Session Laws of Colorado 2005
First Regular Session, 65th General Assembly

 

 

 

CHAPTER 226


_______________


CRIMINAL LAW AND PROCEDURE

_______________



SENATE BILL 05-137 [Digest]


BY SENATOR(S) Grossman, Bacon, Fitz-Gerald, Gordon, Groff, Hanna, Shaffer, Tochtrop, Tupa, Williams, and Windels;

also REPRESENTATIVE(S) Paccione, Frangas, Knoedler, Marshall, Massey, Stengel, Berens, Borodkin, Boyd, Buescher, Butcher, Carroll M., Cerbo, Cloer, Coleman, Crane, Garcia, Green, Jahn, Kerr, King, Larson, Madden, May M., McFadyen, McGihon, Merrifield, Plant, Pommer, Solano, Soper, Todd, Vigil, and Romanoff.




AN ACT


Concerning identity theft.

 


Be it enacted by the General Assembly of the State of Colorado:

 

  SECTION 1.  12-14.3-102, Colorado Revised Statutes, is amended BY THE ADDITION OF THE FOLLOWING NEW SUBSECTIONS to read:

 

  12-14.3-102.  Definitions. As used in this article, unless the context otherwise requires:

 

  (9)  "Proper identification" means information generally deemed sufficient to identify a person. If the consumer is unable to reasonably identify himself or herself with the information described above, a consumer reporting agency may require additional information concerning the consumer's employment and personal or family history in order to verify his or her identity.

 

  (10)  "Reviewing the account" means activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.

 

  (11)  "Security freeze" or "freeze" means a notice placed in a consumer report, at the request of a consumer and subject to certain exemptions, that prohibits the consumer reporting agency from releasing the consumer report or any information from it without the express authorization of the consumer.

 

  SECTION 2.  Part 1 of article 14.3 of title 12, Colorado Revised Statutes, is amended BY THE ADDITION OF THE FOLLOWING NEW SECTIONS to read:

 

  12-14.3-106.6.  Security freeze - timing - covered entities - cost. (1) (a)  A consumer may elect to place a security freeze on his or her consumer report by making a request in writing by certified mail to a consumer reporting agency.

 

  (b)   Except as provided in subsection (11) and paragraph (b) of subsection (6) of this section, if a security freeze is in place, information from a consumer report may not be released to a third party without prior, express authorization from the consumer.

 

  (c)  This section does not prevent a consumer reporting agency from advising a third party that a security freeze is in effect with respect to the consumer report.

 

  (2) (a)  A consumer reporting agency shall place a security freeze on a consumer report no later than five business days after receiving the request from the consumer.

 

  (b)  The consumer reporting agency shall send a written confirmation of the security freeze to the consumer within ten business days and, with the confirmation, shall provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of his or her consumer report to a specific party or for a specific period of time.

 

  (3)  If a consumer wishes to allow his or her consumer report to be accessed by a specific party or for a specific period of time while a freeze is in place, he or she shall contact the consumer reporting agency, request that the freeze be temporarily lifted, and provide the following:

 

  (a)  Proper identification;

 

  (b)  The unique personal identification number or password provided by the consumer reporting agency pursuant to paragraph (b) of subsection (2) of this section; and

 

  (c)  The proper information regarding the third party who is to receive the consumer report or the time period that the report shall be available to users of the consumer report.

 

  (4)  A consumer reporting agency that receives a request from a consumer to temporarily lift a freeze on a consumer report pursuant to subsection (3) of this section, shall comply with the request no later than three business days after receiving the request.

 

  (5)  A consumer reporting agency may develop procedures involving the use of telephone, fax, internet, or other electronic media to receive and process a request from a consumer to place a freeze or to temporarily lift a freeze on a consumer report pursuant to subsection (3) of this section in an expedited manner.

 

  (6)  A consumer reporting agency shall remove or temporarily lift a freeze placed on a consumer report only in the following cases:

 

  (a)  Upon consumer request, pursuant to subsection (3) or (9) of this section; or

 

  (b)  If the consumer report was frozen due to a material misrepresentation of fact by the consumer or somebody purporting to be the consumer. If a consumer reporting agency intends to remove a freeze on a consumer report pursuant to this paragraph (b), the consumer reporting agency shall notify the consumer in writing prior to removing the freeze placed on the consumer report.

