Minnesota, Maryland, and Georgia Pass Legislation Concerning Fees Related to Credit Security Freezes

Recently, Georgia, Minnesota, and Maryland all enacted laws that disallow a consumer credit reporting agency from charging a fee to a consumer for lifting a security freeze on credit reports.  While all three states will now prohibit fees for the lifting of a freeze, each state had slightly different ancillary components.

With the recent rise in data breaches and the resulting threat of identity theft, many consumers resort to placing a “security freeze” on their credit report.  A freeze will prohibit a consumer credit reporting agency from releasing the consumer’s credit report or credit score without the express authorization of the consumer, as provided by statute in the individual state.

While the Georgia legislation simply took away the ability of credit reporting agencies to charge fees as of May 3, 2018, the Minnesota and Maryland bills had further implications.  Minnesota does not allow a fee for the placing or lifting of a security freeze, however a $5 charge for the issuance of a new personal identification number—as long as it is a second reissuance—may be charged by an agency.  Minnesota also added a two-step protocol for reporting agencies to follow when dealing with a “protected person,” defined as an individual under the age of 16: 1) the request to place a freeze for a protected person must come from their representative; and 2) the representative must follow certain steps, including providing sufficient proof of authority to act on behalf of the protected person.  The lifting of the fee went into effect May 20, 2018, while the provisions concerning protected persons take effect January 1, 2019.

Maryland’s new law, which takes effect October 1, 2018, actually allows a consumer reporting agency to charge a fee, not more than $5, for placing a security freeze if the consumer had previously requested more than one freeze within a calendar year.  An agency must also waive the fee if the consumer has obtained a report of alleged identify fraud under Maryland law, and provides a copy of that report to the agency.