59.1-444.2 - Security freezes.
§ 59.1-444.2. Security freezes.
A. A consumer may request that a security freeze be placed on his or hercredit report by sending a request in writing by certified mail, or suchother secure method authorized by a consumer reporting agency, to a consumerreporting agency at an address designated by the consumer reporting agency toreceive such requests. This subsection does not prevent a consumer reportingagency from advising a third party that a security freeze is in effect withrespect to the consumer's credit report.
B. A consumer reporting agency shall place a security freeze on a consumer'scredit report no later than three business days after receiving from theconsumer:
1. A written request described in subsection A;
2. Proper identification; and
3. Payment of a fee not to exceed $10, if applicable.
On and after July 1, 2009, a consumer reporting agency shall place a securityfreeze on a consumer's credit report no later than one business day afterreceiving such a request, if such request is made electronically at anaddress designated by the consumer reporting agency to receive such requests.
C. The consumer reporting agency shall send a written confirmation of theplacement of the security freeze to the consumer within 10 business days.Upon placing the security freeze on the consumer's credit report, theconsumer reporting agency shall provide the consumer with a unique personalidentification number or password, or similar device to be used by theconsumer when providing authorization for the release of his credit reportfor a specific period of time or for a specific party.
D. If the consumer wishes to allow his credit report to be accessed for aspecific period of time or for a specific party while a freeze is in place,he shall contact the consumer reporting agency using a point of contactdesignated by the consumer reporting agency, request that the freeze betemporarily lifted, and provide the following:
1. Proper identification;
2. The unique personal identification number or password provided by theconsumer reporting agency pursuant to subsection C; and
3. The proper information regarding the time period or the specific party forwhich the report shall be available to users of the credit report.
E. A consumer reporting agency:
1. Shall comply with a request made under subsection D:
a. Within three business days after receiving the request if the request ismade at a postal address designated by the agency to receive such requests; or
b. After September 1, 2008, 15 minutes after the consumer's request isreceived by the consumer reporting agency through the electronic contactmethod chosen by the consumer reporting agency in accordance with thissection; and
2. Is not required to temporarily lift a security freeze within the timeprovided in subdivision E 1 b if:
a. The consumer fails to meet the requirements of subsection D; or
b. The consumer reporting agency's ability to temporarily lift the securityfreeze within 15 minutes is prevented by:
(1) An act of God, including fire, earthquakes, hurricanes, storms, orsimilar natural disaster or phenomena;
(2) Unauthorized or illegal acts by a third party, including terrorism,sabotage, riot, vandalism, labor strikes or disputes disrupting operations,or similar occurrence;
(3) Operational interruption, including electrical failure, unanticipateddelay in equipment or replacement part delivery, computer hardware orsoftware failures inhibiting response time, or similar disruption;
(4) Governmental action, including emergency orders or regulations, judicialor law-enforcement action, or similar directives;
(5) Regularly scheduled maintenance, during other than normal business hours,of, or updates to, the consumer reporting agency's systems; or
(6) Commercially reasonable maintenance of, or repair to, the consumerreporting agency's systems that is unexpected or unscheduled.
F. A consumer reporting agency may develop procedures involving the use oftelephone, fax, the Internet, or other electronic media to receive andprocess a request from a consumer to temporarily lift a freeze on a creditreport pursuant to subsection D in an expedited manner.
G. A consumer reporting agency shall remove or temporarily lift a freezeplaced on a consumer's credit report only in the following cases:
1. Upon a consumer request, pursuant to subsection D or subsection J; or
2. If the consumer's credit report was frozen due to a materialmisrepresentation of fact by the consumer. If a consumer reporting agencyintends to remove a freeze upon a consumer's credit report pursuant to thissubdivision, the consumer reporting agency shall notify the consumer inwriting prior to removing the freeze on the consumer's credit report.
H. If a third party requests access to a consumer credit report on which asecurity freeze is in effect, and this request is in connection with anapplication for credit or any other use, and the consumer does not allow hisor her credit report to be accessed for that period of time, the third partymay treat the application as incomplete.
I. If a consumer requests a security freeze, the consumer reporting agencyshall disclose the process of placing and temporarily lifting a freeze, andthe process for allowing access to information from the consumer's creditreport for a period of time while the freeze is in place.
