Fiscal impact reports (FIRs) are prepared by the Legislative Finance Committee (LFC) for standing finance

committees of the NM Legislature. The LFC does not assume responsibility for the accuracy of these reports

if they are used for other purposes.

Current FIRs (in HTML & Adobe PDF formats) are a vailable on the NM Legislative Website (legis.state.nm.us).

Adobe PDF versions include all attachments, whereas HTML versions may not. Previously issued FIRs and

attachments may be obtained from the LFC in Suite 101 of the State Capitol Building North.

F I S C A L I M P A C T R E P O R T

SPONSOR SJC

ORIGINAL DATE

LAST UPDATED

1/26/07

3/12/07 HB

SHORT TITLE Security Freeze on Credit Report

SB

165/448/SJCS/aSFl 1,2,3/

aHBIC

ANALYST Wilson

ESTIMATED ADDITIONAL OPERATING BUDGET IMPACT (dollars in thousands)

FY07

FY08

FY09 3 Year

Total Cost

Recurring

or Non-Rec

Fund

Affected

Total

$0.1

General

Fund

(Parenthesis ( ) Indicate Expenditure Decreases)

SOURCES OF INFORMATION

LFC Files

Responses Received From

Administrative Office of the District Attorneys (AODA)

Attorney General’s Office (AGO)

SUMMARY

Synopsis of HBIC Amendment

The House Business & Industry Committee amendment removes the three Senate Floor

amendments, but restores the language in several cases. The amendment also rewrites much of

the language contained within the bill and the Senate Floor amendments.

The amendment states that a consumer may elect to place a security freeze on the consumer's

credit report by making a request to a consumer reporting agency by means of certified or regular

mail sent to an address designated by the consumer reporting agency or by telephone or a secure

electronic method if such means are provided by the agency. A consumer shall provide any

personal identification required by the consumer reporting agency and pay a fee, if applicable.

Within five business days of placing a security freeze on a consumer’s credit report instead of

the same day, a consumer reporting agency shall be required to send a written confirmation of

the security freeze to the consumer and provide the consumer with a unique personal

identification number, password or similar device to be used by the consumer when providing

authorization for the release of the consumer's credit report to a specific person or for a specific

period of time or for permanent removal of the freeze.

.

As of September 1, 2008, a consumer reporting agency that receives a request shall release a

consumer's credit report as requested by the consumer within 15 minutes after the consumer's

Senate Bill 165/448/SJCS/ aSFl#1, #2, #3/aHBIC– Page

2

request is received by the consumer reporting agency through the use of a telephone or a secure

electronic method provided by the agency, which may include the use of the internet, facsimile

or other electronic means; provided that the consumer reporting agency is not required to release

the credit report within 15 minutes unless the consumer's request is received by the consumer

reporting agency between the hours of 6:00 a.m. and 9:30 p.m. mountain standard or mountain

daylight time, as applicable, Sunday through Saturday.

According to the amendment a consumer reporting agency need not release a credit report within

the time periods set forth above if the consumer fails to meet the above requirements or if the

consumer reporting agency's ability to remove the security freeze within fifteen minutes is

prevented by:

A.

an act of God, including fire, earthquake, hurricane, storm or similar natural

disaster or phenomenon;

B.

unauthorized or illegal acts by a third party, including terrorism, sabotage, riots,

vandalism, labor strikes or disputes disrupting operations or similar occurrences;

C.

operational interruption, including electrical failure, unanticipated delay in

equipment or replacement part delivery, computer hardware or software failure

inhibiting response time or similar disruption;

D.

governmental action, including emergency orders or regulations, judicial or law

enforcement actions or similar directives;

E.

regularly scheduled maintenance of, or updates to, the consumer reporting agency's

systems during other than normal business hours; or

F.

commercially reasonable maintenance of, or repair to, the consumer reporting

agency's systems that is unexpected or unscheduled...

The amendment allows a consumer reporting agency to charge a consumer no more than $10

instead of the current $5 in the bill for the initial placement of a security freeze. A consumer

reporting agency may charge a fee of no more than $5 instead of the current $10 in the bill for

the release of a credit report, upon which a security freeze has been placed, to a specific person

or for a specific period of time. A consumer reporting agency may charge a fee of no more than

$5 for the removal of a security freeze. A fee shall not be charged

to a consumer who is sixty-

five years of age or older or to a victim of identity theft who provides a valid police or

investigative report filed with a law enforcement agency alleging identity theft.

