Previous

Sec. 45.48.010. Disclosure of breach of security.

(a) If a covered person owns or licenses personal information in any form that includes personal information on a state resident, and a breach of the security of the information system that contains personal information occurs, the covered person shall, after discovering or being notified of the breach, disclose the breach to each state resident whose personal information was subject to the breach.

(b) An information collector shall make the disclosure required by (a) of this section in the most expeditious time possible and without unreasonable delay, except as provided in AS 45.48.020 and as necessary to determine the scope of the breach and restore the reasonable integrity of the information system.

(c) Notwithstanding (a) of this section, disclosure is not required if, after an appropriate investigation and after written notification to the attorney general of this state, the covered person determines that there is not a reasonable likelihood that harm to the consumers whose personal information has been acquired has resulted or will result from the breach. The determination shall be documented in writing, and the documentation shall be maintained for five years. The notification required by this subsection may not be considered a public record open to inspection by the public.

Sec. 45.48.020. Allowable delay in notification.

An information collector may delay disclosing the breach under AS 45.48.010 if an appropriate law enforcement agency determines that disclosing the breach will interfere with a criminal investigation. However, the information collector shall disclose the breach to the state resident in the most expeditious time possible and without unreasonable delay after the law enforcement agency informs the information collector in writing that disclosure of the breach will no longer interfere with the investigation.

Sec. 45.48.030. Methods of notice.

An information collector shall make the disclosure required by AS 45.48.010

(1) by a written document sent to the most recent address the information collector has for the state resident;

(2) by electronic means if the information collector's primary method of communication with the state resident is by electronic means or if making the disclosure by the electronic means is consistent with the provisions regarding electronic records and signatures required for notices legally required to be in writing under 15 U.S.C. 7001 et seq. (Electronic Signatures in Global and National Commerce Act); or

(3) if the information collector demonstrates that the cost of providing notice would exceed $150,000, that the affected class of state residents to be notified exceeds 300,000, or that the information collector does not have sufficient contact information to provide notice, by

(A) electronic mail if the information collector has an electronic mail address for the state resident;

(B) conspicuously posting the disclosure on the Internet website of the information collector if the information collector maintains an Internet website; and

(C) providing a notice to major statewide media.

Sec. 45.48.040. Notification of certain other agencies.

(a) If an information collector is required by AS 45.48.010 to notify more than 1,000 state residents of a breach, the information collector shall also notify without unreasonable delay all consumer credit reporting agencies that compile and maintain files on consumers on a nationwide basis and provide the agencies with the timing, distribution, and content of the notices to state residents.

(b) This section may not be construed to require the information collector to provide the consumer reporting agencies identified under (a) of this section with the names or other personal information of the state residents whose personal information was subject to the breach.

(c) This section does not apply to an information collector who is subject to the Gramm-Leach-Bliley Financial Modernization Act.

(d) In this section, "consumer credit reporting agency that compiles and maintains files on consumers on a nationwide basis" has the meaning given to "consumer reporting agency that compiles and maintains files on consumers on a nationwide basis" in 15 U.S.C. 1681a(p).

Sec. 45.48.050. Exception for employees and agents.

In AS 45.48.010 - 45.48.090, the good faith acquisition of personal information by an employee or agent of an information collector for a legitimate purpose of the information collector is not a breach of the security of the information system if the employee or agent does not use the personal information for a purpose unrelated to a legitimate purpose of the information collector and does not make further unauthorized disclosure of the personal information.

Sec. 45.48.060. Waivers.

A waiver of AS 45.48.010 - 45.48.090 is void and unenforceable.

Sec. 45.48.070. Treatment of certain breaches.

(a) If a breach of the security of the information system containing personal information on a state resident that is maintained by an information recipient occurs, the information recipient is not required to comply with AS 45.48.010 - 45.48.030. However, immediately after the information recipient discovers the breach, the information recipient shall notify the information distributor who owns the personal information or who licensed the use of the personal information to the information recipient about the breach and cooperate with the information distributor as necessary to allow the information distributor to comply with (b) of this section. In this subsection, "cooperate" means sharing with the information distributor information relevant to the breach, except for confidential business information or trade secrets.

(b) If an information recipient notifies an information distributor of a breach under (a) of this section, the information distributor shall comply with AS 45.48.010 - 45.48.030 as if the breach occurred to the information system maintained by the information distributor.

Sec. 45.48.080. Violations.

(a) If an information collector who is a governmental agency violates AS 45.48.010 - 45.48.090 with regard to the personal information of a state resident, the information collector

(1) is liable to the state for a civil penalty of up to $500 for each state resident who was not notified under AS 45.48.010 - 45.48.090, but the total civil penalty may not exceed $50,000; and

(2) may be enjoined from further violations.

