NY State Senate Bill 2017-S6886A

Senate Bill S6886A

Signed By Governor

2017-2018 Legislative Session

Relates to fee assessments for security freezes following consumer credit reporting agency data breaches; repealer

download bill text pdf

Archive: Last Bill Status - Signed by Governor

Introduced
- In Committee Assembly
- In Committee Senate
- On Floor Calendar Assembly
- On Floor Calendar Senate
- Passed Assembly
- Passed Senate
Delivered to Governor
Signed By Governor

Please enter your contact information

First Name

Last Name

Email Address

A valid email address is required.

Home address is used to determine the senate district in which you reside. Your support or opposition to this bill is then shared immediately with the senator who represents you.

Optional services from the NY State Senate:

Create an account. An account allows you to officially support or oppose key legislation, sign petitions with a single click, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.

Include a custom message for your Senator? (Optional)

Enter a message to your senator. Many New Yorkers use this to share the reasoning behind their support or opposition to the bill. Others might share a personal anecdote about how the bill would affect them or people they care about.

Actions

View Actions

	Assembly Actions - Lowercase Senate Actions - UPPERCASE
Dec 28, 2018	signed chap.480
Dec 18, 2018	delivered to governor
Jun 13, 2018	returned to senate passed assembly ordered to third reading cal.917 substituted for a8672b
Jun 11, 2018	referred to codes delivered to assembly passed senate
Jun 05, 2018	advanced to third reading
Jun 04, 2018	2nd report cal.
May 31, 2018	1st report cal.1432
May 23, 2018	print number 6886d
May 23, 2018	amend (t) and recommit to consumer protection
May 15, 2018	print number 6886c
May 15, 2018	amend (t) and recommit to consumer protection
May 02, 2018	print number 6886b
May 02, 2018	amend and recommit to consumer protection
Jan 03, 2018	referred to consumer protection
Oct 18, 2017	print number 6886a
Oct 18, 2017	amend and recommit to rules
Sep 25, 2017	referred to rules

Votes

- Jun 11, 2018 - Floor Vote
  S6886A
  
  61
  
  Aye
  
  0
  
  Nay
  
  0
  
  Absent
  
  2
  
  Excused
  
  0
  
  Abstained
  - - Floor Vote: Jun 11, 2018
      
      aye (61)
      
      Addabbo Jr.
      
      Akshar
      
      Alcantara
      
      Amedore
      
      Avella
      
      Bailey
      
      Benjamin
      
      Bonacic
      
      Boyle
      
      Breslin
      
      Brooks
      
      Carlucci
      
      Comrie
      
      DeFrancisco
      
      Dilan
      
      Felder
      
      Flanagan
      
      Funke
      
      Gallivan
      
      Gianaris
      
      Golden
      
      Griffo
      
      Hamilton
      
      Hannon
      
      Helming
      
      Hoylman-Sigal
      
      Jacobs
      
      Kaminsky
      
      Kavanagh
      
      Kennedy
      
      Klein
      
      Krueger
      
      LaValle
      
      Lanza
      
      Larkin
      
      Little
      
      Marcellino
      
      Marchione
      
      Mayer
      
      Montgomery
      
      Murphy
      
      O'Mara
      
      Ortt
      
      Parker
      
      Peralta
      
      Persaud
      
      Phillips
      
      Ranzenhofer
      
      Ritchie
      
      Rivera
      
      Robach
      
      Sanders Jr.
      
      Savino
      
      Serino
      
      Serrano
      
      Seward
      
      Stavisky
      
      Stewart-Cousins
      
      Tedisco
      
      Valesky
      
      Young
      
      excused (2)
      
      Croci
      
      Sepúlveda
  May 31, 2018 - Consumer Protection Committee Vote
  S6886A
  
  10
  
  Aye
  
  0
  
  Nay
  
  1
  
  Aye with Reservations
  
  0
  
  Absent
  
  0
  
  Excused
  
  0
  
  Abstained
  - - Consumer Protection Committee Vote: May 31, 2018
      
      aye (10)
      
      Alcantara
      
      Boyle
      
      Carlucci
      
      Comrie
      
      Funke
      
      Helming
      
      Jacobs
      
      Kavanagh
      
      Robach
      
      Serrano
      
      aye wr (1)
      
      Amedore

Bill Amendments

Original

D (Active)

2017-S6886 - Details

Law Section:: General Business Law
Laws Affected:: Amd §380-t, Gen Bus L

2017-S6886 - Summary

Relates to prohibiting consumer credit reporting agencies from charging a fee for the placement, removal, or temporary lift of a security freeze following consumer credit reporting agency data breaches.

2017-S6886 - Sponsor Memo

                                
 
BILL NUMBER: S6886

SPONSOR: FUNKE
 
TITLE OF BILL:  An act to amend the general business law, in relation
to fee assessments for security freezes following consumer credit
reporting agency data breaches

 
PURPOSE OR GENERAL IDEA OF BILL:

To allow consumers to establish any and all credit freezes, and lift
(temporarily or otherwise) their credit freezes at consumer credit
reporting agencies, after a breach has been detected at one such agency,
without incurring any fees.

 
SUMMARY OF PROVISIONS:

Section 1 of the bill adds a new subparagraph to paragraph 1 of subdivi-
sion (n) of section 380-t of the General Business Law to ensure that:

(A) No consumer credit reporting agency experiencing a data breach shall
charge a fee for placing a credit freeze or lifting (temporarily or

otherwise) a credit freeze for 5 years after such breach;

(B) A consumer credit reporting agency experiencing a data breach shall
reimburse individuals for any frees charged by other consumer credit
reporting agencies for placing a credit freeze or lifting (temporarily
or otherwise) a credit freeze for 5 years after such breach; and

(C) A consumer credit reporting agency experiencing a data breach shall
reimburse individuals for any fees for placing a credit freeze or lift-
ing (temporarily or otherwise) a credit freeze for the time period after
the (post-January 1, 2017) data breach and prior to the enactment of
this law. Such a consumer credit reporting agency shall post a
reimbursement form for this purpose on its website.

Section 2 of the bill sets the effective date.

 
JUSTIFICATION:

On September 7, 2017, consumer credit reporting agency Equifax, made the
public aware of a security breach in its database. Individual personally
sensitive information, such as birthdays and Social Security numbers, of
seemingly 143 million consumers was compromised.

As a result, many New Yorkers are being urged to place security freezes
on their credit reports. These freezes keep potential creditors from
accessing an individual's credit file. Accordingly, a security freeze
can prevent an unauthorized person from using another individual's iden-
tity and credit to steal funds, which can ruin the victim's credit
rating.

Under New York State's existing security freeze law, residents are not
charged for the placement of their first security freeze. However, New
Yorkers (except those who are victims of domestic violence) can be
charged up to $5 when they seek a second or further credit freeze.  In
addition, there can be a charge of up to $5 for the temporary lifting of
a credit freeze, an approach that is often used when an individual knows
that they are about to apply for a new credit card, mortgage or other
loan.
This legislation will strengthen consumer protections, by ensuring that
individuals do not bear the cost of the many security freeze trans-
actions, across all credit bureaus (of which there are major compet-
itors) that they are likely to undertake in the wake of the Equifax or
any similar date breach. Not only would this allow consumers to prior-
itize rebuilding their financial lives without bearing the financial
cost of the proper protections, it also ensures that a credit bureau
cannot profit from its lax data security.

 
PRIOR LEGISLATIVE HISTORY:

New Bill

 
IMPACTS ON FINES, PENAL LAW SANCTIONS AND OTHER PENALTIES:

None

 
FISCAL IMPLICATIONS FOR STATE AND LOCAL GOVERNMENTS:

None

 
EFFECTIVE DATE:
This bill shall take effect immediately and applies to any data breach
that occurred on or after January 1, 2017.

2017-S6886 - Bill Text download pdf

                            
 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   6886
 
                        2017-2018 Regular Sessions
 
                             I N  S E N A T E
 
                            September 25, 2017
                                ___________
 
 Introduced  by  Sen.  FUNKE  -- read twice and ordered printed, and when
   printed to be committed to the Committee on Rules
 
 AN ACT to amend the general business law, in relation to fee assessments
   for security freezes following consumer credit reporting  agency  data
   breaches

   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. Paragraph 1 of subdivision (n)  of  section  380-t  of  the
 general  business  law  is amended by adding a new subparagraph (iii) to
 read as follows:
   (III) (A) NO CONSUMER CREDIT REPORTING AGENCY SHALL CHARGE  A  FEE  TO
 ANY INDIVIDUAL FOR THE PLACEMENT OF A SECOND OR SUBSEQUENT FREEZE OR FOR
 THE REMOVAL OF A FREEZE OR THE TEMPORARY LIFT OF A FREEZE FOR A SPECIFIC
 PARTY  OR PERIOD OF TIME, WHEN SUCH REQUEST IS MADE WITHIN FIVE YEARS OF
 A KNOWN DATA BREACH AT SUCH CONSUMER CREDIT REPORTING AGENCY.
   (B) SUCH CONSUMER CREDIT REPORTING AGENCY SHALL REIMBURSE AN  INDIVID-
 UAL FOR ANY FEE ASSESSED BY ANOTHER CONSUMER CREDIT REPORTING AGENCY FOR
 THE  PLACEMENT  OF A SECOND OR SUBSEQUENT FREEZE OR FOR THE REMOVAL OF A
 FREEZE OR THE TEMPORARY LIFT OF A FREEZE FOR A SPECIFIC PARTY OR  PERIOD
 OF  TIME, WHEN SUCH REQUEST IS MADE WITHIN FIVE YEARS OF SUCH KNOWN DATA
 BREACH.
   (C) IF A FEE IS ASSESSED AND PAID FOR BY AN INDIVIDUAL TO  A  CONSUMER
 CREDIT  REPORTING  AGENCY  FOR  THE  PLACEMENT OF A SECOND OR SUBSEQUENT
 FREEZE OR FOR THE REMOVAL OF A FREEZE OR THE TEMPORARY LIFT OF A  FREEZE
 FOR  A  SPECIFIC  PARTY OR PERIOD OF TIME PRIOR TO THE EFFECTIVE DATE OF
 THIS SUBPARAGRAPH BUT AFTER A KNOWN DATA BREACH OCCURRING AFTER  JANUARY
 FIRST,  TWO  THOUSAND  SEVENTEEN,  SUCH  FEE SHALL BE REIMBURSED BY SUCH
 CONSUMER CREDIT REPORTING AGENCY TO SUCH INDIVIDUAL. EACH CONSUMER CRED-
 IT REPORTING AGENCY SHALL CREATE AND MAINTAIN A FORM FOR SUCH REIMBURSE-
 MENT AND POST SUCH ON THE AGENCY'S WEBSITE.
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD13493-01-7

 S. 6886                             2
 
   (D) FOR THE PURPOSES OF THIS SECTION, "KNOWN DATA BREACH"  SHALL  MEAN
 THE  INTENTIONAL  OR  UNINTENTIONAL  RELEASE OF SECURE INFORMATION TO AN
 UNTRUSTED ENVIRONMENT THAT IS REPORTED TO THE PUBLIC.
   §  2.  This  act  shall take effect immediately and shall apply to any
 known data breach that occurred on or after January 1, 2017.

