New York Law Allows New York Consumers to "Freeze" Their Credit Report

December 1, 2006

Author: Kirsten E. Keefe

On November 1, 2006, the Credit Report Security Freeze Legislation (A.7349-D/S.6805-B) went into effect in New York State.  The law allows New Yorkers to put a security freeze on their credit reports, disallowing unknown third parties from accessing their information.  Intended to help consumers who are either victims of identity theft, or who are concerned that they might be at risk of having their identities stolen, the law’s provisions may prove to be too cumbersome for many to take advantage of its benefits.  The law amends New York’s General Business Law §380-a by adding four subdivisions, and §380-t, relettering it as §380-u and adding a new §380-t.

How does it work?

Consumers can place a “security freeze” on their credit reports to prevent their information from being pulled by unauthorized third parties.  In order to place a freeze, consumers must send a written request via certified or overnight mail to the credit reporting agency (“CRA”), along with proper identification and a fee.1  The consumer must send a separate request to each of the three main CRA’s (Equifax, Experian and TransUnion).2  The CRA’s are to designate a specific address to which the request must be sent.

The CRA must place the security freeze on the account within five business days of their receipt of the request.3  The CRA must send written confirmation to the consumer that a freeze has been placed on their report within ten business days thereafter, along with a unique personal identification number or password.4  A security freeze means that the CRA may not release the consumer’s report or credit score to unauthorized third parties.5  A CRA may advise a third party that a security freeze is in effect.6

The freeze remains on the report indefinitely and may only be removed if requested for by the consumer, or if the CRA discovers the freeze was placed based on a material misrepresentation by the consumer.7

Can a consumer allow a designated creditor to access their credit report?

Yes.  A consumer who wishes to have their credit report information released once a freeze is in place must contact each CRA to request that the freeze be temporarily lifted to allow a specific party to receive their credit information for a designated period of time.  The consumer must send a written request (or may do so by phone or internet if allowed by the CRA8), and must provide their identification number or password, information regarding the third party to which the report should be made available or the time period for which the report should be available.9  A fee up to $5.00 may be charged by the CRA.10  The CRA must comply with the request within three days of receipt of the request.11

Can anyone else access a credit report once a "freeze" is in place?

Yes.  In addition to those to whom authorization is specifically granted, several entities will still be allowed to access a consumer’s report even after a freeze is in place, including: (1) entities to whom a financial obligation is already owed who deem reviewing the account necessary for account maintenance, monitoring, credit line increases, and account upgrades and enhancements; (2) subsidiaries, affiliates, agents, assignees or prospective assignees of a creditor to whom authorized permission has been granted; (3) any entity acting pursuant to a court order, warrant or subpoena including state or local agencies, law enforcement, courts or private collection agencies; (4) a child support agency acting pursuant to Title IV-D of Social Security Act (42 U.S.C. et seq.); (5) the state or an entity acting on behalf of the state when investigating fraud, the collection of delinquent taxes or unpaid court orders, or other statutory responsibilities pursuant to 15 U.S.C. § 1681B; (6) an agency to prescreen as provided for under the FCRA; (7) a company conducting a file monitoring subscription if such is subscribed to by the consumer; and (8) the consumer who requests their credit report or score.12

How can a “freeze” be removed from a credit report for good?

There is no time expiration for a security freeze.  The freeze will remain in place until the consumer requests that it be removed, and provides their personal identification number or password along with a fee if the CRA requires one.  The freeze must be removed within three days of receipt of the request.13

What are the fees?