(b) If an information collector who is not a governmental agency violates AS 45.48.010 - 45.48.090 with regard to the personal information of a state resident, the violation is an unfair or deceptive act or practice under AS 45.50.471 - 45.50.561. However,

(1) the information collector is not subject to the civil penalties imposed under AS 45.50.551 but is liable to the state for a civil penalty of up to $500 for each state resident who was not notified under AS 45.48.010 - 45.48.090, except that the total civil penalty may not exceed $50,000; and

(2) damages that may be awarded against the information collector under

(A) AS 45.50.531 are limited to actual economic damages that do not exceed $500; and

(B) AS 45.50.537 are limited to actual economic damages.

(c) The Department of Administration may enforce (a) of this section against a governmental agency. The procedure for review of an order or action of the department under this subsection is the same as the procedure provided by AS 44.62 (Administrative Procedure Act), except that the office of administrative hearings (AS 44.64.010 ) shall conduct the hearings in contested cases and the decision may be appealed under AS 44.64.030 (c).

Sec. 45.48.090. Definitions.

In AS 45.48.010 - 45.48.090,

(1) "breach of the security" means unauthorized acquisition, or reasonable belief of unauthorized acquisition, of personal information that compromises the security, confidentiality, or integrity of the personal information maintained by the information collector; in this paragraph, "acquisition" includes acquisition by

(A) photocopying, facsimile, or other paper-based method;

(B) a device, including a computer, that can read, write, or store information that is represented in numerical form; or

(C) a method not identified by (A) or (B) of this paragraph;

(2) "covered person" means a

(A) person doing business;

(B) governmental agency; or

(C) person with more than 10 employees;

(3) "governmental agency" means a state or local governmental agency, except for an agency of the judicial branch;

(4) "information collector" means a covered person who owns or licenses personal information in any form if the personal information includes personal information on a state resident;

(5) "information distributor" means a person who is an information collector and who owns or licenses personal information to an information recipient;

(6) "information recipient" means a person who is an information collector but who does not own or have the right to license to another information collector the personal information received by the person from an information distributor;

(7) "personal information" means information in any form on an individual that is not encrypted or redacted, or is encrypted and the encryption key has been accessed or acquired, and that consists of a combination of

(A) an individual's name; in this subparagraph, "individual's name" means a combination of an individual's

(i) first name or first initial; and

(ii) last name; and

(B) one or more of the following information elements:

(i) the individual's social security number;

(ii) the individual's driver's license number or state identification card number;

(iii) except as provided in (iv) of this subparagraph, the individual's account number, credit card number, or debit card number;

(iv) if an account can only be accessed with a personal code, the number in (iii) of this subparagraph and the personal code; in this sub-subparagraph, "personal code" means a security code, an access code, a personal identification number, or a password;

(v) passwords, personal identification numbers, or other access codes for financial accounts.

Article 02. CREDIT REPORT AND CREDIT SCORE SECURITY FREEZE

Sec. 45.48.100. Security freeze authorized.

A consumer may prohibit a consumer credit reporting agency from releasing the consumer's credit report or credit score without the express authorization of the consumer by placing a security freeze on the consumer's credit report.

Sec. 45.48.110. Placement of security freeze.

(a) To place a security freeze, a consumer shall make the request to the consumer credit reporting agency

(1) by mail to the address designated by the consumer credit reporting agency to receive security freeze requests; or

(2) as allowed by (b) of this section.

(b) A consumer may make a request under (a) of this section by telephone or by facsimile, the Internet, or other electronic media if the consumer credit reporting agency has developed procedures for using the telephone or an electronic medium to receive and process the request in an expedited manner.

(c) A consumer credit reporting agency shall place a security freeze within five business days after receiving a request under (a) or (b) of this section and proper identification from the consumer.

Sec. 45.48.120. Confirmation of security freeze.

(a) Within 10 business days after a consumer makes the request under AS 45.48.110 , a consumer credit reporting agency shall send a written confirmation of the placement of the security freeze to the consumer. The confirmation must also inform the consumer that the consumer credit reporting agency may charge, as allowed by AS 45.48.160, a fee for third-party access during the security freeze.

(b) At the same time that the consumer credit reporting agency sends a confirmation under (a) of this section, the consumer credit reporting agency shall provide the consumer with a unique personal identification number, password, or similar device to be used by the consumer when the consumer authorizes the release of the consumer's credit report or credit score under AS 45.48.130 .

Sec. 45.48.130. Access and actions during security freeze.

(a) While a security freeze is in place, a consumer credit reporting agency shall allow a third party access to a consumer's credit report or credit score if the consumer requests that the consumer credit reporting agency allow the access.

