A BILL TO BE ENTITLED
AN ACT to require any consumer credit reporting agency to, upon the written request of a consumer, place a security freeze that prohibits the agency from providing a consumer's credit report to a third party. 
The General Assembly of North Carolina enacts:
SECTION 1.  Chapter 75 of the General Statutes is amended by adding a new Article to read:
"Article 2A.
"Credit Report Protection Act.
"§ 75‑60.  Title.
This Article may be cited as the "Credit Report Protection Act". 
"§ 75‑61.  Definitions.
The following definitions apply in this Article:
(1)	Business. – A sole proprietorship, partnership, corporation, association, or other group, however organized and whether or not organized to operate at a profit. Business includes a financial institution organized, chartered, or holding a license or authorization certificate under the laws of this State, any other state, the United States, or any other country, or the parent or the subsidiary of any such financial institution. Business shall not include any government or governmental subdivision or agency.(2)	Consumer. – An individual.
(3)	Consumer or credit reporting agency. – Any person that, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties.
(4)	Consumer report or credit report. – Any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living that is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for any one or more of the following:
a.	Credit to be used primarily for personal, family, or household purposes.
b.	Employment purposes.
c.	Any other purpose authorized under 15 U.S.C. § 1681b.
(5)	Credit card. – Defined in section 103 of the Truth in Lending Act (15 U.S.C. § 160, et seq.).
(6)	Person. – Any individual, partnership, corporation, trust, estate, cooperative, association, government, or governmental subdivision or agency, or other entity.
(7)	Personal information. – An individual's first name or first initial and last name in combination with identifying information as defined in G.S. 14‑113.20(b) or any identifying information, when not in connection with the individual's first name or first initial and last name, that if compromised would be sufficient to perform or attempt to perform identity theft against the person whose information was compromised.
(8)	Records. – Any material on which written, drawn, spoken, visual, or electromagnetic information is recorded or preserved, regardless of physical form or characteristics. Records do not include publicly available directories containing information an individual has voluntarily consented to have publicly disseminated or listed, such as name, address, or telephone number.
(9)	Security breach. – Unauthorized acquisition of records or data that compromises the security or confidentiality of personal information. Security breach does not include a good faith acquisition of personal information by an employee or agent of the business for a legitimate purpose, provided that the personal information is not used for a purpose unrelated to the business or subject to further unauthorized disclosure.
(10)	Security freeze. – Notice, at the request of the consumer and subject to certain exceptions under G.S. 75‑63(p), that prohibits the consumer reporting agency from releasing all or any part of the consumer's credit report or any information derived from it without the express authorization of the consumer.
"§ 75‑62.  Security freeze.
(a)	If a consumer elects to place a security freeze on his or her credit report, a credit reporting agency shall not release the consumer's credit report or information to a third party without prior express authorization from the consumer. This subsection does not prevent a consumer reporting agency from advising a third party that a security freeze is in effect with respect to the consumer's credit report.
(b)	A consumer may elect to place a security freeze on his or her credit report by making a request directly to a consumer reporting agency by any of the following methods:
(1)	By certified mail.
(2)	By telephone by providing certain personal identification.
(3)	Through a secure electronic mail connection if such connection is made available by the agency.
(c)	A consumer reporting agency shall place a security freeze on a consumer's credit report no later than five business days after receiving a written or telephone request from the consumer or three business days after receiving a secure electronic mail request.
(d)	The consumer reporting agency shall send a written confirmation of the security freeze to the consumer within five business days of placing the freeze and at the same time shall provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of his or her credit for a specific party or period of time.
(e)	If the consumer wishes to allow his or her credit report to be accessed for a specific party or period of time while a freeze is in place, he or she shall contact the consumer reporting agency via telephone, certified mail, or secure electronic mail, request that the freeze be temporarily lifted, and provide all of the following:
(1)	Proper identification.
(2)	The unique personal identification number or password provided by the consumer reporting agency pursuant to subsection (d) of this section.
(3)	The proper information regarding the third party who is to receive the credit report or the time period for which the report shall be available to users of the credit report.
(f)	A consumer reporting agency that receives a request from a consumer to temporarily lift a freeze on a credit report pursuant to subsection (e) of this section shall comply with the request no later than three business days after receiving the request.
(g)	A consumer reporting agency may develop procedures involving the use of telephone, fax, or, upon the consent of the consumer in the manner required by the Electronic Signatures in Global and National Commerce Act (e‑Sign) for legally required notices, by the Internet, e‑mail, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze on a credit report pursuant to subsection (e) of this section in an expedited manner.
(h)	A consumer reporting agency shall remove or temporarily lift a freeze placed on a consumer's credit report only in the following cases:
(1)	Upon the consumer's request, pursuant to subsection (e) of this section.
(2)	If the consumer's credit report was frozen due to a material misrepresentation of fact by the consumer. If a consumer reporting agency intends to remove a freeze upon a consumer's credit report pursuant to this subdivision, the consumer reporting agency shall notify the consumer in writing five business days prior to removing the freeze on the consumer's credit report.
(i)	If a third party requests access to a consumer credit report on which a security freeze is in effect, and this request is in connection with an application for credit or any other use, and the consumer does not allow his or her credit report to be accessed for that specific party or period of time, the third party may treat the application as incomplete.
