SB1417 - 532R

Be it enacted by the Legislature of the State of Arizona:

Section 1. Title 23, chapter 2, article 1, Arizona Revised Statutes, is amended by adding section 23-206, to read:

START_STATUTE23-206. Consumer report or credit; prohibition; violation; classification; definitions

A. Notwithstanding any other law, an employer may not do either of the following:

1. Discharge or fail or refuse to recruit, hire, promote, reassign or retain an individual or otherwise discriminate against an individual with respect to compensation or a term, condition or privilege of employment because of the individual's consumer report or credit history.

2. Inquire about an applicant's or employee's consumer report or credit history.

B. A person that violates this section is guilty of a class 3 misdemeanor.

C. For the purposes of this section:

1. "Consumer report" has the same meaning prescribed in section 44‑1691.

2. "Credit history" means information obtained from a third party, whether or not contained in a consumer report, that reflects or pertains to either of the following for an individual:

(a) Current or past borrowing or repaying behavior, including the accumulation, payment or discharge of financial obligations.

(b) Current or past financial condition or ability to meet financial obligations, including debts owed, payment history or savings or checking account balances or account numbers.

3. "Employer" means any individual, person or type of organization that employs workers, including this state and all political subdivisions of this state. END_STATUTE

Sec. 2. Section 28-376, Arizona Revised Statutes, is amended to read:

START_STATUTE28-376. Employment of personnel; definition

A. The director may obtain criminal history record information regarding applicants for employment for the purpose of hiring personnel. Before making a final offer of employment, the director shall require the preferred applicants to submit a full set of fingerprints. The director shall submit the fingerprints to the department of public safety for the purpose of obtaining a state and federal criminal records check pursuant to section 41‑1750 and Public Law 92-544. The department of public safety may exchange this fingerprint data with the federal bureau of investigation. The department of transportation shall not disclose information obtained pursuant to this subsection except to members of the department's staff solely for employment purposes. An applicant shall not be disqualified from employment under this subsection except in accordance with section 13-904, subsection E.

B. The director may obtain consumer report information regarding applicants for employment for the purpose of hiring personnel. Information obtained may only be used to determine the suitability of the applicant for positions involving fiduciary or financial responsibilities, the issuance of driver licenses or other personal identification documents or access to highly confidential information. Consumer report information may be obtained and used only in accordance with the fair credit reporting act (15 United States Code sections 1681 through 1681x). An applicant shall not be disqualified from employment under this subsection unless the consumer report information relied on for the disqualification has a reasonable relationship to the functions of the position.

C. B. For the purposes of this section, "applicant" means any person who seeks employment as a new hire or any employee of the department who seeks a transfer, a reclassification or a reassignment to a different position. END_STATUTE

Sec. 3. Section 44-1691, Arizona Revised Statutes, is amended to read:

START_STATUTE44-1691. Definitions

In this chapter, unless the context otherwise requires:

1. "Consumer" means an individual.

3. 2. "Consumer report" means any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which that is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for (a) credit or insurance to be used primarily for personal, family, or household purposes, or (b) employment purposes, or (c) other purposes authorized under section 44-1692. The term Consumer report does not include:

(a) Any report containing information solely as to transactions or experiences between the consumer and the person making the report. ; or

(b) Any authorization or approval of a specific extension of credit directly or indirectly by the issuer of a credit card or similar device. ; or

(c) Any report in which a person who has been requested by a third party to make a specific extension of credit directly or indirectly to a consumer conveys his that person's decision with respect to such request, if the third party advises the consumer of the name and address of the person to whom the request was made.

2. 3. "Consumer reporting agency" means any person which that, for monetary fees, for dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information on consumers for the purpose of furnishing consumer reports to third parties.

4. "Employment purposes" when used in connection with a consumer report means a report used for the purpose of evaluating a consumer for employment, promotion, reassignment or retention as an employee.

5. 4. "File" when used in connection with information on any consumer, means all of the information on that consumer recorded and retained by a consumer reporting agency regardless of how the information is stored.

6. 5. "Person" means an individual, partnership, corporation, association, or any other entity of whatever kind or nature. END_STATUTE

Sec. 4. Section 44-1692, Arizona Revised Statutes, is amended to read:

START_STATUTE44-1692. Permissible use of consumer reports

A. Except as provided in section 44‑1693, a consumer reporting agency may furnish a consumer report only under the following circumstances and no other:

1. In response to the order of a court having jurisdiction to issue such an order.

2. In accordance with the written instructions of the consumer to whom it relates.

3. To a person that it has reason to believe:

(a) Intends to use the information in connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer.

(b) Intends to use the information for employment purposes.