2017-S6886A - Details

Law Section:: General Business Law
Laws Affected:: Amd §380-t, Gen Bus L

2017-S6886A - Summary

2017-S6886A - Sponsor Memo

                                
 
BILL NUMBER: S6886A

SPONSOR: FUNKE
 
TITLE OF BILL:

An act to amend the general business law, in relation to fee assessments
for security freezes following consumer credit reporting agency data
breaches

 
PURPOSE OR GENERAL IDEA OF BILL:

To allow consumers to establish any and all credit freezes, and lift
(temporarily or otherwise) their credit freezes at consumer credit
reporting agencies, after a breach has been detected at one such agency,
without incurring any fees.

 
SUMMARY OF PROVISIONS:

Section 1 of the bill adds a new subparagraph to paragraph 1 of subdivi-
sion (n) of section 380-t of the General Business Law to ensure that:

(A) No consumer credit reporting agency experiencing a data breach shall
charge a fee for placing a credit freeze or lifting (temporarily or
otherwise) a credit freeze for 5 years after such breach;

(B) A consumer credit reporting agency experiencing a data breach shall
reimburse individuals for any fees charged by other consumer credit
reporting agencies for placing a credit freeze or lifting (temporarily
or otherwise) a credit freeze for 5 years after such breach; and,

(C) A consumer credit reporting agency experiencing a data breach shall
reimburse individuals for any fees for placing a credit freeze or lift-
ing (temporarily or otherwise) a credit freeze for the time period after
the (post-January 1, 2017) data breach and prior to the enactment of
this law. Such a consumer credit reporting agency shall post a
reimbursement form for this purpose on its website.

Section 2 of the bill sets the effective date.

 
JUSTIFICATION:

On September 7, 2017, consumer credit reporting agency Equifax, made the
public aware of a security breach in its database. Individual personal-
ly-sensitive information, such as birthdays and Social Security numbers,
of seemingly 143 million consumers was compromised.

As a result, many New Yorkers are being urged to place security freezes
on their credit reports. These freezes keep potential creditors from
accessing an individual's credit file. Accordingly, a security freeze
can prevent an unauthorized person from using another individual's iden-
tity and credit to steal funds, which can ruin the victim's credit
rating.

Under New York State's existing security freeze law, residents are not
charged for the placement of their first security freeze. However, New
Yorkers (except those who are victims of domestic violence) can be
charged up to $5 when they seek a second or further credit freeze.  in
addition, there can be a charge of up to $5 for the temporary lifting of
a credit freeze, an approach that is often used when an individual knows
that they are about to apply for a new credit card, mortgage or other
loan.

This legislation will strengthen consumer protections, by ensuring that
individuals do not bear the cost of the many security freeze trans-
actions, across all credit bureaus (of which there are three major
competitors) that they are likely to undertake in the wake of the Equi-
fax or any similar data breach. Not only would this allow consumers to
prioritize rebuilding their financial lives without bearing the finan-
cial cost of proper protections, also ensures that a credit bureau
cannot profit from its lax data security.

 
PRIOR LEGISLATIVE HISTORY:

New Bill

 
IMPACTS ON FINES, PENAL LAW SANCTIONS AND OTHER PENALTIES:

None

 
FISCAL IMPLICATIONS FOR STATE AND LOCAL GOVERNMENTS:

None

 
EFFECTIVE DATE:
The bill shall take effect immediately and applies to any data breach
that occurred on or after January 1, 2017.

2017-S6886A - Bill Text download pdf

                            
 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                  6886--A
 
                        2017-2018 Regular Sessions
 
                             I N  S E N A T E
 
                            September 25, 2017
                                ___________
 
 Introduced  by  Sen.  FUNKE  -- read twice and ordered printed, and when
   printed to be  committed  to  the  Committee  on  Rules  --  committee
   discharged, bill amended, ordered reprinted as amended and recommitted
   to said committee
 
 AN ACT to amend the general business law, in relation to fee assessments
   for  security  freezes following consumer credit reporting agency data
   breaches
 
   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section  1.  Paragraph  1  of  subdivision (n) of section 380-t of the
 general business law is amended by adding a new  subparagraph  (iii)  to
 read as follows:
   (III)  (A)  NO  CONSUMER CREDIT REPORTING AGENCY SHALL CHARGE A FEE TO
 ANY INDIVIDUAL FOR THE PLACEMENT OF A SECOND OR SUBSEQUENT FREEZE OR FOR
 THE REMOVAL OF A FREEZE OR THE TEMPORARY LIFT OF A FREEZE FOR A SPECIFIC
 PARTY OR PERIOD OF TIME, WHEN SUCH REQUEST IS MADE WITHIN FIVE YEARS  OF
 A DATA BREACH AT SUCH CONSUMER CREDIT REPORTING AGENCY.
   (B)  SUCH CONSUMER CREDIT REPORTING AGENCY SHALL REIMBURSE AN INDIVID-
 UAL FOR ANY FEE ASSESSED BY ANOTHER CONSUMER CREDIT REPORTING AGENCY FOR
 THE PLACEMENT OF A SECOND OR SUBSEQUENT FREEZE OR FOR THE REMOVAL  OF  A
 FREEZE  OR THE TEMPORARY LIFT OF A FREEZE FOR A SPECIFIC PARTY OR PERIOD
 OF TIME, WHEN SUCH REQUEST IS  MADE  WITHIN  FIVE  YEARS  OF  SUCH  DATA
 BREACH.
   (C)  IF  A FEE IS ASSESSED AND PAID FOR BY AN INDIVIDUAL TO A CONSUMER
 CREDIT REPORTING AGENCY FOR THE PLACEMENT  OF  A  SECOND  OR  SUBSEQUENT
 FREEZE  OR FOR THE REMOVAL OF A FREEZE OR THE TEMPORARY LIFT OF A FREEZE
 FOR A SPECIFIC PARTY OR PERIOD OF TIME PRIOR TO THE  EFFECTIVE  DATE  OF
 THIS SUBPARAGRAPH BUT AFTER A DATA BREACH OCCURRING AFTER JANUARY FIRST,
 TWO  THOUSAND  SEVENTEEN,  SUCH FEE SHALL BE REIMBURSED BY SUCH CONSUMER
 CREDIT REPORTING AGENCY TO SUCH INDIVIDUAL. EACH CONSUMER CREDIT REPORT-
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD13493-03-7

 S. 6886--A                          2
 
 ING AGENCY EXPERIENCING SUCH A DATA BREACH SHALL CREATE AND  MAINTAIN  A
 FORM FOR SUCH REIMBURSEMENT AND POST SUCH FORM ON SUCH AGENCY'S WEBSITE.
   (D)  FOR  THE  PURPOSES  OF THIS SECTION, "DATA BREACH" SHALL MEAN THE
 INTENTIONAL  OR  UNINTENTIONAL  RELEASE  OF  SECURE  INFORMATION  TO  AN
 UNTRUSTED ENVIRONMENT THAT IS REPORTED TO THE PUBLIC.
   §  2.  This  act  shall take effect immediately and shall apply to any
 data breach that occurred on or after January 1, 2017.

2017-S6886B - Details

Law Section:: General Business Law
Laws Affected:: Amd §380-t, Gen Bus L

2017-S6886B - Summary

2017-S6886B - Sponsor Memo

                                
 
BILL NUMBER: S6886B

SPONSOR: FUNKE
 
TITLE OF BILL:  An act to amend the general business law, in relation
to fee assessments for security freezes following consumer credit
reporting agency data breaches

 
PURPOSE OR GENERAL IDEA OF BILL:

To allow consumers to establish any and all credit freezes, and lift
(temporarily or otherwise) their credit freezes at consumer credit
reporting agencies, after a breach has been detected at one such agency,
without incurring any fees.

 
SUMMARY OF PROVISIONS:

Section 1 of this bill adds a new paragraph 3 to section 380-t of the
general business law to:

define "breach of the security of the system" and "breached consumer
credit reporting agency";

prohibit a consumer credit reporting agency from charging a fee to a
consumer for the placement, removal, or temporary lift of a security
freeze when a request for such placement, lift, or removal of a freeze
is made within three years of a breach of the security of the system of
such consumer credit reporting agency;

require a breached consumer credit reporting agency to reimburse a
consumer for any fee assessed by another consumer credit reporting agen-
cy for the placement, removal, or temporary lift of a freeze if a
request for such placement, removal, or temporary lift is made within
three years of such breach; and

require a consumer who is seeking reimbursement for assessed fees to
provide proper identification and sufficient documentation to prove the
assessment of such fees.

Section 2 of this bill sets the effective date.

 
DIFFERENCE BETWEEN ORIGINAL AND AMENDED VERSION (IF APPLICABLE):

The amendments lower the amount of time during which a breached consumer
credit reporting agency would be required to comply with the provisions
of this bill from 5 years to 3 years. The amendments also add and define
the term "breached consumer credit reporting agency".  Additionally, the
amendments add provisions relating to documentation of the assessment of
fees, and change the effective date of the bill to ensure that the
provisions of the bill may apply to breaches occurring three years prior
to the effective date of the bill or later, but fees already assessed by
a consumer credit reporting agency prior to the effective date are not
eligible for reimbursement.

