S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   2746
 
                        2019-2020 Regular Sessions
 
                           I N  A S S E M B L Y
 
                             January 25, 2019
                                ___________
 
 Introduced  by M. of A. SOLAGES -- read once and referred to the Commit-
   tee on Consumer Affairs and Protection
 
 AN ACT to amend the general business law, in  relation  to  implementing
   provisions to protect credit reports of certain consumers
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. Subdivision (m) of section 380-a of  the  general  business
 law,  as  added by chapter 63 of the laws of 2006, is amended to read as
 follows:
   (m) The term "security freeze" or "freeze" means:
   1. a notice placed in the consumer credit report of or relating  to  a
 consumer,  at  the  request  of  such  consumer  and  subject to certain
 exceptions, that prohibits the consumer  credit  reporting  agency  from
 releasing the consumer credit report, the contents of such report or the
 credit score of such consumer[.];
   2. IF A CONSUMER CREDIT REPORTING AGENCY DOES NOT HAVE A FILE PERTAIN-
 ING TO A PROTECTED CONSUMER, A RESTRICTION THAT:
   A. IS PLACED ON THE PROTECTED CONSUMER'S RECORD IN ACCORDANCE WITH THE
 PROVISIONS OF THIS SECTION; AND
   B.  PROHIBITS  THE  CONSUMER CREDIT REPORTING AGENCY FROM RELEASING TO
 PROTECTED CONSUMER'S RECORD EXCEPT AS PROVIDED IN SECTION THREE  HUNDRED
 EIGHTY-V OF THIS ARTICLE; OR
   3.  IF A CONSUMER CREDIT REPORTING AGENCY HAS A FILE PERTAINING TO THE
 PROTECTED CONSUMER, A RESTRICTION THAT:
   A. IS PLACED ON THE PROTECTED CONSUMER'S CONSUMER REPORT IN ACCORDANCE
 WITH SECTION THREE HUNDRED EIGHTY-V OF THIS ARTICLE; AND
   B. PROHIBITS THE CONSUMER CREDIT REPORTING AGENCY FROM  RELEASING  THE
 PROTECTED  CONSUMER'S  CONSUMER CREDIT REPORT OR ANY INFORMATION DERIVED
 FROM THE PROTECTED CONSUMER'S CONSUMER CREDIT REPORT EXCEPT AS  PROVIDED
 IN SECTION THREE HUNDRED EIGHTY-V OF THIS ARTICLE.

