Freedom from Equifax Exploitation Act

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Freedom from Equifax Exploitation 
Act''.

SEC. 2. DEFINITION OF CREDIT FREEZE.

    Section 603(q) of the Fair Credit Reporting Act (15 U.S.C. 
1681a(q)) is amended by adding at the end the following:
            ``(6) Credit freeze.--
                    ``(A) In general.--The term `credit freeze' means a 
                restriction placed at the request of a consumer or a 
                personal representative of the consumer, on the 
                consumer report of the consumer, that prohibits a 
                consumer reporting agency from releasing the consumer 
                report for a purpose relating to the extension of 
                credit without the express authorization of the 
                consumer.
                    ``(B) Exception.--A credit freeze shall not apply 
                to the use of a consumer report by any of the 
                following:
                            ``(i) A person, or the subsidiary, 
                        affiliate, agent, subcontractor, or assignee of 
                        the person, with whom the consumer has, or 
                        prior to assignment had, an account, contract, 
                        or debtor-creditor relationship for the 
                        purposes of reviewing the active account or 
                        collecting the financial obligation owed on the 
                        account, contract, or debt.
                            ``(ii) A person, or the subsidiary, 
                        affiliate, agent, subcontractor, or assignee of 
                        the person, to whom access has been granted 
                        pursuant to a request by the consumer described 
                        under section 605A(i)(1)(B), for purposes of 
                        facilitating the extension of credit or other 
                        permissible use.
                            ``(iii) Any person acting pursuant to a 
                        court order, warrant, or subpoena.
                            ``(iv) A Federal, State, or local 
                        government, or an agent or assignee thereof.
                            ``(v) Any person for the sole purpose of 
                        providing a credit monitoring or identity theft 
                        protection service to which the consumer has 
                        subscribed.
                            ``(vi) Any person for the purpose of 
                        providing a consumer with a copy of the 
                        consumer report or credit score of the consumer 
                        upon request by the consumer.
                            ``(vii) Any person or entity for insurance 
                        purposes, including use in setting or adjusting 
                        a rate, adjusting a claim, or underwriting.
                            ``(viii) Any person acting pursuant to an 
                        authorization from a consumer to use their 
                        consumer report for employment purposes.''.

SEC. 3. ENHANCEMENT OF FRAUD ALERT PROTECTIONS.

