Senate Bill No. 379–Committee on Judiciary

 

March 17, 2003

____________

 

Referred to Committee on Commerce and Labor

 

SUMMARY—Establishes various provisions relating to identity theft. (BDR 52‑266)

 

FISCAL NOTE:  Effect on Local Government: No.

                           Effect on the State: No.

 

~

 

EXPLANATION – Matter in bolded italics is new; matter between brackets [omitted material] is material to be omitted.

 

AN ACT relating to personal identifying information; prohibiting the public display of certain personal identifying information under certain circumstances and providing certain remedies; providing that a consumer may place a security alert or security freeze in certain files maintained by a reporting agency; providing for certain requirements and procedures relating to a security alert or security freeze; requiring a reporting agency to maintain a toll-free phone number for certain purposes; requiring a reporting agency to make certain disclosures in certain circumstances; and providing other matters properly relating thereto.

 

THE PEOPLE OF THE STATE OF NEVADA, REPRESENTED IN

SENATE AND ASSEMBLY, DO ENACT AS FOLLOWS:

 

1-1  Section 1. Chapter 597 of NRS is hereby amended by adding

1-2  thereto the provisions set forth as sections 2 to 8, inclusive, of this

1-3  act.

1-4  Sec. 2.  As used in sections 2 to 8, inclusive, of this act, unless

1-5  the context otherwise requires, the words and terms defined in

1-6  sections 3 and 4 of this act have the meanings ascribed to them in

1-7  those sections.

1-8  Sec. 3.  “Individual” means a natural person.

1-9  Sec. 4.  “Publicly display” means to intentionally

1-10  communicate or otherwise make available to the general public.

2-1  Sec. 5.  The provisions of sections 2 to 8, inclusive, of this act

2-2  do not apply to a state government, local government, state

2-3  governmental agency or local governmental agency.

2-4  Sec. 6.  1.  Except as otherwise provided in subsection 2, a

2-5  person shall not:

2-6  (a) Publicly display in any manner the social security number

2-7  of an individual;

2-8  (b) Print a social security number of an individual on any card

2-9  required for the individual to access products or services provided

2-10  by the person;

2-11      (c) Require an individual to transmit the social security

2-12  number of the individual over the Internet unless the connection is

2-13  secure or the social security number is encrypted;

2-14      (d) Require an individual to use his social security number to

2-15  access an Internet website, unless a password or unique personal

2-16  identification number or other authentication device is also

2-17  required to access the website; or

2-18      (e) Print an individual’s social security number on any

2-19  materials that are mailed to the individual, unless state or federal

2-20  law requires the social security number to be on the document to

2-21  be mailed. Notwithstanding this provision, applications and forms

2-22  sent by mail may include social security numbers.

2-23      2.  A person who, before July 1, 2003, was using a social

2-24  security number of an individual in a lawful manner may continue

2-25  using the social security number of that individual in that manner

2-26  on or after July 1, 2003, regardless of whether that use violates the

2-27  provisions of subsection 1, if:

2-28      (a) The use of the social security number is continuous; and

2-29      (b) The person provides to the individual an annual disclosure

2-30  statement that informs the individual of the right to stop the use of

2-31  the social security number of the individual by the person in a

2-32  manner that violates the provisions of subsection 1.

2-33      3.  If a person who uses the social security number of an

2-34  individual pursuant to the provisions of subsection 2 receives a

2-35  written request from an individual to stop the use of the social

2-36  security number of the individual in a manner that violates the

2-37  provisions of subsection 1, the person shall implement the request

2-38  within 30 days after receipt of the request. The person shall not

2-39  impose a fee or charge for implementing the request.

2-40      4.  A person shall not deny services to an individual because

2-41  the individual requests that the person cease to use the social

2-42  security number of the individual in a manner that violates the

2-43  provisions of subsection 1.

2-44      5.  The provisions of this section do not prevent the:

3-1  (a) Collection, use or release of a social security number as

3-2  required by state or federal law; or

3-3  (b) Use of a social security number for internal verification or

3-4  administrative purposes.

3-5  Sec. 7.  If a person willfully fails to comply with the

3-6  provisions of sections 2 to 8, inclusive, of this act, the person is

3-7  liable to the individual whose social security number is being used

3-8  in violation of the provisions of sections 2 to 8, inclusive, of this

3-9  act in an amount equal to the sum of:

3-10      1.  Any actual damages sustained by the consumer as a result

3-11  of the violation;

3-12      2.  Such amount of punitive damages as the court may allow;

3-13  and

3-14      3.  The costs of the action plus reasonable attorney’s fees.

