II 

110TH CONGRESS 

1ST SESSION S. 806 

To give consumers tools to protect themselves from ID theft by allowing 

them to prevent unauthorized access to their credit reports, and for 

other purposes. 

IN THE SENATE OF THE UNITED STATES 

MARCH 7, 2007 

Mr. PRYOR introduced the following bill; which was read twice and referred 

to the Committee on Banking, Housing, and Urban Affairs 

A BILL 

To give consumers tools to protect themselves from ID theft 

by allowing them to prevent unauthorized access to their 

credit reports, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Consumer ID Protec5 tion and Security Act’’. 

6 SEC. 2. SECURITY FREEZE. 

7 (a) IN GENERAL.— 

8 (1) EMPLACEMENT.—A consumer may place a 

9 security freeze on the consumer’s credit report by 


jcorcoran on PROD1PC65 with BILLS
2 

•S 806 IS 

1 making a request to a consumer credit reporting 

2 agency in writing, by telephone, or through a secure 

3 electronic connection if such a connection is made 

4 available by the consumer credit reporting agency. 

5 (2) CONSUMER DISCLOSURE.—If a consumer 

6 requests a security freeze, the consumer credit re7 porting agency shall disclose to the consumer the 

8 process of placing and removing the security freeze. 

9 A consumer credit reporting agency may not imply 

10 or inform a consumer that the placement or pres11 ence of a security freeze on the consumer’s credit re12 port may negatively affect the consumer’s credit 

13 score. 

14 (b) EFFECT OF SECURITY FREEZE.— 

15 (1) RELEASE OF INFORMATION BLOCKED.—If a 

16 security freeze is in place on a consumer’s credit re17 port, a consumer credit reporting agency may not 

18 release the credit report for consumer credit pur19 poses to a third party without prior express author20 ization from the consumer. 

21 (2) INFORMATION PROVIDEDTO THIRDPAR22 TIES.—Paragraph (1) does not prevent a consumer 

23 credit reporting agency from advising a third party 

24 that a security freeze is in effect with respect to the 

25 consumer’s credit report. If a third party, in connecVerDate Aug 31 2005 23:12 Mar 10, 2007 Jkt 059196 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S806.IS S806

jcorcoran on PROD1PC65 with BILLS
3 

•S 806 IS 

1 tion with a request for information in any cir2 cumstance under which a consumer reporting agency 

3 may furnish a consumer report under section 604(a) 

4 of the Fair Credit Reporting Act (15 U.S.C. 1681b), 

5 requests access to a consumer credit report on which 

6 a security freeze is in place, the third party may 

7 treat any application associated with the request as 

8 incomplete. 

9 (3) CONSUMER CREDIT SCORE NOT AF10 FECTED.—The placement of a security freeze on a 

11 credit report may not be taken into account for any 

12 purpose in determining the credit score of the con13 sumer to whom the account relates. 

14 (c) REMOVAL; TEMPORARY SUSPENSION.— 

15 (1) IN GENERAL.—Except as provided in para16 graph (2)(B), a security freeze shall remain in place 

17 until the consumer requests that the security freeze 

18 be removed. A consumer may remove a security 

19 freeze on the consumer’s credit report by making a 

20 request to a consumer credit reporting agency in 

21 writing, by telephone, or through a secure electronic 

22 connection made available by the consumer credit re23 porting agency. 


jcorcoran on PROD1PC65 with BILLS
4 

•S 806 IS 

1 (2) CONDITIONS.—A consumer credit reporting 

2 agency may remove a security freeze placed on a 

3 consumer’s credit report only— 

4 (A) upon the consumer’s request, pursuant 

5 to paragraph (1); or 

6 (B) if the agency determines that the con7 sumer’s credit report was frozen due to a mate8 rial misrepresentation of fact by the consumer. 

9 (3) NOTIFICATION TO CONSUMER.—If a con10 sumer credit reporting agency intends to remove a 

11 freeze upon a consumer’s credit report pursuant to 

12 paragraph (2)(B), the consumer credit reporting 

13 agency shall notify the consumer in writing prior to 

14 removing the freeze on the consumer’s credit report. 

