T28CH52
Title 28 > T28CH52
Sections (9)
28-52-101
TITLE 28 COMMERCIAL TRANSACTIONS CHAPTER 52 CREDIT REPORT PROTECTION ACT 28-52-101. Short title. This chapter shall be known and cited as the Credit Report Protection Act. History: [28-52-101, added 2008, ch. 177, sec. 2, p. 523.]
28-52-102
TITLE 28 COMMERCIAL TRANSACTIONS CHAPTER 52 CREDIT REPORT PROTECTION ACT 28-52-102. Definitions. In this chapter: (1) Consumer means a natural person. (2) Consumer reporting agency means a person who, for fees, dues or on a cooperative basis, regularly engages in whole or in part in the practice of assembling or evaluating information concerning a consumer’s credit or other information for the purpose of furnishing a credit report to another person. (3) Credit report means a consumer report, as defined in 15 U.S.C. section 1681a, that is used or collected, in whole or in part, for the purpose of serving as a factor in establishing a consumer’s eligibility for credit for personal, family or household purposes. (4) Personal information means personally identifiable financial information provided by a consumer to another person, resulting from any transaction with the consumer or any service performed for the consumer or otherwise obtained by another person. Personal information does not include publicly available information, as that term is defined by regulations prescribed under 15 U.S.C. section 6804, or any list, description or other grouping of consumers, and publicly available information pertaining to consumers that is derived without using any nonpublic personal information. Notwithstanding the foregoing, personal information includes any list, description or other grouping of consumers, and publicly available information pertaining to the consumers, that is derived using any nonpublic personal information other than publicly available information. (5) Proper identification has the same meaning as in 15 U.S.C. section 1681h(a)(1) and includes: (a) The consumer’s full name, including first, middle and last names and any suffix; (b) Any name the consumer previously used; (c) The consumer’s current and recent full addresses, including street address, any apartment number, city, state and zip code; (d) The consumer’s social security number; and (e) The consumer’s date of birth. (6) Security freeze means a prohibition, consistent with section 28-52-103 , Idaho Code, on a consumer reporting agency’s furnishing of a consumer’s credit report to a third party intending to use the credit report to determine the consumer’s eligibility for credit. History: [28-52-102, added 2008, ch. 177, sec. 2, p. 523.]
28-52-103
TITLE 28 COMMERCIAL TRANSACTIONS CHAPTER 52 CREDIT REPORT PROTECTION ACT 28-52-103. Security freeze. (1) A consumer may place a security freeze on the consumer’s credit report by: (a) Making a request to a consumer reporting agency in writing by regular or certified mail at an address designated by the consumer reporting agency to receive the request; (b) Providing proper identification; and (c) Paying the fee required by the consumer reporting agency in accordance with section 28-52-106 , Idaho Code. (2) Upon receiving a request from a consumer under subsection (1) of this section, the consumer reporting agency shall: (a) Place a security freeze on the consumer’s credit report within three (3) business days after receiving the consumer’s request; and (b) Within five (5) business days after placing the security freeze, send a written confirmation of the security freeze to the consumer and provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorizations for removal or temporary lifts of the security freeze under section 28-52-104 , Idaho Code. (3) If a security freeze is in place, a consumer reporting agency may not release a consumer’s credit report, or information from the credit report, to a third party that intends to use the information to determine a consumer’s eligibility for credit without prior authorization from the consumer. (4) Notwithstanding subsection (3) of this section, a consumer reporting agency may communicate to a third party requesting a consumer’s credit report that a security freeze is in effect on the consumer’s credit report. If a third party requesting a consumer’s credit report in connection with the consumer’s application for credit is notified of the existence of a security freeze under this section, the third party may treat the consumer’s application as incomplete. (5) A consumer reporting agency shall require proper identification of the consumer requesting to place, remove or temporarily remove a security freeze. (6) A consumer reporting agency shall develop a contact method to receive and process a consumer’s request to permanently remove or temporarily lift a security freeze. The contact method may include: a postal address; an electronic contact method chosen by the consumer reporting agency, which may include the use of fax, internet or other electronic means; or the use of telephone in a manner that is consistent with any federal requirements placed on the consumer reporting agency. By no later than September 1, 2008, a consumer reporting agency shall develop a secure electronic means for a consumer to request the temporary lift of a security freeze. (7) A security freeze placed under this section may be removed only in accordance with section 28-52-104 , Idaho Code. History: [28-52-103, added 2008, ch. 177, sec. 2, p. 523.]
