(1) For purposes of this section, a “security freeze” means a notice placed in a consumer report that prohibits a consumer reporting agency, as defined in 15 U.S.C. s. 1681a(f), from releasing the consumer report, credit score, or any information contained within the consumer report to a third party without the express authorization of the consumer. This section does not prevent a consumer reporting agency from advising a third party that a security freeze is in effect with respect to the consumer report. For purposes of this part, the term “consumer report” has the same meaning set forth in 15 U.S.C. s. 1681a(d).

(2) A consumer may place a security freeze on his or her consumer report by:

(a) Making a request in writing by certified mail to a consumer reporting agency.

(b) Including information that properly identifies the consumer.

(3) A consumer reporting agency shall place a security freeze on a consumer report no later than 5 business days after receiving a request from the consumer.

(4) The consumer reporting agency shall send a written confirmation of the security freeze to the consumer within 10 business days after instituting the security freeze and shall provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the removal of a security freeze on his or her consumer report pursuant to subsection (5) or subsection (11).

(5) A consumer may allow his or her consumer report to be accessed for a designated period of time while a security freeze is in effect by contacting the consumer reporting agency and requesting that the freeze be temporarily lifted. The consumer must provide the following information to the consumer reporting agency as part of the request:

(a) Proper identification as determined by the consumer reporting agency.

(b) The unique personal identification number or password provided by the consumer reporting agency pursuant to subsection (4).

(c) Information specifying the period of time for which the report shall be made available.

(6) A consumer reporting agency that receives a request from a consumer to temporarily lift a freeze on a consumer report pursuant to subsection (5) shall comply with the request no later than 3 business days after receiving the request.

(7) No later than July 1, 2007, a consumer reporting agency doing business in this state shall select and develop a secure electronic contact method, which may include the use of telephone, fax, the Internet, or other secure electronic means, by which to receive and process requests from consumers to temporarily lift a freeze on a consumer report pursuant to subsection (5).

(8) A consumer reporting agency shall temporarily lift or remove a security freeze placed on a consumer report only in the following instances:

(a) Upon consumer request, pursuant to subsection (5) or subsection (11).

(b) If the consumer report was frozen due to a material misrepresentation of fact by the consumer. If a consumer reporting agency intends to remove a security freeze on a consumer report pursuant to this paragraph, the consumer reporting agency shall notify the consumer in writing prior to removing the security freeze.

(9) A third party requesting access to a consumer report on which a security freeze is in effect in connection with an application for credit or other permissible use may treat the application as incomplete if the consumer has not authorized a temporary lifting of the security freeze for the period of time during which the request is made.

(10) If a consumer requests a security freeze, the consumer reporting agency shall disclose to the consumer all information relevant to the process of instituting, temporarily lifting, and removing a security freeze and shall include the disclosure required by subsection (17).

(11) A security freeze shall remain in place until the consumer requests that it be removed. A consumer reporting agency shall remove a security freeze within 3 business days after receiving a request for removal from the consumer, who, upon making the request for removal, must provide the following:

(a) Proper identification as determined by the consumer reporting agency.

(b) The unique personal identification number or password provided by the consumer reporting agency pursuant to subsection (4).

(12) The provisions of this section do not apply to the use of a consumer report by the following persons or for the following reasons:

(a) A person to whom the consumer owes a financial obligation or a subsidiary, affiliate, or agent of the person, or an assignee of a financial obligation owed by the consumer to the person, or a prospective assignee of a financial obligation owed by the consumer to the person in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment an account or contract, including a deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owed for the account, contract, or negotiable instrument. For purposes of this paragraph, “reviewing the account” includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.

(b) A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under this section for purposes of facilitating the extension of credit or other permissible use.

(c) A state agency acting within its lawful investigative or regulatory authority.

(d) A state or local law enforcement agency acting to investigate a crime or conducting a criminal background check.

(e) Any person administering a credit file monitoring subscription service to which the consumer has subscribed.

(f) Any person for the purpose of providing a consumer with a copy of the consumer report upon the consumer’s request.

(g) Pursuant to a court order lawfully entered.

(h) The use of credit information for the purposes of prescreening as provided for by the federal Fair Credit Reporting Act.

(i) Any insurance company for use in setting or adjusting a rate, adjusting a claim, or underwriting for insurance purposes.

(j) A consumer reporting agency’s database or file which consists entirely of information concerning, and is used solely for, one or more of the following:

1. Criminal record information.

2. Personal loss history information.

3. Fraud prevention or detection.

4. Tenant screening.

5. Employment screening.

(13)(a) A consumer reporting agency may not charge any fee to a consumer who elects to place, remove, or temporarily lift a security freeze on his or her consumer report.

(b) A consumer reporting agency may charge a reasonable fee, not to exceed $10, if the consumer fails to retain the original personal identification number or password provided by the consumer reporting agency and the agency must reissue the personal identification number or password or provide a new personal identification number or password to the consumer.

(14) If a security freeze is in effect, a consumer reporting agency shall not change any of the following official information in a consumer report without sending a written confirmation of the change to the consumer within 30 days after the change is posted to the consumer’s file:

(a) Name.