  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD05051-01-9
              

 A. 2746                             2
 
   §  2.  Section  380-a of the general business law is amended by adding
 five new subdivisions (u), (v), (w), (x) and (y) to read as follows:
   (U) THE TERM "PROTECTED CONSUMER" MEANS AN INDIVIDUAL WHO IS:
   1. UNDER THE AGE OF SIXTEEN YEARS AT THE TIME A REQUEST FOR THE PLACE-
 MENT OF A SECURITY FREEZE IS MADE; OR
   2.  AN  INCAPACITATED PERSON OR A PROTECTED PERSON FOR WHOM A GUARDIAN
 OR CONSERVATOR HAS BEEN APPOINTED.
   (V) THE TERM "RECORD" MEANS A COMPILATION OF INFORMATION THAT:
   1. IDENTIFIES A PROTECTED CONSUMER;
   2. IS CREATED BY A CONSUMER CREDIT REPORTING  AGENCY  SOLELY  FOR  THE
 PURPOSE  OF  COMPLYING WITH SECTION THREE HUNDRED EIGHTY-V OF THIS ARTI-
 CLE; AND
   3. MAY NOT BE CREATED OR USED TO  CONSIDER  THE  PROTECTED  CONSUMER'S
 CREDIT  WORTHINESS, CREDIT STANDING, CREDIT CAPACITY, CHARACTER, GENERAL
 REPUTATION, PERSONAL CHARACTERISTICS, OR MODE OF LIVING.
   (W) THE TERM "REPRESENTATIVE" MEANS A PERSON WHO PROVIDES TO A CONSUM-
 ER CREDIT REPORTING AGENCY SUFFICIENT  PROOF  OF  AUTHORITY  TO  ACT  ON
 BEHALF  OF  A  PROTECTED  CONSUMER;  INCLUDES,  BUT IS NOT LIMITED TO, A
 PARENT OR LEGAL GUARDIAN.
   (X) THE TERM "SUFFICIENT PROOF OF AUTHORITY" MEANS DOCUMENTATION  THAT
 SHOWS  A  REPRESENTATIVE  HAS  AUTHORITY TO ACT ON BEHALF OF A PROTECTED
 CONSUMER; INCLUDES:
   1. AN ORDER ISSUED BY A COURT OF LAW; OR
   2. A LAWFULLY EXECUTIVE AND VALID POWER OF ATTORNEY; OR
   3. A WRITTEN, NOTARIZED STATEMENT  SIGNED  BY  A  REPRESENTATIVE  THAT
 EXPRESSLY DESCRIBES THE AUTHORITY OF THE REPRESENTATIVE TO ACT ON BEHALF
 OF A PROTECTED CONSUMER.
   (Y) THE TERM "SUFFICIENT PROOF OF IDENTIFICATION" MEANS INFORMATION OR
 DOCUMENTATION  THAT  IDENTIFIES A PROTECTED CONSUMER OR A REPRESENTATIVE
 OF A PROTECTED CONSUMER; INCLUDES:
   1. A SOCIAL SECURITY NUMBER OR A COPY OF A SOCIAL SECURITY CARD ISSUED
 BY THE SOCIAL SECURITY ADMINISTRATION;
   2. A CERTIFIED OR OFFICIAL COPY OF A BIRTH CERTIFICATE ISSUED  BY  THE
 ENTITY AUTHORIZED TO ISSUE THE BIRTH CERTIFICATE; OR
   3.  A COPY OF A DRIVER'S LICENSE, AN IDENTIFICATION CARD ISSUED BY THE
 DEPARTMENT OF MOTOR VEHICLES, OR ANY OTHER GOVERNMENT-ISSUED IDENTIFICA-
 TION.
   § 3. Section 380-v of the general business law, as relettered by chap-
 ter 441 of the laws of 2014, is  relettered  section  380-w  and  a  new
 section 380-v is added to read as follows:
   §  380-V.  PROTECTED  CONSUMER CREDIT REPORTING. (A) THIS SECTION DOES
 NOT APPLY TO THE USE OF A PROTECTED CONSUMER'S CONSUMER CREDIT REPORT OR
 RECORD BY:
   1. A  PERSON  ADMINISTERING  A  CREDIT  FILE  MONITORING  SUBSCRIPTION
 SERVICE TO WHICH:
   (I) THE PROTECTED CONSUMER HAS SUBSCRIBED; OR
   (II)  THE  REPRESENTATIVE  OF THE PROTECTED CONSUMER HAS SUBSCRIBED ON
 BEHALF OF THE PROTECTED CONSUMER;
   2. A PERSON PROVIDING THE PROTECTED CONSUMER OR THE PROTECTED  CONSUM-
 ER'S  REPRESENTATIVE  WITH  A  COPY OF THE PROTECTED CONSUMER'S CONSUMER
 CREDIT REPORT ON REQUEST OF THE  PROTECTED  CONSUMER  OR  THE  PROTECTED
 CONSUMER'S REPRESENTATIVE; OR
   3. AN ENTITY LISTED IN PARAGRAPH ONE, TWO, THREE, FOUR, FIVE OR SIX OF
 SUBDIVISION (M) OF SECTION THREE HUNDRED EIGHTY-T OF THIS ARTICLE.
   (B) 1. A CONSUMER REPORTING AGENCY SHALL PLACE A SECURITY FREEZE FOR A
 PROTECTED CONSUMER IF:

