A BILL TO BE ENTITLED
AN ACT to enhance protections against identity theft and to protect the credit of crime victims during the pendency of crime victims compensation fund applications and appeals.
The General Assembly of North Carolina enacts:
SECTION 1.  G.S. 75‑63 reads as rewritten:
"§ 75‑63.  Security freeze.
(a)	A consumer may place a security freeze on the consumer's credit report by making a request to a consumer reporting agency in accordance with this subsection. A security freeze shall prohibit, subject to exceptions in subsection (l) of this section, the consumer reporting agency from releasing the consumer's credit report or any information from it without the express authorization of the consumer. When a security freeze is in place, a consumer reporting agency may not release the consumer's credit report or information to a third party without prior express authorization from the consumer. This subsection does not prevent a consumer reporting agency from advising a third party that a security freeze is in effect with respect to the consumer's credit report, provided that the consumer reporting agency does not state or otherwise imply to the third party that the consumer's security freeze reflects a negative credit score, history, report, or rating. A consumer reporting agency shall place a security freeze on a consumer's credit report if the consumer requests a security freeze by any of the following methods:
(1)	First‑class mail.
(2)	Telephone call.
(3)	Secure Web site or secure electronic mail connection.
(a1)	A nationwide consumer reporting agency, as defined in section 603(p) [15 U.S.C. § 1681a(p)] of the federal Fair Credit Reporting Act, 15 U.S.C. § 1681, et seq., that receives a request from a consumer residing in this State to place a security freeze on the consumer's file, shall provide a notice communicating to the consumer that the freeze is only placed with the consumer reporting agency to which the consumer directed the request. The notice shall provide to the consumer the Web site, postal address, and telephone number of the other nationwide consumer reporting agencies and of the North Carolina Attorney General's Office and shall inform the consumer that he or she may use this information to contact other nationwide consumer reporting agencies to make security freeze requests and obtain information on combating identity theft. No part of the notice to the consumer shall be used to make a solicitation for other goods and services.
(b)	A consumer reporting agency shall place a security freeze on a consumer's credit report no later than three business days after receiving a written request from the consumer by mail. A consumer reporting agency that receives such a request electronically or by telephone shall comply with the request within 24 hours of receiving the request.
(c)	The consumer reporting agency shall send a written confirmation of the security freeze to the consumer within three business days of placing the freeze and at the same time shall provide the consumer with a unique personal identification number or password, other than the consumer's social security number, to be used by the consumer when providing authorization for the release of the consumer's credit report for a specific period of time, or to a specific party, or for permanently lifting the freeze.
(d)	If the consumer wishes to allow the consumer's credit report to be accessed for a specific period of time or by a specific party while a freeze is in place, the consumer shall contact the consumer reporting agency by mail, phone, or electronically, request that the freeze be lifted or lifted with respect to a specific party, and provide all of the following:
(1)	Proper identification.
(2)	The unique personal identification number or password provided by the consumer reporting agency pursuant to subsection (c) of this section.
(3)	The proper information regarding the third party who is authorized to receive the consumer credit report or the time period for which the report shall be available to users of the credit report.
	(f)	A consumer reporting agency that receives a request by mail from a consumer to lift a freeze on a credit report pursuant to subsection (d) of this section shall comply with the request no later than three business days after receiving the request. A consumer reporting agency that receives such a request electronically or by telephone shall comply with the request within 15 minutes of receiving the request.
(g)	A consumer reporting agency shall remove, temporarily lift, or lift with respect to a specific third party a freeze placed on a consumer's credit report only in the following cases:
(1)	Upon the consumer's request, pursuant to subsections (d) or (j) of this section.
(2)	If the consumer's credit report was frozen due to a material misrepresentation of fact by the consumer. If a consumer reporting agency intends to remove a freeze upon a consumer's credit report pursuant to this subdivision, the consumer reporting agency shall notify the consumer in writing prior to removing the freeze on the consumer's credit report.
(g1)	A consumer reporting agency need not meet the time requirements provided in this section, only for such time as the occurrences prevent compliance, if any of the following occurrences apply:
(1)	The consumer fails to meet the requirements of subsection (d) or (j) of this section.
