ARTICLE 6L. THEFT OF CONSUMER IDENTITY PROTECTIONS.

§46A-6L-101. Definitions.

For the purposes of this article, the following terms have the following meanings:

(1) “Person” means any individual, partnership, corporation, trust, estate, cooperative, association, government or governmental subdivision or agency or other entity.

(2) “Consumer” means an individual.

(3) “Consumer-reporting agency” means any entity which, for monetary fees, dues or on a cooperative nonprofit basis, regularly engages, in whole or in part, in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing credit reports to third parties.

(4) “Credit report” means any written, oral or other communication of any information by a consumer-reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living which is used or expected to be used or collected, in whole or in part, for the purpose of serving as a factor in establishing the consumer's eligibility for:

(A) Credit or insurance to be used primarily for a personal, family, household or agricultural purpose, except that nothing in this article authorizes or prohibits the use of credit evaluations, credit scoring or insurance scoring in the underwriting of personal lines of property or casualty insurance;

(B) Employment purposes; or

(C) Any other purpose authorized under Section 15 U.S.C. §1681b as in effect on the effective date of this article.

(5) “Security freeze” means a notice, at the request of the consumer and subject to certain exceptions, that prohibits the consumer-reporting agency from releasing all or any part of the consumer's credit report or any information derived from it without the express authorization of the consumer.

(6) “Reviewing the account” or “account review” includes activities related to account maintenance, monitoring, credit line increases and account upgrades and enhancements.

§46A-6L-102. Security freeze; timing; effect; covered entities; cost.

(a) A consumer-reporting agency shall permit a consumer to place a security freeze on his or her credit report by the consumer selecting either of the following:

(1) A request in writing by certified or overnight mail to a consumer-reporting agency; or

(2) Making a request directly to the consumer-reporting agency through a secure electronic method, if available: Provided, That by January 31, 2009, a secure electronic method shall be made available to the consumer by the consumer-reporting agency.

(b) A consumer-reporting agency shall place a security freeze on a credit report no later than five business days after receiving a written request from the consumer. If a security freeze is in place, a report or information may not be distributed to a third party without prior express authorization from the consumer. This subdivision does not prevent a consumer-reporting agency from advising a third party that a security freeze is in effect with respect to the consumer's credit report. A consumer-reporting agency may, regardless of the existence of a security freeze, distribute information contained in a consumer file to the extent otherwise permitted by law if the information was lawfully obtained by or for a consumer-reporting agency from an open public record, without respect to the existence of a security freeze. Nothing herein prevents a consumer-reporting agency from choosing to apply the security freeze to the entire contents of the credit reporting file that is subject to the security freeze.

(c) The consumer-reporting agency shall send a written confirmation of the security freeze to the consumer within five business days of placing the freeze and at the same time shall provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the distribution of his or her credit information.

(d) If the consumer wishes to allow his or her credit report to be accessed for a period of time while a freeze is in place, he or she shall contact the consumer-reporting agency by regular mail or a procedure developed under subsection (f) of this section and request that the freeze be temporarily lifted, providing all of the following:

(1) Proper identification;

(2) The unique personal identification number or password provided by the consumer-reporting agency pursuant to subsection (c) of this section; and

(3) The time period for which the credit report shall be available to users of the credit report.

(e) A consumer-reporting agency that receives a request from a consumer to temporarily lift a freeze on a credit report pursuant to subsection (d) of this section shall comply with the request no later than three business days after receiving the request.

(f) A consumer-reporting agency shall develop procedures involving the use of telephone, fax, the Internet or other electronic media to receive and process a request from a consumer pursuant to subsection (d) of this section to temporarily lift a freeze on a credit report in an expedited manner.

(g) (1) Beginning on September 1, 2008, a consumer-reporting agency shall temporarily lift a security freeze from a consumer's credit report within fifteen minutes after the consumer's request is received pursuant to subsection (f) of this section by the consumer-reporting agency.

