The legislature finds and declares that consumers have a vital interest in establishing and maintaining creditworthiness. The legislature further finds that an elaborate mechanism using credit reports has developed for investigating and evaluating a consumer's creditworthiness, credit capacity, and general reputation and character. As such, credit reports are used for evaluating credit card, loan, mortgage, and small business financing applications, as well as for decisions regarding employment and the rental or leasing of dwellings. Moreover, financial institutions and other creditors depend upon fair and accurate credit reports to efficiently and accurately evaluate creditworthiness. Unfair or inaccurate reports undermine both public and creditor confidences in the reliability of credit granting systems.

Therefore, this chapter is necessary to assure accurate credit data collection, maintenance, and reporting on the citizens of the state. It is the policy of the state that credit reporting agencies maintain accurate credit reports, resolve disputed reports promptly and fairly, and adopt reasonable procedures to promote consumer confidentiality and the proper use of credit data in accordance with this chapter.

Unless the context clearly requires otherwise, the definitions in this section apply throughout this chapter.

(1)(a) "Adverse action" includes:

(i) Denial of, increase in any charge for, or reduction in the amount of insurance for personal, family, or household purposes;

(ii) Denial of employment or any other decision for employment purposes that adversely affects a current or prospective employee;

(iii) Action or determination with respect to a consumer's application for credit that is adverse to the interests of the consumer; and

(iv) Action or determination with respect to a consumer's application for the rental or leasing of residential real estate that is adverse to the interests of the consumer.

(b) "Adverse action" does not include:

(i) A refusal to extend additional credit under an existing credit arrangement if:

(A) The applicant is delinquent or otherwise in default with respect to the arrangement; or

(B) The additional credit would exceed a previously established credit limit; or

(ii) A refusal or failure to authorize an account transaction at a point of sale.

(2) "Attorney general" means the office of the attorney general.

(3) "Consumer" means an individual.

(4)(a) "Consumer report" means a written, oral, or other communication of information by a consumer reporting agency bearing on a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living that is used or expected to be used or collected in whole or in part for:

(i) The purpose of serving as a factor in establishing the consumer's eligibility for credit or insurance to be used primarily for personal, family, or household purposes;

(ii) Employment purposes; or

(iii) Other purposes authorized under RCW 19.182.020.

(b) "Consumer report" does not include:

(i) A report containing information solely as to transactions or experiences between the consumer and the person making the report;

(ii) An authorization or approval of a specific extension of credit directly or indirectly by the issuer of a credit card or similar device;

(iii) A report in which a person who has been requested by a third party to make a specific extension of credit directly or indirectly to a consumer conveys his or her decision with respect to the request, if the third party advises the consumer of the name and address of the person to whom the request was made and the person makes the disclosures to the consumer required under RCW 19.182.070;

(iv) A list compiled by a consumer reporting agency to be used by its client for direct marketing of goods or services not involving an offer of credit;

(v) A report solely conveying a decision whether to guarantee a check in response to a request by a third party; or

(vi) A report furnished for use in connection with a transaction that consists of an extension of credit to be used for a commercial purpose.

(5) "Consumer reporting agency" means a person who, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the business of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and who uses any means or facility of commerce for the purpose of preparing or furnishing consumer reports. "Consumer reporting agency" does not include a person solely by reason of conveying a decision whether to guarantee a check in response to a request by a third party or a person who obtains a consumer report and provides the report or information contained in it to a subsidiary or affiliate of the person.

(6) "Credit transaction that is not initiated by the consumer" does not include the use of a consumer report by an assignee for collection or by a person with which the consumer has an account, for purposes of (a) reviewing the account, or (b) collecting the account. For purposes of this subsection "reviewing the account" includes activities related to account maintenance and monitoring, credit line increases, and account upgrades and enhancements.

(7) "Direct solicitation" means the process in which the consumer reporting agency compiles or edits for a client a list of consumers who meet specific criteria and provides this list to the client or a third party on behalf of the client for use in soliciting those consumers for an offer of a product or service.

(8) "Employment purposes," when used in connection with a consumer report, means a report used for the purpose of evaluating a consumer for employment, promotion, reassignment, or retention as an employee.

(9) "File," when used in connection with information on any consumer, means all of the information on that consumer recorded and retained by a consumer reporting agency regardless of how the information is stored.

(10) "Investigative consumer report" means a consumer report or portion of it in which information on a consumer's character, general reputation, personal characteristics, or mode of living is obtained through personal interviews with neighbors, friends, or associates of the consumer reported on or with others with whom the consumer is acquainted or who may have knowledge concerning any items of information. However, the information does not include specific factual information on a consumer's credit record obtained directly from a creditor of the consumer or from a consumer reporting agency when the information was obtained directly from a creditor of the consumer or from the consumer.

(11) "Medical information" means information or records obtained, with the consent of the individual to whom it relates, from a licensed physician or medical practitioner, hospital, clinic, or other medical or medically related facility.

(12) "Person" includes an individual, corporation, government or governmental subdivision or agency, business trust, estate, trust, partnership, association, and any other legal or commercial entity.

(13) "Prescreening" means the process in which the consumer reporting agency compiles or edits for a client a list of consumers who meet specific credit criteria and provides this list to the client or a third party on behalf of the client for use in soliciting those consumers for an offer of credit.

