[ Search ] [ PDF text ] [ Legislation ]
[ Home ] [ Back ] [ Bottom ]
92_HB5582
LRB9215080JSpc
1 AN ACT concerning personal information.
2 Be it enacted by the People of the State of Illinois,
3 represented in the General Assembly:
4 Section 1. Short title. This Act may be cited as the
5 Personal Information Protection Act.
6 Section 5. Credit report security alert.
7 (a) A consumer may elect to place a security alert in
8 his or her credit report by making a request in writing or by
9 telephone to a consumer credit reporting agency.
10 (b) A consumer credit reporting agency shall notify each
11 person requesting consumer credit information with respect to
12 a consumer of the existence of a security alert in the credit
13 report of that consumer, regardless of whether a full credit
14 report, credit score, or summary report is requested.
15 (c) A consumer credit reporting agency shall maintain a
16 toll-free telephone number to accept security alert requests
17 from consumers 24 hours a day, 7 days a week.
18 (d) The toll-free telephone number shall be included in
19 any written disclosure by a consumer credit reporting agency
20 to any consumer pursuant to Section 20 and shall be printed
21 in a clear and conspicuous manner.
22 (e) A consumer credit reporting agency shall place a
23 security alert on a consumer's credit report no later than 72
24 hours after receiving a request from the consumer.
25 (f) The security alert shall remain in place for at
26 least 90 days, and a consumer shall have the right to request
27 a renewal of the security alert.
28 Section 10. Credit report security freeze.
29 (a) A consumer may elect to place a security freeze on
30 his or her credit report by making a request in writing to a
-2- LRB9215080JSpc
1 consumer credit reporting agency. When a security freeze is
2 in place, information from a consumer's credit report may not
3 be released to a third party without prior express
4 authorization from the consumer.
5 (b) A consumer credit reporting agency shall place a
6 security freeze on a consumer's credit report no later than
7 72 hours after receiving a written request from the consumer.
8 (c) The consumer credit reporting agency shall send a
9 written confirmation of the security freeze to the consumer
10 within 10 days after receiving the request and shall provide
11 the consumer with a unique personal identification number or
12 password to be used by the consumer when providing
13 authorization for the release of his or her credit for a
14 specific purpose.
15 (d) If the consumer wishes to allow his or her credit
16 report to be accessed for a specific purpose while a freeze
17 is in place, he or she shall contact the credit reporting
18 agency and provide all of the following:
19 (1) Proper identification, as defined in
20 subdivision (c) of Section 20.
21 (2) The unique personal identification number or
22 password provided by the credit reporting agency pursuant
23 to subsection (c).
24 (3) The proper information regarding the third
25 party who is to receive the credit report.
26 (e) If a consumer requests a security freeze, the
27 consumer credit reporting agency shall disclose the process
28 of placing and lifting a freeze and the process for allowing
29 access to information from the consumer's credit report for a
30 specific purpose while the freeze is in place.
31 (f) A security freeze shall remain in place until the
32 consumer requests in writing that the security freeze be
33 removed. A consumer credit reporting agency shall remove a
34 security freeze within 72 hours of receiving a request for
-3- LRB9215080JSpc
1 removal in writing from the consumer.
2 (g) A consumer credit reporting agency shall require
3 proper identification, as defined in subsection (c) of
4 Section 20, of the person making a request to place or remove
5 a security freeze.
6 (h) The provisions of this Section shall not apply to
7 the use of a consumer report by any of the following:
8 (1) A person or entity, or a subsidiary, affiliate,
9 or agent of that person or entity, or an assignee of a
10 financial obligation owing by the consumer to that person
11 or entity, with which the consumer has or had prior to
12 assignment an account or contract, or to whom the
13 consumer issued a negotiable instrument, for the purposes
14 of reviewing the account or collecting the financial
15 obligation owing for the account, contract, or negotiable
16 instrument. For purposes of this paragraph, "reviewing
17 the account" includes activities related to account
18 maintenance, monitoring, credit line increases, and
19 account upgrades and enhancements.
20 (2) A law enforcement agency acting pursuant to a
21 court order, warrant, or subpoena.
22 (3) A child support agency acting pursuant to the
23 Illinois Public Aid Code or Title IV-D of the Social
24 Security Act (42 U.S.C. et seq.).
25 (4) The Department of Revenue or the Internal
26 Revenue Service, or their agents or assigns, acting to
27 investigate or collect delinquent taxes.
28 (5) The use of credit information for the purposes
29 of prescreening as provided for by the federal Fair
30 Credit Reporting Act.
31 Section 15. Modification of information; notice. If a
32 security alert or security freeze is in place, a consumer
33 credit reporting agency shall not modify any of the following
-4- LRB9215080JSpc
1 information in a consumer credit report without sending a
2 written confirmation of the change to the consumer: last
3 name, date of birth, age, Social Security number, address,
4 and telephone number.
5 In the case of an address change, the written
6 confirmation shall be sent to both the new address and to the
7 former address.
