50-723. Security freeze on consumer report; requirements; procedure; damages.
50-723
50-723. Security freeze on consumer report;requirements; procedure; damages.(a) A consumer may electto place a security freeze on the consumer's consumer report by writtenrequest, sent by certified mailor regular mail, through a secure website if made available by a consumerreporting agency, or by telephone, if the consumer reporting agency does nothave an available secure website. Aconsumer reporting agency shall place a security freeze on a consumer'sconsumer report no later than five business days after receiving:
(1) A request provided by this subsection; and
(2) proper identification.
(b) When a security freeze is in place, information from a consumer reportshall not be released to a third party without prior express authorization fromthe consumer. This subsection shall not prevent a consumer reporting agencyfrom advising a third party that a security freeze is in effect with respect toa consumer report.
(c) The consumer reporting agency, no later than 10 business days after thedate the agency places a security freeze, shall provide theconsumer with a unique personal identification number, password or similardevice to be used bythe consumer when providing authorization for the access to the consumer'sconsumer report for a specific period of time. In addition, the consumerreporting agency shall simultaneously provide to the consumer in writing theprocess of placing, removing and temporarily lifting a security freeze and theprocess for allowing access to information from the consumer's consumer reportfor a specific period while the security freeze is in effect.
(d) If, in connection with an application for credit or any other use, athird party requestsaccess to a consumer report on which a security freeze is in effect, the thirdparty may treat theapplication as incomplete if the consumer does not allow the consumer'sconsumer report to beaccessed for that specific period of time.
(e) If the consumer wishes to allow the consumer's consumer report or scoreto beaccessed for a specific period of time while a freeze is in place, the consumershall contact theconsumer reporting agency, request that the freeze be temporarily lifted andprovide thefollowing:
(1) Clear and proper identification;
(2) the unique personal identification number or password provided by theconsumerreporting agency in accordance with subsection (c); and
(3) the proper information regarding the time period for which the reportshall beavailable to users of the consumer report.
(f) (1) A consumer reporting agency that receives a request from aconsumer totemporarilylift a freeze on a consumer report pursuant to subsection (e) shall comply withthe request:
(A) No later than three business days after receiving the request if therequest is made at a postaladdress designated by the agency to receive such requests; or
(B) fifteen minutes after the request is received by the consumerreporting agencythrough the electronic contact method chosen by the consumer reporting agencyin accordancewith this section and such request is received between 6:00 a.m. and 9:30 p.m.in the central timezone.
(2) A consumer reporting agency is not required to temporarily lift asecurity freeze within thetime provided in subsection (f)(1)(B) if the consumer fails to meet therequirements of subsection (e) or the consumer reporting agency's ability totemporarily lift thesecurity freeze within 15minutes is prevented by:
(A) An act of God, including, but not limited to, fire, earthquake,hurricane, storm or similarnatural disaster orphenomena;
(B) unauthorized or illegal acts by a third party,including, but not limited to, terrorism, sabotage, riot, vandalism,labor strikes or disputes disrupting operations or similar occurrence;
(C) operational interruption, including, but not limited to, electricalfailure, unanticipateddelay in equipment orreplacement part delivery, computer hardware or software failures inhibitingresponse time orsimilar disruption;
(D) governmental action, including, but not limited to, emergency orders orregulations, judicialor law enforcementaction or similar directives;
(E) regularly scheduled maintenance, other than during normal business hours,of or updates tothe consumer reporting agency's systems; or
(F) commercially reasonable maintenance of or repair to the consumerreporting agency'ssystems that is unexpected or unscheduled.
(g) A consumer reporting agency shall remove or temporarily lift a freezeplaced on aconsumer's consumer report only in the following cases:
(1) Upon consumer request as provided in this section; or
(2) if the consumer's consumer report was frozen due to a materialmisrepresentation offact by the consumer, in which case, if a consumer reporting agency intends toremove a freezeupon the consumer's consumer report, the consumer reporting agency shall notifythe consumerin writing prior to removing the freeze on the consumer's consumer report.
(h) A security freeze shall remain in place until the consumer requests thatthe security freeze be removed. A consumer reporting agency shall remove asecurity freeze within threebusiness days after receiving a request for removal from the consumer, whoshall be required toprovide:
(1) Clear and proper identification; and
(2) the unique personal identification number or password provided by theconsumerreporting agency in accordance with subsection (c).