(1) A consumer reporting agency may furnish a consumer report only under the following circumstances:

(a) In response to the order of a court having jurisdiction to issue the order;

(b) In accordance with the written instructions of the consumer to whom it relates; or

(c) To a person that the agency has reason to believe:

(i) Intends to use the information in connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer;

(ii) Intends to use the information for employment purposes;

(iii) Intends to use the information in connection with the underwriting of insurance involving the consumer;

(iv) Intends to use the information in connection with a determination of the consumer's eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant's financial responsibility or status; or

(v) Otherwise has a legitimate business need for the information in connection with a business transaction involving the consumer.

(2)(a) Subject to (c) of this subsection, a person may not procure a consumer report, or cause a consumer report to be procured, for employment purposes with respect to any consumer who is not an employee at the time the report is procured or caused to be procured unless:

(i) A clear and conspicuous disclosure has been made in writing to the consumer before the report is procured or caused to be procured that a consumer report may be obtained for purposes of considering the consumer for employment. The disclosure may be contained in a written statement contained in employment application materials; or

(ii) The consumer authorizes the procurement of the report.

(b) A person may not procure a consumer report, or cause a consumer report to be procured, for employment purposes with respect to any employee unless the employee has received, at any time after the person became an employee, written notice that consumer reports may be used for employment purposes. A written statement that consumer reports may be used for employment purposes that is contained in employee guidelines or manuals available to employees or included in written materials provided to employees constitutes written notice for purposes of this subsection. This subsection does not apply with respect to a consumer report of an employee who the employer has reasonable cause to believe has engaged in specific activity that constitutes a violation of law.

(c) As applied to (a) and (b) of this subsection, a person may not procure a consumer report for employment purposes where any information contained in the report bears on the consumer's creditworthiness, credit standing, or credit capacity, unless the information is either:

(i) Substantially job related and the employer's reasons for the use of such information are disclosed to the consumer in writing; or

(ii) Required by law.

(d) In using a consumer report for employment purposes, before taking any adverse action based in whole or part on the report, a person shall provide to the consumer to whom the report relates: (i) The name, address, and telephone number of the consumer reporting agency providing the report; (ii) a description of the consumer's rights under this chapter pertaining to consumer reports obtained for employment purposes; and (iii) a reasonable opportunity to respond to any information in the report that is disputed by the consumer. This subsection applies to job applicants and current employees.

(1) A consumer reporting agency may provide a consumer report relating to a consumer under RCW 19.182.020(1)(c)(i) in connection with a credit transaction that is not initiated by the consumer only if:

(a) The consumer authorized the consumer reporting agency to provide the report to such a person; or

(b) The consumer has not elected in accordance with subsection (3) of this section to have the consumer's name and address excluded from such transactions.

(2) A consumer reporting agency may provide only the following information under subsection (1) of this section:

(a) The name and address of the consumer; and

(b) Information pertaining to a consumer that is not identified or identifiable with particular accounts or transactions of the consumer.

(3)(a) A consumer may elect to have his or her name and address excluded from any list provided by a consumer reporting agency through prescreening under subsection (1) of this section or from any list provided by a consumer reporting agency for direct solicitation transactions that are not initiated by the consumer by notifying the consumer reporting agency. The notice must be made in writing through the notification system maintained by the consumer reporting agency under subsection (4) of this section and must state that the consumer does not consent to any use of consumer reports relating to the consumer in connection with any transaction that is not initiated by the consumer.

(b) An election of a consumer under (a) of this subsection is effective with respect to a consumer reporting agency and any affiliate of the consumer reporting agency, within five business days after the consumer reporting agency receives the consumer's notice.

(4) A consumer reporting agency that provides information intended to be used in a prescreened credit transaction or direct solicitation transaction that is not initiated by the consumer shall:

(a) Maintain a notification system that facilitates the ability of a consumer in the agency's database to notify the agency to promptly withdraw the consumer's name from lists compiled for prescreened credit transactions and direct solicitation transactions not initiated by the consumer; and

(b) Publish at least annually in a publication of general circulation in the area served by the agency, the address for consumers to use to notify the agency of the consumer's election under subsection (3) of this section.

(5) A consumer reporting agency that maintains consumer reports on a nationwide basis shall establish a system meeting the requirements of subsection (4) of this section on a nationwide basis, and may operate such a system jointly with any other consumer reporting agencies.

(6) Compliance with the requirements of this section by any consumer reporting agency constitutes compliance by the agency's affiliates.

(1) Except as authorized under subsection (2) of this section, no consumer reporting agency may make a consumer report containing any of the following items of information:

(a) Bankruptcies that, from date of adjudication of the most recent bankruptcy, antedate the report by more than ten years;

(b) Suits and judgments that, from date of entry, antedate the report by more than seven years or until the governing statute of limitations has expired, whichever is the longer period;

(c) Paid tax liens that, from date of payment, antedate the report by more than seven years;

(d) Accounts placed for collection or charged to profit and loss that antedate the report by more than seven years;

(e) Records of arrest, indictment, or conviction of an adult for a crime that, from date of disposition, release, or parole, antedate the report by more than seven years;

(f) Juvenile records, as defined in *RCW 13.50.010(1)(c), when the subject of the records is twenty-one years of age or older at the time of the report; and

(g) Any other adverse item of information that antedates the report by more than seven years.

