For the purposes of this subchapter, the term:
(1) "Consumer" means an individual who resides in the District of Columbia.
(2) "Credit report" means information maintained by a credit reporting agency bearing on a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living, which is used or expected to be used or collected in whole or in part for:
(A) Serving as a factor in establishing the consumer's eligibility for credit or insurance to be used primarily for personal, family, or household purposes;
(B) Employment purposes; or
(C) Any other purpose authorized under the Fair Credit Reporting Act, approved October 26, 1970 (84 Stat. 1127; 15 U.S.C. § 1681b).
(3) "Credit reporting agency" means any person who, for consideration, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of maintaining consumers' credit information for the purpose of furnishing the information to third parties.
(4) "Proper identification" means information generally considered sufficient to identify a person. Additional information concerning the consumer's employment and personal or family history shall not be included within the term "proper identification" unless the consumer is unable to reasonably identify himself or herself with other information generally considered sufficient.
(5) "Security freeze" or "freeze" means a restriction, at the request of the consumer and subject to certain exceptions, that prohibits the credit reporting agency from releasing all or any part of a credit report or any information derived from it without the express authorization of the consumer.
(Mar. 8, 2007, D.C. Law 16-238, § 2(b), 54 DCR 397.)
HISTORICAL AND STATUTORY NOTES
Legislative History of Laws
Law 16-238, the "Consumer Security Freeze Act of 2006", was introduced in Council and assigned Bill No. 16-811, which was referred to Committee on Consumer and Regulatory Affairs. The Bill was adopted on first and second readings on November 14, 2006, and December 5, 2006, respectively. Signed by the Mayor on December 28 2006, it was assigned Act No. 16-594 and transmitted to both Houses of Congress for its review. D.C. Law 16-238 became effective on March 8, 2007.
Miscellaneous Notes
Section 4 of D.C. Law 16-238 provided: "This act shall apply as of July 1, 2007."
(a) A credit reporting agency shall place a security freeze on a consumer's credit report if a consumer, providing proper identification, makes a request to the credit reporting agency by certified mail. In addition, on or before January 31, 2009, a credit reporting agency shall make available an Internet-based method of requesting a security freeze and shall accept requests by one of the following methods: telephone or regular mail.
(b) A credit reporting agency shall place the security freeze on the consumer's credit report no later than 3 business days after receiving the request.
(c) The credit reporting agency shall send a written confirmation of the security freeze to the consumer within 5 business days of placing the freeze and at the same time shall provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of his or her credit report to a specific party or for a specific period of time.
(d) A consumer may thereafter request that a credit reporting agency allow his or her credit report to be accessed by a specific party or for a specific period of time by providing the following:
(1) Proper identification;
(2) The unique personal identification number or password provided by the credit reporting agency pursuant to subsection (c) of this section; and
(3) The identity of the third party to receive the credit report or the time period for which the report shall be available to users of the credit report, if applicable.
(e)(1) A credit reporting agency that receives a request pursuant to subsection (d) of this section shall comply with the request no later than 3 business days after receiving the request.
(2) On or before September 1, 2008, the consumer reporting agency shall develop the capability, and offer the option to the consumer, of honoring a request under subsection (d) of this section, through Internet-based and telephonic methods, within 15 minutes after the consumer's request is received by the consumer reporting agency. A consumer reporting agency shall not be required to lift a security freeze within 15 minutes if:
(A) The consumer fails to meet the requirements of subsection (d) of this section; or
(B) The consumer reporting agency is unable to lift the security freeze because of:
(i) An act of God, including fire, earthquakes, hurricanes or storms;
(ii) Unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes, or disputes disrupting operations;
(iii) Operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, or computer hardware or software failures inhibiting response time;
(iv) Governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar directives;
(v) Regularly scheduled maintenance during other than normal business hours of, or updates to, the consumer reporting agency's systems; or
(vi) Commercially reasonable maintenance of, or repair to, the consumer reporting agency's systems that is unexpected or unscheduled.