 A. 2746                             3

   (I)  THE  CONSUMER CREDIT REPORTING AGENCY RECEIVES A REQUEST FROM THE
 PROTECTED CONSUMER'S REPRESENTATIVE FOR THE PLACEMENT  OF  THE  SECURITY
 FREEZE UNDER THIS SECTION; AND
   (II) THE PROTECTED CONSUMER'S REPRESENTATIVE:
   (A) SUBMITS THE REQUEST TO THE CONSUMER CREDIT REPORTING AGENCY AT THE
 ADDRESS  OR  OTHER  POINT  OF  CONTACT AND IN THE MANNER SPECIFIED UNDER
 SUBDIVISION (A) OF THIS SECTION;
   (B) PROVIDES TO THE CONSUMER CREDIT REPORTING AGENCY SUFFICIENT  PROOF
 OF IDENTIFICATION OF THE CONSUMER AND THE REPRESENTATIVE;
   (C)  PROVIDES TO THE CONSUMER CREDIT REPORTING AGENCY SUFFICIENT PROOF
 OF AUTHORITY TO ACT ON BEHALF OF THE PROTECTED CONSUMER; AND
   (D) PAYS TO THE CONSUMER CREDIT REPORTING AGENCY A FEE AS PROVIDED  IN
 SUBDIVISION (H) OF THIS SECTION.
   2. IF A CONSUMER CREDIT REPORTING AGENCY DOES NOT HAVE A FILE PERTAIN-
 ING  TO  A  PROTECTED CONSUMER WHEN THE CONSUMER CREDIT REPORTING AGENCY
 RECEIVES A REQUEST UNDER PARAGRAPH ONE OF THIS SUBDIVISION, THE CONSUMER
 CREDIT REPORTING AGENCY SHALL CREATE A RECORD FOR THE PROTECTED  CONSUM-
 ER.
   (C)  1.  WITHIN  THIRTY  DAYS AFTER RECEIVING A REQUEST THAT MEETS THE
 REQUIREMENTS OF PARAGRAPH ONE OF SUBDIVISION  (B)  OF  THIS  SECTION,  A
 CONSUMER  CREDIT  REPORTING AGENCY SHALL PLACE A SECURITY FREEZE FOR THE
 PROTECTED CONSUMER.
   2. THE CONSUMER CREDIT REPORTING AGENCY SHALL SEND A WRITTEN CONFIRMA-
 TION OF THE PLACEMENT OF THE SECURITY FREEZE TO A  PROTECTED  CUSTOMER'S
 REPRESENTATIVE WITHIN FIVE BUSINESS DAYS OF PLACING SUCH FREEZE.
   (D)  UNLESS  A  SECURITY FREEZE FOR A PROTECTED CONSUMER IS REMOVED IN
 ACCORDANCE WITH SUBDIVISION (F) OR (I) OF THIS SECTION, A CONSUMER CRED-
 IT REPORTING AGENCY MAY NOT RELEASE THE  PROTECTED  CONSUMER'S  CONSUMER
 CREDIT  REPORT,  ANY  INFORMATION  DERIVED FROM THE PROTECTED CONSUMER'S
 CONSUMER CREDIT REPORT, OR ANY RECORD CREATED FOR THE PROTECTED  CONSUM-
 ER.
   (E)  A  SECURITY FREEZE FOR A PROTECTED CONSUMER PLACED UNDER SUBDIVI-
 SION (C) OF THIS SECTION SHALL REMAIN IN EFFECT UNTIL:
   1. THE PROTECTED CONSUMER OR THE PROTECTED  CONSUMER'S  REPRESENTATIVE
 REQUESTS  THE  CONSUMER  CREDIT  REPORTING AGENCY TO REMOVE THE SECURITY
 FREEZE IN ACCORDANCE WITH SUBDIVISION (F) OF THIS SECTION; OR
   2. THE SECURITY FREEZE IS REMOVED IN ACCORDANCE WITH  SUBDIVISION  (I)
 OF THIS SECTION.
   (F)  IF  A PROTECTED CONSUMER OR A PROTECTED CONSUMER'S REPRESENTATIVE
 WISHES TO REMOVE A SECURITY  FREEZE  FOR  THE  PROTECTED  CONSUMER,  THE
 PROTECTED CONSUMER OR THE PROTECTED CONSUMER'S REPRESENTATIVE SHALL:
   1.  SUBMIT  A  REQUEST  FOR  THE REMOVAL OF THE SECURITY FREEZE TO THE
 CONSUMER CREDIT REPORTING AGENCY  AT  THE  ADDRESS  OR  OTHER  POINT  OF
 CONTACT  AND  IN  THE  MANNER SPECIFIED BY THE CONSUMER CREDIT REPORTING
 AGENCY;
   2. PROVIDE TO THE CONSUMER CREDIT REPORTING AGENCY:
   (I) IN THE CASE OF A REQUEST BY THE PROTECTED CONSUMER:
   (A) PROOF THAT THE SUFFICIENT PROOF OF  AUTHORITY  FOR  THE  PROTECTED
 CONSUMER'S  REPRESENTATIVE TO ACT ON BEHALF OF THE PROTECTED CONSUMER IS
 NO LONGER VALID; AND
   (B) SUFFICIENT PROOF OF IDENTIFICATION OF THE PROTECTED CONSUMER; OR
   (II) IN THE CASE OF A REQUEST BY THE  REPRESENTATIVE  OF  A  PROTECTED
 CONSUMER:
   (A)  SUFFICIENT  PROOF OF IDENTIFICATION OF THE PROTECTED CONSUMER AND
 THE REPRESENTATIVE; AND

