What's happening
The Credit Empowerment Act eliminates fees for consumers requesting, lifting, or removing security freezes and speeds up processing times.
Why it matters
Removes all fees for consumers. The bill eliminates any charges for placing, lifting (temporarily or permanently), or removing a security freeze on a credit report, making it easier for all consumers to control access to their credit information without financial barriers.
Accelerates response times. Credit agencies must now process freeze, lift, and removal requests within one business day (down from up to three days), meaning consumers can more quickly protect themselves from identity theft or unfreeze their credit for legitimate uses.
Equal access for all consumers. The removal of prior exceptions (such as free freezes only for victims of identity theft or domestic violence) ensures that everyone, regardless of circumstance, can use these protections at no cost, making credit security more universally accessible.
Stronger consumer control and flexibility. Faster, fee-free access to security freezes and lifts empowers consumers to respond more nimbly to fraud risks or credit needs, reducing the hassle and potential delay when applying for loans, jobs, or other services requiring credit checks.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Headline styles
Faster Data Breach Alerts
Plain English, a few words. Used as the page title.
Sponsors
Senator · Senate District 38
No co-sponsors yet.
History
- Referred to consumer protection
- Referred to consumer protection
Full text
7 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
135
2019-2020 Regular Sessions
IN SENATE (Prefiled)
January 9, 2019
Introduced by Sen. CARLUCCI -- read twice and ordered printed, and when printed to be committed to the Committee on Consumer Protection
AN ACT to amend the general business law, in relation to the timeliness of disclosure of a breach of the security of a system that contains private information
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. Short title. This act shall be known and may be cited as the "Credit Empowerment Act".
§ 2. Section 380-t of the general business law, as amended by chapter 279 of the laws of 2008, subdivisions (b) and (n) as separately amended by chapter 406 of the laws of 2008, and subdivision (g) as amended by section 36 of part A of chapter 62 of the laws of 2011, is amended to read as follows:
§ 380-t. Security freeze. (a) A consumer may request that a security freeze be placed on his or her consumer credit report by sending a request in writing with confirmation of delivery requested or via telephone, secure electronic means, or other methods developed by the consumer credit reporting agency to a consumer credit reporting agency at an address, telephone number or secure website designated by such agency to receive such requests. Consumer credit reporting agencies shall have a secure website and a separately dedicated toll-free number to offer information, to process requests and deliver the services provided for under this section.
(b) A consumer credit reporting agency that receives from a consumer a request in accordance with subdivision (a) of this section shall, provided such request is accompanied by proper identification and payment of any applicable fee, place a security freeze on the consumer credit report of or relating to such consumer no later than four business days after receiving such request, provided further, however, that
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD05339-01-9
S. 135 2
for requests received on or after January first, two thousand nine, such consumer credit reporting agency shall place a security freeze on the consumer credit report of or relating to such consumer no later than three business days after receiving such request and for requests received on or after January first, two thousand ten, such consumer credit reporting agency shall place a security freeze on the consumer credit report of or relating to such consumer no later than one business day after receiving such request. Nothing in this subdivision shall be construed to prevent a consumer credit reporting agency from advising a third party that a security freeze is in effect with respect to the consumer credit report of or relating to such consumer. No consumer credit reporting agency shall advise in any manner a third party, of the fact that the consumer requesting the freeze is alleging to be the victim of domestic violence or identity theft, without the written authorization of the consumer.
(c) The consumer credit reporting agency shall send a written confirmation of the placement of a security freeze to the consumer within five business days of placing such freeze. Upon placing the security freeze on the consumer credit report of or relating to such consumer, the consumer credit reporting agency shall provide the consumer with a unique personal identification number or password, or other device which shall only be used by the consumer when providing authorization for the release of his or her consumer credit report for a specific party or specific period of time. The unique personal identification number or password, or other device to be used by the consumer shall not be a social security number or a sequential portion thereof. Any use of the unique personal identification number or password or other device other than provided for in this section is prohibited.
(d) If the consumer wishes to allow his or her consumer credit report to be accessed for a specific party or a specific period of time while a freeze is in place, he or she shall contact the consumer credit reporting agency via mail with confirmation of delivery, telephone, secure electronic means or other method developed by such consumer credit reporting agency pursuant to subdivision (f) of this section using a point of contact designated by such consumer credit reporting agency, request that the freeze be temporarily lifted, and provide the following:
(1) proper identification;
(2) the unique personal identification number or password provided by the consumer credit reporting agency pursuant to subdivision (c) of this section; and
(3) the proper information regarding the party to which the consumer credit report should be available or the time period for which the consumer credit report shall be available to users of such report[; and
(4) payment of any applicable fee].