(d) (c) Intends to use the information in connection with a determination of the consumer's eligibility for any license or other benefit granted by a governmental instrumentality required by law to consider an applicant's financial responsibility or status.

(e) (d) Otherwise has a legitimate business need for the information in connection with a business transaction involving the consumer.

4. On request by the department of economic security, its agent or another agency administering a title IV‑D program under the social security act certifying that:

(a) The obligor mother or the obligor father has been determined to be the parent of a child to whom a support obligation relates.

(b) The consumer report is needed to establish an obligor's capacity to make support payments or to determine the appropriate amount of the payments or for the purpose of setting an original support amount or modifying an existing support order.

(c) The obligor has received at least ten days' advance notice, by certified mail, at the last known address, by personal delivery or by personal service that a consumer report will be requested.

(d) The consumer report shall be kept confidential and shall be used only for the purposes described in subdivision (b) of this paragraph.

(e) The consumer report shall not be used in connection with any other civil, administrative or criminal proceeding or for any other purpose.

B. The report furnished in subsection A of this section may be provided by electronic or other means. END_STATUTE

Sec. 5. Section 44-1693, Arizona Revised Statutes, is amended to read:

START_STATUTE44-1693. Access to reports by a consumer

A. Upon On furnishing adequate credentials by a consumer as to his the consumer's identity:

1. A creditor who denies credit to any consumer shall disclose to such the consumer the name and address of any consumer reporting agency which that has furnished such the creditor with a consumer report on such the consumer which that was considered by the creditor in making the determination.

2. A licensing agency which that denies a license to any consumer shall disclose to such the consumer the name and address of any consumer reporting agency which that has furnished such the agency with a consumer report on such the consumer which that was considered by the licensing agency in making the determination.

3. An employer who denies a consumer employment, a promotion, retention as an employee or reassignment or does reassign the consumer, whichever is not to the advantage of the consumer, shall disclose to such consumer the name and address of any consumer reporting agency which has furnished such employer with a consumer report on such consumer which was considered by the employer in making the determination.

4. 3. A consumer reporting agency shall disclose to any consumer the contents of its file used for the purpose of making a consumer report on that consumer, any and all facts, allegations or sources upon on which such the information is based and the name and address of each person requesting a report on the consumer within the previous six months. A credit reporting agency may make the disclosures in the following manner:

(a) By a trained employee of the credit reporting agency when the consumer makes the request in person.

(b) By telephone if the credit reporting agency receives a written request for a telephone disclosure from the consumer. Any toll for the telephone disclosure shall be prepaid by the consumer or charged directly to the consumer requesting the telephone disclosure.

(c) By a decoded written copy of the file or a written copy of the consumer report with an explanation of any codes used if the credit reporting agency receives a written request for a written disclosure from the consumer.

B. A consumer reporting agency shall provide trained personnel to disclose the contents of its file to consumers during normal business office hours and assist a consumer in fully understanding all items on his the consumer's consumer report.

C. The consumer shall be permitted to be accompanied by one other person of his the consumer's choosing, who shall furnish reasonable identification, at such the time as the consumer reviews the files of the consumer reporting agency as provided in this section.

D. No A consumer reporting agency nor or any creditor, licensing agency or employer shall not request or require any waiver of rights by any consumer. No A consumer reporting agency nor or any creditor or any other person shall not charge any fee to a consumer for a disclosure of his the consumer's file if within a thirty-day period prior to before the request for a disclosure the consumer is denied credit, or licensure, employment or received receives a notice of collection or received receives other adverse action due to the credit report. Except as provided for in this subsection, a consumer reporting agency may charge a reasonable fee for any disclosures of a file to the consumer or his the consumer's designee. END_STATUTE

Sec. 6. Section 44-1698, Arizona Revised Statutes, is amended to read:

START_STATUTE44-1698. Security freeze on credit reports and credit scores; fees; definitions

A. A consumer may request in writing or in a form acceptable to the consumer reporting agency that a consumer reporting agency place a security freeze on the consumer's credit report. If a security freeze is in place, a consumer reporting agency shall not release a consumer's credit report or consumer's credit score to a third party without the consumer's prior express authorization. This subsection does not prevent a consumer reporting agency from advising a specific party that a security freeze is in effect with respect to the consumer's credit report.

B. A consumer reporting agency shall place a security freeze on a consumer's credit report not later than ten business days after receiving a written request from the consumer.

C. The consumer reporting agency shall send a written confirmation of the security freeze to the consumer within ten business days after placing the security freeze on the consumer's credit report and shall provide the consumer with a unique personal identification number or password, other than the consumer's social security number, that the consumer may use to provide authorization for the release of the consumer's credit report for a specific period of time and to remove the security freeze.