(2) A consumer-reporting agency does not have to remove a security freeze within the time provided in this subsection if:

(A) The consumer fails to meet the requirements of subsection (d) of this section; or

(B) The consumer-reporting agency's ability to remove the security freeze within fifteen minutes is prevented by:

(i) An act of God, including fire, earthquakes, hurricanes, storms or similar natural disasters or phenomena;

(ii) Unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations or similar occurrence;

(iii) Operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time or similar disruption;

(iv) Governmental action, including emergency orders or regulations, judicial or law-enforcement action or similar directives;

(v) Regularly scheduled maintenance, during other than normal business hours, of, or updates to, the consumer-reporting agency's systems; or

(vi) Commercially reasonable maintenance of, or repair to, the consumer-reporting agency's systems that is unexpected or unscheduled.

(h) A consumer-reporting agency shall remove or temporarily lift a freeze placed on a credit report only upon the request of the consumer, pursuant to subsection (d) or (j) of this section.

(i) If a third party requests access to a credit report on which a security freeze is in effect, and this request is in connection with an application for credit or any other use, and the consumer has not allowed his or her credit report to be accessed for a period of time, the third party may treat the application as incomplete.

(j) A security freeze shall remain in place until the consumer requests that the security freeze be removed. A consumer-reporting agency shall remove a security freeze within three business days of receiving a request for removal from the consumer who provides the following:

(1) Proper identification; and

(2) The unique personal identification number or password provided by the consumer-reporting agency pursuant to subsection (c) of this section.

(k) A consumer-reporting agency shall require proper identification of the person making a request to place or remove a security freeze.

(l) The provisions of this section do not apply to the distribution of a consumer credit report to any of the following:

(1) A person or the person's subsidiary, affiliate, agent or assignee with whom the consumer has or, prior to assignment, had an account, contract or debtor-creditor relationship for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract or debt;

(2) A subsidiary, affiliate, agent, assignee or prospective assignee of a person to whom access has been granted under this section for purposes of facilitating the extension of credit or other permissible use;

(3) A person acting pursuant to a court order, warrant or subpoena;

(4) A state or local agency that administers a program for establishing and enforcing child support obligations;

(5) The West Virginia Department of Human Services or its agents or assigns acting to investigate fraud;

(6) The West Virginia Department of Revenue or its agents or assigns acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities;

(7) A person for the purposes of prescreening as defined by the federal Fair Credit Reporting Act;

(8) A person or entity administering a credit file monitoring subscription service to which the consumer has subscribed; and

(9) A person or entity for the purpose of providing a consumer with a copy of his or her credit report upon the consumer's request.

(10) Any person or entity for use in setting or adjusting a rate, adjusting a claim or underwriting for insurance purposes to the extent not otherwise prohibited by law.

(m) The provisions of this section do not apply to any of the following:

(1) A consumer-reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer-reporting agency or multiple consumer credit-reporting agencies and does not maintain a permanent database of credit information from which new consumer credit reports are produced. A consumer-reporting agency acting as a reseller shall honor any security freeze placed on a consumer credit report by another consumer-reporting agency.

(2) A check services or fraud prevention services company which issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers or similar methods of payments.

(3) A deposit account information service company which issues reports regarding account closures due to fraud, a substantial number of overdrafts, ATM abuse or similar negative information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution.

(4) A consumer-reporting agency's database or file which consists of information concerning, and used for, criminal record information, fraud prevention or detection, personal loss history information and employment, tenant or background screening.

(n) Except as prohibited by subsection (o) of this section, a consumer-reporting agency may charge a reasonable fee, not to exceed $5, to a consumer who elects to place, remove or temporarily lift a security freeze on the consumer's credit report. No fees except those authorized by this subsection and subsection (p) of this section may be charged in connection with a security freeze.

(o) A consumer-reporting agency may not charge a fee for security freeze services to a consumer who is a victim of identity theft and who provides a copy of a police report, an investigative report or a written complaint made to the Federal Trade Commission, to the office of the Attorney General of West Virginia or to a law-enforcement agency concerning the identity theft.