(2) Subsection (1)(a) through (e) and (g) of this section is not applicable in the case of a consumer report to be used in connection with:

(a) A credit transaction involving, or that may reasonably be expected to involve, a principal amount of fifty thousand dollars or more;

(b) The underwriting of life insurance involving, or that may reasonably be expected to involve, a face amount of fifty thousand dollars or more; or

(c) The employment of an individual at an annual salary that equals, or that may reasonably be expected to equal, twenty thousand dollars or more.

*Reviser's note: RCW 13.50.010 was amended by 2015 c 265 § 2, changing subsection (1)(c) to subsection (1)(d).

Findings—Intent—2011 c 333: "The legislature finds that:

(1) One of the goals of the juvenile justice system is to rehabilitate juvenile offenders and promote their successful reintegration into society. Without opportunities to reintegrate, juveniles suffer increased recidivism and decreased economic function.

(2) The public has an interest in accessing information relating to juvenile records for public safety and research purposes.

(3) The public's legitimate interest in accessing personal information must be balanced with the rehabilitative goals of the juvenile justice system. All benefit when former juvenile offenders, after paying their debt to society, reintegrate and contribute to their local communities as productive citizens.

(4) It is the intent of the legislature to balance the rehabilitative and reintegration needs of an effective juvenile justice system with the public's need to access personal information for public safety and research purposes." [ 2011 c 333 § 1.]

(1) A person may not procure or cause to be prepared an investigative consumer report on a consumer unless:

(a) It is clearly and accurately disclosed to the consumer that an investigative consumer report including information as to the consumer's character, general reputation, personal characteristics, and mode of living, whichever are applicable, may be made, and the disclosure:

(i) Is made in a writing mailed, or otherwise delivered, to the consumer not later than three days after the date on which the report was first requested; and

(ii) Includes a statement informing the consumer of the consumer's right to request the additional disclosures provided for under subsection (2) of this section and the written summary of the rights of the consumer prepared under RCW 19.182.080(7); or

(b) The report is to be used for employment purposes for which the consumer has not specifically applied.

(2) A person who procures or causes to be prepared an investigative consumer report on a consumer shall make, upon written request made by the consumer within a reasonable period of time after the receipt by the consumer of the disclosure required in subsection (1)(a) of this section, a complete and accurate disclosure of the nature and scope of the investigation requested. This disclosure must be made in a writing mailed, or otherwise delivered, to the consumer not later than the latter of five days after the date on which the request for the disclosure was either received from the consumer or the report was first requested.

(3) No person may be held liable for a violation of subsection (1) or (2) of this section if the person shows by a preponderance of the evidence that at the time of the violation the person maintained reasonable procedures to assure compliance with subsection (1) or (2) of this section.

(4) A consumer reporting agency shall maintain a detailed record of:

(a) The identity of the person to whom an investigative consumer report or information from a consumer report is provided by the consumer reporting agency; and

(b) The certified purpose for which an investigative consumer report on a consumer, or any other information relating to a consumer, is requested by the person.

For purposes of this subsection, "person" does not include an individual who requests the report unless the individual obtains the report or information for his or her own individual purposes.

(1) A consumer reporting agency shall maintain reasonable procedures designed to avoid violations of RCW 19.182.040 and to limit the furnishing of consumer reports to the purposes listed under RCW 19.182.020. These procedures must require that prospective users of the information identify themselves, certify the purposes for which the information is sought, and certify that the information will be used for no other purpose. A consumer reporting agency shall make a reasonable effort to verify the identity of a new prospective user and the uses certified by the prospective user before furnishing the user a consumer report. No consumer reporting agency may furnish a consumer report to a person if the agency has reasonable grounds for believing that the consumer report will not be used for a purpose listed in RCW 19.182.020.

(2) Whenever a consumer reporting agency prepares a consumer report it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.

(3) Notwithstanding RCW 19.182.020, a consumer reporting agency may furnish identifying information about a consumer, limited to the consumer's name, address, former addresses, places of employment, or former places of employment, to a governmental agency.

(4) A consumer reporting agency shall maintain a detailed record of:

(a) The identity of any person to whom a consumer report or information from a consumer report is provided by the consumer reporting agency; and

(b) The certified purpose for which a consumer report on a consumer, or any other information relating to a consumer, is requested by any person.

For purposes of this subsection, "person" does not include an individual who requests the report unless the individual obtains the report or information for his or her own purposes.

A consumer reporting agency shall, upon request by the consumer, clearly and accurately disclose:

(1) All information in the file on the consumer at the time of request, except that medical information may be withheld. The agency shall inform the consumer of the existence of medical information, and the consumer has the right to have that information disclosed to the health care provider of the consumer's choice. Nothing in this chapter prevents, or authorizes a consumer reporting agency to prevent, the health care provider from disclosing the medical information to the consumer. The agency shall inform the consumer of the right to disclosure of medical information at the time the consumer requests disclosure of his or her file.

(2) All items of information in its files on that consumer, including disclosure of the sources of the information, except that sources of information acquired solely for use in an investigative report may only be disclosed to a plaintiff under appropriate discovery procedures.

(3) Identification of (a) each person who for employment purposes within the two-year period before the request, and (b) each person who for any other purpose within the six-month period before the request, procured a consumer report.

(4) A record identifying all inquiries received by the agency in the six-month period before the request that identified the consumer in connection with a credit transaction that is not initiated by the consumer.

