S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   8695
 
                        2017-2018 Regular Sessions
 
                           I N  A S S E M B L Y
 
                              October 5, 2017
                                ___________
 
 Introduced  by M. of A. DINOWITZ, GOTTFRIED, BUCHWALD, SIMON, SEAWRIGHT,
   SIMOTAS, BARRON, THIELE, FAHY, WRIGHT, GUNTHER, SOLAGES, ORTIZ, BRAUN-
   STEIN, McDONALD, WILLIAMS, OTIS --  read  once  and  referred  to  the
   Committee on Consumer Affairs and Protection
 
 AN  ACT  to  amend  the general business law, in relation to prohibiting
   fees for security freezes by consumer credit reporting agencies in the
   case of a breach of information
 
   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section  1.  Subdivision  (n) of section 380-t of the general business
 law is amended by adding a new paragraph 3 to read as follows:
   (3)(I) UPON A BREACH OF DATA OF A  CONSUMER  CREDIT  REPORTING  AGENCY
 WHICH  INCLUDES  ANY  SOCIAL SECURITY NUMBER, SUCH AGENCY SHALL OFFER TO
 EACH CONSUMER, WHOSE INFORMATION, INCLUDING SOCIAL SECURITY NUMBER,  WAS
 BREACHED  OR  IS  REASONABLY  BELIEVED  TO HAVE BEEN BREACHED, UNLIMITED
 REASONABLE IDENTITY THEFT PREVENTION SERVICES AND, IF APPLICABLE,  IDEN-
 TIFY THEFT MITIGATION SERVICES AT NO COST TO SUCH CONSUMERS. SUCH AGENCY
 SHALL  PROVIDE  ALL INFORMATION NECESSARY FOR SUCH CONSUMER TO ENROLL IN
 SUCH SERVICES AND SHALL INCLUDE INFORMATION ON  HOW  SUCH  CONSUMER  CAN
 REQUEST  A  SECURITY FREEZE. SUCH SERVICES ARE NOT REQUIRED IF, AFTER AN
 APPROPRIATE INVESTIGATION, THE AGENCY  REASONABLY  DETERMINES  THAT  THE
 BREACH  OF SECURITY IS UNLIKELY TO RESULT IN HARM TO THE CONSUMERS WHOSE
 INFORMATION HAS BEEN BREACHED.
   (II) UPON A BREACH OF DATA OF A CONSUMER CREDIT REPORTING AGENCY WHICH
 INCLUDES ANY SOCIAL SECURITY NUMBER, NO CONSUMER CREDIT REPORTING AGENCY
 SHALL, AT ANY TIME, CHARGE A FEE TO A CONSUMER REQUESTING THE  PLACEMENT
 OF  A  SECURITY FREEZE, OR FOR ANY SUBSEQUENT REMOVAL OF A FREEZE OR THE
 TEMPORARY LIFT OF A FREEZE FOR A SPECIFIC PARTY OR PERIOD OF TIME OR FOR
 THE ISSUANCE OF A REPLACEMENT PERSONAL IDENTIFICATION NUMBER OR PASSWORD
 WHEN THE CONSUMER FAILS TO RETAIN THE PERSONAL IDENTIFICATION NUMBER  OR
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD13504-03-7
              

