States, Uncle Sam Combating Identity Theft

By Brian Krebs Staff Writer
Wednesday, May 9, 2007; 6:34 AM

Thirty-three states and the District of Columbia allow consumers to place a "security freeze" on their credit files, and more states are considering similar legislation.

For the millions of consumers who receive notice each year that their personal or financial data was lost or stolen, a preemptive security freeze can offer peace of mind. It blocks businesses and potential fraudsters from gaining access to a consumer's credit report and score and from granting new lines of credit in the consumer's name. In many states, consumers who want to remove the freeze can use a special identification number to unlock access to their credit file.

Residents of the District of Columbia will be able to request a credit freeze starting July 1. Maryland's General Assembly approved a similar bill this year. The governor is expected to sign it. Even if he doesn't, it will become law automatically on Jan. 1, 2008. Virginia is among at least four other states where lawmakers are debating credit-freeze legislation.

Most states require consumers to pay a fee of $3 to $10 per credit bureau to freeze their credit files. In some cases, there are additional fees if a consumer wants to remove or temporarily lift a freeze. In all states with credit-freeze laws, victims of identity theft can obtain a freeze without paying a fee, although many states require that the victim provide a copy of a police report detailing the incident.

In the District, consumers will be required to pay a $10 fee per credit bureau to place a freeze, but there are no fees tied to removing it. Maryland consumers could have to pay as much as $5 per freeze, and an additional $5 fee to lift it. (Temporarily "thawing" your credit file to gain access to credit usually only requires lifting the freeze at one of the three major credit bureaus.) Identity-theft victims in D.C. and Maryland will be able to place a freeze on their credit files at no charge.

Gail Hillebrand, senior attorney for Consumers Union, said many states have enacted freeze laws in part to send a message to Capitol Hill that they are intent on securing this option for citizens.

"States are not only making their voice heard, but they're bringing down the cost" for filing credit freezes, Hillebrand said. Montana recently passed a law allowing citizens to freeze their credit file for $3 per credit bureau. "States want this to work for their constituents. Even if companies hold their data and don't protect it, the freeze is the ultimate protection."

In response to a string of high-profile data breaches at companies, universities and government agencies over the past three years, at least 35 states have enacted legislation requiring companies to notify consumers if they have a data breach or loss that jeopardizes consumers' personal and financial information. Faced with the prospect of complying with all of these often disparate state data breach laws, business groups have been pressuring Congress to enact a federal data-breach bill that would unify and override corresponding statutes at the state level.

Among the many data breach notification measures currently being crafted in Congress, only one bill -- a measure currently under consideration by the Senate Commerce Committee -- contains a specific allowance for consumers to freeze their credit. Under the proposed "Identity Theft Prevention Act," consumers would need to spend $30 to place a credit freeze on their files that covers all three major credit reporting bureaus. A couple would have to spend $60 to place a credit freeze jointly. The legislation, sponsored by Committee Chairman Daniel Inouye (D-Hawaii) and ranking Republican Ted Stevens (Alaska), would allow consumers to lift a freeze twice annually for free, with subsequent lifts costing $15 per person.

Under current federal law, individuals can place a 90-day "fraud alert" on their credit files, and are entitled to a free copy of their credit report from each of the three major credit reporting bureaus annually. However, unlike the security freeze, a fraud alert merely notifies the consumer if an inquiry has been made against their credit file. It does not prevent identity thieves or other business from accessing a consumer's credit file or obtaining new lines of credit in their name.

Consumers Union maintains a detailed list of state laws related to data privacy. The page includes links to the individual laws and instructions for how a consumer can file a credit freeze.

© 2007 The Washington Post Company