NY State Senate Bill 2017-S6891

Senate Bill S6891

2017-2018 Legislative Session

Relates to the timeliness of disclosure of a breach of the security of a system that contains private information

download bill text pdf

Archive: Last Bill Status - In Senate Committee Consumer Protection Committee

Introduced
- In Committee Assembly
- In Committee Senate
- On Floor Calendar Assembly
- On Floor Calendar Senate
- Passed Assembly
- Passed Senate
Delivered to Governor
Signed By Governor

Please enter your contact information

First Name

Last Name

Email Address

A valid email address is required.

Home address is used to determine the senate district in which you reside. Your support or opposition to this bill is then shared immediately with the senator who represents you.

Optional services from the NY State Senate:

Create an account. An account allows you to officially support or oppose key legislation, sign petitions with a single click, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.

Include a custom message for your Senator? (Optional)

Enter a message to your senator. Many New Yorkers use this to share the reasoning behind their support or opposition to the bill. Others might share a personal anecdote about how the bill would affect them or people they care about.

Actions

View Actions

	Assembly Actions - Lowercase Senate Actions - UPPERCASE
Jan 03, 2018	referred to consumer protection
Sep 29, 2017	referred to rules

2017-S6891 (ACTIVE) - Details

Current Committee:: Senate Consumer Protection
Law Section:: General Business Law
Laws Affected:: Amd §§380-t & 380-u, Gen Bus L
Versions Introduced in 2019-2020 Legislative Session:: S135

2017-S6891 (ACTIVE) - Summary

Relates to the timeliness of disclosure of a breach of the security of a system that contains private information; removes language that a fee be paid when a freeze is lifted; and requires a security freeze be lifted within one business day of a request.

2017-S6891 (ACTIVE) - Sponsor Memo

                                
 
BILL NUMBER: S6891

SPONSOR: CARLUCCI
 
TITLE OF BILL:

An act to amend the general business law, in relation to the timeliness
of disclosure of a breach of the security of a system that contains
private information

 
PURPOSE:

To require that persons or businesses possessing consumer's personal
information provide a free credit information freeze to any consumer.

 
SUMMARY OF PROVISIONS:

Section 1 - Titles this bill "the Credit Empowerment Act"

Section 2 - Requires that any person or business under the jurisdiction
of the general business law provide any consumer whose personal informa-
tion they are in possession of with a credit freeze, free of charge upon

request. No reason is required to request such a freeze and it will be
provided free of charge. Any lift of a freeze must also be performed
free of charge. Likewise, a new indefinite freeze may be placed on
personal information by the requesting consumer for any reason, also
free of charge. Removes current identification requirements currently
applied to victims of identity theft and domestic abuse. Lowers the
period of time a business has to provide a credit "thaw" from 3 days to
24 hours. Applies existing credit freeze law to all credit information-
related businesses.

Section 3 - Effective date.

 
EXISTING LAW:

Currently, credit freezes for consumers are only given for free the
first time. Companies may charge a fee for "thawing" and refreezing
consumer credit information. Additionally, though fees may be waived for
victims of domestic abuse or identification theft, they must provide
burdensome identification such as a police report or medical report.
Businesses currently have 3 days ' to "thaw" consumer credit informa-
tion. Finally, certain businesses are exempt from the current credit
freeze law. These include, Consumer credit reporting agencies that act
only as resellers of credit information by assembling and merging infor-
mation contained in the data base of another consumer credit reporting
agency (these must only honor an existing freeze, but do not have to
place one on data they have received), most check services or fraud
prevention services that act as clearinghouses, and deposit account
information services that monitor debit transfers for unusual activity.

 
JUSTIFICATION:

Recent headlines have been dominated by a massive data breach that
impacted the largest credit-reporting firm in the United States. This
breach is estimated to have effected 143 million Americans, or 44% of
the population. Millions suddenly found that their birthdates, home
addresses, telephone numbers, and, in some cases, even their social
security numbers and drivers license numbers had been leaked.

The implications of such a large scale and egregious breach of consumer
data security are serious. Millions have been exposed to the possibility
of becoming victims of identity theft. This can lead to ongoing credit
problems and major costs to consumers to remedy the damage done. We must
do more to make sure that data breaches are prevented. But just as
important, is making sure consumers and law enforcement have the tools
available to mitigate damage as soon as a breach occurs. This bill, part
of a larger package that will target consumer data breaches at every
stage, will provide one of those tools.

