II 115th CONGRESS 2d Session S. 2375 IN THE SENATE OF THE UNITED STATES February 5, 2018 Mr. Brown introduced the following bill; which was read twice and referred to the Committee on Banking, Housing, and Urban Affairs A BILL To amend the Fair Credit Reporting Act to allow consumers to prohibit certain consumer reporting agencies from releasing any information in the files of those consumers, and for other purposes.

1. Short title This Act may be cited as the Equifax Consumer Protection and Data Empowerment Act of 2018 . 2. Credit locks (a) In general The Fair Credit Reporting Act ( 15 U.S.C. 1681 et seq.) is amended by inserting after section 605B ( 15 U.S.C. 1681c–2 ) the following: 605C. Protection of credit information of consumers (a) Secure, convenient, accessible, and cost-Free file locks for consumers (1) In general Subject to paragraph (2), each consumer reporting agency described in section 603(p) shall provide to any consumer a secure, convenient, accessible, and cost-free method that, with the express authorization of the consumer, allows that consumer reporting agency to release, or prevents that consumer reporting agency from releasing, any information in the file of the consumer for the purpose of— (A) the marketing or extension of credit or insurance; or (B) opening any financial account. (2) Prohibitions With respect to the method described in paragraph (1)— (A) the method may not be used by the consumer reporting agency that provides the method, or by any other person, to collect any information on a consumer that is not necessary for the purposes of preventing the release of information described in that paragraph; (B) no information collected under the method may be used for any purpose other than a purpose described in subparagraph (A); (C) in offering the method, a credit reporting agency described in section 603(p) may not require a consumer to— (i) waive any rights of the consumer; or (ii) indemnify the credit reporting agency with respect to any liabilities that arise from offering the method; and (D) the method may not be used by any person to market or advertise any product or service. (3) Release of information Nothing in this subsection shall affect the ability of a person with whom a consumer has an account, contract, or debtor-creditor relationship to obtain information regarding the consumer for the purposes of reviewing the account or collecting on the account. (b) Regulations Not later than 18 months after the date of enactment of this section, the Bureau shall prescribe regulations carrying out this section. . (b) Table of contents amendment The table of contents for the Fair Credit Reporting Act ( 15 U.S.C. 1681 et seq.) is amended by inserting after the item relating to section 605B the following: 605C. Protection of credit information of consumers. . 3. Permissible purposes of credit reports; disclosure to consumers (a) In general The Fair Credit Reporting Act ( 15 U.S.C. 1681 et seq.) is amended— (1) in section 604 ( 15 U.S.C. 1681b )— (A) in subsection (a)— (i) in the matter preceding paragraph (1)— (I) by striking Subject to subsection (c), any and inserting Any ; and (II) by striking a consumer report and inserting information from the file of a consumer ; (ii) in paragraph (3)— (I) by striking subparagraphs (A) and (C); (II) by redesignating subparagraph (B) as subparagraph (A); (III) by redesignating subparagraphs (D) through (G) as subparagraphs (B) through (E), respectively; and (IV) in subparagraph (D), as so redesignated, by striking information— and all that follows through the period at the end of clause (ii) and inserting the following: information to review an account to determine whether the consumer continues to meet the terms of the account; or ; and (iii) by adding at the end the following: (7) Pursuant to the express authorization of a consumer, subject to the method provided under section 605C(a) in the case of a consumer reporting agency described in section 603(p). ; (B) by striking subsection (c); and (C) by redesignating subsections (d) through (g) as subsections (c) through (f), respectively; (2) in section 609(a)(1) ( 15 U.S.C. 1681g(a)(1) ), by striking request, except that— and all that follows through the period at the end of subparagraph (B) and inserting the following: request, without regard to whether the information is held by a parent, subsidiary, or affiliate of the consumer reporting agency. ; (3) in section 612(a)(1)(A) ( 15 U.S.C. 1681j(a)(1)(A) ), by striking once during any 12-month period ; and (4) in section 615 ( 15 U.S.C. 1681m )— (A) by striking subsection (d); and (B) by redesignating subsections (e) through (h) as subsections (d) through (g), respectively. (b) Regulations Not later than 18 months after the date of enactment of this Act, the Bureau of Consumer Financial Protection shall issue regulations carrying out section 609(a)(1) of the Fair Credit Reporting Act ( 15 U.S.C. 1681g(a)(1) ), as amended by subsection (a)(2). (c) Technical and conforming amendments (1) Consumer Financial Protection Act of 2010 Section 1002(12)(F) of the Consumer Financial Protection Act of 2010 ( 12 U.S.C. 5481(12)(F) ) is amended— (A) by striking 615(e) and inserting 615(d) ; and (B) by striking 1681m(e) and inserting 1681m(d) . (2) Fair Credit Reporting Act The Fair Credit Reporting Act ( 15 U.S.C. 1681 et seq.) is amended— (A) in section 603 ( 15 U.S.C. 1681a )— (i) in subsection (d)(3), in the matter preceding subparagraph (A), by striking section 604(g)(3) and inserting section 604(f)(3) ; and (ii) in subsection (k)(1)(B)— (I) in clause (iii), by striking section 604(a)(3)(D) and inserting section 604(a)(3)(B) ; and (II) in clause (iv)(I), by striking section 604(a)(3)(F)(ii) and inserting section 604(a)(3)(D) ; (B) in section 621 ( 15 U.S.C. 1681s )— (i) in subsection (b)(1), in the matter preceding subparagraph (A), by striking persons who furnish information to such agencies, and users of information that are subject to section 615(d) and inserting and persons who furnish information to such agencies ; and (ii) in subsection (e)(1), in the first sentence, by striking 615(e) and inserting 615(d) ; (C) in section 623(c)(3) ( 15 U.S.C. 1681s–2(c)(3) ), by striking subsection (e) and inserting subsection (d) ; and (D) in section 625(b) ( 15 U.S.C. 1681t(b) )— (i) in paragraph (1)— (I) in subparagraph (A), by striking subsection (c) or (e) of section 604 and inserting section 604(d) ; (II) by striking subparagraph (D); (III) by redesignating subparagraphs (E) through (I) as subparagraphs (D) through (H), respectively; and (IV) in subparagraph (H), as so redesignated, by striking section 615(h) and inserting section 615(g) ; and (ii) in paragraph (5)(F), by striking (e), (f), and (g) and inserting (d), (e), and (f) . 4. Enhancement of fraud alert protections (a) In general Section 605A of the Fair Credit Reporting Act ( 15 U.S.C. 1681c–1 ) is amended— (1) by striking subsection (a); (2) by redesignating subsections (b) through (h) as subsections (a) through (g), respectively; (3) in subsection (a), as so redesignated— (A) in the subsection heading, by striking Extended and inserting Fraud ; and (B) in paragraph (1)— (i) in the matter preceding subparagraph (A), by striking submits an identity theft report and inserting asserts in good faith a suspicion that the consumer has been or is about to become a victim of fraud or related crime, including identity theft, or has been or will be harmed by the unauthorized disclosure of the financial or personally identifiable information of the consumer, ; (ii) in subparagraph (A), by striking 7-year and inserting 10-year ; (iii) by striking subparagraph (B); (iv) by redesignating subparagraph (C) as subparagraph (B); (v) in subparagraph (B), as so redesignated— (I) by striking extended ; and (II) by striking the period at the end and inserting ; and ; and (vi) by adding at the end the following: (C) upon the expiration of the period described in subparagraph (A), or a subsequent 10-year period, and in response to a direct request by the consumer or such representative, continue the fraud alert for an additional period of 10 years if the consumer or such representative submits an identity theft report. ; (4) in subsection (b), as so redesignated— (A) by striking paragraph (2); (B) by redesignating paragraphs (1) and (3) as subparagraphs (A) and (B), respectively, and adjusting the margins accordingly; (C) in the matter preceding subparagraph (A), as so redesignated, by striking Upon the direct request and inserting the following: (1) In general Upon the direct request ; and (D) by adding at the end the following: (2) Access to free reports If a consumer reporting agency includes an active duty alert in the file of an active duty military consumer, the consumer reporting agency shall— (A) disclose to the active duty military consumer that the active duty military consumer may request a free copy of the file of the active duty military consumer under section 612(d) during each 1-year period beginning on the date on which the activity duty military alert is requested and ending on the date of the last day that the active duty alert applies to the file of the active duty military consumer; and (B) not later than 3 business days after the date on which the active duty military consumer makes a request described in subparagraph (A), provide to the active duty military consumer all disclosures required to be made under section 609, without charge to the active duty military consumer. ; (5) by amending subsection (c), as so redesignated, to read as follows: (c) Procedures Each consumer reporting agency described in section 603(p) shall establish and make available to the public on the Internet website of the consumer reporting agency policies and procedures to comply with this section, including policies and procedures— (1) that inform consumers of the availability of fraud alerts, active duty alerts, or the method provided under section 605C(a), as applicable; (2) that allow consumers to request fraud alerts and active duty alerts in a simple and easy manner; and (3) for asserting in good faith a suspicion that the consumer has been or is about to become a victim of fraud or related crime, including identity theft, or has been or will be harmed by the unauthorized disclosure of the financial or personally identifiable information of the consumer, for a consumer requesting a fraud alert. ; (6) in subsection (d), as so redesignated, by striking paragraphs (1), (2), and (3) and inserting the following: (1) paragraphs (1)(A), (1)(C), and (2) of subsection (a), in the case of a referral under subsection (a)(1)(B); and (2) subsection (b)(1)(A), in the case of a referral under subsection (b)(1)(B). ; (7) in subsection (f), as so redesignated, by inserting ‘‘or has been or will be harmed by the unauthorized disclosure of the financial or personally identifiable information of the consumer,’’ after identity theft, ; and (8) in subsection (g), as so redesignated— (A) in paragraph (1)— (i) in the paragraph heading, by striking initial and inserting fraud alerts ; (ii) in subparagraph (A), by striking initial ; and (iii) in subparagraph (B)(i), by striking an initial and inserting a ; and (B) in paragraph (2)— (i) in the paragraph heading, by striking extended and inserting fraud ; (ii) in subparagraph (A), in the matter preceding clause (i), by striking extended and inserting fraud ; and (iii) in subparagraph (B), by striking an extended and inserting a . (b) Technical and conforming amendment Section 612(d) of the Fair Credit Reporting Act ( 15 U.S.C. 1681j(d) ) is amended by striking subsections (a)(2) and (b)(2) of section 605A, as applicable and inserting section 605A(a)(2) .