The New York State Senate

                    S T A T E   O F   N E W   Y O R K
________________________________________________________________________

                                  8695

                       2017-2018 Regular Sessions

                          I N  A S S E M B L Y

                             October 5, 2017
                               ___________

Introduced  by M. of A. DINOWITZ, GOTTFRIED, BUCHWALD, SIMON, SEAWRIGHT,
  SIMOTAS, BARRON, THIELE, FAHY, WRIGHT, GUNTHER, SOLAGES, ORTIZ, BRAUN-
  STEIN, McDONALD, WILLIAMS, OTIS --  read  once  and  referred  to  the
  Committee on Consumer Affairs and Protection

AN  ACT  to  amend  the general business law, in relation to prohibiting
  fees for security freezes by consumer credit reporting agencies in the
  case of a breach of information

  THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
BLY, DO ENACT AS FOLLOWS:

  Section  1.  Subdivision  (n) of section 380-t of the general business
law is amended by adding a new paragraph 3 to read as follows:
  (3)(I) UPON A BREACH OF DATA OF A  CONSUMER  CREDIT  REPORTING  AGENCY
WHICH  INCLUDES  ANY  SOCIAL SECURITY NUMBER, SUCH AGENCY SHALL OFFER TO
EACH CONSUMER, WHOSE INFORMATION, INCLUDING SOCIAL SECURITY NUMBER,  WAS
BREACHED  OR  IS  REASONABLY  BELIEVED  TO HAVE BEEN BREACHED, UNLIMITED
REASONABLE IDENTITY THEFT PREVENTION SERVICES AND, IF APPLICABLE,  IDEN-
TIFY THEFT MITIGATION SERVICES AT NO COST TO SUCH CONSUMERS. SUCH AGENCY
SHALL  PROVIDE  ALL INFORMATION NECESSARY FOR SUCH CONSUMER TO ENROLL IN
SUCH SERVICES AND SHALL INCLUDE INFORMATION ON  HOW  SUCH  CONSUMER  CAN
REQUEST  A  SECURITY FREEZE. SUCH SERVICES ARE NOT REQUIRED IF, AFTER AN
APPROPRIATE INVESTIGATION, THE AGENCY  REASONABLY  DETERMINES  THAT  THE
BREACH  OF SECURITY IS UNLIKELY TO RESULT IN HARM TO THE CONSUMERS WHOSE
INFORMATION HAS BEEN BREACHED.
  (II) UPON A BREACH OF DATA OF A CONSUMER CREDIT REPORTING AGENCY WHICH
INCLUDES ANY SOCIAL SECURITY NUMBER, NO CONSUMER CREDIT REPORTING AGENCY
SHALL, AT ANY TIME, CHARGE A FEE TO A CONSUMER REQUESTING THE  PLACEMENT
OF  A  SECURITY FREEZE, OR FOR ANY SUBSEQUENT REMOVAL OF A FREEZE OR THE
TEMPORARY LIFT OF A FREEZE FOR A SPECIFIC PARTY OR PERIOD OF TIME OR FOR
THE ISSUANCE OF A REPLACEMENT PERSONAL IDENTIFICATION NUMBER OR PASSWORD
WHEN THE CONSUMER FAILS TO RETAIN THE PERSONAL IDENTIFICATION NUMBER  OR

 EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                      [ ] is old law to be omitted.
                                                           LBD13504-03-7