Under current law, there is no requirement that businesses provide
consumers with a credit freeze, whether in the event of a data breach or
otherwise. This bill corrects this by requiring that businesses provide
consumers with a credit freeze upon request, no matter the reason, free
of charge. The freeze will last for an indefinite period of time and may
only be lifted at the consumer's request, also free of charge. Finally,
the consumer may resume the freeze at any time, free of charge.

A credit freeze is a complete hold on the ability of companies to share
consumers personal information with other companies for purposes of
credit reporting.

Access to an immediate credit freeze would have done much to mitigate
the damage done by the recent major data breach. It would have given
consumers the knowledge that their data was no longer floating in the
stream of commerce at a time it was already compromised. The firm that
was compromised did offer to provide credit freezes, but attempted to
charge consumers for the service. It was only after several days of
immense public pressure that the firm began to provide them for free -
and the offer only stood for 30 days. This does not go nearly far
enough.

The reality is that consumers do not seek out credit reporting firms
looking to provide them with their confidential personal information.
These companies are given that information by other firms looking to run
credit reports. This is not right. It should be the consumer who has the
final say over whether or not their data is available and who may
possess it. Furthermore, this should be a right the consumer has, and
not a privilege for which they must pay. This bill puts that power back
in the hands of the consumer.

 
LEGISLATIVE HISTORY:

New bill.

 
FISCAL IMPLICATIONS:

None to the state.

 
EFFECTIVE DATE:
Immediately.

2017-S6891 (ACTIVE) - Bill Text download pdf

                            
 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   6891
 
                        2017-2018 Regular Sessions
 
                             I N  S E N A T E
 
                            September 29, 2017
                                ___________
 
 Introduced  by Sen. CARLUCCI -- read twice and ordered printed, and when
   printed to be committed to the Committee on Rules
 
 AN ACT to amend the general business law, in relation to the  timeliness
   of  disclosure  of  a breach of the security of a system that contains
   private information

   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section  1.  Short  title. This act shall be known and may be cited as
 the "Credit Empowerment Act".
   § 2. Section 380-t of the general business law, as amended by  chapter
 279  of the laws of 2008, subdivisions (b) and (n) as separately amended
 by chapter 406 of the laws of 2008, and subdivision (g)  as  amended  by
 section  36  of  part A of chapter 62 of the laws of 2011, is amended to
 read as follows:
   § 380-t. Security freeze. (a) A consumer may request that  a  security
 freeze  be  placed  on  his  or  her consumer credit report by sending a
 request in writing with confirmation of delivery requested or via  tele-
 phone,  secure  electronic  means,  or  other  methods  developed by the
 consumer credit reporting agency to a consumer credit  reporting  agency
 at  an  address,  telephone  number or secure website designated by such
 agency to receive such  requests.  Consumer  credit  reporting  agencies
 shall  have a secure website and a separately dedicated toll-free number
 to offer information, to  process  requests  and  deliver  the  services
 provided for under this section.
   (b) A consumer credit reporting agency that receives from a consumer a
 request  in  accordance  with  subdivision  (a)  of  this section shall,
 provided such  request  is  accompanied  by  proper  identification  and
 payment  of  any applicable fee, place a security freeze on the consumer
 credit report of or relating to such consumer no later than  four  busi-
 ness  days after receiving such request, provided further, however, that
 for requests received on or after January first, two thousand nine, such
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.