15 (4) TEMPORARY SUSPENSION.—A consumer 

16 may have a security freeze on the consumer’s credit 

17 report temporarily suspended by making a request 

18 to a consumer credit reporting agency in writing or 

19 by telephone and— 

20 (A) specifying beginning and ending dates 

21 for the period during which the security freeze 

22 is not to apply to that consumer’s credit report; 

23 or 


jcorcoran on PROD1PC65 with BILLS
5 

•S 806 IS 

1 (B) specifying a specific third party to 

2 which access to the credit report may be grant3 ed notwithstanding the freeze. 

4 (d) RESPONSE TIMES; NOTIFICATION OF OTHER EN5 TITIES.— 

6 (1) IN GENERAL.—A consumer credit reporting 

7 agency shall— 

8 (A) place a security freeze on a consumer’s 

9 credit report under subsection (a) no later than 

10 3 business days after receiving a request from 

11 the consumer under subsection (a)(1); 

12 (B) remove a security freeze within 3 busi13 ness days after receiving a request for removal 

14 from the consumer under subsection (c); and 

15 (C) temporarily suspend a security freeze 

16 within 1 business day after receiving a request 

17 under subsection (c)(4). 

18 (2) NOTIFICATION OF OTHER COVEREDENTI19 TIES.—If the consumer requests in writing, by tele20 phone, or by secure electronic connection that other 

21 covered entities be notified of the request, the con22 sumer credit reporting agency shall notify all other 

23 consumer credit reporting agencies described in sec24 tion 603(p)(1) of the Fair Credit Reporting Act (15 

25 U.S.C. 1681a(p)(1)) of the request within 3 days 


jcorcoran on PROD1PC65 with BILLS
6 

•S 806 IS 

1 after placing or removing a security freeze on the 

2 consumer’s credit report under subsection (a) or 

3 (c)(2)(A), or within 1 day after temporarily sus4 pending a security freeze on the consumer’s credit 

5 report under subsection (c)(4). 

6 (3) IMPLEMENTATION BY OTHER COVEREDEN7 TITIES.—A consumer credit reporting agency that is 

8 notified of a request under paragraph (2) to place, 

9 remove, or temporarily suspend a security freeze on 

10 a consumer’s credit report shall— 

11 (A) request proper identification from the 

12 consumer, in accordance with subsection (f), 

13 within 3 business days after receiving the notifi14 cation; and 

15 (B) place, remove, or temporarily suspend 

16 the security freeze on that credit report within 

17 3 business days after receiving proper identi18 fication. 

19 (e) CONFIRMATION.—Except as provided in sub20 section (c)(3), whenever a consumer credit reporting agen21 cy places, removes, or temporarily suspends a security 

22 freeze on a consumer’s credit report at the request of that 

23 consumer under subsection (a) or (c), respectively, it shall 

24 send a written confirmation thereof to the consumer with25 in 10 business days after placing, removing, or temporarily 


jcorcoran on PROD1PC65 with BILLS
7 

•S 806 IS 

1 suspending the security freeze on the credit report. This 

2 subsection does not apply to the placement, removal, or 

3 temporary suspension of a security freeze by a consumer 

4 credit reporting agency because of a notification received 

5 under subsection (d)(2). 

6 (f) ID REQUIRED.—A consumer credit reporting 

7 agency may not place, remove, or temporarily suspend a 

8 security freeze on a consumer’s credit report at the con9 sumer’s request unless the consumer provides proper iden10 tification (within the meaning of section 610(a)(1) of the 

11 Fair Credit Reporting Act (15 U.S.C. 1681h) and the reg12 ulations thereunder. 

13 (g) EXCEPTIONS.—This section does not apply to the 

14 use of a consumer credit report by any of the following: 

15 (1) A person or entity, or a subsidiary, affiliate, 

16 or agent of that person or entity, or an assignee of 

17 a financial obligation owing by the consumer to that 

18 person or entity, or a prospective assignee of a fi19 nancial obligation owing by the consumer to that 

20 person or entity in conjunction with the proposed 

21 purchase of the financial obligation, with which the 

22 consumer has or had prior to assignment an account 

23 or contract, including a demand deposit account, or 

24 to whom the consumer issued a negotiable instru25 ment, for the purposes of reviewing the account or 


jcorcoran on PROD1PC65 with BILLS
8 

•S 806 IS 

1 collecting the financial obligation owing for the ac2 count, contract, or negotiable instrument. 

