AB 248

Current law generally allows an individual to prohibit a consumer reporting

agency (CRA) from releasing the individual's consumer report (credit report) for any

purpose related to the extension of credit without the individual's prior

authorization. If an individual makes a proper request to a CRA, provides proper

identification, and pays any applicable fee, the CRA must include a "security freeze"

on the individual's credit report. A CRA may not release an individual's credit report

for an extension of credit if the report includes a security freeze. There are various

exceptions to these requirements, including CRAs to which the requirements do not

apply and exceptions allowing a CRA to release an individual's credit report that

includes a security freeze for specified purposes or under specified circumstances.

Current law also includes procedures for an individual to authorize release of a credit

report that includes a security freeze. In addition, a CRA must remove a security

freeze upon an individual's request, but may charge a fee to do so.

This bill provides for additional security freezes by allowing representatives to

obtain security freezes on behalf of protected consumers. The bill defines a

"protected consumer" as either: 1) an individual who is under 16 years old; or 2) an

individual for whom a guardian or conservator has been appointed. The bill defines

a "representative" as a person who provides "sufficient proof of authority" to act on

behalf of a protected consumer, which is defined to include: 1) a court order; 2) a

power of attorney; or 3) a notarized statement describing the authority to act on

behalf of a protected consumer. Under the bill, a representative may request a

security freeze for a protected consumer by providing a CRA with the sufficient proof

of authority described above, as well as "sufficient proof of identification" of both the

representative and protected consumer. The bill defines "sufficient proof of

identification" to include: 1) a social security number (SSN) or copy of a SSN card;

2) a certified or official copy of a birth certificate; or 3) a copy of a motor vehicle

operator's license or identification card.

If a CRA receives a representative's request for a security freeze on behalf of a

protected consumer, and the CRA already has a file on the protected consumer, the

CRA must place a security freeze that prohibits the CRA from releasing the protected

consumer's credit report. If the CRA does not have a file on the protected consumer,

the CRA must place a security freeze by creating a record identifying the protected

consumer. The bill prohibits using the record for credit considerations. The bill

requires a CRA to verify that it has no file by checking names and SSNs in its existing

files. The bill requires a CRA to place a security freeze within 30 days after receiving

a request that complies with the bill, regardless of whether the CRA already has a

file on the protected consumer. Upon placement of a security freeze, the CRA may

not release the protected consumer's credit report, any information derived from the

credit report, or any record created under the bill, unless the security freeze is

removed as discussed below.