(a) A consumer may place a security freeze on the consumer's credit report by making a request in writing by certified mail to a consumer credit reporting agency. No later than August 1, 2008, a consumer credit reporting agency shall make available to consumers an Internet based method of requesting a security freeze and a toll-free telephone number for consumers to use to place a security freeze, temporarily lift a security freeze, or completely remove a security freeze. A security freeze shall prohibit, subject to exceptions in subsection (m) of this Code section, the consumer credit reporting agency from releasing the consumer's credit report or credit score without the prior express authorization of the consumer as provided in subsection (d) or (e) of this Code section. Nothing in this subsection prevents a consumer credit reporting agency from advising a third party that a security freeze is in effect with respect to the consumer's credit report.

(b) A consumer credit reporting agency shall place a security freeze on a consumer's credit report no later than three business days after receiving the consumer's written request sent by certified mail.

(c) The consumer credit reporting agency shall send a written confirmation of the security freeze to the consumer within ten business days of placing the security freeze and at the same time shall provide the consumer with a unique personal identification number or password, other than the consumer's social security number, to be used by the consumer when providing authorization for the release of the consumer's credit report for a specific period of time.

(d) If the consumer wishes to allow the consumer's credit report to be accessed for a specific period of time while a security freeze is in place, the consumer shall contact the consumer credit reporting agency through the contact method established by the consumer credit reporting agency, request that the security freeze be temporarily lifted, and provide all of the following:

(1) Proper identification;

(2) The unique personal identification number or password provided by the consumer credit reporting agency pursuant to subsection (c) of this Code section;

(3) The proper information regarding the time period for which the report shall be available to users of the consumer credit report; and

(4) The proper payment as may be required by the consumer credit reporting agency.

(e) A consumer credit reporting agency shall develop procedures involving the use of telephone, facsimile, the Internet, or other electronic media to receive and process a request from a consumer to temporarily lift a security freeze on a consumer credit report pursuant to subsection (d) of this Code section.

(f) A consumer credit reporting agency that receives a request from a consumer to temporarily lift a security freeze on a consumer credit report pursuant to subsection (d) or (e) of this Code section shall comply with the request:

(1) No later than three business days after receiving a written request; or

(2) Within 15 minutes after the request and payment are received by telephone or electronically by the contact method chosen by the consumer credit reporting agency during normal business hours and the request includes the consumer's proper identification, correct personal identification number or password, and the proper payment as may be required by the consumer credit reporting agency.

(g) A consumer credit reporting agency need not remove a security freeze within 15 minutes, as specified in paragraph (2) of subsection (f) of this Code section, if:

(1) The consumer fails to satisfy the requirements of subsection (d) of this Code section; or

(2) The consumer credit reporting agency's ability to remove the security freeze within 15 minutes is prevented by:

(A) An act of God, including fire, earthquakes, hurricanes, storms, or similar natural disaster or phenomenon;

(B) Unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrence;

(C) Operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruption;

(D) Governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar directives;

(E) Regularly scheduled maintenance or updates, during other than normal business hours, to the consumer credit reporting agency's systems;

(F) Commercially reasonable maintenance of, or repair to, the consumer credit reporting agency's systems that is unexpected or unscheduled; or

(G) Receipt of a removal request outside of normal business hours.

(h) A consumer credit reporting agency shall only remove or temporarily lift a security freeze placed on a consumer's credit report:

(1) Upon the consumer's request, in compliance with the requirements of this Code section; or

(2) If the consumer's credit report was frozen due to a material misrepresentation of fact by the consumer. If a consumer credit reporting agency intends to remove a security freeze upon a consumer's credit report pursuant to this paragraph, the consumer credit reporting agency shall notify the consumer in writing prior to removing the security freeze on the consumer's credit report.

(i) If a third party requests access to a consumer credit report on which a security freeze is in effect and this request is in connection with an application for credit or any other use related to the extension of credit and the consumer does not allow the consumer's credit report to be accessed for that specific period of time, the third party may treat the application as incomplete.