The amendment clarifies the debtor-creditor relationship by adding that a consumer reporting

agency may release a consumer’s credit report to a person or the person's subsidiary, affiliate,

agent or assignee with which the consumer has or, prior to assignment, had an account, contract

or debtor-creditor relationship for the purpose of reviewing the account or collecting the

financial obligation owing for the account, contract or debt. As used in this paragraph,

"reviewing the account" includes activities related to account maintenance, monitoring, credit

line increases and account upgrades and enhancements.

A consumer reporting agency may also release a consumer’s credit report to a subsidiary,

affiliate, agent, assignee or prospective assignee of a person to whom access has been granted by

the consumer for the purpose of facilitating the extension of credit or other permissible uses, to a

person or entity administering a credit file monitoring subscription service to which the

consumer has subscribed or to a person or entity for the purpose of providing a consumer with a

copy of the consumer's credit report upon the consumer's request.

Senate Bill 165/448/SJCS/ aSFl#1, #2, #3/aHBIC– Page

3

The amendment adds that the following entities are not required to place a security freeze on

credit reports:

•

a consumer reporting agency that acts only as a reseller of credit information by

assembling and merging information contained in the database of another consumer

reporting agency or multiple consumer credit reporting agencies and does not maintain a

permanent database of credit information from which new consumer credit reports are

produced. However, a consumer reporting agency acting as a reseller shall honor any

security freeze placed on a consumer credit report by another consumer reporting agency;

•

a check services or fraud prevention services company that issues reports on incidents of

fraud or authorizations for the purpose of approving or processing negotiable instruments,

electronic funds transfers or similar methods of payment or

•

a deposit account information service company that issues reports regarding account

closures due to fraud, substantial overdrafts, automatic teller machine abuse or similar

negative information regarding a consumer to inquiring banks or other financial

institutions for use only in reviewing a consumer request for a deposit account at the

inquiring bank or financial institution.

Synopsis of SFl #3

The Senate Floor Amendment #3 to the Senate Judiciary Committee substitute bill for Senate

Bill 165 and Senate Bill 448 strikes all of Senate Floor amendment # 2 and adds as of September

1, 2008 a request to a consumer reporting agency from a consumer asking to temporarily lift a

freeze on a credit report must be complied within 15 minutes of receiving the request by secure

electronic mail, facsimile or telephone.

The amendment also adds the same 15 minute requirement with the same conditions if a

consumer contacts a consumer reporting agency to lift a freeze.

Synopsis of SFl # 2

The Senate Floor Amendment #2 to the Senate Judiciary Committee substitute bill for Senate

Bill 165 and Senate Bill 448 requires a consumer reporting agency to remove a security freeze

within three business days after receiving a request from a consumer who provides the unique

personal identification number, password or similar device and proper identification and as of

September 1, 2008, a consumer reporting agency must comply with the request within 15

minutes after the consumers request is received by the consumer reporting agency through the

use of a telephone during normal business hours, and the request includes the consumer’s proper

identification and unique personal identification number, password or similar device.

Synopsis of SF l# 1

The Senate Floor Amendment #1 to the Senate Judiciary Committee substitute bill for Senate

Bill 165 and Senate Bill 448 adds and clarifies that a

consumer reporting agency that receives a

request shall release a consumer's credit report as requested by the consumer within the

following time periods:

Senate Bill 165/448/SJCS/ aSFl#1, #2, #3/aHBIC– Page

4

1) three business days after the business day on which the consumer’s written request to

release the consumer’s credit report is received by the consumer reporting agency or

2) on or after September 1, 2008, 15 minutes after the consumers request is received by

the consumer reporting agency through a secure electronic method provided by the

agency, or through the use of a telephone, during normal business hours, and the request

includes the consumer’s proper identification and unique personal identification number,

password or similar device.

The amendment does not require a consumer reporting agency to remove a security freeze

within the time periods cited above if the consumer fails to meet the requirements set forth in this

amendment or if the consumer reporting agency’s ability to remove the security freeze within 15

minutes is prevented by:

(a) an act of God, including fire, earthquake, hurricane, storm or similar natural disaster

or phenomenon;

(b) unauthorized or illegal acts by a third party, including terrorism, sabotage, riots,

vandalism, labor strikes or disputes disrupting operations or similar occurrence

(c) operational interruption, including electrical failure, unanticipated delay in equipment

or replacement part delivery, computer hardware or software failure inhibiting response

time or similar disruption;

(d) governmental action, including emergency orders or regulations, judicial or law

enforcement actions or similar directives;

(e) regularly scheduled maintenance of, or updates to, the consumer reporting agency's

systems during other than normal business hours;

(f) commercially reasonable maintenance of, or repair to, the consumer reporting

agency's systems that is unexpected or unscheduled; or

(g) receipt of a removal request outside of normal business hours.