(5) An identification of a person under subsection (3) or (4) of this section must include (a) the name of the person or, if applicable, the trade name under which the person conducts business; and (b) upon request of the consumer, the address of the person.

(1) A consumer reporting agency shall make the disclosures required under RCW 19.182.070 during normal business hours and on reasonable notice.

(2) The consumer reporting agency shall make the disclosures required under RCW 19.182.070 to the consumer:

(a) In person if the consumer appears in person and furnishes proper identification;

(b) By telephone if the consumer has made a written request, with proper identification, for telephone disclosure and the toll charge, if any, for the telephone call is prepaid by or charged directly to the consumer; or

(c) By any other reasonable means that are available to the consumer reporting agency if that means is authorized by the consumer.

(3) A consumer reporting agency shall provide trained personnel to explain to the consumer, information furnished to the consumer under RCW 19.182.070.

(4) The consumer reporting agency shall permit the consumer to be accompanied by one other person of the consumer's choosing, who shall furnish reasonable identification. A consumer reporting agency may require the consumer to furnish a written statement granting permission to the consumer reporting agency to discuss the consumer's file in the other person's presence.

(5) If a credit score is provided by a consumer reporting agency to a consumer, the agency shall provide an explanation of the meaning of the credit score.

(6) Except as provided in RCW 19.182.150, no consumer may bring an action or proceeding in the nature of defamation, invasion of privacy, or negligence with respect to the reporting of information against a consumer reporting agency or a user of information, based on information disclosed under this section or RCW 19.182.070, except as to false information furnished with malice or willful intent to injure the consumer. Except as provided in RCW 19.182.150, no consumer may bring an action or proceeding against a person who provides information to a consumer reporting agency in the nature of defamation, invasion of privacy, or negligence for unintentional error.

(7)(a) A consumer reporting agency must provide to a consumer, with each written disclosure by the agency to the consumer under RCW 19.182.070, a written summary of all rights and remedies the consumer has under this chapter.

(b) The summary of the rights and remedies of consumers under this chapter must include:

(i) A brief description of this chapter and all rights and remedies of consumers under this chapter;

(ii) An explanation of how the consumer may exercise the rights and remedies of the consumer under this chapter; and

(iii) A list of all state agencies, including the attorney general's office, responsible for enforcing any provision of this chapter and the address and appropriate phone number of each such agency.

(1) If the completeness or accuracy of an item of information contained in a consumer's file at a consumer reporting agency is disputed by the consumer and the consumer notifies the agency directly of the dispute, the agency shall reinvestigate without charge and record the current status of the disputed information before the end of thirty business days, beginning on the date the agency receives the notice from the consumer.

(2) Before the end of the five business-day period beginning on the date a consumer reporting agency receives notice of a dispute from a consumer in accordance with subsection (1) of this section, the agency shall notify any person who provided an item of information in dispute.

(3)(a) Notwithstanding subsection (1) of this section, a consumer reporting agency may terminate a reinvestigation of information disputed by a consumer under subsection (1) of this section if the agency determines that the dispute by the consumer is frivolous or irrelevant, including by reason of a failure of the consumer to provide sufficient information.

(b) Upon making a determination in accordance with (a) of this subsection that a dispute is frivolous or irrelevant, a consumer reporting agency shall notify the consumer within five business days of the determination. The notice shall be made in writing or any other means authorized by the consumer that are available to the agency, but the notice shall include the reasons for the determination and a notice of the consumer's rights under subsection (6) of this section.

(4) In conducting a reinvestigation under subsection (1) of this section with respect to disputed information in the file of any consumer, the consumer reporting agency shall review and consider all relevant information submitted by the consumer in the period described in subsection (1) of this section with respect to the disputed information.

(5)(a) If, after a reinvestigation under subsection (1) of this section of information disputed by a consumer, the information is found to be inaccurate or cannot be verified, the consumer reporting agency shall promptly delete the information from the consumer's file.

(b)(i) If information is deleted from a consumer's file under (a) of this subsection, the information may not be reinserted in the file after the deletion unless the person who furnishes the information verifies that the information is complete and accurate.

(ii) If information that has been deleted from a consumer's file under (a) of this subsection is reinserted in the file in accordance with (b)(i) of this subsection, the consumer reporting agency shall notify the consumer of the reinsertion within thirty business days. The notice shall be in writing or any other means authorized by the consumer that are available to the agency.

(6) If the reinvestigation does not resolve the dispute or if the consumer reporting agency determines the dispute is frivolous or irrelevant, the consumer may file a brief statement setting forth the nature of the dispute. The consumer reporting agency may limit these statements to not more than one hundred words if it provides the consumer with assistance in writing a clear summary of the dispute.

(7) After the deletion of information from a consumer's file under this section or after the filing of a statement of dispute under subsection (6) of this section, the consumer reporting agency shall, at the request of the consumer, furnish notification that the item of information has been deleted or that item of information is disputed. In the case of disputed information, the notification shall include the statement filed under subsection (6) of this section. The notification shall be furnished to any person specifically designated by the consumer, who has, within two years before the deletion or filing of a dispute, received a consumer report concerning the consumer for employment purposes, or who has, within six months of the deletion or the filing of the dispute, received a consumer report concerning the consumer for any other purpose, if these consumer reports contained the deleted or disputed information.

