Allows consumers who suspect they are a victim of identity theft to place a security alert and security freeze on their credit accounts. Establishes requirements and procedures for consumer credit reporting agencies.

A BILL FOR AN ACT

SECTION 1. Chapter 487, Hawaii Revised Statutes, is amended by designating section 1 to section 15 as Part .

SECTION 2. Chapter 487, Hawaii Revised Statutes, is amended by adding a new part to be appropriately designated and to read as follows:

"Part

"§487-A Consumer credit reporting agency reporting requirements. (a) Every consumer credit reporting agency shall, upon request and proper identification of any consumer, allow the consumer to visually inspect all files maintained regarding that consumer at the time of the request.

   	(b) Every consumer reporting agency, upon contact by a consumer by telephone, mail, or in person regarding information which may be contained in the agency files regarding that consumer, shall promptly advise the consumer of the consumer's rights under sections 487-H, 487-W, and 487-X, and of the obligation of the agency to provide disclosure of the files in person, by mail, or by telephone pursuant to section 487-M, including the obligation of the agency to provide a decoded written version of the file or a written copy of the file with an explanation of any code, including any credit score used, and the key factors, as defined in section 487-N, if the consumer so requests that copy.  The disclosure shall be provided in the manner selected by the consumer, chosen from among any reasonable means available to the consumer credit reporting agency.  The agency shall determine the applicability of paragraph (1) subsection (a) of section 487-U and, where applicable, the agency shall inform the consumer of the rights under that section.
   	(c) All information on a consumer in the files of a consumer credit reporting agency at the time of a request for inspection under subsection (a) of this section, shall be available for inspection, including the names, addresses and, if provided by the furnisher of information, the telephone numbers identified for customer service of that source of information.
(d)	(1)	The consumer credit reporting agency shall also 
disclose the recipients of any consumer credit report on the consumer which the consumer credit reporting agency has furnished for: 
(A)	Employment purposes within the two-year period preceding the request; or 
(B) Any other purpose within the 12-month period preceding the request. 
(2) 	Disclosure of recipients of consumer credit reports for purposes of this subsection shall include the name of the recipient or, if applicable, the fictitious business name under which the recipient does business disclosed in full.  The identification shall also include the address and, if provided by the recipient, the telephone number identified for customer service for the recipient. 
(e) The consumer credit reporting agency shall also disclose a record of all inquiries received by the agency in the 12-month period preceding the request that identified the consumer in connection with a credit transaction whether initiated by the consumer or not. This record of inquiries shall include the name, address and, if provided by the recipient, the telephone number identified for customer service for each recipient making an inquiry.
   	(f) When any consumer credit reporting agency is subject to the provisions of section 487-EE it is exempted from the requirements of subsections (c), (d), and (e), only with regard to the provision of the address and telephone number.
   	(g) Any consumer credit reporting agency, that provides a consumer credit report to another consumer credit reporting agency that procures the consumer credit report for the purpose of resale and is subject to Section 487-EE, is exempted from the requirements of subsections (d) and (e), only with regard to the provision of the address and telephone number regarding each prospective user to which the consumer credit report was sold.
     §487-B Consumer credit reporting agency reporting limitations. (a) A consumer credit reporting agency shall furnish a consumer credit report only under the following circumstances:
(1) 	In response to the order of a court having jurisdiction to issue an order. 
(2) 	In accordance with the written instructions of the consumer to whom it relates. 
(3) 	To a person whom it has reason to believe:
(A) 	Intends to use the information in connection with a credit transaction, or entering or enforcing an order of a court of competent jurisdiction for support, involving the consumer as to whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer; 
(B) 	Intends to use the information for employment purposes; 
(C) 	Intends to use the information in connection with the underwriting of insurance involving the consumer, or for insurance claims settlements; 
(D) 	Intends to use the information in connection with a determination of the consumer's eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider the applicant's financial responsibility or status; or 
(E) 	Otherwise has a legitimate business need for the information in connection with a business transaction involving the consumer. 
(b) A consumer credit reporting agency may furnish information for purposes of a credit transaction specified in subparagraph (A) of paragraph (3) of subsection (a), where it is a credit transaction that is not initiated by the consumer, only under the circumstances specified in paragraph (1) or (2), as follows:
(1)	The consumer authorizes the consumer credit reporting agency to furnish the consumer credit report to the person. 
(2) 	The proposed transaction involves a firm offer of credit to the consumer, the consumer credit reporting agency has complied with subsection (d), and the consumer has not elected pursuant to paragraph (1) of subsection (d) to have the consumer's name excluded from lists of names provided by the consumer credit reporting agency for purposes of reporting in connection with the potential issuance of firm offers of credit.  A consumer credit reporting agency may provide only the following information pursuant to this paragraph:  
(A) 	The name and address of the consumer. 
(B) 	Information pertaining to a consumer that is not identified or identifiable with a particular consumer. 
(c) Except as provided in paragraph (3) of subsection (a) of section 487-M, a consumer credit reporting agency shall not furnish to any person a record of inquiries solely resulting from credit transactions that are not initiated by the consumer. 
(d)	(1)	A consumer may elect to have the consumer's name and 
address excluded from any list provided by a consumer credit reporting agency pursuant to paragraph (2) of subsection (b) by notifying the consumer credit reporting agency, by telephone or in writing, through the notification system maintained by the consumer credit reporting agency pursuant to subsection (e), that the consumer does not consent to any use of consumer credit reports relating to the consumer in connection with any transaction that is not initiated by the consumer.
(2) 	An election of a consumer under paragraph (1) shall be effective with respect to a consumer credit reporting agency, and any affiliate of the consumer credit reporting agency, on the date on which the consumer notifies the consumer credit reporting agency. 