 
JUSTIFICATION:

On September 7, 2017, consumer credit reporting agency Equifax made the
public aware of a security breach in its database.  Individual personal-
ly-sensitive information, such as birthdays and Social Security numbers,
of seemingly 143 million consumers was compromised. As a result, many
New Yorkers are being urged to place security freezes on their credit
reports. These freezes keep potential creditors from accessing an indi-
vidual's credit file.  Accordingly, a security freeze can prevent an
unauthorized person from using another individual's identity and credit
to steal funds, which can ruin the victim's credit rating.Under New York
State's existing security freeze law, residents are not charged for the
placement of their first security freeze. However, New Yorkers (except
those who are victims of domestic violence) can be charged up to $5 when
they seek a second or further credit freeze. in addition, there can be a
charge of up to $5 for the temporary lifting of a credit freeze, an
approach that is often used when an individual knows that they are about
to apply for a new credit card, mortgage or other loan.This legislation
will strengthen consumer protections by ensuring that individuals do not
bear the cost of the many security freeze transactions, across all cred-
it bureaus (of which there are three major competitors) that they are
likely to undertake in the wake of the Equifax or any similar data
breach. Not only would this allow consumers to prioritize rebuilding
their financial lives without bearing the financial cost of proper
protections, also ensures that a credit bureau cannot profit from its
lax data security.

 
PRIOR LEGISLATIVE HISTORY:

This is a new bill.

 
FISCAL IMPLICATIONS FOR STATE AND LOCAL GOVERNMENTS:

None to the state.

 
EFFECTIVE DATE:
This act shall take effect on the sixtieth day after it shall have
become a law and shall apply to any breach of the security of the system
of a consumer credit reporting agency that occurred no more than three
years prior to the effective date of this act, provided that fees
assessed by a consumer credit reporting agency prior to the effective
date of this act shall not be eligible for reimbursement.

2017-S6886B - Bill Text download pdf

                            
 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                  6886--B
 
                        2017-2018 Regular Sessions
 
                             I N  S E N A T E
 
                            September 25, 2017
                                ___________
 
 Introduced  by  Sen.  FUNKE  -- read twice and ordered printed, and when
   printed to be  committed  to  the  Committee  on  Rules  --  committee
   discharged, bill amended, ordered reprinted as amended and recommitted
   to  said  committee  --  recommitted  to  the  Committee  on  Consumer
   Protection in accordance with Senate  Rule  6,  sec.  8  --  committee
   discharged, bill amended, ordered reprinted as amended and recommitted
   to said committee
 
 AN ACT to amend the general business law, in relation to fee assessments
   for  security  freezes following consumer credit reporting agency data
   breaches
 
   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section  1.  Subdivision  (n) of section 380-t of the general business
 law is amended by adding a new paragraph 3 to read as follows:
   (3) (I) FOR THE PURPOSES OF THIS PARAGRAPH:
   (A) A "BREACH OF THE SECURITY OF THE SYSTEM" SHALL HAVE THE SAME DEFI-
 NITION AS IN PARAGRAPH (C) OF SUBDIVISION ONE OF SECTION  EIGHT  HUNDRED
 NINETY-NINE-AA OF THIS CHAPTER.
   (B) A "BREACHED CONSUMER CREDIT REPORTING AGENCY" SHALL MEAN A CONSUM-
 ER  CREDIT REPORTING AGENCY EXPERIENCING A BREACH OF THE SECURITY OF THE
 SYSTEM OF SUCH CONSUMER CREDIT REPORTING AGENCY WITHIN  THE  PAST  THREE
 YEARS.
   (II)  NO  CONSUMER  CREDIT  REPORTING  AGENCY  SHALL CHARGE A FEE TO A
 CONSUMER FOR THE PLACEMENT OF A SECOND OR SUBSEQUENT FREEZE OR  FOR  THE
 REMOVAL  OF  A  FREEZE  OR THE TEMPORARY LIFT OF A FREEZE FOR A SPECIFIC
 PARTY OR PERIOD OF TIME, WHEN A REQUEST FOR  SUCH  PLACEMENT,  LIFT,  OR
 REMOVAL  OF A FREEZE IS MADE WITHIN THREE YEARS OF A BREACH OF THE SECU-
 RITY OF THE SYSTEM OF SUCH CONSUMER CREDIT REPORTING AGENCY.
   (III) A BREACHED CONSUMER CREDIT REPORTING AGENCY  SHALL  REIMBURSE  A
 CONSUMER FOR ANY FEE ASSESSED BY ANOTHER CONSUMER CREDIT REPORTING AGEN-
 CY FOR THE PLACEMENT OF A SECOND OR SUBSEQUENT FREEZE OR FOR THE REMOVAL
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.

                                                            LBD13493-07-8

 S. 6886--B                          2
 
 OF  A  FREEZE  OR THE TEMPORARY LIFT OF A FREEZE FOR A SPECIFIC PARTY OR
 PERIOD OF TIME, WHEN SUCH REQUEST IS MADE  WITHIN  THREE  YEARS  OF  THE
 BREACH  OF  THE  SECURITY OF THE SYSTEM OF SUCH BREACHED CONSUMER CREDIT
 REPORTING AGENCY. A CONSUMER SEEKING REIMBURSEMENT FOR ANY SUCH ASSESSED
 FEE  SHALL  PROVIDE  SUCH BREACHED CONSUMER CREDIT REPORTING AGENCY WITH
 THE FOLLOWING:
   (A) PROPER IDENTIFICATION;
   (B) IN THE CASE OF A FEE ASSESSED FOR THE PLACEMENT  OF  A  SECOND  OR
 SUBSEQUENT  FREEZE,  A COPY OF THE WRITTEN CONFIRMATION OF THE PLACEMENT
 OF A SECURITY FREEZE  REQUIRED  PURSUANT  TO  SUBDIVISION  (C)  OF  THIS
 SECTION; AND
   (C)  IN  THE CASE OF A FEE ASSESSED FOR THE REMOVAL OF A FREEZE OR THE
 TEMPORARY LIFT OF A FREEZE FOR A SPECIFIC PARTY OR PERIOD OF TIME,  SUCH
 DOCUMENTATION  THAT  SUCH  BREACHED  CONSUMER  CREDIT  REPORTING  AGENCY
 REASONABLY DEEMS SUFFICIENT TO PROVE THE ASSESSMENT OF SUCH FEE.
   § 2. This act shall take effect on the sixtieth  day  after  it  shall
 have  become  a law and shall apply to any breach of the security of the
 system of a consumer credit reporting agency that occurred no more  than
 three  years prior to the effective date of this act, provided that fees
 assessed by a consumer credit reporting agency prior  to  the  effective
 date of this act shall not be eligible for reimbursement.

co-Sponsors

2017-S6886C - Details

Law Section:: General Business Law
Laws Affected:: Amd §380-t, Gen Bus L

2017-S6886C - Summary

2017-S6886C - Sponsor Memo

                                
 
BILL NUMBER: S6886C

SPONSOR: FUNKE
 
TITLE OF BILL:  An act to amend the general business law, in relation
to eliminating the payment of fees for a security freeze on a consumer
credit report; and to repeal paragraph (g-1) of subdivision 2 of section
65.10 of the penal law relating thereto

 
PURPOSE OR GENERAL IDEA OF BILL:

To allow consumers to establish any and all credit freezes, and lift
(temporarily or otherwise) their credit freezes at consumer credit
reporting agencies, after a breach has been detected at one such agency,
without incurring any fees.

 
SUMMARY OF PROVISIONS:

Section 1 amends section 380-t of the general business law to remove any
fees that credit reporting agencies can charge for freezing or unfreez-
ing a consumer's credit.

Section 2 repeals paragraph (g-1) of subdivision 2 of section 65.10 of
the penal law.

 
DIFFERENCE BETWEEN ORIGINAL AND AMENDED VERSION (IF APPLICABLE):

The Amendments shift from lowering the amount of time during which a
breached consumer credit reporting agency would be required to give a
consumer the chance to freeze their credit free of charge, to simply
removing a credit reporting agencies ability to charge a fee for freez-
ing credit whether there was a breech or not.

 
JUSTIFICATION:

On September 7, 2017, consumer credit reporting agency Equifax made the
public aware of a security breach in its database. Individual personal-
ly-sensitive information, such as birthdays and Social

Security numbers, of seemingly 143 million consumers was compromised.
As a result, many New Yorkers are being urged to place security freezes
on their credit reports. These freezes keep potential creditors from
accessing an individual's credit file. Accordingly, a security freeze
can prevent an unauthorized person from using another individual's iden-
tity and credit to steal funds, which can ruin the victim's credit
rating.  Under New York State's existing security freeze law, residents
are not charged for the placement of their first security freeze.
However, New Yorkers (except those who are victims of domestic violence)
can be charged up to $5 when they seek a second or further credit
freeze. In addition, there can be a charge of up to $5 for the temporary
lifting of a credit freeze, an approach that is often used when an indi-
vidual knows that they are about to apply for a new credit card, mort-
gage or other loan. This legislation will strengthen consumer
protections by ensuring that individuals do not bear the cost of the
many security freeze transactions, across all credit bureaus (of which
there are three major competitors) that they are likely to undertake in
the wake of the Equifax or any similar data breach. Not only would this
allow consumers to prioritize rebuilding their financial lives without
bearing the financial cost of proper protections, also ensures that a
credit bureau cannot profit from its lax data security.
 
PRIOR LEGISLATIVE HISTORY:

This is a new bill.

 
FISCAL IMPLICATIONS FOR STATE AND LOCAL GOVERNMENTS:

None to the state.

 
EFFECTIVE DATE:
This act shall take effect on the one hundred eightieth day after it
shall have become law.

2017-S6886C - Bill Text download pdf

                            
 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                  6886--C
 
                        2017-2018 Regular Sessions
 
                             I N  S E N A T E
 
                            September 25, 2017
                                ___________
 
 Introduced  by  Sen.  FUNKE  -- read twice and ordered printed, and when
   printed to be  committed  to  the  Committee  on  Rules  --  committee
   discharged, bill amended, ordered reprinted as amended and recommitted
   to  said  committee  --  recommitted  to  the  Committee  on  Consumer
   Protection in accordance with Senate  Rule  6,  sec.  8  --  committee
   discharged, bill amended, ordered reprinted as amended and recommitted
   to  said  committee  --  committee  discharged,  bill amended, ordered
   reprinted as amended and recommitted to said committee
 
 AN ACT to amend the general business law, in relation to eliminating the
   payment of fees for a security freeze on a consumer credit report; and
   to repeal paragraph (g-1) of subdivision 2 of  section  65.10  of  the
   penal law relating thereto
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. Section 380-t of the general business law,  as  amended  by
 chapter  279 of the laws of 2008, subdivisions (b) and (n) as separately
 amended by chapter 406 of the laws  of  2008,  and  subdivision  (g)  as
 amended  by  section  36 of part A of chapter 62 of the laws of 2011, is
 amended to read as follows:
   § 380-t. Security freeze. (a) A consumer may request that  a  security
 freeze  be  placed  on  his  or  her consumer credit report by sending a
 request in writing with confirmation of delivery requested or via  tele-
 phone,  secure  electronic  means,  or  other  methods  developed by the
 consumer credit reporting agency to a consumer credit  reporting  agency
 at  an  address,  telephone  number or secure website designated by such
 agency to receive such  requests.  Consumer  credit  reporting  agencies
 shall  have a secure website and a separately dedicated toll-free number
 to offer information, to  process  requests  and  deliver  the  services
 provided for under this section.
   (b) A consumer credit reporting agency that receives from a consumer a
 request  in  accordance  with  subdivision  (a)  of  this section shall,

  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.