(8)(a) Upon completion of the reinvestigation under this section, a consumer reporting agency shall provide notice, in writing or by any other means authorized by the consumer, of the results of a reinvestigation within five business days.

(b) The notice required under (a) of this subsection must include:

(i) A statement that the reinvestigation is completed;

(ii) A consumer report that is based upon the consumer's file as that file is revised as a result of the reinvestigation;

(iii) A description or indication of any changes made in the consumer report as a result of those revisions to the consumer's file;

(iv) If requested by the consumer, a description of the procedure used to determine the accuracy and completeness of the information shall be provided to the consumer by the agency, including the name, business address, and telephone number of any person contacted in connection with the information;

(v) If the reinvestigation does not resolve the dispute, a summary of the consumer's right to file a brief statement as provided in subsection (6) of this section; and

(vi) If information is deleted or disputed after reinvestigation, a summary of the consumer's right to request notification to persons who have received a consumer report as provided in subsection (7) of this section.

(9) In the case of a consumer reporting agency that compiles and maintains consumer reports on a nationwide basis, the consumer reporting agency must provide to a consumer who has undertaken to dispute the information contained in his or her file a toll-free telephone number that the consumer can use to communicate with the agency. A consumer reporting agency that provides a toll-free number required by this subsection shall also provide adequately trained personnel to answer basic inquiries from consumers using the toll-free number.

(1) Except as provided in subsections (2) and (3) of this section, a consumer reporting agency may charge the following fees to the consumer:

(a) For making a disclosure under RCW 19.182.070 and 19.182.080, the consumer reporting agency may charge a fee not exceeding eight dollars. Beginning January 1, 1995, the eight-dollar charge may be adjusted on January 1st of each year based on corresponding changes in the consumer price index with fractional changes rounded to the nearest half dollar.

(b) For furnishing a notification, statement, or summary to a person under RCW 19.182.090(7), the consumer reporting agency may charge a fee not exceeding the charge that the agency would impose on each designated recipient for a consumer report. The amount of any charge must be disclosed to the consumer before furnishing the information.

(2) A consumer reporting agency shall make all disclosures under RCW 19.182.070 and 19.182.080 and furnish all consumer reports under RCW 19.182.090 without charge, if requested by the consumer within sixty days after receipt by the consumer of a notification of adverse action under RCW 19.182.110 or of a notification from a debt collection agency affiliated with that consumer reporting agency stating that the consumer's credit rating may be or has been adversely affected.

(3) A consumer reporting agency shall not impose any charge for (a) providing notice to a consumer required under RCW 19.182.090, or (b) notifying a person under RCW 19.182.090(7) of the deletion of information that is found to be inaccurate or that can no longer be verified, if the consumer designates that person to the agency before the end of the thirty-day period beginning on the date of notice under RCW 19.182.090(8).

If a person takes an adverse action with respect to a consumer that is based, in whole or in part, on information contained in a consumer report, the person shall:

(1) Provide written notice of the adverse action to the consumer, except verbal notice may be given by a person in an adverse action involving a business regulated by the Washington utilities and transportation commission if such verbal notice does not impair a consumer's ability to obtain a credit report without charge under RCW 19.182.100(2); and

(2) Provide the consumer with the name, address, and telephone number of the consumer reporting agency that furnished the report to the person.

Finding—2012 c 41: See note following RCW 59.18.257.

An action to enforce a liability created under this chapter is permanently barred unless commenced within two years after the cause of action accrues, except that where a defendant has materially and willfully misrepresented information required under this chapter to be disclosed to an individual and the information so misrepresented is material to the establishment of the defendant's liability to that individual under this chapter, the action may be brought at any time within two years after discovery by the individual of the misrepresentation.

A person who knowingly and willfully obtains information on a consumer from a consumer reporting agency under false pretenses is subject to a fine of up to five thousand dollars or imprisonment for up to three hundred sixty-four days, or both.

Findings—Intent—2011 c 96: See note following RCW 9A.20.021.

An officer or employee of a consumer reporting agency who knowingly and willfully provides information concerning an individual from the agency's files to a person not authorized to receive that information is subject to a fine of up to five thousand dollars or imprisonment for up to three hundred sixty-four days, or both.

Findings—Intent—2011 c 96: See note following RCW 9A.20.021.

The legislature finds that the practices covered by this chapter are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW. Violations of this chapter are not reasonable in relation to the development and preservation of business. A violation of this chapter is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW. The burden of proof in an action alleging a violation of this chapter shall be by a preponderance of the evidence, and the applicable statute of limitation shall be as set forth in RCW 19.182.120. For purposes of a judgment awarded pursuant to an action by a consumer under chapter 19.86 RCW, the consumer shall be awarded actual damages and costs of the action together with reasonable attorney's fees as determined by the court. However, where there has been willful failure to comply with any requirement imposed under this chapter, the consumer shall be awarded actual damages, a monetary penalty of one thousand dollars, and the costs of the action together with reasonable attorneys' fees as determined by the court.

(1) Within thirty days of receipt of proof of the consumer's identification and a copy of a police report, filed by the consumer, evidencing the consumer's claim to be a victim of a violation of RCW 9.35.020, a consumer reporting agency shall permanently block reporting any information the consumer identifies on his or her consumer report is a result of a violation of RCW 9.35.020, so that the information cannot be reported, except as provided in subsection (2) of this section. The consumer reporting agency shall promptly notify the furnisher of the information that a police report has been filed, that a block has been requested, and the effective date of the block.