                                                            LBD13525-02-7

 S. 6891                             2
 
 consumer credit reporting agency shall place a security  freeze  on  the
 consumer  credit  report  of  or relating to such consumer no later than
 three business days  after  receiving  such  request  and  for  requests
 received  on  or  after  January  first, two thousand ten, such consumer
 credit reporting agency shall place a security freeze  on  the  consumer
 credit report of or relating to such consumer no later than one business
 day  after  receiving such request. Nothing in this subdivision shall be
 construed to prevent a consumer credit reporting agency from advising  a
 third  party  that  a  security  freeze is in effect with respect to the
 consumer credit report of or relating  to  such  consumer.  No  consumer
 credit reporting agency shall advise in any manner a third party, of the
 fact  that  the  consumer  requesting  the  freeze is alleging to be the
 victim of domestic violence  or  identity  theft,  without  the  written
 authorization of the consumer.
   (c)  The consumer credit reporting agency shall send a written confir-
 mation of the placement of a security freeze to the consumer within five
 business days of placing such freeze. Upon placing the  security  freeze
 on  the  consumer  credit  report  of  or relating to such consumer, the
 consumer credit reporting agency  shall  provide  the  consumer  with  a
 unique personal identification number or password, or other device which
 shall  only be used by the consumer when providing authorization for the
 release of his or her consumer credit report for  a  specific  party  or
 specific  period  of  time. The unique personal identification number or
 password, or other device to be used by the  consumer  shall  not  be  a
 social  security  number or a sequential portion thereof. Any use of the
 unique personal identification number or password or other device  other
 than provided for in this section is prohibited.
   (d)  If the consumer wishes to allow his or her consumer credit report
 to be accessed for a specific party or a specific period of time while a
 freeze is in place, he or she shall contact the consumer credit  report-
 ing  agency  via  mail  with confirmation of delivery, telephone, secure
 electronic means or other  method  developed  by  such  consumer  credit
 reporting  agency  pursuant  to  subdivision (f) of this section using a
 point of contact designated by such consumer  credit  reporting  agency,
 request  that  the freeze be temporarily lifted, and provide the follow-
 ing:
   (1) proper identification;
   (2) the unique personal identification number or password provided  by
 the consumer credit reporting agency pursuant to subdivision (c) of this
 section; AND
   (3)  the  proper information regarding the party to which the consumer
 credit report should be available or  the  time  period  for  which  the
 consumer credit report shall be available to users of such report[; and
   (4) payment of any applicable fee].
   (e)  (1)  A  consumer  credit reporting agency that receives a request
 from a consumer to temporarily lift a freeze on a consumer credit report
 pursuant to subdivision (d) of  this  section,  shall  comply  with  the
 request: (i) no later than [three] ONE business [days] DAY after receiv-
 ing  such  request;  (ii)  as  of  September first, two thousand nine, a
 consumer credit reporting agency that receives a request via the use  of
 a telephone or secure electronic method provided by the agency, pursuant
 to  subdivision  (d)  of this section, shall release a consumer's credit
 report as requested by the consumer within  fifteen  minutes  after  the
 request is received by the consumer credit reporting agency.

 S. 6891                             3
 
   (2)  A consumer credit reporting agency is not required to temporarily
 lift a security freeze within the time provided in subparagraph (ii)  of
 paragraph one of this subdivision if:
   (i)  the consumer fails to meet the requirements of subdivision (b) of
 this section; or
   (ii) the consumer credit reporting  agency's  ability  to  temporarily
 lift the security freeze within fifteen minutes is prevented by:
   (A) an act of God, including fire, earthquakes, hurricanes, storms, or
 similar natural disaster or phenomena;
   (B)  unauthorized  or illegal acts by a third party, including terror-
 ism, sabotage, riot, vandalism, labor  strikes  or  disputes  disrupting
 operations, or similar occurrence;
   (C)  operational  interruption, including electrical failure, unantic-
 ipated delay in equipment or replacement part delivery,  computer  hard-
 ware   or   software  failures  inhibiting  response  time,  or  similar
 disruption;
   (D) governmental action, including emergency  orders  or  regulations,
 judicial or law enforcement action, or similar directives;
   (E) regularly scheduled maintenance, during other than normal business
 hours, of, or updates to, the consumer reporting agency's systems; or
   (F) commercially reasonable maintenance of, or repair to, the consumer
 reporting agency's systems that is unexpected or unscheduled.
   (f)  A consumer credit reporting agency may develop procedures involv-
 ing other secure methods of communication,  including  the  use  of  the
 internet,  or  other  electronic  media to receive and process a request
 from a consumer to temporarily lift a freeze on a consumer credit report
 pursuant to subdivision (d) of this section in an expedited manner.
   (g) The department of state shall  monitor  the  state  of  technology
 relating  to  the means available to process requests for the lifting or
 removal of a security freeze, and shall report to the  legislature  when
 it is determined that the technology to process requests for the lifting
 or  removal  of  a security freeze in a shorter period of time than that
 set forth in subdivision (e) of this section is available.
   (h) A consumer credit reporting agency  shall  remove  or  temporarily
 lift  a  freeze placed on the consumer credit report of or relating to a
 consumer only in the following cases:
   (1) upon consumer request, pursuant to subdivision (d) or (k) of  this
 section; or
   (2)  if the consumer credit report of or relating to such consumer was
 frozen due to a material misrepresentation of fact by the consumer. If a
 consumer credit reporting agency intends  to  remove  a  freeze  upon  a
 consumer  credit  report pursuant to this paragraph, the consumer credit
 reporting agency shall notify the consumer in writing,  by  first  class
 mail,  within  three  business days prior to removing the freeze on such
 consumer credit report.
   (i) If a third party requests access to a consumer  credit  report  on
 which  a security freeze is in effect, and this request is in connection
 with an application for credit or any other use, and the  consumer  does
 not  allow  his  or  her  consumer credit report to be accessed for that
 period of time, the third party may treat the application as incomplete.
   (j) If a consumer requests a  security  freeze,  the  consumer  credit
 reporting  agency  shall disclose the process of placing and temporarily
 lifting a freeze, and the process for  allowing  access  to  information
 from  such  consumer  credit  report for a specific party or a period of
 time while the freeze is in place.