J. A security freeze shall remain in place until the consumer requests, usinga point of contact designated by the consumer reporting agency, that thesecurity freeze be removed. A consumer reporting agency shall remove asecurity freeze within three business days of receiving a request for removalfrom the consumer, who provides:
1. Proper identification; and
2. The unique personal identification number or password or similar deviceprovided by the consumer reporting agency pursuant to subsection C.
K. A consumer reporting agency shall require proper identification of theperson making a request to place or remove a security freeze.
L. The provisions of this section do not apply to the use of a consumercredit report by any of the following:
1. A person or entity, or a subsidiary, affiliate, or agent of that person orentity, or an assignee of a financial obligation owing by the consumer tothat person or entity, or a prospective assignee of a financial obligationowing by the consumer to that person or entity in conjunction with theproposed purchase of the financial obligation, with which the consumer has orhad prior to assignment an account or contract, including a demand depositaccount, or to whom the consumer issued a negotiable instrument, for thepurposes of reviewing the account or collecting the financial obligationowing for the account, contract, or negotiable instrument. For purposes ofthis paragraph, "reviewing the account" includes activities related toaccount maintenance, monitoring, credit line increases, and account upgradesand enhancements;
2. A subsidiary, affiliate, agent, assignee, or prospective assignee of aperson to whom access has been granted for purposes of facilitating theextension of credit or other permissible use;
3. Any state or local agency, law-enforcement agency, trial court, or privatecollection agency acting pursuant to a court order, warrant, or subpoena;
4. A child support agency acting pursuant to Title IV-D of the SocialSecurity Act (42 U.S.C. § 654 et seq.);
5. The Commonwealth or its agents or assigns acting to investigate fraud oracting to investigate or collect delinquent taxes or unpaid court orders orto fulfill any of its other statutory responsibilities provided suchresponsibilities are consistent with a permissible purpose under 15 U.S.C. §1681b;
6. The use of credit information for the purposes of prescreening orpostscreening as provided for by the federal Fair Credit Reporting Act;
7. Any person or entity administering a credit file monitoring subscriptionor similar service to which the consumer has subscribed;
8. Any person or entity for the purpose of providing a consumer with a copyof his credit report or score upon the consumer's request;
9. Any person or entity for use in setting or adjusting a rate, adjusting aclaim, or underwriting for insurance purposes; or
10. Any employer in connection with any application for employment with theemployer.
M. This chapter does not prevent a consumer reporting agency from charging afee of no more than $10 to a consumer to place each freeze, except that aconsumer reporting agency may not charge a fee to a victim of identity theftwho has submitted a valid police report to the consumer reporting agency.
N. If a security freeze is in place, a consumer reporting agency shall notchange any of the following official information in a consumer credit reportwithout sending a written confirmation of the change to the consumer within30 days of the change being posted to the consumer's file: name, date ofbirth, social security number, and address. Written confirmation is notrequired for technical modifications of a consumer's official information,including name and street abbreviations, complete spellings, or transpositionof numbers or letters. In the case of an address change, the writtenconfirmation shall be sent to both the new address and to the former address.
O. The following entities are not required to place a security freeze on acredit report:
1. A consumer reporting agency that acts only as a reseller of creditinformation by assembling and merging information contained in the databaseof another consumer reporting agency or multiple consumer credit reportingagencies, and does not maintain a permanent database of credit informationfrom which new consumer credit reports are produced. However, a consumerreporting agency acting as a reseller shall honor any security freeze placedon a consumer credit report by another consumer reporting agency;
2. A check services or fraud prevention services company, which issuesreports on incidents of fraud or authorizations for the purpose of approvingor processing negotiable instruments, electronic funds transfers, or similarmethods of payments;
3. A deposit account information service company, which issues reportsregarding account closures due to fraud, substantial overdrafts, ATM abuse,or similar negative information regarding a consumer, to inquiring banks orother financial institutions for use only in reviewing a consumer request fora deposit account at the inquiring bank or financial institution; and
4. A consumer reporting agency's database or file that consists ofinformation concerning, and used for, one or more of the following: criminalrecord information, fraud prevention or detection, personal loss historyinformation, and employment, tenant, or background screening.