(3) 	An election of a consumer under paragraph (1) shall terminate and be of no force or effect following notice from the consumer to the consumer credit reporting agency, through the system established pursuant to subsection (e), that the election is no longer effective.
(e) Each consumer credit reporting agency that furnishes a pre-qualifying report pursuant to subsection (b) in connection with a credit transaction not initiated by the consumer shall establish and maintain a notification system, including a toll-free telephone number, that permits any consumer, with appropriate identification and for which the consumer credit reporting agency has a file, to notify the consumer credit reporting agency of the consumer's election to have the consumer's name removed from any list of names and addresses provided by the consumer credit reporting agency, and by any affiliated consumer credit reporting agency, pursuant to paragraph (2) of subsection (b).  Compliance with the requirements of this subsection by a consumer credit reporting agency shall constitute compliance with those requirements by any affiliate of that consumer credit reporting agency. 
(f) Each consumer credit reporting agency that compiles and maintains files on consumers on a nationwide basis shall establish and maintain a notification system under paragraph (1) of subsection (e) jointly with its affiliated consumer credit reporting agencies. 
§487-C Consumer credit report security alert. (a) A consumer may elect to place a security alert in the consumer's credit report by making a request in writing or by telephone to a consumer credit reporting agency.  "Security alert" means a notice placed in a consumer's credit report, at the request of the consumer, that notifies a recipient of the credit report that the consumer's identity may have been used without the consumer's consent to fraudulently obtain goods or services in the consumer's name.
(b) A consumer credit reporting agency shall notify each person requesting consumer credit information with respect to a consumer of the existence of a security alert in the credit report of that consumer, regardless of whether a full credit report, credit score, or summary report is requested. 
(c) Each consumer credit reporting agency shall maintain a toll-free telephone number to accept security alert requests from consumers 24 hours a day, 7 days a week.  
(d) The toll-free telephone number shall be included in any written disclosure by a consumer credit reporting agency to any consumer pursuant to section 487-M and shall be printed in a clear and conspicuous manner. 
(e) A consumer credit reporting agency shall place a security alert on a consumer's credit report no later than 3 business days after receiving a request from the consumer.  
(f) The security alert shall remain in place for at least 180 days, and a consumer shall have the right to request a renewal of the security alert.  
(g) Any person who uses a consumer credit report in connection with the approval of credit based on an application for an extension of credit, or with the purchase, lease, or rental of goods or non-credit-related services and who receives notification of a security alert pursuant to subsection (a) may not lend money, extend credit, or complete the purchase, lease, or rental of goods or non-credit-related services without taking reasonable steps to verify the consumer's identity, in order to ensure that the application for an extension of credit or for the purchase, lease, or rental of goods or non-credit-related services is not the result of identity theft.  If the consumer has placed a statement with the security alert in the consumer's file requesting that identity be verified by calling a specified telephone number, any person who receives that statement with the security alert in a consumer's file pursuant to subsection (a) shall take reasonable steps to verify the identity of the consumer by contacting the consumer using the specified telephone number prior to lending money, extending credit, or completing the purchase, lease, or rental of goods or non-credit-related services.  If a person uses a consumer credit report to facilitate the extension of credit or for another permissible purpose on behalf of a subsidiary, affiliate, agent, assignee, or prospective assignee, that person may verify a consumer's identity under this section in lieu of the subsidiary, affiliate, agent, assignee, or prospective assignee. 
(h) For purposes of this section, "extension of credit" does not include an increase in the dollar limit of an existing open-end credit plan or any change to, or review of, an existing credit account. 
(i) If reasonable steps are taken to verify the identity of the consumer pursuant to subsection (b) of section 487-BB, those steps constitute compliance with the requirements of this section, except that if a consumer has placed a statement including a telephone number with the security alert in the consumer's file, the consumer's identity shall be verified by contacting the consumer using that telephone number as specified pursuant to subsection (g).  
(j) A consumer credit reporting agency shall notify each consumer who has requested that a security alert be placed on the consumer's consumer credit report of the expiration date of the alert.  
(k) Notwithstanding section 487-W, any consumer credit reporting agency that recklessly, willfully, or intentionally fails to place a security alert pursuant to this section shall be liable for a penalty in an amount of up to two thousand five hundred dollars ($2,500) and reasonable attorneys' fees. 
§487-D Consumer credit report security freeze. (a) A consumer may elect to place a security freeze on the consumer's credit report by making a request in writing by certified mail to a consumer credit reporting agency.  "Security freeze" means a notice placed in a consumer's credit report, at the request of the consumer and subject to certain exceptions, that prohibits the consumer credit reporting agency from releasing the consumer's credit report or any information from it without the express authorization of the consumer.  If a security freeze is in place, information from a consumer's credit report may not be released to a third party without prior express authorization from the consumer.  This subsection does not prevent a consumer credit reporting agency from advising a third party that a security freeze is in effect with respect to the consumer's credit report.  
(b) A consumer credit reporting agency shall place a security freeze on a consumer's credit report no later than 3 business days after receiving a written request from the consumer. 
(c) The consumer credit reporting agency shall send a written confirmation of the security freeze to the consumer within 10 business days and shall provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of the consumer's credit for a specific party or period of time. 
(d) If the consumer wishes to allow the consumer's credit report to be accessed for a specific party or period of time while a freeze is in place, he or she shall contact the consumer credit reporting agency, request that the freeze be temporarily lifted, and provide the following:
(1)	Proper identification, as defined in subsection (c) of section 487-M. 