(2)	The consumer reporting agency's ability to remove, place, temporarily lift, or lift with respect to a specific party the security freeze is prevented by any of the following:
a.	An act of God, including fire, earthquakes, hurricanes, storms, or similar natural disaster or phenomena.
b.	Unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrences.
c.	Operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruption.
d.	Governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar directives.
e.	Regularly scheduled maintenance, during other than normal business hours, of, or updates to, the consumer reporting agency's systems.
f.	Commercially reasonable maintenance of, or repair to, the consumer reporting agency's systems that is unexpected or unscheduled.
g.	Receipt of a removal request outside of normal business hours.
(h)	If a third party requests access to a consumer credit report on which a security freeze is in effect and this request is in connection with an application for credit or any other use and the consumer does not allow the consumer's credit report to be accessed for that specific period of time, the third party may treat the application as incomplete.
(i)	If a consumer requests a security freeze pursuant to this section, the consumer reporting agency shall disclose to the consumer the process of placing and temporarily lifting a security freeze and the process for allowing access to information from the consumer's credit report for a specific period of time or to a specific third party while the security freeze is in place.
(j)	A security freeze shall remain in place until the consumer requests that the security freeze be temporarily lifted for a specific period of time or to a specific third party or removed. A consumer reporting agency shall remove a security freeze within 15 minutes of receiving an electronic request for removal from the consumer or within three business days of receiving a written or telephonic request for removal from the consumer, who provides all of the following:
(1)	Proper identification.
(2)	The unique personal identification number or password provided by the consumer reporting agency pursuant to subsection (c) of this section.
(k)	A consumer reporting agency shall require proper identification of the person making a request to place or remove a security freeze.
(l)	The provisions of this section do not apply to the use of a consumer credit report by any of the following:
(1)	A person, or the person's subsidiary, affiliate, agent, subcontractor, or assignee with whom the consumer has, or prior to assignment had, an account, contract, or debtor‑creditor relationship for the purposes of reviewing the active account or collecting the financial obligation owing for the account, contract, or debt.
(2)	A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under subsection (d) of this section for purposes of facilitating the extension of credit or other permissible use.
(3)	Any person acting pursuant to a court order, warrant, or subpoena.
(4)	A state or local agency, or its agents or assigns, which administers a program for establishing and enforcing child support obligations.
(5)	A state or local agency, or its agents or assigns, acting to investigate fraud, including Medicaid fraud, or acting to investigate or collect delinquent taxes or assessments, including interest and penalties, unpaid court orders, or to fulfill any of its other statutory responsibilities.
(6)	A federal, state, or local governmental entity, including law enforcement agency, court, or their agent or assigns.
(7)	A person for the purposes of prescreening as defined by the Fair Credit Reporting Act, 15 U.S.C. § 1681, et seq.
(8)	Any person for the sole purpose of providing for a credit file monitoring subscription service to which the consumer has subscribed.
(9)	A consumer reporting agency for the purpose of providing a consumer with a copy of the consumer's credit report upon the consumer's request.
(10)	Any depository financial institution for checking, savings, and investment accounts.
(11)	Any property and casualty insurance company for use in setting or adjusting a rate, adjusting a claim, or underwriting for property and casualty insurance purposes.
(12)	A person for the purpose of furnishing or using credit reports for employment purposes pursuant to 15 U.S.C. § 1681b(b) or tenant screening pursuant to 15 U.S.C. § 1681b(a)(3)(F).
(13)	A person for the purpose of criminal background record information.
(m)	If a security freeze is in place, a consumer reporting agency shall not change any of the following official information in a credit report without sending a written confirmation of the change to the consumer within 30 days of the change being posted to the consumer's file: name, date of birth, social security number, and address. Written confirmation is not required for technical modifications of a consumer's official information, including name and street abbreviations, complete spellings, or transposition of numbers or letters. In the case of an address change, the written confirmation shall be sent to both the new address and the former address.
(n)	The following persons are not required to place in a credit report a security freeze pursuant to this section provided, however, that any person that is not required to place a security freeze on a credit report under the provisions of subdivision (3) of this subsection shall be subject to any security freeze placed on a credit report by another consumer reporting agency from which it obtains information:
(1)	A check services or fraud prevention services company, which reports on incidents of fraud or issues authorizations for the purpose of approving or processing negotiable instruments, electronic fund transfers, or similar methods of payment.
