Protect Kids' Credit Reports

Section 1. Subdivision (m) of section 380-a of the general business law, as added by chapter 63 of the laws of 2006, is amended to read as follows:

(m) The term "security freeze" or "freeze" means:

1. a notice placed in the consumer credit report of or relating to a consumer, at the request of such consumer and subject to certain exceptions, that prohibits the consumer credit reporting agency from releasing the consumer credit report, the contents of such report or the credit score of such consumer[.];

2. if a consumer credit reporting agency does not have a file pertaining to a protected consumer, a restriction that:

a. is placed on the protected consumer's record in accordance with the provisions of this section; and

b. prohibits the consumer credit reporting agency from releasing to protected consumer's record except as provided in section three hundred eighty-v of this article; or

3. if a consumer credit reporting agency has a file pertaining to the protected consumer, a restriction that:

a. is placed on the protected consumer's consumer report in accordance with section three hundred eighty-v of this article; and

b. prohibits the consumer credit reporting agency from releasing the protected consumer's consumer credit report or any information derived from the protected consumer's consumer credit report except as provided in section three hundred eighty-v of this article.

EXPLANATION--Matter in italics (underscored) is new; matter in brackets

[ ] is old law to be omitted.

LBD04574-01-7

A. 6782 2

§ 2. Section 380-a of the general business law is amended by adding five new subdivisions (u), (v), (w), (x) and (y) to read as follows:

(u) The term "protected consumer" means an individual who is:

1. under the age of sixteen years at the time a request for the placement of a security freeze is made; or

2. an incapacitated person or a protected person for whom a guardian or conservator has been appointed.

(v) The term "record" means a compilation of information that:

1. identifies a protected consumer;

2. is created by a consumer credit reporting agency solely for the purpose of complying with section three hundred eighty-v of this article; and

3. may not be created or used to consider the protected consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living.

(w) The term "representative" means a person who provides to a consumer credit reporting agency sufficient proof of authority to act on behalf of a protected consumer; includes, but is not limited to, a parent or legal guardian.

(x) The term "sufficient proof of authority" means documentation that shows a representative has authority to act on behalf of a protected consumer; includes:

1. an order issued by a court of law; or

2. a lawfully executive and valid power of attorney; or

3. a written, notarized statement signed by a representative that expressly describes the authority of the representative to act on behalf of a protected consumer.

(y) The term "sufficient proof of identification" means information or documentation that identifies a protected consumer or a representative of a protected consumer; includes:

1. a social security number or a copy of a social security card issued by the social security administration;

2. a certified or official copy of a birth certificate issued by the entity authorized to issue the birth certificate; or

3. a copy of a driver's license, an identification card issued by the department of motor vehicles, or any other government-issued identification.

§ 3. Section 380-v of the general business law, as relettered by chapter 441 of the laws of 2014, is relettered section 380-w and a new section 380-v is added to read as follows:

§ 380-v. Protected consumer credit reporting. (a) This section does not apply to the use of a protected consumer's consumer credit report or record by:

1. a person administering a credit file monitoring subscription service to which:

(i) the protected consumer has subscribed; or

(ii) the representative of the protected consumer has subscribed on behalf of the protected consumer;

2. a person providing the protected consumer or the protected consumer's representative with a copy of the protected consumer's consumer credit report on request of the protected consumer or the protected consumer's representative; or

3. an entity listed in paragraph one, two, three, four, five or six of subdivision (m) of section three hundred eighty-t of this article.

(b) 1. A consumer reporting agency shall place a security freeze for a protected consumer if:

A. 6782 3

(i) the consumer credit reporting agency receives a request from the protected consumer's representative for the placement of the security freeze under this section; and

(ii) the protected consumer's representative:

(A) submits the request to the consumer credit reporting agency at the address or other point of contact and in the manner specified under subdivision (a) of this section;

(B) provides to the consumer credit reporting agency sufficient proof of identification of the consumer and the representative;

(C) provides to the consumer credit reporting agency sufficient proof of authority to act on behalf of the protected consumer; and

(D) pays to the consumer credit reporting agency a fee as provided in subdivision (h) of this section.

