SECTION 1. Short title.

SEC. 2. Definition of credit freeze.

“(6) CREDIT FREEZE.—

“(A) IN GENERAL.—The term ‘credit freeze’ means a restriction placed at the request of a consumer or a personal representative of the consumer, on the consumer report of the consumer, that prohibits a consumer reporting agency from releasing the consumer report for a purpose relating to the extension of credit without the express authorization of the consumer.

“(B) EXCEPTION.—A credit freeze shall not apply to the use of a consumer report by any of the following:

“(i) A person, or the subsidiary, affiliate, agent, subcontractor, or assignee of the person, with whom the consumer has, or prior to assignment had, an account, contract, or debtor-creditor relationship for the purposes of reviewing the active account or collecting the financial obligation owed on the account, contract, or debt.

“(ii) A person, or the subsidiary, affiliate, agent, subcontractor, or assignee of the person, to whom access has been granted pursuant to a request by the consumer described under section 605A(i)(1)(B), for purposes of facilitating the extension of credit or other permissible use.

“(iii) Any person acting pursuant to a court order, warrant, or subpoena.

“(iv) A Federal, State, or local government, or an agent or assignee thereof.

“(v) Any person for the sole purpose of providing a credit monitoring or identity theft protection service to which the consumer has subscribed.

“(vi) Any person for the purpose of providing a consumer with a copy of the consumer report or credit score of the consumer upon request by the consumer.

“(vii) Any person or entity for insurance purposes, including use in setting or adjusting a rate, adjusting a claim, or underwriting.

“(viii) Any person acting pursuant to an authorization from a consumer to use their consumer report for employment purposes.”.

SEC. 3. Enhancement of fraud alert protections.

(1) in subsection (a)—

(A) in the subsection heading, by striking “One-Call” and inserting “One-Year”;

(B) in paragraph (1)—

(i) in the paragraph heading, by striking “Initial alerts” and inserting “In general”;

(ii) in the matter preceding subparagraph (A), by inserting “or harmed by the unauthorized disclosure of the financial or personally identifiable information of the consumer,” after “identity theft,”;

(iii) in subparagraph (A)—

(I) by striking “90 days” and inserting “1 year”; and

(II) by striking “and” at the end;

(iv) in subparagraph (B)—

(I) by inserting “1-year” before “fraud alert”; and

(II) by striking the period at the end and inserting “; and”; and

(v) by adding at the end the following:

“(C) upon the expiration of the 1-year period described in subparagraph (A) or a subsequent 1-year period, and in response to a direct request by the consumer or such representative, continue the fraud alert for an additional period of 1 year if the information asserted in this paragraph remains applicable.”; and

(C) in paragraph (2)—

(i) in the matter preceding subparagraph (A), by inserting “1-year” before “fraud alert”; and

(ii) in subparagraph (B), by striking “any request described in subparagraph (A)” and inserting “the consumer reporting agency includes the 1-year fraud alert in the file of the consumer”;

(2) in subsection (b)—

(A) in the subsection heading, by striking “Extended” and inserting “Seven-Year”;

(B) in paragraph (1)—

(i) in subparagraph (B)—

(I) by striking “5-year period beginning on the date of such request” and inserting “the 7-year period described in subparagraph (A)”; and

(II) by striking “and” at the end;

(ii) in subparagraph (C)—

(I) by striking “extended” and inserting “7-year”; and

(II) by striking the period at the end and inserting “; and”; and

(iii) by adding at the end the following:

“(D) upon the expiration of the 7-year period described in subparagraph (A) or a subsequent 7-year period, and in response to a direct request by the consumer or such representative, continue the fraud alert for an additional period of 7 years if the consumer or such representative submits an updated identity theft report.”; and

(C) in paragraph (2), by amending subparagraph (A) to read as follows:

“(A) disclose to the consumer that the consumer may request a free copy of the file of the consumer pursuant to section 612(d) during each 12-month period beginning on the date on which the 7-year fraud alert was included in the file and ending on the date of the last day that the 7-year fraud alert applies to the file of the consumer; and”;

(3) in subsection (c)—

(A) by redesignating paragraphs (1), (2), and (3), as subparagraphs (A), (B), and (C), respectively, and adjusting the margins accordingly;

(B) in the matter preceding subparagraph (A), as so redesignated, by striking “Upon the direct request” and inserting the following:

“(1) IN GENERAL.—Upon the direct request”; and

(C) by adding at the end the following:

“(2) ACCESS TO FREE REPORTS.—If a consumer reporting agency includes an active duty alert in the file of an active duty military consumer, the consumer reporting agency shall—

“(A) disclose to the active duty military consumer that the active duty military consumer may request a free copy of the file of the active duty military consumer pursuant to section 612(d), during each 12-month period beginning on the date on which the activity duty military alert is requested and ending on the date of the last day that the active duty alert applies to the file of the active duty military consumer; and

“(B) not later than 3 business days after the date on which the active duty military consumer makes a request described in subparagraph (A), provide to the active duty military consumer all disclosures required to be made under section 609, without charge to the active duty military consumer.”;

(4) by amending subsection (d) to read as follows:

“(d) Procedures.—Each consumer reporting agency described in section 603(p) shall establish and make available to the public on the Internet website of the consumer reporting agency policies and procedures to comply with this section, including policies and procedures—