(2)	A deposit account information service company, which issues reports regarding account closures due to fraud, substantial overdrafts, ATM abuse, or other similar negative information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution.
(3)	A consumer reporting agency that does all of the following:
a.	Acts only to resell credit information by assembling and merging information contained in a database of one or more credit reporting agencies.
b.	Does not maintain a permanent database of credit information from which new credit reports are produced.
(o)	A consumer reporting agency shall not charge a fee to put a security freeze in place, remove a freeze, or lift a freeze pursuant to subsection (d) or (j) of this section, provided that any such request is made electronically. If a request to put a security freeze in place is made by telephone or by mail, a consumer reporting agency may charge a fee to a consumer not to exceed three dollars ($3.00), except that a consumer reporting agency may not charge any fee to a consumer over the age of 62, to a victim of identity theft who has submitted a copy of a valid investigative or incident report or complaint with a law enforcement agency about the unlawful use of the victim's identifying information by another person, or to the victim's spouse. A consumer reporting agency shall not charge an additional fee to a consumer who requests to temporarily lift for a specific period of time or to a specific third party, reinstate, or remove a security freeze. A consumer reporting agency shall not charge a consumer for a onetime reissue of a replacement personal identification number. A consumer reporting agency may charge a fee not to exceed three dollars ($3.00) to provide any subsequent replacement personal identification number.
(o1)	A parent or guardian of a minor residing in this State may, upon appropriate proof of identity and proof of their relationship to the minor, inquire of a nationwide consumer reporting agency, as defined in section 603(p) [15 U.S.C. § 1681a(p)] of the federal Fair Credit Reporting Act, 15 U.S.C. § 1681, et seq., as to the existence of a credit report for the minor of the parent or guardian. If a credit report for the minor exists, the nationwide consumer reporting agency shall make reasonable efforts to prevent providing a credit report on the minor until the minor reaches the age of majority. If a credit report for the minor does not exist, the nationwide consumer reporting agency has no obligation to create one.
(p)	At any time that a consumer is required to receive a summary of rights required under section 609 of the federal Fair Credit Reporting Act, the following notice shall be included:

'North Carolina Consumers Have the Right to Obtain a Security Freeze.

You have a right to place a "security freeze" on your credit report pursuant to North Carolina law. The security freeze will prohibit a consumer reporting agency from releasing any information in your credit report without your express authorization. A security freeze can be requested in writing by first‑class mail, by telephone, or electronically. You also may request a freeze by visiting the following Web site: [URL] or calling the following telephone number: [NUMBER].
The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gains access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding new loans, credit, mortgage, insurance, rental housing, employment, investment, license, cellular phone, utilities, digital signature, Internet credit card transactions, or other services, including an extension of credit at point of sale.
The freeze will be placed within three business days if you request it by mail, or within 24 hours if you request it by telephone or electronically. When you place a security freeze on your credit report, within three business days, you will be sent a personal identification number or a password to use when you want to remove the security freeze, temporarily lift it, or lift it with respect to a particular third party.
A freeze does not apply when you have an existing account relationship and a copy of your report is requested by your existing creditor or its agents or affiliates for certain types of account review, collection, fraud control, or similar activities.
You should plan ahead and lift a freeze if you are actively seeking credit or services as a security freeze may slow your applications, as mentioned above.
You can remove a freeze, temporarily lift a freeze, or lift a freeze with respect to a particular third party by contacting the consumer reporting agency and providing all of the following:
(1)	Your personal identification number or password,
(2)	Proper identification to verify your identity, and
(3)	Proper information regarding the period of time you want your report available to users of the credit report, or the third party with respect to which you want to lift the freeze.
A consumer reporting agency that receives a request from you to temporarily lift a freeze or to lift a freeze with respect to a particular third party on a credit report shall comply with the request no later than three business days after receiving the request by mail and no later than 15 minutes after receiving a request by telephone or electronically. A consumer reporting agency may charge you up to three dollars ($3.00) to institute a freeze if your request is made by telephone or by mail. A consumer reporting agency may not charge you any amount to freeze, remove a freeze, temporarily lift a freeze, or lift a freeze with respect to a particular third party, if any of the following are true:(1)	Your request is made electronically.
