§489P-3 Security freeze by consumer reporting agency. (a) Any consumer who is a resident of this State may place a security freeze on the consumer's credit report. A consumer credit reporting agency shall not charge a fee for placing, lifting, or removing a security freeze on a credit report.

A consumer who is a resident of this State may place a security freeze on the consumer's credit report by making a request to a consumer credit reporting agency, at an address, telephone number, or website designated by the consumer credit reporting agency to receive such requests, by any of the following methods:

(1) First-class mail;

(2) Telephone call; or

(3) Secure website.

A security freeze shall prohibit the consumer credit reporting agency from releasing the consumer's credit report or any information from it without the express authorization of the consumer. This subsection shall not prevent a consumer credit reporting agency from advising a third party that a security freeze is in effect with respect to the consumer's credit report.

(b) A consumer reporting agency shall place a security freeze on a consumer's credit report no later than five business days after receiving a written request from the consumer.

(c) The consumer reporting agency shall send a written confirmation of the security freeze to the consumer within ten business days of placing the security freeze and shall provide the consumer with a unique personal identification number or password, other than the consumer's social security number, to be used by the consumer when providing authorization for the release of the consumer's credit report for a specific party, parties, or period of time.

(d) If the consumer wishes to allow access to the consumer's credit report for a specific party, parties, or period of time while a freeze is in place, the consumer shall contact the consumer reporting agency at a point of contact designated by the agency using the procedures that may be developed by the consumer reporting agency, request that the freeze be temporarily lifted, and provide the following:

(1) Clear and proper identification;

(2) The unique personal identification number or password provided by the consumer reporting agency; and

(3) Clear and proper information regarding the third party, parties, or time period for which the report shall be available to users of the credit report.

(e) A consumer reporting agency may develop procedures involving the use of telephone, fax, the Internet, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze on a credit report in an expedited manner.

(f) A consumer reporting agency that receives a request from a consumer to temporarily lift a freeze on a credit report shall comply with the request no later than three business days after receiving the request.

(g) A consumer reporting agency shall remove or temporarily lift a security freeze placed on a consumer's credit report only in the following cases:

(1) Upon consumer request; or

(2) When the consumer's credit report was frozen due to a material misrepresentation of fact by the consumer.

If a consumer reporting agency removes a security freeze upon a consumer's credit report pursuant to this subsection, the consumer reporting agency shall send a written confirmation of the removal of the security freeze to the consumer within five business days of removing the security freeze on the consumer's credit report.

(h) If a third party requests access to a credit report on which a security freeze is in effect and this request is in connection with an application for credit or any other use and the consumer does not allow the consumer's credit report to be accessed by that specific party or for that period of time, the third party may treat the application as incomplete.

(i) If a consumer requests a security freeze, the consumer reporting agency shall disclose to the consumer the process of placing and temporarily lifting a security freeze and the process for allowing access to information from the consumer's credit report for a specific party, parties, or period of time while the security freeze is in place.

(j) A security freeze shall remain in place until the consumer requests that the security freeze be removed. A consumer reporting agency shall remove a security freeze within three business days of receiving a request for removal at a point of contact designated by the agency using procedures that may be developed by the consumer reporting agency; provided that the consumer shall provide the following:

(1) Clear and proper identification; and

(2) The unique personal identification number or password provided by the consumer reporting agency pursuant to subsection (c).

(k) A consumer reporting agency shall require clear and proper identification of the person making a request to place or remove a security freeze.

(l) The provisions of this section, including the security freeze, do not apply to the use of a consumer’s credit report by the following:

(1) A person, or the person's subsidiary, affiliate, agent, or assignee with which the consumer has or, prior to assignment, had an account, contract, or debtor-creditor relationship for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or debt, or extending credit to a consumer with a prior or existing account, contract, or debtor-creditor relationship. For purposes of this subsection, "reviewing the account" includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements;

(2) A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted for purposes of facilitating the extension of credit or other permissible use;

(3) Any person acting pursuant to a court order, warrant, or subpoena;

(4) A child support enforcement agency when investigating a child support case pursuant to Title IV-D of the Social Security Act (42 U.S.C. sections 651 to 669b);

(5) The department of the attorney general or county prosecuting attorneys or their agents or assignees acting to investigate medicaid fraud;

(6) The department of taxation, county taxing authorities, or any of their agents or assignees, acting to investigate or collect delinquent taxes or assessments, including interest and penalties, unpaid court orders, or to fulfill any of their other statutory or charter responsibilities;

(7) The use of credit information for the purposes of prescreening as provided by the federal Fair Credit Reporting Act (15 U.S.C. sections 1681 to 1681x);

(8) Any person for the sole purpose of providing a credit file monitoring subscription service to which the consumer has subscribed;

(9) A person for the sole purpose of providing a consumer with a copy of the consumer's credit report upon the consumer's request; and

(10) Any person or entity using a credit report in setting or adjusting a rate, adjusting a claim, or underwriting for insurance purposes. [L 2006, c 138, pt of §1; am L 2007, c 189, §1; am L 2018, c 22, §4]