(b) To make a request under (a) of this section, the consumer shall contact the consumer credit reporting agency by mail at the address designated by the consumer credit reporting agency to receive security freeze requests or as allowed by (c) of this section, authorize the consumer credit reporting agency to allow the access, and provide the consumer credit reporting agency with

(1) proper identification to verify the consumer's identity;

(2) the unique personal identification number, password, or similar device provided under AS 45.48.120 (b); and

(3) the proper information necessary to identify the third party to whom the consumer credit reporting agency may allow the access or the time period during which the consumer credit reporting agency may allow the access to third parties who request the access.

(c) In addition to making the request by mail, a consumer may make a request under (a) of this section by telephone or by facsimile, the Internet, or other electronic media if the consumer credit reporting agency has developed procedures for using the telephone or an electronic medium to receive and process the request in an expedited manner.

(d) Except as provided by (e) of this section, a consumer credit reporting agency that receives a request from a consumer under (b) or (c) of this section shall comply with the request within 15 minutes after receiving the request by telephone or by an electronic medium or within three business days after receiving the request by mail.

(e) A consumer credit reporting agency is not required to comply with a request under (a) of this section within the 15 minutes required by (d) of this section if

(1) the consumer fails to satisfy the requirements of (b) of this section;

(2) one of the following events prevents the consumer credit reporting agency from removing the security freeze within 15 minutes:

(A) an act of God, including a fire, earthquake, hurricane, storm, or similar natural disaster or phenomenon;

(B) an unauthorized or illegal act by another person, including terrorism, sabotage, riot, vandalism, labor strike, labor dispute disrupting operations, or similar occurrence;

(C) an operational interruption, including an electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failure inhibiting response time, or similar disruption;

(D) governmental action, including an emergency order or regulation, a judicial law enforcement action, or a similar directive;

(E) regularly scheduled maintenance during other than normal business hours of the consumer credit reporting agency's systems, or updates to the consumer credit reporting agency's systems;

(F) commercially reasonable maintenance of, or repair to, the consumer credit reporting agency's systems that is unexpected or unscheduled; or

(3) the request is received outside of normal business hours.

(f) If a security freeze is in place, a consumer credit reporting agency may not release the credit report or credit score to a third party without the prior express authorization of the consumer.

(g) If a security freeze is in place on a consumer's credit report and credit score and if a third party applies to a consumer credit reporting agency to provide the third party with access to the consumer's credit report or credit score, the consumer credit reporting agency and the third party may treat the third party's application as incomplete unless the consumer authorizes the access under (a) of this section.

(h) If a security freeze is in place, a consumer credit reporting agency may not change the consumer's official information in the consumer's credit report and credit score without sending a written statement of the change to the consumer within 30 days after the change is made. A consumer credit reporting agency is not required to send a written statement if the consumer credit reporting agency makes a technical change in the consumer's official information. If a consumer credit reporting agency makes a change, other than a technical change, in a consumer's address, the consumer credit reporting agency shall send the written statement to the consumer at both the new address and the former address. In this subsection,

(1) "official information" means name, date of birth, social security number, and address;

(2) "technical change" means changing spelling, transposing numbers or letters, abbreviating a word, or spelling out an abbreviation.

(i) This section is not intended to prevent a consumer credit reporting agency from advising a third party that requests access to a consumer's credit report or credit score that a security freeze is in effect.

(j) The procedures used by a consumer credit reporting agency for implementing the provisions of this section may include the use of telephone, facsimile, or electronic means if making the disclosure by the electronic means is consistent with the provisions regarding electronic records and signatures required for notices legally required to be in writing under 15 U.S.C. 7001 et seq. (Electronic Signatures in Global and National Commerce Act).

Sec. 45.48.140. Removal of security freeze.

(a) Except as provided by AS 45.48.130 , a consumer credit reporting agency may not remove a security freeze unless

(1) the consumer requests that the consumer credit reporting agency remove the security freeze under (b) of this section; or

(2) the consumer made a material misrepresentation of fact to the consumer credit reporting agency when the consumer requested the security freeze under AS 45.48.110 ; if a consumer credit reporting agency intends to remove a security freeze on a consumer's credit report under this paragraph, the consumer credit reporting agency shall notify the consumer in writing before removing the security freeze.

(b) A consumer credit reporting agency shall remove a security freeze within three business days after receiving a request for removal from the consumer who requested the security freeze.

(c) To make a request under (b) of this section, the consumer shall contact the consumer credit reporting agency by mail or as allowed by (d) of this section, authorize the consumer credit reporting agency to remove the security freeze, and provide the consumer credit reporting agency with

(1) proper identification to verify the consumer's identity; and

(2) the unique personal identification number, password, or similar device provided under AS 45.48.120 (b).

(d) In addition to mail, a consumer may make a request under (b) of this section by telephone or by facsimile, the Internet, or other electronic media if the consumer credit reporting agency has developed procedures for using the telephone or an electronic medium to receive and process the request in an expedited manner.