Synopsis of Original Bill

The Senate Judiciary Committee substitute bill for Senate Bill 165 and Senate Bill 448 enacts the

Credit Report Security Act, providing consumers with the opportunity to place a security freeze

on the consumer’s credit report by making a request to a consumer reporting agency to refrain

from releasing any part of the consumer’s credit report or any information derived from the

report without the express authorization of the consumer.

The bill requires the consumer reporting agency to place a security freeze on a consumer’s credit

report no later than three business days after receiving a request from the consumer.

The bill also provides that while a freeze is in effect, a consumer may authorize a consumer

reporting agency to release the report to a specific person or to release the report for a specific

Senate Bill 165/448/SJCS/ aSFl#1, #2, #3/aHBIC– Page

5

period of time. The freeze shall remain in place until the consumer requests its removal. The

agency must remove the freeze within three business days after receiving the request provided

that no acts of God or vandalism by third parties prevent the consumer reporting agency from

releasing the consumer’s credit report. Under the Act, if an agency releases information on a

credit report while a freeze is in effect and without authorization, it must notify the consumer

within 5 business days.

SB 448 provides that an agency may charge a consumer who is less than 65 years old a fee of no

more than $5 for the initial placement of a freeze but shall not charge a fee for the release of a

credit report to a person, for the release of a credit report for a specific period of time or for the

removal of the freeze, nor to a proven victim of identity theft. The bill allows an agency to

provide information to a person with a current debtor-creditor relationship with the consumer, a

person acting pursuant to a court order, warrant or subpoena, the Child Support Enforcement

Division in order to carry out its statutory duties of establishing and collecting child support

obligations, a person for the purposes of prescreening as defined by the federal Fair Credit

Reporting Act, a consumer reporting agency for its data base or files for certain information and

for a governmental agency acting to investigate fraud, to investigate or collect delinquent taxes

or unpaid court orders or to fulfill any of its other statutory duties.

The bill also provides that whenever an agency is required to provide the consumer with a

summary of rights under the federal Fair Credit Reporting Act, a specific notice of right to obtain

a freeze must be include.

Finally, the bill provides for the bringing of a civil action by a consumer, in the event an agency

releases information placed under a security freeze in violation of the act. The consumer may

seek the following:

1) injunctive relief to prevent further violation of the security freeze;

2) any actual damages sustained as a result of a violation;

3) a civil penalty in an amount up to $2,000 for each violation of the security freeze; and

4) costs of the action and reasonable attorney fees.

The effective date of the Act is July 1, 2007.

FISCAL IMPLICATIONS

There will be a minimal administrative cost for statewide update, distribution and documentation

of statutory changes. New laws, amendments to existing laws and new hearings have the

potential to increase caseloads in the courts, thus requiring additional resources to handle the

increase.

SIGNIFICANT ISSUES

Credit reporting agencies are governed by the Federal Fair Credit Reporting Act (FCRA) and

therefore state laws governing credit reporting agencies are subject to possible preemption.

However, state security freeze laws should not be preempted by FCRA. The federal law offers

other consumer credit protection measures but does not address the issue of a security freeze.

Federal law requires credit bureaus upon the request of a consumer to:

•

put a fraud alert into the consumer’s file to warn potential users of the report that new

Senate Bill 165/448/SJCS/ aSFl#1, #2, #3/aHBIC– Page

6

credit should not be extended without first verifying the identity of the credit applicant;

•

block the reporting of any information in a consumer’s file that the consumer identifies as

information resulting from an identity theft.

States are preempted from imposing requirements regarding the conduct required by these

specific fraud alert and blocking provisions. These two provisions, however, do not establish

any conduct with respect to freezing access to the entire report and therefore, security freeze laws

should not be subject to federal preemption.

ADMINISTRATIVE IMPLICATIONS

The AODA suggests that if consumers take advantage of the provisions in the bill there will be a

reduction in identity theft prosecutions.

OTHER SUBSTANTIVE ISSUES

While the bill imposes liability on and creates a civil cause of action against a CRA that

wrongfully releases protected information, it does not create similar liability as against any

person who wrongfully requests and obtains that information.

DW/mt