P. At any time a consumer is required to receive a summary of rights requiredunder 15 U.S.C. § 1681g(d), the following notice shall be included:
"Virginia Consumers Have the Right to Obtain a Security Freeze.
You have a right to place a "security freeze" on your credit report, whichwill prohibit a consumer reporting agency from releasing information in yourcredit report without your express authorization. A security freeze must berequested in writing by certified mail. The security freeze is designed toprevent credit, loans, and services from being approved in your name withoutyour consent. However, you should be aware that using a security freeze totake control over who gets access to the personal and financial informationin your credit report may delay, interfere with, or prohibit the timelyapproval of any subsequent request or application you make regarding a newloan, credit, mortgage, government services or payments, rental housing,employment, investment, license, cellular phone, utilities, digitalsignature, Internet credit card transaction, or other services, including anextension of credit at point of sale. When you place a security freeze onyour credit report, you will be provided a personal identification number orpassword to use if you choose to remove the freeze on your credit report orauthorize the release of your credit report for a period of time or for aspecific party after the freeze is in place. To provide that authorizationyou must contact the consumer reporting agency and provide all of thefollowing:
1. The personal identification number or password;
2. Proper identification to verify your identity; and
3. The proper information regarding the period of time or the specific partyfor which the report shall be available.
A consumer reporting agency must authorize the release of your credit reportno later than three business days after receiving the above information.After September 1, 2008, a consumer credit reporting agency must authorizethe release of your credit report no later than 15 minutes after receivingthe request.
A security freeze does not apply to a person or entity, or its affiliates, orcollection agencies acting on behalf of the person or entity, with which youhave an existing account, that requests information in your credit report forthe purposes of reviewing or collecting the account. Reviewing the accountincludes activities related to account maintenance, monitoring, credit lineincreases, and account upgrades and enhancements.
You have a right to bring civil action against anyone, including a consumerreporting agency, who improperly obtains access to a file, knowingly orwillfully misuses file data, or fails to correct inaccurate file data.
Unless you are a victim of identity theft with a police report to verify thecrimes, a consumer reporting agency has the right to charge you up to $10 toplace a freeze on your credit report."
Q. Any person who willfully fails to comply with any requirement imposedunder this chapter with respect to any consumer is liable to that consumer inan amount equal to the sum of:
1. Any actual damages sustained by the consumer as a result of the failure ordamages of not less than $100 and not more than $1,000;
2. Such amount of punitive damages as the court may allow; and
3. In the case of any successful action to enforce any liability under thissection, the costs of the action together with reasonable attorney fees asdetermined by the court.
R. Any person who obtains a consumer report, requests a security freeze,requests the temporary lift of a freeze, or the removal of a security freezefrom a consumer reporting agency under false pretenses or in an attempt toviolate federal or state law shall be liable to the consumer reporting agencyfor actual damages sustained by the consumer reporting agency or $1,000,whichever is greater.
S. Any person who is negligent in failing to comply with any requirementimposed under this chapter with respect to any consumer is liable to thatconsumer in an amount equal to the sum of:
1. Any actual damages sustained by the consumer as a result of the failure;and
2. In the case of any successful action to enforce any liability under thissection, the costs of the action together with reasonable attorney fees asdetermined by the court.
T. Upon a finding by the court that an unsuccessful pleading, motion, orother paper filed in connection with an action under this chapter was filedin bad faith or for purposes of harassment, the court shall award to theprevailing party attorney fees reasonable in relation to the work expended inresponding to the pleading, motion, or other paper.
U. Notwithstanding any other provision of law:
1. The exclusive authority to bring an action for any violation ofsubdivision E 1 b shall be with the Attorney General. In any action broughtunder this subsection, the Attorney General may cause an action to be broughtin the name of the Commonwealth to enjoin the violation and to recoverdamages for aggrieved consumers consistent with the limits stated insubsections Q and S for such violations.
2. In any action brought under this subsection, if the court finds a willfulviolation, the court may, in its discretion, also award a civil penalty ofnot more than $1,000 per violation, to be deposited in the Literary Fund ofthe Commonwealth.
3. In any action brought under this subsection, the Attorney General mayrecover any costs, the reasonable expenses incurred in investigating andpreparing the case, and attorneys' fees.
(2008, cc. 480, 496; 2009, c. 406.)