(2)	You are over the age of 62.
(3)	You are the victim of identity theft and have submitted a copy of a valid investigative or incident report or complaint with a law enforcement agency about the unlawful use of your identifying information by another person, or you are the spouse of such a person.
You have a right to bring a civil action against someone who violates your rights under the credit reporting laws. The action can be brought against a consumer reporting agency or a user of your credit report.'
(q)	A violation of this section is a violation of G.S. 75‑1.1."
SECTION 2.  G.S. 75‑65 reads as rewritten:
"§ 75‑65.  Protection from security breaches.
(a)	Any business that owns or licenses personal information of residents of North Carolina or any business that conducts business in North Carolina that owns or licenses personal information in any form (whether computerized, paper, or otherwise) shall provide notice to the affected person that there has been a security breach following discovery or notification of the breach. The disclosure notification shall be made without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subsection (c) of this section, and consistent with any measures necessary to determine sufficient contact information, determine the scope of the breach and restore the reasonable integrity, security, and confidentiality of the data system. For the purposes of this section, personal information shall not include electronic identification numbers, electronic mail names or addresses, Internet account numbers, Internet identification names, parent's legal surname prior to marriage, or a password unless this information would permit access to a person's financial account or resources.
(b)	Any business that maintains or possesses records or data containing personal information of residents of North Carolina that the business does not own or license, or any business that conducts business in North Carolina that maintains or possesses records or data containing personal information that the business does not own or license shall notify the owner or licensee of the information of any security breach immediately following discovery of the breach, consistent with the legitimate needs of law enforcement as provided in subsection (c) of this section.
(c)	The notice required by this section shall be delayed if a law enforcement agency informs the business that notification may impede a criminal investigation or jeopardize national or homeland security, provided that such request is made in writing or the business documents such request contemporaneously in writing, including the name of the law enforcement officer making the request and the officer's law enforcement agency engaged in the investigation. The notice required by this section shall be provided without unreasonable delay after the law enforcement agency communicates to the business its determination that notice will no longer impede the investigation or jeopardize national or homeland security.
(d)	The notice shall be clear and conspicuous. The notice shall include all of the following:
(1)	A description of the incident in general terms.
(2)	A description of the type of personal information that was subject to the unauthorized access and acquisition.
(3)	A description of the general acts of the business to protect the personal information from further unauthorized access.
(4)	A telephone number for the business that the person may call for further information and assistance, if one exists.
(5)	Advice that directs the person to remain vigilant by reviewing account statements and monitoring free credit reports.
(6)	The toll‑free numbers and addresses for the major consumer reporting agencies.
(7)	The toll‑free numbers, addresses, and Web site addresses for the Federal Trade Commission and the North Carolina Attorney General's Office, along with a statement that the individual can obtain information from these sources about preventing identity theft.
(e)	For purposes of this section, notice to affected persons may be provided by one of the following methods:
(1)	Written notice.
(2)	Electronic notice, for those persons for whom it has a valid e‑mail address and who have agreed to receive communications electronically if the notice provided is consistent with the provisions regarding electronic records and signatures for notices legally required to be in writing set forth in 15 U.S.C. § 7001.
(3)	Telephonic notice provided that contact is made directly with the affected persons.
(4)	Substitute notice, if the business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000) or that the affected class of subject persons to be notified exceeds 500,000, or if the business does not have sufficient contact information or consent to satisfy subdivisions (1), (2), or (3) of this subsection, for only those affected persons without sufficient contact information or consent, or if the business is unable to identify particular affected persons, for only those unidentifiable affected persons. Substitute notice shall consist of all the following:
a.	E‑mail notice when the business has an electronic mail address for the subject persons.
b.	Conspicuous posting of the notice on the Web site page of the business, if one is maintained.
c.	Notification to major statewide media.
(e1)	In the event a business provides notice to an affected person pursuant to this section, the business shall notify without unreasonable delay the Consumer Protection Division of the Attorney General's Office of the nature of the breach, the number of consumers affected by the breach, steps taken to investigate the breach, steps taken to prevent a similar breach in the future, and information regarding the timing, distribution, and content of the notice.
