This Act amends B.C.’s Business Practices and Consumer Protection Act and the Personal Information Protection Act to add new consumer tools and supplier obligations around credit reporting. It creates a framework for security-alert flags and consumer-requested credit freezes in credit reports, requires identity verification when alerts or freezes are present, and sets disclosure, cancellation and refund rules for credit monitoring and credit repair contracts.
The bill also changes how credit reporting agencies must handle access and correction requests (including new obligations to forward corrections and to provide credit scores on request), prohibits credit repair businesses from collecting payment until specified outcomes are achieved, and adds offence and regulatory hooks for enforcement. The result: more friction for bad actors and improved consumer controls — with new compliance burdens for reporting agencies, repair firms, and lenders.
At a Glance
What It Does
The Act requires reporting agencies to accept “security alert” requests and include prescribed security-contact information in any reports; it creates a statutory credit freeze that prevents disclosure of a report for credit‑agreement purposes; it requires identity verification before creditors rely on reports that contain security alerts; and it establishes a regulated regime for credit monitoring and credit repair services, including disclosure, cancellation, refund and payment‑timing rules.
Who It Affects
Credit reporting agencies and any business that requests consumer credit reports for credit agreements (lenders, lessors), credit monitoring and credit repair service providers, privacy officers under PIPA, and consumers who seek to protect themselves from identity theft or to correct credit report errors.
Why It Matters
The bill gives consumers direct control tools (alerts and freezes) and statutory rights to correction while restricting business models that take upfront fees for credit repair. That shifts operational risk onto reporting agencies and service providers and creates new points of interaction — and liability — for anyone relying on credit reports in B.C.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The Act adds a new Part 6 and a new Part 6.4 to the Business Practices and Consumer Protection Act focused on credit reporting, monitoring and repair. It defines new terms (credit freeze, credit monitoring services, credit repair services, credit score) and requires reporting agencies to accept written requests to include “security alert information” in a consumer’s report.
Once verified, that security alert information must appear on any report and include contact details and a short summary of the verification/alert mechanism.
When a report presented to a creditor contains security alert information, the creditor must either verify the person's identity in person or, if the person is not present, make reasonable efforts to contact them using the contact information in the alert and keep a record of those efforts. Separately, consumers may place a credit freeze that forbids reporting agencies from disclosing a consumer’s report for anyone requesting it for the purpose of entering into a credit agreement; consumers can also suspend or terminate freezes subject to prescribed rules.The bill puts express limits on credit monitoring and credit repair providers.
Credit monitoring providers must give prescribed disclosures (including the consumer’s right to obtain copies of personal information and their credit score under PIPA) and consumers get enhanced cancellation and refund rights if those disclosures fail. Credit repair providers face stricter controls: they must disclose specific rights and cannot demand or accept payment—or take security for payment—until they achieve a “specified outcome,” such as correcting an error in a report or improving a credit score.
Contracts must be acknowledged by initialing and carry a 10‑day cancellation window (longer where mandatory disclosure failures occur).The Act also amends the Personal Information Protection Act to (1) add “credit score” to its definitions, (2) require credit reporting agencies to provide the individual’s credit score when an access request is made, and (3) create an explicit, time‑bound right to request correction of a credit reporting agency’s records with a duty on the agency to forward corrections to organizations that received the information in the previous year. The bill forbids charges for many of the actions required (e.g., security alert and freeze processing and certain access requests) and creates new offence provisions tied to specified contraventions.
Several technical amendments add regulatory flexibility to prescribe form, timing, suspension rules, and prescribed outcomes.
The Five Things You Need to Know
Section 112.002 creates a statutory credit freeze: once a verified freeze is in effect a reporting agency must refuse any request for a report made for the purpose of entering into a credit agreement and must tell the requester why no report is provided.
Section 112.35 bars credit repair services providers from requiring or accepting payment (or taking security) until they achieve a 'specified outcome' such as correcting an error in a report or improving a consumer's credit score.
Section 107.1 requires a creditor to verify identity or make and record reasonable contact efforts before entering a credit agreement when a report contains security alert information.
Section 24.1 (PIPA addition) gives individuals a direct right to request correction from a credit reporting agency, obliges agencies to correct or to annotate disputed information, and requires agencies to notify downstream recipients of corrections made within the prior year.
Section 112.004 gives consumers a refund remedy: if a credit monitoring provider fails to make required pre‑contract disclosures the consumer may cancel within one year and obtain a full refund within 15 days.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
New definitions and misrepresentation ban for credit repair providers
This amendment injects credit‑specific terms into the statute (credit repair services, credit score, reporting agency, report) and adds an explicit prohibition against credit repair providers misrepresenting that they hold licences, can compel reporting agencies, or can improve credit scores except where the provider has examined the consumer's report and reasonably concluded the report contains inaccuracy or incompleteness. Practically, that creates a per‑service advertising standard and a basis for enforcement actions against deceptive claims.
Renames Part 6 and expands credit‑related definitions
The Act renames Part 6 as 'Credit Reporting and Credit Monitoring' and broadens section 106 to define credit monitoring services, providers, credit agreements (including leases), and security alert information. Those definitions shape the universe of contracts and suppliers covered by the new consumer protections, and they trigger downstream amendments to other statutes (for example, the Motor Dealer Act) so those industries fall into the updated regulatory perimeter.
