§1310. Additional requirements for persons subject to this chapter
In addition to the compliance requirements of section 1309, subsection 1, a person subject to this chapter shall comply with this section. [PL 2013, c. 228, §1 (NEW).]
1. Security freeze by consumer reporting agency; time in effect. A person subject to this chapter shall comply with the following provisions regarding security freezes.
A. A consumer may place a security freeze on the consumer's consumer report as follows.
(2) Prior to October 1, 2015, a consumer who has not been the victim of identity theft may place a security freeze on the consumer's consumer report by making a request in writing by certified mail to a consumer reporting agency. A consumer reporting agency may charge a fee of no more than $10 to a consumer for each security freeze, removal of a security freeze or temporary suspension of a security freeze for a period of time or for reissuing the same or a new personal identification number if the consumer fails to retain the original personal identification number provided by the agency under paragraph D. A consumer reporting agency may charge a fee of not more than $12 for a temporary suspension of a security freeze for a specific party. Beginning October 1, 2015, a consumer reporting agency may not charge a fee for placing, removing or suspending for a specific party or period of time a security freeze on a consumer report. [PL 2015, c. 139, §2 (AMD).]
B. Subject to the exceptions in paragraph M, when a security freeze has been placed on an account the consumer reporting agency may not:
(1) Release the consumer report or any information from it without the express authorization of the consumer; or
(2) Release information from a consumer report to a 3rd party without express authorization of the consumer. This subparagraph does not prevent a consumer reporting agency from advising a 3rd party that a security freeze is in effect with respect to the consumer report. [PL 2013, c. 228, §1 (NEW).]
C. A consumer reporting agency shall place a security freeze on a consumer report no later than 5 business days after receiving a written request from the consumer. [PL 2013, c. 228, §1 (NEW).]
D. The consumer reporting agency shall send a written confirmation of the security freeze to the consumer within 10 business days after receiving a written request from the consumer and shall provide the consumer with a personal identification number or password, other than the consumer's social security number, to be used by the consumer when providing authorization for the release of the consumer report to a specific party or for a period of time. [PL 2013, c. 228, §1 (NEW).]
E. If a consumer wishes to allow access to a consumer report by a specific party or for a period of time while a security freeze is in place, the consumer may contact the consumer reporting agency, request that the security freeze be temporarily suspended and provide the following:
(1) Proper identification;
(2) The personal identification number or password provided by the consumer reporting agency pursuant to paragraph D; and
(3) The proper information regarding the specific party granted access or the time period for which the consumer report is to be available to users. [PL 2013, c. 228, §1 (NEW).]
F. A consumer reporting agency may develop procedures involving the use of telephone, facsimile transmission, the Internet or other medium of electronic communications to receive and process a request from a consumer to temporarily suspend a security freeze on a consumer report pursuant to paragraph E in an expedited manner. A consumer reporting agency may not charge a fee to a consumer for use of these procedures in excess of those fees otherwise permitted under this section. [PL 2013, c. 228, §1 (NEW).]
G. A consumer reporting agency that receives a request from a consumer to temporarily suspend a security freeze on a consumer report pursuant to paragraph E shall comply with the request no later than 3 business days after receiving the request. [PL 2013, c. 228, §1 (NEW).]
H. A consumer reporting agency shall remove or temporarily suspend a security freeze placed on a consumer report only:
(1) Upon consumer request pursuant to paragraph E or K; or
(2) If the security freeze was due to a material misrepresentation of fact by the consumer. If a consumer reporting agency intends to remove a security freeze from a consumer report pursuant to this subparagraph, the consumer reporting agency shall notify the consumer in writing prior to removing the security freeze. [PL 2013, c. 228, §1 (NEW).]
I. If a 3rd party requests access to a consumer report on which a security freeze is in effect and this request is in connection with an application for credit or any other use and the consumer does not allow access to the consumer report for that specific party or period of time, the 3rd party may treat the application as incomplete. [PL 2013, c. 228, §1 (NEW).]
J. If a consumer requests a security freeze pursuant to this subsection, the consumer reporting agency shall disclose to the consumer the processes of placing and temporarily lifting a security freeze and the process for allowing access to information from the consumer report for a specific party or period of time while the security freeze is in place. A consumer reporting agency shall provide a sample copy of the agency's disclosure form to the administrator at the annual registration or reregistration under section 1310-A and any time there is a material change in the disclosure form required by this paragraph. [PL 2013, c. 228, §1 (NEW).]