(f)	In the event a business provides notice to more than 1,000 persons at one time pursuant to this section, the business shall notify, without unreasonable delay, the Consumer Protection Division of the Attorney General's Office and all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 U.S.C. § 1681a(p), of the timing, distribution, and content of the notice.
(g)	Any waiver of the provisions of this Article is contrary to public policy and is void and unenforceable.
(h)	A financial institution that is subject to and in compliance with the Federal Interagency Guidance Response Programs for Unauthorized Access to Consumer Information and Customer Notice, issued on March 7, 2005, by the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the Office of the Comptroller of the Currency, and the Office of Thrift Supervision, and any revisions, additions, or substitutions relating to said interagency guidance, shall be deemed to be in compliance with this section.
(i)	A violation of this section is a violation of G.S. 75‑1.1. No private right of action may be brought by an individual for a violation of this section unless such individual is injured as a result of the violation.
(j)	Causes of action arising under this Article may not be assigned."
SECTION 3.  G.S. 132‑1.10 is amended by adding a new subsection to read:
"(f1)	Without a request made pursuant to subsection (f) of this section, a register of deeds or clerk of court may remove from an image or copy of an official record placed on a register of deeds' or clerk of court's Internet Web site available to the general public, or placed on an Internet Web site available to the general public used by a register of deeds or clerk of court to display public records, a person's social security or drivers license number contained in that official record. Registers of deeds and clerks of court may apply optical character recognition technology or other reasonably available technology to official records placed on Internet Web sites available to the general public in order to, in good faith, identify and redact social security and drivers license numbers."
SECTION 4.  The Conference of Clerks of Superior Court shall, in consultation with the registers of deeds, annually study the status of the individual counties and judicial districts as to whether or not the clerks of superior court or the registers of deeds are implementing this act and report results of the study to the Joint Legislative Commission on Governmental Operations on or before March 1 of each year.
SECTION 5.  G.S. 15B‑2 reads as rewritten:
"§ 15B‑2.  Definitions.
As used in this Article, the following definitions apply, unless the context requires otherwise:
(1)	Allowable expense. – Reasonable charges incurred for reasonably needed products, services, and accommodations, including those for medical care, rehabilitation, medically‑related property, and other remedial treatment and care.
Allowable expense includes a total charge not in excess of five thousand dollars ($5,000) for expenses related to funeral, cremation, and burial, including transportation of a body, but excluding expenses for flowers, gravestone, and other items not directly related to the funeral service.
Allowable expense for medical care, counseling, rehabilitation, medically‑related property, and other remedial treatment and care of a victim shall be limited to sixty‑six and two‑thirds percent (66 2/3%) of the amount usually charged by the provider for the treatment or care. By accepting the compensation paid as allowable expense pursuant to this subdivision, the provider agrees that the compensation is payment in full for the treatment or care and shall not charge or otherwise hold a claimant financially responsible for the cost of services in addition to the amount of allowable expense.
(2)	Claimant. – Any of the following persons who claims an award of compensation under this Article:
a.	A victim;
b.	A dependent of a deceased victim;
c.	A third person who is not a collateral source and who provided benefit to the victim or his family other than in the course or scope of his employment, business, or profession;
d.	A person who is authorized to act on behalf of a victim, a dependent, or a third person described in subdivision c.
The claimant, however, may not be the offender or an accomplice of the offender who committed the criminally injurious conduct.
(3)	Collateral source. – A source of benefits or advantages for economic loss otherwise compensable that the victim or claimant has received or that is readily available to the victim or the claimant from any of the following sources:
a.	The offender.
b.	The government of the United States or any of its agencies, a state or any of its political subdivisions, or an instrumentality of two or more states.
c.	Social Security, Medicare, or Medicaid.
d.	State‑required, temporary, nonoccupational disability insurance.
e.	Worker's compensation.
f.	Wage continuation programs of any employer.
g.	Proceeds of a contract of insurance payable to the victim for loss that the victim sustained because of the criminally injurious conduct.
h.	A contract providing prepaid hospital and other health care services, or benefits for disability.
i.	A contract of insurance that will pay for expenses directly related to a funeral, cremation, and burial, including transportation of a body.
(4)	Commission. – The Crime Victims Compensation Commission established by G.S. 15B‑3.