(i) A security freeze does not apply to a consumer report provided to:
(1) A federal, state or local governmental entity, including a lawenforcement agency orcourt, or agents or assigns thereof;
(2) a private collection agency for the sole purpose of assisting in thecollection of anexisting debt of the consumer who is the subject of the consumer reportrequested;
(3) a person or entity, or a subsidiary, affiliate or agent of such person orentity, or anassignee of a financial obligation owing by the consumer to such person orentity, or aprospective assignee of a financial obligation owing by the consumer to suchperson or entity inconjunction with the proposed purchase of the financial obligation, with whichthe consumer hasor had prior to assignment of an account or contract, including a demanddepositaccount, or towhom the consumer issued a negotiable instrument, for the purposes of reviewingthe account orcollecting the financial obligation owing for the account, contract, ornegotiable instrument. Forpurposes of this paragraph, "reviewing the account" includes activities relatedto accountmaintenance, monitoring, credit line increases and account upgrades andenhancements;
(4) a subsidiary, affiliate, agent, assignee or prospective assignee of aperson to whomaccess has been granted under subsection (e) for the purposes of facilitatingthe extension ofcredit;
(5) a person providing a credit report for the purposes permitted under 15U.S.C. § 1681b(c);
(6) any person providing a consumer with a copy of the consumer's own reportat such consumer's request;
(7) a child support enforcement agency;
(8) a consumer reporting agency that acts only as a reseller of creditinformation byassembling and merging information contained in the database of anotherconsumer reporting agency or multiple consumer reporting agencies and does notmaintain a permanent database ofcredit information from which new consumer reports are produced; however, aconsumerreporting agency acting as a reseller shall honor any security freeze placed ona consumer reportby another consumer reporting agency;
(9) a check services or fraud prevention services company, which issuesreports onincidents of fraud or authorizations for the purpose of approving or processingnegotiableinstruments, electronic funds transfers or similar methods of payments;
(10) a deposit account information service company which issues to inquiringbanks orother financial institutions, for use only in reviewing a consumer request fora deposit account atthe inquiring bank or financial institution, reports regarding account closuresdue to fraud,substantial overdrafts, ATM abuse or similar negative information regarding aconsumer;
(11) an employer in connection with any application for employment with theemployer;
(12) any person administering a credit file monitoring subscription serviceto which the consumer has subscribed; or
(13) any person or entity for use in setting or adjusting a rate, adjustinga claim or underwriting for insurance purposes.
(j) Except as otherwise provided in this section, a consumer reportingagency may charge a fee not to exceed $5 for placing, temporarily lifting orremovingeach freeze. The consumer reporting agency shall not charge a feefor replacing a previously requested personal identificationnumber. Such agency shall not charge a fee to a victim ofidentity theft for placing,temporarily lifting or removing a securityfreeze on a consumer report, provided that at the time of requestinga freeze the victim provides to theagency a valid copy ofa police report, investigative report or complaint the consumer has filed witha law enforcementagency.
(1) A person who has learned or reasonably suspects that the person has beena victim of identitytheft may contact the local law enforcement agency that has jurisdiction overthe person's actualresidence, which shall take a police report of the matter, and provide thecomplainant with a copyof that report. Notwithstanding the fact the jurisdiction may be elsewhere forinvestigation andprosecution of a crime of identity theft, any local or state law enforcementagency shall take thecomplaint and provide the complainant with a copy of the complaint and mayrefer thecomplainant to a law enforcement agency in a different jurisdiction.
(2) Nothing in this section shall be construed to interfere with thediscretion of a law enforcement agencyto allocate resources for investigation of crimes. A complaintfiled under this sectionis not required to be counted as an open case for statistical reportingpurposes.
(k) If a security freeze is in place, a consumer reporting agency shall notchange any of thefollowing official information in the consumer report without sending a writtenconfirmation ofthe change to the consumer within 30 days after the change is posted to theconsumer's file:Name, date of birth, social security number and address. Written confirmationis not required fortechnical modifications of a consumer's official information, including nameand streetabbreviations, complete spellings or transposition of numbers or letters. Inthe case of an addresschange, the written confirmation shall be sent to both the new address and tothe former address.
(l) Any person who willfully fails to comply with any requirement imposedunder this subchapter with respect to any consumer is liable to that consumerin an amount equal to the sum of:
(1) Actual damages sustained by the consumer as a result of the failure ordamages of not less than $100 and not more than $1,000; or
(2) such amount of punitive damages as the court may allow; and
(3) in the case of any successful action to enforce any liability under thissection, the costs of the action together with reasonable attorney's fees asdetermined by the court.
(m) Any person who obtains a consumer report, requests a security freeze,requests the temporary lift of a freeze, or the removal of a security freezefrom a consumer reporting agency under false pretenses or in an attempt toviolate federal or state law shall be liable to the consumer reporting agencyfor actual damages sustained by the consumer reporting agency or $1,000,whichever is greater.
(n) Any person who is negligent in failing to comply with any requirementimposed under this section with respect to any consumer, is liable to thatconsumer in an amount equal to the sum of:
(1) Any actual damages sustained by the consumer as a result of the failure;and
(2) in the case of any successful action to enforce any liability under thissection, the costs of the action together with reasonable attorney's fees asdetermined by the court.
(o) Upon a finding by the court that an unsuccessful pleading, motion orother paper filed in connection with an action under this section was filed inbad faith or for purposes of harassment, the court shall award to theprevailing party attorney's fees reasonable in relation to the work expended inresponding to the pleading, motion or other paper.
(p) This section shall be part of and supplemental to the fair creditreporting act.
(q) This section shall take effect and be in force on and after January 1,2007.
(r) Notwithstanding any other provision of law to the contrary, theexclusiveauthority to bring an action for any violation of subsection (f)(1)(B) shall bewith the attorney general.
History: L. 2006, ch. 149, § 12;L. 2009, ch. 112, § 2; July 1.