                                                            LBD13493-09-8

 S. 6886--C                          2
 
 provided such request  is  accompanied  by  proper  identification  [and
 payment  of any applicable fee], place a security freeze on the consumer
 credit report of or relating to such consumer no later than  four  busi-
 ness  days after receiving such request, provided further, however, that
 for requests received on or after January first, two thousand nine, such
 consumer credit reporting agency shall place a security  freeze  on  the
 consumer  credit  report  of  or relating to such consumer no later than
 three business days  after  receiving  such  request  and  for  requests
 received  on  or  after  January  first, two thousand ten, such consumer
 credit reporting agency shall place a security freeze  on  the  consumer
 credit report of or relating to such consumer no later than one business
 day  after  receiving such request. Nothing in this subdivision shall be
 construed to prevent a consumer credit reporting agency from advising  a
 third  party  that  a  security  freeze is in effect with respect to the
 consumer credit report of or relating  to  such  consumer.  No  consumer
 credit reporting agency shall advise in any manner a third party, of the
 fact  that  the  consumer  requesting  the  freeze is alleging to be the
 victim of domestic violence  or  identity  theft,  without  the  written
 authorization of the consumer.
   (c)  The consumer credit reporting agency shall send a written confir-
 mation of the placement of a security freeze to the consumer within five
 business days of placing such freeze. Upon placing the  security  freeze
 on  the  consumer  credit  report  of  or relating to such consumer, the
 consumer credit reporting agency  shall  provide  the  consumer  with  a
 unique personal identification number or password, or other device which
 shall  only be used by the consumer when providing authorization for the
 release of his or her consumer credit report for  a  specific  party  or
 specific  period  of  time. The unique personal identification number or
 password, or other device to be used by the  consumer  shall  not  be  a
 social  security  number or a sequential portion thereof. Any use of the
 unique personal identification number or password or other device  other
 than provided for in this section is prohibited.
   (d)  If the consumer wishes to allow his or her consumer credit report
 to be accessed for a specific party or a specific period of time while a
 freeze is in place, he or she shall contact the consumer credit  report-
 ing  agency  via  mail  with confirmation of delivery, telephone, secure
 electronic means or other  method  developed  by  such  consumer  credit
 reporting  agency  pursuant  to  subdivision (f) of this section using a
 point of contact designated by such consumer  credit  reporting  agency,
 request  that  the freeze be temporarily lifted, and provide the follow-
 ing:
   (1) proper identification;
   (2) the unique personal identification number or password provided  by
 the consumer credit reporting agency pursuant to subdivision (c) of this
 section; AND
   (3)  the  proper information regarding the party to which the consumer
 credit report should be available or  the  time  period  for  which  the
 consumer credit report shall be available to users of such report[; and
   (4) payment of any applicable fee].
   (e)  (1)  A  consumer  credit reporting agency that receives a request
 from a consumer to temporarily lift a freeze on a consumer credit report
 pursuant to subdivision (d) of  this  section,  shall  comply  with  the
 request:  (i)  no  later  than  three business days after receiving such
 request; (ii) as of September first, two thousand nine, a consumer cred-
 it reporting agency that receives a request via the use of  a  telephone
 or secure electronic method provided by the agency, pursuant to subdivi-

 S. 6886--C                          3

 sion  (d)  of  this section, shall release a consumer's credit report as
 requested by the consumer within fifteen minutes after  the  request  is
 received by the consumer credit reporting agency.
   (2)  A consumer credit reporting agency is not required to temporarily
 lift a security freeze within the time provided in subparagraph (ii)  of
 paragraph one of this subdivision if:
   (i)  the consumer fails to meet the requirements of subdivision (b) of
 this section; or
   (ii) the consumer credit reporting  agency's  ability  to  temporarily
 lift the security freeze within fifteen minutes is prevented by:
   (A) an act of God, including fire, earthquakes, hurricanes, storms, or
 similar natural disaster or phenomena;
   (B)  unauthorized  or illegal acts by a third party, including terror-
 ism, sabotage, riot, vandalism, labor  strikes  or  disputes  disrupting
 operations, or similar occurrence;
   (C)  operational  interruption, including electrical failure, unantic-
 ipated delay in equipment or replacement part delivery,  computer  hard-
 ware   or   software  failures  inhibiting  response  time,  or  similar
 disruption;
   (D) governmental action, including emergency  orders  or  regulations,
 judicial or law enforcement action, or similar directives;
   (E) regularly scheduled maintenance, during other than normal business
 hours, of, or updates to, the consumer reporting agency's systems; or
   (F) commercially reasonable maintenance of, or repair to, the consumer
 reporting agency's systems that is unexpected or unscheduled.
   (f)  A consumer credit reporting agency may develop procedures involv-
 ing other secure methods of communication,  including  the  use  of  the
 internet,  or  other  electronic  media to receive and process a request
 from a consumer to temporarily lift a freeze on a consumer credit report
 pursuant to subdivision (d) of this section in an expedited manner.
   (g) The department of state shall  monitor  the  state  of  technology
 relating  to  the means available to process requests for the lifting or
 removal of a security freeze, and shall report to the  legislature  when
 it is determined that the technology to process requests for the lifting
 or  removal  of  a security freeze in a shorter period of time than that
 set forth in subdivision (e) of this section is available.
   (h) A consumer credit reporting agency  shall  remove  or  temporarily
 lift  a  freeze placed on the consumer credit report of or relating to a
 consumer only in the following cases:
   (1) upon consumer request, pursuant to subdivision (d) or (k) of  this
 section; or
   (2)  if the consumer credit report of or relating to such consumer was
 frozen due to a material misrepresentation of fact by the consumer. If a
 consumer credit reporting agency intends  to  remove  a  freeze  upon  a
 consumer  credit  report pursuant to this paragraph, the consumer credit
 reporting agency shall notify the consumer in writing,  by  first  class
 mail,  within  three  business days prior to removing the freeze on such
 consumer credit report.
   (i) If a third party requests access to a consumer  credit  report  on
 which  a security freeze is in effect, and this request is in connection
 with an application for credit or any other use, and the  consumer  does
 not  allow  his  or  her  consumer credit report to be accessed for that
 period of time, the third party may treat the application as incomplete.
   (j) If a consumer requests a  security  freeze,  the  consumer  credit
 reporting  agency  shall disclose the process of placing and temporarily
 lifting a freeze, and the process for  allowing  access  to  information

 S. 6886--C                          4
 
 from  such  consumer  credit  report for a specific party or a period of
 time while the freeze is in place.
   (k)  (1)  A  security  freeze shall remain in place until the consumer
 requests, using a point of contact designated  by  the  consumer  credit
 reporting  agency,  that the security freeze be removed and provides the
 following:
   (i) proper identification; AND
   (ii) the unique personal identification number or password or  similar
 device  provided  by  the  consumer  credit reporting agency pursuant to
 subdivision (c) of this section[; and
   (iii) a fee, if applicable].
   (2) A consumer credit reporting agency shall remove a security  freeze
 within  three  business days of receiving a request for removal from the
 consumer pursuant to paragraph one of this subdivision.
   (l) A consumer credit reporting agency shall require proper  identifi-
 cation  of  the  person  making  a request to place or remove a security
 freeze.
   (m) The provisions of this section do  not  apply  to  the  use  of  a
 consumer credit report by any of the following:
   (1)  a  person or entity, or a subsidiary, affiliate, or agent of that
 person or entity, or an assignee of a financial obligation owing by  the
 consumer to that person or entity, or a prospective assignee of a finan-
 cial  obligation  owing  by  the  consumer  to  that person or entity in
 conjunction with the proposed purchase of the financial obligation, with
 which the consumer  has  or  had  prior  to  assignment  an  account  or
 contract,  including  a  demand deposit account, or to whom the consumer
 issued a negotiable  instrument,  for  the  purposes  of  reviewing  the
 account  or  collecting  the financial obligation owing for the account,
 contract, or negotiable instrument.  For  purposes  of  this  paragraph,
 "reviewing  the  account" includes activities related to account mainte-
 nance, monitoring, credit  line  increases,  and  account  upgrades  and
 enhancements;
   (2)  a subsidiary, affiliate, agent, assignee, or prospective assignee
 of a person to whom access has been granted for purposes of facilitating
 the extension of credit or other permissible use;
   (3) any state or local agency, law enforcement agency, court,  private
 collection  agency, or person acting pursuant to a court order, warrant,
 or subpoena;
   (4) a child support agency acting pursuant to title iv-d of the social
 security act (42 U.S.C. et seq.);
   (5) the state or its political subdivisions or its agents  or  assigns
 acting  to  investigate fraud or acting to investigate or collect delin-
 quent taxes or unpaid court orders or to fulfill any of its other statu-
 tory responsibilities provided such responsibilities are consistent with
 a permissible purpose under 15 U.S.C. section 1681b;
   (6) the use of credit information for the purposes of prescreening  as
 provided for by the federal fair credit reporting act;
   (7)  any  person  or  entity  administering  a  credit file monitoring
 subscription or similar service to which the consumer has subscribed; or
   (8) any person or entity for the purpose of providing a consumer  with
 a copy of his or her consumer credit report or score upon the request of
 such consumer.
   (n) [(1) (i) No consumer credit reporting agency shall charge a fee to
 a  victim of identity theft who submits a copy of a signed federal trade
 commission ID theft victim's affidavit, or a report of ID theft  from  a
 law enforcement agency to such consumer credit reporting agency.