 A. 2746                             4
 
   (B) SUFFICIENT PROOF OF AUTHORITY TO ACT ON BEHALF  OF  THE  PROTECTED
 CONSUMER; AND
   (C)  PAY  TO THE CONSUMER CREDIT REPORTING AGENCY A FEE AS PROVIDED IN
 SUBDIVISION (H) OF THIS SECTION.
   (G) WITHIN THIRTY DAYS  AFTER  RECEIVING  A  REQUEST  THAT  MEETS  THE
 REQUIREMENTS  OF  SUBDIVISION  (F)  OF THIS SECTION, THE CONSUMER CREDIT
 REPORTING AGENCY SHALL REMOVE THE  SECURITY  FREEZE  FOR  THE  PROTECTED
 CONSUMER.
   (H)  1.  EXCEPT  AS  PROVIDED  IN PARAGRAPH TWO OF THIS SUBDIVISION, A
 CONSUMER CREDIT REPORTING AGENCY MAY NOT CHARGE A FEE  FOR  ANY  SERVICE
 PERFORMED UNDER THIS SECTION.
   2. A CONSUMER CREDIT REPORTING AGENCY MAY CHARGE A REASONABLE FEE, NOT
 EXCEEDING  FIVE  DOLLARS,  FOR  EACH  PLACEMENT OR REMOVAL OF A SECURITY
 FREEZE FOR A PROTECTED CONSUMER.
   3. NOTWITHSTANDING THE PROVISIONS OF PARAGRAPH TWO  OF  THIS  SUBDIVI-
 SION,  A  CONSUMER  CREDIT REPORTING AGENCY MAY NOT CHARGE ANY FEE UNDER
 THIS SECTION IF THE PROTECTED CONSUMER'S REPRESENTATIVE:
   (I) HAS OBTAINED A  REPORT  OF  ALLEGED  IDENTITY  FRAUD  AGAINST  THE
 PROTECTED CONSUMER; AND
   (II)  PROVIDES  A  COPY OF THE REPORT TO THE CONSUMER CREDIT REPORTING
 AGENCY.
   (I) A CONSUMER CREDIT REPORTING AGENCY MAY REMOVE  A  SECURITY  FREEZE
 FOR  A  PROTECTED CONSUMER OR DELETE A RECORD OF A PROTECTED CONSUMER IF
 THE SECURITY FREEZE WAS PLACED OR THE RECORD  WAS  CREATED  BASED  ON  A
 MATERIAL  MISREPRESENTATION  OF  FACT  BY  THE PROTECTED CONSUMER OR THE
 PROTECTED CONSUMER'S REPRESENTATIVE.
   (J) WHEN A CONSUMER CREDIT REPORTING  AGENCY  ERRONEOUSLY  RELEASES  A
 PROTECTED CONSUMER'S CONSUMER CREDIT REPORT SUBJECT TO A SECURITY FREEZE
 OR ANY INFORMATION CONTAINED IN SUCH CONSUMER CREDIT REPORT, THE CONSUM-
 ER  CREDIT  REPORTING  AGENCY  SHALL  SEND  WRITTEN  NOTIFICATION TO THE
