Consumer Report Security Freezes

STATE OF MAINE DEPARTMENT OF PROFESSIONAL AND FINANCIAL REGULATION BUREAU OF INSURANCE AND BUREAU OF CONSUMER CREDIT PROTECTION l'aul ll. Lc l':igL ( ;m I R '\/()){ Bureau of Insurance Bulletin 412 Bureau of Consumer Credit Protection Advisory Ruling FCRA-AR 16-1 Consumer Report Security Freezes The Maine Fair Credit Reporting Act ("FCRA")1 allows Maine consumers to place freezes on their credit records.2 This is an important consumer protection for Maine consumers, given the proliferation of data security breaches and other attacks on their financial records. However, the regulated entities that work with frozen accounts do not always handle freezes in ways that recognize existing insurance relationships with consumers. These regulated entities include insurers that use credit information to underwrite or rate personal insurance policies, vendors that supply insurance scoring information to insurers, and consumer reporting agencies from which those insurers or vendors obtain credit information. In our respective capacities as the regulators responsible for enforcing the Maine Insurance Code3 and the FCRA, the Superintendent of Insurance and the Superintendent of the Maine Bureau of Consumer Credit Protection therefore direct this Bulletin/Advisory Ruling to those insurers, vendors, and consumer reporting agencies. Our purpose is to explain how they should handle the renewal of insurance policies where consumers have frozen their credit records. The FCRA defines a security freeze as a notice, placed in a consumer report at the consumer's request, that "prohibits a consumer reporting agency from releasing the consumer['s) report or any information in the report without that consumer's express authorization."4 More specifically, under the FCRA, a consumer reporting agency may not release either a consumer's report or any information from it without the consumer's express authorization. The FCRA also prohibits a consumer reporting agency from releasing information from a consumer report to a third party without authorization.5 However. a consumer reporting agency may tell a third party that a security freeze is in effect.6 Importantly, the FCRA's security freeze provisions do not apply when a person has "an account, contract or debtor-creditor relationship" with a consumer and the person seeks the consumer's credit information for the purposes specified in the FCRA.7 Those purposes include "reviewing the account or collecting the financial obligation owing for the account, contract or debt or extending credit to a consumer with a prior or existing account, contract or debtor-creditor relationship." The statute describes "reviewing the account'" as including ·'activities related to I 10 M.R.S. §§ 1306-1310-H 2 10 M.R.S. § 1310 3 Title 24-A M.R.S. ~ 10 M.R.S. § 1308(7) s 10 M.R.S. § 1310(1)(8) 6 Id. 7 10 M.R.S. § 1310(1 )(M)( I) 011· 1< 1.s L oe \II I> \I 76 '-. 1rn1111 KN \ \I NLI. G \KD l 1' 1 R. ~ l \INI 0 131 5 http://www. mamc. µov / p&/ in~uraacc/ mdcx.shrml hll:p: //www Old!Ol'.~·1v / p (r/cc1mumcrcrc<lu I m<lci. .~html account maintenance, monitoring, credit line increases and account upgrades and enhancements.''8 It has come to our attention that some consumer reporting agencies interpret this language as applying only to credit-related accounts, and not to other types ofaccounts such as insurance accounts. In our view, the controlling statutes do not support such a narrow interpretation for several reasons. First, the phrase "debtor-creditor" in Section I 310(1 )(M)(I) of the FCRA modifies only "'relationship'' and not "account" or "contract." Second, this statute does not specify the al lowed activities and, therefore, does not limit them to credit-related activities. Rather, it is enough that the activity relate, for example, to ''account maintenance" or '"morutoring.'· In our view, the decision to renew an insurance policy involves "account maintenance" and "monitoring" at a minimum. Other activities related to the policy, such as the decision to increase coverage, clearly fall into the category of ··account upgrades and enhancements." Third, the Insurance Code presumes in its personal lines cancellation and renewal statutes that insurance policies will renew.9 This presumption is an important policyholder protection. Entities working with credit information that underlies the tem1s on which an insurer will renew a policy should not act in a way that hampers this protection. Finally, consumers place freezes on their credit information to simplify their financial lives, not to complicate them. This interpretation unnecessarily burdens what in the vast majority of cases is a simple transaction. Therefore, insurers that use credit information to underwrite or rate policies, the vendors from which they get insurance scores, and the consumer reporting agencies that supply credit information must establish procedures that implement the purposes of the FCRA's exception for existing accounts to the freeze provisions and the Insurance Code's renewal statutes. Insurers, vendors, and consumer reporting agencies should develop and implement procedures that will prevent policyholders from receiving adverse action notices based on the existence of freezes that they have placed. Companies that fail to adopt such procedures may be subject to disciplinary action. May 5, 2016 William N. Lund Superintendent ofConsumer Credit Protection NOTE: This Bulletin/Advisory Ruling is intended solely for informational purposes. It is not intended to set forth legal rights, duties, or privileges, nor is it intended to provide legal advice. Readers should consult applicable statutes and rules and contact the Bureau of Insurance or Bureau of Consumer Credit Protection if additional information is needed. s Id. 9 The Automobile Insurance Cancellation Control Act, 24-A M.R.S. §§ 29 11 - 2924, and Property Insurance Cancel- lation Control Act, 24-A M.R.S. §§ 3048- 3061 , limit the reasons for which insurers may nonrenew policies subject to these laws. For details, see 24-A M.R.S. § 2916-A and § 305 1. - 2 -