Bill 210 amends Alberta’s Consumer Protection Act to let individuals place two new protections on their credit reports: a security alert (a flagged note with contact details and a prompt for extra verification) and a credit freeze (which prevents reports being furnished for new credit agreements). The bill imposes verification and record-keeping duties on reporting agencies and on any person who receives a report containing a security alert, sets notice and expiry requirements, forbids charging fees for these services, and grants extensive regulation-making power.
Why it matters: the proposals insert a statutory, province-level mechanism for victims or at‑risk consumers to force extra checks or halt the flow of credit-file data — shifting operational burdens onto reporting agencies and creditors, creating new privacy interactions with PIPA, and leaving many implementation details to regulation.
At a Glance
What It Does
The bill adds definitions for “security alert request” and “credit freeze request,” requires reporting agencies to verify identity and include prescribed security alert information in reports, and requires recipients to take steps to verify identity or to attempt contact before extending credit. It bars reporting agencies from charging fees for these measures and requires public disclosure of rights on websites.
Who It Affects
Credit reporting agencies operating in Alberta, lenders and other persons that obtain credit reports for the purpose of entering credit agreements, consumers who suspect fraud or want to control access to their credit file, and privacy officers because of a limited PIPA exception tied to credit freezes.
Why It Matters
It creates a statutory pathway for consumers to force extra identity checks or to block disclosure of credit reports for new credit, potentially reducing fraud but increasing compliance, verification costs, and transaction friction for lenders; regulators must fill in major operational details by regulation.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The bill inserts two consumer-facing tools into Part 5 of the Consumer Protection Act. A security alert is a flagged note that a reporting agency must add to an individual’s credit report on request and after identity verification; the alert must include the individual’s contact information and statements telling recipients that special verification obligations apply.
The recipient obligations are practical: if the consumer is not present, the recipient must make reasonable efforts to contact them using the provided contact details and record those attempts; if the consumer is present, the recipient must verify identity and document how that verification occurred.
Separately, the credit freeze lets an individual tell a reporting agency to withhold any report requested for the purpose of entering a credit agreement. After verifying the requester’s identity, the reporting agency must refuse to provide the report and must tell the requester why it is withholding the report.
Consumers can later terminate or (subject to regulation) temporarily suspend a freeze; the agency must verify identity before acting on those consumer notices.The bill builds in operational guardrails: reporting agencies must publish explanatory material on a publicly accessible website and they cannot charge fees for security alerts or freezes. The statutory duties expire after a period to be set in regulation, and the reporting agency must notify individuals both shortly after the request and again before expiry.
The bill also creates a limited exception in the Personal Information Protection Act so that certain PIPA provisions do not apply to information while a credit freeze is in effect, and it expands the list of contraventions that are offenses under the Consumer Protection Act.Implementation is heavily delegated to regulation: the government will prescribe how consumers give notice, the form and type of contact information required, expiry periods, and rules governing temporary suspensions. The Act comes into force 90 days after Royal Assent, giving reporting agencies and creditors a short window to prepare for the new operational duties.
The Five Things You Need to Know
Reporting agencies must add to every report, once identity is verified, a security-alert entry containing a statement that it was added at the individual’s request, a summary alerting recipients to extra verification duties under section 48.1, and the individual’s contact information.
A credit freeze prevents a reporting agency from providing a report to any person who requests it for the purpose of entering into a credit agreement, and the agency must inform the requester why the report is withheld.
Reporting agencies must notify the individual no later than 30 days after a request of the date the obligation will expire, and again no later than 30 days before expiry that they may reapply.
The bill forbids reporting agencies from charging any fee for actions taken under the security alert or credit freeze provisions and requires agencies to publish explanatory information on a public website.
Sections 14(g) and 17(g) of Alberta’s Personal Information Protection Act will not apply to information while a credit freeze request is in effect, and contraventions of many new duties are made offences in section 161.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
New definitions for security alerts and credit freeze requests
The Act adds precise definitions: “security alert information,” “security alert request,” and “credit freeze request.” Those definitions tie the new consumer tools to later operational duties and to regulatory prescriptions (for example, what contact information must be supplied). For compliance teams this is the pivot point: anything the regulations require about form or method will be read against these statutory labels.
Reporting agency disclosure rule made conditional
Section 44(1) is amended to make a reporting agency’s ability to furnish reports explicitly subject to the new credit freeze regime. Practically, that means a reporting agency cannot rely on prior statutory language to override a later credit freeze — the freeze sits as an immediate statutory limiter on routine report distribution for credit purposes.
Security alert requests: contents, verification, updates and expiry
Section 48 sets out how an individual requests a security alert, requires the reporting agency to verify the individual’s identity and then to include prescribed security alert information in every report. It also allows the individual to update or terminate the alert and obliges the agency to verify identity before making the change. Importantly, the obligation to include security alerts expires after a period set by regulation and the agency must give two statutory notices to the individual about expiry—one within 30 days of the initial request listing the expiry date, and one 30 days before the expiry reminding the individual they can reapply.