3-15      Sec. 8.  If a person negligently fails to comply with the

3-16  provisions of sections 2 to 8, inclusive, of this act, the person is

3-17  liable to the individual whose social security number is being used

3-18  in violation of the provisions of sections 2 to 8, inclusive, of this

3-19  act in an amount equal to the sum of:

3-20      1.  Any actual damages sustained by the consumer as a result

3-21  of the violation; and

3-22      2.  The costs of the action plus reasonable attorney’s fees.

3-23      Sec. 9.  Chapter 598C of NRS is hereby amended by adding

3-24  thereto the provisions set forth as sections 10 to 19, inclusive, of this

3-25  act.

3-26      Sec. 10.  “Security alert” means a notice placed in the file of

3-27  a consumer, at the request of the consumer, that notifies a

3-28  recipient of the consumer report of the consumer that the identity

3-29  of the consumer may have been used without the consent of the

3-30  consumer to fraudulently obtain goods or services in the name of

3-31  the consumer.

3-32      Sec. 11.  “Security freeze” means a notice placed in the file of

3-33  a consumer, at the request of the consumer, that prohibits the

3-34  reporting agency from releasing the consumer report of the

3-35  consumer or any information from the file of the consumer

3-36  without the express authorization of the consumer.

3-37      Sec. 12.  1.  A consumer may place a security alert in the file

3-38  of the consumer by making a request to the reporting agency:

3-39      (a) In writing; or

3-40      (b) By telephone.

3-41      2.  At the time of the request to place a security alert, the

3-42  consumer must provide to the reporting agency sufficient

3-43  identification to establish the identity of the consumer.

4-1  3.  A reporting agency shall place a security alert in the file of

4-2  a consumer no more than 5 business days after receiving a request

4-3  from the consumer to place a security alert in the file.

4-4  4.  A reporting agency shall notify each person requesting a

4-5  consumer report of the existence of any security alert in the file of

4-6  that consumer.

4-7  5.  A security alert must remain in place for at least 90 days,

4-8  and the consumer has the right to renew the security alert.

4-9  6.  At the termination of a security alert placed in the file of a

4-10  consumer, if the consumer requests, a reporting agency shall

4-11  provide to the consumer a free copy of the consumer report of the

4-12  consumer.

4-13      Sec. 13. 1.  A reporting agency shall maintain a toll-free

4-14  telephone number to accept requests for security alerts from a

4-15  consumer 24 hours a day, 7 days a week.

4-16      2.  The toll-free telephone number, printed in a clear and

4-17  conspicuous manner, must be included in any disclosure by a

4-18  reporting agency to a consumer pursuant to the provisions of this

4-19  chapter.

4-20      Sec. 14.  1.  A consumer may place a security freeze in the

4-21  file of the consumer by making a request in writing by certified

4-22  mail to a consumer credit reporting agency.

4-23      2.  At the time of the request to place a security freeze, the

4-24  consumer must provide to the reporting agency sufficient

4-25  identification to establish the identity of the consumer.

4-26      3.  A reporting agency shall place a security freeze in the file

4-27  of a consumer no more than 5 business days after receiving a

4-28  request from the consumer to place a security freeze in the file.

4-29      4.  Within 10 business days after the placement of the security

4-30  freeze, the reporting agency shall:

4-31      (a) Send written confirmation to the consumer of the

4-32  placement of the security freeze in the file of the consumer; and

4-33      (b) Provide the consumer with:

4-34          (1) A unique personal identification number or password to

4-35  be used by the consumer when providing authorization for the

4-36  release of the consumer report of the consumer; and

4-37          (2) Information on the procedure for contacting the

4-38  reporting agency to temporarily authorize the release of the

4-39  consumer report of the consumer or to remove a security freeze

4-40  from the file of the consumer.

4-41      5.  Except as otherwise provided by subsection 6 and sections

4-42  16 to 19, inclusive, of this act, if a security freeze has been placed

4-43  in the file of a consumer, a reporting agency shall not provide a

4-44  consumer report of the consumer to a third party.

5-1  6.  The reporting agency may release to a person requesting

5-2  the consumer report of a consumer that a security freeze is in

5-3  effect with respect to the consumer report of the consumer.

5-4  7.  A reporting agency may charge a reasonable fee to a

5-5  consumer to place a security freeze pursuant to the provisions of

5-6  this section, except that a reporting agency may not charge a fee to

5-7  place a security freeze to a victim of identity theft who submits, at

5-8  the time the security freeze is requested, a police report evidencing

5-9  that the consumer was a victim of identity theft.