 AFFECTED PROTECTED CONSUMER'S REPRESENTATIVE WITHIN THREE BUSINESS  DAYS
 FOLLOWING  DISCOVERY  OR  NOTIFICATION  OF  SUCH ERRONEOUS RELEASE. SUCH
 NOTIFICATION SHALL ALSO INFORM THE PROTECTED CONSUMER OF THE  NATURE  OF
 THE  INFORMATION  RELEASED  AND IDENTIFY AND PROVIDE CONTACT INFORMATION
 FOR THE RECIPIENT OF SUCH INFORMATION OR CONSUMER CREDIT REPORT.
   (K) WHENEVER THERE SHALL BE A VIOLATION OF THIS  SECTION,  APPLICATION
 MAY  BE  MADE  BY  THE ATTORNEY GENERAL IN THE NAME OF THE PEOPLE OF THE
 STATE OF NEW YORK TO A COURT OR JUSTICE HAVING JURISDICTION BY A SPECIAL
 PROCEEDING TO ISSUE AN INJUNCTION, AND UPON NOTICE TO THE  DEFENDANT  OF
 NOT  LESS THAN FIVE DAYS, TO ENJOIN AND RESTRAIN THE CONTINUANCE OF SUCH
 VIOLATIONS; AND IF IT SHALL APPEAR TO THE SATISFACTION OF THE  COURT  OR
 JUSTICE  THAT  THE  DEFENDANT  HAS,  IN  FACT, VIOLATED THIS SECTION, AN
 INJUNCTION MAY BE  ISSUED  BY  SUCH  COURT  OR  JUSTICE,  ENJOINING  AND
 RESTRAINING  ANY  FURTHER  VIOLATION,  WITHOUT  REQUIRING PROOF THAT ANY
 PERSON HAS, IN FACT, BEEN  INJURED  OR  DAMAGED  THEREBY.  IN  ANY  SUCH
 PROCEEDING,  THE  COURT  MAY  MAKE ALLOWANCES TO THE ATTORNEY GENERAL AS
 PROVIDED IN PARAGRAPH SIX OF SUBDIVISION  (A)  OF  SECTION  EIGHTY-THREE
 HUNDRED  THREE  OF THE CIVIL PRACTICE LAW AND RULES, AND DIRECT RESTITU-
 TION. WHENEVER THE COURT  SHALL  DETERMINE  THAT  A  VIOLATION  OF  THIS
 SECTION  HAS  OCCURRED, THE COURT MAY IMPOSE A CIVIL PENALTY OF NOT MORE
 THAN FIVE THOUSAND DOLLARS FOR EACH VIOLATION. IN  CONNECTION  WITH  ANY
 SUCH  PROPOSED  APPLICATION,  THE ATTORNEY GENERAL IS AUTHORIZED TO TAKE
 PROOF AND MAKE A DETERMINATION  OF  THE  RELEVANT  FACTS  AND  TO  ISSUE
 SUBPOENAS IN ACCORDANCE WITH THE CIVIL PRACTICE LAW AND RULES.
   §  4.  This  act shall take effect on the ninetieth day after it shall
 have become a law.