(p) A consumer may be charged a reasonable fee, not to exceed $5, if the consumer fails to retain the original unique personal identification number or password provided by the consumer-reporting agency and must be reissued the same or a new unique personal identification number or password.

§46A-6L-103. Notice of rights.

(a) At any time that a consumer is required to receive a summary of rights required under Section 609 of the federal Fair Credit Reporting Act, 15 U.S.C. §1681g, as in effect on the effective date of this article, the following notice shall be included:

“West Virginia consumers have the right to obtain a security freeze.

You may obtain a security freeze on your credit report to protect your privacy and ensure that credit is not granted in your name without your knowledge. You have a right to place a security freeze on your credit report pursuant to West Virginia law.

The security freeze will prohibit a consumer-reporting agency from releasing any information in your credit report without your express authorization or approval.

The security freeze is designed to prevent credit, loans and services from being approved in your name without your consent. When you place a security freeze on your credit report, within five business days you will be provided a unique personal identification number or password to use if you choose to remove the freeze on your credit report or to temporarily authorize the distribution of your credit report for a period of time after the freeze is in place. To provide that authorization, you must contact the consumer-reporting agency and provide all of the following:

(1) The unique personal identification number or password provided by the consumer-reporting agency;

(2) Proper identification to verify your identity; and

(3) The period of time for which the report shall be available to users of the credit report.

A consumer-reporting agency that receives a request from a consumer to temporarily lift a freeze on a credit report shall comply with the request no later than three business days after receiving the request.

A security freeze does not apply to circumstances in which you have an existing account relationship and a copy of your report is requested by your existing creditor or its agents or affiliates for certain types of account review, collection, fraud control or similar activities.

If you are actively seeking credit, you should understand that the procedures involved in lifting a security freeze may slow your own applications for credit. You should plan ahead and lift a freeze, either completely if you are shopping around or specifically for a certain creditor, a few days before actually applying for new credit.

You have the right to bring a civil action against someone who violates your rights under the credit reporting laws. The action can be brought against a consumer-reporting agency."

(b) If a consumer requests information about a security freeze, he or she shall be provided with the notice provided in this section about how to place, temporarily lift and remove a security freeze.

§46A-6L-104. Violations; penalties.

(a) If a consumer-reporting agency negligently violates the security freeze by releasing credit information that has been placed under a security freeze, the affected consumer is entitled to:

(1) Notification within five business days following discovery or actual knowledge of the distribution of the information, including specificity as to the information distributed and the third-party recipient of the information.

(2) File a complaint with the Federal Trade Commission or the office of the Attorney General of West Virginia.

(3) File a civil action against the consumer-reporting agency seeking:

(A) Injunctive relief to prevent or restrain further violation of the security freeze;

(B) Actual damages sustained or not more than $1,000, whichever is greater; and

(C) Reasonable expenses, court costs, investigative costs and attorney's fees.

(4) Each violation of the security freeze is a separate incident for purposes of imposing penalties under this section.

(b) If a consumer-reporting agency willfully violates the security freeze by releasing credit information that has been placed under a security freeze, the affected consumer is entitled to:

(1) Notification within five business days following discovery or actual knowledge of the distribution of the information, including specificity as to the information distributed and the third-party recipient of the information.

(2) File a complaint with the Federal Trade Commission or the office of the Attorney General of West Virginia.

(3) File a civil action against the consumer-reporting agency seeking:

(A) Injunctive relief to prevent or restrain further violation of the security freeze;

(B) Actual damages sustained or not more than $5,000, whichever is greater; and

(C) Reasonable expenses, court costs, investigative costs and attorney's fees.

(4) Each violation of the security freeze is a separate incident for purposes of imposing penalties under this section.

§46A-6L-105. Unfair or deceptive acts or practices.

Any violation of this article constitutes an unlawful act or practice under the provisions of article six of this chapter regarding fraudulent acts or practices committed by a person in connection with a consumer transaction and shall be subject to the enforcement provisions of article seven of this chapter.