pg_0001

SJC/SB 165 & 448

Page 1

AN ACT

RELATING TO CONSUMER CREDIT; PROVIDING FOR A SECURITY FREEZE

ON THE RELEASE OF CONSUMER CREDIT INFORMATION; ENACTING THE

CREDIT REPORT SECURITY ACT; PROVIDING PENALTIES.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF NEW MEXICO:

Section 1. SHORT TITLE.--This act may be cited as the

"Credit Report Security Act".

Section 2. DEFINITIONS.--As used in the Credit Report

Security Act:

A. "consumer" means an individual who is a

resident of New Mexico;

B. "consumer reporting agency" means any person

that, for monetary fees, dues or on a cooperative nonprofit

basis, regularly engages in the practice of assembling or

evaluating consumer credit information or other information

on consumers for the purpose of furnishing credit reports to

third parties;

C. "credit report" means a written, oral or other

communication of information by a consumer reporting agency

bearing on a consumer's credit worthiness, credit standing,

credit capacity, character, general reputation, personal

characteristics or mode of living that is used or expected to

be used or collected for the purpose of serving as a factor

in establishing the consumer's eligibility for credit,

pg_0002

SJC/SB 165 & 448

Page 2

insurance, investment, benefit, employment or other purpose

as authorized by the federal Fair Credit Reporting Act, 15

U.S.C. Section 1681a;

D. "person" means an individual, corporation,

firm, association, organization, trust, estate, cooperative,

business, partnership, limited liability company, joint

venture, governmental agency or subdivision or any legal or

commercial entity; and

E. "security freeze" means a notice placed in a

consumer's credit report, at the request of the consumer and

subject to certain exceptions, that prohibits a consumer

reporting agency from releasing the consumer's credit report

or score relating to the extension of credit or the opening

of new accounts without the express authorization of the

consumer.

Section 3. SECURITY FREEZE.--

A. A consumer may elect to place a security freeze

on the consumer's credit report by making a request to a

consumer reporting agency by means of certified or regular

mail sent to an address designated by the consumer reporting

agency, or by means of a telephone or a secure electronic

method if such means are provided by the agency. A consumer

shall provide any personal identification required by the

consumer reporting agency and pay a fee, if applicable.

B. A consumer reporting agency shall place a

pg_0003

SJC/SB 165 & 448

Page 3

security freeze on a consumer's credit report no later than

three business days after receiving a request from the

consumer.

C. Within five business days of placing a security

freeze on a consumer's credit report, a consumer reporting

agency shall:

(1) send a written confirmation of the

security freeze to the consumer; and

(2) provide the consumer with a unique

personal identification number, password or similar device to

be used by the consumer when providing authorization for the

release of the consumer's credit report to a specific person

or for a specific period of time or for permanent removal of

the freeze.

D. While a security freeze is in effect, a

consumer may authorize a consumer reporting agency to release

the consumer's credit report to a specific person or to

release the credit report for a specific period of time by

contacting the consumer reporting agency by regular or

certified mail or by telephone, and as of September 1, 2008,

by contacting the consumer reporting agency by mail, by

telephone or by a secure electronic method, and providing:

(1) proper identification;

(2) the unique personal identification

number, password or similar device;

pg_0004

SJC/SB 165 & 448

Page 4

(3) information regarding the party that is

to have access to the credit report or the time period during

which the credit report can be released; and

(4) payment of a fee, if applicable

E. A consumer reporting agency that receives a

request pursuant to Subsection D of this section shall

release a consumer's credit report as requested by the

consumer within three business days after the business day on

which the consumer's request by regular or certified mail or

by telephone is received by the consumer reporting agency.

As of September 1, 2008, a consumer reporting agency that

receives a request pursuant to Subsection D of this section

shall release a consumer's credit report as requested by the

consumer within fifteen minutes after the consumer's request

is received by the consumer reporting agency through the use

of a telephone or a secure electronic method provided by the

agency, which may include the use of the internet, facsimile

or other electronic means; provided that the consumer

reporting agency is not required to release the credit report

within fifteen minutes unless the consumer's request is

received by the consumer reporting agency between the hours

of 6:00 a.m. and 9:30 p.m. mountain standard or mountain

daylight time, as applicable, Sunday through Saturday.