A. 8695                             2

PASSWORD  PROVIDED  TO  SUCH  CONSUMER BY SUCH CONSUMER CREDIT REPORTING
AGENCY.
  (III)  "BREACH  OF  THE SECURITY" AS USED IN THIS PARAGRAPH SHALL MEAN
THE UNAUTHORIZED ACQUISITION OR ACQUISITION WITHOUT VALID  AUTHORIZATION
OF  COMPUTERIZED DATA THAT COMPROMISES THE SECURITY, CONFIDENTIALITY, OR
INTEGRITY OF PRIVATE INFORMATION.  GOOD  FAITH  ACQUISITION  OF  PRIVATE
INFORMATION  BY AN EMPLOYEE OR AGENT OF THE BUSINESS FOR THE PURPOSES OF
THE BUSINESS IS NOT A BREACH OF THE SECURITY  OF  THE  SYSTEM,  PROVIDED
THAT  THE  PRIVATE  INFORMATION  IS  NOT USED OR SUBJECT TO UNAUTHORIZED
DISCLOSURE.
  § 2. Subdivision (q) of section 380-t of the general business law,  as
amended  by  chapter  279  of  the  laws  of 2008, is amended to read as
follows:
  (q) (1) Any time a consumer credit reporting  agency  is  required  to
send  a  summary  of rights required under 15 U.S.C. section 1681g, to a
consumer residing in this state the following notice shall  be  included
with such summary of rights:
  "NEW YORK CONSUMERS HAVE THE RIGHT TO OBTAIN A SECURITY FREEZE.
  YOU  HAVE  A RIGHT TO PLACE A "SECURITY FREEZE" ON YOUR CREDIT REPORT,
WHICH WILL PROHIBIT A CONSUMER CREDIT REPORTING  AGENCY  FROM  RELEASING
INFORMATION  IN YOUR CREDIT REPORT WITHOUT YOUR EXPRESS AUTHORIZATION. A
SECURITY FREEZE MUST  BE  REQUESTED  IN  WRITING  DELIVERY  CONFIRMATION
REQUESTED  OR  VIA  TELEPHONE, SECURE ELECTRONIC MEANS, OR OTHER METHODS
DEVELOPED BY THE CONSUMER CREDIT REPORTING AGENCY. THE  SECURITY  FREEZE
IS  DESIGNED  TO PREVENT CREDIT, LOANS, AND SERVICES FROM BEING APPROVED
IN YOUR NAME WITHOUT YOUR CONSENT.  IN THE CASE OF A SECURITY BREACH  OF
DATA  OF  A  CONSUMER  CREDIT REPORTING AGENCY WHICH INCLUDES ANY SOCIAL
SECURITY NUMBER YOU HAVE A RIGHT TO REQUEST  A  SECURITY  FREEZE  AT  NO
COST.  HOWEVER, YOU SHOULD BE AWARE THAT USING A SECURITY FREEZE TO TAKE
CONTROL OVER WHO GETS ACCESS TO THE PERSONAL AND  FINANCIAL  INFORMATION
IN  YOUR CREDIT REPORT MAY DELAY, INTERFERE WITH, OR PROHIBIT THE TIMELY
APPROVAL OF ANY SUBSEQUENT REQUEST OR APPLICATION YOU MAKE  REGARDING  A
NEW  LOAN, CREDIT, MORTGAGE, GOVERNMENT SERVICES OR PAYMENTS, INSURANCE,
RENTAL HOUSING, EMPLOYMENT, INVESTMENT, LICENSE, CELLULAR PHONE,  UTILI-
TIES,  DIGITAL  SIGNATURE,  INTERNET  CREDIT  CARD TRANSACTION, OR OTHER
SERVICES, INCLUDING AN EXTENSION OF CREDIT AT POINT OF  SALE.  WHEN  YOU
PLACE  A  SECURITY  FREEZE ON YOUR CREDIT REPORT, YOU WILL BE PROVIDED A
PERSONAL IDENTIFICATION NUMBER OR PASSWORD  TO  USE  IF  YOU  CHOOSE  TO
REMOVE THE FREEZE ON YOUR CREDIT REPORT OR AUTHORIZE THE RELEASE OF YOUR
CREDIT  REPORT  TO  A  SPECIFIC  PARTY OR FOR A PERIOD OF TIME AFTER THE
FREEZE IS IN PLACE. TO PROVIDE THAT AUTHORIZATION YOU MUST  CONTACT  THE
CONSUMER CREDIT REPORTING AGENCY AND PROVIDE ALL OF THE FOLLOWING:
  (1) THE PERSONAL IDENTIFICATION NUMBER OR PASSWORD;
  (2) PROPER IDENTIFICATION TO VERIFY YOUR IDENTITY;
  (3)  THE  PROPER INFORMATION REGARDING THE PARTY OR PARTIES WHO ARE TO
RECEIVE THE CREDIT REPORT OR THE PERIOD OF TIME  FOR  WHICH  THE  REPORT
SHALL BE AVAILABLE TO USERS OF THE CREDIT REPORT; AND
  (4) PAYMENT OF ANY APPLICABLE FEE.
  A  CONSUMER CREDIT REPORTING AGENCY MUST AUTHORIZE THE RELEASE OF YOUR
CREDIT REPORT NO LATER THAN THREE  BUSINESS  DAYS  AFTER  RECEIVING  THE
ABOVE  INFORMATION.  EFFECTIVE  SEPTEMBER  FIRST,  TWO  THOUSAND NINE, A
CONSUMER CREDIT REPORTING AGENCY THAT RECEIVES A REQUEST  VIA  TELEPHONE
OR  SECURE  ELECTRONIC  METHOD  SHALL RELEASE A CONSUMER'S CREDIT REPORT
WITHIN FIFTEEN MINUTES WHEN THE REQUEST IS RECEIVED.
  A SECURITY FREEZE DOES NOT APPLY TO CIRCUMSTANCES IN WHICH YOU HAVE AN
EXISTING ACCOUNT RELATIONSHIP AND A COPY OF YOUR REPORT IS REQUESTED  BY

A. 8695                             3

YOUR  EXISTING CREDITOR OR ITS AGENTS OR AFFILIATES FOR CERTAIN TYPES OF
ACCOUNT REVIEW, COLLECTION, FRAUD CONTROL OR SIMILAR ACTIVITIES.
  IF  YOU  ARE  ACTIVELY  SEEKING CREDIT, YOU SHOULD UNDERSTAND THAT THE
PROCEDURES INVOLVED IN LIFTING A SECURITY FREEZE MAY SLOW YOUR  APPLICA-
TION  FOR  CREDIT.  YOU  SHOULD  PLAN  AHEAD  AND  LIFT A FREEZE, EITHER
COMPLETELY IF YOU ARE SHOPPING AROUND, OR  SPECIFICALLY  FOR  A  CERTAIN
CREDITOR,  BEFORE APPLYING FOR NEW CREDIT. WHEN SEEKING CREDIT OR PURSU-
ING ANOTHER TRANSACTION REQUIRING ACCESS TO YOUR CREDIT  REPORT,  IT  IS
NOT  NECESSARY  TO  RELINQUISH  YOUR  PIN OR PASSWORD TO THE CREDITOR OR
BUSINESS; YOU CAN CONTACT THE CONSUMER CREDIT REPORTING AGENCY DIRECTLY.
IF YOU CHOOSE TO GIVE OUT YOUR PIN OR PASSWORD TO THE CREDITOR OR  BUSI-
NESS,  IT  IS RECOMMENDED THAT YOU OBTAIN A NEW PIN OR PASSWORD FROM THE
CONSUMER CREDIT REPORTING AGENCY."
  (2) If a consumer requests information about a security  freeze,  such
consumer shall be provided with the notice set forth in paragraph one of
this  subdivision  and  with  any  other information necessary to place,
temporarily lift or permanently lift a security  freeze,  including  but
not  limited  to  the  address,  telephone number or point of contact at
which the consumer credit reporting agency receives such requests.
  § 3. This act shall take effect immediately and  shall  be  deemed  to
have been in full force and effect on and after July 1, 2017.