Equifax Consumer Protection and Data Empowerment Act of 2018

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Equifax Consumer Protection and Data 
Empowerment Act of 2018''.

SEC. 2. CREDIT LOCKS.

    (a) In General.--The Fair Credit Reporting Act (15 U.S.C. 1681 et 
seq.) is amended by inserting after section 605B (15 U.S.C. 1681c-2) 
the following:

``SEC. 605C. PROTECTION OF CREDIT INFORMATION OF CONSUMERS.

    ``(a) Secure, Convenient, Accessible, and Cost-Free File Locks for 
Consumers.--
            ``(1) In general.--Subject to paragraph (2), each consumer 
        reporting agency described in section 603(p) shall provide to 
        any consumer a secure, convenient, accessible, and cost-free 
        method that, with the express authorization of the consumer, 
        allows that consumer reporting agency to release, or prevents 
        that consumer reporting agency from releasing, any information 
        in the file of the consumer for the purpose of--
                    ``(A) the marketing or extension of credit or 
                insurance; or
                    ``(B) opening any financial account.
            ``(2) Prohibitions.--With respect to the method described 
        in paragraph (1)--
                    ``(A) the method may not be used by the consumer 
                reporting agency that provides the method, or by any 
                other person, to collect any information on a consumer 
                that is not necessary for the purposes of preventing 
                the release of information described in that paragraph;
                    ``(B) no information collected under the method may 
                be used for any purpose other than a purpose described 
                in subparagraph (A);
                    ``(C) in offering the method, a credit reporting 
                agency described in section 603(p) may not require a 
                consumer to--
                            ``(i) waive any rights of the consumer; or
                            ``(ii) indemnify the credit reporting 
                        agency with respect to any liabilities that 
                        arise from offering the method; and
                    ``(D) the method may not be used by any person to 
                market or advertise any product or service.
            ``(3) Release of information.--Nothing in this subsection 
        shall affect the ability of a person with whom a consumer has 
        an account, contract, or debtor-creditor relationship to obtain 
        information regarding the consumer for the purposes of 
        reviewing the account or collecting on the account.
    ``(b) Regulations.--Not later than 18 months after the date of 
enactment of this section, the Bureau shall prescribe regulations 
carrying out this section.''.
    (b) Table of Contents Amendment.--The table of contents for the 
Fair Credit Reporting Act (15 U.S.C. 1681 et seq.) is amended by 
inserting after the item relating to section 605B the following:

``605C. Protection of credit information of consumers.''.

SEC. 3. PERMISSIBLE PURPOSES OF CREDIT REPORTS; DISCLOSURE TO 
              CONSUMERS.