F. A consumer reporting agency need not release a

credit report within the time periods set forth in Subsection

pg_0005

SJC/SB 165 & 448

Page 5

E of this section if:

(1) the consumer fails to meet the

requirements of Subsection D of this section; or

(2) the consumer reporting agency's ability

to remove the security freeze within fifteen minutes is

prevented by:

(a) an act of God, including fire,

earthquake, hurricane, storm or similar natural disaster or

phenomenon;

(b) unauthorized or illegal acts by a

third party, including terrorism, sabotage, riots, vandalism,

labor strikes or disputes disrupting operations or similar

occurrences;

electrical failure, unanticipated delay in equipment or

replacement part delivery, computer hardware or software

failure inhibiting response time or similar disruption;

(d) governmental action, including

emergency orders or regulations, judicial or law enforcement

actions or similar directives;

(e) regularly scheduled maintenance of,

or updates to, the consumer reporting agency's systems during

other than normal business hours; or

(f) commercially reasonable maintenance

of, or repair to, the consumer reporting agency's systems

pg_0006

SJC/SB 165 & 448

Page 6

that is unexpected or unscheduled.

G. If a consumer reporting agency erroneously

releases information on a credit report while a security

freeze is in effect and without a consumer's authorization,

it shall notify the consumer of the release of information

within five business days of the agency's discovery of the

erroneous release of information and inform the consumer of

the specific information released and the third party to whom

it has been released.

H. A security freeze shall remain in place until a

consumer requests its removal. A consumer reporting agency

shall remove the security freeze within three business days

after receiving a request from a consumer who provides the

unique personal identification number, password or similar

device and proper identification.

I. A consumer reporting agency may charge a

consumer a fee of no more than ten dollars ($10.00) for the

placement of a security freeze. A consumer reporting agency

may charge a fee of no more than five dollars ($5.00) for the

release of a credit report, upon which a security freeze has

been placed, to a specific person or for a specific period of

time. A consumer reporting agency may charge a fee of no

more than five dollars ($5.00) for the removal of a security

freeze. A fee shall not be charged to a consumer who is

sixty-five years of age or older or to a victim of identity

pg_0007

SJC/SB 165 & 448

Page 7

theft who provides a valid police or investigative report

filed with a law enforcement agency alleging the crime of

identity theft.

J. If a consumer's credit report was frozen due to

a material misrepresentation of fact by the consumer and a

consumer reporting agency intends to remove the freeze, the

consumer reporting agency shall notify the consumer in

writing five business days prior to removing the security

freeze on the consumer's credit report.

K. A consumer reporting agency may advise a third

party that a security freeze is in effect with respect to a

consumer's credit report. A consumer reporting agency shall

not suggest or otherwise state or imply to a third party that

the security freeze reflects a negative credit score,

history, report or rating.

L. The provisions of this section do not prevent a

consumer reporting agency from releasing a consumer's credit

report:

(1) to a person or the person's subsidiary,

affiliate, agent or assignee with which the consumer has or,

prior to assignment, had an account, contract or

debtor-creditor relationship for the purpose of reviewing the

account or collecting the financial obligation owing for the

account, contract or debt, or to a prospective assignee of a

financial obligation owing by the consumer in conjunction

pg_0008

SJC/SB 165 & 448

Page 8

with the proposed purchase of the financial obligation. As

used in this paragraph, "reviewing the account" includes

activities related to account maintenance, monitoring, credit

line increases and account upgrades and enhancements;

(2) to a subsidiary, affiliate, agent,

assignee or prospective assignee of a person to whom access

has been granted by the consumer pursuant to Subsection D of

this section for the purpose of facilitating the extension of

credit or other permissible use;

(3) to a person or entity administering a

credit file monitoring subscription service to which the

consumer has subscribed;

(4) to a person or entity for the purpose of

providing a consumer with a copy of the consumer's credit

report upon the consumer's request;

(5) to a person acting pursuant to a court

order, warrant or subpoena;

(6) to the child support enforcement

division of the human services department for the purpose of

carrying out its statutory duties of establishing and

collecting child support obligations;

(7) to a governmental agency acting to

investigate fraud, to investigate or collect delinquent taxes

or unpaid court orders or to fulfill any of its other

statutory duties;

pg_0009

SJC/SB 165 & 448

Page 9

(8) to a person for the purposes of

prescreening as defined by the federal Fair Credit Reporting

Act;

(9) from a consumer reporting agency's

database or file that consists only of and is used solely for

one or more of the following:

(a) criminal record information;

(b) tenant screening;

(d) fraud prevention or detection; or

(10) to a person or entity for use in

setting or adjusting an insurance rate, adjusting an

insurance claim or underwriting for insurance purposes.

