As Congress holds hearings, press conferences and otherwise wrings its hands
over the onslaught of data breaches and resulting identity theft, states are
taking action. And California is leading the pack.
It was the California Legislature, after all, that passed a seminal data-breach disclosure law in 2003. Only because of that legislation, millions of
Americans have been informed that their personal data might be in the hands
of identity thieves.
Earlier this year, Congress decided California might be onto something. But now Congress is still dithering while states continue to pass
laws.
California, for instance, didn’t stop at a breach disclosure law. It also
passed the nation’s first credit file freeze law. Since then, nine other
states — Texas, Louisiana, Vermont, Colorado, Connecticut, Illinois, Maine,
Nevada and Washington — enacted credit file freeze laws.
That’s the sort of momentum that catches Congress’ attention, as well as that of
credit bureaus, banks and think tanks that
dread the prospect of myriad regulations that vary from state to state.
“File freeze legislation enacted in the states gives roughly one-third of
all Americans some ability to freeze their credit report. These laws,
however, are all over the map,” Michael Turner, president and senior
scholar at the Information Policy Institute, states in a new white paper.
Turner adds, “Given the existence of national credit markets and national
credit reporting laws, it is sensible that all Americans enjoy the same
ability to add another layer of control over who may access and use their
personal credit information.”
In other words, Turner wants a national law pre-empting any state laws. The
Identity Theft Protection Act passed by the Senate Commerce Committee in July may be that ticket.
The proposed law requires data brokers,
government agencies and educational institutions to disclose breaches to
consumers if there is a “reasonable” risk of identity theft.
Once informed of a breach, some in Congress want to follow the states and
give consumers rights to freeze their credit files.
“Ideally, an efficient credit freeze law benefits individuals, credit
bureaus and lenders,” Turner writes. “Individuals would benefit from
additional protection against identity fraud. Bureaus would benefit from
reduced inaccuracies in credit files … and lenders would benefit from
diminished fraud costs.”
Opponents of credit file freezing, primarily the entire business community,
argue that consumers will lose out on discounts by not being able to apply
for store credit cards or will miss the opportunity to purchase a house or a
car when they cannot immediately access their credit.
Security experts worry credit file freeze legislation will simply give
identity thieves another data platform to crack, freezing and unfreezing the
files of identities they’ve swiped. Ironically, it appears, identity thieves
could use a consumer protection tool to elude detection.
“The alarmist scenario of an identity thief taking over someone’s identity
so thoroughly as to control their entire account line and credit history is
unlikely,” Turner claims, pointing out that individuals with frozen files
will still be able to access their credit reports with a PIN or some other
access and verification system.
According to Turner, predictions of a consumer wholesale rush to freeze
files will not result in businesses losing sales. Fewer than 2,000
Californians, he notes, have asked to have their files frozen. California,
though, requires a mailed request to freeze files.
“Should individuals be able to freeze their credit files through the
Internet or the telephone, the percentage of ID fraud victims who elect to
freeze their files could increase significantly,” he wrote.
Congress will have to sort out all of this when it returns to work after
the Labor Day holiday. And while Congress spends time debating, as many as 12
more states are expected to move forward with freeze laws in the near future.