 S. 6886--C                          5

   (ii)  No  consumer  credit  reporting  agency  shall charge a fee to a
 domestic violence victim who  has  submitted  to  such  consumer  credit
 reporting agency:
   (A)  a  valid  domestic  violence incident report form as such term is
 defined in subdivision fifteen of section eight hundred thirty-seven  of
 the executive law;
   (B) a valid police report;
   (C) a valid order of protection; or
   (D)  a  signed affidavit from a licensed medical or mental health care
 provider, employee of a court acting within the  scope  of  his  or  her
 employment, social worker, a rape crisis counselor as defined in section
 forty-five  hundred ten of the civil practice law and rules, or advocate
 acting on behalf of an agency that assists domestic violence victims.
   For the purposes of this  subdivision,  the  term  "domestic  violence
 victim"  means  an  individual  who  is a victim of a family offense, as
 described in subdivision one of section 530.11 of the criminal procedure
 law, or an offense committed by a member of such individual's  immediate
 family,  as  defined  in subdivision four of section 120.40 of the penal
 law.
   (2) No consumer credit reporting  agency  shall  charge  a  fee  to  a
 consumer requesting the placement of a security freeze when such consum-
 er  has not previously requested the placement of a security freeze from
 such consumer credit reporting agency. Except as provided for  in  para-
 graph  one  of  this subdivision, a consumer credit reporting agency may
 charge a consumer a fee not to exceed five dollars for the placement  of
 a  second  or  subsequent  freeze  or for the removal of a freeze or the
 temporary lift of a freeze for a specific party or period of time or for
 the issuance of a replacement personal identification number or password
 when the consumer fails to retain the personal identification number  or
 password  provided  to  such  consumer by such consumer credit reporting
 agency pursuant to subdivision (c) of this section.
   (o)] If a security freeze is in place,  a  consumer  credit  reporting
 agency  shall  not change any of the following official information in a
 consumer credit report without sending a  written  confirmation  of  the
 change  to the consumer within thirty days of the change being posted to
 the file of or relating to such consumer: name, date  of  birth,  social
 security  number,  and address. Written confirmation is not required for
 technical modifications of the official information of  or  relating  to
 such  consumer, including name and street abbreviations, complete spell-
 ings, or transposition of numbers or letters. In the case of an  address
 change,  the  written confirmation shall be sent to both the new address
 and to the former address.
   [(p)] (O) The following entities are not required to place a  security
 freeze on a consumer credit report:
   (1) a consumer credit reporting agency that acts only as a reseller of
 credit  information  by  assembling and merging information contained in
 the data base of another consumer credit reporting  agency  or  multiple
 consumer  credit  reporting  agencies, and does not maintain a permanent
 data base of credit information from which new consumer  credit  reports
 are  produced.  However,  a consumer credit reporting agency acting as a
 reseller shall honor any security freeze placed  on  a  consumer  credit
 report by another consumer credit reporting agency;
   (2)  a  check  services  or  fraud  prevention services company, which
 issues reports on incidents of fraud or authorizations for  the  purpose
 of  approving  or  processing  negotiable  instruments, electronic funds
 transfers, or similar methods of payments; or

 S. 6886--C                          6
 
   (3) a  deposit  account  information  service  company,  which  issues
 reports regarding account closures due to fraud, substantial overdrafts,
 ATM  abuse,  or  similar  negative  information regarding a consumer, to
 inquiring banks or other financial institutions for use only in  review-
 ing  a  consumer  request for a deposit account at the inquiring bank or
 financial institution.
   [(q)] (P) (1) Any time a consumer credit reporting agency is  required
 to send a summary of rights required under 15 U.S.C. section 1681g, to a
 consumer  residing  in this state the following notice shall be included
 with such summary of rights:
   "NEW YORK CONSUMERS HAVE THE RIGHT TO OBTAIN A SECURITY FREEZE.
   YOU HAVE A RIGHT TO PLACE A "SECURITY FREEZE" ON YOUR  CREDIT  REPORT,
 WHICH  WILL  PROHIBIT  A CONSUMER CREDIT REPORTING AGENCY FROM RELEASING
 INFORMATION IN YOUR CREDIT REPORT WITHOUT YOUR EXPRESS AUTHORIZATION.  A
 SECURITY  FREEZE  MUST  BE  REQUESTED  IN  WRITING DELIVERY CONFIRMATION
 REQUESTED OR VIA TELEPHONE, SECURE ELECTRONIC MEANS,  OR  OTHER  METHODS
 DEVELOPED  BY  THE CONSUMER CREDIT REPORTING AGENCY. THE SECURITY FREEZE
 IS DESIGNED TO PREVENT CREDIT, LOANS, AND SERVICES FROM  BEING  APPROVED
 IN  YOUR  NAME  WITHOUT  YOUR CONSENT. HOWEVER, YOU SHOULD BE AWARE THAT
 USING A SECURITY FREEZE TO TAKE CONTROL OVER  WHO  GETS  ACCESS  TO  THE
 PERSONAL  AND  FINANCIAL  INFORMATION  IN  YOUR CREDIT REPORT MAY DELAY,
 INTERFERE WITH, OR  PROHIBIT  THE  TIMELY  APPROVAL  OF  ANY  SUBSEQUENT
 REQUEST  OR APPLICATION YOU MAKE REGARDING A NEW LOAN, CREDIT, MORTGAGE,
 GOVERNMENT SERVICES OR PAYMENTS, INSURANCE, RENTAL HOUSING,  EMPLOYMENT,
 INVESTMENT,  LICENSE,  CELLULAR  PHONE,  UTILITIES,  DIGITAL  SIGNATURE,
 INTERNET CREDIT CARD TRANSACTION, OR OTHER SERVICES, INCLUDING AN EXTEN-
 SION OF CREDIT AT POINT OF SALE. WHEN YOU PLACE  A  SECURITY  FREEZE  ON
 YOUR  CREDIT  REPORT,  YOU  WILL  BE  PROVIDED A PERSONAL IDENTIFICATION
 NUMBER OR PASSWORD TO USE IF YOU CHOOSE TO REMOVE  THE  FREEZE  ON  YOUR
 CREDIT  REPORT  OR  AUTHORIZE  THE  RELEASE  OF  YOUR CREDIT REPORT TO A
 SPECIFIC PARTY OR FOR A PERIOD OF TIME AFTER THE FREEZE IS IN PLACE.  TO
 PROVIDE  THAT AUTHORIZATION YOU MUST CONTACT THE CONSUMER CREDIT REPORT-
 ING AGENCY AND PROVIDE ALL OF THE FOLLOWING:
   (1) THE PERSONAL IDENTIFICATION NUMBER OR PASSWORD;
   (2) PROPER IDENTIFICATION TO VERIFY YOUR IDENTITY; AND
   (3) THE PROPER INFORMATION REGARDING THE PARTY OR PARTIES WHO  ARE  TO
 RECEIVE  THE  CREDIT  REPORT  OR THE PERIOD OF TIME FOR WHICH THE REPORT
 SHALL BE AVAILABLE TO USERS OF THE CREDIT REPORT[; AND
   (4) PAYMENT OF ANY APPLICABLE FEE].
   A CONSUMER CREDIT REPORTING AGENCY MUST AUTHORIZE THE RELEASE OF  YOUR
 CREDIT  REPORT  NO  LATER  THAN  THREE BUSINESS DAYS AFTER RECEIVING THE
 ABOVE INFORMATION. EFFECTIVE  SEPTEMBER  FIRST,  TWO  THOUSAND  NINE,  A
 CONSUMER  CREDIT  REPORTING AGENCY THAT RECEIVES A REQUEST VIA TELEPHONE
 OR SECURE ELECTRONIC METHOD SHALL RELEASE  A  CONSUMER'S  CREDIT  REPORT
 WITHIN FIFTEEN MINUTES WHEN THE REQUEST IS RECEIVED.
   A SECURITY FREEZE DOES NOT APPLY TO CIRCUMSTANCES IN WHICH YOU HAVE AN
 EXISTING  ACCOUNT RELATIONSHIP AND A COPY OF YOUR REPORT IS REQUESTED BY
 YOUR EXISTING CREDITOR OR ITS AGENTS OR AFFILIATES FOR CERTAIN TYPES  OF
 ACCOUNT REVIEW, COLLECTION, FRAUD CONTROL OR SIMILAR ACTIVITIES.
   IF  YOU  ARE  ACTIVELY  SEEKING CREDIT, YOU SHOULD UNDERSTAND THAT THE
 PROCEDURES INVOLVED IN LIFTING A SECURITY FREEZE MAY SLOW YOUR  APPLICA-
 TION  FOR  CREDIT.  YOU  SHOULD  PLAN  AHEAD  AND  LIFT A FREEZE, EITHER
 COMPLETELY IF YOU ARE SHOPPING AROUND, OR  SPECIFICALLY  FOR  A  CERTAIN
 CREDITOR,  BEFORE APPLYING FOR NEW CREDIT. WHEN SEEKING CREDIT OR PURSU-
 ING ANOTHER TRANSACTION REQUIRING ACCESS TO YOUR CREDIT  REPORT,  IT  IS
 NOT  NECESSARY  TO  RELINQUISH  YOUR  PIN OR PASSWORD TO THE CREDITOR OR

 S. 6886--C                          7
 
 BUSINESS; YOU CAN CONTACT THE CONSUMER CREDIT REPORTING AGENCY DIRECTLY.
 IF YOU CHOOSE TO GIVE OUT YOUR PIN OR PASSWORD TO THE CREDITOR OR  BUSI-
 NESS,  IT  IS RECOMMENDED THAT YOU OBTAIN A NEW PIN OR PASSWORD FROM THE
 CONSUMER CREDIT REPORTING AGENCY."
   (2)  If  a consumer requests information about a security freeze, such
 consumer shall be provided with the notice set forth in paragraph one of
 this subdivision and with any  other  information  necessary  to  place,
 temporarily  lift  or  permanently lift a security freeze, including but
 not limited to the address, telephone number  or  point  of  contact  at
 which the consumer credit reporting agency receives such requests.
   [(r)] (Q) When a consumer credit reporting agency erroneously releases
 a consumer credit report subject to a security freeze or any information
 contained  in such consumer credit report, the consumer credit reporting
 agency shall send written notification to the affected  consumer  within
 three  business days following discovery or notification of such errone-
 ous release. Such notification shall also inform  the  consumer  of  the
 nature  of  the  information  released  and identify and provide contact
 information for the recipient of such  information  or  consumer  credit
 report.
   [(s)]  (R) Whenever there shall be a violation of this section, appli-
 cation may be made by the attorney general in the name of the people  of
 the  state  of  New  York to a court or justice having jurisdiction by a
 special proceeding to issue  an  injunction,  and  upon  notice  to  the
 defendant of not less than five days, to enjoin and restrain the contin-
 uance  of such violations; and if it shall appear to the satisfaction of
 the court or justice that the defendant  has,  in  fact,  violated  this
 section, an injunction may be issued by such court or justice, enjoining
 and  restraining any further violation, without requiring proof that any
 person has, in fact, been  injured  or  damaged  thereby.  In  any  such
 proceeding,  the  court  may  make allowances to the attorney general as
 provided in paragraph six of subdivision  (a)  of  section  eighty-three
 hundred  three  of the civil practice law and rules, and direct restitu-
 tion. Whenever the court  shall  determine  that  a  violation  of  this
 section  has  occurred, the court may impose a civil penalty of not more
 than five thousand dollars for each violation. In  connection  with  any
 such  proposed  application,  the attorney general is authorized to take
 proof and make a determination  of  the  relevant  facts  and  to  issue
 subpoenas in accordance with the civil practice law and rules.
   §  2.  Paragraph  (g-1) of subdivision 2 of section 65.10 of the penal
 law is REPEALED.
   § 3. This act shall take effect on the one hundred eightieth day after
 it shall have become a law.