(f) A credit reporting agency may develop procedures involving the use of telephone, fax, or, upon the consent of the consumer in the manner required by the Electronic Signatures in Global and National Commerce Act, approved June 30, 2000 (114 Stat. 464; 15 U.S.C. § 7001 et seq.), for legally required notices, by the Internet, e-mail, or other electronic media, to receive and process a request from a consumer to temporarily lift a freeze on a credit report pursuant to subsection (d) of this section.
(g) A credit reporting agency may permanently remove a freeze placed on a credit report, without a request from the consumer, if the credit reporting agency placed the freeze as a result of a material misrepresentation of fact by the consumer.
(h) A credit reporting agency shall send written notification to the consumer 5 business days prior to permanently removing a freeze on a credit report pursuant to subsection (g) of this section.
(i) If a third party requests access to a credit report on which a security freeze is in effect in connection with an application for credit and the consumer does not allow his or her consumer report to be accessed by that specific party or for that period of time, the third party may treat the application as incomplete.
(j) If a security freeze is in place, a credit report shall not be released to a third party without prior express authorization from the consumer. A credit reporting agency may advise a third party that a security freeze is in effect with respect to the credit report.
(k) A security freeze shall remain in place until the consumer requests its permanent removal in writing. On or before January 31, 2009, a credit reporting agency shall remove a security freeze within 3 business days of receiving a request for permanent removal from the consumer.
(l) A credit reporting agency shall not suggest or otherwise state or imply to a third party that the consumer's security freeze reflects a negative credit score, history, report, or rating.
(m) Nothing in this section shall prevent the lawful use of a credit report by any of the following:
(1)(A) A person or entity (including a subsidiary, affiliate, or agent of that person or entity; an assignee of a financial obligation owing by the consumer to that person or entity; or a prospective assignee of a financial obligation owing by the consumer to that person or entity), with which the consumer has or had prior to assignment an account or contract, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account in conjunction with the proposed purchase of a financial obligation or collecting the financial obligation owing for the account, contract, or negotiable instrument.
(B) For purposes of this paragraph, the term "reviewing the account" includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements;
(2) A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under subsection (d) of this section for purposes of facilitating the extension of credit or other permissible use;
(3) A person or entity acting pursuant to a court order, warrant, subpoena, or other compulsory process;
(4) A state or local agency that administers a program for establishing and enforcing child support obligations;
(5) A third party for the purposes of prescreening under section 604(e) of the Fair Credit Reporting Act, approved October 26, 1970 (84 Stat. 1129; 15 U.S.C. § 1681b(e));
(6) A person or entity for the purpose of providing a consumer with a copy of his or her credit report upon the consumer's request;
(7) An insurance company, licensed in the District, for the purpose of setting or adjusting a rate or premium, adjusting a claim, or underwriting for property and casualty insurance purposes;
(8) A person or entity administering a credit file monitoring subscription service to which the consumer has subscribed; or
(9) A state, local, or federal government agency and its agents acting pursuant to a lawful investigation or to fulfill any of its other official duties.
(n) The following persons are not required to place a security freeze on a credit report:
(1) A person or entity that acts only as a reseller of credit information by assembling and merging information contained in the database of another person or entity, or multiple persons or entities, and does not maintain a permanent database of credit information from which new credit reports are produced; provided, that a person or entity acting as a reseller shall honor any security freeze placed on a credit report by a credit reporting agency;
(2) A check services or fraud prevention services company which issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments; and
(3) A deposit account information service company which issues reports regarding account closures due to fraud, substantial overdrafts, ATM abuse, or similar negative information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution.
(o) A consumer reporting agency may charge a consumer for a security freeze service only as follows:
(1) For the initial application for the consumer's first personal identification number or password, the consumer may be charged $10.
(2) If the consumer fails to retain the original personal identification number or password provided by the agency, the consumer may not be charged for a one-time reissue of the same or a new personal identification number or password, but may be charged an amount not to exceed $10 for subsequent instances of loss and reissuance of a new personal identification number or password.
(3) Notwithstanding the foregoing, a consumer who has been a victim of identity theft shall not be charged any fee, but may be charged an amount not to exceed $10 for second or subsequent instances of loss and reissuance of a new personal identification number or password, for placement of a security freeze on his or her report.
(Mar. 8, 2007, D.C. Law 16-238, § 2(b), 54 DCR 397.)