 S. 6891                             4
 
   (k) (1) A security freeze shall remain in  place  until  the  consumer
 requests,  using  a  point  of contact designated by the consumer credit
 reporting agency, that the security freeze be removed and  provides  the
 following:
   (i) proper identification; AND
   (ii)  the unique personal identification number or password or similar
 device provided by the consumer  credit  reporting  agency  pursuant  to
 subdivision (c) of this section[; and
   (iii) a fee, if applicable].
   (2)  A consumer credit reporting agency shall remove a security freeze
 within [three] ONE business  [days]  DAY  of  receiving  a  request  for
 removal from the consumer pursuant to paragraph one of this subdivision.
   (l)  A consumer credit reporting agency shall require proper identifi-
 cation of the person making a request to  place  or  remove  a  security
 freeze.
   (m)  The  provisions  of  this  section  do  not apply to the use of a
 consumer credit report by any of the following:
   (1) a person or entity, or a subsidiary, affiliate, or agent  of  that
 person  or entity, or an assignee of a financial obligation owing by the
 consumer to that person or entity, or a prospective assignee of a finan-
 cial obligation owing by the  consumer  to  that  person  or  entity  in
 conjunction with the proposed purchase of the financial obligation, with
 which  the  consumer  has  or  had  prior  to  assignment  an account or
 contract, including a demand deposit account, or to  whom  the  consumer
 issued  a  negotiable  instrument,  for  the  purposes  of reviewing the
 account or collecting the financial obligation owing  for  the  account,
 contract,  or  negotiable  instrument.  For  purposes of this paragraph,
 "reviewing the account" includes activities related to  account  mainte-
 nance,  monitoring,  credit  line  increases,  and  account upgrades and
 enhancements;
   (2) a subsidiary, affiliate, agent, assignee, or prospective  assignee
 of a person to whom access has been granted for purposes of facilitating
 the extension of credit or other permissible use;
   (3)  any state or local agency, law enforcement agency, court, private
 collection agency, or person acting pursuant to a court order,  warrant,
 or subpoena;
   (4) a child support agency acting pursuant to title iv-d of the social
 security act (42 U.S.C. et seq.);
   (5)  the  state or its political subdivisions or its agents or assigns
 acting to investigate fraud or acting to investigate or  collect  delin-
 quent taxes or unpaid court orders or to fulfill any of its other statu-
 tory responsibilities provided such responsibilities are consistent with
 a permissible purpose under 15 U.S.C. section 1681b;
   (6)  the use of credit information for the purposes of prescreening as
 provided for by the federal fair credit reporting act;
   (7) any person  or  entity  administering  a  credit  file  monitoring
 subscription or similar service to which the consumer has subscribed; or
   (8)  any person or entity for the purpose of providing a consumer with
 a copy of his or her consumer credit report or score upon the request of
 such consumer.
   (n) [(1) (i) No consumer credit reporting agency shall charge a fee to
 a victim of identity theft who submits a copy of a signed federal  trade
 commission  ID  theft victim's affidavit, or a report of ID theft from a
 law enforcement agency to such consumer credit reporting agency.

