(A) On written request sent by certified mail or electronic mail that includes proper identification provided by a consumer, the consumer's attorney-in-fact, or the consumer's legal guardian, if the consumer has not been a victim of identity theft or if the consumer has reason to believe that he is the victim of financial identity fraud, as evidenced by a copy of a valid police report, investigative report, or complaint made pursuant to Section 16-13-510, a consumer reporting agency shall place a security freeze on the consumer's consumer file not later than the fifth business day after the date the agency receives the request.
(B) On written request for a security freeze from a consumer pursuant to subsection (A), a consumer reporting agency shall disclose to the consumer the process of placing, removing, and temporarily lifting a security freeze and the process for allowing access to information from the consumer's consumer file for a specific requester or period while the security freeze is in effect.
(C) A consumer reporting agency, not later than the tenth business day after the date the agency receives the request for a security freeze shall:
(1) send a written confirmation of the security freeze to the consumer; and
(2) provide the consumer with a unique personal identification number or password to be used by the consumer to authorize a removal or temporary lifting of the security freeze.
(D) A consumer may request in writing a replacement personal identification number or password. The request must comply with the requirements for requesting a security freeze pursuant to subsection (A). The consumer reporting agency, not later than the third business day after the date the agency receives the request for a replacement personal identification number or password, shall provide the consumer with a new unique personal identification number or password to be used by the consumer instead of the number or password that was provided earlier.
(E) If a security freeze is in place, a consumer reporting agency shall notify the consumer in writing of a change in the consumer file to the consumer's name, date of birth, social security number, or address not later than thirty calendar days after the date the change is made. The agency shall send notification of a change of address to the new address and former address. This section does not require notice of an immaterial change, including a street abbreviation change or correction of a transposition of letters or misspelling of a word.
(F) A consumer reporting agency shall notify a person who requests a consumer report if a security freeze is in effect for the consumer file involved in that report and the consumer report may not be released without express authorization by the consumer.
(G)(1) On a request by a consumer electronically, in writing, or by telephone and with proper identification provided by a consumer, including the consumer's personal identification number or password provided pursuant to subsection (C)(2), a consumer reporting agency shall remove a security freeze not later than the third business day after the date the agency receives the request at a point designated by the agency to receive the request.
(2)(a) On a request by a consumer electronically or by telephone and with proper identification provided by a consumer, including the consumer's personal identification number or password provided pursuant to subsection (C)(2), a consumer reporting agency, within fifteen minutes of receiving the request, shall lift the security freeze temporarily for a:
(i) certain properly designated period; or
(ii) certain properly identified requester.
(b) It is not a violation of this item if the consumer reporting agency is prevented from timely lifting the freeze by an act of God, a fire, a storm, an earthquake, an accident, or other event beyond the agency's control.
(H) A consumer reporting agency may develop procedures involving the use of a telephone, a facsimile machine, the Internet, or another electronic medium to receive and process a request from a consumer pursuant to this section.
(I) A consumer reporting agency shall remove a security freeze placed on a consumer file if the security freeze was placed due to a material misrepresentation of fact by the consumer. The consumer reporting agency shall notify the consumer in writing before removing the security freeze pursuant to this subsection.
(J) A consumer reporting agency may not charge a fee for a freeze, removal of a freeze, temporary lifting of a freeze, or reinstatement of a freeze.
(K) A security freeze does not apply to the use of a consumer report provided to:
(1) a state or local governmental entity, including a law enforcement agency or court or private collection agency, if the entity, agency, or court is acting pursuant to a court order, warrant, subpoena, or administrative subpoena;
(2) a child support agency acting to investigate or collect child support payments or acting pursuant to Title IV-D of the Social Security Act (42 U.S.C. Section 651, et seq.);
(3) the Department of Social Services acting to investigate fraud;
(4) the Department of Revenue acting to administer state tax laws;
(5) a local official authorized to investigate or collect delinquent amounts owed to a public entity;
(6) a person for the purposes of prescreening as provided by the Fair Credit Reporting Act (15 U.S.C. Section 1681, et seq.), as amended;
(7) a person with whom the consumer has an account or contract or to whom the consumer has issued a negotiable instrument, or the person's subsidiary, affiliate, agent, assignee, prospective assignee, subcontractor, or private collection agency, for purposes related to that account, contract, or instrument;
(8) a subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted pursuant to subsection (G)(2);
(9) a person who administers a credit file monitoring subscription service to which the consumer has subscribed;
(10) a person for the purpose of providing a consumer with a copy of the consumer's report on the consumer's request;
(11) a depository financial institution for checking, savings, and investment accounts;
(12) an insurance company for the purpose of conducting its ordinary business; or
(13) a consumer reporting agency that:
(a) acts only to resell credit information by assembling and merging information contained in a database of another consumer reporting agency or multiple consumer reporting agencies; and
(b) does not maintain a permanent database of credit information from which new consumer reports are produced.
(L) The requirement of this section to place a security freeze on a consumer file does not apply to:
(1) a check service or fraud prevention service company that issues consumer reports:
(a) to prevent or investigate fraud; or
(b) for purposes of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payment;
(2) a deposit account information service company that issues consumer reports related to account closures caused by fraud, substantial overdrafts, automated teller machine abuses, or similar negative information regarding a consumer to an inquiring financial institution for use by the financial institution only in reviewing a consumer request for a deposit account with that institution; or
(3) a consumer reporting agency's database or file that consists of information concerning, and used for, one or more of the following, but not for credit granting purposes:
(a) criminal record information;
(b) fraud prevention or detection;
(c) personal loss history information; and
(d) employment, tenant, or individual background screening.
(M) A consumer reporting agency shall honor a security freeze placed on a consumer file by another consumer reporting agency.
(N) If a third party requests access to a consumer report on which a security freeze is in effect, this request is in connection with an application for credit or another use, and the consumer does not allow his credit report to be accessed, the third party may treat the application as incomplete. The presence of a security freeze on the file of a consumer must not be considered an adverse factor in the consumer's creditworthiness, credit standing, or credit capacity.
(O) The provisions of this section are cumulative, and an action taken pursuant to this section is not an election to take that action to the exclusion of other action authorized by law.
HISTORY: 2008 Act No. 190, Section 2, eff December 31, 2008.