II 115th CONGRESS 1st Session S. 1816 IN THE SENATE OF THE UNITED STATES September 14, 2017 Ms. Warren (for herself, Mr. Schatz , Mr. Menendez , Mr. Van Hollen , Mrs. Gillibrand , Mr. Blumenthal , Mr. Markey , Mr. Sanders , Mr. Wyden , Mr. Durbin , Mr. Merkley , and Mr. Franken ) introduced the following bill; which was read twice and referred to the Committee on Banking, Housing, and Urban Affairs A BILL To amend the Fair Credit Reporting Act to enhance fraud alert procedures and provide free access to credit freezes, and for other purposes.

1. Short title This Act may be cited as the Freedom from Equifax Exploitation Act . 2. Definition of credit freeze Section 603(q) of the Fair Credit Reporting Act ( 15 U.S.C. 1681a(q) ) is amended by adding at the end the following: (6) Credit freeze (A) In general The term credit freeze means a restriction placed at the request of a consumer or a personal representative of the consumer, on the consumer report of the consumer, that prohibits a consumer reporting agency from releasing the consumer report for a purpose relating to the extension of credit without the express authorization of the consumer. (B) Exception A credit freeze shall not apply to the use of a consumer report by any of the following: (i) A person, or the subsidiary, affiliate, agent, subcontractor, or assignee of the person, with whom the consumer has, or prior to assignment had, an account, contract, or debtor-creditor relationship for the purposes of reviewing the active account or collecting the financial obligation owed on the account, contract, or debt. (ii) A person, or the subsidiary, affiliate, agent, subcontractor, or assignee of the person, to whom access has been granted pursuant to a request by the consumer described under section 605A(i)(1)(B), for purposes of facilitating the extension of credit or other permissible use. (iii) Any person acting pursuant to a court order, warrant, or subpoena. (iv) A Federal, State, or local government, or an agent or assignee thereof. (v) Any person for the sole purpose of providing a credit monitoring or identity theft protection service to which the consumer has subscribed. (vi) Any person for the purpose of providing a consumer with a copy of the consumer report or credit score of the consumer upon request by the consumer. (vii) Any person or entity for insurance purposes, including use in setting or adjusting a rate, adjusting a claim, or underwriting. (viii) Any person acting pursuant to an authorization from a consumer to use their consumer report for employment purposes. . 3. Enhancement of fraud alert protections Section 605A of the Fair Credit Reporting Act ( 15 U.S.C. 1681c–1 ) is amended— (1) in subsection (a)— (A) in the subsection heading, by striking One-Call and inserting One-Year ; (B) in paragraph (1)— (i) in the paragraph heading, by striking Initial alerts and inserting In general ; (ii) in the matter preceding subparagraph (A), by inserting or harmed by the unauthorized disclosure of the financial or personally identifiable information of the consumer, after identity theft, ; (iii) in subparagraph (A)— (I) by striking 90 days and inserting 1 year ; and (II) by striking and at the end; (iv) in subparagraph (B)— (I) by inserting 1-year before fraud alert ; and (II) by striking the period at the end and inserting ; and ; and (v) by adding at the end the following: (C) upon the expiration of the 1-year period described in subparagraph (A) or a subsequent 1-year period, and in response to a direct request by the consumer or such representative, continue the fraud alert for an additional period of 1 year if the information asserted in this paragraph remains applicable. ; and (C) in paragraph (2)— (i) in the matter preceding subparagraph (A), by inserting 1-year before fraud alert ; and (ii) in subparagraph (B), by striking any request described in subparagraph (A) and inserting the consumer reporting agency includes the 1-year fraud alert in the file of the consumer ; (2) in subsection (b)— (A) in the subsection heading, by striking Extended and inserting Seven-Year ; (B) in paragraph (1)— (i) in subparagraph (B)— (I) by striking 5-year period beginning on the date of such request and inserting the 7-year period described in subparagraph (A) ; and (II) by striking and at the end; (ii) in subparagraph (C)— (I) by striking extended and inserting 7-year ; and (II) by striking the period at the end and inserting ; and ; and (iii) by adding at the end the following: (D) upon the expiration of the 7-year period described in subparagraph (A) or a subsequent 7-year period, and in response to a direct request by the consumer or such representative, continue the fraud alert for an additional period of 7 years if the consumer or such representative submits an updated identity theft report. ; and (C) in paragraph (2), by amending subparagraph (A) to read as follows: (A) disclose to the consumer that the consumer may request a free copy of the file of the consumer pursuant to section 612(d) during each 12-month period beginning on the date on which the 7-year fraud alert was included in the file and ending on the date of the last day that the 7-year fraud alert applies to the file of the consumer; and ; (3) in subsection (c)— (A) by redesignating paragraphs (1), (2), and (3), as subparagraphs (A), (B), and (C), respectively, and adjusting the margins accordingly; (B) in the matter preceding subparagraph (A), as so redesignated, by striking Upon the direct request and inserting the following: (1) In general Upon the direct request ; and (C) by adding at the end the following: (2) Access to free reports If a consumer reporting agency includes an active duty alert in the file of an active duty military consumer, the consumer reporting agency shall— (A) disclose to the active duty military consumer that the active duty military consumer may request a free copy of the file of the active duty military consumer pursuant to section 612(d), during each 12-month period beginning on the date on which the activity duty military alert is requested and ending on the date of the last day that the active duty alert applies to the file of the active duty military consumer; and (B) not later than 3 business days after the date on which the active duty military consumer makes a request described in subparagraph (A), provide to the active duty military consumer all disclosures required to be made under section 609, without charge to the active duty military consumer. ; (4) by amending subsection (d) to read as follows: (d) Procedures Each consumer reporting agency described in section 603(p) shall establish and make available to the public on the Internet website of the consumer reporting agency policies and procedures to comply with this section, including policies and procedures— (1) that inform consumers of the availability of 1-year fraud alerts, 7-year fraud alerts, active