A BILL TO BE ENTITLED
AN ACT to require any consumer credit reporting agency to, upon the written request of a consumer, place a security freeze that prohibits the agency from providing a consumer's credit report to a third party. 
The General Assembly of North Carolina enacts:
SECTION 1.  Chapter 25B of the General Statutes is amended by adding a new Article to read:
"Article 2.
"Security Freeze on Consumers' Credit Reports.
"§ 25B‑10. Definitions.
As used in this Article, the following definitions apply:
(1)	'Consumer credit file' means all of the information about a consumer that is recorded and retained by a consumer credit reporting agency regardless of how the information is stored.
(2)	'Consumer credit report' means a communication or other information by a consumer credit reporting agency relating to the creditworthiness, credit standing, credit capacity, debts, character, general reputation, personal characteristics, or mode of living of a consumer that is used or expected to be used or collected, wholly or partly, as a factor in establishing the consumer's eligibility for credit or insurance for personal, family, or household purposes, employment purposes, or other purpose authorized under section 603 and section 604 of the Fair Credit Reporting Act, 15 U.S.C. § 1681a and § 1681b, as amended. The term does not include any of the following:
a.	A report containing information solely on a transaction between the consumer and the person making the report.
b.	An authorization or approval of a specific extension of credit directly or indirectly by the issuer of a credit card or similar device.
c.	A report in which a person who has been requested by a third party to make a specific extension of credit directly or indirectly to a consumer makes a decision with respect to the request, if the third party advises the consumer of the name and address of the person to whom the request was made and the person makes the disclosures that must be made under section 615 of the Fair Credit Reporting Act, 15 U.S.C. § 1681m, as amended, to the consumer in the event of adverse action against the consumer.
d.	Any communication of information described in this subdivision among persons related by common ownership or affiliated by corporate control.
(3)	'Consumer credit reporting agency' means a person that regularly engages wholly or partly in the practice of assembling or evaluating consumer credit information or other information on consumers in order to provide consumer credit reports to third parties for monetary fees, for dues, or on a cooperative nonprofit basis. Consumer credit reporting agency does not include a business entity that provides only check verification or check guarantee services.
(4)	'Proper identification' means information generally sufficient to identify a person.
"§ 25B‑20. Request and placement of security freeze.
(a)	A consumer may elect to place a security freeze on his or her consumer credit file by submitting to a consumer credit reporting agency a request in writing that is sent by certified mail and that includes proper identification of the consumer. Subject to G.S. 25B‑50, upon receiving the consumer's request for a security freeze under this section, a consumer credit reporting agency shall place a notice in a consumer's credit file that indicates the file is subject to a security freeze. When a consumer credit file is subject to a security freeze, a consumer credit reporting agency shall not release information from that consumer's credit file and shall not provide a consumer credit report for that consumer to a third party, unless the agency receives prior express authorization under G.S. 25B‑40 from the consumer. This section does not prevent a consumer credit reporting agency from advising a third party that a security freeze is in effect with respect to the consumer's credit file.
(b)	A consumer credit reporting agency shall place a security freeze for a consumer no later than five business days after receiving the written request from the consumer. The consumer credit reporting agency shall, no later than 10 business days after receiving the written request from the consumer, also do all of the following:
(1)	Send a written confirmation of the security freeze to the consumer.
(2)	Disclose in writing to the consumer the process of placing and removing the security freeze and the process for allowing access to information from the consumer's credit file or for providing a consumer credit report for a specific requester or a specific period of time while the security freeze is in effect by temporarily lifting the security freeze under G.S. 25B‑40(b).
(3)	Provide the consumer with a unique personal identification number or password to be used by the consumer to authorize a removal or temporary lifting of the security freeze under G.S. 25B‑40.
(c)	Any consumer credit reporting agency shall honor a security freeze placed by any other consumer credit reporting agency.(d)	A consumer may request in writing a replacement personal identification number or password. The request must comply with the requirements for requesting a security freeze under subsection (a) of this section. The consumer reporting agency shall no later than the third business day after the date the agency receives the request for a replacement personal identification number or password provide the consumer with a new unique personal identification number or password to be used by the consumer instead of the number or password that was provided under subsection (b) of this section.
"§ 25B‑30. Notification of change.
If a security freeze is in place, a consumer credit reporting agency shall notify the consumer in writing of a change in the consumer credit file to the consumer's name, date of birth, social security number, or address no later than 30 calendar days after the date the change is made. The agency shall send notification of a change of address to the new address and former address. This section does not require notice of an immaterial change, including a street abbreviation change or correction of a transposition of letters or misspelling of a word.
"§ 25B‑40. Removal or temporary lifting of security freeze.
