[§489P-1] Purpose. The Federal
Trade Commission recently determined that between October 1998,
and September 2003, more than twenty-seven million three hundred
Americans have been victims of identity theft, resulting in billions
of dollars of losses to consumers. The purpose of this chapter
is to protect Hawaii consumers who are victims of identity theft
by allowing them to place a security freeze on their credit reports. This
security freeze will prohibit a consumer reporting agency from
releasing any information to unauthorized parties without the consumer's
express authorization and provide consumers more control over who
has access to their credit report. This chapter aims to effectively
prevent identity thieves from continuing to secure credit in an
identity theft victim's name. [L 2006, c 138, pt of §1]
[§489P-2] Definitions. When
used in this chapter, unless the context otherwise requires:
"Consumer credit reporting agency" or "consumer
reporting agency" means any person who, for monetary fees or
dues or on a cooperative nonprofit basis, regularly engages in
whole or in part in the practice of assembling or evaluating
consumer credit information or other information on consumers
for the purpose of furnishing credit reports to third parties,
but does not include any governmental agency whose records are
maintained primarily for law enforcement or licensing purposes.
"Credit report" means any written,
oral, or other communication of any credit information by a consumer
reporting agency, as defined in the federal Fair Credit Reporting
Act, which operates or maintains a database of consumer credit
information bearing on a consumer's credit worthiness, credit
standing, or credit capacity.
"Identity theft" means the unauthorized
use of another person's identifying information to obtain credit,
goods, services, money, or property.
"Security freeze" means a notice placed
in a credit report, at the request of the consumer who is a victim
of identity theft. [L 2006, c 138, pt of §1]
§489P-3 Security freeze by consumer reporting
agency. (a) Any consumer who is a
resident of this State may place a security freeze on the consumer's
credit report. A consumer credit reporting agency shall
not charge a victim of identity theft a fee for placing, lifting,
or removing a security freeze on a credit report but may charge
any other consumer a fee not to exceed $5 for each request by
the consumer to place, lift, or remove a security freeze from
the consumer's credit report.
A consumer who is a resident of this
State and has been the victim of identity theft may place a security
freeze on the consumer's credit report by making a request in writing
by certified mail to a consumer credit reporting agency, at an
address designated by the agency to receive such requests, with
a valid copy of a police report, investigative report, or complaint
the consumer has filed with a law enforcement agency about unlawful
use of the consumer's personal information by another person. A
consumer who has not been the victim of identity theft may place
a security freeze on the consumer's credit report by making a
request in writing by certified mail to a consumer credit reporting
agency.
A security freeze shall prohibit the
consumer credit reporting agency from releasing the consumer's
credit report or any information from it without the express authorization
of the consumer. This subsection shall not prevent a consumer
credit reporting agency from advising a third party that a security
freeze is in effect with respect to the consumer's credit report.
(b) A consumer reporting agency
shall place a security freeze on a consumer's credit report no
later than five business days after receiving a written request
from the consumer.
(c) The consumer reporting agency
shall send a written confirmation of the security freeze to the
consumer within ten business days of placing the security freeze
and shall provide the consumer with a unique personal identification
number or password, other than the consumer's social security
number, to be used by the consumer when providing authorization
for the release of the consumer's credit report for a specific
party, parties, or period of time.
(d) If the consumer wishes to
allow access to the consumer's credit report for a specific party,
parties, or period of time while a freeze is in place, the consumer
shall contact the consumer reporting agency at a point of contact
designated by the agency using the procedures that may be developed
by the consumer reporting agency, request that the freeze be
temporarily lifted, and provide the following:
(1) Clear and proper identification;
(2) The unique personal identification
number or password provided by the consumer reporting agency;
and
(3) Clear and proper information
regarding the third party, parties, or time period for which
the report shall be available to users of the credit report.
(e) A consumer reporting agency
may develop procedures involving the use of telephone, fax, the
Internet, or other electronic media to receive and process a
request from a consumer to temporarily lift a freeze on a credit
report in an expedited manner.
(f) A consumer reporting agency
that receives a request from a consumer to temporarily lift a
freeze on a credit report shall comply with the request no later
than three business days after receiving the request.
(g) A consumer reporting agency
shall remove or temporarily lift a freeze placed on a consumer's
credit report only in the following cases:
(1) Upon consumer request; or
(2) When the consumer's credit
report was frozen due to a material misrepresentation of fact
by the consumer.
If a consumer reporting agency intends to remove a freeze upon
a consumer's credit report pursuant to this subsection, the consumer
reporting agency shall notify the consumer in writing prior to
removing the freeze on the consumer's credit report.
(h) If a third party requests
access to a credit report on which a security freeze is in effect
and this request is in connection with an application for credit
or any other use and the consumer does not allow the consumer's
credit report to be accessed by that specific party or for that
period of time, the third party may treat the application as
incomplete.
(i) If a consumer requests a
security freeze, the consumer reporting agency shall disclose
to the consumer the process of placing and temporarily lifting
a security freeze and the process for allowing access to information
from the consumer's credit report for a specific party, parties,
or period of time while the security freeze is in place.
