Placing, lifting and removal of security freezes

201 CMR: OFFICE OF CONSUMER AFFAIRS AND BUSINESS REGULATION

201 CMR 16.00: PLACING, LIFTING AND REMOVAL OF SECURITY FREEZES

Section

16.01: Purpose and Scope 16.02: Definitions 16.03: Providing Information to Consumers Regarding Security Freezes 16.04: Placing a Security Freeze 16.05: Temporarily Lifting a Security Freeze 16.06: Removing a Security Freeze 16.07: Removal of Security Freeze Due to Material Misrepresentation of Fact 16.08: Changing Official Information 16.09: Lost Personal Identification or Password 16.10: Fees

16.01: Purpose and Scope

(1) Purpose. .00 implements the provisions of M.G.L. c. 93, § 62A relative to the methods of requesting, temporarily lifting and removing security freezes for the benefit of consumers. .00 also establishes standards for expediting the methods of placing, temporarily lifting and removing security freezes, including how certain information in connection therewith should be provided.

(2) Scope. The provisions of .00 relating to security freezes applies to all persons subject to M.G.L. c. 93, §§ 50, 55, 56, 58, 62A, 62B, 63 and 64.

16.02: Definitions

The following definitions shall, unless the context requires otherwise, have the following meanings:

Consumer Report. Any written, oral or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing or credit capacity which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for: (a) credit or insurance to be used primarily for personal, family, or household purposes; or (b) employment purposes; or (c) other purposes authorized under M.G.L. c. 93, § 51. Consumer Report does not include any report containing information solely as to transactions or experiences between the consumer and the person making the report, any authorization or approval of a specific extension of credit directly or indirectly by the issuer of a credit card or similar device, or any report in which a person who has been requested by a third-party to make a specific extension of credit directly or indirectly to a consumer conveys his or her decision with respect to such request, if the third-party advises the consumer of the name and address of the person to whom the request was made and such person makes the disclosures to the consumer required under M.G.L. c. 93, § 62.

Consumer Reporting Agency. Any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties.

Electronic. Relating to technology having electrical, digital, magnetic, wireless, optical, electromagnetic or similar capabilities.

Identity Theft Report. A report that alleges a violation of M.G.L. c. 266, § 37E, 18 USC § 1028, or a similar statute in any other jurisdiction, or a copy of a report filed by a consumer with an appropriate federal, state or local law enforcement agency, and the filing of which subjects the person filing the report to criminal penalties pursuant to M.G.L. c. 266, § 67B or M.G.L. c. 269, § 13A.

10/2/20 201 CMR - 85

201 CMR: OFFICE OF CONSUMER AFFAIRS AND BUSINESS REGULATION

16.02: continued

Lift. To suspend a security freeze for the purpose of releasing a consumer’s credit information to a specific party or for a specified period of time, as authorized by the consumer.

Official Information. A consumer’s name, date of birth, Social Security number, and address.

Person. A natural person, corporation, association, partnership or other legal entity.

Personal Identification Number or Password. A unique and random number or a unique and random combination of numbers, letters or symbols, which cannot contain a consumer's Social Security number or any sequence of three or more numbers of a consumer's Social Security number, or other personal identifying information.

Proper Identification. Information sufficient to identify a person. Proper identification includes, but is not limited to: name, address, Social Security number and date of birth. Proper identification does not include information concerning a consumer’s employment and personal or family history, unless the consumer is unable to reasonably identify himself with the above information.

Remove. To permanently terminate a security freeze.

Security Freeze. A notice placed on a person’s consumer report by a consumer reporting agency at the request of the consumer and subject to certain exceptions. A security freeze prohibits the consumer reporting agency from releasing the consumer report or any information derived from the consumer report without the express prior authorization of the consumer.

16.03: Providing Information to Consumers Regarding Security Freezes

Each consumer reporting agency shall provide to consumers, by posting on its website (including an obvious link to the information on its home page), complete easily accessible information, in plain language, concerning the steps necessary and documents and information required to place, lift and remove a security freeze on a consumer report. Such information shall include: (a) all identifying information that the consumer reporting agency requires from a consumer in order to place, temporarily lift or remove a security freeze on a consumer report, as set forth in M.G.L. c. 93, § 50; (b) the methods by which a consumer can make a request to the consumer reporting agency to place, temporarily lift or remove a security freeze on a consumer report which include toll free telephone, secure electronic communication, or a written request by certified or overnight mail or regular stamped mail to an electronic or postal address designated by the consumer reporting agency to receive such requests; (c) a notice that the consumer must place a security freeze with each consumer reporting agency separately; and (d) information on the procedures to replace a lost personal identification number or password. In addition, each consumer reporting agency shall provide a toll-free number to consumers who are unable to place, temporarily lift or remove a security freeze for any reason including, but not limited to, lack of access to or failure of any automated electronic means established by that consumer reporting agency to effectuate the placing, temporary lifting or removal of a security freeze that affords the consumer, during regular business hours, Eastern Standard Time, access to a live representative of the consumer reporting agency who can supply any additional information reasonably needed by the consumer to place, temporarily lift or remove a security freeze.