(a)	On a request in writing and with proper identification provided by a consumer, including the consumer's personal identification number or password provided under G.S. 25B‑20, a consumer credit reporting agency shall remove a security freeze no later than the third business day after the date the agency receives the request.
(b)	On a request in writing and with proper identification provided by a consumer, including the consumer's personal identification number or password provided under G.S. 25B‑20, a consumer credit reporting agency, shall, no later than the third business day after the date the agency receives the request, temporarily lift the security freeze for either or both of the following:
(1)	A certain properly designated period of time.
(2)	A certain properly identified third party.
(c)	A consumer credit reporting agency may develop procedures involving the use of a telephone, a facsimile machine, the Internet, or another electronic medium to receive and process a request from a consumer under this section.
(d)	A consumer credit reporting agency shall remove a security freeze when the security freeze was placed due to a material misrepresentation of fact by the consumer. The consumer credit reporting agency shall notify the consumer in writing before removing the security freeze under this subsection.
(e)	A consumer credit reporting agency shall not charge a fee for a request under subsection (a) or (b) of this section.
"§ 25B‑50. Exemptions from security freeze.
A consumer credit reporting agency may provide a consumer credit report to all of the following for any consumer credit file that is currently subject to a freeze under G.S. 25B‑20:
(1)	A State or local governmental entity, including a law enforcement agency or court or private collection agency, if the entity, agency, or court is acting under a court order, warrant, subpoena, or administrative subpoena.
(2)	A child support agency acting to investigate or collect child support payments or acting under title IV‑D of the Social Security Act, 42 U.S.C. § 651, et seq., as amended.
(3)	The Department of Health and Human Services acting to investigate fraud.
(4)	The Department of Revenue acting to investigate or collect delinquent sales or franchise taxes.
(5)	A tax assessor‑collector acting to investigate or collect delinquent ad valorem taxes.
(6)	A person for the purposes of prescreening as provided by the Fair Credit Reporting Act, 15 U.S.C. § 1681, et seq., as amended.
(7)	A person with whom the consumer has an account or contract or to whom the consumer has issued a negotiable instrument, or the person's subsidiary, affiliate, agent, assignee, prospective assignee, or private collection agency, for purposes related to that account, contract, or instrument.
(8)	A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under G.S. 25B‑40(b).
(9)	A person who administers a credit file monitoring subscription service to which the consumer has subscribed.
(10)	A check service or fraud prevention service company that issues consumer credit reports:
a.	To prevent or investigate fraud; or
b.	For purposes of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payment.
(11)	A deposit account information service company that issues consumer reports related to account closures caused by fraud, substantial overdrafts, automated teller machine abuses, or similar negative information regarding a consumer to an inquiring financial institution for use by the financial institution only in reviewing a consumer request for a deposit account with that institution.
(12)	A consumer credit reporting agency that:
a.	Acts only to resell credit information by assembling and merging information contained in a database of another consumer credit reporting agency or multiple consumer credit reporting agencies; and
b.	Does not maintain a permanent database of credit information from which new consumer credit reports are produced."§ 25B‑60. Charges for placing security freeze.
A consumer credit reporting agency may impose a reasonable charge on a consumer for each placement of a security freeze. The amount of the charge shall not exceed ten dollars ($10.00). A consumer credit reporting agency shall charge no such fee to any victim of identity fraud under Article 20 of Chapter 14 of the General Statutes who submits a valid police report.
"§ 25B‑70. Injunctive relief; civil penalty.
(a)	The Attorney General may file a suit against a person for either or both of the following:
(1)	Injunctive relief to prevent or restrain a violation of this Article.
(2)	A civil penalty in an amount not to exceed two thousand five hundred dollars ($2,500) for each violation of this Article.
(b)	If the Attorney General brings an action against a person under subsection (a) of this section, and an injunction is granted against the person or the person is found liable for a civil penalty, the Attorney General may recover reasonable expenses, court costs, investigative costs, and attorneys' fees.
(c)	Each day a violation continues or occurs is a separate violation for purposes of imposing a penalty under this section.
"§ 25B‑80. Exemptions from Article.
The provisions of this Article do not apply to any of the following entities:
(1)	A check service or fraud prevention service company that issues consumer credit reports:
a.	To prevent or investigate fraud, or
b.	For purposes of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payment.
(2)	A deposit account information service company that issues consumer credit reports related to account closures caused by fraud, substantial overdrafts, automated teller machine abuses, or similar negative information regarding a consumer to an inquiring financial institution for use by only the financial institution in reviewing a consumer request for a deposit account with that institution."
SECTION 2.  This act becomes effective October 1, 2005.