(2) A consumer reporting agency may decline to block or may rescind any block of consumer information if, in the exercise of good faith and reasonable judgment, the consumer reporting agency believes:

(a) The information was blocked due to a misrepresentation of fact by the consumer relevant to the request to block under this section;

(b) The consumer agrees that the blocked information or portions of the blocked information were blocked in error; or

(c) The consumer knowingly obtained possession of goods, services, or moneys as a result of the blocked transaction or transactions or the consumer should have known that he or she obtained possession of goods, services, or moneys as a result of the blocked transaction or transactions.

(3) If the block of information is declined or rescinded under this section, the consumer shall be notified promptly in the same manner as consumers are notified of the reinsertion of information pursuant to section 611 of the fair credit reporting act, 15 U.S.C. Sec. 1681i, as amended. The prior presence of the blocked information in the consumer reporting agency's file on the consumer is not evidence of whether the consumer knew or should have known that he or she obtained possession of any goods, services, or moneys.

(4) In order to facilitate the exercise of a consumer's right to block information in his or her consumer report, all police and sheriff's departments in Washington state shall provide to the consumer, at the consumer's request, a copy of any police report, filed by the consumer, evidencing the consumer's claim to be a victim of a violation of RCW 9.35.020.

Nothing in this section shall be construed to require a law enforcement agency to investigate reports claiming identity theft.

Captions not law—2001 c 217: See note following RCW 9.35.005.

(1) A consumer, who is a resident of this state, may elect to place a security freeze on his or her credit report by making a request to a consumer reporting agency. "Security freeze" means a prohibition, consistent with this section, on a consumer reporting agency's furnishing of a consumer's credit report to a third party intending to use the credit report to determine the consumer's eligibility for credit. If a security freeze is in place, information from a consumer's credit report may not be released to a third party without prior express authorization from the consumer. This subsection does not prevent a consumer reporting agency from advising a third party that a security freeze is in effect with respect to the consumer's credit report.

(2) For purposes of this section and RCW 19.182.180 through 19.182.210:

(a) "Victim of identity theft" means a person who has a police report evidencing their claim to be a victim of a violation of RCW 9.35.020 and which report will be produced to a consumer reporting agency, upon such consumer reporting agency's request.

(b) "Credit report" means a consumer report, as defined in 15 U.S.C. Sec. 1681a, that is used or collected to serve as a factor in establishing a consumer's eligibility for credit for personal, family, or household purposes.

(c) "Normal business hours" means Sunday through Saturday, between the hours of 6:00 a.m. and 9:30 p.m. Pacific time.

(3) A consumer reporting agency shall place a security freeze on a consumer's credit report no later than five business days after receiving a request from the consumer.

(4) The consumer reporting agency shall send a confirmation of the security freeze to the consumer within ten business days and shall provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of his or her credit report for a specific party or period of time.

(5) If the consumer wishes to allow his or her credit report to be accessed for a specific period of time while a freeze is in place, he or she shall contact the consumer reporting agency, request that the freeze be temporarily lifted, and provide the following:

(a) Proper identification, which means that information generally deemed sufficient to identify a person. Only if the consumer is unable to sufficiently identify himself or herself, may a consumer reporting agency require additional information concerning the consumer's employment and personal or family history in order to verify his or her identity;

(b) The unique personal identification number or password provided by the consumer reporting agency under subsection (4) of this section; and

(c) The proper information regarding the time period for which the report is available to users of the credit report.

(6) A consumer reporting agency that receives a request from a consumer to temporarily lift a freeze on a credit report under subsection (5) of this section shall comply with the request within:

(a) Three business days of receiving the request by mail; or

(b) Fifteen minutes of receiving the request from the consumer through the electronic contact method chosen by the consumer reporting agency in accordance with subsection (8) of this section, if the request:

(i) Is received during normal business hours; and

(ii) Includes the consumer's proper identification and correct personal identification number or password.

(7) A consumer reporting agency is not required to remove a security freeze within the time provided in subsection (6)(b) of this section if:

(a) The consumer fails to meet the requirements of subsection (5) of this section; or

(b) The consumer reporting agency's ability to remove the security freeze within fifteen minutes is prevented by:

(i) An act of God, including fire, earthquakes, hurricanes, storms, or similar natural disasters or phenomena;

(ii) Unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes, or disputes disrupting operations, or similar occurrences;

(iii) An interruption in operations, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruptions;

(iv) Governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar directives;

(v) Regularly scheduled maintenance of, or updates to, the consumer reporting agency's systems outside of normal business hours;

(vi) Commercially reasonable maintenance of, or repair to, the consumer reporting agency's systems that is unexpected or unscheduled; or

(vii) Receipt of a removal request outside of normal business hours.

(8) A consumer reporting agency may develop procedures involving the use of telephone, fax, the internet, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze on a credit report under subsection (5) of this section in an expedited manner.

(9) A consumer reporting agency shall remove or temporarily lift a freeze placed on a consumer's credit report only in the following cases:

(a) Upon consumer request, under subsection (5) or (12) of this section; or

(b) When the consumer's credit report was frozen due to a material misrepresentation of fact by the consumer. When a consumer reporting agency intends to remove a freeze upon a consumer's credit report under this subsection, the consumer reporting agency shall notify the consumer in writing prior to removing the freeze on the consumer's credit report.