K. A security freeze must remain in place until the consumer requests that the security freeze be removed. A consumer reporting agency shall remove a security freeze within 3 business days of receiving a request for removal from a consumer who provides:
(1) Proper identification; and
(2) The personal identification number or password provided by the consumer reporting agency pursuant to paragraph D. [PL 2013, c. 228, §1 (NEW).]
L. A consumer reporting agency shall require proper identification of the person making a request to place or remove a security freeze. [PL 2013, c. 228, §1 (NEW).]
M. The provisions of this subsection, including the security freeze, do not apply to the use of a consumer report by:
(1) A person or person's subsidiary, affiliate, agent or assignee with which the consumer has or, prior to assignment, had an account, contract or debtor-creditor relationship for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract or debt or extending credit to a consumer with a prior or existing account, contract or debtor-creditor relationship, subject to the requirements of 15 United States Code, Section 1681b. For purposes of this subparagraph, "reviewing the account" includes activities related to account maintenance, monitoring, credit line increases and account upgrades and enhancements;
(2) A subsidiary, affiliate, agent, assignee or prospective assignee of a person to whom access has been granted under paragraph E for purposes of facilitating the extension of credit or another permissible use;
(3) A person acting pursuant to a court order, warrant or subpoena;
(4) Child support enforcement officials when investigating a child support case pursuant to Title 19‑A or the federal Social Security Act, Title IV‑D;
(5) The Department of Health and Human Services or its agents or assignees acting to investigate Medicaid fraud;
(6) The Department of Administrative and Financial Services, Maine Revenue Services; municipal taxing authorities; the Secretary of State, Bureau of Motor Vehicles; or any of their agents or assignees, acting to investigate or collect delinquent taxes or assessments, including interest and penalties and unpaid court orders, or to fulfill any of their other statutory or charter responsibilities;
(7) A person's use of credit information for prescreening as provided by the federal Fair Credit Reporting Act or this chapter;
(8) A person for the sole purpose of providing a credit file monitoring subscription service to which the consumer has subscribed;
(9) A consumer reporting agency for the sole purpose of providing a consumer with a copy of that consumer's report upon the consumer's request; and
(10) The administrator pursuant to section 1310‑A. [PL 2013, c. 228, §1 (NEW).]
[PL 2015, c. 139, §2 (AMD).]
1-A. Security freeze for a protected consumer. Beginning October 1, 2015, a person subject to this chapter shall comply with the following provisions regarding a security freeze for a protected consumer.
A. A consumer reporting agency shall place a security freeze for a protected consumer if:
(1) The consumer reporting agency receives a request from the protected consumer's representative for the placement of the security freeze under this subsection; and
(2) The protected consumer's representative:
(a) Submits the request to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency;
(b) Provides to the consumer reporting agency sufficient proof of identification of the protected consumer and the representative;
(c) Provides to the consumer reporting agency sufficient proof of authority to act on behalf of the protected consumer; and
(d) Pays to the consumer reporting agency any fee, as provided in paragraph H. [PL 2015, c. 139, §3 (NEW).]
B. If a consumer reporting agency does not have a file pertaining to a protected consumer when the consumer reporting agency receives a request under this subsection, the consumer reporting agency shall create a record for the protected consumer.
This record may not be created or used to consider the protected consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living for any purpose listed in 15 United States Code, Section 1681b. [RR 2015, c. 1, §4 (COR).]
C. Within 30 days after receiving a request that meets the requirements of this subsection, a consumer reporting agency shall place a security freeze for the protected consumer on the record created for the protected consumer or on the file pertaining to the protected consumer in the event that the consumer reporting agency already has a file pertaining to the protected consumer. [PL 2015, c. 139, §3 (NEW).]
D. Unless a security freeze for a protected consumer is removed in accordance with this subsection, a consumer reporting agency may not release the protected consumer's consumer report, any information derived from the protected consumer's consumer report, or any record created for the protected consumer. [PL 2015, c. 139, §3 (NEW).]
E. A security freeze for a protected consumer placed under this subsection remains in effect until:
(1) The protected consumer or the protected consumer's representative requests the consumer reporting agency to remove the security freeze in accordance with this subsection; or
(2) The security freeze is removed in accordance with paragraph F or I. [PL 2015, c. 139, §3 (NEW).]