3 (2) Any Federal, State or local agency, law en4 forcement agency, trial court, or private collection 

5 agency acting pursuant to a court order, warrant, 

6 subpoena, or other compulsory process. 

7 (3) A child support agency or its agents or as8 signs acting pursuant to subtitle D of title IV of the 

9 Social Security Act (42 U.S.C. et seq.) or similar 

10 State law. 

11 (4) The Department of Health and Human 

12 Services, a similar State agency, or the agents or as13 signs of the Federal or State agency acting to inves14 tigate medicare or medicaid fraud. 

15 (5) The Internal Revenue Service or a State or 

16 municipal taxing authority, or a State department of 

17 motor vehicles, or any of the agents or assigns of 

18 these Federal, State, or municipal agencies acting to 

19 investigate or collect delinquent taxes or unpaid 

20 court orders or to fulfill any of their other statutory 

21 responsibilities. 

22 (6) Any person or entity administering a credit 

23 file monitoring subscription to which the consumer 

24 has subscribed. 


jcorcoran on PROD1PC65 with BILLS
9 

•S 806 IS 

1 (7) Any person or entity for the purpose of pro2 viding a consumer with a copy of the consumer’s 

3 credit report or credit score upon the consumer’s re4 quest. 

5 (8) Except when access is restricted to a spe6 cific third party during a temporary suspension of a 

7 security freeze under subsection (c)(4)(B), any per8 son who seeks access during the time period that a 

9 security freeze is temporarily suspended for the pur10 pose of facilitating the extension of credit or another 

11 permissable use. 

12 (h) FEES.— 

13 (1) IN GENERAL.—Except as provided in para14 graph (2), a consumer credit reporting agency may 

15 charge a fee, not in excess of $15, for placing, re16 moving, or temporarily suspending a security freeze 

17 on a consumer’s credit report. 

18 (2) FEES PROHIBITED.— 

19 (A) ID THEFT VICTIMS ANDNOTIFIED

20 CONSUMERS.—A consumer credit reporting 

21 agency may not charge a fee for placing, remov22 ing, or temporarily suspending a security freeze 

23 on a consumer’s credit report if— 


jcorcoran on PROD1PC65 with BILLS
10 

•S 806 IS 

1 (i) the consumer is a victim of identity 

2 theft or has received a notice under section 

3 3(c) of this Act; 

4 (ii) the consumer requests the security 

5 freeze in writing; 

6 (iii) the consumer has filed a police 

7 report with respect to the theft, or an iden8 tity theft report (as defined in section 

9 603(q)(4) of the Fair Credit Reporting Act 

10 (15 U.S.C. 1681a(q)(4))), within 90 days 

11 after the theft occurred or was discovered 

12 by the consumer; and 

13 (iv) the consumer provides a copy of 

14 the report to the credit reporting agency. 

15 (B) CATEGORICAL CLASSES.—A consumer 

16 credit reporting agency may not charge a fee 

17 for placing, removing, or temporarily sus18 pending a security freeze on a consumer’s credit 

19 report if the consumer requesting it— 

20 (i) has attained the age of 65 years; 

21 (ii) is a on active duty or in the ready 

22 reserve component of an armed force of 

23 the United States; or 

24 (iii) is the spouse of an individual de25 scribed in clause (ii). 


jcorcoran on PROD1PC65 with BILLS
11 

•S 806 IS 

1 (i) LIMITATION ON INFORMATION CHANGES IN FRO2 ZEN REPORTS.— 

3 (1) IN GENERAL.—If a security freeze is in 

4 place on a consumer’s credit report, a consumer 

5 credit reporting agency may not change any of the 

6 following official information in that credit report 

7 without sending a written confirmation of the 

8 change to the consumer within 30 days after the 

9 change is made: 

10 (A) Name. 

11 (B) Date of birth. 

12 (C) Social Security number. 

13 (D) Address. 

14 (2) CONFIRMATION.—Paragraph (1) does not 

15 require written confirmation for technical modifica16 tions of a consumer’s official information, including 

17 name and street abbreviations, complete spellings, or 

18 transposition of numbers or letters. In the case of an 

19 address change, the written confirmation shall be 

20 sent to both the new address and to the former ad21 dress. 