Recipient verification and record-keeping duties
Section 48.1 requires any person receiving a report with security-alert information to take concrete steps before entering a credit agreement: either attempt contact (if the consumer is not present) using the alert contact details and record the attempts, or verify identity if the consumer is present and record how verification was done. Those records create an evidentiary trail and a new compliance burden for lenders and merchants that approve credit in person or remotely.
Credit freezes: freeze, suspension, termination and verification
Section 48.2 gives individuals a statutory right to freeze their file against disclosure for new credit agreements. The reporting agency must verify identity when receiving a freeze request and must refuse disclosures for credit-entering purposes while the freeze is in effect. Consumers can terminate or (subject to regulation) suspend freezes; the agency must verify identity before lifting or suspending a freeze. The statute leaves the allowable duration of suspensions, and minimum/maximum suspension lengths, to regulation.
Website disclosures, fee ban, and PIPA carve-out
Section 48.3 requires reporting agencies to publish information on a public website describing the rights under sections 48 and 48.2 and expressly prohibits charging fees for anything done under those sections. Section 48.4 creates a narrow carve-out from specified sections of the Personal Information Protection Act so certain PIPA provisions do not apply to information while a credit freeze is in effect; this shifts how privacy obligations interact with operational freezes and will affect privacy compliance assessments.
Regulation-making authority for form, notice periods and suspension rules
The Act adds broad regulation-making powers covering the manner of notice, the method and type of contact information, expiry periods for alerts and freezes, the manner of notices tied to both processes, and the rules for temporary suspension including minimum and maximum durations. Because many operational details are missing from the statute, the quality and specificity of forthcoming regulations will determine how burdensome or workable these rights are in practice.
New offences and timing
Section 161 is expanded to make contraventions of numerous new provisions offences under the Consumer Protection Act, so non-compliance carries potential criminal or quasi-criminal consequences. The Act comes into force 90 days after Royal Assent, giving a short, legislated lead time for reporting agencies, creditors and regulators to finalize processes and draft regulations.
This bill is one of many.
Codify tracks hundreds of bills on this topic across all five countries.
Explore this topic in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Consumers who suspect identity theft or fraud: they gain two statutory tools — a security alert that prompts extra verification and a credit freeze that blocks report disclosure for new credit — increasing their practical control over who can issue credit in their name.
- Vulnerable populations (seniors, recent identity‑theft victims): the security alert’s requirement that recipients attempt contact or verify identity can materially reduce successful fraud attempts against people who are targeted.
- Institutions that prioritize fraud prevention (banks, large lenders): these organizations gain a statutory backstop that encourages better verification practices and can reduce losses from fraud if they implement the verification and record-keeping steps effectively.
Who Bears the Cost
- Credit reporting agencies: they must implement identity-verification workflows, track and include security alert information in all reports, publish explanatory materials, and process suspensions/terminations — all without charging fees, so costs fall on their operations or other revenue lines.
- Lenders, merchants and other credit grantors: recipients of reports must change underwriting and point‑of‑sale processes to make contact attempts, delay credit decisions when alerts apply, and retain documentation of verification efforts, which increases transaction time and compliance overhead.
- Regulators and privacy offices: the government and privacy officers must draft detailed regulations, manage enforcement of new offences, and reconcile the PIPA carve-out with existing privacy frameworks, requiring additional administrative resources.
Key Issues
The Core Tension
The central dilemma is balancing stronger consumer control to prevent identity‑based fraud against the increased friction, delay and operational cost imposed on reporting agencies and creditors: stronger protections reduce fraud risk but can slow legitimate credit access and create significant compliance burdens, and the Act leaves many trade-offs to future regulations.
The bill delegates most implementation details to regulation, leaving crucial questions—what constitutes acceptable contact information, how long protections last, how long temporary suspensions may run, and the exact form of required notices—to future rulemaking. That makes regulatory design the central determinant of how burdensome these duties will be.
The statute also uses terms that are operationally vague (for example, “reasonable efforts” to contact an individual) and creates record‑keeping duties without specifying retention periods or standards for what proof satisfies the identity‑verification requirement.
The PIPA carve-out is another flashpoint. Exempting certain PIPA provisions while a credit freeze is in effect eases operational constraints on withholding or sharing information, but it also shifts privacy risk: agencies and recipients will hold and rely on contact details and verification records that are not fully governed by the referenced PIPA sections, raising questions about secondary uses, cross-border disclosures, and data-security obligations.
Finally, the no-fee prohibition improves access but compresses the incentive for reporting agencies to absorb the new costs, increasing the likelihood that they will reallocate costs elsewhere or resist rapid operational changes. The expansion of offences in section 161 raises compliance stakes but may also chill implementation if providers fear liability for ambiguous compliance standards.
There's more to this law than the bill.
Codify Laws traces every connection across the legislative lifecycle.