F. If a protected consumer or a protected consumer's representative wishes to remove a security freeze for the protected consumer, the protected consumer or the protected consumer's representative shall:
(1) Submit a request for the removal of the security freeze to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency;
(2) Provide to the consumer reporting agency:
(a) In the case of a request by the protected consumer:
(i) Proof that the sufficient proof of authority for the protected consumer's representative to act on behalf of the protected consumer is no longer valid or that the protected consumer has attained the age of 16; and
(ii) Sufficient proof of identification of the protected consumer; or
(b) In the case of a request by the representative of a protected consumer:
(i) Sufficient proof of identification of the protected consumer and the representative; and
(ii) Sufficient proof of authority to act on behalf of the protected consumer; and
(3) Pay to the consumer reporting agency any fee authorized in paragraph H. [PL 2015, c. 139, §3 (NEW).]
G. Within 30 days after receiving a request that meets the requirements for removing a security freeze for a protected consumer, the consumer reporting agency shall remove the security freeze. [PL 2015, c. 139, §3 (NEW).]
H. A consumer reporting agency may charge a reasonable fee, not exceeding $10 for each placement or removal of a security freeze for a protected consumer, except that a consumer reporting agency may not charge a fee for placement or removal of a security freeze for a protected consumer if:
(1) The protected consumer or the protected consumer's representative:
(a) Has obtained a report of alleged identity theft or fraud against the protected consumer; and
(b) The representative provides a copy of the report to the consumer reporting agency;
(2) The consumer reporting agency has a consumer report pertaining to the protected consumer; or
(3) The protected consumer or the protected consumer's representative:
(a) Receives a notice from an information broker or other person of a security breach as required by section 1348; and
(b) Provides a copy of that notice to the consumer reporting agency. [PL 2015, c. 139, §3 (NEW).]
I. A consumer reporting agency shall remove a security freeze for a protected consumer or delete a record of a protected consumer if the security freeze was placed or the record was created based on a material misrepresentation of fact by the protected consumer or the protected consumer's representative. [PL 2015, c. 139, §3 (NEW).]
J. The provisions of this subsection do not apply to the use of a consumer report by:
(1) A person administering a credit file monitoring subscription service to which the protected consumer has subscribed or to which a representative has subscribed on behalf of a protected consumer;
(2) A consumer reporting agency for the sole purpose of providing the protected consumer or the protected consumer's representative a copy of the protected consumer's consumer report upon the request of the protected consumer or the protected consumer's representative;
(3) An entity described in subsection 1, paragraph M, subparagraphs (3), (4), (5) and (10); or
(4) A consumer reporting agency's database or file that consists of information concerning, and used for, one or more of the following: criminal record information, fraud prevention or detection, personal loss history information, and employment, tenant or background screening. [PL 2015, c. 139, §3 (NEW).]
K. A person may not be held liable for any violation of this subsection if the person shows by a preponderance of the evidence that at the time of the alleged violation the person maintained reasonable procedures to ensure compliance with the provisions of this subsection. [PL 2015, c. 139, §3 (NEW).]
For the purposes of this subsection, "record" means a compilation of information that identifies a protected consumer and is created by a consumer reporting agency solely for the purpose of complying with this subsection.
[RR 2015, c. 1, §4 (COR).]
2. Duties of consumer reporting agency if security freeze is in place. If a security freeze is in place, a consumer reporting agency may not change any of the following official information in a consumer report without sending written confirmation of the change to the consumer within 30 days after the change is posted to the consumer's file: name, date of birth, social security number and address. Written confirmation is not required for technical modifications of a consumer's official information, including name and street abbreviations, complete spellings and transposition of numbers or letters. In the case of an address change, the written confirmation must be sent to the new address and the former address.
[PL 2013, c. 228, §1 (NEW).]
3. Persons not required to place security freeze. The following persons are not required to place a security freeze pursuant to subsection 1 or 1-A, except that any person that is not required to place a security freeze under the provisions of subsection 1 or 1-A is subject to a security freeze placed by another consumer reporting agency from which it obtains information:
A. A check services or fraud prevention services company that reports on incidents of fraud or issues authorizations for the purpose of approving or processing negotiable instruments, electronic fund transfers or similar methods of payment; [PL 2013, c. 228, §1 (NEW).]
B. A deposit account information services company that issues reports regarding account closures due to fraud, overdrafts, automated teller machine abuse or similar negative information regarding a consumer to inquiring financial institutions for use only in reviewing that consumer's request for a deposit account at the inquiring financial institution; and [PL 2013, c. 228, §1 (NEW).]
C. A consumer reporting agency that:
(1) Acts only to resell credit information by assembling and merging information contained in a database of one or more consumer reporting agencies; and
(2) Does not maintain a permanent database of credit information from which new consumer reports are produced. [PL 2013, c. 228, §1 (NEW).]