(2) 	The unique personal identification number or password provided by the credit reporting agency pursuant to subsection (c). 
(3) 	The proper information regarding the third party who is to receive the credit report or the time period for which the report shall be available to users of the credit report. 
(e) A consumer credit reporting agency that receives a request from a consumer to temporarily lift a freeze on a credit report pursuant to subsection (d), shall comply with the request no later than 3 business days after receiving the request. 
(f) A consumer credit reporting agency may develop procedures involving the use of telephone, fax, the Internet, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze on a credit report pursuant to subsection (d) in an expedited manner. 
(g) A consumer credit reporting agency shall remove or temporarily lift a freeze placed on a consumer's credit report only in the following cases: 
(1) 	Upon consumer request, pursuant to subsection (d) or (j). 
(2) 	If the consumer's credit report was frozen due to a material misrepresentation of fact by the consumer or the person who made the request.  If a consumer credit reporting agency intends to remove a freeze upon a consumer's credit report pursuant to this paragraph, the consumer credit reporting agency shall notify the consumer in writing prior to removing the freeze on the consumer's credit report.
(h) If a third party requests access to a consumer credit report on which a security freeze is in effect, and this request is in connection with an application for credit or any other use, and the consumer does not allow the consumer's credit report to be accessed for that specific party or period of time, the third party may treat the application as incomplete. 
(i) If a consumer requests a security freeze, the consumer credit reporting agency shall disclose the process of placing and temporarily lifting a freeze, and the process for allowing access to information from the consumer's credit report for a specific party or period of time while the freeze is in place. 
(j) A security freeze shall remain in place until the consumer requests that the security freeze be removed.  A consumer credit reporting agency shall remove a security freeze within 3 business days of receiving a request for removal from the consumer, who provides both of the following:
(1) 	Proper identification, as defined in subsection (c) of section 487-M. 
(2) 	The unique personal identification number or password provided by the credit reporting agency pursuant to subsection (c). 
(k) A consumer credit reporting agency shall require proper identification, as defined in subsection (c) of section 487-M, of the person making a request to place or remove a security freeze. 
(l) The provisions of this section do not apply to the use of a consumer credit report by any of the following: 
(1) 	A person or entity, or a subsidiary, affiliate, or agent of that person or entity, or an assignee of a financial obligation owing by the consumer to that person or entity, or a prospective assignee of a financial obligation owing by the consumer to that person or entity in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment an account or contract, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument.  For purposes of this paragraph, "reviewing the account" includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements. 
(2) 	A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under this section for purposes of facilitating the extension of credit or other permissible use. 
(3) 	Any state or local agency, law enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena. 
(4) 	A child support agency acting pursuant Title 42 of the United States Code. 
(5) 	The department of human services or its agents or assigns, acting to investigate Medicare fraud. 
(6) 	The department of taxation or its agents or assigns, acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities. 
(7) 	The use of credit information for the purposes of prescreening as provided for by the Federal Fair Credit Reporting Act. 
(8) 	Any person or entity administering a credit file monitoring subscription service to which the consumer has subscribed. 
(9) 	Any person or entity for the purpose of providing a consumer with a copy of the consumer's credit report upon the consumer's request. 
(m) This act does not prevent a consumer credit reporting agency from charging a fee of no more than ten dollars ($10) to a consumer for each freeze, removal of the freeze, or temporary lift of the freeze for a period of time, or a fee of no more than twelve dollars ($12) for a temporary lift of a freeze for a specific party, regarding access to a consumer credit report, except that a consumer credit reporting agency may not charge a fee to a victim of identity theft who has submitted a valid police report that alleges a violation of section 708-839.6, 708-839.7, and 708-839.8 of the Penal Code. 
§487-E Consumer credit report security freeze change notice. (a) If a security freeze is in place, a consumer credit reporting agency shall not change any of the following official information in a consumer credit report without sending a written confirmation of the change to the consumer within 15 days of the change being posted to the consumer's file: name, date of birth, social security number, and address.  Written confirmation is not required for technical modifications of a consumer's official information, including name and street  abbreviations, complete spellings, or transposition of numbers or letters.  In the case of an address change, the written confirmation shall be sent to both the new address and to the former address. 
(b) If a consumer has placed a security alert, a consumer credit reporting agency shall provide the consumer, upon request, with a free copy of the consumer's credit report at the time the 180-day security alert period expires. 
§487-F Consumer credit reporting agency exceptions. The provisions of sections 487-C, 487-D, and 487-E do not apply to a consumer credit reporting agency that acts only as a reseller of credit information pursuant to section 487-EE by assembling and merging information contained in the data base of another consumer credit reporting agency or multiple consumer credit reporting agencies, and does not maintain a permanent data base of credit information from which new consumer credit reports are produced.  However, a consumer credit reporting agency acting pursuant to section 487-EE shall honor any security freeze placed on a consumer credit report by another consumer credit reporting agency. 
§487-G. The following entities are not required to place in a credit report either a security alert, pursuant to section 487-C, or a security freeze, pursuant to section 487-D: 
(a) A check services or fraud prevention services company, which issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments. 
(b) A deposit account information service company, which issues reports regarding account closures due to fraud, substantial overdrafts, ATM abuse, or similar negative information regarding a consumer, to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution. 
SECTION 3.  Chapter 487, Hawaii Revised Statutes, is amended by adding a new part to be appropriately designated and to read as follows:

