§8-35-2. Security freeze on credit report.

(a) A consumer may place a security freeze on the consumer's credit report by making a request in writing by certified mail to a consumer credit reporting agency. No later than August 31, 2012, a consumer credit reporting agency shall make available to consumers an Internet based method of requesting a security freeze and a toll-free telephone number for consumers to use to place a security freeze, temporarily lift a security freeze, or completely remove a security freeze. A security freeze shall prohibit, subject to exceptions in subsection (m), the consumer credit reporting agency from releasing the consumer's credit report or credit score without the prior express authorization of the consumer as provided in subsection (d) or (e). Nothing in this subsection shall prevent a consumer credit reporting agency from advising a third party that a security freeze is in effect with respect to the consumer's credit report.

(b) A consumer credit reporting agency shall place a security freeze on a consumer's credit report no later than three business days after receiving the consumer's written request sent by certified mail.

(c) The consumer credit reporting agency shall send a written confirmation of the security freeze to the consumer within 10 business days of placing the security freeze and at the same time shall provide the consumer with a unique personal identification number or password, other than the consumer's Social Security number, to be used by the consumer when providing authorization for the release of the consumer's credit report for a specific period of time.

(d) If the consumer wishes to allow the consumer's credit report to be accessed for a specific period of time while a security freeze is in place, the consumer shall contact the consumer credit reporting agency through the contact method established by the consumer credit reporting agency, request that the security freeze be temporarily lifted, and provide all of the following:

(1) Proper identification.

(2) The unique personal identification number or password provided by the consumer credit reporting agency pursuant to subsection (c).

(3) The proper information regarding the time period for which the report shall be available to users of the consumer credit report.

(4) The proper payment as may be required by the consumer credit reporting agency.

(e) A consumer credit reporting agency shall develop procedures involving the use of telephone, the Internet, or other electronic media to receive and process a request from a consumer to temporarily lift a security freeze on a consumer credit report pursuant to subsection (d).

(f) A consumer credit reporting agency that receives a request from a consumer to temporarily lift a security freeze on a consumer credit report pursuant to subsection (d) or (e) shall comply with the request as follows:

(1) No later than three business days after receiving a written request.

(2) Within 15 minutes after the request and payment are received by telephone or electronically by the contact method chosen by the consumer reporting agency during normal business hours and the request includes the consumer's proper identification, correct personal identification number or password, and the proper payment as may be required by the consumer credit reporting agency.

(g) A consumer reporting agency need not temporarily lift a security freeze within 15 minutes, as specified in subdivision (2) of subsection (f), if either of the following occurs:

(1) The consumer fails to satisfy the requirements of subsection (d).

(2) The consumer credit reporting agency's ability to temporarily lift the security freeze within 15 minutes is prevented by the following:

a. An act of God, including earthquakes, hurricanes, storms, or similar natural disaster or phenomenon, or fire.

b. Unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrence.

c. Operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruption.

d. Governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar directives.

e. Regularly scheduled maintenance or updates, during other than normal business hours, to the consumer reporting agency's systems.

f. Commercially reasonable maintenance of, or repair to, the consumer reporting agency's systems that is unexpected or unscheduled.

g. Receipt of a request outside of normal business hours.

(h) A consumer credit reporting agency shall only remove or temporarily lift a security freeze placed on a consumer's credit report upon any of the following circumstances:

(1) Upon the consumer's request, in compliance with the requirements of this section.

(2) If the consumer's credit report was frozen due to a material misrepresentation of fact by the consumer. If a consumer credit reporting agency intends to remove a security freeze upon a consumer's credit report pursuant to this subdivision, the consumer credit reporting agency shall notify the consumer in writing prior to removing the security freeze on the consumer's credit report.

(i) If a third party requests access to a consumer credit report on which a security freeze is in effect and this request is in connection with an application for credit or any other use related to the extension of credit and the consumer does not allow the consumer's credit report to be accessed for that specific period of time, the third party may treat the application as incomplete.

(j) If a consumer requests a security freeze pursuant to this section, the consumer credit reporting agency shall disclose to the consumer the process of placing and temporarily lifting a security freeze and the process for allowing access to information from the consumer's credit report for a specific period of time while the security freeze is in place.