Sec. 45.48.150. Prohibition.

When dealing with a third party, a consumer credit reporting agency may not suggest, state, or imply that a consumer's security freeze reflects a negative credit score, history, report, or rating.

Sec. 45.48.160. Charges.

(a) Except as provided by (b), (c), or (d) of this section, a consumer credit reporting agency may not charge a consumer to place or remove a security freeze, to provide access under AS 45.48.130 , or to take any other action, including the issuance of a personal identification number, password, or similar device under AS 45.48.120 , that is related to the placement of, removal of, or allowing access to a credit report or credit score on which a security freeze has been placed.

(b) A consumer credit reporting agency may charge a consumer $5 for placing a security freeze.

(c) A consumer credit reporting agency may charge the consumer $2 for each access request made by the consumer. In this subsection, "access request" means a request made by the consumer under AS 45.48.130 to allow third-party access to the consumer's credit report or credit score on which a security freeze has been placed.

(d) If a consumer fails to retain a personal identification number, password, or similar device issued under AS 45.48.120 , a consumer credit reporting agency may charge the consumer up to $5 for each time after the first time that the consumer credit reporting agency issues the consumer another personal identification number, password, or similar device because the consumer failed to retain the personal identification number, password, or similar device.

(e) A consumer credit reporting agency may not charge a consumer a fee under (b) or (c) of this section if the consumer has been a victim of identity theft and provides the consumer credit reporting agency with a complaint filed by the consumer with a law enforcement agency.

Sec. 45.48.170. Notice of rights.

When a consumer credit reporting agency is required to give a consumer a summary of rights under 15 U.S.C. 1681g (Fair Credit Reporting Act), a consumer credit reporting agency shall also give the consumer the following notice:

Consumers Have the Right to Obtain a Security Freeze

You may obtain a security freeze on your credit report and credit

score for $5 to protect your privacy and ensure that credit is not

granted in your name without your knowledge. You may not have to pay

the $5 charge if you are a victim of identity theft. You have a right

to place a security freeze on your credit report and credit score under

state law (AS 45.48.100 - 45.48.290).

The security freeze will prohibit a consumer credit reporting

agency from releasing your credit score and any information in your

credit report without your express authorization or approval.

The security freeze is designed to prevent credit, loans, and other

services from being approved in your name without your consent.

However, you should be aware that using a security freeze to take

control over who gets access to the personal and financial information

in your credit report and credit score may delay, interfere with, or

prohibit the timely approval of any subsequent request or application

you make regarding a new loan, credit, a mortgage, a governmental

service, a governmental payment, a cellular telephone, a utility, an

Internet credit card application, an extension of credit at point of

sale, and other items and services.

When you place a security freeze on your credit report and credit

score, within 10 business days, you will be provided a personal

identification number, password, or similar device to use if you choose

to remove the freeze on your credit report and credit score or to

temporarily authorize the release of your credit report and credit

score to a specific third party or specific third parties or for a

specific period of time after the freeze is in place. To provide that

authorization, you must contact the consumer credit reporting agency

and provide all of the following:

(1) proper identification to verify your identity;

(2) the personal identification number, password, or similar

device provided by the consumer credit reporting agency;

(3) proper information necessary to identify the third party or

third parties who are authorized to receive the credit report and

credit score or the specific period of time for which the credit

report and credit score are to be available to third parties.

A consumer credit reporting agency that receives your request to

temporarily lift a freeze on a credit report and credit score is

required to comply with the request within 15 minutes, except after

normal business hours and under certain other conditions, after

receiving your request if you make the request by telephone, or an

electronic method if the agency provides an electronic method, or

within three business days after receiving your request if you make

the request by mail. The consumer credit reporting agency may charge

you $2 to temporarily lift the freeze.

A security freeze does not apply to circumstances where you have an

existing account relationship and a copy of your credit report and

credit score are requested by your existing creditor or its agents or

affiliates for certain types of account review, collection, fraud

control, or similar activities.

If you are actively seeking credit, you should understand that the

procedures involved in lifting a security freeze may slow your own

applications for credit. You should plan ahead and lift a freeze,

either completely if you are shopping around, or specifically for a

certain creditor, days before applying for new credit.

You have a right to bring a civil action against someone who

violates your rights under these laws on security freezes. The action

can be brought against a consumer credit reporting agency.

Sec. 45.48.180. Notification after violation.

If a consumer credit reporting agency violates a security freeze by releasing a consumer's credit report or credit score, the consumer credit reporting agency shall notify the consumer within five business days after discovering or being notified of the release, and the information in the notice must include an identification of the information released and of the third party who received the information.

Sec. 45.48.190. Resellers.

A consumer credit reporting agency that acts as a reseller of consumer information shall honor a security freeze placed on a consumer's credit report and credit score by another consumer credit reporting agency.

Next