Chapter ATCP 112

Chapter ATCP 112

CREDIT REPORT SECURITY FREEZES

ATCP 112.01   Definitions.

ATCP 112.02   Proper identification to create a security freeze.

ATCP 112.03   Proof of identity to release a credit report or remove a security freeze.

ATCP 112.04   Written procedures.

Ch. ATCP 112 Note Note: Chapter ATCP 112 was created as an emergency rule eff. 1-19-07.

ATCP 112.01 ATCP 112.01 Definitions. In this chapter:

ATCP 112.01(1) (1) “Consumer report” has the meaning given in 15 USC 1681a (d).

ATCP 112.01(2) (2) “Consumer reporting agency” has the meaning given in 15 USC 1681a (f).

ATCP 112.01(3) (3) “Proper identification” means information that is sufficient to confirm, with reasonable assurance, that an individual is who he or she claims to be.

ATCP 112.01(4) (4) “Security freeze” has the meaning given in s. 100.54 (1) (e), Stats.

ATCP 112.01 History History: CR 06-130: cr. Register September 2007 No. 621, eff. 10-1-07.

ATCP 112.02 ATCP 112.02 Proper identification to create a security freeze. A consumer reporting agency may require proper identification of an individual who requests a security freeze under s. 100.54 (2) (a), Stats. Proper identification may include any of the following:

ATCP 112.02(1) (1) The individual’s current full name, and prior names if any.

ATCP 112.02(2) (2) The individual’s current address, and recent prior addresses if any.

ATCP 112.02(3) (3) The individual’s social security number.

ATCP 112.02(4) (4) The individual’s date of birth.

ATCP 112.02(5) (5) Copies of appropriate identifying documents, if justified under s. ATCP 112.04. Identifying documents may include documents authorized under 16 CFR 614.1.

ATCP 112.02(6) (6) Identifying information, readily known by the individual in whose name the security freeze is requested but not generally known by others, which the consumer reporting agency lawfully obtained before receiving the security freeze request.

ATCP 112.02 History History: CR 06-130: cr. Register September 2007 No. 621, eff. 10-1-07.

ATCP 112.03 ATCP 112.03 Proof of identity to release a credit report or remove a security freeze.

ATCP 112.03(1) (1) A consumer reporting agency may require any of the following information from an individual as proof of identity for purposes of s. 100.54 (4) (a) 2. and (6) (a) 2., Stats.:

ATCP 112.03(1)(a) (a) Any identifying information or identifying document that complies with s. ATCP 112.02.

ATCP 112.03(1)(b) (b) Except as provided in sub. (2), a personal identification number, password, or other device or system that uniquely identifies the individual.

ATCP 112.03(2) (2) In no case may the consumer reporting agency use a device or system that requires the individual to provide identifying information that was not previously obtained by the consumer reporting agency.

ATCP 112.03 Note Note: Subsection (2) does not prohibit the credit reporting agency from accepting new information from an individual who offers the information voluntarily. For example, when a credit reporting agency is unable to grant a request to suspend a freeze because the individual requesting the freeze cannot remember the password or provide other identifying information, the credit reporting agency may accept new information offered voluntarily by the individual for the purpose of establishing identity.

ATCP 112.03 History History: CR 06-130: cr. Register September 2007 No. 621, eff. 10-1-07.

ATCP 112.04 ATCP 112.04 Written procedures. A consumer reporting agency shall adopt and implement written procedures for obtaining proper identification under s. 100.54 (2) (a) 2., (4) (a) 2., and (6) (a) 2., Stats. The procedures shall be consistent with this chapter and s. 100.54, Stats. The procedures shall do all of the following:

ATCP 112.04(1) (1) Enable the consumer reporting agency to confirm the identity of a requesting individual, so that the consumer reporting agency can correctly match the individual with his or her file.

ATCP 112.04(2) (2) Establish identification requirements that are commensurate with identifiable risks of harm related to possible misidentification of individuals.

ATCP 112.04(3) (3) Avoid requesting more information than necessary to confirm an individual’s identity unless the information is necessary for payment purposes.

ATCP 112.04 History History: CR 06-130: cr. Register September 2007 No. 621, eff. 10-1-07.