75.118—Other credit protection services.
(a)
With respect to individuals found under this subpart by the Secretary to be subject to a reasonable risk for the potential misuse of any sensitive personal information under this subpart, the Secretary may offer one or more of the following as warranted based on considerations specified in paragraph (b) of this section:
(1)
One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;
(3)
Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution; and/or
(b)
Consistent with the requirements of the Fair Credit Reporting Act (15 U.S.C. 1681
et seq.) as interpreted and applied by the Federal Trade Commission, the notice to the individual offering other credit protection services will explain how the individual may obtain the services, including the information required to be submitted by the individual to obtain the services, and the time period within which the individual must act to take advantage of the credit protection services offered.
(c)
In determining whether any or all of the credit protection services specified in paragraph (a) of this section will be offered to individuals subject to a data breach, the Secretary will consider the following:
(3)
The likelihood the sensitive personal information will be or has been made accessible to and usable by unauthorized persons;
(c)
The Secretary will take action to obtain data mining and data breach analyses services, as appropriate, to obtain information relevant for making determinations under this subpart.