Free Credit Freezes and Security Alerts

Summary#

This bill changes Alberta’s Consumer Protection Act to add new tools to prevent identity theft and credit fraud. It lets people place a “security alert” or a “credit freeze” on their credit file with a reporting agency (credit bureau). It also sets duties for lenders who use credit reports and for reporting agencies that handle these requests. The goal is to reduce fraudulent credit accounts and improve consumer control.

Key changes:

• Creates a free “security alert” that adds contact details to a person’s credit report and warns lenders to verify identity before giving credit.
• Creates a free “credit freeze” that stops a reporting agency from giving a credit report for the purpose of entering into a credit agreement.
• Requires lenders who receive a report with a security alert to contact the person (if not in person) or verify ID (if in person) and keep a record of what they did.
• Requires reporting agencies to verify identity before acting on alert/freeze requests; include alert info in all reports; and send notices about when alerts/freezes will expire.
• Bans fees for placing, updating, suspending, or removing alerts/freezes and requires agencies to post clear information about these rights on a public website.
• Adds offences for breaking these rules. Timing: starts 90 days after Royal Assent.
• What is unclear: how long alerts/freezes last and some process details will be set later by regulation.

What it means for you#

• Consumers (individuals in Alberta)

  • You can ask a credit bureau to add a security alert to your credit report. Lenders who see it must take extra steps to confirm it is really you before giving credit.
  • You can ask for a credit freeze. While it is in effect, the bureau must not provide your report to anyone asking for it to open new credit with you.
  • You can update your contact info, or end an alert or freeze at any time. You can also ask to suspend a freeze for a set time (for example, to apply for credit), within limits that regulations will set.
  • The bureau must tell you (within 30 days) when your alert/freeze will expire and remind you no later than 30 days before it ends. You can make a new request after it expires (and for freezes, at any time).
  • You cannot be charged fees for these services.
  • What is unclear: the bill does not state how long alerts or freezes last; this will come in regulations.

• Businesses that extend credit (lenders, retailers offering financing, etc.)

  • If a report you receive has a security alert and the customer is not in front of you, you must make reasonable efforts to contact them using the alert’s contact info before granting credit and keep a record of those efforts.
  • If the customer is present, you must verify their identity and record how you did it.
  • If a credit freeze is in place, the bureau must not give you that person’s report for the purpose of entering into a credit agreement.
  • Non-compliance with these duties is an offence under the Act.
  • This could mean new steps in your credit approval process, more recordkeeping, and possible delays in approving credit when an alert is present.

• Credit reporting agencies (credit bureaus)

  • You must create and run processes to receive, verify, apply, update, suspend, and end security alerts and credit freezes.
  • When an alert is in place, you must include alert information in every report about that person.
  • When a freeze is in place, you must not provide a report for credit-granting purposes and must tell the requester why no report is provided.
  • You must notify consumers of expiry dates within 30 days of a request and again at least 30 days before expiry.
  • You must not charge any fees for these actions and must publish clear public information about these rights on your website.
  • Breaking these rules is an offence under the Act.

• Other users of credit reports (for non-credit purposes)

  • By the bill’s wording, the freeze blocks reports requested “for the purpose of entering into a credit agreement.” It does not clearly block reports requested for other purposes (such as employment or tenancy checks).

• Privacy obligations (PIPA)

  • The bill says two clauses of Alberta’s Personal Information Protection Act (sections 14(g) and 17(g)) do not apply to information about a person while a credit freeze is in effect.
  • What is unclear: the bill does not explain what those clauses cover; the practical effect for organizations subject to PIPA is not clear here.

Expenses#

No publicly available information.

• Reporting agencies will likely face administrative and technology costs to build systems, verify identity, send notices, and manage suspensions and expiries.
• Businesses that extend credit may face compliance and training costs to verify identity and keep records when a security alert appears.
• Government may have enforcement and oversight costs; no estimate is provided.

Proponents' View#

• The bill appears intended to reduce identity theft and stop fraudsters from opening credit in someone else’s name.
• Security alerts would prompt extra identity checks before credit is granted, which could prevent fraudulent accounts.
• Credit freezes would likely block most new credit from being opened without the person’s consent, by cutting off credit reports for that purpose.
• Making alerts and freezes free removes cost barriers for consumers.
• Required notices and public information could improve awareness and help people keep protections active.
• Recordkeeping by lenders could improve accountability and make enforcement easier.

Opponents' View#

• A possible trade-off is slower, more complex credit approvals, especially for remote or online applications when a security alert is present.
• The term “reasonable efforts” to contact a consumer is not defined in detail, which may create uncertainty about what steps are enough.
• Many important details (expiry lengths, allowed contact methods, and how long a temporary suspension can last) are left to future regulations, making the real-world impact hard to judge now.
• Consumers must track expiry dates and renew protections; lapses could expose them to fraud.
• The freeze appears to block credit reports only for credit-granting purposes; it may not affect other uses of reports, which could limit its scope.
• The change to PIPA (disapplying two clauses when a freeze is active) is not explained here, which may create compliance questions for organizations handling personal information.