§487-H Consumer credit report; dissemination of consumer information. A consumer may elect that the consumer's name shall be removed from any list that a consumer credit reporting agency furnishes for credit card solicitations, by notifying the consumer credit reporting agency, by telephone or in writing, pursuant to the notification system maintained by the consumer credit reporting agency pursuant to subsection (d) of section 487-B. The election shall be effective for a minimum of two years, unless otherwise specified by the consumer.

§487-I. Consumer credit report; dissemination of consumer information applicability to government agency. Notwithstanding the provisions of section 487-B, a consumer credit reporting agency may furnish to a governmental agency a consumer's name, address, former address, places of employment, or former places of employment.

§487-J Consumer credit report; dissemination of consumer information; limitation on information. (a) No consumer credit reporting agency shall make any consumer credit report containing any of the following items of information:

(b) The 7-year period specified in paragraphs (5) and (7) of subsection (a) shall commence to run, with respect to any account that is placed for collection (internally or by referral to a third party, whichever is earlier), charged to profit and loss, or subjected to any similar action, upon the expiration of the 180-day period beginning on the date of the commencement of the delinquency that immediately preceded the collection activity, charge to profit and loss, or similar action. Where more than one of these actions is taken with respect to a particular account, the 7-year period specified in paragraphs (5) and (7) shall commence concurrently for all these actions on the date of the first of these actions.

(c) Any consumer credit reporting agency that furnishes a consumer credit report containing information regarding any case involving a consumer arising under the bankruptcy provisions of Title 11 of the United States Code shall include an identification of the chapter of Title 11 of the United States Code under which the case arose if that can be ascertained from what was provided to the consumer credit reporting agency by the source of the information.

(d) A consumer credit report shall not include any adverse information concerning a consumer predating the report by more than 10 years or that otherwise is prohibited from being included in a consumer credit report.

(e) If a consumer credit reporting agency is notified by a furnisher of credit information that an open-end credit account of the consumer has been closed by the consumer, any consumer credit report thereafter issued by the consumer credit reporting agency with respect to that consumer, and that includes information respecting that account, shall indicate the fact that the consumer has closed the account. For purposes of this subsection, "open-end credit account" does not include any demand deposit account, such as a checking account, money market account, or share draft account.

(f) Consumer credit reporting agencies shall not include medical information in their files on consumers or furnish medical information for employment, insurance, or credit purposes in a consumer credit report without the consent of the consumer.

(g) A consumer credit reporting agency shall include in any consumer credit report information, if any, on the failure of the consumer to pay overdue child support, where the information was provided to the consumer credit reporting agency and verified by another federal, state, or local governmental agency.

§487-K Consumer credit report; dissemination of consumer information; information not applicable. No consumer credit reporting agency shall make any consumer credit report with respect to a document which acts as a lien or other encumbrance, including, but not limited to, a notice of lis pendens, but which has together with it a court order striking or releasing the lien or other encumbrance.