    Section 605A of the Fair Credit Reporting Act (15 U.S.C. 1681c-1) 
is amended--
            (1) in subsection (a)--
                    (A) in the subsection heading, by striking ``One-
                Call'' and inserting ``One-Year'';
                    (B) in paragraph (1)--
                            (i) in the paragraph heading, by striking 
                        ``Initial alerts'' and inserting ``In 
                        general'';
                            (ii) in the matter preceding subparagraph 
                        (A), by inserting ``or harmed by the 
                        unauthorized disclosure of the financial or 
                        personally identifiable information of the 
                        consumer,'' after ``identity theft,'';
                            (iii) in subparagraph (A)--
                                    (I) by striking ``90 days'' and 
                                inserting ``1 year''; and
                                    (II) by striking ``and'' at the 
                                end;
                            (iv) in subparagraph (B)--
                                    (I) by inserting ``1-year'' before 
                                ``fraud alert''; and
                                    (II) by striking the period at the 
                                end and inserting ``; and''; and
                            (v) by adding at the end the following:
                    ``(C) upon the expiration of the 1-year period 
                described in subparagraph (A) or a subsequent 1-year 
                period, and in response to a direct request by the 
                consumer or such representative, continue the fraud 
                alert for an additional period of 1 year if the 
                information asserted in this paragraph remains 
                applicable.''; and
                    (C) in paragraph (2)--
                            (i) in the matter preceding subparagraph 
                        (A), by inserting ``1-year'' before ``fraud 
                        alert''; and
                            (ii) in subparagraph (B), by striking ``any 
                        request described in subparagraph (A)'' and 
                        inserting ``the consumer reporting agency 
                        includes the 1-year fraud alert in the file of 
                        the consumer'';
            (2) in subsection (b)--
                    (A) in the subsection heading, by striking 
                ``Extended'' and inserting ``Seven-Year'';
                    (B) in paragraph (1)--
                            (i) in subparagraph (B)--
                                    (I) by striking ``5-year period 
                                beginning on the date of such request'' 
                                and inserting ``the 7-year period 
                                described in subparagraph (A)''; and
                                    (II) by striking ``and'' at the 
                                end;
                            (ii) in subparagraph (C)--
                                    (I) by striking ``extended'' and 
                                inserting ``7-year''; and
                                    (II) by striking the period at the 
                                end and inserting ``; and''; and
                            (iii) by adding at the end the following:
                    ``(D) upon the expiration of the 7-year period 
                described in subparagraph (A) or a subsequent 7-year 
                period, and in response to a direct request by the 
                consumer or such representative, continue the fraud 
                alert for an additional period of 7 years if the 
                consumer or such representative submits an updated 
                identity theft report.''; and
                    (C) in paragraph (2), by amending subparagraph (A) 
                to read as follows:
                    ``(A) disclose to the consumer that the consumer 
                may request a free copy of the file of the consumer 
                pursuant to section 612(d) during each 12-month period 
                beginning on the date on which the 7-year fraud alert 
                was included in the file and ending on the date of the 
                last day that the 7-year fraud alert applies to the 
                file of the consumer; and'';
            (3) in subsection (c)--
                    (A) by redesignating paragraphs (1), (2), and (3), 
                as subparagraphs (A), (B), and (C), respectively, and 
                adjusting the margins accordingly;
                    (B) in the matter preceding subparagraph (A), as so 
                redesignated, by striking ``Upon the direct request'' 
                and inserting the following:
            ``(1) In general.--Upon the direct request''; and
                    (C) by adding at the end the following:
            ``(2) Access to free reports.--If a consumer reporting 
        agency includes an active duty alert in the file of an active 
        duty military consumer, the consumer reporting agency shall--
                    ``(A) disclose to the active duty military consumer 
                that the active duty military consumer may request a 
                free copy of the file of the active duty military 
                consumer pursuant to section 612(d), during each 12-
                month period beginning on the date on which the 
                activity duty military alert is requested and ending on 
                the date of the last day that the active duty alert 
                applies to the file of the active duty military 
                consumer; and
                    ``(B) not later than 3 business days after the date 
                on which the active duty military consumer makes a 
                request described in subparagraph (A), provide to the 
                active duty military consumer all disclosures required 
                to be made under section 609, without charge to the 
                active duty military consumer.'';
            (4) by amending subsection (d) to read as follows:
    ``(d) Procedures.--Each consumer reporting agency described in 
section 603(p) shall establish and make available to the public on the 
Internet website of the consumer reporting agency policies and 
procedures to comply with this section, including policies and 
procedures--
            ``(1) that inform consumers of the availability of 1-year 
        fraud alerts, 7-year fraud alerts, active duty alerts, and 
        credit freezes, as applicable;
            ``(2) that allow consumers to request 1-year fraud alerts, 
        7-year fraud alerts, and active duty alerts, as applicable, and 
        to place, temporarily lift, or fully remove a credit freeze in 
        a simple and easy manner; and
            ``(3) for asserting in good faith a suspicion that the 
        consumer has been or is about to become a victim of identity 
        theft, fraud, or a related crime, or harmed by the unauthorized 
        disclosure of the financial or personally identifiable 
        information of the consumer, for a consumer seeking a 1-year 
        fraud alert or credit freeze.'';
            (5) in subsection (e), in the matter preceding paragraph 
        (1), by inserting ``1-year or 7-year'' before ``fraud alert'';
            (6) in subsection (f), by striking ``or active duty alert'' 
        and inserting ``active duty alert, or credit freeze, as 
        applicable,'';
            (7) in subsection (g)--
                    (A) by inserting ``or has been harmed by the 
                unauthorized disclosure of the financial or personally 
                identifiable information of the consumer,'' after 
                ``identity theft,''; and
                    (B) by inserting ``or credit freezes'' after 
                ``request alerts''; and
            (8) in subsection (h)--
                    (A) in paragraph (1)--
                            (i) in the paragraph heading, by striking 
                        ``initial'' and inserting ``1-year'';
                            (ii) in subparagraph (A), by striking 
                        ``initial'' and inserting ``1-year''; and
                            (iii) in subparagraph (B)(i), by striking 
                        ``an initial'' and inserting ``a 1-year''; and
                    (B) in paragraph (2)--
                            (i) in the paragraph heading, by striking 
                        ``extended'' and inserting ``7-year'';
                            (ii) in subparagraph (A), in the matter 
                        preceding clause (i), by striking ``extended'' 
                        and inserting ``7-year''; and
                            (iii) in subparagraph (B), by striking ``an 
                        extended'' and inserting ``a 7-year''.