D. A security freeze remains in effect until the consumer requests that the security freeze be removed or temporarily lifted as provided in this section. A consumer may request that a security freeze be removed or temporarily lifted by mail, telephone, internet or other electronic contact method in a form acceptable to the consumer reporting agency. A consumer reporting agency shall require proper identification of any person who makes a request to place or remove a security freeze.

E. On requesting removal, the consumer shall provide the following information:

1. Proper identification.

2. The unique personal identification number or password that the consumer reporting agency provided to the consumer.

F. On requesting a temporary lift to allow a credit report to be accessed for a specific period of time, the consumer shall contact the consumer reporting agency and shall request that the security freeze be temporarily lifted and shall provide the following information:

1. Proper identification.

2. The unique personal identification number or password that the consumer reporting agency provided to the consumer.

3. The proper information regarding the specific time period for which the credit report shall be available to users of the credit report.

G. A consumer reporting agency shall remove or temporarily lift a security freeze from a consumer's credit report within:

1. Three business days after receiving the consumer's request for the removal or temporary lift by mail.

2. Fifteen minutes after receiving the consumer's request through the use of telephone, internet or other electronic contact method in a form acceptable to the consumer reporting agency, during normal business hours. The consumer reporting agency is not required to remove or temporarily lift the security freeze within the fifteen minute time limit if the agency's ability is prevented by any of the following:

(a) An act of God, including fire, earthquakes, hurricanes, storms or similar natural disaster or phenomena.

(b) Unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations or similar occurrence.

(c) Operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time or similar disruption.

(d) Governmental action, including emergency orders or regulations, judicial or law enforcement action or similar directives.

(e) Regularly scheduled maintenance, during other than normal business hours of, or updates to, the consumer reporting agency's systems.

(f) Commercially reasonable maintenance of, or repair to, the consumer reporting agency's systems that is unexpected or unscheduled.

(g) Receipt of a removal or temporary lift request outside of normal business hours.

H. A consumer reporting agency shall remove or temporarily lift a security freeze placed on a consumer's credit report only in the following cases:

1. If the consumer requests removal pursuant to subsection E of this section or a temporary lift pursuant to subsection F of this section.

2. If the consumer's credit report was frozen as a result of a material misrepresentation of fact. If a consumer reporting agency intends to remove a security freeze on a consumer's credit report pursuant to this paragraph, the consumer reporting agency shall notify by mail, telephone, internet or other electronic contact method the consumer before removing the security freeze on the consumer's credit report.

I. When a consumer requests a security freeze, the consumer reporting agency shall disclose the process for placing and for removing or temporarily lifting a freeze and the process for allowing access to information from the consumer's credit report for a specific period of time while the security freeze is in place.

J. If a third party requests access to a credit report on which a security freeze is in effect, the request is in connection with an application for credit or any other use and the consumer does not allow the consumer's credit report to be accessed for a specific period of time, the third party may treat the application as incomplete.

K. A consumer reporting agency may charge a five dollar fee for each security freeze, removal of the freeze or temporary lift of the freeze for a period of time on the consumer's credit report. A consumer reporting agency shall not charge a fee to a victim of identity theft who submits a valid police report that alleges a violation of section 13-2008, 13-2009 or 13‑2010.

L. A consumer reporting agency may charge a five dollar fee if the consumer fails to retain the original unique personal identification number or password provided by the consumer reporting agency and the consumer reporting agency must reissue the unique personal identification number or password or provide a new unique personal identification number or password to the consumer.

M. If a security freeze is in place, a consumer reporting agency shall not change a consumer's name, date of birth, social security number or address in the consumer's credit report without sending a written confirmation of the change to the consumer within thirty days after the change is posted to the consumer's file. Written confirmation is not required for technical modifications of a consumer's official information, including name and street abbreviations, complete spellings or transposition of numbers or letters. For the purposes of address changes, the consumer reporting agency shall send the written confirmation to both the new address and the former address.

N. This section does not apply to the use of a credit report or credit score by any of the following:

1. A person, a subsidiary, affiliate, agent or subcontractor of that person, an assignee of a financial obligation owed by the consumer to that person or a prospective assignee of a financial obligation owed by the consumer to that person in conjunction with the proposed purchase of the financial obligation with which the consumer has or had before assignment an account or contract, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owed for the account, contract or negotiable instrument. For the purposes of this paragraph, "reviewing the account" includes activities that are related to account maintenance, monitoring, credit line increases and account upgrades and enhancements.

2. A subsidiary, affiliate, agent, assignee or prospective assignee of a person to whom access has been granted under this section for the purpose of facilitating the extension of credit or other permissible use.