 S. 6891                             5

   (ii) No consumer credit reporting agency  shall  charge  a  fee  to  a
 domestic  violence  victim  who  has  submitted  to such consumer credit
 reporting agency:
   (A)  a  valid  domestic  violence incident report form as such term is
 defined in subdivision fifteen of section eight hundred thirty-seven  of
 the executive law;
   (B) a valid police report;
   (C) a valid order of protection; or
   (D)  a  signed affidavit from a licensed medical or mental health care
 provider, employee of a court acting within the  scope  of  his  or  her
 employment, social worker, a rape crisis counselor as defined in section
 forty-five  hundred ten of the civil practice law and rules, or advocate
 acting on behalf of an agency that assists domestic violence victims.
   For the purposes of this  subdivision,  the  term  "domestic  violence
 victim"  means  an  individual  who  is a victim of a family offense, as
 described in subdivision one of section 530.11 of the criminal procedure
 law, or an offense committed by a member of such individual's  immediate
 family,  as  defined  in subdivision four of section 120.40 of the penal
 law.
   (2)] No consumer credit reporting agency  shall  charge  a  fee  to  a
 consumer  requesting  the  placement  of  a  security  freeze [when such
 consumer has not previously requested the placement of a security freeze
 from such consumer credit reporting agency. Except as  provided  for  in
 paragraph one of this subdivision, a]. A consumer credit reporting agen-
 cy  may NOT charge a consumer a fee [not to exceed five dollars] for the
 placement of a second or subsequent freeze  or  for  the  removal  of  a
 freeze  or the temporary lift of a freeze for a specific party or period
 of time or for the issuance of  a  replacement  personal  identification
 number  or password when the consumer fails to retain the personal iden-
 tification number or password provided to such consumer by such consumer
 credit reporting agency pursuant to subdivision (c) of this section.
   (o) If a security freeze is in  place,  a  consumer  credit  reporting
 agency  shall  not change any of the following official information in a
 consumer credit report without sending a  written  confirmation  of  the
 change  to the consumer within thirty days of the change being posted to
 the file of or relating to such consumer: name, date  of  birth,  social
 security  number,  and address. Written confirmation is not required for
 technical modifications of the official information of  or  relating  to
 such  consumer, including name and street abbreviations, complete spell-
 ings, or transposition of numbers or letters. In the case of an  address
 change,  the  written confirmation shall be sent to both the new address
 and to the former address.
   (p) [The following entities are  not  required  to  place  a  security
 freeze on a consumer credit report:
   (1) a consumer credit reporting agency that acts only as a reseller of
 credit  information  by  assembling and merging information contained in
 the data base of another consumer credit reporting  agency  or  multiple
 consumer  credit  reporting  agencies, and does not maintain a permanent
 data base of credit information from which new consumer  credit  reports
 are  produced.  However,  a consumer credit reporting agency acting as a
 reseller shall honor any security freeze placed  on  a  consumer  credit
 report by another consumer credit reporting agency;
   (2)  a  check  services  or  fraud  prevention services company, which
 issues reports on incidents of fraud or authorizations for  the  purpose
 of  approving  or  processing  negotiable  instruments, electronic funds
 transfers, or similar methods of payments; or