    (a) In General.--The Fair Credit Reporting Act (15 U.S.C. 1681 et 
seq.) is amended--
            (1) in section 604 (15 U.S.C. 1681b)--
                    (A) in subsection (a)--
                            (i) in the matter preceding paragraph (1)--
                                    (I) by striking ``Subject to 
                                subsection (c), any'' and inserting 
                                ``Any''; and
                                    (II) by striking ``a consumer 
                                report'' and inserting ``information 
                                from the file of a consumer'';
                            (ii) in paragraph (3)--
                                    (I) by striking subparagraphs (A) 
                                and (C);
                                    (II) by redesignating subparagraph 
                                (B) as subparagraph (A);
                                    (III) by redesignating 
                                subparagraphs (D) through (G) as 
                                subparagraphs (B) through (E), 
                                respectively; and
                                    (IV) in subparagraph (D), as so 
                                redesignated, by striking 
                                ``information--'' and all that follows 
                                through the period at the end of clause 
                                (ii) and inserting the following: 
                                ``information to review an account to 
                                determine whether the consumer 
                                continues to meet the terms of the 
                                account; or''; and
                            (iii) by adding at the end the following:
            ``(7) Pursuant to the express authorization of a consumer, 
        subject to the method provided under section 605C(a) in the 
        case of a consumer reporting agency described in section 
        603(p).'';
                    (B) by striking subsection (c); and
                    (C) by redesignating subsections (d) through (g) as 
                subsections (c) through (f), respectively;
            (2) in section 609(a)(1) (15 U.S.C. 1681g(a)(1)), by 
        striking ``request, except that--'' and all that follows 
        through the period at the end of subparagraph (B) and inserting 
        the following: ``request, without regard to whether the 
        information is held by a parent, subsidiary, or affiliate of 
        the consumer reporting agency.'';
            (3) in section 612(a)(1)(A) (15 U.S.C. 1681j(a)(1)(A)), by 
        striking ``once during any 12-month period''; and
            (4) in section 615 (15 U.S.C. 1681m)--
                    (A) by striking subsection (d); and
                    (B) by redesignating subsections (e) through (h) as 
                subsections (d) through (g), respectively.
    (b) Regulations.--Not later than 18 months after the date of 
enactment of this Act, the Bureau of Consumer Financial Protection 
shall issue regulations carrying out section 609(a)(1) of the Fair 
Credit Reporting Act (15 U.S.C. 1681g(a)(1)), as amended by subsection 
(a)(2).
    (c) Technical and Conforming Amendments.--
            (1) Consumer financial protection act of 2010.--Section 
        1002(12)(F) of the Consumer Financial Protection Act of 2010 
        (12 U.S.C. 5481(12)(F)) is amended--
                    (A) by striking ``615(e)'' and inserting 
                ``615(d)''; and
                    (B) by striking ``1681m(e)'' and inserting 
                ``1681m(d)''.
            (2) Fair credit reporting act.--The Fair Credit Reporting 
        Act (15 U.S.C. 1681 et seq.) is amended--
                    (A) in section 603 (15 U.S.C. 1681a)--
                            (i) in subsection (d)(3), in the matter 
                        preceding subparagraph (A), by striking 
                        ``section 604(g)(3)'' and inserting ``section 
                        604(f)(3)''; and
                            (ii) in subsection (k)(1)(B)--
                                    (I) in clause (iii), by striking 
                                ``section 604(a)(3)(D)'' and inserting 
                                ``section 604(a)(3)(B)''; and
                                    (II) in clause (iv)(I), by striking 
                                ``section 604(a)(3)(F)(ii)'' and 
                                inserting ``section 604(a)(3)(D)'';
                    (B) in section 621 (15 U.S.C. 1681s)--
                            (i) in subsection (b)(1), in the matter 
                        preceding subparagraph (A), by striking 
                        ``persons who furnish information to such 
                        agencies, and users of information that are 
                        subject to section 615(d)'' and inserting ``and 
                        persons who furnish information to such 
                        agencies''; and
                            (ii) in subsection (e)(1), in the first 
                        sentence, by striking ``615(e)'' and inserting 
                        ``615(d)'';
                    (C) in section 623(c)(3) (15 U.S.C. 1681s-2(c)(3)), 
                by striking ``subsection (e)'' and inserting 
                ``subsection (d)''; and
                    (D) in section 625(b) (15 U.S.C. 1681t(b))--
                            (i) in paragraph (1)--
                                    (I) in subparagraph (A), by 
                                striking ``subsection (c) or (e) of 
                                section 604'' and inserting ``section 
                                604(d)'';
                                    (II) by striking subparagraph (D);
                                    (III) by redesignating 
                                subparagraphs (E) through (I) as 
                                subparagraphs (D) through (H), 
                                respectively; and
                                    (IV) in subparagraph (H), as so 
                                redesignated, by striking ``section 
                                615(h)'' and inserting ``section 
                                615(g)''; and
                            (ii) in paragraph (5)(F), by striking 
                        ``(e), (f), and (g)'' and inserting ``(d), (e), 
                        and (f)''.

SEC. 4. ENHANCEMENT OF FRAUD ALERT PROTECTIONS.

