Section 359-B:24 Security Freeze by Consumer Reporting Agency; Time in Effect.
I. A consumer may place a security freeze on his or her consumer report as follows:
(a) A consumer who has been the victim of identity theft may place a security freeze on his or her consumer report by making a request in writing, by certified mail to a consumer reporting agency with a valid copy of the police report, investigative report, or complaint the consumer has filed with a law enforcement agency about unlawful use of personal information by another person. In the case of a victim of identity theft, a consumer reporting agency shall not charge a fee for placing, removing, or temporarily lifting for a specific party or period of time a security freeze on a consumer report.
(b) A consumer who has not been the victim of identity theft may place a security freeze on his or her consumer report by making a request in writing, by certified mail to a consumer reporting agency. A consumer reporting agency may charge a fee of no more than $10 to a consumer for each freeze, removal of a freeze, or temporary lift of a freeze for a period of time or specific party or for reissuing the same or a new personal identification number if the consumer fails to retain the original personal identification number provided by the agency.
II. Subject to the exceptions in paragraph XIII, when a security freeze has been placed on a consumer report, the consumer reporting agency shall not release the consumer report or any information from it without the express authorization of the consumer. This subparagraph shall not prevent a consumer reporting agency from advising a third party that a security freeze is in effect with respect to the consumer report.
III. A consumer reporting agency shall place a security freeze on a consumer report no later than 5 business days after receiving a written request from the consumer.
IV. The consumer reporting agency shall send a written confirmation of the security freeze to the consumer within 10 business days after placing the security freeze and shall provide the consumer with a personal identification number or password, other than the consumer's social security number, to be used by the consumer when providing authorization for the release of a consumer report to a specific party or for a period of time.
V. If the consumer wishes to allow access to the consumer report by a specific party or for a certain period of time while a freeze is in place, the consumer may contact the consumer reporting agency, request that the freeze be temporarily lifted, and provide each of the following:
(a) Proper identification.
(b) The personal identification number or password provided by the consumer reporting agency pursuant to paragraph IV.
(c) The proper information regarding the specific party granted access or the time period for which the report is to be available to users.
(d) Payment of the applicable fee, if any, pursuant to subparagraph I(b).
VI. A consumer reporting agency may develop procedures involving use of phone, fax, internet, or other electronic media to receive and process requests.
VII. A consumer reporting agency that receives a request from a consumer to temporarily lift a freeze on a consumer report pursuant to paragraph V shall comply with the request no later than 3 business days after receiving the request.
VIII. A consumer reporting agency shall remove or temporarily lift a freeze placed on a consumer report only:
(a) Upon consumer request, pursuant to paragraph V or XI; or
(b) If the consumer report was frozen due to a material misrepresentation of fact by the consumer. If a consumer reporting agency intends to remove a freeze upon a consumer report pursuant to this subparagraph, the consumer reporting agency shall notify the consumer in writing prior to removing the freeze on the consumer report.
IX. If a third party requests access to a consumer report on which a security freeze is in effect and this request is in connection with an application for credit or any other use and the consumer does not allow access to the consumer report for that specific party or period of time, the third party may treat the application as incomplete.
X. If a consumer requests a security freeze pursuant to this section, the consumer reporting agency shall disclose to the consumer the processes of placing and temporarily lifting a security freeze and the process for allowing access to information from the consumer report for a specific party or period of time while the security freeze is in place.
XI. A security freeze shall remain in place until the consumer requests that the security freeze be removed. A consumer reporting agency shall remove a security freeze within 3 business days of receiving a request for removal from a consumer who provides:
(a) Proper identification.
(b) The personal identification number or password provided by the consumer reporting agency pursuant to paragraph IV.
(c) Payment of the applicable fee, if any, pursuant to subparagraph I(b).
XII. A consumer reporting agency shall require proper identification of the person making a request to place or remove a security freeze.
XIII. This section, including the security freeze, shall not apply to the use of a consumer report by the following:
(a) A person or person's subsidiary, affiliate, agent, or assignee with which the consumer has or, prior to assignment, had an account, contract, or debtor-creditor relationship for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or debt or extending credit to a consumer with a prior or existing account, contract, or debtor-creditor relationship, subject to the requirements of RSA 359-B:4. For purposes of this subparagraph, ""reviewing the account'' includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.
(b) A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under paragraph V for the purpose of facilitating the extension of credit or another permissible use.
(c) A person acting pursuant to a court order, warrant, or subpoena.
(d) Child support enforcement officials when investigating a child support case pursuant to Title IV-D of the Social Security Act.
(e) The department of health and human services, the department of justice, or any of their agents or assignees, acting to investigate Medicaid fraud.
(f) The department of revenue administration, municipal taxing authorities, the secretary of state, the division of motor vehicles in the department of safety, or any of their agents or assignees, acting to investigate or collect delinquent taxes or assessments, including interest and penalties and unpaid court orders, or to fulfill any of their other statutory or charter responsibilities.
(g) A person's use of credit information for prescreening as provided by the federal Fair Credit Reporting Act.
(h) A person for the sole purpose of providing a credit file monitoring subscription service to which the consumer has subscribed.
(i) Any person or entity, including but not limited to a consumer reporting agency, for the purpose of providing a consumer with a copy of his or her consumer report or credit score upon the consumer's request.
(j) Any person or entity for use in setting or adjusting an insurance rate or claim or underwriting for insurance purposes.
Source. 2006, 208:1, eff. Jan. 1, 2007.