House Bill text for HB0131

HOUSE BILL 131

49th legislature - STATE OF NEW MEXICO - second session, 2010

INTRODUCED BY

William "Bill" R. Rehm

AN ACT

RELATING TO CREDIT REPORTING; REQUIRING A CONSUMER REPORTING AGENCY TO REMOVE INFORMATION CONTESTED BECAUSE OF IDENTITY THEFT OR FALSE REPORTING; AMENDING AND ENACTING SECTIONS OF THE NMSA 1978.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF NEW MEXICO:

Section 1. Section 56-3A-1 NMSA 1978 (being Laws 2007, Chapter 106, Section 1) is amended to read:

"56-3A-1. SHORT TITLE.--[This act] Chapter 56, Article 3A NMSA 1978 may be cited as the "[Credit Report] Fair Credit Reporting and Identity Security Act"."

Section 2. Section 56-3A-2 NMSA 1978 (being Laws 2007, Chapter 106, Section 2) is amended to read:

"56-3A-2. DEFINITIONS.--As used in the [Credit Report] Fair Credit Reporting and Identity Security Act:

A. "consumer" means an individual who is a resident of New Mexico;

B. "consumer reporting agency" means any person that, for monetary fees, dues or on a cooperative nonprofit basis, regularly engages in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing credit reports to third parties;

C. "credit report" means a written, oral or other communication of information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living that is used or expected to be used or collected for the purpose of serving as a factor in establishing the consumer's eligibility for credit, insurance, investment, benefit, employment or other purpose as authorized by the federal Fair Credit Reporting Act, 15 U.S.C. Section 1681a;

D. "declaration of removal" means a statement or affidavit that is delivered by regular or certified mail or facsimile or delivered electronically to a consumer reporting agency that operates within New Mexico and that states:

(1) that the consumer is entitled to removal of information in the consumer reporting agency's files on grounds that the consumer is the victim of identity theft or inaccurate or false reporting; and

(2) the address at which the consumer is available for service of process by the consumer reporting agency and an identifying number such as a social security number by which the consumer can be identified by the consumer reporting agency;

[D.] E. "person" means an individual, corporation, firm, association, organization, trust, estate, cooperative, business, partnership, limited liability company, joint venture, governmental agency or subdivision or any legal or commercial entity; [and

E.] F. "security freeze" means a notice placed in a consumer's credit report, at the request of the consumer and subject to certain exceptions, that prohibits a consumer reporting agency from releasing the consumer's credit report or score relating to the extension of credit or the opening of new accounts without the express authorization of the consumer; and

G. "operates within New Mexico" means accepting or maintaining a credit report on a person that resides within New Mexico."

Section 3. A new section of the Fair Credit Reporting and Identity Security Act is enacted to read:

"[NEW MATERIAL] DECLARATION OF REMOVAL--PROCEDURES.--

A. A consumer may file a declaration of removal with a consumer reporting agency operating within New Mexico declaring that the consumer:

(1) is the victim of identity theft or inaccurate or false reporting;

(2) is eligible for removal of information reported to or by the consumer reporting agency on the basis of identity theft or inaccurate or false reporting;

(3) is available for service of process at a conclusively valid designated address for at least thirty days; and

(4) discloses an identifying number, such as a social security number, by which the consumer may be identified by the consumer reporting agency.

B. The attorney general may publish a sample declaration of removal in compliance with the applicable requirements of Subsection A of this section. The declaration of removal published by the attorney general is not required to be used. A consumer may use other forms that serve the same purpose and that are in compliance with the applicable requirements of Subsection A of this section.

C. A consumer reporting agency shall make available on a web site and on all credit reports of the consumer reporting agency the means for contacting the consumer reporting agency through a physical mailing address, by telephone and facsimile, and through use of a web site and an internet electronic mailing address. A consumer reporting agency shall state on a web site and on all credit reports of the consumer the methods for submitting a declaration of removal.