3. Any state or local agency, law enforcement agency, trial court or private collection agency acting pursuant to a court order, warrant or subpoena.

4. A child support agency acting pursuant to title 25, chapter 3, article 2 or title IV-D of the social security act.

5. The department of health services or its agents or assigns acting to investigate fraud.

6. The department of revenue or its agents or assigns acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities.

7. The department of transportation or its agents or assigns acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities.

8. The administrative office of the courts to conduct audits or investigate fraud or for applicant screening.

9. Any agency or entity for the purposes of prescreening or postscreening as provided for by the federal fair credit reporting act (15 United States Code section 1681b).

10. Any person or entity that administers a credit file monitoring subscription service to which the consumer has subscribed.

11. Any person or entity for the purpose of providing a consumer with a copy of the consumer's credit report or consumer's credit score on the consumer's request.

12. Except as otherwise provided by law, a person setting or adjusting a rate or claim or underwriting for insurance purposes.

13. Any person who uses a consumer reporting agency's database or file that consists entirely of information concerning, and is used solely for, one or more of the following:

(a) Criminal record information.

(b) Fraud prevention or detection.

(d) Employment screening.

14. Any state or federally regulated bank or financial institution for checking, savings and investment accounts.

O. The following entities are not required to place a security freeze on a credit report:

1. A check services or fraud prevention services company that issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers or similar methods of payments.

2. A deposit account information service company that issues reports regarding account closures due to fraud, substantial overdrafts, automated teller machine abuse or similar negative information regarding a consumer to inquiring banks or financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution.

3. A consumer reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or multiple consumer reporting agencies and that does not maintain a permanent database of credit information from which new credit reports or credit scores are produced.

P. An act or practice in violation of this section is an unlawful practice under section 44-1522 and is subject to enforcement through a private action and by the attorney general. Injunctive relief may be sought to prevent future violations of this section. The remedies provided in this section are not intended to be the exclusive remedies available to a consumer. This subsection does not apply to subsection G, paragraph 2 of this section.

Q. For the purposes of this section:

1. "Proper identification" means information that is generally deemed to be sufficient to identify a person under the circumstances.

2. "Security freeze" means a notice that is placed in a consumer's credit report at the request of the consumer and that prohibits the consumer reporting agency from releasing the consumer's credit report without the express authorization of the consumer. END_STATUTE

Sec. 7. Section 44-1698.02, Arizona Revised Statutes, is amended to read:

START_STATUTE44-1698.02. Security freezes; credit reports; protected person; fee; definitions

A. A consumer reporting agency shall place a security freeze on a protected person's record or credit report if both of the following apply:

1. The consumer reporting agency receives a request from the protected person's representative for the placement of the security freeze.

2. The protected person's representative does all of the following:

(a) Submits the request to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency.

(b) Provides to the consumer reporting agency sufficient proof of identification of the protected person and the representative.

(d) Pays to the consumer reporting agency a fee as prescribed in subsection H of this section.

B. If a consumer reporting agency does not have a file pertaining to a protected person when the consumer reporting agency receives a request pursuant to subsection A, paragraph 1 of this section, the consumer reporting agency shall create a record for the protected person.

C. Within thirty days after receiving a request pursuant to this section, a consumer reporting agency shall place a security freeze on the protected person's record or credit report.

D. Unless a security freeze is removed pursuant to subsection F or J of this section, a consumer reporting agency may not release the protected person's credit report, any information derived from the protected person's credit report or any record created for the protected person.

E. A security freeze that is placed on a protected person's record or credit report placed under this section remains in effect until either:

1. The protected person or the protected person's representative requests that the consumer reporting agency remove the security freeze pursuant to subsection F of this section.

2. The security freeze is removed pursuant to subsection J of this section.

F. To remove a security freeze for a protected person, the protected person or the protected person's representative shall submit a request for the removal of the security freeze to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency and pay a fee as prescribed in subsection H of this section. In addition:

1. If the protected person requested the removal of the security freeze, the protected person shall provide to the consumer reporting agency either of the following:

(a) Proof that the protected person's representative no longer has sufficient proof of authority to act on behalf of the protected person.

(b) Sufficient proof of identification of the protected person.

2. If the protected person's representative requested the removal of the security freeze on behalf of the protected person, the protected person's representative shall provide to the consumer reporting agency both of the following:

(a) Sufficient proof of identification of the protected person and the representative.

(b) Sufficient proof of authority to act on behalf of the protected person.

G. Within thirty days after receiving a request to remove a security freeze placed pursuant to subsection A of this section, the consumer reporting agency shall remove the security freeze for the protected person.

