(1) (a) A consumer may elect to place a security freeze on his or her consumer report by making a request in writing by certified mail to a consumer reporting agency.

(b) Except as provided in subsections (6)(b) and (11) of this section, if a security freeze is in place, information from a consumer report may not be released to a third party without prior, express authorization from the consumer.

(c) This section does not prevent a consumer reporting agency from advising a third party that a security freeze is in effect with respect to the consumer report.

(2) (a) A consumer reporting agency shall place a security freeze on a consumer report no later than five business days after receiving the request from the consumer.

(b) The consumer reporting agency shall send a written confirmation of the security freeze to the consumer within ten business days and, with the confirmation, shall provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of his or her consumer report to a specific party or for a specific period of time.

(3) If a consumer wishes to allow his or her consumer report to be accessed by a specific party or for a specific period of time while a freeze is in place, he or she shall contact the consumer reporting agency, request that the freeze be temporarily lifted, and provide the following:

(a) Proper identification;

(b) The unique personal identification number or password provided by the consumer reporting agency pursuant to subsection (2)(b) of this section; and

(c) The proper information regarding the third party who is to receive the consumer report or the time period that the report shall be available to users of the consumer report.

(4) A consumer reporting agency that receives a request from a consumer to temporarily lift a freeze on a consumer report pursuant to subsection (3) of this section, shall comply with the request no later than three business days after receiving the request.

(5) A consumer reporting agency may develop procedures involving the use of telephone, fax, internet, or other electronic media to receive and process a request from a consumer to place a freeze or to temporarily lift a freeze on a consumer report pursuant to subsection (3) of this section in an expedited manner.

(6) A consumer reporting agency shall remove or temporarily lift a freeze placed on a consumer report only in the following cases:

(a) Upon consumer request, pursuant to subsection (3) or (9) of this section; or

(b) If the consumer report was frozen due to a material misrepresentation of fact by the consumer or somebody purporting to be the consumer. If a consumer reporting agency intends to remove a freeze on a consumer report pursuant to this subsection (6)(b), the consumer reporting agency shall notify the consumer in writing prior to removing the freeze placed on the consumer report.

(7) If a third party requests access to a consumer report on which a security freeze is in effect, and the request is in connection with an application for credit or other use, and the consumer does not allow his or her consumer report to be accessed by that specific party or during that period of time, the third party may treat the application as incomplete.

(8) If a consumer requests a security freeze, the consumer reporting agency shall disclose the process of placing and temporarily lifting a freeze and the process for allowing access to information from the consumer report to a specific party or for a specific period of time while the freeze is in place.

(9) Except as otherwise provided pursuant to subsection (6)(b) of this section, a security freeze shall remain in place until the consumer requests that the security freeze be removed. A consumer reporting agency shall remove a security freeze within three business days of receiving a request for removal from the consumer, who provides both of the following:

(a) Proper identification; and

(b) The unique personal identification number or password provided by the consumer reporting agency pursuant to subsection (2)(b) of this section.

(10) A consumer reporting agency shall require proper identification of the person making a request to place a security freeze in a manner consistent with the requirements of this section.

(11) The provisions of this section shall not apply to the use of a consumer report by or for any of the following:

(a) A person or entity, or a subsidiary, affiliate, or agent of that person or entity that owns a financial obligation owing by the consumer to that person or entity, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, debt, or negotiable instrument, and lawful associated costs;

(b) An assignee or a prospective assignee of a financial obligation owing by the consumer to a person or entity in subsection (11)(a) of this section;

(c) A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under subsection (3) of this section for purposes of facilitating the extension of credit or other permissible use;

(d) A state or local agency, law enforcement agency, trial court, private collection agency, or person acting pursuant to a court order, warrant, or subpoena authorizing the use of the consumer report;

(e) A child support enforcement agency acting to enforce child support obligations;

(f) The department of health care policy and financing or its agents or assigns acting to investigate fraud;

(g) The department of human services or its agents or assignees acting to investigate fraud;

(h) The department of revenue or its agents or assigns acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities or exercise any of its statutory authority;

(i) The use of credit information for the purposes of prescreening as provided for by the federal "Fair Credit Reporting Act", 15 U.S.C. sec. 1681 et seq.;

(j) Any person or entity administering a credit file monitoring subscription service to which the consumer has subscribed;

(k) Any person or entity for the purpose of providing a consumer with a copy of his or her consumer report upon the consumer's request;

(l) Any person or entity for use in setting or adjusting a rate, adjusting a claim, or underwriting for insurance purposes;

(m) A pension plan acting to determine the consumer's eligibility for plan benefits orpayments authorized by law or to investigate fraud;

(n) A person conducting a pre-sentence investigation in a criminal matter or a probation officer using this information for supervision of an offender;

(o) A collections investigator or other person engaged in the collecting of fees, fines, or restitution assessed in a court proceeding;

(p) A licensed hospital with which the consumer has or had a contract, or a debtor-creditor relationship for the purposes of reviewing the account or collecting the financial obligation owing for the contract, account, or debt;

(q) A law enforcement agency or its agents acting to investigate a crime or conducting a criminal background check.

(12) (a) Fees for requesting a security freeze, temporarily lifting a security freeze, and permanently removing a security freeze from consumer reports may be charged only in accordance with this subsection (12).

(b) A consumer reporting agency may not charge a fee for a consumer's first request to place a security freeze on his or her consumer report.

(c) Except as provided for in subsections (12)(a) and (12)(b) of this section, a consumer reporting agency may charge a consumer a reasonable fee of no more than ten dollars for:

(I) A temporary lift for a period of time or permanent removal of a security freeze from the consumer report; or

(II) A subsequent request for a security freeze of the consumer report after the consumer's first request for a security freeze has been permanently removed from his or her consumer report.

(d) Except as provided for in subsections (12)(a) and (12)(b) of this section, a consumer reporting agency may charge a fee not to exceed twelve dollars for temporarily lifting a security freeze on the consumer report for a specific party.