer or the protected consumer's representative.

Subsection J requires that when a consumer credit reporting agency erroneously releases a protected consumer's consumer credit report subject to a security freeze or any information contained in such consumer credit report, the consumer credit reporting agency shall send written notification to the affected protected consumer's representative within three business days following discovery or notification of such erroneous release.

Subsection K relates to penalties associated with violations of this section.

Section 4 adds the effective date.

Justification

At a time when identity theft is an increasing threat to New Yorkers, children and those unable to care for themselves face an even greater risk of having their identity stolen. Under current state law, credit agencies must place a security freeze on the credit of anyone who requests it. However, they can refuse to freeze the credit of those who do not have a pre-existing credit report. When credit bureaus collect data for people applying for credit from lending partners, they get a name and Social Security number, but they don't have data to double check someone's actual age due to a lack of information sharing between credit reporting agencies and the Social Security Administration.

Since most children do not have a line of credit or other credit history, they do not have a preexisting credit report. Thus, the only way a credit report can be created is if the child opens a line of credit, which is unlikely, or someone fraudulently opens a line of credit under their name and social security number, which is becoming increasingly common. A study released last year by ID Analytics, a California-based consumer risk management firm, found that about 140,000 identity frauds against minors occur each year. Additionally, a study by researchers at Carnegie Mellon found that children are more likely than adults to be targeted for identity theft. Parents cannot protect their children from identity theft and sometimes, a child won't even realize they have been the victim of identity theft until years later when they try to get a loan or open a credit card account.

This legislation would seek to correct this problem by requiring consumer credit reporting agencies to create a credit report for a child under 16 years of age when requested by the child's parent or guardian. The child's representative could also place a security freeze on the child's credit report, which will allow parents to be proactive in protecting their children from identity theft. In addition, these same protections will be provided to incapacitated individuals under the care of a guardianship.

Fiscal implications

None.

Effective date

This act shall take effect on the ninetieth day after it has become a law.