(j) If a consumer requests a security freeze pursuant to this Code section, the consumer credit reporting agency shall disclose to the consumer the process of placing and temporarily lifting a security freeze and the process for allowing access to information from the consumer's credit report for a specific period of time while the security freeze is in place.

(k) A security freeze shall remain in place until the consumer requests that the security freeze be removed. A consumer credit reporting agency shall remove a security freeze within three business days of receiving a request for removal from the consumer. The consumer shall provide all of the following:

(1) Proper identification; and

(2) The unique personal identification number or password provided by the consumer credit reporting agency pursuant to subsection (c) of this Code section.

(l) A consumer credit reporting agency shall require proper identification of the person making a request to place, temporarily lift, or remove a security freeze.

(m) By way of example only, and not intending to be exclusive, the provisions of this Code section shall not apply to the use of a consumer credit report by any of the following:

(1) A person, or the person's subsidiary, affiliate, agent, subcontractor, or assignee with whom the consumer has, or prior to assignment had, an account, contract, or debtor-creditor relationship for the purposes of reviewing the active account or collecting the financial obligation owing for the account, contract, or debt;

(2) A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under subsection (d) of this Code section for purposes of facilitating the extension of credit or other permissible use;

(3) Any person acting pursuant to a court order, warrant, or subpoena;

(4) A state or local agency, or its agents or assigns, which administers a program for establishing and enforcing child support obligations;

(5) A state or local agency, or its agents or assigns, acting to investigate fraud, including Medicaid fraud; acting to investigate or collect delinquent taxes or assessments, including interest, penalties, and unpaid court orders; or acting to fulfill any of its other statutory responsibilities;

(6) A federal, state, or local governmental entity, including a law enforcement agency, court, or its agents or assigns;

(7) Any person for the use of a credit report for purposes permitted under 15 U.S.C. Section 1681b(c);

(8) Any person for the sole purpose of providing a credit file monitoring subscription service to which the consumer has subscribed;

(9) Any person for the purpose of providing a consumer with a copy of the consumer's credit report or credit score upon the consumer's request;

(10) Any depository financial institution for checking, savings, and investment accounts; or

(11) Any person or entity for insurance purposes, including use in setting or adjusting a rate, adjusting a claim, or underwriting.

(n) If a security freeze is in place, a consumer credit reporting agency shall not change any of the following official information in a credit report without sending a written confirmation of the change to the consumer within 30 days of the change being posted to the consumer's file: name, date of birth, social security number, and address. Written confirmation is not required for technical modifications of a consumer's official information, including name and street abbreviations, complete spellings, or transposition of numbers or letters. In the case of an address change, the written confirmation shall be sent to both the new address and the former address.

(o) The following persons shall not be required to place a security freeze in a consumer credit report pursuant to this Code section; provided, however, that any person that shall not be required to place a security freeze on a consumer credit report under the provisions of paragraph (3) of this subsection shall be subject to any security freeze placed on a consumer credit report by another consumer credit reporting agency from which it obtains information:

(1) A check services or fraud prevention services company, including reports on incidents of fraud, or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payment;

(2) A deposit account information service company, which issues reports regarding account closures due to fraud, substantial overdrafts, automated teller machine abuse, or other similar negative information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution;

(3) Resellers of consumer credit report information that assemble and merge information contained in a data base of one or more consumer credit reporting agencies and do not maintain a permanent data base of consumer credit information from which new consumer credit reports are produced; or

(4) A consumer credit reporting agency's data base or file which consists of information concerning, and used for, one or more of the following: criminal record information, fraud prevention or detection, personal claim loss history information, and employment, tenant, or individual background screening.

(p) A person that violates this Code section may be investigated and prosecuted under the provisions of the Fair Business Practices Act, Code Section 10-1-390, et seq., and may be fined not more than $100.00 for a violation concerning a specific consumer.