 A. 8695                             2
 
 PASSWORD  PROVIDED  TO  SUCH  CONSUMER BY SUCH CONSUMER CREDIT REPORTING
 AGENCY.
   (III)  "BREACH  OF  THE SECURITY" AS USED IN THIS PARAGRAPH SHALL MEAN
 THE UNAUTHORIZED ACQUISITION OR ACQUISITION WITHOUT VALID  AUTHORIZATION
 OF  COMPUTERIZED DATA THAT COMPROMISES THE SECURITY, CONFIDENTIALITY, OR
 INTEGRITY OF PRIVATE INFORMATION.  GOOD  FAITH  ACQUISITION  OF  PRIVATE
 INFORMATION  BY AN EMPLOYEE OR AGENT OF THE BUSINESS FOR THE PURPOSES OF
 THE BUSINESS IS NOT A BREACH OF THE SECURITY  OF  THE  SYSTEM,  PROVIDED
 THAT  THE  PRIVATE  INFORMATION  IS  NOT USED OR SUBJECT TO UNAUTHORIZED
 DISCLOSURE.
   § 2. Subdivision (q) of section 380-t of the general business law,  as
 amended  by  chapter  279  of  the  laws  of 2008, is amended to read as
 follows:
   (q) (1) Any time a consumer credit reporting  agency  is  required  to
 send  a  summary  of rights required under 15 U.S.C. section 1681g, to a
 consumer residing in this state the following notice shall  be  included
 with such summary of rights:
   "NEW YORK CONSUMERS HAVE THE RIGHT TO OBTAIN A SECURITY FREEZE.
   YOU  HAVE  A RIGHT TO PLACE A "SECURITY FREEZE" ON YOUR CREDIT REPORT,
 WHICH WILL PROHIBIT A CONSUMER CREDIT REPORTING  AGENCY  FROM  RELEASING
 INFORMATION  IN YOUR CREDIT REPORT WITHOUT YOUR EXPRESS AUTHORIZATION. A
 SECURITY FREEZE MUST  BE  REQUESTED  IN  WRITING  DELIVERY  CONFIRMATION
 REQUESTED  OR  VIA  TELEPHONE, SECURE ELECTRONIC MEANS, OR OTHER METHODS
 DEVELOPED BY THE CONSUMER CREDIT REPORTING AGENCY. THE  SECURITY  FREEZE
 IS  DESIGNED  TO PREVENT CREDIT, LOANS, AND SERVICES FROM BEING APPROVED
 IN YOUR NAME WITHOUT YOUR CONSENT.  IN THE CASE OF A SECURITY BREACH  OF
 DATA  OF  A  CONSUMER  CREDIT REPORTING AGENCY WHICH INCLUDES ANY SOCIAL
 SECURITY NUMBER YOU HAVE A RIGHT TO REQUEST  A  SECURITY  FREEZE  AT  NO
 COST.  HOWEVER, YOU SHOULD BE AWARE THAT USING A SECURITY FREEZE TO TAKE
 CONTROL OVER WHO GETS ACCESS TO THE PERSONAL AND  FINANCIAL  INFORMATION
 IN  YOUR CREDIT REPORT MAY DELAY, INTERFERE WITH, OR PROHIBIT THE TIMELY
 APPROVAL OF ANY SUBSEQUENT REQUEST OR APPLICATION YOU MAKE  REGARDING  A
 NEW  LOAN, CREDIT, MORTGAGE, GOVERNMENT SERVICES OR PAYMENTS, INSURANCE,
 RENTAL HOUSING, EMPLOYMENT, INVESTMENT, LICENSE, CELLULAR PHONE,  UTILI-
 TIES,  DIGITAL  SIGNATURE,  INTERNET  CREDIT  CARD TRANSACTION, OR OTHER
 SERVICES, INCLUDING AN EXTENSION OF CREDIT AT POINT OF  SALE.  WHEN  YOU
 PLACE  A  SECURITY  FREEZE ON YOUR CREDIT REPORT, YOU WILL BE PROVIDED A
 PERSONAL IDENTIFICATION NUMBER OR PASSWORD  TO  USE  IF  YOU  CHOOSE  TO
 REMOVE THE FREEZE ON YOUR CREDIT REPORT OR AUTHORIZE THE RELEASE OF YOUR
 CREDIT  REPORT  TO  A  SPECIFIC  PARTY OR FOR A PERIOD OF TIME AFTER THE
 FREEZE IS IN PLACE. TO PROVIDE THAT AUTHORIZATION YOU MUST  CONTACT  THE
 CONSUMER CREDIT REPORTING AGENCY AND PROVIDE ALL OF THE FOLLOWING:
   (1) THE PERSONAL IDENTIFICATION NUMBER OR PASSWORD;
   (2) PROPER IDENTIFICATION TO VERIFY YOUR IDENTITY;
   (3)  THE  PROPER INFORMATION REGARDING THE PARTY OR PARTIES WHO ARE TO
 RECEIVE THE CREDIT REPORT OR THE PERIOD OF TIME  FOR  WHICH  THE  REPORT
 SHALL BE AVAILABLE TO USERS OF THE CREDIT REPORT; AND
   (4) PAYMENT OF ANY APPLICABLE FEE.
   A  CONSUMER CREDIT REPORTING AGENCY MUST AUTHORIZE THE RELEASE OF YOUR
 CREDIT REPORT NO LATER THAN THREE  BUSINESS  DAYS  AFTER  RECEIVING  THE
 ABOVE  INFORMATION.  EFFECTIVE  SEPTEMBER  FIRST,  TWO  THOUSAND NINE, A
 CONSUMER CREDIT REPORTING AGENCY THAT RECEIVES A REQUEST  VIA  TELEPHONE
 OR  SECURE  ELECTRONIC  METHOD  SHALL RELEASE A CONSUMER'S CREDIT REPORT
 WITHIN FIFTEEN MINUTES WHEN THE REQUEST IS RECEIVED.
   A SECURITY FREEZE DOES NOT APPLY TO CIRCUMSTANCES IN WHICH YOU HAVE AN
 EXISTING ACCOUNT RELATIONSHIP AND A COPY OF YOUR REPORT IS REQUESTED  BY