HISTORICAL AND STATUTORY NOTES
Legislative History of Laws
For Law 16-238, see notes following § 28-3861.
Each time a credit reporting agency provides a consumer with a copy of the consumer's credit report under section 609 of the Fair Credit Reporting Act, approved October 26, 1970 (84 Stat. 1131; 15 U.S.C. § 1681g), the credit reporting agency shall include the following notice with the credit report:
"District of Columbia Consumers Have the Right to Obtain a Security Freeze
"District of Columbia law gives you the right to place a "security freeze" on your credit report. A security freeze restricts when a credit reporting agency may release information in your credit report without your express authorization or approval.
"A security freeze is designed to help prevent credit, loans, and services from being approved in your name without your consent. To obtain a security freeze, you should contact each credit reporting agency. When you place a security freeze on your credit report, the credit reporting agency will send you a personal identification number or password to use if you later choose to lift the freeze from your credit report, or to authorize the release of your credit report to a specific party or parties, or for a specific period of time after the freeze is in place. To provide that authorization, you must contact the credit reporting agency and provide all of the following:
"1. The unique personal identification number or password provided by the credit reporting agency.
"2. Verification of your identity.
"3. Information regarding who may receive the credit report or the period of time for which the report shall be made available.
"Upon receiving your proper request to lift temporarily a freeze from your credit report, the credit reporting agency shall comply within 3 business days. Beginning September 1, 2008, the credit reporting agency is required to provide methods, including web-based and telephonic methods, for you to request that the freeze be temporarily lifted within 15 minutes.
"A security freeze does not apply when you have an existing account relationship and a copy of your report is requested by your existing creditor or its agents or affiliates for certain types of account review, collection, fraud control or similar activities.
"If you are actively seeking credit, the procedures involved in lifting a security freeze may slow your own applications for credit. You should plan ahead and consider lifting a freeze--either completely if you are shopping around, or for a specific creditor before actually applying for new credit. Beginning September 1, 2008, you will be able to have a credit reporting agency temporarily lift a freeze on your credit report within 15 minutes of your request.
"You have a right to take legal action against someone who violates your rights under the credit reporting laws. The action can be brought against a credit reporting agency or anyone who fraudulently caused the release of your credit information.".
(Mar. 8, 2007, D.C. Law 16-238, § 2(b), 54 DCR 397.)
HISTORICAL AND STATUTORY NOTES
Legislative History of Laws
For Law 16-238, see notes following § 28-3861.
(a) A credit reporting agency that discovers a security breach of credit information in violation of a security freeze shall provide written notice to the affected consumer of the security breach of credit information in accordance with Subchapter II [of this chapter].
(b) If a credit reporting agency willfully violates the security freeze by releasing credit information that has been placed under a security freeze, the affected consumer may bring a civil action against the credit reporting agency for the following:
(1) Injunctive relief to prevent or restrain further violation of the security freeze;
(2) Actual damages;
(3) Punitive damages; and
(4) Reasonable attorney's fees and costs of the action.
(c) If a credit reporting agency negligently violates the security freeze by releasing credit information that has been placed under a security freeze, the affected consumer may bring a civil action against the credit reporting agency for the following:
(1) Injunctive relief to prevent or restrain further violation of the security freeze;
(2) Actual damages; and
(3) Reasonable attorney's fees and costs of the action.
(d)(1) The Attorney General may petition the Superior Court of the District of Columbia for temporary or permanent injunctive relief against, and for an award of restitution for property lost or damages suffered by a consumer as a consequence of, a violation of this subchapter by a credit reporting agency, or fraudulent or deceptive conduct that causes the improper release or use of credit information that is subject to a security freeze. Notwithstanding any other provision of this section, only the Attorney General shall enforce the requirements under § 28-3862(e)(2).
(2) In an action under this section, the Attorney General may recover:
(A) A civil penalty not to exceed $1,000 for each violation; and
(B) Reasonable attorney's fees and costs of the action.
(Mar. 8, 2007, D.C. Law 16-238, § 2(b), 54 DCR 397.)
HISTORICAL AND STATUTORY NOTES
Legislative History of Laws
For Law 16-238, see notes following § 28-3861.