8 Section 20. Disclosure of credit information.
9 (a) A consumer credit reporting agency shall supply
10 files and credit report information during normal business
11 hours and on reasonable notice. A consumer has the right to
12 request and receive all of the following:
13 (1) Either a decoded written version of the file or
14 a written copy of the file, including all information in
15 the file at the time of the request, with an explanation
16 of any code used.
17 (2) A credit score for the consumer, the key
18 factors, and the related information.
19 (3) A record of all inquiries, by recipient, which
20 result in the provision of information concerning the
21 consumer in connection with a credit transaction that is
22 not initiated by the consumer and which were received by
23 the consumer credit reporting agency in the 12-month
24 period immediately preceding the request for disclosure
25 under this Section.
26 (4) The recipients, including end users, of any
27 consumer credit report on the consumer which the consumer
28 credit reporting agency has furnished:
29 (A) for employment purposes within the 2-year
30 period preceding the request; or
31 (B) for any other purpose within the 12-month
32 period preceding the request.
33 Identification for purposes of this subsection shall
-5- LRB9215080JSpc
1 include the name of the recipient or, if applicable, the
2 fictitious business name under which the recipient does
3 business disclosed in full. If requested by the consumer, the
4 identification shall also include the address of the
5 recipient.
6 (b) Files maintained on a consumer shall be disclosed
7 promptly as follows:
8 (1) In person, at the location where the consumer
9 credit reporting agency maintains the trained personnel
10 required by subsection (d), if he or she appears in
11 person and furnishes proper identification.
12 (2) By mail, if the consumer makes a written
13 request with proper identification for a copy of the file
14 or a decoded written version of that file to be sent to
15 the consumer at a specified address. A disclosure
16 pursuant to this paragraph shall be deposited in the
17 United States mail, postage prepaid, within 5 business
18 days after the consumer's written request for the
19 disclosure is received by the consumer credit reporting
20 agency. Consumer credit reporting agencies complying with
21 requests for mailings under this Section shall not be
22 liable for disclosures to third parties caused by
23 mishandling of mail after the mailings leave the consumer
24 reporting agencies.
25 (3) A summary of all information contained in files
26 on a consumer shall be provided by telephone, if the
27 consumer has made a written request, with proper
28 identification for telephone disclosure.
29 (4) Information in a consumer's file required to be
30 provided in writing under this Section may also be
31 disclosed in another form if authorized by the consumer
32 and if available from the consumer credit reporting
33 agency. For this purpose a consumer may request
34 disclosure in person, by telephone upon disclosure of
-6- LRB9215080JSpc
1 proper identification by the consumer, by electronic
2 means if available from the consumer credit reporting
3 agency, or by any other reasonable means that is
4 available from the consumer credit reporting agency.
5 (c) "Proper identification," as used in subsection (b)
6 means that information generally deemed sufficient to
7 identify a person. Only if the consumer is unable to
8 reasonably identify himself or herself may a consumer credit
9 reporting agency require additional information concerning
10 the consumer's employment and personal or family history in
11 order to verify his or her identity.
12 (d) The consumer credit reporting agency shall provide
13 trained personnel to explain to the consumer any information
14 furnished to him or her.
15 (e) The consumer shall be permitted to be accompanied by
16 one other person of his or her choosing, who shall furnish
17 reasonable identification. A consumer credit reporting agency
18 may require the consumer to furnish a written statement
19 granting permission to the consumer credit reporting agency
20 to discuss the consumer's file in that person's presence.
21 (f) Any written disclosure by a consumer credit
22 reporting agency to any consumer pursuant to this Section
23 shall include a written summary of all rights the consumer
24 has under this Act and in the case of a consumer credit
25 reporting agency that compiles and maintains consumer credit
26 reports on a nationwide basis, a toll-free telephone number
27 that the consumer can use to communicate with the consumer
28 credit reporting agency. The written summary of rights
29 required under this Act is sufficient if in substantially the
30 following form:
31 "You have a right to obtain a copy of your credit file
32 from a consumer credit reporting agency. You may be charged a
33 reasonable fee not exceeding $8. There is no fee, however, if
34 you have been turned down for credit, employment, insurance,
-7- LRB9215080JSpc
1 or a rental dwelling because of information in your credit
2 report within the preceding 60 days. The consumer credit
3 reporting agency must provide someone to help you interpret
4 the information in your credit file.
5 You have a right to dispute inaccurate information by
6 contacting the consumer credit reporting agency directly.
7 However, neither you nor any credit repair company or credit
8 service organization has the right to have accurate, current,
9 and verifiable information removed from your credit report.
10 Under the federal Fair Credit Reporting Act, the consumer
11 credit reporting agency must remove accurate, negative
12 information from your report only if it is over 7 years old.
13 Bankruptcy information can be reported for 10 years.
14 If you have notified a credit reporting agency in writing
15 that you dispute the accuracy of information in your file,
16 the consumer credit reporting agency must then, within 30
17 business days, reinvestigate and modify or remove inaccurate
18 information. The consumer credit reporting agency may not
19 charge a fee for this service. Any pertinent information and
20 copies of all documents you have concerning an error should
21 be given to the consumer credit reporting agency.