 

  (7)  If a third party requests access to a consumer report on which a security freeze is in effect, and the request is in connection with an application for credit or other use, and the consumer does not allow his or her consumer report to be accessed by that specific party or during that period of time, the third party may treat the application as incomplete.

 

  (8)  If a consumer requests a security freeze, the consumer reporting agency shall disclose the process of placing and temporarily lifting a freeze and the process for allowing access to information from the consumer report to a specific party or for a specific period of time while the freeze is in place.

 

  (9)  Except as otherwise provided pursuant to paragraph (b) of subsection (6) of this section, a security freeze shall remain in place until the consumer requests that the security freeze be removed. A consumer reporting agency shall remove a security freeze within three business days of receiving a request for removal from the consumer, who provides both of the following:

 

  (a)  Proper identification; and

 

  (b)  The unique personal identification number or password provided by the consumer reporting agency pursuant to paragraph (b) of subsection (2) of this section.

 

  (10)  A consumer reporting agency shall require proper identification of the person making a request to place a security freeze in a manner consistent with the requirements of this section.

 

  (11)  The provisions of this section shall not apply to the use of a consumer report by or for any of the following:

 

  (a)  A person or entity, or a subsidiary, affiliate, or agent of that person or entity that owns a financial obligation owing by the consumer to that person or entity, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, debt, or negotiable instrument, and lawful associated costs;

 

  (b)  An assignee or a prospective assignee of a financial obligation owing by the consumer to a person or entity in paragraph (a) of this subsection (11);

 

  (c)  A subsidiary, affiliate, agent, assignee, or prospective

assignee of a person to whom access has been granted under subsection (3) of this section for purposes of facilitating the extension of credit or other permissible use;

 

  (d)  A state or local agency, law enforcement agency, trial court, private collection agency, or person acting pursuant to a court order, warrant, or subpoena authorizing the use of the consumer report;

 

  (e)  A child support enforcement agency acting to enforce child support obligations;

 

  (f)  The department of health care policy and financing or its agents or assigns acting to investigate fraud;

 

  (g)  The department of human services or its agents or assignees acting to investigate fraud;

 

  (h)  The department of revenue or its agents or assigns acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities or exercise any of its statutory authority;

 

  (i)  The use of credit information for the purposes of prescreening as provided for by the "Fair Credit Reporting Act", 15 U.S.C. 1681, et seq.;

 

  (j)  Any person or entity administering a credit file monitoring subscription service to which the consumer has subscribed;

 

  (k)  Any person or entity for the purpose of providing a consumer with a copy of his or her consumer report upon the consumer's request;

 

  (l)  Any person or entity for use in setting or adjusting a rate, adjusting a claim, or underwriting for insurance purposes;

 

  (m)  A pension plan acting to determine the consumer's eligibility for plan benefits or payments authorized by law or to investigate fraud;

 

  (n)  A person conducting a pre-sentence investigation in a criminal matter or a probation officer using this information for supervision of an offender;

 

  (o)  A collections investigator or other person engaged in the collecting of fees, fines, or restitution assessed in a court proceeding;

 

  (p)  A licensed hospital with which the consumer has or had a contract, or a debtor-creditor relationship for the purposes of reviewing the account or collecting the financial obligation owing for the contract, account, or debt;

 

  (q)  A law enforcement agency or its agents acting to investigate a crime or conducting a criminal background check.

 

  (12) (a)  Fees for requesting a security freeze, temporarily lifting a security freeze, and permanently removing a security freeze from consumer reports may be charged only in accordance with this subsection.

 

  (b)  A consumer reporting agency may not charge a fee for a consumer's first request to place a security freeze on his or her consumer report.