(b) Address.

(c) Date of birth.

(d) Social security number.

Written confirmation is not required for technical corrections of a consumer’s official information, including name and street abbreviations, complete spellings, or transposition of numbers or letters. In the case of an address change, the written confirmation shall be sent to both the new address and the former address.

(15) The provisions of this section do not apply to the following entities:

(a) A check services company, which issues authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payment.

(b) A deposit account information service company that issues reports regarding account closures due to fraud, substantial overdrafts, automatic teller machine abuse, or similar negative information regarding a consumer to an inquiring financial institution as defined in s. 655.005 for use only in reviewing a consumer request for a deposit account at the inquiring financial institution, as defined in s. 655.005 or in federal law.

(c) A consumer reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or multiple consumer reporting agencies and does not maintain a permanent database of credit information from which new consumer reports are produced. However, a consumer reporting agency shall honor any security freeze placed, removed, or temporary lifted on a consumer report by another consumer reporting agency.

(d) A fraud prevention services company issuing reports to prevent or investigate fraud.

(16) In addition to any other penalties or remedies provided under law, a person who is aggrieved by a violation of the provisions of this section may bring a civil action as authorized by this subsection.

(a) Any person who willfully fails to comply with any requirement imposed under this section with respect to any consumer is liable to that consumer for actual damages sustained by the consumer as a result of the failure of not less than $100 and not more than $1,000, plus the cost of the action together with reasonable attorney’s fees.

(b) Any individual who obtains a consumer report under false pretenses or knowingly without a permissible purpose is liable to the consumer for actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000, whichever is greater. Any person who obtains a consumer report from a consumer reporting agency under false pretenses or knowingly without a permissible purpose is liable to the consumer reporting agency for actual damages sustained by the consumer reporting agency or $1,000, whichever is greater.

(c) Punitive damages may be assessed for willful violations of this section.

(d) Any person who is negligent in failing to comply with any requirement imposed under this section with respect to any consumer is liable to that consumer for any actual damages sustained by the consumer as a result of the failure of not less than $100 and not more than $1,000.

(e) Upon a finding by the court that an unsuccessful pleading, motion, or other paper filed in connection with an action under this subsection was filed in bad faith or for purposes of harassment, the court shall award to the prevailing party attorney’s fees that are reasonable in relation to the work performed in responding to the pleading, motion, or other paper.

(17) Any written disclosure by a consumer reporting agency, pursuant to 15 U.S.C. s. 1681g, to any consumer residing in this state shall include a written summary of all rights the consumer has under this section, and, in the case of a consumer reporting agency which compiles and maintains consumer reports on a nationwide basis, a toll-free telephone number which the consumer can use to communicate with the consumer reporting agency. The information set forth in paragraph (b) of the written summary of rights must be in at least 12-point boldface type. The written summary of rights required under this section is sufficient if it is substantially in the following form:

(a) You have a right to place a “security freeze” on your consumer report, which will prohibit a consumer reporting agency from releasing any information in your consumer report without your express authorization. A security freeze must be requested in writing by certified mail to a consumer reporting agency. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent.

(b) YOU SHOULD BE AWARE THAT USING A SECURITY FREEZE TO CONTROL ACCESS TO THE PERSONAL AND FINANCIAL INFORMATION IN YOUR CONSUMER REPORT MAY DELAY, INTERFERE WITH, OR PROHIBIT THE TIMELY APPROVAL OF ANY SUBSEQUENT REQUEST OR APPLICATION YOU MAKE REGARDING A NEW LOAN, CREDIT, MORTGAGE, INSURANCE, GOVERNMENT SERVICES OR PAYMENTS, RENTAL HOUSING, EMPLOYMENT, INVESTMENT, LICENSE, CELLULAR PHONE, UTILITIES, DIGITAL SIGNATURE, INTERNET CREDIT CARD TRANSACTION, OR OTHER SERVICES, INCLUDING AN EXTENSION OF CREDIT AT POINT OF SALE.

(c) When you place a security freeze on your consumer report, you will be provided a personal identification number or password to use if you choose to remove the freeze on your consumer report or authorize the release of your consumer report for a designated period of time after the security freeze is in place. To provide that authorization, you must contact the consumer reporting agency and provide all of the following:

1. The personal identification number or password.

2. Proper identification to verify your identity.

3. Information specifying the period of time for which the report shall be made available.

(d) A consumer reporting agency must authorize the release of your consumer report no later than 3 business days after receiving the above information.

(e) A security freeze does not apply to a person or entity, or its affiliates, or collection agencies acting on behalf of the person or entity, with which you have an existing account, that requests information in your consumer report for the purposes of reviewing or collecting the account. Reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.

(f) You have the right to bring a civil action against anyone, including a consumer reporting agency, who fails to comply with the provisions of s. 501.005, Florida Statutes, which governs the placing of a consumer report security freeze on your consumer report.

History.—s. 1, ch. 2006-124; s. 38, ch. 2011-194; s. 1, ch. 2018-62.