House Bill 904 Summary

• Expands the definition of "security breach" to include encrypted records or data accessed along with confidential process or key, and requires businesses to document determinations that illegal use has not occurred for at least three years.

• Establishes a shared internet website and toll-free number allowing consumers to request security freezes with all consumer reporting agencies simultaneously, with requests communicated between agencies within three days.

• Eliminates fees for placing, removing, or temporarily lifting security freezes when requests are made electronically; limits fees to $3.00 for telephone or mail requests, with exceptions for seniors over 62 and identity theft victims.

• Requires businesses to notify affected persons within 30 days of discovering a security breach and notify the Attorney General's Consumer Protection Division within 30 days; mandates credit monitoring services at no cost for at least 24-48 months when social security numbers are compromised.

• Adds new sections requiring consumer consent before obtaining credit reports, establishing consumer rights to request and review credit file information, and clarifying that Fair Credit Reporting Act provisions control in conflicts with state law.