 

  (c)  Except as provided for in paragraphs (a) and (b) of this subsection, a consumer reporting agency may charge a consumer a reasonable fee of no more than ten dollars for:

 

  (I)  A temporary lift for a period of time or permanent removal of a security freeze from the consumer report; or

 

  (II)  A subsequent request for a security freeze of the consumer report after the consumer's first request for a security freeze has been permanently removed from his or her consumer report.

 

  (d)  Except as provided for in paragraphs (a) and (b) of this subsection, a consumer reporting agency may charge a fee not to exceed twelve dollars for temporarily lifting a security freeze on the consumer report for a specific party.

 

  12-14.3-106.7.  Notice of rights. (1)  At any time that a consumer is required to receive a summary of rights required under section 609 of the "Fair Credit Reporting Act" or under state law, the following notice shall be included:

 

State Consumers Have the Right to Obtain a Security Freeze.

 

You may obtain a security freeze on your consumer report to protect your privacy and ensure that credit is not granted in your name without your knowledge, except as provided by law. You have a right to place a security freeze on your consumer report to prohibit a consumer reporting agency from releasing any information in your consumer report without your express authorization or approval, except as the law allows.

 

You will not be initially charged to place a security freeze on your consumer report. However, you will be charged a fee of no more than ten dollars to temporary lift the freeze for a period of time, to permanently remove the freeze from your consumer report, or when you make a subsequent request for a freeze to be placed on your consumer report. As well, you may be charged a fee of no more than twelve dollars to temporarily lift the freeze for a specific party.

 

The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. When you place a security freeze on your consumer report, within five business days you will be provided procedures for the temporary release of your consumer report to a specific party or parties or for a period of time after the security freeze is in place. To provide that authorization, you must contact the consumer reporting agency and provide the proper information regarding the third party or parties who are to receive the consumer report or the period of time for which the report shall be available to users of the consumer report.

 

A consumer reporting agency that receives a request from a consumer to temporarily lift a security freeze on a consumer report shall comply with the request no later than three business days after receiving the request.

 

A security freeze does not apply to circumstances where you have an existing account relationship, and a copy of your report is requested by your existing creditor or its agents or affiliates for certain types of account review, collection, fraud control or similar activities.

 

You should be aware that using a security freeze to take control over who gains access to the personal and financial information in your consumer report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding new loans, credit, mortgage, insurance, government services or payments, rental housing, employment, investment, license, cellular phone, utilities, digital signature, internet credit card transaction, or other services, including an extension of credit at the point of sale. You should plan ahead and lift a security freeze either completely if you are shopping around, or specifically for a certain creditor a few days before actually applying for new credit.

 

You have the right to bring a civil action or submit to binding arbitration against a consumer reporting agency to enforce an obligation under the security freeze law after following specified dispute procedures and having received the necessary notice.

 

  12-14.3-106.8.  Security freeze - prohibition of changing official information in credit report. If a security freeze is in place, a consumer reporting agency shall not change any of the following official information in a consumer report without sending a written notice of the change to the consumer within thirty days of the change being posted to the consumer's file: Name, date of birth, social security number, and address. Written notice is not required for technical modifications of a consumer's official information, including name and street abbreviations, complete spellings, or transposition of numbers or letters. In the case of an address change, the written notice shall be sent to both the new address and the former address.

 

  12-14.3-106.9.  Security freeze - exemptions. (1)  Sections 12-14.3-106.6 to 12-14.3-106.8 shall not apply to a consumer reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or multiple consumer reporting agencies, and that does not maintain a permanent database of credit information from which new consumer reports are produced. However, a consumer reporting agency shall honor any security freeze placed on a consumer report by another consumer reporting agency.

 

  (2)  The following entities are not required to place in a consumer report a security freeze:

 

  (a)  A check service or company or fraud prevention service or company that issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments;

 

  (b)  A deposit account information service or company that issues reports regarding account closures due to fraud, substantial overdrafts, or automatic teller machine abuse or similar negative information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution;

 

  (c)  A fraud prevention service or company issuing reports to prevent or investigate fraud.