(e) (1) A consumer credit reporting agency that receives a request from a consumer to temporarily lift a freeze on a consumer credit report pursuant to subdivision (d) of this section, shall comply with the request: (i) no later than [three] one business [days] day after receiving such request; (ii) as of September first, two thousand nine, a consumer credit reporting agency that receives a request via the use of a telephone or secure electronic method provided by the agency, pursuant to subdivision (d) of this section, shall release a consumer's credit report as requested by the consumer within fifteen minutes after the request is received by the consumer credit reporting agency.
S. 135 3
(2) A consumer credit reporting agency is not required to temporarily lift a security freeze within the time provided in subparagraph (ii) of paragraph one of this subdivision if:
(i) the consumer fails to meet the requirements of subdivision (b) of this section; or
(ii) the consumer credit reporting agency's ability to temporarily lift the security freeze within fifteen minutes is prevented by:
(A) an act of God, including fire, earthquakes, hurricanes, storms, or similar natural disaster or phenomena;
(B) unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrence;
(C) operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruption;
(D) governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar directives;
(E) regularly scheduled maintenance, during other than normal business hours, of, or updates to, the consumer reporting agency's systems; or
(F) commercially reasonable maintenance of, or repair to, the consumer reporting agency's systems that is unexpected or unscheduled.
(f) A consumer credit reporting agency may develop procedures involving other secure methods of communication, including the use of the internet, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze on a consumer credit report pursuant to subdivision (d) of this section in an expedited manner.
(g) The department of state shall monitor the state of technology relating to the means available to process requests for the lifting or removal of a security freeze, and shall report to the legislature when it is determined that the technology to process requests for the lifting or removal of a security freeze in a shorter period of time than that set forth in subdivision (e) of this section is available.
(h) A consumer credit reporting agency shall remove or temporarily lift a freeze placed on the consumer credit report of or relating to a consumer only in the following cases:
(1) upon consumer request, pursuant to subdivision (d) or (k) of this section; or
(2) if the consumer credit report of or relating to such consumer was frozen due to a material misrepresentation of fact by the consumer. If a consumer credit reporting agency intends to remove a freeze upon a consumer credit report pursuant to this paragraph, the consumer credit reporting agency shall notify the consumer in writing, by first class mail, within three business days prior to removing the freeze on such consumer credit report.
(i) If a third party requests access to a consumer credit report on which a security freeze is in effect, and this request is in connection with an application for credit or any other use, and the consumer does not allow his or her consumer credit report to be accessed for that period of time, the third party may treat the application as incomplete.
(j) If a consumer requests a security freeze, the consumer credit reporting agency shall disclose the process of placing and temporarily lifting a freeze, and the process for allowing access to information from such consumer credit report for a specific party or a period of time while the freeze is in place.
S. 135 4
(k) (1) A security freeze shall remain in place until the consumer requests, using a point of contact designated by the consumer credit reporting agency, that the security freeze be removed and provides the following:
(i) proper identification; and
(ii) the unique personal identification number or password or similar device provided by the consumer credit reporting agency pursuant to subdivision (c) of this section[; and
(iii) a fee, if applicable].
(2) A consumer credit reporting agency shall remove a security freeze within [three] one business [days] day of receiving a request for removal from the consumer pursuant to paragraph one of this subdivision.
(l) A consumer credit reporting agency shall require proper identification of the person making a request to place or remove a security freeze.
(m) The provisions of this section do not apply to the use of a consumer credit report by any of the following:
(1) a person or entity, or a subsidiary, affiliate, or agent of that person or entity, or an assignee of a financial obligation owing by the consumer to that person or entity, or a prospective assignee of a financial obligation owing by the consumer to that person or entity in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment an account or contract, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument. For purposes of this paragraph, "reviewing the account" includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements;
(2) a subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted for purposes of facilitating the extension of credit or other permissible use;
(3) any state or local agency, law enforcement agency, court, private collection agency, or person acting pursuant to a court order, warrant, or subpoena;
(4) a child support agency acting pursuant to title iv-d of the social security act (42 U.S.C. et seq.);
(5) the state or its political subdivisions or its agents or assigns acting to investigate fraud or acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities provided such responsibilities are consistent with a permissible purpose under 15 U.S.C. section 1681b;
(6) the use of credit information for the purposes of prescreening as provided for by the federal fair credit reporting act;
(7) any person or entity administering a credit file monitoring subscription or similar service to which the consumer has subscribed; or
(8) any person or entity for the purpose of providing a consumer with a copy of his or her consumer credit report or score upon the request of such consumer.
(n) [(1) (i) No consumer credit reporting agency shall charge a fee to a victim of identity theft who submits a copy of a signed federal trade commission ID theft victim's affidavit, or a report of ID theft from a law enforcement agency to such consumer credit reporting agency.
