75-61. Definitions.

The following definitions apply in this Article:

(1) "Business". - A sole proprietorship, partnership, corporation, association, or other group, however organized and whether or not organized to operate at a profit. The term includes a financial institution organized, chartered, or holding a license or authorization certificate under the laws of this State, any other state, the United States, or any other country, or the parent or the subsidiary of any such financial institution. Business shall not include any government or governmental subdivision or agency.

(2) "Consumer". - An individual.

(3) "Consumer report" or "credit report". - Any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for any of the following:

a. Credit to be used primarily for personal, family, or household purposes.

b. Employment purposes.

c. Any other purpose authorized under 15 U.S.C. 168l(b).

(4) "Consumer reporting agency". - Any person who, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties.

(5) "Credit card". - Has the same meaning as in section 103 of the Truth in Lending Act (15 U.S.C. 160, et seq.).

(6) "Debit card". - Any card or device issued by a financial institution to a consumer for use in initiating an electronic fund transfer from the account holding assets of the consumer at such financial institution, for the purpose of transferring money between accounts or obtaining money, property, labor, or services.

(7) "Disposal" includes the following:

a. The discarding or abandonment of records containing personal information.

b. The sale, donation, discarding, or transfer of any medium, including computer equipment or computer media, containing records of personal information, or other nonpaper media upon which records of personal information are stored, or other equipment for nonpaper storage of information.

(8) "Encryption". - The use of an algorithmic process to transform data into a form in which the data is rendered unreadable or unusable without use of a confidential process or key.

(9) "Person". - Any individual, partnership, corporation, trust, estate, cooperative, association, government, or governmental subdivision or agency, or other entity.

(10) "Personal information". - A person's first name or first initial and last name in combination with identifying information as defined in G.S. 14-113.20(b). Personal information does not include publicly available directories containing information an individual has voluntarily consented to have publicly disseminated or listed, including name, address, and telephone number, and does not include information made lawfully available to the general public from federal, state, or local government records.

(11) "Proper identification". - Information generally deemed sufficient to identify a person. If a person is unable to reasonably identify himself or herself with the information described above, a consumer reporting agency may require additional information concerning the consumer's employment and personal or family history in order to verify the consumer's identity.

(11a) "Protected consumer". - An individual (i) who is under the age of 16 at the time a request for the placement of a security freeze is made pursuant to G.S. 75-63.1 or (ii) who is incapacitated or for whom a guardian or guardian ad litem has been appointed.

(11b) "Protected consumer security freeze". - A security freeze placed on a protected consumer's credit report or on a protected consumer's file pursuant to G.S. 75-63.1.

(11c) "Protected consumer's file". - A record that (i) identifies a protected consumer, (ii) is created by a consumer reporting agency solely for the purpose of complying with the requirements of G.S. 75-63.1, and (iii) may not be created or used to consider the protected consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living.

(12) "Records". - Any material on which written, drawn, spoken, visual, or electromagnetic information is recorded or preserved, regardless of physical form or characteristics.

(13) "Redaction". - The rendering of data so that it is unreadable or is truncated so that no more than the last four digits of the identification number is accessible as part of the data.

(13a) "Representative". - A person who provides to a consumer reporting agency sufficient proof of authority to act on behalf of a protected consumer.

(14) "Security breach". - An incident of unauthorized access to and acquisition of unencrypted and unredacted records or data containing personal information where illegal use of the personal information has occurred or is reasonably likely to occur or that creates a material risk of harm to a consumer. Any incident of unauthorized access to and acquisition of encrypted records or data containing personal information along with the confidential process or key shall constitute a security breach. Good faith acquisition of personal information by an employee or agent of the business for a legitimate purpose is not a security breach, provided that the personal information is not used for a purpose other than a lawful purpose of the business and is not subject to further unauthorized disclosure.

(15) "Security freeze". - Notice placed in a credit report, at the request of the consumer and subject to certain exceptions, that prohibits the consumer reporting agency from releasing all or any part of the consumer's credit report or any information derived from it without the express authorization of the consumer.

(16) "Sufficient proof of authority". - Either of the following:

a. A certified or official copy of the protected consumer's birth certificate, if the representative is a parent of the protected consumer.

b. Documentation that shows that a representative has authority to act on behalf of a protected consumer, including the following:

1. An order issued by a court of law.

2. A valid power of attorney.

3. A written, notarized statement signed by the person that expressly describes the authority of the representative to act on behalf of a protected consumer.

(17) "Sufficient proof of identification". - Information or documentation that identifies a protected consumer or representative, including the following:

a. A Social Security number or a copy of a Social Security card issued by the Social Security Administration.

b. A certified or official copy of a birth certificate issued by the entity authorized to issue the birth certificate.

c. A copy of a drivers license, an identification card issued by the Division of Motor Vehicles, or any other government-issued identification.

d. A copy of a bill, including a bill for telephone, sewer, septic tank, water, electric, oil, or natural gas service, that shows a name and home address.