SB 472 — AN ACT CONCERNING SECURITY FREEZES ON CREDIT REPORTS, IDENTITY THEFT PREVENTION SERVICES AND REGULATIONS OF CREDIT RATING AGENCIES.

AN ACT CONCERNING FEES FOR SECURITY FREEZES ON CREDIT REPORTS, NOTIFICATIONIDENTITY OFTHEFT APREVENTION CONSUMER'SSERVICES, DECISIONEMPLOYER TO PLACE OR REMOVE A SECURITY FREEZE ON A CREDIT REPORTINQUIRIES AND THEREGULATIONS DURATION OF CERTAINCREDIT IDENTITYRATING THEFTAGENCIES. PREVENTION SERVICES REQUIRED AFTER A DATA BREACH.

General Assembly   RaisedSubstitute Bill No.

472 February Session, 2018   LCO*_____SB00472BA____032118____* No.AN ACT CONCERNING SECURITY FREEZES ON CREDIT REPORTS, IDENTITY THEFT PREVENTION SERVICES, EMPLOYER CREDIT INQUIRIES AND REGULATIONS OF CREDIT RATING AGENCIES.

1724   *01724_______BA_* Referred to Committee on BANKING   Introduced by:

  (BA)   AN ACT CONCERNING FEES FOR SECURITY FREEZES ON CREDIT REPORTS, NOTIFICATION OF A CONSUMER'S DECISION TO PLACE OR REMOVE A SECURITY FREEZE ON A CREDIT REPORT AND THE DURATION OF CERTAIN IDENTITY THEFT PREVENTION SERVICES REQUIRED AFTER A DATA BREACH.

(i) (1) [Except as provided in subdivision (2) of this subsection, a] A credit rating agency [may] shall not (A) charge a fee [of not more than ten dollars] to a consumer for [each] a security freeze, removal of such freeze, [or] temporary lift of such freeze for a period of time [, and a fee of not more than twelve dollars for] or a temporary lift of such freeze for a specific party.party, or (B) require as a condition for placing a security freeze that a consumer enter into an agreement that limits any claim the consumer may have against such credit rating agency.

Sec.

3.

Section 31-51tt of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2018):

(a) As used in this section:

(1) "Employee" means any person engaged in service to an employer in a business of his employer;

(2) "Employer" means any person engaged in business who has one or more employees, including the state or any political subdivision of the state;

(3) "Financial institution" means (A) any entity or affiliate of a state bank and trust company, national banking association, state or federally chartered savings bank, state or federally chartered savings and loan association, state or federally chartered credit union, insurance company, investment advisor, broker-dealer, (B) an entity registered with the Securities and Exchange Commission, or (C) any mortgage broker, mortgage correspondent lender or mortgage lender licensed pursuant to chapter 668 or any mortgage servicing company, as defined in section 36a-715;

and (4) "Substantially related to the employee's current or potential job" means the information contained in the credit report is related to the position for which the employee or prospective employee who is the subject of the report is being evaluated because the position:

(A) Is a managerial position which involves setting the direction or control of a business, division, unit or an agency of a business;

(B) Involves access to customers', employees' or the employer's personal or financial information other than information customarily provided in a retail transaction;

(C) Involves a fiduciary responsibility to the employer, including, but not limited to, the authority to issue payments, collect debts, transfer money or enter into contracts;

(D) Provides an expense account or corporate debit or credit card;

(E) Provides access to (i) confidential or proprietary business information, or (ii) information, including a formula, pattern, compilation, program, device, method, technique, process or trade secret that:

(I) Derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from the disclosure or use of the information;

and (II) is the subject of efforts that are reasonable under the circumstances to maintain its secrecy;

or (F) Involves access to [the employer's nonfinancial assets valued at two thousand five dollars or more, including, but not limited to,] museum and library collections and to prescription drugs and other pharmaceuticals.

(b) No employer or employer's agent, representative or designee may require an employee or prospective employee to consent to a request for a credit report that contains information about the employee's or prospective employee's credit score, credit account balances, payment history, savings or checking account balances or savings or checking account numbers as a condition of employment unless (1) such employer is a financial institution, (2) such report is required by law, (3) the employer reasonably believes that the employee has engaged in specific activity that constitutes a violation of the law related to the employee's employment, or (4) such report is substantially related to the employee's current or potential job or the employer has a bona fide purpose for requesting or using information in the credit report that is substantially job-related and is disclosed in writing to the employee or applicant.

(c) Any employee or prospective employee may file a complaint with the Labor Commissioner alleging a violation of the provisions of subsection (b) of this section.

Within thirty days after the filing of such complaint, the commissioner shall conduct an investigation and shall render his findings.

Should such findings warrant, the commissioner shall hold a hearing, in accordance with the provisions of chapter 54.

An employer shall be liable to the Labor Department for a civil penalty of three hundred dollars for each inquiry made in violation of subsection (b) of this section.

(d) The Attorney General, upon complaint of the Labor Commissioner, shall institute civil actions to recover the penalties provided for under subsection (c) of this section.

Any amount recovered shall be deposited in the General Fund.

Sec.

4.

(NEW) (Effective October 1, 2018) The Banking Commissioner shall adopt regulations in accordance with chapter 54 of the general statutes to require credit rating agencies to (1) provide to the Banking Commissioner dedicated points of contact through which the Department of Banking may assist consumers in the event of a data breach;

(2) respond not later than ten days after the Department of Banking makes a request for information on behalf of a consumer;

(3) report to the Banking Commissioner all fees associated with the purchase or use of products and services marketed as identity theft protection products and a description of all business affiliations and contractual relationships with any other entities relating to the provision of any identity theft prevention or mitigation products or services;

and (4) disclose to the Banking Commissioner the fees associated with the purchase or use of any proprietary products offered to consumers for the prevention of identity theft, including, if offered on a trial basis, any fees charged to purchase or use such product after the trial period ends.

2 October 1, 2018 36a-701b StatementSec. of Purpose:

To3 (1)October prohibit1, credit2018 rating31-51tt agenciesSec. from charging a fee to consumers to place or remove a security freeze from the consumer's account, (2) require credit rating agencies to notify other credit rating agencies of a consumer's request to place or remove a security freeze from such consumer's account, and (3) increase the amount of identity theft prevention or mitigation services provided after a security breach.

[Proposed4 deletionsOctober are1, enclosed2018 inNew brackets.section BA Joint Favorable Subst.

Proposed additions are indicated by underline, except that when the entire text of a bill or resolution or a section of a bill or resolution is new, it is not underlined.]