co-Sponsors

View additional co-sponsors

2017-S6886D (ACTIVE) - Details

Law Section:: General Business Law
Laws Affected:: Amd §380-t, Gen Bus L

2017-S6886D (ACTIVE) - Summary

2017-S6886D (ACTIVE) - Sponsor Memo

                                
 
BILL NUMBER: S6886D

SPONSOR: FUNKE
 
TITLE OF BILL:  An act to amend the general business law, in relation
to prohibiting consumer credit reporting agencies from charging a fee
for the placement, removal, or temporary lift of a security freeze on a
consumer credit report; and to repeal paragraph (g-1) of subdivision 2
of section 65.10 of the penal law relating thereto

 
PURPOSE OR GENERAL IDEA OF BILL:

To allow consumers to establish any and all credit freezes, and lift
(temporarily or otherwise) such freezes at consumer credit reporting
agencies without incurring any fees.

 
SUMMARY OF PROVISIONS:

Section 1 amends section 380-t of the general business law to prohibit
consumer credit reporting agencies from charging consumers a fee for the
placement, removal, or temporary lift of a security freeze, or for the
issuance of a replacement PIN or password.

Section 2 repeals paragraph (g-1) of subdivision 2 of section 65.10 of
the penal law.

Section 3 provides the effective date of the bill.

 
DIFFERENCE BETWEEN ORIGINAL AND AMENDED VERSION (IF APPLICABLE):

The original bill would have prohibited breached consumer credit report-
ing agencies from charging fees for security freezes, and required such
agencies to reimburse consumers for fees that they incurred for placing
security freezes with other, non-breached consumer credit reporting
agencies. The amended version of the bill prohibits all consumer credit
reporting agencies from charging a fee for the placement, lift, or
temporary removal of a security freeze.

 
JUSTIFICATION:

On September 7, 2017, consumer credit reporting agency Equifax made the
public aware of a security breach in its database. Individual personal-
ly-sensitive information, such as birthdays and Social

Security numbers, of seemingly 143 million consumers was compromised.
As a result, many New Yorkers are being urged to place security freezes
on their credit reports. These freezes keep potential creditors from
accessing an individual's credit file. Accordingly, a security freeze
can prevent an unauthorized person from using another individual's iden-
tity and credit to steal funds, which can ruin the victim's credit
rating. Under New York State's existing security freeze law, residents
are not charged for the placement of their first security freeze.

However, New Yorkers (except those who are victims of domestic
violence)can be charged up to $5 when they seek a second or further
credit freeze. In addition, there can be a charge of up to $5 for the
temporary lifting of a credit freeze, an approach that is often used
when an individual knows that they are about to apply for a new credit
card, mortgage or other loan. This legislation will strengthen consumer
protections by ensuring that individuals do not bear the cost of the
many security freeze transactions, across all credit bureaus (of which
there are three major competitors) that they are likely to undertake in
the wake of the Equifax or any similar data breach. Not only would this
allow consumers to prioritize rebuilding their financial lives without
bearing the financial cost of proper protections, also ensures that a
credit bureau cannot profit from its lax data security.

 
PRIOR LEGISLATIVE HISTORY:

This is a new bill.

 
FISCAL IMPLICATIONS FOR STATE AND LOCAL GOVERNMENTS:

None to the state.

 
EFFECTIVE DATE:
This act shall take effect on the one hundred eightieth day after it
shall have become law.

2017-S6886D (ACTIVE) - Bill Text download pdf

                            
 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                  6886--D
 
                        2017-2018 Regular Sessions
 
                             I N  S E N A T E
 
                            September 25, 2017
                                ___________
 
 Introduced by Sens. FUNKE, JACOBS -- read twice and ordered printed, and
   when  printed  to  be committed to the Committee on Rules -- committee
   discharged, bill amended, ordered reprinted as amended and recommitted
   to  said  committee  --  recommitted  to  the  Committee  on  Consumer
   Protection  in  accordance  with  Senate  Rule  6, sec. 8 -- committee
   discharged, bill amended, ordered reprinted as amended and recommitted
   to said committee  --  committee  discharged,  bill  amended,  ordered
   reprinted  as  amended  and recommitted to said committee -- committee
   discharged, bill amended, ordered reprinted as amended and recommitted
   to said committee
 
 AN ACT to amend the general business law,  in  relation  to  prohibiting
   consumer  credit reporting agencies from charging a fee for the place-
   ment, removal, or temporary lift of a security freeze  on  a  consumer
   credit  report;  and  to  repeal  paragraph  (g-1) of subdivision 2 of
   section 65.10 of the penal law relating thereto
 
   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section  1.  Section  380-t of the general business law, as amended by
 chapter 279 of the laws of 2008, subdivisions (b) and (n) as  separately
 amended  by  chapter  406  of  the  laws of 2008, and subdivision (g) as
 amended by section 36 of part A of chapter 62 of the laws  of  2011,  is
 amended to read as follows:
   § 380-t.  Security  freeze. (a) A consumer may request that a security
 freeze be placed on his or her  consumer  credit  report  by  sending  a
 request  in writing with confirmation of delivery requested or via tele-
 phone, secure electronic  means,  or  other  methods  developed  by  the
 consumer  credit  reporting agency to a consumer credit reporting agency
 at an address, telephone number or secure  website  designated  by  such
 agency  to  receive  such  requests.  Consumer credit reporting agencies
 shall have a secure website and a separately dedicated toll-free  number

  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD13493-10-8

 S. 6886--D                          2
 
 to  offer  information,  to  process  requests  and deliver the services
 provided for under this section.
   (b) A consumer credit reporting agency that receives from a consumer a
 request  in  accordance  with  subdivision  (a)  of  this section shall,
 provided such request  is  accompanied  by  proper  identification  [and
 payment  of any applicable fee], place a security freeze on the consumer
 credit report of or relating to such consumer no later than  four  busi-
 ness  days after receiving such request, provided further, however, that
 for requests received on or after January first, two thousand nine, such
 consumer credit reporting agency shall place a security  freeze  on  the
 consumer  credit  report  of  or relating to such consumer no later than
 three business days  after  receiving  such  request  and  for  requests
 received  on  or  after  January  first, two thousand ten, such consumer
 credit reporting agency shall place a security freeze  on  the  consumer
 credit report of or relating to such consumer no later than one business
 day  after  receiving such request. Nothing in this subdivision shall be
 construed to prevent a consumer credit reporting agency from advising  a
 third  party  that  a  security  freeze is in effect with respect to the
 consumer credit report of or relating  to  such  consumer.  No  consumer
 credit reporting agency shall advise in any manner a third party, of the
 fact  that  the  consumer  requesting  the  freeze is alleging to be the
 victim of domestic violence  or  identity  theft,  without  the  written
 authorization of the consumer.
   (c)  The consumer credit reporting agency shall send a written confir-
 mation of the placement of a security freeze to the consumer within five
 business days of placing such freeze. Upon placing the  security  freeze
 on  the  consumer  credit  report  of  or relating to such consumer, the
 consumer credit reporting agency  shall  provide  the  consumer  with  a
 unique personal identification number or password, or other device which
 shall  only be used by the consumer when providing authorization for the
 release of his or her consumer credit report for  a  specific  party  or
 specific  period  of  time. The unique personal identification number or
 password, or other device to be used by the  consumer  shall  not  be  a
 social  security  number or a sequential portion thereof. Any use of the
 unique personal identification number or password or other device  other
 than provided for in this section is prohibited.
   (d)  If the consumer wishes to allow his or her consumer credit report
 to be accessed for a specific party or a specific period of time while a
 freeze is in place, he or she shall contact the consumer credit  report-
 ing  agency  via  mail  with confirmation of delivery, telephone, secure
 electronic means or other  method  developed  by  such  consumer  credit
 reporting  agency  pursuant  to  subdivision (f) of this section using a
 point of contact designated by such consumer  credit  reporting  agency,
 request  that  the freeze be temporarily lifted, and provide the follow-
 ing:
   (1) proper identification;
   (2) the unique personal identification number or password provided  by
 the consumer credit reporting agency pursuant to subdivision (c) of this
 section; AND
   (3)  the  proper information regarding the party to which the consumer
 credit report should be available or  the  time  period  for  which  the
 consumer credit report shall be available to users of such report[; and
   (4) payment of any applicable fee].
   (e)  (1)  A  consumer  credit reporting agency that receives a request
 from a consumer to temporarily lift a freeze on a consumer credit report
 pursuant to subdivision (d) of  this  section,  shall  comply  with  the