(k) A security freeze shall remain in place until the consumer requests that the security freeze be removed. A consumer credit reporting agency shall remove a security freeze within three business days of receiving a request for removal from the consumer. The consumer shall provide all of the following:

(1) Proper identification.

(2) The unique personal identification number or password provided by the consumer credit reporting agency pursuant to subsection (c).

(3) The proper fee as may be required by the consumer credit reporting agency.

(l) A consumer credit reporting agency shall require proper identification of the person making a request to place, temporarily lift, or remove a security freeze.

(m) This section shall not apply to the use of a consumer report by any of the following persons or entities. The persons and entities exempt from this section include but are not limited to:

(1) A person, or the person's subsidiary, affiliate, agent, subcontractor, or assignee with whom the consumer has, or prior to assignment had, an account, contract, or debtor-creditor relationship for the purposes of reviewing the active account or collecting the financial obligation owing for the account, contract, or debt.

(2) A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under subsection (d) for purposes of facilitating the extension of credit or other permissible use.

(3) Any person acting pursuant to a court order, warrant, or subpoena.

(4) A state or local agency, or its agents or assigns, which administers a program for establishing and enforcing child support obligations.

(5) A state or local agency, or its agents or assigns, acting to investigate fraud, including Medicaid fraud; acting to investigate or collect delinquent taxes or assessments, including interest, penalties, and unpaid court orders; or acting to fulfill any of its other statutory responsibilities.

(6) A federal, state, or local governmental entity, including a law enforcement agency, court, or its agents or assigns.

(7) Any person for the use of a credit report for purposes permitted under 15 U.S.C. §1681b(c).

(8) Any person for the sole purpose of providing a credit file monitoring subscription service to which the consumer has subscribed.

(9) Any person for the purpose of providing a consumer with a copy of the consumer's credit report or credit score upon the consumer's request.

(10) Any depository financial institution for checking, savings, and investment accounts.

(11) Any person or entity for insurance purposes, including use in setting or adjusting a rate, adjusting a claim, or underwriting.

(n) If a security freeze is in place, a consumer credit reporting agency shall not change any of the following official information in a credit report without sending a written confirmation of the change to the consumer within 30 days of the change being posted to the consumer's file: Name, date of birth, Social Security number, and address. Written confirmation shall not be required for technical modifications of a consumer's official information, including name and street abbreviations, complete spellings, or transposition of numbers or letters. In the case of an address change, the written confirmation shall be sent to both the new address and the former address.

(o) The following persons shall not be required to place a security freeze in a consumer credit report pursuant to this section, provided, however, that any person not required to place a security freeze on a consumer credit report under the provisions of subdivision (3) shall be subject to any security freeze placed on a consumer credit report by another consumer credit reporting agency from which it obtains information:

(1) A check services or fraud prevention services company, including reports on incidents of fraud, or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payment.

(2) A deposit account information service company which issues reports regarding account closures due to fraud, substantial overdrafts, automated teller machine abuse, or other similar negative information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution.

(3) Resellers of consumer credit report information that assemble and merge information contained in a database of one or more consumer credit reporting agencies and do not maintain a permanent database of consumer credit information from which new consumer credit reports are produced.

(4) A consumer credit reporting agency's database or file which consists of information concerning, and used for, one or more of the following:

a. Criminal record information.

b. Fraud prevention or detection.

c. Personal claim loss history information.

d. Employment, tenant, or individual background screening.

(p) This section shall not prevent a consumer credit reporting agency from charging a fee of no more than ten dollars ($10) to a consumer for each security freeze placement, any permanent removal of the security freeze, or any temporary lifting of the security freeze for a period of time. A consumer credit reporting agency shall not charge a person age 65 years or over for the placement of a security freeze. A consumer credit reporting agency shall not charge any fee to a victim of identity theft who has submitted a copy of a valid investigative or incident report or complaint with a law enforcement agency about the unlawful use of the victim's identifying information by another person that was filed with the law enforcement agency no more than 90 days prior to the consumer's request for a security freeze. A consumer credit reporting agency may charge a fee of no more than five dollars ($5) to a consumer for each replacement of a unique personal identification number or password.

(q) A person that violates this section may be fined not more than one hundred dollars ($100) for a violation concerning a specific consumer.

(Act 2012-500, p. 1470, §2.)