SF 3459

as introduced - 90th Legislature (2017 - 2018) Posted on 03/16/2018 08:44am

A bill for an act
relating to consumer protection; regulating security freezes on consumer reports;
providing for payment of fees; amending Minnesota Statutes 2016, section 13C.016,
subdivisions 1, 8; proposing coding for new law in Minnesota Statutes, chapter
13C.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

Minnesota Statutes 2016, section 13C.016, subdivision 1, is amended to read:

Subdivision 1.

Definitions.

(a) For purposes of this section and sections 13C.017 to
13C.019, the terms defined in this section have the meanings given.

(b) "Security freeze" means a notice placed in a consumer's consumer report, at the
request of the consumer and subject to certain exceptions, that prohibits the consumer
reporting agency from releasing the consumer report or any information from it, in connection
with the extension of credit or the opening of a new account, without the express authorization
of the consumer. If a security freeze is in place, information from a consumer's consumer
report may not be released to a third party, in connection with the extension of credit or the
opening of an account, without prior express authorization from the consumer. This paragraph
does not prevent a consumer reporting agency from advising a third party that a security
freeze is in effect with respect to the consumer report.

new text begin (c) "Victim of a data breach" means a consumer who has a notice that there has been a
breach of the security system involving the consumer's personal information, as provided
in section 325E.61.
new text end

deleted text begin (c) deleted text end new text begin (d) new text end "Victim of identity theft" means a consumer who has a copy of a valid police
report evidencing that the consumer has alleged to be a victim of identity theft as defined
in section 609.527.

Sec. 2.

Minnesota Statutes 2016, section 13C.016, subdivision 8, is amended to read:

Subd. 8.

Fees.

(a) A consumer reporting agency may charge a fee of $5 for placing,
temporarily lifting, or removing a security freeze unless:

(1) the consumer is a victim of identity theft as defined in subdivision 1, paragraph deleted text begin (c); deleted text end new text begin
(d), new text end and

deleted text begin (2) deleted text end the consumer provides the consumer reporting agency with a valid copy of a police
report or a police case number documenting the identity theft deleted text begin . deleted text end new text begin ; or
new text end

new text begin (2) the consumer is a victim of a data breach as defined in subdivision 1, paragraph (c),
and the consumer provides the consumer reporting agency with a copy of a notice that there
has been a breach of the security system.
new text end

(b) In addition to the charge, if any, permitted under paragraph (a), a consumer may be
charged no more than $5 if the consumer fails to retain the original personal identification
number given to the consumer by the agency, but the consumer may not be charged for a
onetime reissue of the same or a new personal identification number. The consumer may
be charged no more than $5 for subsequent instances of loss of the personal identification
number.

(c) A consumer who makes a written request by mail may pay any fee charged pursuant
to this subdivision by check, money order, or credit card. A consumer who makes a request
by telephone or other electronic media may pay any fee charged pursuant to this subdivision
by credit card.

Sec. 3.

new text begin [13C.05] CONTRACT CLAUSES.
new text end

new text begin If a consumer reporting agency reports that there has been a breach of the security system
involving consumers' personal information, as provided in section 325E.61, and the consumer
reporting agency offers additional or reduced cost security services, including but not limited
to credit monitoring services, security freezes, or security locks, then the consumer reporting
agency may not include in a contract with the consumer a clause requiring mediation,
arbitration, or any other form of alternative dispute resolution, or limiting the liability of
the consumer reporting agency in any way. Such a clause is void and unenforceable.
new text end

Sec. 4. new text begin EFFECTIVE DATE.
new text end

new text begin Sections 1 to 3 are effective retroactively for data breaches that occurred on or after July
1, 2017.
new text end