text: SECTION 1. SHORT TITLE.
  
      This Act may be cited as the ``Freedom from Equifax Exploitation 
  Act''.
  
  SEC. 2. DEFINITION OF CREDIT FREEZE.
  
      Section 603(q) of the Fair Credit Reporting Act (15 U.S.C. 
  1681a(q)) is amended by adding at the end the following:
              ``(6) Credit freeze.--
                      ``(A) In general.--The term `credit freeze' means a 
                  restriction placed at the request of a consumer or a 
                  personal representative of the consumer, on the 
                  consumer report of the consumer, that prohibits a 
                  consumer reporting agency from releasing the consumer 
                  report for a purpose relating to the extension of 
                  credit without the express authorization of the 
                  consumer.
                      ``(B) Exception.--A credit freeze shall not apply 
                  to the use of a consumer report by any of the 
                  following:
                              ``(i) A person, or the subsidiary, 
                          affiliate, agent, subcontractor, or assignee of 
                          the person, with whom the consumer has, or 
                          prior to assignment had, an account, contract, 
                          or debtor-creditor relationship for the 
                          purposes of reviewing the active account or 
                          collecting the financial obligation owed on the 
                          account, contract, or debt.
                              ``(ii) A person, or the subsidiary, 
                          affiliate, agent, subcontractor, or assignee of 
                          the person, to whom access has been granted 
                          pursuant to a request by the consumer described 
                          under section 605A(i)(1)(B), for purposes of 
                          facilitating the extension of credit or other 
                          permissible use.
                              ``(iii) Any person acting pursuant to a 
                          court order, warrant, or subpoena.
                              ``(iv) A Federal, State, or local 
                          government, or an agent or assignee thereof.
                              ``(v) Any person for the sole purpose of 
                          providing a credit monitoring or identity theft 
                          protection service to which the consumer has 
                          subscribed.
                              ``(vi) Any person for the purpose of 
                          providing a consumer with a copy of the 
                          consumer report or credit score of the consumer 
                          upon request by the consumer.
                              ``(vii) Any person or entity for insurance 
                          purposes, including use in setting or adjusting 
                          a rate, adjusting a claim, or underwriting.
                              ``(viii) Any person acting pursuant to an 
                          authorization from a consumer to use their 
                          consumer report for employment purposes.''.
  
  SEC. 3. ENHANCEMENT OF FRAUD ALERT PROTECTIONS.
  