2. If a consumer credit reporting agency does not have a file pertaining to a protected consumer when the consumer credit reporting agency receives a request under paragraph one of this subdivision, the consumer credit reporting agency shall create a record for the protected consumer.

(c) 1. Within thirty days after receiving a request that meets the requirements of paragraph one of subdivision (b) of this section, a consumer credit reporting agency shall place a security freeze for the protected consumer.

2. The consumer credit reporting agency shall send a written confirmation of the placement of the security freeze to a protected customer's representative within five business days of placing such freeze.

(d) Unless a security freeze for a protected consumer is removed in accordance with subdivision (f) or (i) of this section, a consumer credit reporting agency may not release the protected consumer's consumer credit report, any information derived from the protected consumer's consumer credit report, or any record created for the protected consumer.

(e) A security freeze for a protected consumer placed under subdivision (c) of this section shall remain in effect until:

1. the protected consumer or the protected consumer's representative requests the consumer credit reporting agency to remove the security freeze in accordance with subdivision (f) of this section; or

2. the security freeze is removed in accordance with subdivision (i) of this section.

(f) If a protected consumer or a protected consumer's representative wishes to remove a security freeze for the protected consumer, the protected consumer or the protected consumer's representative shall:

1. submit a request for the removal of the security freeze to the consumer credit reporting agency at the address or other point of contact and in the manner specified by the consumer credit reporting agency;

2. provide to the consumer credit reporting agency:

(i) in the case of a request by the protected consumer:

(A) proof that the sufficient proof of authority for the protected consumer's representative to act on behalf of the protected consumer is no longer valid; and

(B) sufficient proof of identification of the protected consumer; or

(ii) in the case of a request by the representative of a protected consumer:

(A) sufficient proof of identification of the protected consumer and the representative; and

A. 6782 4

(B) sufficient proof of authority to act on behalf of the protected consumer; and

(C) pay to the consumer credit reporting agency a fee as provided in subdivision (h) of this section.

(g) Within thirty days after receiving a request that meets the requirements of subdivision (f) of this section, the consumer credit reporting agency shall remove the security freeze for the protected consumer.

(h) 1. Except as provided in paragraph two of this subdivision, a consumer credit reporting agency may not charge a fee for any service performed under this section.

2. A consumer credit reporting agency may charge a reasonable fee, not exceeding five dollars, for each placement or removal of a security freeze for a protected consumer.

3. Notwithstanding the provisions of paragraph two of this subdivision, a consumer credit reporting agency may not charge any fee under this section if the protected consumer's representative:

(i) has obtained a report of alleged identity fraud against the protected consumer; and

(ii) provides a copy of the report to the consumer credit reporting agency.

(i) A consumer credit reporting agency may remove a security freeze for a protected consumer or delete a record of a protected consumer if the security freeze was placed or the record was created based on a material misrepresentation of fact by the protected consumer or the protected consumer's representative.

(j) When a consumer credit reporting agency erroneously releases a protected consumer's consumer credit report subject to a security freeze or any information contained in such consumer credit report, the consumer credit reporting agency shall send written notification to the affected protected consumer's representative within three business days following discovery or notification of such erroneous release. Such notification shall also inform the protected consumer of the nature of the information released and identify and provide contact information for the recipient of such information or consumer credit report.

(k) Whenever there shall be a violation of this section, application may be made by the attorney general in the name of the people of the state of New York to a court or justice having jurisdiction by a special proceeding to issue an injunction, and upon notice to the defendant of not less than five days, to enjoin and restrain the continuance of such violations; and if it shall appear to the satisfaction of the court or justice that the defendant has, in fact, violated this section, an injunction may be issued by such court or justice, enjoining and restraining any further violation, without requiring proof that any person has, in fact, been injured or damaged thereby. In any such proceeding, the court may make allowances to the attorney general as provided in paragraph six of subdivision (a) of section eighty-three hundred three of the civil practice law and rules, and direct restitution. Whenever the court shall determine that a violation of this section has occurred, the court may impose a civil penalty of not more than five thousand dollars for each violation. In connection with any such proposed application, the attorney general is authorized to take proof and make a determination of the relevant facts and to issue subpoenas in accordance with the civil practice law and rules.

§ 4. This act shall take effect on the ninetieth day after it shall have become a law.