22 (j) CERTAIN ENTITY EXEMPTIONS.— 

23 (1) RESELLERS ANDOTHER AGENCIES.—The 

24 provisions of this Act do not apply to a consumer 

25 credit reporting agency that acts only as a reseller 


jcorcoran on PROD1PC65 with BILLS
12 

•S 806 IS 

1 of credit information by assembling and merging in2 formation contained in the data base of another con3 sumer credit reporting agency or multiple consumer 

4 credit reporting agencies, and does not maintain a 

5 permanent data base of credit information from 

6 which new consumer credit reports are produced. 

7 (2) OTHER EXEMPTEDENTITIES.—The fol8 lowing entities are not required to place a security 

9 freeze in a credit report: 

10 (A) A check services or fraud prevention 

11 services company, which issues reports on inci12 dents of fraud or authorizations for the purpose 

13 of approving or processing negotiable instru14 ments, electronic funds transfers, or similar 

15 methods of payments. 

16 (B) A deposit account information service 

17 company, which issues reports regarding ac18 count closures due to fraud, substantial over19 drafts, ATM abuse, or similar negative informa20 tion regarding a consumer, to inquiring banks 

21 or other financial institutions for use only in re22 viewing a consumer request for a deposit ac23 count at the inquiring bank or financial institu24 tion. 


jcorcoran on PROD1PC65 with BILLS
13 

•S 806 IS 

1 SEC. 3. ENFORCEMENT. 

2 (a) ENFORCEMENT BY COMMISSION.—Except as pro3 vided in subsection (c), this Act shall be enforced by the 

4 Commission. 

5 (b) VIOLATION IS UNFAIR OR DECEPTIVE ACT OR

6 PRACTICE.—The violation of any provision of this Act 

7 shall be treated as an unfair or deceptive act or practice 

8 proscribed under a rule issued under section 18(a)(1)(B) 

9 of the Federal Trade Commission Act (15 U.S.C. 

10 57a(a)(1)(B)). 

11 (c) ENFORCEMENT BY CERTAIN OTHER AGEN12 CIES.—Compliance with this Act shall be enforced 

13 under— 

14 (1) section 8 of the Federal Deposit Insurance 

15 Act (12 U.S.C. 1818), in the case of— 

16 (A) national banks, and Federal branches 

17 and Federal agencies of foreign banks, by the 

18 Office of the Comptroller of the Currency; 

19 (B) member banks of the Federal Reserve 

20 System (other than national banks), branches 

21 and agencies of foreign banks (other than Fed22 eral branches, Federal agencies, and insured 

23 State branches of foreign banks), commercial 

24 lending companies owned or controlled by for25 eign banks, and organizations operating under 


jcorcoran on PROD1PC65 with BILLS
14 

•S 806 IS 

1 section 25 or 25A of the Federal Reserve Act 

2 (12 U.S.C. 601 and 611), by the Board; and 

3 (C) banks insured by the Federal Deposit 

4 Insurance Corporation (other than members of 

5 the Federal Reserve System) and insured State 

6 branches of foreign banks, by the Board of Di7 rectors of the Federal Deposit Insurance Cor8 poration; 

9 (2) section 8 of the Federal Deposit Insurance 

10 Act (12 U.S.C. 1818), by the Director of the Office 

11 of Thrift Supervision, in the case of a savings asso12 ciation the deposits of which are insured by the Fed13 eral Deposit Insurance Corporation; 

14 (3) the Federal Credit Union Act (12 U.S.C. 

15 1751 et seq.) by the National Credit Union Adminis16 tration Board with respect to any Federal credit 

17 union; and 

18 (4) the Securities and Exchange Act of 1934 

19 (15 U.S.C. 78a et seq.) by the Securities and Ex20 change Commission with respect to— 

21 (A) a broker or dealer subject to that Act; 

22 (B) an investment company subject to the 

23 Investment Company Act of 1940 (15 U.S.C. 

24 80a–1 et seq.); and 


jcorcoran on PROD1PC65 with BILLS
15 

•S 806 IS 

1 (C) an investment advisor subject to the 

2 Investment Advisers Act of 1940 (15 U.S.C. 

3 80b–1 et seq.). 