 S. 6891                             6

   (3) a  deposit  account  information  service  company,  which  issues
 reports regarding account closures due to fraud, substantial overdrafts,
 ATM  abuse,  or  similar  negative  information regarding a consumer, to
 inquiring banks or other financial institutions for use only in  review-
 ing  a  consumer  request for a deposit account at the inquiring bank or
 financial institution.
   (q)] (1) Any time a consumer credit reporting agency  is  required  to
 send  a  summary  of rights required under 15 U.S.C. section 1681g, to a
 consumer residing in this state the following notice shall  be  included
 with such summary of rights:
   "NEW YORK CONSUMERS HAVE THE RIGHT TO OBTAIN A SECURITY FREEZE.
   YOU  HAVE  A RIGHT TO PLACE A "SECURITY FREEZE" ON YOUR CREDIT REPORT,
 WHICH WILL PROHIBIT A CONSUMER CREDIT REPORTING  AGENCY  FROM  RELEASING
 INFORMATION  IN YOUR CREDIT REPORT WITHOUT YOUR EXPRESS AUTHORIZATION. A
 SECURITY FREEZE MUST  BE  REQUESTED  IN  WRITING  DELIVERY  CONFIRMATION
 REQUESTED  OR  VIA  TELEPHONE, SECURE ELECTRONIC MEANS, OR OTHER METHODS
 DEVELOPED BY THE CONSUMER CREDIT REPORTING AGENCY. THE  SECURITY  FREEZE
 IS  DESIGNED  TO PREVENT CREDIT, LOANS, AND SERVICES FROM BEING APPROVED
 IN YOUR NAME WITHOUT YOUR CONSENT. HOWEVER, YOU  SHOULD  BE  AWARE  THAT
 USING  A  SECURITY  FREEZE  TO  TAKE CONTROL OVER WHO GETS ACCESS TO THE
 PERSONAL AND FINANCIAL INFORMATION IN  YOUR  CREDIT  REPORT  MAY  DELAY,
 INTERFERE  WITH,  OR  PROHIBIT  THE  TIMELY  APPROVAL  OF ANY SUBSEQUENT
 REQUEST OR APPLICATION YOU MAKE REGARDING A NEW LOAN, CREDIT,  MORTGAGE,
 GOVERNMENT  SERVICES OR PAYMENTS, INSURANCE, RENTAL HOUSING, EMPLOYMENT,
 INVESTMENT,  LICENSE,  CELLULAR  PHONE,  UTILITIES,  DIGITAL  SIGNATURE,
 INTERNET CREDIT CARD TRANSACTION, OR OTHER SERVICES, INCLUDING AN EXTEN-
 SION  OF  CREDIT  AT  POINT OF SALE. WHEN YOU PLACE A SECURITY FREEZE ON
 YOUR CREDIT REPORT, YOU  WILL  BE  PROVIDED  A  PERSONAL  IDENTIFICATION
 NUMBER  OR  PASSWORD  TO  USE IF YOU CHOOSE TO REMOVE THE FREEZE ON YOUR
 CREDIT REPORT OR AUTHORIZE THE  RELEASE  OF  YOUR  CREDIT  REPORT  TO  A
 SPECIFIC  PARTY OR FOR A PERIOD OF TIME AFTER THE FREEZE IS IN PLACE. TO
 PROVIDE THAT AUTHORIZATION YOU MUST CONTACT THE CONSUMER CREDIT  REPORT-
 ING AGENCY AND PROVIDE ALL OF THE FOLLOWING:
   (1) THE PERSONAL IDENTIFICATION NUMBER OR PASSWORD;
   (2) PROPER IDENTIFICATION TO VERIFY YOUR IDENTITY;
   (3)  THE  PROPER INFORMATION REGARDING THE PARTY OR PARTIES WHO ARE TO
 RECEIVE THE CREDIT REPORT OR THE PERIOD OF TIME  FOR  WHICH  THE  REPORT
 SHALL BE AVAILABLE TO USERS OF THE CREDIT REPORT; AND
   (4) PAYMENT OF ANY APPLICABLE FEE.
   A  CONSUMER CREDIT REPORTING AGENCY MUST AUTHORIZE THE RELEASE OF YOUR
 CREDIT REPORT NO LATER THAN THREE  BUSINESS  DAYS  AFTER  RECEIVING  THE
 ABOVE  INFORMATION.  EFFECTIVE  SEPTEMBER  FIRST,  TWO  THOUSAND NINE, A
 CONSUMER CREDIT REPORTING AGENCY THAT RECEIVES A REQUEST  VIA  TELEPHONE
 OR  SECURE  ELECTRONIC  METHOD  SHALL RELEASE A CONSUMER'S CREDIT REPORT
 WITHIN FIFTEEN MINUTES WHEN THE REQUEST IS RECEIVED.
   A SECURITY FREEZE DOES NOT APPLY TO CIRCUMSTANCES IN WHICH YOU HAVE AN
 EXISTING ACCOUNT RELATIONSHIP AND A COPY OF YOUR REPORT IS REQUESTED  BY
 YOUR  EXISTING CREDITOR OR ITS AGENTS OR AFFILIATES FOR CERTAIN TYPES OF
 ACCOUNT REVIEW, COLLECTION, FRAUD CONTROL OR SIMILAR ACTIVITIES.
   IF YOU ARE ACTIVELY SEEKING CREDIT, YOU  SHOULD  UNDERSTAND  THAT  THE
 PROCEDURES  INVOLVED IN LIFTING A SECURITY FREEZE MAY SLOW YOUR APPLICA-
 TION FOR CREDIT. YOU  SHOULD  PLAN  AHEAD  AND  LIFT  A  FREEZE,  EITHER
 COMPLETELY  IF  YOU  ARE  SHOPPING AROUND, OR SPECIFICALLY FOR A CERTAIN
 CREDITOR, BEFORE APPLYING FOR NEW CREDIT. WHEN SEEKING CREDIT OR  PURSU-
 ING  ANOTHER  TRANSACTION  REQUIRING ACCESS TO YOUR CREDIT REPORT, IT IS
 NOT NECESSARY TO RELINQUISH YOUR PIN OR  PASSWORD  TO  THE  CREDITOR  OR