duty alerts, and credit freezes, as applicable; (2) that allow consumers to request 1-year fraud alerts, 7-year fraud alerts, and active duty alerts, as applicable, and to place, temporarily lift, or fully remove a credit freeze in a simple and easy manner; and (3) for asserting in good faith a suspicion that the consumer has been or is about to become a victim of identity theft, fraud, or a related crime, or harmed by the unauthorized disclosure of the financial or personally identifiable information of the consumer, for a consumer seeking a 1-year fraud alert or credit freeze. ; (5) in subsection (e), in the matter preceding paragraph (1), by inserting 1-year or 7-year before fraud alert ; (6) in subsection (f), by striking or active duty alert and inserting active duty alert, or credit freeze, as applicable, ; (7) in subsection (g)— (A) by inserting or has been harmed by the unauthorized disclosure of the financial or personally identifiable information of the consumer, after identity theft, ; and (B) by inserting or credit freezes after request alerts ; and (8) in subsection (h)— (A) in paragraph (1)— (i) in the paragraph heading, by striking initial and inserting 1-year ; (ii) in subparagraph (A), by striking initial and inserting 1-year ; and (iii) in subparagraph (B)(i), by striking an initial and inserting a 1-year ; and (B) in paragraph (2)— (i) in the paragraph heading, by striking extended and inserting 7-year ; (ii) in subparagraph (A), in the matter preceding clause (i), by striking extended and inserting 7-year ; and (iii) in subparagraph (B), by striking an extended and inserting a 7-year . 4. Providing free access to credit freezes Section 605A of the Fair Credit Reporting Act ( 15 U.S.C. 1681c–1 ) is amended by adding at the end the following: (i) Credit freezes (1) In general Upon the direct request of a consumer, or an individual acting on behalf of or as a personal representative of a consumer, a consumer reporting agency that maintains a file on the consumer and has received appropriate proof of the identity of the requester (as described in section 1022.123 of title 12, Code of Federal Regulations, or any successor thereto) shall— (A) (i) not later than 1 business day after receiving the request sent by postal mail, toll-free telephone, or secure electronic means as established by the agency, place a credit freeze on the file of the consumer; (ii) not later than 5 business days after placing a credit freeze described in clause (i), provide the consumer with written confirmation of the credit freeze and a unique personal identification number or password (other than the social security number of the consumer) for use to authorize the release of the file of the consumer for a specific period of time; and (iii) disclose all relevant information to the consumer relating to the procedures for temporarily lifting and fully removing a credit freeze, including a statement about the maximum amount of time given to an agency to conduct those actions; (B) if the consumer provides a correct personal identification number or password, temporarily lift an existing credit freeze from the file of the consumer for a period of time specified by the consumer for a specific user or category of users, as determined by the consumer— (i) not later than 1 business day after receiving the request by postal mail; or (ii) not later than 15 minutes after receiving the request by toll-free telephone number or secure electronic means established by the agency, if the request is received during regular business hours, except if the ability of the consumer reporting agency to temporarily lift the credit freeze is prevented by— (I) an act of God, including earthquakes, hurricanes, storms, or similar natural disaster or phenomenon, or fire; (II) unauthorized or illegal acts by a third party including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or a similar occurrence; (III) an operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or a similar disruption; (IV) governmental action, including emergency orders or regulations, judicial or law enforcement action, or a similar directive; (V) regularly scheduled maintenance or updates to the systems of the consumer reporting agency occurring outside of normal business hours; or (VI) commercially reasonable maintenance of, or repair to, the systems of the consumer reporting agency that is unexpected or unscheduled; or (C) if the consumer provides a correct personal identification number or password, fully remove an existing credit freeze from the file of the consumer not later than 21 business days after receiving the request by postal mail, toll-free telephone, or secure electronic means established by the consumer reporting agency. (2) No fee A consumer reporting agency may not charge a consumer a fee to place, temporarily lift, or fully remove a credit freeze. (3) Exclusion from third-party lists During the period beginning on the date on which a consumer or a representative of the consumer requests to place a credit freeze and ending the date on which the consumer or representative requests to fully remove a credit freeze, a consumer reporting agency shall exclude the consumer from any list of consumers prepared by the consumer reporting agency and provided to any third party to offer credit or insurance to the consumer as part of a transaction that was not initiated by the consumer, unless the consumer or that representative requests that the exclusion be rescinded before end of the period. . 5. Additional free consumer report Section 612 of the Fair Credit Reporting Act ( 15 U.S.C. 1681j ) is amended— (1) in subsection (f)(1), in the matter preceding subparagraph (A), by inserting or subsection (h) after through (d) ; and (2) by adding at the end the following: (h) Free disclosures in connection with credit freeze In addition to the free annual disclosure required under subsection (a)(1)(A), each consumer reporting agency that maintains a file on a consumer who requests a credit freeze under section 605A(i) shall make all disclosures pursuant to section 609 once during any 12-month period without charge to the consumer if the consumer makes a request under section 609. . 6. Refunds (a) Definitions In this section, the terms consumer , consumer reporting agency , and credit freeze have the meanings given those terms in section 603 of the Fair Credit Reporting Act ( 15 U.S.C. 1681a ), as amended by section 2. (b) Refunds With respect to any consumer who requested a credit freeze from a consumer reporting agency during the period beginning on September 7, 2017, and ending on the day before the date of enactment of this Act, the consumer reporting agency— (1) shall issue a refund to the consumer for any fees charged to the consumer relating to the request for a credit freeze; and (2) may not impose a fee on the consumer to temporarily lift or fully remove the credit freeze.