(4a)	Consumer reporting agency. – As defined in G.S. 75‑61(4).
(4b)	Credit report. – As defined in G.S. 75‑61(3).
(5)	Criminally injurious conduct. – Conduct that by its nature poses a substantial threat of personal injury or death, and is punishable by fine or imprisonment or death, or would be so punishable but for the fact that the person engaging in the conduct lacked the capacity to commit the crime under the laws of this State. Criminally injurious conduct includes conduct that amounts to an offense involving impaired driving as defined in G.S. 20‑4.01(24a), and conduct that amounts to a violation of G.S. 20‑166 if the victim was a pedestrian or was operating a vehicle moved solely by human power or a mobility impairment device. For purposes of this Article, a mobility impairment device is a device that is designed for and intended to be used as a means of transportation for a person with a mobility impairment, is suitable for use both inside and outside a building, and whose maximum speed does not exceed 12 miles per hour when the device is being operated by a person with a mobility impairment. Criminally injurious conduct does not include conduct arising out of the ownership, maintenance, or use of a motor vehicle when the conduct is punishable only as a violation of other provisions of Chapter 20 of the General Statutes. Criminally injurious conduct shall also include an act of terrorism, as defined in 18 U.S.C. § 2331, that is committed outside of the United States against a citizen of this State.
(6)	Dependent. – An individual wholly or substantially dependent upon the victim for care and support and includes a child of the victim born after his death.
(7)	Dependent's economic loss. – Loss after a victim's death of contributions of things of economic value to his dependents, not including services they would have received from the victim if he had not suffered the fatal injury, less expenses of the dependents avoided by reason of the victim's death.
(8)	Dependent's replacement service loss. – Loss reasonably incurred by dependents after a victim's death in obtaining ordinary and necessary services in lieu of those the victim would have performed for their benefit if he had not suffered the fatal injury, less expenses of the dependents avoided by reason of the victim's death and not subtracted in calculating dependent's economic loss.
Dependent's replacement service loss will be limited to a 26‑week period commencing from the date of the injury and compensation shall not exceed two hundred dollars ($200.00) per week.
(9)	Director. – The Director of the Commission appointed under G.S. 15B‑3(g).
(10)	Economic loss. – Economic detriment consisting only of allowable expense, work loss, replacement services loss, and household support loss. If criminally injurious conduct causes death, economic loss includes a dependent's economic loss and a dependent's replacement service loss. Noneconomic detriment is not economic loss, but economic loss may be caused by pain and suffering or physical impairment.
(10a)	Household support loss. – The loss of support that a victim would have received from the victim's spouse for the purpose of maintaining a home or residence for the victim and the victim's dependents. A victim may be compensated fifty dollars ($50.00) per week for each dependent child. Compensation for household support loss shall not exceed three hundred dollars ($300.00) per week and shall be limited to 26 weeks commencing from the date of the injury. A victim may receive only one compensation for household support loss. Household support loss is only available to an unemployed victim whose spouse is the offender who committed the criminally injurious conduct that is the basis of the victim's claim under this act.
(11)	Noneconomic detriment. – Pain, suffering, inconvenience, physical impairment, or other nonpecuniary damage.
(12)	Replacement services loss. – Expenses reasonably incurred in obtaining ordinary and necessary services in lieu of those the injured person would have performed, not for income but for the benefit of himself or his family, if he had not been injured.
Replacement service loss will be limited to a 26‑week period commencing from the date of the injury, and compensation may not exceed two hundred dollars ($200.00) per week.
(12a)	Substantial evidence. – Relevant evidence that a reasonable mind might accept as adequate to support a conclusion.
(13)	Victim. – A person who suffers personal injury or death proximately caused by criminally injurious conduct.
(14)	Work loss. – Loss of income from work that the injured person would have performed if he had not been injured and expenses reasonably incurred by him to obtain services in lieu of those he would have performed for income, reduced by any income from substitute work actually performed by him, or by income he would have earned in available appropriate substitute work that he was capable of performing but unreasonably failed to undertake.
Compensation for work loss will be limited to 26 weeks commencing from the date of the injury, and compensation shall not exceed three hundred dollars ($300.00) per week. A claim for work loss will be paid only upon proof that the injured person was gainfully employed at the time of the criminally injurious conduct and, by physician's certificate, that the injured person was unable to work."