D. Within five days of receiving a declaration of removal and, if applicable, receipt of a fee as authorized in Subsection I of Section 56-3A-3 NMSA 1978, a consumer reporting agency shall remove from its files and credit reports of the affected consumer the information that is the subject of the declaration of removal and notify the consumer once the removal is complete. A facsimile or electronic mail confirmation is prima facie evidence that the consumer reporting agency received the declaration of removal. A consumer reporting agency shall not state on a credit report that information was removed at the request of a declaration of removal and shall not use that information to suggest or otherwise state or imply to a third party that the affected consumer has a negative credit score, history, report or rating.

E. If a consumer reporting agency fails to remove information that is the subject of a declaration of removal or restores information that is the subject of a declaration of removal in violation of the provisions of the Fair Credit Reporting and Identity Security Act, the affected consumer or the attorney general may bring a civil action against the consumer reporting agency for:

(1) injunctive relief to remove the information or to prevent further violation of the declaration of removal;

(2) any actual damages sustained by the consumer as a result of the violation;

(3) a civil penalty in an amount not to exceed two thousand dollars ($2,000) for each violation of the declaration of removal; and

(4) costs of the action and reasonable attorney fees.

F. Upon request of a consumer, or upon a court's order, after adjudication of the alleged debt in the judicial district in which the consumer resides, a consumer reporting agency may restore the information that was the subject of a declaration of removal."

Section 4. Section 56-3A-3 NMSA 1978 (being Laws 2007, Chapter 106, Section 3) is amended to read:

"56-3A-3. SECURITY FREEZE.--

A. A consumer may elect to place a security freeze on the consumer's credit report by making a request to a consumer reporting agency by means of certified or regular mail sent to an address designated by the consumer reporting agency, or by means of a telephone or a secure electronic method if such means are provided by the agency. A consumer shall provide any personal identification required by the consumer reporting agency and pay a fee, if applicable.

B. A consumer reporting agency shall place a security freeze on a consumer's credit report no later than three business days after receiving a request from the consumer.

C. Within five business days of placing a security freeze on a consumer's credit report, a consumer reporting agency shall:

(1) send a written confirmation of the security freeze to the consumer; and

(2) provide the consumer with a unique personal identification number, password or similar device to be used by the consumer when providing authorization for the release of the consumer's credit report to a specific person or for a specific period of time or for permanent removal of the freeze.

D. While a security freeze is in effect, a consumer may authorize a consumer reporting agency to release the consumer's credit report to a specific person or to release the credit report for a specific period of time by contacting the consumer reporting agency by regular or certified mail or by telephone, and as of September 1, 2008, by contacting the consumer reporting agency by mail, by telephone or by a secure electronic method, and providing:

(1) proper identification;

(2) the unique personal identification number, password or similar device;

(3) information regarding the party that is to have access to the credit report or the time period during which the credit report can be released; and

(4) payment of a fee, if applicable.

E. A consumer reporting agency that receives a request pursuant to Subsection D of this section shall release a consumer's credit report as requested by the consumer within three business days after the business day on which the consumer's request by regular or certified mail or by telephone is received by the consumer reporting agency. As of September 1, 2008, a consumer reporting agency that receives a request pursuant to Subsection D of this section shall release a consumer's credit report as requested by the consumer within fifteen minutes after the consumer's request is received by the consumer reporting agency through the use of a telephone or a secure electronic method provided by the agency, which may include the use of the internet, facsimile or other electronic means; provided that the consumer reporting agency is not required to release the credit report within fifteen minutes unless the consumer's request is received by the consumer reporting agency between the hours of 6:00 a.m. and 9:30 p.m. mountain standard or mountain daylight time, as applicable, Sunday through Saturday.

F. A consumer reporting agency need not release a credit report within the time periods set forth in Subsection E of this section if:

(1) the consumer fails to meet the requirements of Subsection D of this section; or

(2) the consumer reporting agency's ability to remove the security freeze within fifteen minutes is prevented by:

(a) an act of God, including fire, earthquake, hurricane, storm or similar natural disaster or phenomenon;

(b) unauthorized or illegal acts by a third party, including terrorism, sabotage, riots, vandalism, labor strikes or disputes disrupting operations or similar occurrences;

(c) operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failure inhibiting response time or similar disruption;

(d) governmental action, including emergency orders or regulations, judicial or law enforcement actions or similar directives;

(e) regularly scheduled maintenance of, or updates to, the consumer reporting agency's systems during other than normal business hours; or

(f) commercially reasonable maintenance of, or repair to, the consumer reporting agency's systems that is unexpected or unscheduled.