5-10      8.  Except as otherwise provided by sections 16, 17 and 18 of

5-11  this act, a reporting agency shall not remove a security freeze

5-12  placed into the file of a consumer pursuant to the provisions of

5-13  this section.

5-14      Sec. 15.  1.  After a security freeze has been placed in the

5-15  file of a consumer pursuant to the provisions of section 14 of this

5-16  act, a reporting agency shall not make any changes to the file of

5-17  the consumer relating to:

5-18      (a) The name of the consumer;

5-19      (b) The date of birth of the consumer;

5-20      (c) The social security number of the consumer; and

5-21      (d) The address of the consumer,

5-22  without sending written confirmation of the change to the

5-23  consumer within 30 days after the change is posted to the file of

5-24  the consumer.

5-25      2.  Written confirmation is not required for technical

5-26  modifications of the information related to a consumer.

5-27      3.  For a change of the address of the consumer, the written

5-28  confirmation must be sent to both the new address and to the

5-29  former address.

5-30      Sec. 16.  1.  To authorize the temporary release of the

5-31  consumer report of the consumer after a security freeze has been

5-32  placed in the file of the consumer pursuant to the provisions of

5-33  section 14 of this act, the consumer must:

5-34      (a) Contact the reporting agency;

5-35      (b) Request that the consumer report of the consumer be

5-36  temporarily released; and

5-37      (c) Provide to the reporting agency:

5-38          (1) Sufficient identification to establish the identity of the

5-39  consumer;

5-40          (2) The unique personal identification number or password

5-41  provided by the reporting agency pursuant to subparagraph (1) of

5-42  paragraph (b) of subsection 4 of section 14 of this act; and

5-43          (3) Information:

5-44             (I) Regarding the party who is to receive the consumer

5-45  report of the consumer; or

6-1          (II) The period for which the consumer report will be

6-2  available to persons who request the consumer report of the

6-3  consumer.

6-4  2.  A reporting agency that receives a request from a

6-5  consumer to temporarily release the consumer report of the

6-6  consumer pursuant to subsection 1, shall comply with the request

6-7  no later than 3 business days after receiving the request.

6-8  3.  A reporting agency shall develop procedures for a

6-9  consumer to contact the reporting agency to authorize the release

6-10  of a consumer report pursuant to the provisions of subsection 1.

6-11  These procedures may include, without limitation, the use of

6-12  telephone, facsimile machine, the Internet or other electronic

6-13  media by a consumer to authorize the release of the consumer

6-14  report of the consumer.

6-15      4.  A reporting agency may charge a reasonable fee to a

6-16  consumer requesting to temporarily release the consumer report of

6-17  the consumer pursuant to the provisions of this section, except

6-18  that a reporting agency may not charge a fee to temporarily

6-19  release the consumer report of a consumer if the consumer was a

6-20  victim of identity theft and submitted, at the time the consumer

6-21  placed the security freeze, a police report evidencing that the

6-22  consumer was a victim of identity theft.

6-23      Sec. 17.  1.  To authorize the permanent removal of a

6-24  security freeze that has been placed in the file of a consumer

6-25  pursuant to the provisions of section 14 of this act, the consumer

6-26  must:

6-27      (a) Contact the reporting agency;

6-28      (b) Request that the security freeze be released; and

6-29      (c) Provide to the reporting agency:

6-30          (1) Sufficient identification to establish the identity of the

6-31  consumer; and

6-32          (2) The unique personal identification number or password

6-33  provided by the reporting agency pursuant to subparagraph (1) of

6-34  paragraph (b) of subsection 4 of section 14 of this act.

6-35      2.  A reporting agency that receives a request from a

6-36  consumer pursuant to subsection 1 to release a security freeze

6-37  placed into the file of the consumer shall comply with the request

6-38  no later than 3 business days after receiving the request.

6-39      3.  A reporting agency shall develop procedures for a

6-40  consumer to contact the reporting agency to authorize the removal

6-41  of a security freeze that has been placed in the file of the

6-42  consumer pursuant to the provisions of subsection 1. These

6-43  procedures may include, without limitation, the use of telephone,

6-44  facsimile machine, the Internet or other electronic media by a

6-45  consumer to authorize the removal of a security freeze.