    (a) In General.--Section 605A of the Fair Credit Reporting Act (15 
U.S.C. 1681c-1) is amended--
            (1) by striking subsection (a);
            (2) by redesignating subsections (b) through (h) as 
        subsections (a) through (g), respectively;
            (3) in subsection (a), as so redesignated--
                    (A) in the subsection heading, by striking 
                ``Extended'' and inserting ``Fraud''; and
                    (B) in paragraph (1)--
                            (i) in the matter preceding subparagraph 
                        (A), by striking ``submits an identity theft 
                        report'' and inserting ``asserts in good faith 
                        a suspicion that the consumer has been or is 
                        about to become a victim of fraud or related 
                        crime, including identity theft, or has been or 
                        will be harmed by the unauthorized disclosure 
                        of the financial or personally identifiable 
                        information of the consumer,'';
                            (ii) in subparagraph (A), by striking ``7-
                        year'' and inserting ``10-year'';
                            (iii) by striking subparagraph (B);
                            (iv) by redesignating subparagraph (C) as 
                        subparagraph (B);
                            (v) in subparagraph (B), as so 
                        redesignated--
                                    (I) by striking ``extended''; and
                                    (II) by striking the period at the 
                                end and inserting ``; and''; and
                            (vi) by adding at the end the following:
                    ``(C) upon the expiration of the period described 
                in subparagraph (A), or a subsequent 10-year period, 
                and in response to a direct request by the consumer or 
                such representative, continue the fraud alert for an 
                additional period of 10 years if the consumer or such 
                representative submits an identity theft report.'';
            (4) in subsection (b), as so redesignated--
                    (A) by striking paragraph (2);
                    (B) by redesignating paragraphs (1) and (3) as 
                subparagraphs (A) and (B), respectively, and adjusting 
                the margins accordingly;
                    (C) in the matter preceding subparagraph (A), as so 
                redesignated, by striking ``Upon the direct request'' 
                and inserting the following:
            ``(1) In general.--Upon the direct request''; and
                    (D) by adding at the end the following:
            ``(2) Access to free reports.--If a consumer reporting 
        agency includes an active duty alert in the file of an active 
        duty military consumer, the consumer reporting agency shall--
                    ``(A) disclose to the active duty military consumer 
                that the active duty military consumer may request a 
                free copy of the file of the active duty military 
                consumer under section 612(d) during each 1-year period 
                beginning on the date on which the activity duty 
                military alert is requested and ending on the date of 
                the last day that the active duty alert applies to the 
                file of the active duty military consumer; and
                    ``(B) not later than 3 business days after the date 
                on which the active duty military consumer makes a 
                request described in subparagraph (A), provide to the 
                active duty military consumer all disclosures required 
                to be made under section 609, without charge to the 
                active duty military consumer.'';
            (5) by amending subsection (c), as so redesignated, to read 
        as follows:
    ``(c) Procedures.--Each consumer reporting agency described in 
section 603(p) shall establish and make available to the public on the 
Internet website of the consumer reporting agency policies and 
procedures to comply with this section, including policies and 
procedures--
            ``(1) that inform consumers of the availability of fraud 
        alerts, active duty alerts, or the method provided under 
        section 605C(a), as applicable;
            ``(2) that allow consumers to request fraud alerts and 
        active duty alerts in a simple and easy manner; and
            ``(3) for asserting in good faith a suspicion that the 
        consumer has been or is about to become a victim of fraud or 
        related crime, including identity theft, or has been or will be 
        harmed by the unauthorized disclosure of the financial or 
        personally identifiable information of the consumer, for a 
        consumer requesting a fraud alert.'';
            (6) in subsection (d), as so redesignated, by striking 
        paragraphs (1), (2), and (3) and inserting the following:
            ``(1) paragraphs (1)(A), (1)(C), and (2) of subsection (a), 
        in the case of a referral under subsection (a)(1)(B); and
            ``(2) subsection (b)(1)(A), in the case of a referral under 
        subsection (b)(1)(B).'';
            (7) in subsection (f), as so redesignated, by inserting 
        ``or has been or will be harmed by the unauthorized disclosure 
        of the financial or personally identifiable information of the 
        consumer,'' after ``identity theft,''; and
            (8) in subsection (g), as so redesignated--
                    (A) in paragraph (1)--
                            (i) in the paragraph heading, by striking 
                        ``initial'' and inserting ``fraud alerts'';
                            (ii) in subparagraph (A), by striking 
                        ``initial''; and
                            (iii) in subparagraph (B)(i), by striking 
                        ``an initial'' and inserting ``a''; and
                    (B) in paragraph (2)--
                            (i) in the paragraph heading, by striking 
                        ``extended'' and inserting ``fraud'';
                            (ii) in subparagraph (A), in the matter 
                        preceding clause (i), by striking ``extended'' 
                        and inserting ``fraud''; and
                            (iii) in subparagraph (B), by striking ``an 
                        extended'' and inserting ``a''.
    (b) Technical and Conforming Amendment.--Section 612(d) of the Fair 
Credit Reporting Act (15 U.S.C. 1681j(d)) is amended by striking 
``subsections (a)(2) and (b)(2) of section 605A, as applicable'' and 
inserting ``section 605A(a)(2)''.

Summary: Equifax Consumer Protection and Data Empowerment Act of 2018 This bill amends the Fair Credit Reporting Act to revise the consumer protection duties of consumer reporting agencies. Credit reporting agencies must provide a cost-free method for consumers to control the release of their information for certain purposes. The bill limits the purposes for which a consumer reporting agencies may provide a consumer's information to a third party. For example, consumer reporting agencies may not provide consumer information to a third party for a credit or insurance transaction not initiated by the consumer. The bill revises the requirements for fraud alerts provided by consumer reporting agencies, including by extending the length of all alerts to 10 years and expanding access to free reports.