4 (d) EXERCISE OF CERTAIN POWERS.—For the pur5 pose of the exercise by any agency referred to in sub6 section (c) of its powers under any Act referred to in that 

7 subsection, a violation of this Act is deemed to be a viola8 tion of a requirement imposed under that Act. In addition 

9 to its powers under any provision of law specifically re10 ferred to in subsection (c), each of the agencies referred 

11 to in that subsection may exercise, for the purpose of en12 forcing compliance with any requirement imposed under 

13 this Act, any other authority conferred on it by law. 

14 SEC. 4. DEFINITIONS. 

15 In this Act: 

16 (1) COMMISSION.—The term ‘‘Commission’’ 

17 means the Federal Trade Commission. 

18 (2) CONSUMER CREDIT REPORTING AGENCY.— 

19 The term ‘‘consumer credit reporting agency’’ means 

20 any person which, for monetary fees, dues, or on a 

21 cooperative nonprofit basis, regularly engages in 

22 whole or in part in the practice of assembling or 

23 evaluating consumer credit information or other in24 formation on consumers for the purpose of fur25 nishing credit reports to third parties, and which 


jcorcoran on PROD1PC65 with BILLS
16 

•S 806 IS 

1 uses any means or facility of interstate commerce 

2 for the purpose of preparing or furnishing credit re3 ports. 

4 (3) CREDIT REPORT.—The term ‘‘credit report’’ 

5 means a consumer report, as defined in section 

6 603(d) of the Fair Credit Reporting Act (15 U.S.C. 

7 1681a(d)), that is used or expected to be used or 

8 collected in whole or in part for the purpose of serv9 ing as a factor in establishing a consumer’s eligi10 bility for credit for personal, family or household 

11 purposes. 

12 (4) IDENTITY THEFT.—The term ‘‘identity 

13 theft’’ has the meaning given that term by section 

14 603(q)(3) of the Fair Credit Reporting Act (15 

15 U.S.C. 1681a(q)(3)). 

16 (5) REVIEWING THE ACCOUNT.—The term ‘‘re17 viewing the account’’ includes activities related to 

18 account maintenance, monitoring, credit line in19 creases, and account upgrades and enhancements. 

20 (6) SECURITY FREEZE.—The term ‘‘security 

21 freeze’’ means a notice that— 

22 (A) a consumer credit reporting agency 

23 places at the request of a consumer in the file 

24 on the consumer at the consumer credit report25 ing agency; and 


jcorcoran on PROD1PC65 with BILLS
17 

•S 806 IS 

1 (B) prohibits the agency from releasing 

2 consumer credit report information on the con3 sumer for consumer credit purposes without the 

4 express authorization of the consumer, except 

5 as otherwise provided in this Act. 

6 (7) SENSITIVE PERSONAL INFORMATION.— 

7 (A) IN GENERAL.—Except as provided in 

8 subparagraphs (B) and (C), the term ‘‘sensitive 

9 personal information’’ means an individual’s 

10 name, address, or telephone number combined 

11 with 1 or more of the following data elements 

12 related to that individual: 

13 (i) Social security number, taxpayer 

14 identification number, or an employer iden15 tification number that is the same as or is 

16 derived from the social security number of 

17 that individual. 

18 (ii) Financial account number, or 

19 credit card or debit card number of such 

20 individual, combined with any required se21 curity code, access code, or password that 

22 would permit access to such individual’s 

23 account. 


jcorcoran on PROD1PC65 with BILLS
18 

•S 806 IS 

1 (iii) State driver’s license identifica2 tion number or State resident identifica3 tion number. 

4 (B) FTC MODIFICATIONS.—The Commis5 sion may, through a rulemaking proceeding in 

6 accordance with section 553 of title 5, United 

7 States Code, designate other identifying infor8 mation that may be used to effectuate identity 

9 theft as sensitive personal information for pur10 poses of this Act and limit or exclude any infor11 mation described in subparagraph (A) from the 

12 definition of sensitive personal information for 

13 purposes of this Act. 

Æ 


jcorcoran on PROD1PC65 with BILLS