(1) The consumer credit reporting agency receives a request from the protected consumer's representative for the placement of the security freeze under this section; and

(2) The protected consumer's representative (i) submits the request to the consumer credit reporting agency at the address or other point of contact and in the manner specified by the consumer credit reporting agency; (ii) provides to the consumer credit reporting agency sufficient proof of identification of the protected consumer and the representative; (iii) provides to the consumer credit reporting agency sufficient proof of authority to act on behalf of the protected consumer; and (iv) pays to the consumer credit reporting agency a fee, if any, as provided in this section.

(b) If a consumer credit reporting agency does not have a file pertaining to a protected consumer when the consumer credit reporting agency receives a request under subdivision (a) of this section, the consumer credit reporting agency shall create a record for the protected consumer.

(c) Within thirty days after receiving a request that meets the requirements of paragraph two of subdivision (a) of this section, a consumer credit reporting agency shall place a security freeze for the protected consumer on the record created for the protected consumer or on the file pertaining to the protected consumer in the event that the consumer reporting agency already has a file pertaining to the protected consumer.

(d) Unless a security freeze for a protected consumer is removed in accordance with this section, a consumer credit reporting agency may not release the protected consumer's consumer credit report, any information derived from the protected consumer's consumer report, or any record created for the protected consumer.

(e) A security freeze for a protected consumer placed under this section shall remain in effect until:

(1) The protected consumer or the protected consumer's representative requests the consumer credit reporting agency to remove the security freeze for a protected consumer in accordance with subdivision (f) of this section; or

(2) The security freeze is removed in accordance with subdivision (i) of this section.

(f) If a protected consumer or a protected consumer's representative wishes to remove a security freeze for the protected consumer, the protected consumer or the protected consumer's representative shall:

(1) Submit a request for the removal of the security freeze to the consumer credit reporting agency at the address or other point of contact and in the manner specified by the consumer credit reporting agency;

(2) Provide to the consumer credit reporting agency: (i) in the case of a request by the protected consumer: (A) proof that the sufficient proof of authority for the protected consumer's representative to act on behalf of the protected consumer is no longer valid or that the protected consumer has attained the age of sixteen; and (B) sufficient proof of identification of the protected consumer; or (ii) in the case of a request by the representative of a protected consumer: (A) sufficient proof of identification of the protected consumer and the representative; and (B) sufficient proof of authority to act on behalf of the protected consumer; and (C) payment to the consumer credit reporting agency of a fee, if any, as provided in subdivision (h) of this section.

(g) Within thirty days after receiving a request that meets the requirements of subdivision (f) of this section, the consumer credit reporting agency shall remove the security freeze for the protected consumer.

(h)(1) A consumer credit reporting agency may charge a reasonable fee, not exceeding fifteen dollars, for each placement or removal of a security freeze for a protected consumer as provided for in subparagraph (iv) of paragraph two of subdivision (a) or clause (C) of subparagraph (ii) of paragraph two of subdivision (f) of this section. A consumer credit reporting agency shall not charge a fee for any other service performed under this section.

(2) Notwithstanding paragraph one of this subdivision, a consumer credit reporting agency may not charge any fee under this section if; (i) the protected consumer's representative: (A) has obtained a report of alleged identity theft or fraud against the protected consumer; and (B) provides a copy of the report to the consumer credit reporting agency; or (ii) the consumer credit reporting agency has a consumer credit report pertaining to the protected consumer.

(i) A consumer credit reporting agency shall remove a security freeze for a protected consumer, or delete a record of a protected consumer, if the security freeze was placed or the record was created based on a material misrepresentation of fact by the protected consumer or the protected consumer's representative.

(j) This section does not apply to:

(1) A person administering a credit file monitoring subscription service to which: (i) the protected consumer has subscribed; or (ii) the representative of the protected consumer has subscribed on behalf of the protected consumer;

(2) A person providing the protected consumer or the protected consumer's representative with a copy of the protected consumer's consumer credit report upon the request of the protected consumer or the protected consumer's representative;

(3)(i) An entity listed in paragraphs three through eight of subdivision (m) of section three hundred eighty-t of this article; (ii) an entity listed in subdivision (p) of section three hundred eighty-t of this article; or (iii) a consumer credit reporting agency's database or file that consists of information concerning, and used for, one or more of the following: criminal record information, fraud prevention or detection, personal loss history information, and employment, tenant, or background screening.

(k) Notwithstanding any other provision of law, the exclusive remedy for a violation of this section shall be in an action commenced by the attorney general.