7-1  4.  A reporting agency may charge a reasonable fee to a

7-2  consumer requesting to permanently remove a security freeze from

7-3  the file of the consumer pursuant to the provisions of this section,

7-4  except that a reporting agency may not charge a fee to

7-5  permanently remove a security freeze from the file of a consumer

7-6  pursuant to the provisions of this section if the consumer was a

7-7  victim of identity theft and submitted, at the time the consumer

7-8  placed the security freeze, a police report evidencing that the

7-9  consumer was a victim of identity theft.

7-10      Sec. 18.  1.  A reporting agency may remove a security

7-11  freeze from the file of a consumer if the reporting agency has

7-12  reasonable belief that the consumer placed the security freeze into

7-13  the file of the consumer for the purposes of:

7-14      (a) Committing fraud;

7-15      (b) Misrepresenting any material fact;

7-16      (c) Aiding and abetting any unlawful act; or

7-17      (d) Any other act prohibited by law.

7-18      2.  If a reporting agency removes a security freeze pursuant to

7-19  the provisions of subsection 1, the reporting agency shall, within 5

7-20  days of removing the security freeze, provide written notice to the

7-21  consumer that the reporting agency is removing the security

7-22  freeze.

7-23      Sec. 19.  Notwithstanding that a security freeze has been

7-24  placed in the file of the consumer pursuant to the provisions of

7-25  section 14 of this act, a reporting agency shall release the

7-26  consumer report of a consumer to:

7-27      1.  A person with whom the consumer has an existing

7-28  business relationship for any purpose relating to the relationship

7-29  between the person and the consumer;

7-30      2.  A third party to whom an account of the consumer has

7-31  been assigned for purpose of collection;

7-32      3.  Any person requesting the consumer report pursuant to a

7-33  court order, warrant or subpoena;

7-34      4.  An agency, acting pursuant to the provisions Part D of

7-35  Title IV of the Social Security Act, 42 U.S.C. §§ 651 et seq.,

7-36  seeking to collect child support payments;

7-37      5.  A person that seeks to use information in the file of a

7-38  consumer for the purposes of prescreening as provided for by the

7-39  Fair Credit Reporting Act; and

7-40      6.  A state government, local government, state governmental

7-41  agency or local governmental agency.

7-42      Sec. 20.  NRS 598C.010 is hereby amended to read as follows:

7-43      598C.010  As used in this chapter, unless the context otherwise

7-44  requires, the words and terms defined in NRS 598C.020 to

8-1  598C.100, inclusive, and sections 10 and 11 of this act have the

8-2  meanings ascribed to them in those sections.

8-3  Sec. 21.  NRS 598C.130 is hereby amended to read as follows:

8-4  598C.130  1.  Upon request and information sufficient to

8-5  identify a consumer, a reporting agency shall:

8-6  [1.] (a) Clearly and accurately disclose to the consumer the

8-7  nature and substance of the consumer report in its files which relates

8-8  to him at the time of the request, and disclose the names of the

8-9  institutional sources of information. If the consumer requests, the

8-10  reporting agency shall provide a readable copy of the consumer

8-11  report.

8-12      [2.] (b) Disclose the name of each person who has received

8-13  from the reporting agency information concerning him:

8-14      [(a)] (1) Within the preceding 2 years for purposes of

8-15  employment, promotion, reassignment or retention as an employee;

8-16  or

8-17      [(b)] (2) Within the preceding [6] 12 months for any other

8-18  purpose.

8-19      2.  At the discretion of the consumer, any disclosure pursuant

8-20  to the provisions of subsection 1 must be made to the consumer:

8-21      (a) In person, at the office of the reporting agency;

8-22      (b) By mail, to the address specified by the consumer; or

8-23      (c) By telephone.

8-24      3.  A reporting agency shall make available to a consumer

8-25  personnel trained to explain to the consumer any information

8-26  furnished to him pursuant subsection 1.

8-27      4.  If a reporting agency provides a disclosure pursuant to the

8-28  provisions of paragraph (a) of subsection 2, the consumer may be

8-29  accompanied by a person of the consumer’s choice. A reporting

8-30  agency may require that:

8-31      (a) The accompanying person provide identification sufficient

8-32  to establish the identity of the accompanying person; and

8-33      (b) The consumer sign a waiver providing that the file of the

8-34  consumer may be disclosed in the presence of the accompanying

8-35  person.

8-36      5.  Any written disclosure by a reporting agency to a

8-37  consumer pursuant to this section must include a written summary

8-38  of the rights of the consumer pursuant to the provisions of this

8-39  chapter. The written summary of rights required by this subsection

8-40  is sufficient if it is in substantially the following form:

 

8-41      “You have a right to obtain a copy of your file from a

8-42  reporting agency. If adverse action has been taken against

8-43  you because of information in your consumer report within

8-44  the preceding 60 days, you have the right to obtain a copy of

9-1  your file without paying a fee. If you request, the consumer

9-2  credit reporting agency must provide someone to help you

9-3  interpret the information in your credit file.