Identity verification duties when a report contains security‑alert information
Section 107.1 requires anyone who receives a report that contains security‑alert information to take identity verification steps before entering into a credit agreement. If the consumer is present, the creditor must verify identity and document how verification occurred; if absent, the creditor must try to contact the consumer using the contact information on the alert and keep a record of those efforts. This creates documentary obligations for lenders and lessors and elevates the evidentiary value of security alerts in blocking fraudulent transactions.
Security‑alert requests and statutory credit freezes
Section 112.001 allows consumers to request that a reporting agency include security‑alert information in all reports; the agency must verify the requestor's identity, include prescribed text and contact details in reports, publish rights on its website, and cannot charge for these services. Section 112.002 establishes a consumer's right to a credit freeze that prevents disclosure of a report for the purpose of entering into a credit agreement, requires identity verification before activating or terminating freezes, permits temporary suspensions subject to regulation, and prohibits fees for freeze services. Both regimes include notification timing obligations where obligations end after prescribed periods.
Obligations and remedies for credit monitoring services providers
Credit monitoring providers must disclose specific information before contracting (including the consumer's PIPA rights and credit score availability) and consumers get layered cancellation rights: the usual statutory windows plus up to a one‑year cancellation right where the provider fails to comply with disclosure duties. Refunds must be paid within 15 days and existing mechanics for notice of cancellation and recovery of refunds apply, increasing financial risk for non‑compliant providers.
Comprehensive regime for credit repair services
This new Part defines credit repair services and establishes three core constraints: (1) a ban on taking payment until the provider achieves a specified outcome; (2) pre‑contract disclosure and a requirement that consumers initial each contract term; and (3) a short cancellation window plus extended cancellation and refund rights where disclosure duties are breached. The 'specified outcome' is broadly defined and partially left to regulation, creating both substantive protection and later rule‑making scope.
Access, correction and fee limits for credit reporting agencies
The Act amends PIPA to add 'credit score' to the statutory lexicon, to require credit reporting agencies to provide an individual's credit score on access requests, and to grant a direct correction right against a credit reporting agency (section 24.1). Agencies must implement or annotate corrections within a prescribed timeframe and forward corrections to organizations that received the information in the prior year. The law also bars fees for repeated access requests within one month, and makes contraventions a potential offence for credit reporting agencies.
New regulatory powers and enumerated offences
The Act lists many of the new sections as designated activities for enforcement and links specific contraventions to existing offence provisions (including a newly added offence in section 56 for certain failures by credit reporting agencies). It also empowers the Lieutenant Governor in Council to prescribe technical details: forms, periods for suspensions, what counts as a specified outcome for credit repair, and disclosure content for services — leaving key operational rules to regulation.
This bill is one of many.
Codify tracks hundreds of bills on this topic across all five countries.
Explore this topic in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Consumers at risk of identity theft and fraud — they can add security alerts and freezes to their reports, force identity verification, and obtain refunds where providers fail to disclose required information.
- Consumers seeking record correction — new PIPA section 24.1 creates a direct correction pathway against credit reporting agencies and obliges agencies to push corrections to prior recipients, improving the practical effect of successful disputes.
- Victims of deceptive credit repair marketing — the law criminalizes certain misrepresentations by repair providers and requires clear pre‑contract disclosures, giving regulators and private consumers clearer remedies.
Who Bears the Cost
- Credit reporting agencies — must implement request intake, identity verification workflows, recordkeeping, website publications, no‑fee access periods, correction‑forwarding mechanisms, and face new offence exposure for breaches.
- Credit repair and credit monitoring firms — must restructure pricing and contracts (no upfront fees for repair), implement prescribed disclosure scripts, support consumer cancellations and refunds, and track outcomes to justify payment timing.
- Lenders, lessors and other users of credit reports — will face additional verification and recordkeeping duties when reports contain alerts or freezes, and may encounter delays or denials when a consumer has an active freeze or unresolved security alert.
Key Issues
The Core Tension
The central dilemma is trade‑off between stronger consumer safety and consumer control on one hand, and operational friction for lawful credit transactions on the other: robust freezes and verification protocols reduce identity‑theft harms but create delays and administrative burdens for lenders and reporting agencies — and the choice of regulatory details will determine which side of that trade‑off dominates.
The Act stacks consumer protections that add friction into the credit lifecycle without fully specifying operational details; many of the day‑to‑day mechanics are deferred to regulation (prescribed periods, the meaning of 'specified outcome', suspension rules). That regulatory gap matters because implementation choices — e.g., how strictly agencies must verify identity, the form of contact efforts, or the minimum/maximum suspension windows — will determine whether freezes and alerts are robust protections or sources of friction for legitimate transactions.
The payment prohibition for credit repair services addresses a clear abuse, but it raises practical questions: how to verify when a provider has 'achieved' an improvement in score, how to handle mixed outcomes (partial corrections), and whether contingent‑fee structures will create disputes about causation. There is also a risk that stricter rules will push some operators outside the regulated market (informal or offshore services) or encourage consumers to sign up for dubious 'free trial' monitoring that migrates to paid services.
Finally, the Act increases operational and compliance costs for reporting agencies and for organizations that consume credit reports; those costs will be borne somewhere in the system (higher prices, slower onboarding, or conservative declines). Enforcement depends on offence provisions and regulatory attention, but the Act's effectiveness will turn on the quality and timing of the Lieutenant Governor’s regulations and on agencies' practical capacity to execute identity verification and correction‑forwarding at scale.
There's more to this law than the bill.
Codify Laws traces every connection across the legislative lifecycle.