SECTION 6.  Chapter 15B of the General Statutes is amended by adding a new section to read:
"§ 15B‑26.  Crime victims credit protection.
(a)	A creditor that is owed money for services provided to a victim as a result of the criminally injurious conduct inflicted on the victim shall not communicate any information about the debt to a consumer reporting agency during the pendency of an application for an award filed pursuant to G.S. 15B‑7 or during the pendency of an appeal from a decision related to such an application. 
(b)	The victim bears the burden of notifying the creditor that the debt is subject to subsection (a) of this section.
(c)	A creditor may request monthly verification from the Commission that the application or appeal is still pending, and the Commission shall provide this verification."SECTION 7.  Chapter 75 of the General Statutes is amended by adding a new Article to read:
"Article 7.
"Credit Monitoring Services Act.
"§ 75‑133.  Title.
This Article shall be known and may be cited as the 'Credit Monitoring Services Act.'
"§ 75‑134.  Definitions.
The following definitions apply in this Article:
(1)	Credit monitoring service. – Any person who offers, for a fee or compensation, to obtain, provide, or monitor a credit report on behalf of a consumer, or to assist a consumer in obtaining or monitoring the consumer's credit report, and provides or purports to provide the foregoing services. The term also includes any person who offers, for a fee or compensation, to obtain or provide a fraud alert on behalf of a consumer or to assist a consumer in obtaining such fraud alert. The term does not include the following activities of a consumer reporting agency, as defined in section 603(f) [15 U.S.C. § 1681a(f)] of the federal Fair Credit Reporting Act, provided that, while the excluded activities themselves do not fall within the definition of the term 'credit monitoring service' none of these excluded activities exempts a consumer reporting agency from the duty to provide the notice required under G.S. 75‑135 where the sale of a credit monitoring service occurs as a result of an offer for the credit monitoring service made at a time during communications involving such activities:
a.	Providing a credit report to another party that monitors a credit report on behalf of a consumer;b.	Providing a disclosure to a consumer of the information in the consumer's file pursuant to section 609(a) [15 U.S.C. § 1681g(a)] of the federal Fair Credit Reporting Act and also imposing a charge permitted under section 612(f) [15 U.S.C. § 1681j(f)] of the federal Fair Credit Reporting Act;
c.	Providing the disclosure of a score pursuant to section 609(f) [15 U.S.C. § 1681g(f)] of the federal Fair Credit Reporting Act and also imposing a charge permitted under section 609(f)(8) [15 U.S.C. § 1681g(f)(8)] of the federal Fair Credit Reporting Act;
d.	Providing a notice required by G.S. 75‑63(m); or
e.	Providing a monitoring service to individuals who receive a notice provided by a person who experienced a security breach and where the monitoring service was paid for by the person who experienced the security breach.
(2)	Consumer report. – As defined in G.S. 75‑61(3).
(3)	Consumer. – An individual.
(4)	Fraud alert. – As defined in the federal Fair Credit Reporting Act, 15 U.S.C. § 1681c‑1.
(5)	Person. – Any individual, partnership, corporation, association, business establishment, or any other legal or commercial entity.
"§ 75‑135.  Required disclosure.
(a)	Prior to charging or collecting any fee or compensation from a consumer for obtaining, providing, or monitoring the consumer's credit report on behalf of the consumer, a credit monitoring service shall provide a clear and conspicuous written description of a consumer's right to one free credit report per year pursuant to section 612(a) [15 U.S.C. § 1681j(a)] of the federal Fair Credit Reporting Act, and how to obtain those credit reports from each of the nationwide consumer reporting agencies, as defined in section 603(p) [15 U.S.C. § 1681a(p)] of the federal Fair Credit Reporting Act, 15 U.S.C. § 1681, et seq.
(b)	If the credit monitoring service is offered and fees are collected during a telephone call, the notice required by subsection (a) of this section will be offered in the same manner.
(c)	A violation of this section is a violation of G.S. 75‑1.1, except that compliance with the requirement that the notice required by this section be clear and conspicuous shall be enforced exclusively by the Attorney General under G.S. 75‑15."
SECTION 8.  This act becomes effective October 1, 2009.