M. The following entities are not required to

place a security freeze on a credit report:

(1) a consumer reporting agency that acts

only as a reseller of credit information by assembling and

merging information contained in the database of another

consumer reporting agency or multiple consumer credit

reporting agencies and does not maintain a permanent database

of credit information from which new consumer credit reports

are produced. However, a consumer reporting agency acting as

a reseller shall honor any security freeze placed on a

consumer credit report by another consumer reporting agency;

(2) a check services or fraud prevention

pg_0010

SJC/SB 165 & 448

Page 10

services company that issues reports on incidents of fraud or

authorizations for the purpose of approving or processing

negotiable instruments, electronic funds transfers or similar

methods of payment; or

(3) a deposit account information service

company that issues reports regarding account closures due to

fraud, substantial overdrafts, automatic teller machine abuse

or similar negative information regarding a consumer to

inquiring banks or other financial institutions for use only

in reviewing a consumer request for a deposit account at the

inquiring bank or financial institution.

Section 4. NOTICE OF RIGHTS.--At any time that a

consumer reporting agency is required to provide the consumer

with a summary of rights pursuant to Section 609 of the

federal Fair Credit Reporting Act, the following notice shall

be included:

"New Mexico Consumers Have the

Right to Obtain a Security Freeze

You may obtain a security freeze on your

credit report to protect your privacy and ensure

that credit is not granted in your name without

your knowledge. You have a right to place a

security freeze on your credit report pursuant to

the Credit Report Security Act.

The security freeze will prohibit a consumer

pg_0011

SJC/SB 165 & 448

Page 11

reporting agency from releasing any information in

your credit report without your express

authorization or approval.

The security freeze is designed to prevent

credit, loans and services from being approved in

your name without your consent. When you place a

security freeze on your credit report, you will be

provided with a personal identification number,

password or similar device to use if you choose to

remove the freeze on your credit report or to

temporarily authorize the release of your credit

report to a specific party or parties or for a

specific period of time after the freeze is in

place. To remove the freeze or to provide

authorization for the temporary release of your

credit report, you must contact the consumer

reporting agency and provide all of the following:

(1) the unique personal identification

number, password or similar device provided by the

consumer reporting agency;

(2) proper identification to verify

your identity;

(3) information regarding the third

party or parties who are to receive the credit

report or the period of time for which the credit

pg_0012

SJC/SB 165 & 448

Page 12

report may be released to users of the credit

report; and

(4) payment of a fee, if applicable.

A consumer reporting agency that receives a

request from a consumer to lift temporarily a

freeze on a credit report shall comply with the

request no later than three business days after

receiving the request. As of September 1, 2008, a

consumer reporting agency shall comply with the

request within fifteen minutes of receiving the

request by a secure electronic method or by

telephone.

A security freeze does not apply in all

circumstances, such as where you have an existing

account relationship and a copy of your credit

report is requested by your existing creditor or

its agents for certain types of account review,

collection, fraud control or similar activities;

for use in setting or adjusting an insurance rate

or claim or insurance underwriting; for certain

governmental purposes; and for purposes of

prescreening as defined in the federal Fair Credit

Reporting Act.

If you are actively seeking a new credit,

loan, utility, telephone or insurance account, you

pg_0013

SJC/SB 165 & 448

Page 13

should understand that the procedures involved in

lifting a security freeze may slow your own

applications for credit. You should plan ahead and

lift a freeze, either completely if you are

shopping around or specifically for a certain

creditor, with enough advance notice before you

apply for new credit for the lifting to take

effect. You should contact a consumer reporting

agency and request it to lift the freeze at least

three business days before applying. As of

September 1, 2008, if you contact a consumer

reporting agency by a secure electronic method or

by telephone, the consumer reporting agency should

lift the freeze within fifteen minutes. You have a

right to bring a civil action against a consumer

reporting agency that violates your rights under

the Credit Report Security Act."

Section 5. VIOLATION OF SECURITY FREEZE--CIVIL

LIABILITY.--If a consumer reporting agency releases

information placed under a security freeze in violation of

the provisions of Section 3 of the Credit Report Security

Act, the affected consumer may bring a civil action against

the consumer reporting agency for:

A. injunctive relief to prevent further violation

of the security freeze;

pg_0014

SJC/SB 165 & 448

Page 14

B. any actual damages sustained by the consumer as

a result of the violation;

C. a civil penalty in an amount not to exceed two

thousand dollars ($2,000) for each violation of the security

freeze; and

D. costs of the action and reasonable attorney

fees.

Section 6. SEVERABILITY.--If any part or application of

the Credit Report Security Act is held invalid, the remainder

or its application to other persons or situations shall not

be affected.

Section 7. EFFECTIVE DATE.--The effective date of the

provisions of this act is July 1, 2007.