 

  SECTION 3.  12-14.3-107, Colorado Revised Statutes, is amended to read:

 

  12-14.3-107.  Consumer's right to file action in court or arbitrate disputes. An action to enforce any obligation of a consumer reporting agency to a consumer under this article may be brought in any court of competent jurisdiction as provided by the federal "Fair Credit Reporting Act" or submitted to binding arbitration after the consumer has followed all dispute procedures in section 12-14.3-106 and has received the notice specified in subsection (6) of said section, or has followed all of the block procedures in section 12-14.3-106.5, or has followed all of the freeze procedures in section 12-14.3-106.6, in the manner set forth in the rules of the American arbitration association to determine whether the consumer reporting agency met its obligations under this article. No decision by an arbitrator pursuant to this section shall affect the validity of any obligations or debts owed to any party. A successful party to any such arbitration proceeding shall be compensated for the costs and attorney fees of the proceeding as determined by the court or arbitration. No consumer may submit more than one action to arbitration against any consumer reporting agency during any one-hundred-twenty-day period. The results of an arbitration action brought against a consumer reporting agency doing business in this state shall be communicated in a timely manner with all other consumer reporting agencies doing business in this state. If, as a result of an arbitration a determination is made in favor of the consumer, any adverse information in such consumer's file or record shall be blocked, removed, or stricken in a timely manner, or the consumer report shall be frozen within five days of receipt of such determination by the consumer reporting agency. If such adverse information is not so blocked, removed, or stricken, or the file is not frozen, the consumer may bring an action against the noncomplying agency pursuant to this section notwithstanding the one-hundred-twenty-day waiting period.

 

  SECTION 4.  12-14.3-108, Colorado Revised Statutes, is amended to read:

 

  12-14.3-108.  Violations. (1)  Any consumer reporting agency that willfully violates any provision of this article, or the federal "Fair Credit Reporting Act", sec. 1681c, as amended, shall be liable for three times the amount of actual damages or one thousand dollars for a violation of section 12-14.3-106.6, or for each inaccurate or unblocked entry in the consumer's file that was disputed or alleged to be unauthorized in accordance with section 12-14.3-106.5 by the consumer, whichever is greater, reasonable attorney fees, and costs.

 

  (2) (a)  Any consumer reporting agency that negligently violates this article, or the federal "Fair Credit Reporting Act", sec. 1681c, as amended, shall be liable for the greater of actual damages or one thousand dollars for each violation of section 12-14.3-106.6, or for each inaccurate or unblocked entry in the consumer's file that was disputed or alleged to be unauthorized in accordance with section 12-14.3-106.5 by the consumer and that affects the consumer's creditworthiness, as defined in section 12-14.3-102 (4.5), plus reasonable attorney fees, and costs, if within thirty days after receiving notice of dispute from a consumer, in accordance with section 12-14.3-106, the consumer reporting agency does not correct the complained of items or activities and does not send the consumer and, upon request of the consumer, any person who has requested the consumer information, written notification of such corrective action, in accordance with section 12-14.3-106 (6), or section 12-14.3-106.6 or if, within thirty days after receiving a copy of a police report alleging, or a certified court order finding, unauthorized activity, the consumer reporting agency does not block the information in accordance with section 12-14.3-106.5.

 

  (b)  Any consumer reporting agency that negligently violates this article, or the federal "Fair Credit Reporting Act", sec. 1681c, as amended, shall be liable for the greater of actual damages or one thousand dollars for all violations of section 12-14.3-106.6 or all inaccurate or unblocked entries in the consumer's file that were disputed or alleged to be unauthorized in accordance with section 12-14.3-106.5 or section 12-14.3-106.6 by the consumer but that did not affect the consumer's creditworthiness, plus reasonable attorney fees, and costs, if within thirty days after receiving notice of dispute from a consumer, in accordance with section 12-14.3-106, the consumer reporting agency does not correct the complained of items or activities and does not send the consumer and, if requested by the consumer, any person who has requested the consumer information, written notification of such corrective action, in accordance with section 12-14.3-106 (6) or section 12-14.3-106.6 or if, within thirty days after receiving a copy of a police report alleging, or a certified court order finding, unauthorized activity, the consumer reporting agency does not block the information in accordance with section 12-14.3-106.5.