G. If a consumer reporting agency erroneously releases information on a credit report while a security freeze is in effect and without a consumer's authorization, it shall notify the consumer of the release of information within five business days of the agency's discovery of the erroneous release of information and inform the consumer of the specific information released and the third party to whom it has been released.

H. A security freeze shall remain in place until a consumer requests its removal. A consumer reporting agency shall remove the security freeze within three business days after receiving a request from a consumer who provides the unique personal identification number, password or similar device and proper identification.

I. A consumer reporting agency may charge a consumer a fee of no more than ten dollars ($10.00) for the placement of a security freeze or for processing a declaration of removal. A consumer reporting agency may charge a fee of no more than five dollars ($5.00) for the release of a credit report, upon which a security freeze has been placed, to a specific person or for a specific period of time. A consumer reporting agency may charge a fee of no more than five dollars ($5.00) for the removal of a security freeze or to change a declaration of removal. A fee shall not be charged to a consumer who is sixty-five years of age or older or to a victim of identity theft who provides a valid police or investigative report filed with a law enforcement agency alleging the crime of identity theft. A consumer reporting agency shall accept payment by check sent via regular or certified mail and by debit or credit card via a secure electronic method and telephone and shall accept automatic clearinghouse and electronic fund transfer payments.

J. If a consumer's credit report was frozen due to a material misrepresentation of fact by the consumer and a consumer reporting agency intends to remove the freeze, the consumer reporting agency shall notify the consumer in writing five business days prior to removing the security freeze on the consumer's credit report.

K. A consumer reporting agency may advise a third party that a security freeze is in effect with respect to a consumer's credit report. A consumer reporting agency shall not suggest or otherwise state or imply to a third party that the security freeze reflects a negative credit score, history, report or rating.

L. The provisions of this section do not prevent a consumer reporting agency from releasing a consumer's credit report:

(1) to a person or the person's subsidiary, affiliate, agent or assignee with which the consumer has or, prior to assignment, had an account, contract or debtor-

creditor relationship for the purpose of reviewing the account or collecting the financial obligation owing for the account, contract or debt, or to a prospective assignee of a financial obligation owing by the consumer in conjunction with the proposed purchase of the financial obligation. As used in this paragraph, "reviewing the account" includes activities related to account maintenance, monitoring, credit line increases and account upgrades and enhancements;

(2) to a subsidiary, affiliate, agent, assignee or prospective assignee of a person to whom access has been granted by the consumer pursuant to Subsection D of this section for the purpose of facilitating the extension of credit or other permissible use;

(3) to a person or entity administering a credit file monitoring subscription service to which the consumer has subscribed;

(4) to a person or entity for the purpose of providing a consumer with a copy of the consumer's credit report upon the consumer's request;

(5) to a person acting pursuant to a court order, warrant or subpoena;

(6) to the child support enforcement division of the human services department for the purpose of carrying out its statutory duties of establishing and collecting child support obligations;

(7) to a governmental agency acting to investigate fraud, to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory duties;

(8) to a person for the purposes of prescreening as defined by the federal Fair Credit Reporting Act;

(9) from a consumer reporting agency's database or file that consists only of and is used solely for one or more of the following:

(a) criminal record information;

(b) tenant screening;

(d) fraud prevention or detection; or

(10) to a person or entity for use in setting or adjusting an insurance rate, adjusting an insurance claim or underwriting for insurance purposes.

M. The following entities are not required to place a security freeze on a credit report:

(1) a consumer reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or multiple consumer credit reporting agencies and does not maintain a permanent database of credit information from which new consumer credit reports are produced. However, a consumer reporting agency acting as a reseller shall honor any security freeze placed on a consumer credit report by another consumer reporting agency;

(2) a check services or fraud prevention services company that issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers or similar methods of payment; or

(3) a deposit account information service company that issues reports regarding account closures due to fraud, substantial overdrafts, automatic teller machine abuse or similar negative information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution."