H. A consumer reporting agency may charge a five dollar fee for each placement or removal of a security freeze on a protected person's record or credit report.

I. Notwithstanding subsection H of this section, a consumer reporting agency may not charge any fee under this section if either of the following applies:

1. The protected person's representative provides a copy of a police report to the consumer reporting agency alleging that the protected person has been a victim of an offense involving a violation of section 13‑2008 or 13‑2009.

2. A request for the placement or removal of a security freeze is for a protected person who is under sixteen years of age at the time of the request and the consumer reporting agency has a credit report pertaining to the protected person.

J. A consumer reporting agency may remove a security freeze for a protected person or may delete a protected person's record if the security freeze was placed or the record was created based on a material misrepresentation of fact by the protected person or the protected person's representative.

K. An act or practice in violation of this section is an unlawful practice under section 44‑1522 and is subject to enforcement through a private action and by the attorney general. The attorney general may investigate and take appropriate action as prescribed by chapter 10, article 7 of this title. The remedies provided in this section are not intended to be the exclusive remedies available to a protected person.

L. This section does not apply to the use of a protected person's credit report or record by any of the following:

1. A person administering a credit file monitoring subscription service to which either:

(a) The protected person has subscribed.

(b) The protected person's representative has subscribed on behalf of the protected person.

2. A person providing the protected person or the protected person's representative with a copy of the protected person's credit report on the request of the protected person or the protected person's representative.

3. A check services or fraud prevention services company that issues either:

(a) Reports on incidents of fraud.

(b) Authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers or similar payment methods.

4. A deposit account information service company that issues reports relating to account closures due to fraud, substantial overdrafts, automated teller machine abuse or similar negative information about a protected person to inquiring banks or other financial institutions for use only in reviewing a protected person person's request for a deposit account at the inquiring bank or financial institution.

5. An insurance company for the purpose of conducting its ordinary business.

6. A consumer reporting agency that both:

(a) Acts only to resell credit information by assembling and merging information contained in a database of another consumer reporting agency.

(b) Does not maintain a permanent database of credit information from which new credit reports are produced.

7. A consumer reporting agency's database or file that consists of information concerning and used for one or more of the following, but not for credit granting, purposes:

(a) Criminal record information.

(b) Fraud prevention or detection.

(d) Employment, Tenant or individual background screening.

8. A governmental entity when carrying out its duties.

9. A person, a subsidiary, affiliate, agent or subcontractor of that person, an assignee of a financial obligation owed by the protected person to that person or a prospective assignee of a financial obligation owed by the protected person to that person in conjunction with the proposed purchase of the financial obligation with which the protected person has or had before assignment an account or contract, including a demand deposit account, or to whom the protected person issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owed for the account, contract or negotiable instrument. For the purposes of this paragraph, "reviewing the account" includes activities that are related to account maintenance, monitoring, credit line increases and account upgrades and enhancements.

M. For the purposes of this section:

1. "Protected person" means an individual who is under sixteen years of age at the time a request for the placement of a security freeze is made or who is an incapacitated person or a protected person for whom a guardian or conservator has been appointed.

2. "Record" means a compilation of information to which all of the following apply:

(a) The record identifies a protected person.

(b) The record is created by a consumer reporting agency solely for the purpose of complying with this section.

(c) The record is not created or used to consider the protected person's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living.

3. "Representative" means a person who provides to a consumer reporting agency sufficient proof of authority to act on behalf of a protected person.

4. "Security freeze" means:

(a) If a consumer reporting agency does not have a file pertaining to a protected person, a restriction that is placed on the protected person's record and that prohibits the consumer reporting agency from releasing the protected person's record.

(b) If a consumer reporting agency has a file pertaining to the protected person, a restriction that is placed on the protected person's credit report and that prohibits the consumer reporting agency from releasing the protected person's credit report or any information derived from the protected person's credit report.

5. "Sufficient proof of authority" means documentation that shows a representative has authority to act on behalf of a protected person and includes:

(a) A court order.

(b) A lawfully executed and valid power of attorney.

(c) A written, notarized statement signed by a representative that expressly describes the authority of the representative to act on behalf of a protected person.

6. "Sufficient proof of identification" means information or documentation that identifies a protected person or a representative of a protected person and includes:

(a) A social security number or a social security card issued by the social security administration.

(b) A certified or official copy of a birth certificate issued by the department of health services.

(c) A driver license or a nonoperating identification license issued by the department of transportation pursuant to title 28, chapter 8 or any other government issued identification. END_STATUTE

Sec. 8. Short title

This act may be cited as the "Employee Credit Privacy Act".