§487-L Consumer credit reporting agency; dissemination of consumer information; safeguard procedures. (a) Every consumer credit reporting agency shall maintain reasonable procedures designed to avoid violations of section 487-J and to limit furnishing of consumer credit reports to the purposes listed under section 487-B. These procedures shall require that prospective users of the information identify themselves, certify the purposes for which the information is sought and certify that the information will be used for no other purposes. From the effective date of this act the consumer credit reporting agency shall keep a record of the purposes as stated by the user. Every consumer credit reporting agency shall make a reasonable effort to verify the identity of a new prospective user and the uses certified by the prospective user prior to furnishing the user a consumer report. No consumer credit reporting agency may furnish a consumer credit report to any person unless the consumer credit reporting agency has reasonable grounds for believing that the consumer credit report will be used by the person for the purposes listed in section 487-B. A consumer credit reporting agency does not have reasonable grounds for believing that a consumer credit report will be used by the person for the purposes listed in section 487-B unless all of the following requirements are met:

(b) Whenever a consumer credit reporting agency prepares a consumer credit report, it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates. These reasonable procedures shall include, but not be limited to, permanent retention by the consumer credit reporting agency in the consumer's file, or a separately individualized file, of that portion of the data in the file that is used by the consumer credit reporting agency to identify the individual consumer pursuant to paragraph (1) of subsection (a). This permanently retained data shall be available for use in either a reinvestigation pursuant to subsection (a) of section 487-Q, an investigation where the consumer has filed a police report pursuant to subsection (k) of section 487-Q, or a restoration of a file involving the consumer. If the permanently retained identifying information is retained in a consumer's file, it shall be clearly identified in the file in order for an individual who reviews the file to easily distinguish between the permanently stored identifying information and any other identifying information that may be a part of the file. This retention requirement shall not apply to data that is reported in error, that is obsolete, or that is found to be inaccurate through the results of a reinvestigation initiated by a consumer pursuant to subsection (a) of section 487-Q.

(c) No consumer credit reporting agency may prohibit any user of any consumer credit report furnished by the consumer credit reporting agency from disclosing the contents of the consumer credit report to the consumer who is the subject of the report if adverse action may be taken by the user based in whole or in part on the consumer credit report. The act of disclosure to the consumer by the user of the contents of a consumer credit report shall not be a basis for liability of the consumer credit reporting agency or the user under section 487-GG.

(d) A consumer credit reporting agency shall provide a written notice to any person who regularly and in the ordinary course of business, supplies information to the consumer credit reporting agency concerning any consumer or to whom a consumer credit report is provided by the consumer credit reporting agency. The notice shall specify the person's obligations under this chapter. Copies of the appropriate code sections shall satisfy the requirement of this subsection.

§487-M Consumer credit reporting agency; dissemination of consumer information; times of operation; consumer notice required. (a) A consumer credit reporting agency shall supply files and information required under section 487-A during normal business hours and on reasonable notice. In addition to the disclosure provided by this chapter and any disclosures received by the consumer, the consumer has the right to request and receive all of the following:

Identification for purposes of this paragraph shall include the name of the recipient or, if applicable, the fictitious business name under which the recipient does business disclosed in full. If requested by the consumer, the identification shall also include the address of the recipient.

(b) Files maintained on a consumer shall be disclosed promptly as follows:

(c) "Proper identification," as used in this chapter means that information generally deemed sufficient to identify a person. Only if the consumer is unable to be reasonably identified with the information described above, may a consumer credit reporting agency require additional information concerning the consumer's employment and personal or family history in order to verify the consumer's identity.

(d) The consumer credit reporting agency shall provide trained personnel to explain to the consumer any information furnished to the consumer pursuant to section 487-A.

(e) The consumer shall be permitted to be accompanied by one other person of the consumer's choosing, who shall furnish reasonable identification. A consumer credit reporting agency may require the consumer to furnish a written statement granting permission to the consumer credit reporting agency to discuss the consumer's file in that person's presence.

(f) Any written disclosure by a consumer credit reporting agency to any consumer pursuant to this section shall include a written summary of all rights the consumer has under this chapter and in the case of a consumer credit reporting agency which compiles and maintains consumer credit reports on a nationwide basis, a toll-free telephone number which the consumer can use to communicate with the consumer credit reporting agency. The written summary of rights required under this subsection is sufficient if in substantially the following form:

§487-N Consumer credit reporting agency; dissemination of consumer information; consumer credit score. (a) Upon the consumer's request for a credit score, a consumer credit reporting agency shall supply to a consumer a notice which shall include the information described in paragraphs (1) to (5), and a statement indicating that the information and credit scoring model may be different than the credit score that may be used by the lender. However, if the consumer requests the credit file and not the credit score, then the consumer shall receive the credit file and a statement that he or she may request and obtain a credit score.

(b) For purposes of this act, "credit score" means a numerical value or a categorization derived from a statistical tool or modeling system used by a person who makes or arranges a loan to predict the likelihood of certain credit behaviors, including default. The numerical value or the categorization derived from this analysis may also be referred to as a "risk predictor" or "risk score." "Credit score" does not include any mortgage score or rating of an automated underwriting system that considers one or more factors in addition to credit information, including, but not limited to, the loan to value ratio, the amount of down payment, or a consumer's financial assets. "Credit score" does not include other elements of the underwriting process or underwriting decision.

