Application of AS 21.36.460 to a Consumer's Request that Equifax Prevent New Creditors From Accessing the Consumer's Equifax Credit Report

THE STATE 01ALASKA Department of Commerce, Community, and Economic Development GOVERNOR BILL \VALKER BULLETIN B 17-07 DIVISION OF INSURANCE P.O. Box 110805 Juneau. AK 99811-0805 Main: 907 .465.2515 Fax: 907.465.3422 TO: ALL INSURERS WRITING PERSONAL LINES POLICIES IN THE ST ATE OF ALASKA AND OTHER INTERESTED PARTIES RE: APPLICATION OF AS 21.36.460 TO A CONSUMER'S REQUEST THAT EQUIFAX PREVENT NEW CREDITORS FROM ACCESSING THE CONSUMER'S EQUIFAX CREDIT REPORT On September 7, 2017, Equifax Inc. announced a cybersecurity incident potentially impacting approximately 143 million U.S. consumers. The unauthorized activity accessed information including names, Social Security numbers, birth dates, addresses, and, in some cases, driver's license numbers. Equifax discovered the unauthorized access on July 29, 2017. Equifax's announcement also stated: Equifax has established a dedicated website, www.equifaxsecurity2017.com, to help consumers determine if their information has been potentially impacted and to sign up for credit file monitoring and identity theft protection. The offering, called TrustedID Premier, includes 3-Bureau credit monitoring of Equifax, Experian and Transunion credit reports; copies of Equifax credit reports; the ability to lock and unlock Equifax credit reports; identity theft insurance; and Internet scanning for Social Security numbers - all complimentary to U.S. consumers for one year. The Equifax website's frequently asked questions page, https :/ /www. equifaxsecuri ty20 1 7. com/freguentl y-asked-questions/, explains the difference between a credit file lock and a security freeze noting: At their most basic level, both prevent new creditors from accessing your Equifax credit report unless you give permission or take an action such as removing, unlocking, or lifting the freeze or lock. Both a security freeze and a credit file lock help prevent a lender or other creditor from accessing a consumer's credit report to open unauthorized new accounts. • Security freezes were created in the early 2000's, are subject to regulation by each state and use a PIN based system for authentication. • Credit file locks were created more recently, are mobile-enabled and use modern authentication techniques, such as username and passwords and one-time passcodes for better user experience. Alaskan consumers, through no fault of their own, may be greatly and negatively impacted by the unauthorized access to personal and other information that was in the possession of Equifax and, in response to the Equifax cybersecurity incident, may seek to prevent new creditors from accessing their Equifax credit reports via a security freeze or credit file lock. The Alaska Division of Insurance (division) will not consider these consumer responses to be activities that have, or should have, any bearing on that consumer's creditworthiness, credit standing, or credit capacity under AS 21.36.460. The division reminds insurers that under AS 21.36.460( d)(2), an insurer may not: cancel, deny, underwrite, or rate personal insurance coverage based in whole or in part on (A) the absence of credit history or the inability to determine the consumer's credit history if the insurer has received accurate and complete information from the consumer; this subparagraph does not apply if the insurer treats the consumer as if the consumer had neutral credit information as approved by the director; For an insurer who contracts exclusively with Equifax for credit reports, the division encourages the insurer to discuss with a new insurance consumer the advantages and disadvantages the consumer's Equifax security freeze or credit file lock and resulting neutral credit information may have on the insurance transaction. For an insurer who does not contract exclusively Equifax, or who contracts with a different credit agency, the new insurance consumer may benefit from a credit report which results in a more favorable outcome for the consumer than if the consumer were treated as if they had neutral credit information. The division will consider AS 21.36.460 violated if an insurer writing personal insurance in this state takes an adverse action under the statute as a result of a consumer's Equifax security freeze or credit file lock when reasonable alternatives exist for the insurer to utilize an alternative credit agency to access the consumer's credit information. If you have questions regarding this bulletin, please contact the Division of Insurance at P .0. Box 110805, Juneau, AK 99801-0805; (907) 465-2515; or i urance alaska. ov. Dated October lo.J-h , 2017.