 S. 6886--D                          3
 
 request:  (i)  no  later  than  three business days after receiving such
 request; (ii) as of September first, two thousand nine, a consumer cred-
 it reporting agency that receives a request via the use of  a  telephone
 or secure electronic method provided by the agency, pursuant to subdivi-
 sion  (d)  of  this section, shall release a consumer's credit report as
 requested by the consumer within fifteen minutes after  the  request  is
 received by the consumer credit reporting agency.
   (2)  A consumer credit reporting agency is not required to temporarily
 lift a security freeze within the time provided in subparagraph (ii)  of
 paragraph one of this subdivision if:
   (i)  the consumer fails to meet the requirements of subdivision (b) of
 this section; or
   (ii) the consumer credit reporting  agency's  ability  to  temporarily
 lift the security freeze within fifteen minutes is prevented by:
   (A) an act of God, including fire, earthquakes, hurricanes, storms, or
 similar natural disaster or phenomena;
   (B)  unauthorized  or illegal acts by a third party, including terror-
 ism, sabotage, riot, vandalism, labor  strikes  or  disputes  disrupting
 operations, or similar occurrence;
   (C)  operational  interruption, including electrical failure, unantic-
 ipated delay in equipment or replacement part delivery,  computer  hard-
 ware   or   software  failures  inhibiting  response  time,  or  similar
 disruption;
   (D) governmental action, including emergency  orders  or  regulations,
 judicial or law enforcement action, or similar directives;
   (E) regularly scheduled maintenance, during other than normal business
 hours, of, or updates to, the consumer reporting agency's systems; or
   (F) commercially reasonable maintenance of, or repair to, the consumer
 reporting agency's systems that is unexpected or unscheduled.
   (f)  A consumer credit reporting agency may develop procedures involv-
 ing other secure methods of communication,  including  the  use  of  the
 internet,  or  other  electronic  media to receive and process a request
 from a consumer to temporarily lift a freeze on a consumer credit report
 pursuant to subdivision (d) of this section in an expedited manner.
   (g) The department of state shall  monitor  the  state  of  technology
 relating  to  the means available to process requests for the lifting or
 removal of a security freeze, and shall report to the  legislature  when
 it is determined that the technology to process requests for the lifting
 or  removal  of  a security freeze in a shorter period of time than that
 set forth in subdivision (e) of this section is available.
   (h) A consumer credit reporting agency  shall  remove  or  temporarily
 lift  a  freeze placed on the consumer credit report of or relating to a
 consumer only in the following cases:
   (1) upon consumer request, pursuant to subdivision (d) or (k) of  this
 section; or
   (2)  if the consumer credit report of or relating to such consumer was
 frozen due to a material misrepresentation of fact by the consumer. If a
 consumer credit reporting agency intends  to  remove  a  freeze  upon  a
 consumer  credit  report pursuant to this paragraph, the consumer credit
 reporting agency shall notify the consumer in writing,  by  first  class
 mail,  within  three  business days prior to removing the freeze on such
 consumer credit report.
   (i) If a third party requests access to a consumer  credit  report  on
 which  a security freeze is in effect, and this request is in connection
 with an application for credit or any other use, and the  consumer  does

 S. 6886--D                          4
 
 not  allow  his  or  her  consumer credit report to be accessed for that
 period of time, the third party may treat the application as incomplete.
   (j)  If  a  consumer  requests  a security freeze, the consumer credit
 reporting agency shall disclose the process of placing  and  temporarily
 lifting  a  freeze,  and  the process for allowing access to information
 from such consumer credit report for a specific party  or  a  period  of
 time while the freeze is in place.
   (k)  (1)  A  security  freeze shall remain in place until the consumer
 requests, using a point of contact designated  by  the  consumer  credit
 reporting  agency,  that the security freeze be removed and provides the
 following:
   (i) proper identification; AND
   (ii) the unique personal identification number or password or  similar
 device  provided  by  the  consumer  credit reporting agency pursuant to
 subdivision (c) of this section[; and
   (iii) a fee, if applicable].
   (2) A consumer credit reporting agency shall remove a security  freeze
 within  three  business days of receiving a request for removal from the
 consumer pursuant to paragraph one of this subdivision.
   (l) A consumer credit reporting agency shall require proper  identifi-
 cation  of  the  person  making  a request to place or remove a security
 freeze.
   (m) The provisions of this section do  not  apply  to  the  use  of  a
 consumer credit report by any of the following:
   (1)  a  person or entity, or a subsidiary, affiliate, or agent of that
 person or entity, or an assignee of a financial obligation owing by  the
 consumer to that person or entity, or a prospective assignee of a finan-
 cial  obligation  owing  by  the  consumer  to  that person or entity in
 conjunction with the proposed purchase of the financial obligation, with
 which the consumer  has  or  had  prior  to  assignment  an  account  or
 contract,  including  a  demand deposit account, or to whom the consumer
 issued a negotiable  instrument,  for  the  purposes  of  reviewing  the
 account  or  collecting  the financial obligation owing for the account,
 contract, or negotiable instrument.  For  purposes  of  this  paragraph,
 "reviewing  the  account" includes activities related to account mainte-
 nance, monitoring, credit  line  increases,  and  account  upgrades  and
 enhancements;
   (2)  a subsidiary, affiliate, agent, assignee, or prospective assignee
 of a person to whom access has been granted for purposes of facilitating
 the extension of credit or other permissible use;
   (3) any state or local agency, law enforcement agency, court,  private
 collection  agency, or person acting pursuant to a court order, warrant,
 or subpoena;
   (4) a child support agency acting pursuant to title iv-d of the social
 security act (42 U.S.C. et seq.);
   (5) the state or its political subdivisions or its agents  or  assigns
 acting  to  investigate fraud or acting to investigate or collect delin-
 quent taxes or unpaid court orders or to fulfill any of its other statu-
 tory responsibilities provided such responsibilities are consistent with
 a permissible purpose under 15 U.S.C. section 1681b;
   (6) the use of credit information for the purposes of prescreening  as
 provided for by the federal fair credit reporting act;
   (7)  any  person  or  entity  administering  a  credit file monitoring
 subscription or similar service to which the consumer has subscribed; or

 S. 6886--D                          5
 
   (8) any person or entity for the purpose of providing a consumer  with
 a copy of his or her consumer credit report or score upon the request of
 such consumer.
   (n) [(1) (i) No consumer credit reporting agency shall charge a fee to
 a  victim of identity theft who submits a copy of a signed federal trade
 commission ID theft victim's affidavit, or a report of ID theft  from  a
 law enforcement agency to such consumer credit reporting agency.
   (ii)  No  consumer  credit  reporting  agency  shall charge a fee to a
 domestic violence victim who  has  submitted  to  such  consumer  credit
 reporting agency:
   (A)  a  valid  domestic  violence incident report form as such term is
 defined in subdivision fifteen of section eight hundred thirty-seven  of
 the executive law;
   (B) a valid police report;
   (C) a valid order of protection; or
   (D)  a  signed affidavit from a licensed medical or mental health care
 provider, employee of a court acting within the  scope  of  his  or  her
 employment, social worker, a rape crisis counselor as defined in section
 forty-five  hundred ten of the civil practice law and rules, or advocate
 acting on behalf of an agency that assists domestic violence victims.
   For the purposes of this  subdivision,  the  term  "domestic  violence
 victim"  means  an  individual  who  is a victim of a family offense, as
 described in subdivision one of section 530.11 of the criminal procedure
 law, or an offense committed by a member of such individual's  immediate
 family,  as  defined  in subdivision four of section 120.40 of the penal
 law.
   (2) No consumer credit reporting  agency  shall  charge  a  fee  to  a
 consumer requesting the placement of a security freeze when such consum-
 er  has not previously requested the placement of a security freeze from
 such consumer credit reporting agency. Except as provided for  in  para-
 graph  one  of  this subdivision, a consumer credit reporting agency may
 charge a consumer a fee not to exceed five dollars for the placement  of
 a  second  or  subsequent  freeze  or for the removal of a freeze or the
 temporary lift of a freeze for a specific party or period of time or for
 the issuance of a replacement personal identification number or password
 when the consumer fails to retain the personal identification number  or
 password  provided  to  such  consumer by such consumer credit reporting
 agency pursuant to subdivision (c) of this section.] NO CONSUMER  CREDIT
 REPORTING AGENCY SHALL CHARGE A FEE TO ANY CONSUMER FOR THE PLACEMENT OF
 ANY  SECURITY  FREEZE, THE REMOVAL OF ANY SECURITY FREEZE, THE TEMPORARY
 LIFT OF ANY SECURITY FREEZE FOR A SPECIFIC PARTY OR PERIOD OF  TIME,  OR
 THE  ISSUANCE OF ANY REPLACEMENT PERSONAL IDENTIFICATION NUMBER OR PASS-
 WORD WHEN THE CONSUMER  FAILS  TO  RETAIN  THE  PERSONAL  IDENTIFICATION
 NUMBER  OR  PASSWORD  PROVIDED  TO SUCH CONSUMER BY SUCH CONSUMER CREDIT
 REPORTING AGENCY PURSUANT TO SUBDIVISION (C) OF THIS SECTION.
   (o) If a security freeze is in  place,  a  consumer  credit  reporting
 agency  shall  not change any of the following official information in a
 consumer credit report without sending a  written  confirmation  of  the
 change  to the consumer within thirty days of the change being posted to
 the file of or relating to such consumer: name, date  of  birth,  social
 security  number,  and address. Written confirmation is not required for
 technical modifications of the official information of  or  relating  to
 such  consumer, including name and street abbreviations, complete spell-
 ings, or transposition of numbers or letters. In the case of an  address
 change,  the  written confirmation shall be sent to both the new address
 and to the former address.