(c) For the purposes of this section, "key factors" means all relevant elements or reasons adversely affecting the credit score for the particular individual listed in the order of their importance based on their effect on the credit score.

(d) The information required by this section shall be provided in the same timeframe and manner as the information described in section 487-M.

(e) This section shall not be construed to compel a consumer reporting agency to develop or disclose a score if the agency does not (1) distribute scores that are used in connection with residential real property loans, or (2) develop scores that assist credit providers in understanding a consumer's general credit behavior and predicting the consumer's future credit behavior.

(f) This section shall not be construed to require a consumer credit reporting agency that distributes credit scores developed by another person or entity to provide a further explanation of them, or to process a dispute arising pursuant to subsection (a) of section 487-Q, except that the consumer credit reporting agency shall provide the consumer with the name, address, telephone number, and, if applicable, website for contacting the person or entity who developed the score or developed the methodology of the score. This subsection does not apply to a consumer credit reporting agency that develops or modifies scores that are developed by another person or entity.

(g) This section shall not be construed to require a consumer reporting agency to maintain credit scores in its files.

§487-O Consumer credit reporting agency; dissemination of consumer information; consumer credit score reporting procedure. (a) In complying with section 487-N, a consumer credit reporting agency shall supply the consumer with a credit score that is derived from a credit scoring model that is widely distributed to users by that consumer credit reporting agency in connection with residential real property loans or with a credit score that assists the consumer in understanding the credit scoring assessment of the consumer's credit behavior and predictions about the consumer's future credit behavior, and a statement indicating that the information and credit scoring model may be different than that used by the lender.

(b) A consumer credit reporting agency may charge a reasonable fee for providing the information required under section 487-N.

§487-P Consumer credit reporting agency; dissemination of consumer information; consumer file review; identity theft. (a) In addition to any other rights the consumer may have under this chapter, every consumer credit reporting agency, after being contacted by telephone, mail, or in person by any consumer who has reason to believe he or she may be a victim of identity theft, shall promptly provide to that consumer a statement, written in a clear and conspicuous manner, describing the statutory rights of victims of identity theft under this chapter.

(b) Every consumer credit reporting agency shall, upon the receipt from a victim of identity theft of a police report prepared pursuant to section 708-839.6, 708-839.7, and 708-839.8 of the Penal Code, provide the victim, free of charge and upon request, with up to 12 copies of the consumer's file during a consecutive 12-month period, not to exceed one copy per month, following the date of the police report. Notwithstanding any other provision of this chapter, the maximum number of free reports a victim of identity theft is entitled to obtain under this chapter is 12 per year, as provided by this subsection.

(c) Subsection (a) does not apply to a consumer reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or agencies and that does not maintain a permanent database of credit information from which new credit reports are produced.

§487-Q Consumer credit reporting agency; consumer disputed information. (a) If the completeness or accuracy of any item of information contained in the consumer's file is disputed by a consumer, and the dispute is conveyed directly to the consumer credit reporting agency by the consumer or user on behalf of the consumer, the consumer credit reporting agency shall within a reasonable period of time and without charge, reinvestigate and record the current status of the disputed information before the end of the 30-business-day period beginning on the date the agency receives notice of the dispute from the consumer or user, unless the consumer credit reporting agency has reasonable grounds to believe and determines that the dispute by the consumer is frivolous or irrelevant, including by reason of a failure of the consumer to provide sufficient information, as requested by the consumer credit reporting agency, to investigate the dispute. Unless the consumer credit reporting agency determines that the dispute is frivolous or irrelevant, before the end of the 5-business-day period beginning on the date the consumer credit reporting agency receives notice of dispute under this section, the agency shall notify any person who provided information in dispute at the address and in the manner specified by the person. A consumer credit reporting agency may require that disputes by consumers be in writing.

(b) In conducting the reinvestigation the consumer credit reporting agency shall review and consider all relevant information submitted by the consumer with respect to the disputed item of information. If the consumer credit reporting agency determines that the dispute is frivolous or irrelevant, it shall notify the consumer by mail or, if authorized by the consumer for that purpose, by any other means available to the consumer credit reporting agency, within 5 business days after that determination is made that it is terminating its reinvestigation of the item of information. In this notification, the consumer credit reporting agency shall state the specific reasons why it has determined that the consumer's dispute is frivolous or irrelevant. If the disputed item of information is found to be inaccurate, missing, or can no longer be verified by the evidence submitted, the consumer credit reporting agency shall promptly add, correct, or delete that information from the consumer's file.

(c) No information may be reinserted in a consumer's file after having been deleted pursuant to this section unless the person who furnished the information certifies that the information is accurate. If any information deleted from a consumer's file is reinserted in the file, the consumer credit reporting agency shall promptly notify the consumer of the reinsertion in writing or, if authorized by the consumer for that purpose, by any other means available to the consumer credit reporting agency. As part of, or in addition to, this notice the consumer credit reporting agency shall, within 5 business days of reinserting the information, provide the consumer in writing:

(d) A consumer credit reporting agency shall provide written notice to the consumer of the results of any reinvestigation under this subsection, within 5 days of completion of the reinvestigation. The notice shall include:

(1) A statement that the reinvestigation is completed;

(e) The presence of information in the consumer's file that contradicts the contention of the consumer shall not, in and of itself, constitute reasonable grounds for believing the dispute is frivolous or irrelevant.