Section 5. Section 56-3A-4 NMSA 1978 (being Laws 2007, Chapter 106, Section 4) is amended to read:

"56-3A-4. NOTICE OF RIGHTS.--At any time that a consumer reporting agency is required to provide the consumer with a summary of rights pursuant to Section 609 of the federal Fair Credit Reporting Act, the following notice shall be included:

"New Mexico Consumers Have the

Right to Obtain a Security Freeze or

Submit a Declaration of Removal

You may obtain a security freeze on your credit report to protect your privacy and ensure that credit is not granted in your name without your knowledge. You may submit a declaration of removal to remove information placed in your credit report as a result of being a victim of identity theft or inaccurate or false reporting. You have a right to place a security freeze on your credit report or submit a declaration of removal pursuant to the Fair Credit [Report] Reporting and Identity Security Act.

The security freeze will prohibit a consumer reporting agency from releasing any information in your credit report without your express authorization or approval.

The security freeze is designed to prevent credit, loans and services from being approved in your name without your consent. When you place a security freeze on your credit report, you will be provided with a personal identification number, password or similar device to use if you choose to remove the freeze on your credit report or to temporarily authorize the release of your credit report to a specific party or parties or for a specific period of time after the freeze is in place. To remove the freeze or to provide authorization for the temporary release of your credit report, you must contact the consumer reporting agency and provide all of the following:

(1) the unique personal identification number, password or similar device provided by the consumer reporting agency;

(2) proper identification to verify your identity;

(3) information regarding the third party or parties who are to receive the credit report or the period of time for which the credit report may be released to users of the credit report; and

(4) payment of a fee, if applicable.

A consumer reporting agency that receives a request from a consumer to lift temporarily a freeze on a credit report shall comply with the request no later than three business days after receiving the request. As of September 1, 2008, a consumer reporting agency shall comply with the request within fifteen minutes of receiving the request by a secure electronic method or by telephone.

A security freeze does not apply in all circumstances, such as where you have an existing account relationship and a copy of your credit report is requested by your existing creditor or its agents for certain types of account review, collection, fraud control or similar activities; for use in setting or adjusting an insurance rate or claim or insurance underwriting; for certain governmental purposes; and for purposes of prescreening as defined in the federal Fair Credit Reporting Act.

If you are actively seeking a new credit, loan, utility, telephone or insurance account, you should understand that the procedures involved in lifting a security freeze may slow your own applications for credit. You should plan ahead and lift a freeze, either completely if you are shopping around or specifically for a certain creditor, with enough advance notice before you apply for new credit for the lifting to take effect. You should contact a consumer reporting agency and request it to lift the freeze at least three business days before applying. As of September 1, 2008, if you contact a consumer reporting agency by a secure electronic method or by telephone, the consumer reporting agency should lift the freeze within fifteen minutes. You have a right to bring a civil action against a consumer reporting agency that violates your rights under the Fair Credit [Report] Reporting and Identity Security Act"."

Section 6. Section 56-3A-5 NMSA 1978 (being Laws 2007, Chapter 106, Section 5) is amended to read:

"56-3A-5. [VIOLATION OF SECURITY FREEZE] VIOLATIONS--CIVIL LIABILITY.--If a consumer reporting agency releases information [placed under a security freeze] in violation of the provisions of [Section 3 of the Credit Report Security Act] the Fair Credit Reporting and Identity Security Act, the affected consumer may bring a civil action against the consumer reporting agency for:

A. injunctive relief to prevent further violation of the [security freeze] Fair Credit Reporting and Identity Security Act;

B. any actual damages sustained by the consumer as a result of the violation;

C. a civil penalty in an amount not to exceed two thousand dollars ($2,000) for each violation of the security freeze; and

D. costs of the action and reasonable attorney fees."

Section 7. Section 56-3A-6 NMSA 1978 (being Laws 2007, Chapter 106, Section 6) is amended to read:

"56-3A-6. SEVERABILITY.--If any part or application of the Fair Credit [Report] Reporting and Identity Security Act is held invalid, the remainder or its application to other persons or situations shall not be affected."

- 19 -