(j)	If a third party requests access to a consumer credit report on which a security freeze is in effect for the purpose of receiving, extending, or otherwise utilizing the credit therein, and not for the sole purpose of account review, the consumer credit reporting agency shall notify the consumer that an attempt has been made to access the credit report and by whom.
(k)	A security freeze shall remain in place until the consumer requests that the security freeze be removed. A consumer reporting agency shall remove a security freeze within three business days of receiving a request for removal from the consumer who provides both of the following:
(1)	Proper identification.
(2)	The unique personal identification number or password provided by the consumer reporting agency pursuant to subsection (d) of this section.
(l)	A consumer reporting agency shall require proper identification of the person making a request to place or remove a security freeze.
(m)	A consumer reporting agency shall not suggest or otherwise state or imply to a third party that the consumer's security freeze reflects a negative credit score, history, report, or rating.
(n)	A consumer shall not be charged for any security freeze services, including, but not limited to, the placement or lifting of a security freeze; however, a consumer may be charged no more than five dollars ($5.00) only in the following discrete circumstances:
(1)	If the consumer fails to retain the original personal identification number provided by the agency, the consumer shall not be charged for a one‑time reissue of the personal identification number and no more than five dollars ($5.00) for subsequent instances of loss of the personal identification number.
(2)	The consumer may be charged no more than five dollars ($5.00) for the third and each subsequent time within a calendar year the consumer requests a security freeze on his or her credit report be temporarily lifted pursuant to subsection (e) of this section.
(3)	For consumers that remove a security freeze pursuant to subsection (k) of this section, the consumer may be charged no more than five dollars ($5.00) for the third and each subsequent time within a calendar year the consumer requests a security freeze be placed on his or her credit report pursuant to subsection (b) of this section.
(o)	At anytime that a consumer is required to receive a summary of rights required under section 609 of the federal Fair Credit Reporting Act, the following notice shall be included:
"North Carolina Consumers Have the Right to Obtain a Security Freeze on a Credit Report.
You may obtain a security freeze on your credit report at no charge to protect your privacy and ensure that credit is not granted in your name without your knowledge. You have a right to place a security freeze on your credit report pursuant to North Carolina law. The security freeze will prohibit a consumer reporting agency from releasing any information in your credit report without your express authorization or approval.
The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. When you place a security freeze on your credit report, within five business days you will be provided a personal identification number or password. You may use this number or password to remove the freeze on your credit report or to temporarily authorize the release of your credit report to a specific party or parties or for a period of time after the freeze is in place. To provide that authorization, you must contact the consumer reporting agency and provide all of the following:
(1)	The unique personal identification number or password provided by the consumer reporting agency.
(2)	Proper identification to verify your identity.
(3)	Proper information regarding the third party or parties who are to receive the credit report or the period of time for which the report shall be available to users of the credit report.
A consumer reporting agency that receives a request from a consumer to lift temporarily a freeze on a credit report shall comply with the request no later than three business days after receiving the request. A security freeze does not apply to circumstances where you have an existing account relationship and a copy of your report is requested by your existing creditor or its agents or affiliates for certain types of account review, collection, fraud control, or similar activities.
If you are actively seeking credit, you should understand that the procedures involved in lifting a security freeze may slow your own applications for credit. You should plan ahead and lift a freeze – either for a period of time if you are shopping around or specifically for a certain creditor – a few days before actually applying for new credit.
If you lift your freeze more than two times in a calendar year, you may be charged no more than five dollars ($5.00) for each subsequent time you wish to impose a security freeze on your credit report. You have a right to bring a civil action against someone who violates your rights under the credit reporting laws. The action may be brought against a consumer reporting agency or a user of your credit report."
(p)	The provisions of this section do not apply to the use of a consumer credit report by any of the following:
(1)	A person, or the person's subsidiary, affiliate, agent, or assignee with which the consumer has or, prior to assignment, had an account, contract, or debtor‑creditor relationship for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or debt.
(2)	A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under subsection (e) of this section for purposes of facilitating the extension of credit or other permissible use.
(3)	Any person acting pursuant to a court order, warrant, or subpoena.
(4)	A State or local agency that administers a program for establishing and enforcing child support obligations.
(5)	The State or its agents or assigns acting to investigate fraud or acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities.
(6)	A person for the purposes of prescreening, as defined by the federal Fair Credit Reporting Act.
(7)	Any person or entity administering a credit file monitoring subscription service to which the consumer has subscribed.
(8)	Any person or entity for the purpose of providing a consumer with a copy of his or her credit report upon the consumer's request.
(q)	If a consumer reporting agency erroneously, whether by accident or design, violates a security freeze by releasing credit information that has been placed under a security freeze or violates any other provision in this section, the affected consumer is entitled to:
(1)	Notification within five business days of the release of the information, including specificity as to the information released and the third‑party recipient of the information.
(2)	File a civil action pursuant to G.S. 75‑16. In addition to the remedies therein, a consumer may recover statutory damages of one thousand dollars ($1,000) per violation and seek injunctive relief to prevent or restrain further violations."
SECTION 2.  This act becomes effective October 1, 2005.