S. 135 5
(ii) No consumer credit reporting agency shall charge a fee to a domestic violence victim who has submitted to such consumer credit reporting agency:
(A) a valid domestic violence incident report form as such term is defined in subdivision fifteen of section eight hundred thirty-seven of the executive law;
(B) a valid police report;
(C) a valid order of protection; or
(D) a signed affidavit from a licensed medical or mental health care provider, employee of a court acting within the scope of his or her employment, social worker, a rape crisis counselor as defined in section forty-five hundred ten of the civil practice law and rules, or advocate acting on behalf of an agency that assists domestic violence victims.
For the purposes of this subdivision, the term "domestic violence victim" means an individual who is a victim of a family offense, as described in subdivision one of section 530.11 of the criminal procedure law, or an offense committed by a member of such individual's immediate family, as defined in subdivision four of section 120.40 of the penal law.
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the general business law, in relation to the timeliness of disclosure of a breach of the security of a system that contains private information
Purpose
To require that persons or businesses possessing consumer's personal information provide a free credit information freeze to any consumer.
Summary of provisions
Section 1 - Titles this bill "the Credit Empowerment Act"
Read the full memo (840 words)
Section 2 - Requires that any person or business under the jurisdiction of the general business law provide any consumer whose personal informa- tion they are in possession of with a credit freeze, free of charge upon request. No reason is required to request such a freeze and it will be provided free of charge. Any lift of a freeze must also be performed free of charge. Likewise, a new indefinite freeze may be placed on personal information by the requesting consumer for any reason, also free of charge. Removes current identification requirements currently applied to victims of identity theft and domestic abuse. Lowers the period of time a business has to provide a credit "thaw" from 3 days to 24 hours. Applies existing credit freeze law to all credit information- related businesses.
Section 3 - Effective date.
Existing law
Currently, credit freezes for consumers are only given for free the first time. Companies may charge a fee for "thawing" and refreezing consumer credit information. Additionally, though fees may be waived for victims of domestic abuse or identification theft, they must provide burdensome identification such as a police report or medical report. Businesses currently have 3 days ' to "thaw" consumer credit informa- tion. Finally, certain businesses are exempt from the current credit freeze law. These include, Consumer credit reporting agencies that act only as resellers of credit information by assembling and merging infor- mation contained in the data base of another consumer credit reporting agency (these must only honor an existing freeze, but do not have to place one on data they have received), most check services or fraud prevention services that act as clearinghouses, and deposit account information services that monitor debit transfers for unusual activity.
Justification
Recent headlines have been dominated by a massive data breach that impacted the largest credit-reporting firm in the United States. This breach is estimated to have effected 143 million Americans, or 44% of the population. Millions suddenly found that their birthdates, home addresses, telephone numbers, and, in some cases, even their social security numbers and drivers license numbers had been leaked. The implications of such a large scale and egregious breach of consumer data security are serious. Millions have been exposed to the possibility of becoming victims of identity theft. This can lead to ongoing credit problems and major costs to consumers to remedy the damage done. We must do more to make sure that data breaches are prevented. But just as important, is making sure consumers and law enforcement have the tools available to mitigate damage as soon as a breach occurs. This bill, part of a larger package that will target consumer data breaches at every stage, will provide one of those tools.
Under current law, there is no requirement that businesses provide consumers with a credit freeze, whether in the event of a data breach or otherwise. This bill corrects this by requiring that businesses provide consumers with a credit freeze upon request, no matter the reason, free of charge. The freeze will last for an indefinite period of time and may only be lifted at the consumer's request, also free of charge. Finally, the consumer may resume the freeze at any time, free of charge.
A credit freeze is a complete hold on the ability of companies to share consumers personal information with other companies for purposes of credit reporting.
Access to an immediate credit freeze would have done much to mitigate the damage done by the recent major data breach. It would have given consumers the knowledge that their data was no longer floating in the stream of commerce at a time it was already compromised. The firm that was compromised did offer to provide credit freezes, but attempted to charge consumers for the service. It was only after several days of immense public pressure that the firm began to provide them for free and the offer only stood for 30 days. This does not go nearly far enough.
The reality is that consumers do not seek out credit reporting firms looking to provide them with their confidential personal information. These companies are given that information by other firms looking to run credit reports. This is not right. It should be the consumer who has the final say over whether or not their data is available and who may possess it. Furthermore, this should be a right the consumer has, and not a privilege for which they must pay. This bill puts that power back in the hands of the consumer.
Legislative history
2017-18: S6891 - CONSUMER PROTECTION
Fiscal implications
None to the state.
Effective date
Immediately.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.