SEC. 4. PROVIDING FREE ACCESS TO CREDIT FREEZES.

    Section 605A of the Fair Credit Reporting Act (15 U.S.C. 1681c-1) 
is amended by adding at the end the following:
    ``(i) Credit Freezes.--
            ``(1) In general.--Upon the direct request of a consumer, 
        or an individual acting on behalf of or as a personal 
        representative of a consumer, a consumer reporting agency that 
        maintains a file on the consumer and has received appropriate 
        proof of the identity of the requester (as described in section 
        1022.123 of title 12, Code of Federal Regulations, or any 
        successor thereto) shall--
                    ``(A)(i) not later than 1 business day after 
                receiving the request sent by postal mail, toll-free 
                telephone, or secure electronic means as established by 
                the agency, place a credit freeze on the file of the 
                consumer;
                    ``(ii) not later than 5 business days after placing 
                a credit freeze described in clause (i), provide the 
                consumer with written confirmation of the credit freeze 
                and a unique personal identification number or password 
                (other than the social security number of the consumer) 
                for use to authorize the release of the file of the 
                consumer for a specific period of time; and
                    ``(iii) disclose all relevant information to the 
                consumer relating to the procedures for temporarily 
                lifting and fully removing a credit freeze, including a 
                statement about the maximum amount of time given to an 
                agency to conduct those actions;
                    ``(B) if the consumer provides a correct personal 
                identification number or password, temporarily lift an 
                existing credit freeze from the file of the consumer 
                for a period of time specified by the consumer for a 
                specific user or category of users, as determined by 
                the consumer--
                            ``(i) not later than 1 business day after 
                        receiving the request by postal mail; or
                            ``(ii) not later than 15 minutes after 
                        receiving the request by toll-free telephone 
                        number or secure electronic means established 
                        by the agency, if the request is received 
                        during regular business hours, except if the 
                        ability of the consumer reporting agency to 
                        temporarily lift the credit freeze is prevented 
                        by--
                                    ``(I) an act of God, including 
                                earthquakes, hurricanes, storms, or 
                                similar natural disaster or phenomenon, 
                                or fire;
                                    ``(II) unauthorized or illegal acts 
                                by a third party including terrorism, 
                                sabotage, riot, vandalism, labor 
                                strikes or disputes disrupting 
                                operations, or a similar occurrence;
                                    ``(III) an operational 
                                interruption, including electrical 
                                failure, unanticipated delay in 
                                equipment or replacement part delivery, 
                                computer hardware or software failures 
                                inhibiting response time, or a similar 
                                disruption;
                                    ``(IV) governmental action, 
                                including emergency orders or 
                                regulations, judicial or law 
                                enforcement action, or a similar 
                                directive;
                                    ``(V) regularly scheduled 
                                maintenance or updates to the systems 
                                of the consumer reporting agency 
                                occurring outside of normal business 
                                hours; or
                                    ``(VI) commercially reasonable 
                                maintenance of, or repair to, the 
                                systems of the consumer reporting 
                                agency that is unexpected or 
                                unscheduled; or
                    ``(C) if the consumer provides a correct personal 
                identification number or password, fully remove an 
                existing credit freeze from the file of the consumer 
                not later than 21 business days after receiving the 
                request by postal mail, toll-free telephone, or secure 
                electronic means established by the consumer reporting 
                agency.
            ``(2) No fee.--A consumer reporting agency may not charge a 
        consumer a fee to place, temporarily lift, or fully remove a 
        credit freeze.
            ``(3) Exclusion from third-party lists.--During the period 
        beginning on the date on which a consumer or a representative 
        of the consumer requests to place a credit freeze and ending 
        the date on which the consumer or representative requests to 
        fully remove a credit freeze, a consumer reporting agency shall 
        exclude the consumer from any list of consumers prepared by the 
        consumer reporting agency and provided to any third party to 
        offer credit or insurance to the consumer as part of a 
        transaction that was not initiated by the consumer, unless the 
        consumer or that representative requests that the exclusion be 
        rescinded before end of the period.''.