(10) When a third party requests access to a consumer credit report on which a security freeze is in effect, and this request is in connection with an application for credit or any other use, and the consumer does not allow his or her credit report to be accessed for that period of time, the third party may treat the application as incomplete.

(11) When a consumer requests a security freeze, the consumer reporting agency shall disclose the process of placing and temporarily lifting a freeze, and the process for allowing access to information from the consumer's credit report for a specific period of time while the freeze is in place.

(12) A security freeze remains in place until the consumer requests that the security freeze be removed. A consumer reporting agency shall remove a security freeze within three business days of receiving a request for removal from the consumer, who provides all of the following:

(a) Proper identification, as defined in subsection (5)(a) of this section; and

(b) The unique personal identification number or password provided by the consumer reporting agency under subsection (4) of this section.

(13) A consumer reporting agency may not charge a fee for any service under this section including, but not limited to, placing a security freeze, assigning a unique personal identification number or password, temporarily lifting a security freeze, or removing a security freeze.

(14) This section does not apply to the use of a consumer credit report by any of the following:

(a) A person or entity, or a subsidiary, affiliate, or agent of that person or entity, or an assignee of a financial obligation owing by the consumer to that person or entity, or a prospective assignee of a financial obligation owing by the consumer to that person or entity in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment an account or contract, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument. For purposes of this subsection, "reviewing the account" includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements;

(b) Any federal, state, or local entity, including a law enforcement agency, court, or their agents or assigns;

(c) Any person acting under a court order, warrant, or subpoena;

(d) A child support agency acting under Title IV-D of the social security act (42 U.S.C. Sec. 651 et seq.);

(e) The department of social and health services acting to fulfill any of its statutory responsibilities;

(f) The internal revenue service acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities;

(g) The use of credit information for the purposes of prescreening as provided for by the federal fair credit reporting act;

(h) Any person or entity administering a credit file monitoring subscription service to which the consumer has subscribed;

(i) Any person or entity for the purpose of providing a consumer with a copy of his or her credit report upon the consumer's request; and

(j) A mortgage broker or loan originator required to be licensed under chapter 19.146 RCW.

(15) Liability may not result to the consumer reporting agency if through inadvertence or mistake the consumer reporting agency releases credit report information to a person or entity purporting to be a mortgage broker or loan originator under subsection (14) of this section that is, in fact, not a mortgage broker or loan originator.

(16) The consumer's request for a security freeze does not prohibit the consumer reporting agency from disclosing the consumer's credit report for other than credit-related purposes.

(17) A violation of subsection (6) of this section does not provide a private cause of action under RCW 19.86.090. A violation of subsection (6) of this section shall be enforced exclusively by the attorney general. A violation of subsection (6) of this section is subject to all other remedies and penalties available under this chapter.

Effective date—2007 c 499: "This act takes effect September 1, 2008." [ 2007 c 499 § 2.]

If a security freeze is in place, a consumer reporting agency may not change any of the following official information in a consumer credit report without sending a written confirmation of the change to the consumer within thirty days of the change being posted to the consumer's file: Name, date of birth, social security number, and address. Written confirmation is not required for technical modifications of a consumer's official information, including name and street abbreviations, complete spellings, or transposition of numbers or letters. In the case of an address change, the written confirmation shall be sent to both the new address and to the former address.

A consumer reporting agency is not required to place a security freeze in a consumer credit report under RCW 19.182.170 if it acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or multiple consumer reporting agencies, and does not maintain a permanent database of credit information from which new consumer credit reports are produced. However, a consumer reporting agency must honor any security freeze placed on a consumer credit report by another consumer reporting agency.

The following entities are not required to place a security freeze in a consumer credit report under RCW 19.182.170:

(1) A check services or fraud prevention services company, which issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments; and

(2) A deposit account information service company, which issues reports regarding account closures due to fraud, substantial overdrafts, ATM abuse, or similar negative information regarding a consumer, to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution.

A consumer reporting agency may furnish to a governmental agency a consumer's name, address, former address, places of employment, or former places of employment.

The definitions in this section apply throughout this section and RCW 19.182.230 unless the context clearly requires otherwise.

(1) "Credit report" means a consumer report, as defined in 15 U.S.C. Sec. 1681a, that is used or collected to serve as a factor in establishing a consumer's eligibility for credit for personal, family, or household purposes.

(2) "Normal business hours" means Sunday through Saturday, between the hours of 6:00 a.m. and 9:30 p.m. Pacific time.

(3) "Protected consumer" means an individual who is:

(a) Under the age of sixteen years old at the time a request for the placement of a security freeze is made pursuant to RCW 19.182.230; or

(b) Incapacitated and for whom a guardian or limited guardian has been appointed.

(4) "Record" means a compilation of information that:

(a) Identifies a protected consumer;

(b) Is created by a consumer reporting agency solely for the purpose of complying with RCW 19.182.230; and

(c) May not be created or used to consider the protected consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living for any purpose listed in RCW 19.182.020.

(5) "Representative" means a person who provides to a consumer reporting agency sufficient proof of authority to act on behalf of a protected consumer.