(j) A security freeze shall remain
in place until the consumer requests that the security freeze be
removed. A consumer reporting agency shall remove a security
freeze within three business days of receiving a request for
removal at a point of contact designated by the agency using
procedures that may be developed by the consumer reporting agency;
provided that the consumer shall provide the following:
(1) Clear and proper identification;
and
(2) The unique personal identification
number or password provided by the consumer reporting agency
pursuant to subsection (c).
(k) A consumer reporting agency
shall require clear and proper identification of the person making
a request to place or remove a security freeze.
(l) The provisions of this section,
including the security freeze, do not apply to the use of a consumer’s
credit report by the following:
(1) A person, or the person's subsidiary,
affiliate, agent, or assignee with which the consumer has or, prior
to assignment, had an account, contract, or debtor-creditor relationship
for the purposes of reviewing the account or collecting the financial
obligation owing for the account, contract, or debt, or extending
credit to a consumer with a prior or existing account, contract,
or debtor-creditor relationship. For purposes of this subsection, "reviewing
the account" includes activities related to account maintenance,
monitoring, credit line increases, and account upgrades and enhancements;
(2) A subsidiary, affiliate,
agent, assignee, or prospective assignee of a person to whom
access has been granted for purposes of facilitating the extension
of credit or other permissible use;
(3) Any person acting pursuant
to a court order, warrant, or subpoena;
(4) A child support enforcement
agency when investigating a child support case pursuant to Title
IV-D of the Social Security Act (42 U.S.C. Sections 651 to 669b);
(5) The department of the attorney
general or county prosecuting attorneys or their agents or assignees
acting to investigate medicaid fraud;
(6) The department of taxation,
county taxing authorities, or any of their agents or assignees,
acting to investigate or collect delinquent taxes or assessments,
including interest and penalties, unpaid court orders, or to
fulfill any of their other statutory or charter responsibilities;
(7) The use of credit information
for the purposes of prescreening as provided by the federal Fair
Credit Reporting Act (15 U.S.C. Sections 1681 to 1681x);
(8) Any person for the sole purpose
of providing a credit file monitoring subscription service to
which the consumer has subscribed;
(9) A person for the sole purpose
of providing a consumer with a copy of the consumer's credit
report upon the consumer's request; and
(10) Any person or entity using a credit
report in setting or adjusting a rate, adjusting a claim, or underwriting
for insurance purposes. [L 2006, c 138, pt of §1; am L 2007,
c 189, §1]
[§489P-4] Consumer reporting agency duties
if security freeze in place. If a security freeze
is in place, a consumer reporting agency shall not change any
of the following official information in a credit report without
sending a written confirmation of the change to the consumer
within thirty days of the change being posted to the consumer's
file: name, date of birth, social security number, and
address. Written confirmation shall not be required for
technical modifications of a consumer's official information,
including name and street abbreviations, complete spellings,
or transposition of numbers or letters. In the case of
an address change, the written confirmation shall be sent to
both the new address and the former address. [L 2006, c 138,
pt of §1]
[§489P-5] Persons not required to place security
freeze. The requirement under this chapter to
place a security freeze on a credit report shall not apply to:
(1) A check services or fraud
prevention services company that reports on incidents of fraud
or issues authorizations for the purpose of approving or processing
negotiable instruments, electronic fund transfers, or similar
methods of payment;
(2) A deposit account information
service company that issues reports regarding account closures
due to fraud, substantial overdrafts, ATM abuse, or similar negative
information regarding a consumer to inquiring banks or other
financial institutions for use only in reviewing a consumer request
for a deposit account at the inquiring bank or financial institution;
(3) A consumer reporting agency
that:
(A) Acts
only to resell credit information by assembling and merging information
contained in a database of one or more consumer reporting agencies;
and
(B) Does
not maintain a permanent database of credit information from which
new credit reports are produced. [L 2006, c 138, pt of §1]
[§489P-6] Violation, penalties. (a) A
person who violates any provision of this chapter shall be subject
to penalties of not more than $2,500 for each violation. The
attorney general or the executive director of the office of consumer
protection may bring an action pursuant to this section.
(b) In addition to any penalty
provided for in subsection (a), any person who violates any provision
of this chapter shall be liable to the injured party in an amount
equal to the sum of any actual damages sustained by the injured
party as a result of the violation. The court in any action
brought under this section may award reasonable attorneys' fees
to the prevailing party.
(c) The penalties provided in this
section shall be cumulative to the remedies or penalties available
under all other laws of the State. [L 2006, c 138, pt of §1]
Identity
theft complaints in Hawaii totaled 615 in 2006, according to the
Federal Trade Commission. Among the top ID theft complaints were
credit card fraud (38%), phone or utilities fraud
(16%), bank fraud (15%), government documents or benefits fraud (6%),
employment-related fraud (9%), and loan fraud (6%). Hawaii identity
theft information and links are listed below.