22 If reinvestigation does not resolve the dispute to your
23 satisfaction, you may send a brief statement to the consumer
24 credit reporting agency to keep in your file explaining why
25 you think the record is inaccurate. The consumer credit
26 reporting agency must include your statement about disputed
27 information in a report it issues about you.
28 You have a right to receive a record of all inquiries
29 relating to a credit transaction initiated in 12 months
30 preceding your request. This record shall include the
31 recipients of any consumer credit report.
32 You may request in writing that the information contained
33 in your file not be provided to a third party for marketing
34 purposes.
-8- LRB9215080JSpc
1 You have a right to place a "security alert" in your
2 credit report, which will warn anyone who receives
3 information in your credit report that your identity may have
4 been used without your consent and verification of identity
5 is advised. A security alert may be requested by calling the
6 following toll-free number: (Insert applicable toll-free
7 number).
8 You have a right to place a "security freeze" on your
9 credit report, which will prohibit a consumer credit
10 reporting agency from releasing any information in your
11 credit report without your express authorization. A security
12 freeze must be requested in writing and may delay or
13 interfere with the approval of any application you file for a
14 new loan, credit, insurance, or service. When you place a
15 security freeze on your credit report, you will be provided a
16 personal identification number or password to use if you
17 choose to authorize the release of your credit report for a
18 specific purpose after the freeze is in place. To provide
19 that authorization you must contact the consumer credit
20 reporting agency and provide all of the following:
21 (1) The personal identification number or password.
22 (2) Proper identification to verify your identity.
23 (3) The proper information regarding the third
24 party who is to receive the credit report.
25 A security freeze does not apply to a person or entity,
26 or its affiliates, or collection agencies acting on behalf
27 the person or entity, with which you have an existing
28 account, that requests information in your credit report for
29 the purposes of reviewing or collecting the account.
30 Reviewing the account includes activities related to account
31 maintenance, monitoring, credit line increases, and account
32 upgrades and enhancements.
33 You have a right to bring civil action against anyone,
34 including a consumer credit reporting agency, who improperly
-9- LRB9215080JSpc
1 obtains access to a file, knowingly or willfully misuses file
2 data, or fails to correct inaccurate file data.".
3 Section 25. Confidentiality of social security numbers.
4 (a) A person or entity or State or local agency shall
5 not do any of the following:
6 (1) Publicly post or display in any manner an
7 individual's Social Security number.
8 (2) Print an individual's Social Security number on
9 any card required for the individual to access products
10 or services provided by the person, entity, or State or
11 local agency.
12 (3) Require an individual to transmit his or her
13 Social Security number over the Internet unless the
14 connection is secure or the Social Security number is
15 encrypted.
16 (4) Require an individual to use his or her Social
17 Security number to access an Internet website, unless a
18 password or unique personal identification number is also
19 required to access the website.
20 (5) Print an individual's Social Security number on
21 any materials that are mailed to the individual, unless
22 State or federal law requires the Social Security number
23 to be on the document to be mailed. Notwithstanding this
24 provision, applications and forms sent by mail may
25 include Social Security numbers.
26 (b) Except as provided in subsection (c), subsection (a)
27 applies only to the use of Social Security numbers on or
28 after July 1, 2003.
29 (c) Notwithstanding any other provision of law, a person
30 or entity or State or local agency that has used, prior to
31 July 1, 2003, an individual's Social Security number in a
32 manner inconsistent with subsection (a), may continue using
33 that individual's Social Security number in that manner on or
-10- LRB9215080JSpc
1 after July 1, 2003, if all of the following conditions are
2 met:
3 (1) The use of the Social Security number is
4 continuous. If the use is stopped for any reason,
5 subsection (a) shall apply.
6 (2) The individual is provided an annual
7 disclosure, commencing in the year 2004, that informs the
8 individual that he or she has the right to stop the use
9 of his or her Social Security number in a manner
10 prohibited by subsection (a).
11 (3) A written request by an individual to stop the
12 use of his or her Social Security number in a manner
13 prohibited by subsection (a) shall be implemented within
14 30 days after the receipt of the request. There shall be
15 no fee or charge for implementing the request.
16 (4) A person or entity or State or local agency
17 shall not deny services to an individual because the
18 individual makes a written request pursuant to this
19 subsection.
20 (d) This Section shall not prevent a State or local
21 agency from using a Social Security number for internal
22 verification and administrative purposes, providing that the
23 use does not result in, or require the release of, the Social
24 Security number to persons not designated by the public
25 agency to perform associated functions authorized by law.
26 (e) This Section shall become inoperative with respect
27 to a provider of health care, a health care service plan, or
28 a licensed health care professional on and after the date a
29 federal law takes effect requiring the United States
30 Department of Health and Human Services to establish a
31 national unique patient health identifier program.