(1) As used in this section, the term:

(a) “Consumer report” has the same meaning as provided in 15 U.S.C. s. 1681a(d).

(b) “Consumer reporting agency” has the same meaning as provided in 15 U.S.C. s. 1681a(f).

(c) “Protected consumer” means a person younger than 16 years of age at the time a security freeze request is made or a person represented by a guardian or other advocate pursuant to chapter 39, chapter 393, chapter 744, or chapter 914.

(d) “Record” means a compilation of information that:

1. Identifies a protected consumer; and

2. Is created by a consumer reporting agency exclusively for the purpose of complying with this section.

(e) “Representative” means the parent or legal guardian of a protected consumer, including a guardian appointed pursuant to s. 914.17.

(f) “Security freeze” means:

1. A notice placed on a protected consumer’s consumer report which prohibits a consumer reporting agency from releasing the consumer report, the credit score, or any information contained within the consumer report to a third party without the express authorization of the representative; or

2. If a consumer reporting agency does not have a consumer report pertaining to a protected consumer, a notice placed on a protected consumer’s record which prohibits the consumer reporting agency from releasing the protected consumer’s record except as provided in this section.

(g) “Sufficient proof of authority” means documentation showing that a representative has authority to act on behalf of a protected consumer. The term includes, but is not limited to, a court order, a copy of a valid power of attorney, or a written notarized statement signed by the representative which expressly describes the authority of the representative to act on behalf of the protected consumer. A representative who is a parent may establish sufficient proof of authority by providing a certified or official copy of the protected consumer’s birth certificate.

(h) “Sufficient proof of identification” means documentation identifying a protected consumer or a representative. The term includes, but is not limited to, a copy of a social security card, a certified or official copy of a birth certificate, a copy of a valid driver license, or a copy of a government-issued photo identification.

(2) A representative may place a security freeze on a protected consumer’s consumer report by:

(a) Submitting a request to a consumer reporting agency in the manner prescribed by that agency;

(b) Providing the agency with sufficient proof of authority and sufficient proof of identification of the representative; and

(3) If a consumer reporting agency does not have a consumer report pertaining to a protected consumer when the consumer reporting agency receives a request for a security freeze under subsection (2), the consumer reporting agency shall create a record for the protected consumer and place a security freeze on the record. A record may not be created or used to consider the protected consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or eligibility for other financial services.

(4) A consumer reporting agency shall place a security freeze on a consumer report or record within 30 days after confirming the authenticity of a security freeze request made in accordance with this section.

(5) The consumer reporting agency shall send a written confirmation of the security freeze to the representative within 10 business days after instituting the security freeze on the consumer report or record and shall provide the representative with instructions for removing the security freeze and a unique personal identifier to be used by the representative when providing authorization for removal of the security freeze.

(6) A consumer reporting agency may not state or imply to any person that a security freeze reflects a negative credit score, a negative credit history, or a negative credit rating.

(7) A consumer reporting agency shall remove a security freeze from a protected consumer’s consumer report or record only under either of the following circumstances:

(a) Upon the request of a representative or a protected consumer. A consumer reporting agency shall remove a security freeze within 30 days after receiving a request for removal from a protected consumer or his or her representative.

1. A representative submitting a request for removal must provide all of the following:

a. Sufficient proof of identification of the representative and sufficient proof of authority as determined by the consumer reporting agency.

b. The unique personal identifier provided by the consumer reporting agency pursuant to subsection (5).

2. A protected consumer submitting a request for removal must provide all of the following:

a. Sufficient proof of identification of the protected consumer as determined by the consumer reporting agency.

b. Documentation that the sufficient proof of authority of the protected consumer’s representative to act on behalf of the protected consumer is no longer valid.

(b) If the security freeze was instituted due to a material misrepresentation of fact. A consumer reporting agency that intends to remove a security freeze under this paragraph shall notify the representative and protected consumer in writing before removing the security freeze.

(8) This section does not apply to the use of a protected consumer’s consumer report or record by the following persons or for the following reasons:

(a) A state agency acting within its lawful investigative or regulatory authority.

(b) A state or local law enforcement agency investigating a crime or conducting a criminal background check.

(c) A person administering a credit file monitoring subscription service to which the protected consumer or the representative, on behalf of the protected consumer, has subscribed.

(d) A person providing the protected consumer’s consumer report or record to the protected consumer or representative upon the request of the protected consumer or representative.

(e) Pursuant to a court order lawfully entered.

(f) An insurance company for use in setting or adjusting a rate, adjusting a claim, or underwriting for insurance purposes.

(g) A consumer reporting agency’s database or file that consists entirely of information concerning, and used exclusively for, one or more of the following:

1. Criminal record information.

2. Personal loss history information.

3. Fraud prevention or detection.

4. Tenant screening.

5. Employment screening.

6. Personal insurance policy information.

7. Noncredit information used for insurance purposes.

(h) A check services company issuing authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payment.

(i) A deposit account information service company issuing reports regarding account closures due to fraud, substantial overdrafts, automatic teller machine abuse, or similar negative information regarding a protected consumer to an inquiring financial institution, as defined in s. 655.005 or in federal law, for use only in reviewing a representative’s request for a deposit account for the protected consumer at the inquiring financial institution.

(j) A consumer reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or multiple consumer reporting agencies and that does not maintain a permanent database of credit information from which new consumer reports are produced. However, such consumer reporting agency shall honor any security freeze placed or removed by another consumer reporting agency.