      Section 605A of the Fair Credit Reporting Act (15 U.S.C. 1681c-1) 
  is amended--
              (1) in subsection (a)--
                      (A) in the subsection heading, by striking ``One-
                  Call'' and inserting ``One-Year'';
                      (B) in paragraph (1)--
                              (i) in the paragraph heading, by striking 
                          ``Initial alerts'' and inserting ``In 
                          general'';
                              (ii) in the matter preceding subparagraph 
                          (A), by inserting ``or harmed by the 
                          unauthorized disclosure of the financial or 
                          personally identifiable information of the 
                          consumer,'' after ``identity theft,'';
                              (iii) in subparagraph (A)--
                                      (I) by striking ``90 days'' and 
                                  inserting ``1 year''; and
                                      (II) by striking ``and'' at the 
                                  end;
                              (iv) in subparagraph (B)--
                                      (I) by inserting ``1-year'' before 
                                  ``fraud alert''; and
                                      (II) by striking the period at the 
                                  end and inserting ``; and''; and
                              (v) by adding at the end the following:
                      ``(C) upon the expiration of the 1-year period 
                  described in subparagraph (A) or a subsequent 1-year 
                  period, and in response to a direct request by the 
                  consumer or such representative, continue the fraud 
                  alert for an additional period of 1 year if the 
                  information asserted in this paragraph remains 
                  applicable.''; and
                      (C) in paragraph (2)--
                              (i) in the matter preceding subparagraph 
                          (A), by inserting ``1-year'' before ``fraud 
                          alert''; and
                              (ii) in subparagraph (B), by striking ``any 
                          request described in subparagraph (A)'' and 
                          inserting ``the consumer reporting agency 
                          includes the 1-year fraud alert in the file of 
                          the consumer'';
              (2) in subsection (b)--
                      (A) in the subsection heading, by striking 
                  ``Extended'' and inserting ``Seven-Year'';
                      (B) in paragraph (1)--
                              (i) in subparagraph (B)--
                                      (I) by striking ``5-year period 
                                  beginning on the date of such request'' 
                                  and inserting ``the 7-year period 
                                  described in subparagraph (A)''; and
                                      (II) by striking ``and'' at the 
                                  end;
                              (ii) in subparagraph (C)--
                                      (I) by striking ``extended'' and 
                                  inserting ``7-year''; and
                                      (II) by striking the period at the 
                                  end and inserting ``; and''; and
                              (iii) by adding at the end the following:
                      ``(D) upon the expiration of the 7-year period 
                  described in subparagraph (A) or a subsequent 7-year 
                  period, and in response to a direct request by the 
                  consumer or such representative, continue the fraud 
                  alert for an additional period of 7 years if the 
                  consumer or such representative submits an updated 
                  identity theft report.''; and
                      (C) in paragraph (2), by amending subparagraph (A) 
                  to read as follows:
                      ``(A) disclose to the consumer that the consumer 
                  may request a free copy of the file of the consumer 
                  pursuant to section 612(d) during each 12-month period 
                  beginning on the date on which the 7-year fraud alert 
                  was included in the file and ending on the date of the 
                  last day that the 7-year fraud alert applies to the 
                  file of the consumer; and'';
              (3) in subsection (c)--
                      (A) by redesignating paragraphs (1), (2), and (3), 
                  as subparagraphs (A), (B), and (C), respectively, and 
                  adjusting the margins accordingly;
                      (B) in the matter preceding subparagraph (A), as so 
                  redesignated, by striking ``Upon the direct request'' 
                  and inserting the following:
              ``(1) In general.--Upon the direct request''; and
                      (C) by adding at the end the following:
              ``(2) Access to free reports.--If a consumer reporting 
          agency includes an active duty alert in the file of an active 
          duty military consumer, the consumer reporting agency shall--
                      ``(A) disclose to the active duty military consumer 
                  that the active duty military consumer may request a 
                  free copy of the file of the active duty military 
                  consumer pursuant to section 612(d), during each 12-
                  month period beginning on the date on which the 
                  activity duty military alert is requested and ending on 
                  the date of the last day that the active duty alert 
                  applies to the file of the active duty military 
                  consumer; and
                      ``(B) not later than 3 business days after the date 
                  on which the active duty military consumer makes a 
                  request described in subparagraph (A), provide to the 
                  active duty military consumer all disclosures required 
                  to be made under section 609, without charge to the 
                  active duty military consumer.'';
              (4) by amending subsection (d) to read as follows:
      ``(d) Procedures.--Each consumer reporting agency described in 
  section 603(p) shall establish and make available to the public on the 
  Internet website of the consumer reporting agency policies and 
  procedures to comply with this section, including policies and 
  procedures--
              ``(1) that inform consumers of the availability of 1-year 
          fraud alerts, 7-year fraud alerts, active duty alerts, and 
          credit freezes, as applicable;
              ``(2) that allow consumers to request 1-year fraud alerts, 
          7-year fraud alerts, and active duty alerts, as applicable, and 
          to place, temporarily lift, or fully remove a credit freeze in 
          a simple and easy manner; and
              ``(3) for asserting in good faith a suspicion that the 
          consumer has been or is about to become a victim of identity 
          theft, fraud, or a related crime, or harmed by the unauthorized 
          disclosure of the financial or personally identifiable 
          information of the consumer, for a consumer seeking a 1-year 
          fraud alert or credit freeze.'';
              (5) in subsection (e), in the matter preceding paragraph 
          (1), by inserting ``1-year or 7-year'' before ``fraud alert'';
              (6) in subsection (f), by striking ``or active duty alert'' 
          and inserting ``active duty alert, or credit freeze, as 
          applicable,'';
              (7) in subsection (g)--
                      (A) by inserting ``or has been harmed by the 
                  unauthorized disclosure of the financial or personally 
                  identifiable information of the consumer,'' after 
                  ``identity theft,''; and
                      (B) by inserting ``or credit freezes'' after 
                  ``request alerts''; and
              (8) in subsection (h)--
                      (A) in paragraph (1)--
                              (i) in the paragraph heading, by striking 
                          ``initial'' and inserting ``1-year'';
                              (ii) in subparagraph (A), by striking 
                          ``initial'' and inserting ``1-year''; and
                              (iii) in subparagraph (B)(i), by striking 
                          ``an initial'' and inserting ``a 1-year''; and
                      (B) in paragraph (2)--
                              (i) in the paragraph heading, by striking 
                          ``extended'' and inserting ``7-year'';
                              (ii) in subparagraph (A), in the matter 
                          preceding clause (i), by striking ``extended'' 
                          and inserting ``7-year''; and
                              (iii) in subparagraph (B), by striking ``an 
                          extended'' and inserting ``a 7-year''.
  