(f) If the consumer credit reporting agency determines that the dispute is frivolous or irrelevant, or if the reinvestigation does not resolve the dispute, or if the information is reinserted into the consumer's file pursuant to subsection (c), the consumer may file a brief statement setting forth the nature of the dispute. The consumer credit reporting agency may limit these statements to not more than 100 words if it provides the consumer with assistance in writing a clear summary of the dispute.

(g) Whenever a statement of dispute is filed, the consumer credit reporting agency shall, in any subsequent consumer credit report containing the information in question, clearly note that the information is disputed by the consumer and shall include in the report either the consumer's statement or a clear and accurate summary thereof.

(h) Following the deletion of information from a consumer's file pursuant to this section, or following the filing of a statement of dispute pursuant to subsection (f), the consumer credit reporting agency, at the request of the consumer, shall furnish notification that the item of information has been deleted or that the item of information is disputed. In the case of disputed information, the notification shall include the statement or summary of the dispute filed pursuant to subsection (f). This notification shall be furnished to any person designated by the consumer who has, within 2 years prior to the deletion or the filing of the dispute, received a consumer credit report concerning the consumer for employment purposes, or who has, within 12 months of the deletion or the filing of the dispute, received a consumer credit report concerning the consumer for any other purpose, if these consumer credit reports contained the deleted or disputed information. The consumer credit reporting agency shall clearly and conspicuously disclose to the consumer the consumer's rights to make a request for this notification. The disclosure shall be made at or prior to the time the information is deleted pursuant to this section or the consumer's statement regarding the disputed information is received pursuant to subsection (f).

(i) A consumer credit reporting agency shall maintain reasonable procedures to prevent the reappearance in a consumer's file and in consumer credit reports of information that has been deleted pursuant to this section and not reinserted pursuant to subsection (c).

(j) If the consumer's dispute is resolved by deletion of the disputed information within 3 business days, beginning with the day the consumer credit reporting agency receives notice of the dispute in accordance with subsection (a), and provided that verification thereof is provided to the consumer in writing within 5 business days following the deletion, then the consumer credit reporting agency shall be exempt from requirements for further action under subsections (d), (f), and (g).

(k) If a consumer submits to a credit reporting agency a copy of a valid police report filed pursuant to section 708-839.6, 708-839.7, and 708-839.8 of the Penal Code, the consumer credit reporting agency shall promptly and permanently block reporting any information that the consumer alleges appears on the consumer's credit report as a result of a violation of section 708-839.6, 708-839.7, and 708-839.8 of the Penal Code so that the information cannot be reported. The consumer credit reporting agency shall promptly notify the furnisher of the information that the information has been so blocked. Furnishers of information and consumer credit reporting agencies shall ensure that information is unblocked only upon a preponderance of the evidence establishing the facts required under paragraph (1), (2), or (3). The permanently blocked information shall be unblocked only if:

(l) In unblocking information as described in subsection (k), a consumer reporting agency shall comply with all requirements of this section and 15 U.S.C. Sec. 1681i relating to reinvestigating disputed information. In addition, a consumer reporting agency shall accept the consumer's version of the disputed information and correct or delete the disputed item when the consumer submits to the consumer reporting agency documentation obtained from the source of the item in dispute or from public records confirming that the report was inaccurate or incomplete, unless the consumer reporting agency, in the exercise of good faith and reasonable judgment, has substantial reason based on specific, verifiable facts to doubt the authenticity of the documentation submitted and notifies the consumer in writing of that decision, explaining its reasons for unblocking the information and setting forth the specific, verifiable facts on which the decision was based.

(m) Any provision in a contract that prohibits the disclosure of a credit score by a person who makes or arranges loans or a consumer credit reporting agency is void. A lender shall not have liability under any contractual provision for disclosure of a credit score.

§487-R Consumer credit reporting agency; consumer disputed information; identity theft items removed. A consumer credit reporting agency shall delete from a consumer credit report inquiries for credit reports based upon credit requests that the consumer credit reporting agency verifies were initiated as the result of identity theft, as defined in section 487-BB(d).

§487-S Consumer credit reporting agency; consumer debt information not to be sold. (a) No creditor may sell a consumer debt to a debt collector, as defined in 15 U.S.C. Sec. 1692a, if the consumer is a victim of identity theft, as defined in section 487-BB(d), and with respect to that debt, the creditor has received notice pursuant to subsection (k) of section 487-Q.

(b) Subsection (a) does not apply to a creditor's sale of a debt to a subsidiary or affiliate of the creditor, if, with respect to that debt, the subsidiary or affiliate does not take any action to collect the debt.