(k) A fraud prevention services company issuing reports to prevent or investigate fraud.

(l) A person or entity, or its affiliates, or a collection agency acting on behalf of the person or entity, with which the protected consumer has an existing account, requesting information in the protected consumer’s consumer report or record for the purposes of reviewing or collecting the account. Reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.

(9)(a) A consumer reporting agency may not charge any fee to place or remove a security freeze.

(b) A consumer reporting agency may charge a reasonable fee, not to exceed $10, if the representative fails to retain the original unique personal identifier provided by the consumer reporting agency and the agency must reissue the unique personal identifier or provide a new unique personal identifier to the representative.

(10) If a security freeze is in effect, a consumer reporting agency must send written confirmation to a protected consumer’s representative of a change to any of the following official information in the protected consumer’s consumer report or record within 30 days after the change is posted:

(a) The protected consumer’s name.

(b) The protected consumer’s address.

(c) The protected consumer’s date of birth.

(d) The protected consumer’s social security number.

Written confirmation is not required for technical corrections of a protected consumer’s official information, including name and street abbreviations, complete spellings, or transposition of numbers or letters. In the case of an address change, the written confirmation must be sent to the representative and to the protected consumer’s new address and former address.

(11) If a consumer reporting agency violates a security freeze placed in accordance with this section by releasing information subject to a security freeze without proper authorization, the consumer reporting agency shall, within 5 business days after discovering or being notified of the release of information, notify the representative of the protected consumer in writing. The notice must state the specific information released and provide the name, address, and other contact information of the recipient of the information.

(12) The Department of Agriculture and Consumer Services shall investigate any complaints received concerning violations of this section. If, after investigating any complaint, the department finds that there has been a violation of this section, the department may bring an action to impose an administrative penalty. A consumer reporting agency that willfully fails to comply with any requirement imposed under this section is subject to an administrative penalty in the amount of $500 for each violation, imposed by the department. An administrative proceeding that could result in the entry of an order imposing an administrative penalty must be conducted in accordance with chapter 120. The administrative penalty shall be deposited in the General Inspection Trust Fund.

(13) In addition to any other penalties or remedies provided under law, persons who are aggrieved by a violation of this section may bring a civil action as follows:

(a) A person who obtains a protected consumer’s consumer report or record from a consumer reporting agency under false pretenses or who knowingly obtains a protected consumer’s consumer report or record without a permissible purpose is liable to the representative and protected consumer for actual damages sustained by the protected consumer or $1,000, whichever is greater.

(b) A person who obtains a protected consumer’s consumer report or record from a consumer reporting agency under false pretenses or who knowingly obtains a protected consumer’s consumer report or record without a permissible purpose is liable to the consumer reporting agency for actual damages sustained by the consumer reporting agency or $1,000, whichever is greater.

(14) A written disclosure by a consumer reporting agency, pursuant to 15 U.S.C. s. 1681g, to a representative and protected consumer residing in this state must include a written summary of all rights that the representative and protected consumer have under this section and, in the case of a consumer reporting agency that compiles and maintains records on a nationwide basis, a toll-free telephone number that the representative can use to communicate with the consumer reporting agency. The information provided in paragraph (b) must be in at least 12-point boldfaced type. The written summary of rights required under this section is sufficient if it is substantially in the following form:

(a) If you are the parent or legal guardian of a minor younger than 16 years of age or a guardian or advocate of an incapacitated, disabled, or protected person under chapter 39, chapter 393, chapter 744, or chapter 914, Florida Statutes, you have the right to place a security freeze on the consumer report of the person you are legally authorized to care for. If no consumer report exists, you have the right to request that a record be created and a security freeze be placed on the record. A record with a security freeze is intended to prevent the opening of credit accounts until the security freeze is removed.

(b) YOU SHOULD BE AWARE THAT USING A SECURITY FREEZE TO CONTROL ACCESS TO THE PERSONAL AND FINANCIAL INFORMATION IN A CONSUMER REPORT OR RECORD MAY DELAY, INTERFERE WITH, OR PROHIBIT THE TIMELY APPROVAL OF ANY SUBSEQUENT REQUEST OR APPLICATION REGARDING A NEW LOAN, CREDIT, MORTGAGE, INSURANCE, GOVERNMENT SERVICES OR PAYMENTS, RENTAL HOUSING, EMPLOYMENT, INVESTMENT, LICENSE, CELLULAR PHONE, UTILITIES, DIGITAL SIGNATURE, INTERNET CREDIT CARD TRANSACTION, OR OTHER SERVICES, INCLUDING AN EXTENSION OF CREDIT AT POINT OF SALE.

(c) To remove the security freeze on the protected consumer’s record or report, you must contact the consumer reporting agency and provide all of the following:

1. Proof of identification as required by the consumer reporting agency.

2. Proof of authority over the protected consumer as required by the consumer reporting agency.

3. The unique personal identifier provided by the consumer reporting agency.

(d) A consumer reporting agency must, within 30 days after receiving the above information, authorize the removal of the security freeze.

(e) A security freeze does not apply to a person or entity, or its affiliates, or a collection agency acting on behalf of the person or entity, with which the protected consumer has an existing account, which requests information in the protected consumer’s consumer report or record for the purposes of reviewing or collecting the account. Reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.

(f) You have the right to bring a civil action as authorized by section 501.0051, Florida Statutes, which governs the security of protected consumer information.

History.—s. 2, ch. 2014-66; s. 2, ch. 2018-62.