16.04: Placing a Security Freeze

Upon receipt of a consumer’s request to place a security freeze on his or her consumer report made in accordance with the procedures in .04, a consumer reporting agency shall: (a) disclose to the consumer the process of placing a security freeze;

10/2/20 201 CMR - 86

201 CMR: OFFICE OF CONSUMER AFFAIRS AND BUSINESS REGULATION

16.04: continued

(b) place the security freeze on the consumer report as soon as practicable and without unreasonable delay, but under no circumstances any later than three business days after receiving a request from the consumer; (c) send a written confirmation of the security freeze to the consumer as soon as practicable and without unreasonable delay, but in any event within five business days after receiving the request, together with instructions on the procedures for temporarily lifting or removing a security freeze, and a toll-free number that a consumer may use for any further questions; (d) provide the consumer at the time of the written confirmation with a unique and random personal identification number or a unique and random combination of numbers, letters or symbols, which shall not contain the consumer’s Social Security number or any sequence of three or more numbers of the consumer’s Social Security number, or other personal identifying information, to be used by the consumer for the purpose of providing authorization for the removal or temporary lifting of the security freeze or for other communications with the consumer reporting agency; and (e) provide a copy of the notice relevant to security freezes set forth in M.G.L. c. 93, § 56(b).

16.05: Temporarily Lifting a Security Freeze

Upon receipt of a consumer’s request to temporarily lift a security freeze, the consumer reporting agency shall lift the security freeze as soon as practicable and without unreasonable delay, but under no circumstances any later than three business days after receiving the request, provided that the consumer has properly supplied the following: (a) the information necessary for proper identification specified in the information given to the consumer pursuant to .04(d); and (b) the identity of the third-party who is to receive the consumer report or the specified period of time for which the report shall be available to authorized users of the consumer report.

16.06: Removing a Security Freeze

Where a consumer reporting agency has received a request from the consumer to remove a security freeze it shall remove the security freeze as soon as practicable and without unreasonable delay, but in any event within three business days of receiving a request, provided that the consumer has supplied the information necessary for proper identification specified in the information given to the consumer pursuant to .04(d).

16.07: Removal of Security Freeze Due to Material Misrepresentation of Fact

If a consumer reporting agency intends to remove a security freeze based on a material misrepresentation of fact by a consumer, the consumer reporting agency shall notify the consumer in writing at least five business days prior to removing the freeze on the consumer report. Notification shall not be deemed to have occurred until receipt by the consumer of the notice from the consumer reporting agency. The notification to the consumer shall state the basis upon which the consumer reporting agency has concluded that there was a material misrepresentation of fact; state the action that the consumer reporting agency intends to take and the effective date of that action; and provide information for contacting the consumer reporting agency, including a telephone number, to dispute its findings, pursuant to M.G.L. c. 93, § 56(b).

16.08: Changing Official Information

Until a security freeze placed on a consumer report is removed, a consumer reporting agency shall not change any of the official information in a consumer report without sending a written confirmation of the change to the consumer as soon as practicable and without unreasonable delay, but under no circumstances any later than within 30 days of the change being posted to the consumer report. Written confirmation shall not be required for technical modifications of information contained in a consumer report, such as name and street abbreviations, complete spellings, or corrective transposition of numbers or letters. The written confirmation shall:

10/2/20 201 CMR - 87

201 CMR: OFFICE OF CONSUMER AFFAIRS AND BUSINESS REGULATION

16.08: continued

(a) state the official information that is being changed; (b) advise the consumer that he or she must contact the consumer reporting agency if the change in the official information is disputed; and (c) in the case of an address change, the written confirmation shall be sent to both the new address and to the former address.

16.09: Lost Personal Identification Number or Password

Upon receipt of notification, conforming to the procedures referenced in .03(e), that a resident has lost his or her personal identification number or password, the consumer reporting agency shall cancel the lost personal identification number or password and, as soon as practicable thereafter and without unreasonable delay, but in no event later than three business days after receipt of such notification, mail to such resident a new personal identification number or password, provided that the resident has supplied the information necessary for proper identification given pursuant to 201CMR 16.03(a). The new personal identification number or password shall not contain the resident’s Social Security Number or any sequence of three or more numbers of the resident’s Social Security Number.

16.10: Fees

No consumer reporting agency may charge a fee to any consumer who elects to place, temporarily lift or remove a security freeze on a consumer report in accordance with M.G.L. c. 93, § 62A, and 15 U.S.C. § 1681 c-1 and to the extent permitted by federal law. No fee may be charged to a victim of identity theft or his or her spouse if a copy of a valid identity theft report relating to the identity theft has been submitted to the consumer reporting agency.

REGULATORY AUTHORITY

.00: M.G.L. c. 93, § 62A.

10/2/20 201 CMR - 88