  SEC. 4. PROVIDING FREE ACCESS TO CREDIT FREEZES.
  
      Section 605A of the Fair Credit Reporting Act (15 U.S.C. 1681c-1) 
  is amended by adding at the end the following:
      ``(i) Credit Freezes.--
              ``(1) In general.--Upon the direct request of a consumer, 
          or an individual acting on behalf of or as a personal 
          representative of a consumer, a consumer reporting agency that 
          maintains a file on the consumer and has received appropriate 
          proof of the identity of the requester (as described in section 
          1022.123 of title 12, Code of Federal Regulations, or any 
          successor thereto) shall--
                      ``(A)(i) not later than 1 business day after 
                  receiving the request sent by postal mail, toll-free 
                  telephone, or secure electronic means as established by 
                  the agency, place a credit freeze on the file of the 
                  consumer;
                      ``(ii) not later than 5 business days after placing 
                  a credit freeze described in clause (i), provide the 
                  consumer with written confirmation of the credit freeze 
                  and a unique personal identification number or password 
                  (other than the social security number of the consumer) 
                  for use to authorize the release of the file of the 
                  consumer for a specific period of time; and
                      ``(iii) disclose all relevant information to the 
                  consumer relating to the procedures for temporarily 
                  lifting and fully removing a credit freeze, including a 
                  statement about the maximum amount of time given to an 
                  agency to conduct those actions;
                      ``(B) if the consumer provides a correct personal 
                  identification number or password, temporarily lift an 
                  existing credit freeze from the file of the consumer 
                  for a period of time specified by the consumer for a 
                  specific user or category of users, as determined by 
                  the consumer--
                              ``(i) not later than 1 business day after 
                          receiving the request by postal mail; or
                              ``(ii) not later than 15 minutes after 
                          receiving the request by toll-free telephone 
                          number or secure electronic means established 
                          by the agency, if the request is received 
                          during regular business hours, except if the 
                          ability of the consumer reporting agency to 
                          temporarily lift the credit freeze is prevented 
                          by--
                                      ``(I) an act of God, including 
                                  earthquakes, hurricanes, storms, or 
                                  similar natural disaster or phenomenon, 
                                  or fire;
                                      ``(II) unauthorized or illegal acts 
                                  by a third party including terrorism, 
                                  sabotage, riot, vandalism, labor 
                                  strikes or disputes disrupting 
                                  operations, or a similar occurrence;
                                      ``(III) an operational 
                                  interruption, including electrical 
                                  failure, unanticipated delay in 
                                  equipment or replacement part delivery, 
                                  computer hardware or software failures 
                                  inhibiting response time, or a similar 
                                  disruption;
                                      ``(IV) governmental action, 
                                  including emergency orders or 
                                  regulations, judicial or law 
                                  enforcement action, or a similar 
                                  directive;
                                      ``(V) regularly scheduled 
                                  maintenance or updates to the systems 
                                  of the consumer reporting agency 
                                  occurring outside of normal business 
                                  hours; or
                                      ``(VI) commercially reasonable 
                                  maintenance of, or repair to, the 
                                  systems of the consumer reporting 
                                  agency that is unexpected or 
                                  unscheduled; or
                      ``(C) if the consumer provides a correct personal 
                  identification number or password, fully remove an 
                  existing credit freeze from the file of the consumer 
                  not later than 21 business days after receiving the 
                  request by postal mail, toll-free telephone, or secure 
                  electronic means established by the consumer reporting 
                  agency.
              ``(2) No fee.--A consumer reporting agency may not charge a 
          consumer a fee to place, temporarily lift, or fully remove a 
          credit freeze.
              ``(3) Exclusion from third-party lists.--During the period 
          beginning on the date on which a consumer or a representative 
          of the consumer requests to place a credit freeze and ending 
          the date on which the consumer or representative requests to 
          fully remove a credit freeze, a consumer reporting agency shall 
          exclude the consumer from any list of consumers prepared by the 
          consumer reporting agency and provided to any third party to 
          offer credit or insurance to the consumer as part of a 
          transaction that was not initiated by the consumer, unless the 
          consumer or that representative requests that the exclusion be 
          rescinded before end of the period.''.
  