 S. 6886--D                          6
 
   (p) The following entities are not required to place a security freeze
 on a consumer credit report:
   (1) a consumer credit reporting agency that acts only as a reseller of
 credit  information  by  assembling and merging information contained in
 the data base of another consumer credit reporting  agency  or  multiple
 consumer  credit  reporting  agencies, and does not maintain a permanent
 data base of credit information from which new consumer  credit  reports
 are  produced.  However,  a consumer credit reporting agency acting as a
 reseller shall honor any security freeze placed  on  a  consumer  credit
 report by another consumer credit reporting agency;
   (2)  a  check  services  or  fraud  prevention services company, which
 issues reports on incidents of fraud or authorizations for  the  purpose
 of  approving  or  processing  negotiable  instruments, electronic funds
 transfers, or similar methods of payments; or
   (3) a  deposit  account  information  service  company,  which  issues
 reports regarding account closures due to fraud, substantial overdrafts,
 ATM  abuse,  or  similar  negative  information regarding a consumer, to
 inquiring banks or other financial institutions for use only in  review-
 ing  a  consumer  request for a deposit account at the inquiring bank or
 financial institution.
   (q) (1) Any time a consumer credit reporting  agency  is  required  to
 send  a  summary  of rights required under 15 U.S.C. section 1681g, to a
 consumer residing in this state the following notice shall  be  included
 with such summary of rights:
   "NEW YORK CONSUMERS HAVE THE RIGHT TO OBTAIN A SECURITY FREEZE.
   YOU  HAVE  A RIGHT TO PLACE A "SECURITY FREEZE" ON YOUR CREDIT REPORT,
 WHICH WILL PROHIBIT A CONSUMER CREDIT REPORTING  AGENCY  FROM  RELEASING
 INFORMATION IN YOUR CREDIT REPORT WITHOUT YOUR EXPRESS AUTHORIZATION.  A
 CONSUMER  CREDIT  REPORTING AGENCY IS PROHIBITED FROM CHARGING YOU A FEE
 FOR THE PLACEMENT, REMOVAL, OR TEMPORARY LIFT OF A SECURITY  FREEZE,  OR
 FOR  THE  ISSUANCE OF A REPLACEMENT PERSONAL IDENTIFICATION NUMBER (PIN)
 OR PASSWORD IN THE EVENT THAT YOU FAIL TO RETAIN  THE  ORIGINAL  PIN  OR
 PASSWORD  PROVIDED  TO  YOU  BY SUCH CONSUMER CREDIT REPORTING AGENCY. A
 SECURITY FREEZE MUST  BE  REQUESTED  IN  WRITING  DELIVERY  CONFIRMATION
 REQUESTED  OR  VIA  TELEPHONE, SECURE ELECTRONIC MEANS, OR OTHER METHODS
 DEVELOPED BY THE CONSUMER CREDIT REPORTING AGENCY. THE  SECURITY  FREEZE
 IS  DESIGNED  TO PREVENT CREDIT, LOANS, AND SERVICES FROM BEING APPROVED
 IN YOUR NAME WITHOUT YOUR CONSENT. HOWEVER, YOU  SHOULD  BE  AWARE  THAT
 USING  A  SECURITY  FREEZE  TO  TAKE CONTROL OVER WHO GETS ACCESS TO THE
 PERSONAL AND FINANCIAL INFORMATION IN  YOUR  CREDIT  REPORT  MAY  DELAY,
 INTERFERE  WITH,  OR  PROHIBIT  THE  TIMELY  APPROVAL  OF ANY SUBSEQUENT
 REQUEST OR APPLICATION YOU MAKE REGARDING A NEW LOAN, CREDIT,  MORTGAGE,
 GOVERNMENT  SERVICES OR PAYMENTS, INSURANCE, RENTAL HOUSING, EMPLOYMENT,
 INVESTMENT,  LICENSE,  CELLULAR  PHONE,  UTILITIES,  DIGITAL  SIGNATURE,
 INTERNET CREDIT CARD TRANSACTION, OR OTHER SERVICES, INCLUDING AN EXTEN-
 SION  OF  CREDIT  AT  POINT OF SALE. WHEN YOU PLACE A SECURITY FREEZE ON
 YOUR CREDIT REPORT, YOU  WILL  BE  PROVIDED  A  PERSONAL  IDENTIFICATION
 NUMBER  OR  PASSWORD  TO  USE IF YOU CHOOSE TO REMOVE THE FREEZE ON YOUR
 CREDIT REPORT OR AUTHORIZE THE  RELEASE  OF  YOUR  CREDIT  REPORT  TO  A
 SPECIFIC  PARTY OR FOR A PERIOD OF TIME AFTER THE FREEZE IS IN PLACE. TO
 PROVIDE THAT AUTHORIZATION YOU MUST CONTACT THE CONSUMER CREDIT  REPORT-
 ING AGENCY AND PROVIDE ALL OF THE FOLLOWING:
   (1) THE PERSONAL IDENTIFICATION NUMBER OR PASSWORD;
   (2) PROPER IDENTIFICATION TO VERIFY YOUR IDENTITY; AND

 S. 6886--D                          7
 
   (3)  THE  PROPER INFORMATION REGARDING THE PARTY OR PARTIES WHO ARE TO
 RECEIVE THE CREDIT REPORT OR THE PERIOD OF TIME  FOR  WHICH  THE  REPORT
 SHALL BE AVAILABLE TO USERS OF THE CREDIT REPORT[; AND
   (4) PAYMENT OF ANY APPLICABLE FEE].
   A  CONSUMER CREDIT REPORTING AGENCY MUST AUTHORIZE THE RELEASE OF YOUR
 CREDIT REPORT NO LATER THAN THREE  BUSINESS  DAYS  AFTER  RECEIVING  THE
 ABOVE  INFORMATION.  EFFECTIVE  SEPTEMBER  FIRST,  TWO  THOUSAND NINE, A
 CONSUMER CREDIT REPORTING AGENCY THAT RECEIVES A REQUEST  VIA  TELEPHONE
 OR  SECURE  ELECTRONIC  METHOD  SHALL RELEASE A CONSUMER'S CREDIT REPORT
 WITHIN FIFTEEN MINUTES WHEN THE REQUEST IS RECEIVED.
   A SECURITY FREEZE DOES NOT APPLY TO CIRCUMSTANCES IN WHICH YOU HAVE AN
 EXISTING ACCOUNT RELATIONSHIP AND A COPY OF YOUR REPORT IS REQUESTED  BY
 YOUR  EXISTING CREDITOR OR ITS AGENTS OR AFFILIATES FOR CERTAIN TYPES OF
 ACCOUNT REVIEW, COLLECTION, FRAUD CONTROL OR SIMILAR ACTIVITIES.
   IF YOU ARE ACTIVELY SEEKING CREDIT, YOU  SHOULD  UNDERSTAND  THAT  THE
 PROCEDURES  INVOLVED IN LIFTING A SECURITY FREEZE MAY SLOW YOUR APPLICA-
 TION FOR CREDIT. YOU  SHOULD  PLAN  AHEAD  AND  LIFT  A  FREEZE,  EITHER
 COMPLETELY  IF  YOU  ARE  SHOPPING AROUND, OR SPECIFICALLY FOR A CERTAIN
 CREDITOR, BEFORE APPLYING FOR NEW CREDIT. WHEN SEEKING CREDIT OR  PURSU-
 ING  ANOTHER  TRANSACTION  REQUIRING ACCESS TO YOUR CREDIT REPORT, IT IS
 NOT NECESSARY TO RELINQUISH YOUR PIN OR  PASSWORD  TO  THE  CREDITOR  OR
 BUSINESS; YOU CAN CONTACT THE CONSUMER CREDIT REPORTING AGENCY DIRECTLY.
 IF  YOU CHOOSE TO GIVE OUT YOUR PIN OR PASSWORD TO THE CREDITOR OR BUSI-
 NESS, IT IS RECOMMENDED THAT YOU OBTAIN A NEW PIN OR PASSWORD  FROM  THE
 CONSUMER CREDIT REPORTING AGENCY."
   (2)  If  a consumer requests information about a security freeze, such
 consumer shall be provided with the notice set forth in paragraph one of
 this subdivision and with any  other  information  necessary  to  place,
 temporarily  lift  or  permanently lift a security freeze, including but
 not limited to the address, telephone number  or  point  of  contact  at
 which the consumer credit reporting agency receives such requests.
   (r)  When  a  consumer  credit reporting agency erroneously releases a
 consumer credit report subject to a security freeze or  any  information
 contained  in such consumer credit report, the consumer credit reporting
 agency shall send written notification to the affected  consumer  within
 three  business days following discovery or notification of such errone-
 ous release. Such notification shall also inform  the  consumer  of  the
 nature  of  the  information  released  and identify and provide contact
 information for the recipient of such  information  or  consumer  credit
 report.
   (s)  Whenever  there shall be a violation of this section, application
 may be made by the attorney general in the name of  the  people  of  the
 state of New York to a court or justice having jurisdiction by a special
 proceeding  to  issue an injunction, and upon notice to the defendant of
 not less than five days, to enjoin and restrain the continuance of  such
 violations;  and  if it shall appear to the satisfaction of the court or
 justice that the defendant has,  in  fact,  violated  this  section,  an
 injunction  may  be  issued  by  such  court  or  justice, enjoining and
 restraining any further violation,  without  requiring  proof  that  any
 person  has,  in  fact,  been  injured  or  damaged thereby. In any such
 proceeding, the court may make allowances to  the  attorney  general  as
 provided  in  paragraph  six  of subdivision (a) of section eighty-three
 hundred three of the civil practice law and rules, and  direct  restitu-
 tion.  Whenever  the  court  shall  determine  that  a violation of this
 section has occurred, the court may impose a civil penalty of  not  more
 than  five  thousand  dollars for each violation. In connection with any

 S. 6886--D                          8
 
 such proposed application, the attorney general is  authorized  to  take
 proof  and  make  a  determination  of  the  relevant facts and to issue
 subpoenas in accordance with the civil practice law and rules.
   §  2.  Paragraph  (g-1) of subdivision 2 of section 65.10 of the penal
 law is REPEALED.
   § 3. This act shall take effect on the one hundred eightieth day after
 it shall have become a law.

Comments

Open Legislation is a forum for New York State legislation. All comments are subject to review and community moderation is encouraged.

Comments deemed off-topic, commercial, campaign-related, self-promotional; or that contain profanity, hate or toxic speech; or that link to sites outside of the nysenate.gov domain are not permitted, and will not be published. Attempts to intimidate and silence contributors or deliberately deceive the public, including excessive or extraneous posting/posts, or coordinated activity, are prohibited and may result in the temporary or permanent banning of the user. Comment moderation is generally performed Monday through Friday. By contributing or voting you agree to the Terms of Participation and verify you are over 13.

Create an account. An account allows you to sign petitions with a single click, officially support or oppose key legislation, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.

Senate Bill S6886A

Share this bill

Sponsored By

Rich Funke

Archive: Last Bill Status - Signed by Governor

Bill Amendments

2017-S6886 - Details

2017-S6886 - Summary

2017-S6886 - Sponsor Memo

2017-S6886 - Bill Text download pdf

2017-S6886A - Details

2017-S6886A - Summary

2017-S6886A - Sponsor Memo

2017-S6886A - Bill Text download pdf

2017-S6886B - Details

2017-S6886B - Summary

2017-S6886B - Sponsor Memo

2017-S6886B - Bill Text download pdf

co-Sponsors

Chris Jacobs

2017-S6886C - Details

2017-S6886C - Summary

2017-S6886C - Sponsor Memo

2017-S6886C - Bill Text download pdf

co-Sponsors

Chris Jacobs

David Carlucci

Martin J. Golden

Timothy M. Kennedy

2017-S6886D (ACTIVE) - Details

2017-S6886D (ACTIVE) - Summary

2017-S6886D (ACTIVE) - Sponsor Memo

2017-S6886D (ACTIVE) - Bill Text download pdf

Comments