[PL 2015, c. 139, §4 (AMD).]
4. Reporting of child support debts. Information regarding child support debt must be provided as required under this subsection.
A. The Department of Health and Human Services, upon request of a consumer reporting agency, shall make available information regarding the amount of overdue child support owed by any parent. [PL 2013, c. 228, §1 (NEW).]
B. Prior to making the information available to a requesting agency, the department shall provide the obligor parent with notice of the proposed action. The parent must be given 20 days in which to contest the accuracy of the information before the information may be made available. [PL 2013, c. 228, §1 (NEW).]
C. The department may impose a fee upon the requesting agency in an amount not exceeding the actual cost of providing the information. [PL 2013, c. 228, §1 (NEW).]
Nothing in this section prevents the department from voluntarily providing information to a consumer reporting agency regarding any individual who is indebted to the department for failure to pay child support.
[PL 2013, c. 228, §1 (NEW).]
5. Solicitation of loans using prescreened trigger lead information from consumer report. Solicitation of loans using prescreened trigger lead information from consumer reports is subject to the requirements of this subsection. For the purposes of this subsection, "prescreened trigger lead information" means information in a consumer report provided to a nonaffiliated 3rd party by a consumer reporting agency that the agency has reason to believe will be used to solicit a loan or extension of credit.
A. When using prescreened trigger lead information derived from a consumer report to solicit a consumer who has applied for a loan with another lender or loan broker, a lender or loan broker may not use unfair or deceptive practices described in paragraph B. [PL 2013, c. 228, §1 (NEW).]
B. Without limitation, it is an unfair or deceptive practice to:
(1) Fail to state in the initial phase of the solicitation from a lender or loan broker that the solicitor is not affiliated with the lender or loan broker with which the consumer initially applied;
(2) Fail in the initial solicitation to conform to state and federal law relating to prescreened solicitations using consumer reports, including the requirement to make a firm offer of credit to the consumer;
(3) Knowingly or negligently use information regarding consumers who have opted out of prescreened offers of credit or who have placed their contact information on the most current federal do-not-call registry; or
(4) Solicit a consumer with offers of certain rates, terms and costs with intent to subsequently raise the rates or change the terms to the consumer's detriment. [PL 2013, c. 228, §1 (NEW).]
[PL 2013, c. 228, §1 (NEW).]
6. Consumer mortgage reports. In any consumer credit transaction involving a consumer report relating to a loan to be secured by a first mortgage on an owner-occupied dwelling, whenever a user has requested such a report and because or partly because of information contained in the report adverse action is taken, the user shall provide a copy of the report to the consumer. This requirement does not apply if the consumer reporting agency provides a copy of the report to the consumer.
[PL 2013, c. 228, §1 (NEW).]
7. Dissemination of consumer report information prohibited. Every user of a consumer report or an investigative consumer report is prohibited from disseminating to any other person, other than the consumer who is the subject of the report, any such report other than information contained in its own files as a result of its direct experience with the consumer. Except for information or records obtained directly or indirectly and with the consent of the individual to whom it relates, from a licensed physician, medical practitioner, hospital, clinic or other medical or medically related facility, a consumer reporting agency may not by contract or otherwise prohibit a user of any consumer report or investigative consumer report from disclosing the contents of the report to the consumer to whom it relates. A contractual provision in violation of this section is unenforceable.
[PL 2013, c. 228, §1 (NEW).]
8. Medical expenses debts; court or administrative orders. A debt collector may report overdue medical expenses for a minor child to a consumer reporting agency, but only in the name of the responsible party identified in a court order or administrative order and only if the debt collector is notified orally or in writing of the existence of the order. In addition, a report may not be made until after the debt collector has notified, or made a good faith effort to notify, the responsible party of that party's obligation to pay the overdue medical expenses. Existing information regarding overdue medical expenses for a minor child in the name of a person other than the responsible party identified in a court order or administrative order is considered inaccurate information and is subject to correction. A debt collector or consumer reporting agency may request reasonable verification of the order, including a certified copy of the order.
[PL 2013, c. 228, §1 (NEW).]
9. Nonliability. A person may not be held liable for any violation of this section if the person shows by a preponderance of the evidence that at the time of the alleged violation the person maintained reasonable procedures to ensure compliance with the provisions of this section.
[PL 2013, c. 228, §1 (NEW).]
SECTION HISTORY
PL 2013, c. 228, §1 (NEW). RR 2015, c. 1, §4 (COR). PL 2015, c. 139, §§2-4 (AMD).