  SEC. 5. ADDITIONAL FREE CONSUMER REPORT.
  
      Section 612 of the Fair Credit Reporting Act (15 U.S.C. 1681j) is 
  amended--
              (1) in subsection (f)(1), in the matter preceding 
          subparagraph (A), by inserting ``or subsection (h)'' after 
          ``through (d)''; and
              (2) by adding at the end the following:
      ``(h) Free Disclosures in Connection With Credit Freeze.--In 
  addition to the free annual disclosure required under subsection 
  (a)(1)(A), each consumer reporting agency that maintains a file on a 
  consumer who requests a credit freeze under section 605A(i) shall make 
  all disclosures pursuant to section 609 once during any 12-month period 
  without charge to the consumer if the consumer makes a request under 
  section 609.''.
  
  SEC. 6. REFUNDS.
  
      (a) Definitions.--In this section, the terms ``consumer'', 
  ``consumer reporting agency'', and ``credit freeze'' have the meanings 
  given those terms in section 603 of the Fair Credit Reporting Act (15 
  U.S.C. 1681a), as amended by section 2.
      (b) Refunds.--With respect to any consumer who requested a credit 
  freeze from a consumer reporting agency during the period beginning on 
  September 7, 2017, and ending on the day before the date of enactment 
  of this Act, the consumer reporting agency--
              (1) shall issue a refund to the consumer for any fees 
          charged to the consumer relating to the request for a credit 
          freeze; and
              (2) may not impose a fee on the consumer to temporarily 
          lift or fully remove the credit freeze.
target: Freedom from Equifax Exploitation Act This bill amends the Fair Credit Reporting Act to revise fraud alert provisions required of consumer reporting agencies. A fraud alert must be placed in a consumer's file upon request if the consumer suspects harm from an unauthorized disclosure. The time period for fraud alerts is extended from 90 days to 1 year. The bill also revises provisions relating to 7-year renewable fraud alerts in cases of identity theft.  The bill establishes a credit freeze process. A consumer reporting agency must place a free credit freeze on the consumer's file upon a consumer's request, prohibiting a consumer reporting agency from releasing any credit information without the consumer's permission. Consumer reporting agencies must provide procedures for temporarily and permanently lifting the freeze at no charge to the consumer. Consumers are allowed a free credit report when requesting a credit freeze. While the file is subject to a freeze, a consumer reporting agency is prohibited from including the consumer in lists provided to third parties for credit or insurance offers. A consumer reporting agency must provide on the Internet policies and procedures for consumers to: (1) place, temporarily lift, or fully remove a credit freeze; and (2) make required statements for fraud alerts or credit freezes.  The bill requires consumer reporting agencies to issue a refund of fees to any consumer who requested a credit freeze beginning September 7, 2017, through the day before enactment of this bill. 
feat_title: Freedom from Equifax Exploitation Act