28-52-104
TITLE 28 COMMERCIAL TRANSACTIONS CHAPTER 52 CREDIT REPORT PROTECTION ACT 28-52-104. Removal of security freeze — Requirements and timing. (1) A consumer reporting agency may remove a security freeze from a consumer’s credit report only if the consumer reporting agency receives the consumer’s request through a contact method established and required in accordance with subsection (6) of section 28-52-103 , Idaho Code, and the consumer reporting agency receives the consumer’s proper identification and other information sufficient to identify the consumer, including the consumer’s personal identification number or password; or the consumer makes a material misrepresentation of fact in connection with the placement of the security freeze and the consumer reporting agency notifies the consumer in writing before removing the security freeze. (2) A consumer reporting agency shall temporarily lift a security freeze upon receipt of the consumer’s request through the contact method established by the consumer reporting agency in accordance with subsection (6) of section 28-52-103 , Idaho Code, along with: (a) The consumer’s proper identification and other information sufficient to identify the consumer; (b) The consumer’s personal identification number or password; (c) The proper information regarding the third party who is to receive the credit report or the time period for which the credit report is to be available to users of the credit report; and (d) A fee, if applicable. (3) A consumer reporting agency shall remove or temporarily lift a security freeze from a consumer’s credit report as follows: (a) Except as provided in paragraph (b) of this subsection regarding temporary lifts, within three (3) business days after the business day on which the consumer’s written request to remove or temporarily lift the security freeze is received by the consumer reporting agency using a contact method chosen by the consumer reporting agency in accordance with subsection (6) of section 28-52-103 , Idaho Code; and (b) On and after September 1, 2008, within fifteen (15) minutes after the consumer’s request to temporarily lift the security freeze is received by the consumer reporting agency through the electronic contact method chosen by the consumer reporting agency in accordance with subsection (6) of section 28-52-103 , Idaho Code, if such request is received between 6:00 a.m. and 9:30 p.m. mountain time. (4) A consumer reporting agency need not remove or temporarily lift a security freeze within the time specified in subsection (3) of this section if the consumer fails to meet the requirements of subsection (1) or (2) of this section, as applicable, or the consumer reporting agency’s ability to remove the security freeze within such time is prevented by: (a) An act of God, including fire, earthquake, hurricane, storm or similar natural disaster or phenomenon; (b) Unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor st
28-52-105
TITLE 28 COMMERCIAL TRANSACTIONS CHAPTER 52 CREDIT REPORT PROTECTION ACT 28-52-105. Exceptions. (1) Notwithstanding subsection (1) of section 28-52-103 , Idaho Code, a consumer reporting agency may furnish a consumer’s credit report to a third party if the purpose of the credit report is to: (a) Use the credit report for purposes permitted under 15 U.S.C. section 1681b(c); (b) Review the consumer’s account with the third party, including for account maintenance or monitoring credit line increases or other upgrades or enhancements; (c) Collect on a financial obligation owed by the consumer to the third party requesting the credit report; or (d) Review the consumer’s account with another person, or collect on a financial obligation owed by the consumer to another person and the credit report request is for purposes permitted under 15 U.S.C. section 1681b(c) or the third party requesting the credit report is a subsidiary, affiliate, agent, assignee or prospective assignee of the person holding the consumer’s account or to whom the consumer owes a financial obligation. (2) The consumer’s request for a security freeze does not prohibit the consumer reporting agency from disclosing the consumer’s credit report for other than credit related purposes consistent with the definition of credit report in section 28-52-102 , Idaho Code. The following list identifies the types of credit report disclosures by consumer reporting agencies to third parties that are not prohibited by a security freeze: (a) The third party does not use the credit report for the purpose of serving as a factor in establishing a consumer’s eligibility for credit; (b) The third party is acting under a court order, warrant or subpoena requiring release of the credit report; (c) The third party is a child support agency, or its agent or assignee acting under part D, title IV, of the social security act or a similar state law; (d) The third party is the federal department of health and human services or a similar state agency, or its agent or assignee, investigating medicare or medicaid fraud; (e) The purpose of the credit report is to investigate or collect delinquent taxes, assessments or unpaid court orders and the third party is the federal internal revenue service; a state taxing authority; the division of motor vehicles of the Idaho transportation department; a county, municipality or other taxing district; a federal, state or local law enforcement agency; or the agent or assignee listed in subsection (1) or (2) of this section; (f) The third party is using the information solely for criminal record information, tenant screening, employment screening, fraud prevention or detection, or personal loss history information; (g) The third party is a person or entity regulated under title 41 , Idaho Code; (h) The third party is administering a credit file monitoring service to which the consumer has subscribed; or (i) The third party requests the credit report for the sole purpose of provid