 S. 6891                             7
 
 BUSINESS; YOU CAN CONTACT THE CONSUMER CREDIT REPORTING AGENCY DIRECTLY.
 IF  YOU CHOOSE TO GIVE OUT YOUR PIN OR PASSWORD TO THE CREDITOR OR BUSI-
 NESS, IT IS RECOMMENDED THAT YOU OBTAIN A NEW PIN OR PASSWORD  FROM  THE
 CONSUMER CREDIT REPORTING AGENCY."
   (2)  If  a consumer requests information about a security freeze, such
 consumer shall be provided with the notice set forth in paragraph one of
 this subdivision and with any  other  information  necessary  to  place,
 temporarily  lift  or  permanently lift a security freeze, including but
 not limited to the address, telephone number  or  point  of  contact  at
 which the consumer credit reporting agency receives such requests.
   [(r)] (Q) When a consumer credit reporting agency erroneously releases
 a consumer credit report subject to a security freeze or any information
 contained  in such consumer credit report, the consumer credit reporting
 agency shall send written notification to the affected  consumer  within
 three  business days following discovery or notification of such errone-
 ous release. Such notification shall also inform  the  consumer  of  the
 nature  of  the  information  released  and identify and provide contact
 information for the recipient of such  information  or  consumer  credit
 report.
   [(s)]  (R) Whenever there shall be a violation of this section, appli-
 cation may be made by the attorney general in the name of the people  of
 the  state  of  New  York to a court or justice having jurisdiction by a
 special proceeding to issue  an  injunction,  and  upon  notice  to  the
 defendant of not less than five days, to enjoin and restrain the contin-
 uance  of such violations; and if it shall appear to the satisfaction of
 the court or justice that the defendant  has,  in  fact,  violated  this
 section, an injunction may be issued by such court or justice, enjoining
 and  restraining any further violation, without requiring proof that any
 person has, in fact, been  injured  or  damaged  thereby.  In  any  such
 proceeding,  the  court  may  make allowances to the attorney general as
 provided in paragraph six of subdivision  (a)  of  section  eighty-three
 hundred  three  of the civil practice law and rules, and direct restitu-
 tion. Whenever the court  shall  determine  that  a  violation  of  this
 section  has  occurred, the court may impose a civil penalty of not more
 than five thousand dollars for each violation. In  connection  with  any
 such  proposed  application,  the attorney general is authorized to take
 proof and make a determination  of  the  relevant  facts  and  to  issue
 subpoenas in accordance with the civil practice law and rules.
   §  3.  Paragraph  3 of subdivision (j) of section 380-u of the general
 business law, as added by chapter 441 of the laws of 2014, is amended to
 read as follows:
   (3)(i) An entity listed in paragraphs three through eight of  subdivi-
 sion  (m)  of  section  three hundred eighty-t of this article; [(ii) an
 entity listed in subdivision (p) of section three  hundred  eighty-t  of
 this  article;]  or  [(iii)]  (II)  a consumer credit reporting agency's
 database or file that consists of information concerning, and used  for,
 one  or  more  of  the  following:  criminal  record  information, fraud
 prevention or detection, personal loss history information, and  employ-
 ment, tenant, or background screening.
   § 4. This act shall take effect immediately.

Comments

Open Legislation is a forum for New York State legislation. All comments are subject to review and community moderation is encouraged.

Comments deemed off-topic, commercial, campaign-related, self-promotional; or that contain profanity, hate or toxic speech; or that link to sites outside of the nysenate.gov domain are not permitted, and will not be published. Attempts to intimidate and silence contributors or deliberately deceive the public, including excessive or extraneous posting/posts, or coordinated activity, are prohibited and may result in the temporary or permanent banning of the user. Comment moderation is generally performed Monday through Friday. By contributing or voting you agree to the Terms of Participation and verify you are over 13.

Create an account. An account allows you to sign petitions with a single click, officially support or oppose key legislation, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.