 

  (3)  In addition to the damages assessed under subsections (1) and (2) of this section, if, ten days after the entry of any judgment for damages, the consumer's file is still not corrected, or blocked, or frozen by the consumer reporting agency, such assessed damages shall be increased to one thousand dollars per day per unfrozen consumer report or inaccurate or unblocked entry that remains in the consumer's file until the inaccurate entry is corrected or blocked, or the consumer report is frozen.

 

  SECTION 5.  7-90-306, Colorado Revised Statutes, is amended BY THE ADDITION OF THE FOLLOWING NEW SUBSECTIONS to read:

 

  7-90-306.  Filing duty of secretary of state - manner of filing. (5) (a)  Notwithstanding the foregoing or any other provision of law, the secretary of state may, upon receipt of a written request from and a showing of good cause by an authorized person supported by such validating, verifying, and authenticating documents as the secretary of state may require, remove personal identifying information from the publicly accessible documents and other records of the secretary of state maintained pursuant to this section where such information is not required by law to be included in such documents and records.

 

  (b)  A document or record from which the secretary of state removes personal identifying information pursuant to paragraph (a) of this subsection (5) shall not be rendered insufficient or ineffective by such removal notwithstanding any other provision of law.

 

  (c)  The secretary of state may retain the original or a copy of a document or record that contains personal identifying information, but such a document or record shall be open for inspection, and copies or printouts of the document or record or information from the document or record shall be furnished only upon application to the secretary of state and only for good cause shown notwithstanding any provision of part 2 of article 72 of title 24, C.R.S., or any other provision of law.

 

  (6)  For the purposes of this section, "personal identifying information" means information about an individual that could reasonably be used to identify such individual, including, but not limited to:

 

  (a)  A social security number;

 

  (b)  A personal identification number;

 

  (c)  A password; or

 

  (d)  A pass code.

 

  SECTION 6.  Part 1 of article 5 of title 18, Colorado Revised Statutes, is amended BY THE ADDITION OF A NEW SECTION to read:

 

  18-5-119.  Theft of personal identifying information. (1) (a)  A person who, with the intent to defraud another person of personal identifying information, unlawfully enters a trash receptacle and takes documents from that trash receptacle commits theft of personal identifying information.

 

  (b)  For purposes of this section, "personal identifying information" shall have the same meaning as provided in section 6-1-713 (2), C.R.S.; except that "personal identifying information" shall not include a financial transaction device, as defined in section 18-5-701 (3).

 

  (2)  Theft of personal identifying information is a class 1 misdemeanor.

 

  SECTION 7.  Effective date - applicability. (1)  Sections 5 and 8 of this act shall take effect upon passage, section 6 of this act shall take effect on July 1, 2005, and shall apply to offenses committed on or after said date, and the remainder of this act shall take effect on July 1, 2006.

 

  (2)  However, if a referendum petition is filed against this act or an item, section, or part, other than section 5 or 6, of this act during the 90-day period after final adjournment of the general assembly that is allowed for submitting a referendum petition pursuant to article V, section 1 (3) of the state constitution, then the act, item, section, or part, shall not take effect unless approved by the people at a biennial regular general election and shall take effect on the date specified in subsection (1) or on the date of the official declaration of the vote thereon by proclamation of the governor, whichever is later.

 

  SECTION 8.  Safety clause. The general assembly hereby finds, determines, and declares that sections 5 and 6 of this act are necessary for the immediate preservation of the public peace, health, and safety.

 

Approved: June 1, 2005

 

----------

Capital letters indicate new material added to existing statutes; dashes through words indicate deletions from existing statutes and such material not part of act.


Session Laws of Colorado Digest of Bills General Assembly State of Colorado


Office of Legislative Legal Services, State Capitol Building, Room 091, Denver, Colorado 80203-1782
Telephone: 303-866-2045 | Facsimile: 303-866-4157
Send comments about this web page to: olls.ga@state.co.us
 

The information on this page is presented as an informational service only and should not be relied upon as an official record of action or legal position of the State of Colorado, the Colorado General Assembly, or the Office of Legislative Legal Services.