(6) "Security freeze" means:

(a) If a consumer reporting agency does not have a file pertaining to a protected consumer, a restriction that:

(i) Is placed on the protected consumer's record in accordance with RCW 19.182.230; and

(ii) Prohibits the consumer reporting agency from releasing the protected consumer's record except as provided in RCW 19.182.230; or

(b) If a consumer reporting agency has a file pertaining to the protected consumer, a restriction that:

(i) Is placed on the protected consumer's consumer report in accordance with RCW 19.182.230; and

(ii) Prohibits the consumer reporting agency from releasing the protected consumer's consumer report or any information derived from the protected consumer's consumer report except as provided in RCW 19.182.230.

(7) "Sufficient proof of authority" means documentation that shows a representative has authority to act on behalf of a protected consumer, including:

(a) An order issued by a court of law;

(b) A lawfully executed and valid power of attorney; and

(c) A written, notarized statement signed by a representative that expressly describes the authority of the representative to act on behalf of a protected consumer.

(8) "Sufficient proof of identification" means information or documentation that identifies a protected consumer or a representative of a protected consumer, including:

(a) A social security number or a copy of a social security card issued by the social security administration;

(b) A certified or official copy of a birth certificate issued by the entity authorized to issue the birth certificate;

(c) A copy of a driver's license, an identicard issued under RCW 46.20.117, or any other government-issued identification; or

(d) A copy of a bill, including a bill for telephone, sewer, septic tank, water, electric, oil, or natural gas services, that shows a name and home address.

Effective date—Rule-making authority—2019 c 148: See RCW 70.58A.901 and 70.58A.902.

Effective date—2016 c 135: "This act takes effect January 1, 2017." [ 2016 c 135 § 4.]

(1) A consumer reporting agency shall place a security freeze for a protected consumer if:

(a) The consumer reporting agency receives a request from the protected consumer's representative for the placement of the security freeze under this section; and

(b) The protected consumer's representative:

(i) Submits the request to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency;

(ii) Provides to the consumer reporting agency sufficient proof of identification of the protected consumer and the representative; and

(iii) Provides to the consumer reporting agency sufficient proof of authority to act on behalf of the protected consumer.

(2) If a consumer reporting agency does not have a file pertaining to a protected consumer when the consumer reporting agency receives a request under subsection (1)(a) of this section, the consumer reporting agency shall create a record for the protected consumer.

(3) Within thirty days after receiving a request that meets the requirements of subsection (1) of this section, a consumer reporting agency shall place a security freeze for the protected consumer.

(4) Unless a security freeze for a protected consumer is removed in accordance with subsection (6) or (9) of this section, a consumer reporting agency may not release the protected consumer's consumer report, any information derived from the protected consumer's consumer report, or any record created for the protected consumer.

(5) A security freeze for a protected consumer placed in accordance with this section shall remain in effect until:

(a) The protected consumer or the protected consumer's representative requests the consumer reporting agency to remove the security freeze in accordance with subsection (6) of this section; or

(b) The security freeze is removed in accordance with subsection (9) of this section.

(6) If a protected consumer or a protected consumer's representative wishes to remove a security freeze for the protected consumer, the protected consumer or the protected consumer's representative shall:

(a) Submit a request for the removal of the security freeze to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency;

(b) Provide to the consumer reporting agency:

(i) In the case of a request by the protected consumer:

(A) Proof that the sufficient proof of authority for the protected consumer's representative to act on behalf of the protected consumer is no longer valid; and

(B) Sufficient proof of identification of the protected consumer; and

(ii) In the case of a request by the representative of a protected consumer:

(A) Sufficient proof of identification of the protected consumer and the representative; and

(B) Sufficient proof of authority to act on behalf of the protected consumer.

(7) Within thirty days after receiving a request that meets the requirements of subsection (6) of this section, the consumer reporting agency shall remove the security freeze for the protected consumer.

(8) A consumer reporting agency may not charge a fee for any service performed under this section.

(9) A consumer reporting agency may remove a security freeze for a protected consumer or delete a record of a protected consumer if the security freeze was placed or the record was created based on a material misrepresentation of fact by the protected consumer or the protected consumer's representative.

(10) A violation of this section is enforced in accordance with RCW 19.182.170(17).

(11) This section does not apply to:

(a) Persons or transactions described in RCW 19.182.170(14)(b), (c), (d), (e), (f), (h), or (i);

(b) Persons or transactions described in RCW 19.182.190;

(c) Persons or transactions described in RCW 19.182.200; or

(d) A person or entity that maintains, or a database used solely for, the following:

(i) Criminal record information;

(ii) Personal loss history information;

(iii) Fraud prevention or detection;

(iv) Employment screening; or

(v) Tenant screening.

Effective date—2016 c 135: See note following RCW 19.182.220.

The office of cybersecurity, the office of privacy and data protection, and the attorney's general office must work with stakeholders to evaluate the impact to consumers and the consumer reporting agencies regarding the modifications in chapter 54, Laws of 2018. The report must include trends in data breaches including the frequency and nature of security breaches, best practices for preventing cybersecurity attacks, identity theft mitigation services available to consumers, and identity theft mitigation protocols recommended by the federal trade commission, the consumer financial protection bureau, and other relevant federal or state agencies. The report must be submitted to the house of representatives committee on business and financial services and the senate committee on financial institutions and insurance by December 1, 2020.

This chapter shall be known as the Fair Credit Reporting Act.

This act takes effect January 1, 1994.