9-4  You have a right to dispute inaccurate information by

9-5  contacting the reporting agency directly. However, neither

9-6  you nor anyone working on your behalf has the right to

9-7  have accurate, current and verifiable information removed

9-8  from your credit report. A reporting agency must remove

9-9  accurate, negative information from your report only if it is

9-10  over 7 years old. Bankruptcy information may be reported

9-11  for 10 years.

9-12      If you have notified a reporting agency in writing that

9-13  you dispute the accuracy of information in your file, the

9-14  reporting agency must, within 30 business days,

9-15  reinvestigate and modify or remove inaccurate information.

9-16  The reporting agency may not charge a fee for this service.

9-17  Any pertinent information and copies of all documents you

9-18  have concerning an error should be given to the reporting

9-19  agency.

9-20      If reinvestigation does not resolve the dispute to your

9-21  satisfaction, you may send a brief statement to the reporting

9-22  agency to keep in your file, explaining why you think the

9-23  record is inaccurate. The reporting agency must include

9-24  your statement about disputed information in a consumer

9-25  report it issues about you.

9-26      You have a right to receive a record of all inquiries

9-27  relating to a credit transaction initiated during the 12

9-28  months preceding your request. This record must include

9-29  the recipients of your consumer report.

9-30      You have a right to place a “security alert” in your file

9-31  which will warn anyone who receives your consumer report

9-32  that your identity may have been used without your consent

9-33  and that recipients of your credit report are advised, but not

9-34  required, to verify your identity before issuing credit. The

9-35  security alert may prevent credit, loans and services from

9-36  being approved in your name without your consent.

9-37  However, you should be aware that taking advantage of this

9-38  right may delay or interfere with the timely approval of any

9-39  subsequent request or application you make regarding a

9-40  new loan, credit, mortgage, insurance, rental housing,

9-41  employment, investment, license, cellular phone, utilities,

9-42  digital signature, Internet credit card transaction or other

9-43  services, including an extension of credit at point of sale. If

9-44  you place a security alert in your file, you have a right to

9-45  obtain a free copy of your credit report at the time the

10-1  security alert period expires. A security alert may be

10-2  requested by calling the following toll-free telephone

10-3  number: (Insert applicable toll-free telephone number).

10-4      You have a right to place a “security freeze” in your file

10-5  which will prohibit a reporting agency from releasing any

10-6  information in your file without your express authorization.

10-7  A security freeze must be requested in writing by certified

10-8  mail. The security freeze is designed to prevent a reporting

10-9  agency from releasing your consumer report without your

10-10  consent. However, you should be aware that using a

10-11  security freeze to take control over who is allowed access to

10-12  the personal and financial information in your file may

10-13  delay, interfere with or prohibit the timely approval of any

10-14  subsequent request or application you make regarding a

10-15  new loan, credit, mortgage, insurance, government services

10-16  or payments, rental housing, employment, investment,

10-17  license, cellular phone, utilities, digital signature, Internet

10-18  credit card transaction or other services, including an

10-19  extension of credit at point of sale. When you place a

10-20  security freeze in your file, you will be provided a personal

10-21  identification number or password to use if you choose to

10-22  remove the security freeze in your file or to authorize the

10-23  release of your consumer report for a specific party or

10-24  period of time after the freeze is in place. To provide that

10-25  authorization you must contact the reporting agency and

10-26  provide all of the following:

10-27     1.  The personal identification number or password.

10-28     2.  Proper identification to verify your identity.

10-29     3.  Information regarding who is to receive your

10-30  consumer report or the period of time for which the

10-31  consumer report must be available.

10-32     A reporting agency must authorize the release of your

10-33  consumer report no later than 3 business days after

10-34  receiving the above information.

10-35     A security freeze does not apply to a person, or collection

10-36  agencies acting on behalf of a person, with whom you have

10-37  an existing account that requests information in your credit

10-38  report for the purposes of reviewing or collecting the

10-39  account.

10-40     You have a right to bring civil action against anyone,

10-41  including a reporting agency, who improperly obtains

10-42  access to your file, knowingly or willfully misuses file data,

10-43  or fails to correct inaccurate file data.”

 

 

11-1      Sec. 22. This act becomes effective July 1, 2003.

 

11-2  H