28-52-106
TITLE 28 COMMERCIAL TRANSACTIONS CHAPTER 52 CREDIT REPORT PROTECTION ACT 28-52-106. Fees for security freeze. (1) Except as provided in subsection (2) of this section, a consumer reporting agency may not charge an administrative fee to a consumer for the first placement of a security freeze during a twelve (12) month period, and for the first temporary lift of a security freeze during a twelve (12) month period. A consumer reporting agency may charge an administrative fee, not to exceed six dollars (6.00) for the second or subsequent temporary lift of a security freeze during a twelve (12) month period. (2) A consumer reporting agency may not charge a fee under section 28-52-103 (1)(c), Idaho Code, to a consumer who has been the victim of identity theft and who has submitted to the consumer reporting agency a valid police report, an investigative report or complaint that the consumer has filed with a law enforcement agency. (3) A consumer may be charged a reasonable fee, not to exceed ten dollars ($10.00), if the consumer fails to retain the original personal identification number, password or other device provided by the consumer reporting agency and if the consumer asks the consumer reporting agency to reissue the same or a new personal identification number, password or other device. History: [28-52-106, added 2008, ch. 177, sec. 2, p. 527; am. 2018, ch. 163, sec. 1, p. 322.]
28-52-107
TITLE 28 COMMERCIAL TRANSACTIONS CHAPTER 52 CREDIT REPORT PROTECTION ACT 28-52-107. Changes to information in a credit report subject to a security freeze. (1) If a credit report is subject to a security freeze, a consumer reporting agency shall notify the consumer who is the subject of the credit report within thirty (30) days if the consumer reporting agency changes the consumer’s name, date of birth, social security number or address. (2) Notwithstanding subsection (1) of this section, a consumer reporting agency may make technical modifications to information in a credit report that is subject to a security freeze without providing notification to the consumer. Technical modifications include the addition or subtraction of abbreviations to names and addresses and transpositions or corrections of incorrect numbering or spelling. (3) When providing notice of a change of address under subsection (1) of this section, the consumer reporting agency shall provide notice to the consumer at both the new address and the former address. History: [28-52-107, added 2008, ch. 177, sec. 2, p. 527.]
28-52-108
TITLE 28 COMMERCIAL TRANSACTIONS CHAPTER 52 CREDIT REPORT PROTECTION ACT 28-52-108. Protection of personal information. (1) Except as otherwise specifically provided by law, a person shall not intentionally communicate an individual’s social security number to the general public. (2) The state of Idaho, a department, agency, board, commission or other political subdivision may not employ or contract for the employment of an inmate in any facility operated by the department of correction or private correctional facility contracted with the department of correction or county jail in any capacity that would allow any inmate access to any other person’s personal information. History: [28-52-108, added 2008, ch. 177, sec. 2, p. 527.]
28-52-109
TITLE 28 COMMERCIAL TRANSACTIONS CHAPTER 52 CREDIT REPORT PROTECTION ACT 28-52-109. Enforcement. (1) Except as otherwise specified in this section, any credit reporting agency that willfully fails to comply with any requirement imposed under this chapter with respect to any consumer is liable to that consumer in an amount equal to the sum of: (a) Any actual damages sustained by the consumer as a result of the failure or damages of not less than one hundred dollars (1,000); or (b) Such amount of punitive damages as the court may allow; and (c) In the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney’s fees as determined by the court. (2) Any person who obtains a consumer report, requests a security freeze, requests the temporary lifting of a freeze or requests the removal of a security freeze from a consumer reporting agency under false pretenses or in an attempt to violate federal or state law shall be liable to the consumer reporting agency for actual damages sustained by the consumer reporting agency or one thousand dollars (100) or greater than one thousand dollars (100,000) in the aggregate for related violations concerning more than one (1) consumer. In addition to the penalties provided in this section, the attorney general may seek injunctive relief to prevent future violations of this chapter in the district c