 A. 8695                             3
 
 YOUR  EXISTING CREDITOR OR ITS AGENTS OR AFFILIATES FOR CERTAIN TYPES OF
 ACCOUNT REVIEW, COLLECTION, FRAUD CONTROL OR SIMILAR ACTIVITIES.
   IF  YOU  ARE  ACTIVELY  SEEKING CREDIT, YOU SHOULD UNDERSTAND THAT THE
 PROCEDURES INVOLVED IN LIFTING A SECURITY FREEZE MAY SLOW YOUR  APPLICA-
 TION  FOR  CREDIT.  YOU  SHOULD  PLAN  AHEAD  AND  LIFT A FREEZE, EITHER
 COMPLETELY IF YOU ARE SHOPPING AROUND, OR  SPECIFICALLY  FOR  A  CERTAIN
 CREDITOR,  BEFORE APPLYING FOR NEW CREDIT. WHEN SEEKING CREDIT OR PURSU-
 ING ANOTHER TRANSACTION REQUIRING ACCESS TO YOUR CREDIT  REPORT,  IT  IS
 NOT  NECESSARY  TO  RELINQUISH  YOUR  PIN OR PASSWORD TO THE CREDITOR OR
 BUSINESS; YOU CAN CONTACT THE CONSUMER CREDIT REPORTING AGENCY DIRECTLY.
 IF YOU CHOOSE TO GIVE OUT YOUR PIN OR PASSWORD TO THE CREDITOR OR  BUSI-
 NESS,  IT  IS RECOMMENDED THAT YOU OBTAIN A NEW PIN OR PASSWORD FROM THE
 CONSUMER CREDIT REPORTING AGENCY."
   (2) If a consumer requests information about a security  freeze,  such
 consumer shall be provided with the notice set forth in paragraph one of
 this  subdivision  and  with  any  other information necessary to place,
 temporarily lift or permanently lift a security  freeze,  including  but
 not  limited  to  the  address,  telephone number or point of contact at
 which the consumer credit reporting agency receives such requests.
   § 3. This act shall take effect immediately and  shall  be  deemed  to
 have been in full force and effect on and after July 1, 2017.