(c) For the purposes of this section, the requirement in 15 U.S.C. Sec. 1692a, that a person must use an instrumentality of interstate commerce or the mails in the collection of any debt to be considered a debt collector, does not apply.

§487-T Consumer credit reporting agency; dissemination consumer information; exceptions. The provisions of subsections (k) and (l) of section 487-Q do not apply to a consumer reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or agencies, and that does not maintain a permanent database of credit information from which new credit reports are produced.

§487-U Consumer credit reporting agency; consumer information; fees and charges. (a) Except as otherwise provided, a consumer credit reporting agency may impose a reasonable charge upon a consumer, as follows:

(b) A consumer credit reporting agency shall make all disclosures pursuant to sections 487-A and 487-M and furnish all consumer reports pursuant to section 487-Q without charge, if requested by the consumer within 60 days after receipt by the consumer of a notification of adverse action pursuant to section 487-Y or of a notification from a debt collection agency affiliated with the consumer credit reporting agency stating that the consumer's credit rating may be or has been adversely affected.

(c) A consumer credit reporting agency shall not impose any charge for:

§487-V Consumer credit reporting agency; dissemination consumer information; source revealed. (a) Each consumer credit reporting agency which compiles and reports items of information concerning consumers which are matters of public record, shall specify in any report containing public record information the source from which that information was obtained, including the particular court, if there be such, and the date that the information was initially reported or publicized.

(b) A consumer credit reporting agency which furnishes a consumer credit report for employment purposes, and which for that purpose compiles and reports items of information on consumers which are matters of public record and are likely to have an adverse effect upon a consumer's ability to obtain employment shall, in addition, maintain strict procedures designed to ensure that whenever public record information which is likely to have an adverse effect on a consumer's ability to obtain employment is reported it is complete and up to date. For purposes of this paragraph, items of public record relating to arrests, indictments, convictions, suits, tax liens, and outstanding judgments shall be considered up to date if the current public record status of the item at the time of the report is reported.

(c) No consumer credit reporting agency which furnishes a consumer credit report for employment purposes shall report information on the age, marital status, race, color, or creed of any consumer.

§487-W Consumer credit reporting agency; consumer information; remedy. (a) In addition to any other remedy provided by law, a consumer may bring an action for a civil penalty against any of the following:

(b) If a plaintiff prevails in an action under subsection (a) he or she shall be awarded the civil penalty, costs, and reasonable attorney fees.

§487-X Consumer credit reporting agency; dissemination consumer information; consumer written request. Every consumer credit reporting agency, upon written request and the furnishing of sufficient identification to identify the consumer and the subject file, shall create reasonable procedures to prevent a consumer credit report or information from a consumer's file from being provided to any third party for marketing purposes or for any offer of credit not requested by the consumer. This section does not apply to the use of information by a credit grantor for purposes related to an existing credit relationship.

§487-Y Consumer credit reporting agency; adverse action against consumer; notice requirement. (a) If any person takes any adverse action with respect to any consumer, and the adverse action is based, in whole or in part, on any information contained in a consumer credit report, that person shall do all of the following:

(b) Whenever credit or insurance for personal, family, or household purposes involving a consumer is denied or the charge for such credit is increased either wholly or in part because of information obtained from a person other than a consumer credit reporting agency bearing upon consumer's credit worthiness or credit standing, the user of that information shall, within a reasonable period of time, and upon the consumer's written request for the reasons for that adverse action received within 60 days after learning of the adverse action, disclose the nature and substance of the information to the consumer. The user of the information shall clearly and accurately disclose to the consumer the consumer's right to make such a written request at the time the adverse action is communicated to the consumer.

(c) No person shall be held liable for any violation of this section if he or she shows by a preponderance of the evidence that at the time of the alleged violation he or she maintained reasonable procedures to assure compliance with this section.

§487-Z Consumer credit reporting agency; adverse action against consumer; notice requirement; firm credit offer. (a) Except as provided in subsection (b), any person who uses a consumer credit report in connection with any credit transaction not initiated by the consumer and which consists of a firm offer of credit shall provide with any solicitation made to the consumer a clear and conspicuous statement as to all of the following:

(b) Subsection (a) does not apply to any person using a pre-qualifying report if all of the following conditions are met:

(c) No person shall be denied credit on the basis of the consumer's refusal to provide consent pursuant to paragraph (3) of subsection (b), unless consent is necessary for the extension of credit, related to that transaction, by an affiliate.

§487-AA Consumer credit reporting agency; adverse action against consumer; notice requirement; credit score use. Any person who makes or arranges loans and who uses a consumer credit score as defined in section 487-N in connection with an application initiated or sought by a consumer for a closed end loan or establishment of an open end loan for a consumer purpose that is secured by one to 4 units of residential real property shall provide the following to the consumer as soon as reasonably practicable:

SECTION 6. In codifying the new sections added by sections 2 and 3 of this Act, the revisor of statutes shall substitute appropriate section numbers for the letters used in designating the new sections in this Act.

SECTION 7. This Act shall take effect on July 1, 2006.