There is no fee to place the freeze if the consumer has been a victim of identify theft and submits a copy of a signed Federal Trade Commission ID theft victim’s affidavit,14 or a valid police report.15

In addition, all consumers are allowed to place one freeze free of charge on their credit reports.  If the freeze is removed and the consumer wishes to place a subsequent freeze on their account, the CRA may charge up to $5.00.  Each CRA may also charge a fee up to $5.00 for a temporary lift or for the permanent removal of the freeze.  An additional $5.00 fee may be charged for a replacement identification number or password if the consumer loses the original.16

Notice to consumers

The federal Fair Credit Report Act (15 U.S.C. §1681 et seq.) requires CRA’s to provide a summary of rights to consumers when they request information in writing about their credit report, and/or if they request information as the result of being a victim of identity theft.  When such information is required to be sent, residents of New York must also be sent a notice informing the consumer of their right to obtain a security freeze.17  Specific language to be included in the notice is set forth in the law.18  The notice must also be sent to any consumer who requests information about a security freeze.19

What happens if the CRA releases information even though there is a “freeze”?

If information is erroneously released to a third party, the CRA must notify the consumer in writing within five business days following discovery of the error regarding the information released, and the identity and contact information for the entity to whom the report was released.20  There is no private right of action, however, the attorney general may seek an injunction against the CRA, as well as seek a maximum civil penalty from the court in the amount of $5,000 for each violation.21

Conclusion

Identity theft has been identified by Attorney General Eliot Spitzer as the fastest growing financial crime, affecting half a million Americans each year.  Research shows that low-income consumers are not any more immune from identify theft.  Major security breaches such as the ChoicePoint debacle in February 2005 in which personal information was obtained from computer files over the internet, an increase in news reports of stolen business laptops out of the back seat of cars, as well as an increase in police reports about identify theft are strong evidence that we all must be more vigilant about protecting our information.
Though this new law may provide some protection, requiring requests be sent via certified or overnight mail, as well as the fees that could become costly for consumers at $5.00 for each request to have the freeze lifted, limits the likelihood that many New Yorkers will take advantage of its benefits.  Since September 2005, New Yorkers have been entitled to obtain a free copy of their credit report from each of the agencies.  Frequent monitoring, in addition to common sense practices, may continue to prove to be the most practicable means for consumers to protect their information.

To obtain a free copy of your credit report, go to  http://tinyurl.com/ye5nm3 or call toll free at 1-877-322-8228. Hearing-impaired consumers can access via TDD service at 1-877-730-4104. More information about New York’s Security Freeze Law, credit reports, and identity theft can be found on the NYS Consumer Protection Board’s website at http://www.consumer.state.ny.us/.

---

 Footnotes

1  NY General Business Law, § 380-t(a) and (b).  “Proper identification” is broadly defined as “information generally deemed sufficient to identify a person.” Id. at § 380-a(n).
2  “Consumer credit reporting agency” is defined as an agency that “regularly engages in the practice of assembling or evaluating and maintaining, for the purpose of furnishing consumer credit reports to third parties bearing on a consumer’s credit worthiness, credit standing, or credit capacity, public record information and credit account information from persons who furnish that information regularly and in the ordinary course of business.”  Id. at 380-a(k).  The law exempts certain CRA’s, however, including CRA’s that act as resellers of information but do not maintain permanent data bases, check service or fraud prevention services companies, and deposit account information services.  Id. at § 380-t(p).
3  Id. at § 380-t(b).  Requests received after January 1, 2008 must be processed within four business days; requests received after January 1, 2009, must be processed within three business days.  Id.
4  Id. at § 380-t(c).
5  See Id. at § 380-a(m).
6  Id. at § 380-t(b).
7  See §§ 380-t(h) and (k).  If a freeze is to be involuntarily removed, the CRA must notify the consumer in writing prior to the removal.
8  See Id. at § 380-t(f).
9  Id. at § 380-t(d).
10 Id. at § 380-t(n).
11 Id. at § 380-t(e).
12 Id. at § 380-t(m).
13 Id. at § 380-t(k).
14 Affidavit, can be found at <http://www.ftc.gov/opa/2002/02/idtheft.htm>.
15 NY General Business Law, § 380-t(n)(1).
16 Id at §380-t(n)(2).
17 Id. at § 380-t(q(1).
18 See Id.
19 Id. at § 380-t(Q)(2).
20 Id. at § 380-t(R).
21 Id. at § 380-t(S).