“(1) that inform consumers of the availability of 1-year fraud alerts, 7-year fraud alerts, active duty alerts, and credit freezes, as applicable;

“(2) that allow consumers to request 1-year fraud alerts, 7-year fraud alerts, and active duty alerts, as applicable, and to place, temporarily lift, or fully remove a credit freeze in a simple and easy manner; and

“(3) for asserting in good faith a suspicion that the consumer has been or is about to become a victim of identity theft, fraud, or a related crime, or harmed by the unauthorized disclosure of the financial or personally identifiable information of the consumer, for a consumer seeking a 1-year fraud alert or credit freeze.”;

(5) in subsection (e), in the matter preceding paragraph (1), by inserting “1-year or 7-year” before “fraud alert”;

(6) in subsection (f), by striking “or active duty alert” and inserting “active duty alert, or credit freeze, as applicable,”;

(7) in subsection (g)—

(A) by inserting “or has been harmed by the unauthorized disclosure of the financial or personally identifiable information of the consumer,” after “identity theft,”; and

(B) by inserting “or credit freezes” after “request alerts”; and

(8) in subsection (h)—

(A) in paragraph (1)—

(i) in the paragraph heading, by striking “initial” and inserting “1-year”;

(ii) in subparagraph (A), by striking “initial” and inserting “1-year”; and

(iii) in subparagraph (B)(i), by striking “an initial” and inserting “a 1-year”; and

(B) in paragraph (2)—

(i) in the paragraph heading, by striking “extended” and inserting “7-year”;

(ii) in subparagraph (A), in the matter preceding clause (i), by striking “extended” and inserting “7-year”; and

(iii) in subparagraph (B), by striking “an extended” and inserting “a 7-year”.

SEC. 4. Providing free access to credit freezes.

“(i) Credit freezes.—

“(1) IN GENERAL.—Upon the direct request of a consumer, or an individual acting on behalf of or as a personal representative of a consumer, a consumer reporting agency that maintains a file on the consumer and has received appropriate proof of the identity of the requester (as described in section 1022.123 of title 12, Code of Federal Regulations, or any successor thereto) shall—

“(A) (i) not later than 1 business day after receiving the request sent by postal mail, toll-free telephone, or secure electronic means as established by the agency, place a credit freeze on the file of the consumer;

“(ii) not later than 5 business days after placing a credit freeze described in clause (i), provide the consumer with written confirmation of the credit freeze and a unique personal identification number or password (other than the social security number of the consumer) for use to authorize the release of the file of the consumer for a specific period of time; and

“(iii) disclose all relevant information to the consumer relating to the procedures for temporarily lifting and fully removing a credit freeze, including a statement about the maximum amount of time given to an agency to conduct those actions;

“(B) if the consumer provides a correct personal identification number or password, temporarily lift an existing credit freeze from the file of the consumer for a period of time specified by the consumer for a specific user or category of users, as determined by the consumer—

“(i) not later than 1 business day after receiving the request by postal mail; or

“(ii) not later than 15 minutes after receiving the request by toll-free telephone number or secure electronic means established by the agency, if the request is received during regular business hours, except if the ability of the consumer reporting agency to temporarily lift the credit freeze is prevented by—

“(I) an act of God, including earthquakes, hurricanes, storms, or similar natural disaster or phenomenon, or fire;

“(II) unauthorized or illegal acts by a third party including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or a similar occurrence;

“(III) an operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or a similar disruption;

“(IV) governmental action, including emergency orders or regulations, judicial or law enforcement action, or a similar directive;

“(V) regularly scheduled maintenance or updates to the systems of the consumer reporting agency occurring outside of normal business hours; or

“(VI) commercially reasonable maintenance of, or repair to, the systems of the consumer reporting agency that is unexpected or unscheduled; or

“(C) if the consumer provides a correct personal identification number or password, fully remove an existing credit freeze from the file of the consumer not later than 21 business days after receiving the request by postal mail, toll-free telephone, or secure electronic means established by the consumer reporting agency.

“(2) NO FEE.—A consumer reporting agency may not charge a consumer a fee to place, temporarily lift, or fully remove a credit freeze.

“(3) EXCLUSION FROM THIRD-PARTY LISTS.—During the period beginning on the date on which a consumer or a representative of the consumer requests to place a credit freeze and ending the date on which the consumer or representative requests to fully remove a credit freeze, a consumer reporting agency shall exclude the consumer from any list of consumers prepared by the consumer reporting agency and provided to any third party to offer credit or insurance to the consumer as part of a transaction that was not initiated by the consumer, unless the consumer or that representative requests that the exclusion be rescinded before end of the period.”.

SEC. 5. Additional free consumer report.

(1) in subsection (f)(1), in the matter preceding subparagraph (A), by inserting “or subsection (h)” after “through (d)”; and

(2) by adding at the end the following:

“(h) Free disclosures in connection with credit freeze.—In addition to the free annual disclosure required under subsection (a)(1)(A), each consumer reporting agency that maintains a file on a consumer who requests a credit freeze under section 605A(i) shall make all disclosures pursuant to section 609 once during any 12-month period without charge to the consumer if the consumer makes a request under section 609.”.

SEC. 6. Refunds.