SEC. 5. ADDITIONAL FREE CONSUMER REPORT.

    Section 612 of the Fair Credit Reporting Act (15 U.S.C. 1681j) is 
amended--
            (1) in subsection (f)(1), in the matter preceding 
        subparagraph (A), by inserting ``or subsection (h)'' after 
        ``through (d)''; and
            (2) by adding at the end the following:
    ``(h) Free Disclosures in Connection With Credit Freeze.--In 
addition to the free annual disclosure required under subsection 
(a)(1)(A), each consumer reporting agency that maintains a file on a 
consumer who requests a credit freeze under section 605A(i) shall make 
all disclosures pursuant to section 609 once during any 12-month period 
without charge to the consumer if the consumer makes a request under 
section 609.''.

SEC. 6. REFUNDS.

    (a) Definitions.--In this section, the terms ``consumer'', 
``consumer reporting agency'', and ``credit freeze'' have the meanings 
given those terms in section 603 of the Fair Credit Reporting Act (15 
U.S.C. 1681a), as amended by section 2.
    (b) Refunds.--With respect to any consumer who requested a credit 
freeze from a consumer reporting agency during the period beginning on 
September 7, 2017, and ending on the day before the date of enactment 
of this Act, the consumer reporting agency--
            (1) shall issue a refund to the consumer for any fees 
        charged to the consumer relating to the request for a credit 
        freeze; and
            (2) may not impose a fee on the consumer to temporarily 
        lift or fully remove the credit freeze.

Summary: Freedom from Equifax Exploitation Act This bill amends the Fair Credit Reporting Act to revise fraud alert provisions required of consumer reporting agencies. A fraud alert must be placed in a consumer's file upon request if the consumer suspects harm from an unauthorized disclosure. The time period for fraud alerts is extended from 90 days to 1 year. The bill also revises provisions relating to 7-year renewable fraud alerts in cases of identity theft.  The bill establishes a credit freeze process. A consumer reporting agency must place a free credit freeze on the consumer's file upon a consumer's request, prohibiting a consumer reporting agency from releasing any credit information without the consumer's permission. Consumer reporting agencies must provide procedures for temporarily and permanently lifting the freeze at no charge to the consumer. Consumers are allowed a free credit report when requesting a credit freeze. While the file is subject to a freeze, a consumer reporting agency is prohibited from including the consumer in lists provided to third parties for credit or insurance offers. A consumer reporting agency must provide on the Internet policies and procedures for consumers to: (1) place, temporarily lift, or fully remove a credit freeze; and (2) make required statements for fraud alerts or credit freezes.  The bill requires consumer reporting agencies to issue a refund of fees to any consumer who requested a credit freeze beginning September 7, 2017, through the day before enactment of this bill.