§489P-3.5 Security freeze for protected consumers; removal of security freezes; fees; applicability and scope. (a) A consumer credit reporting agency shall place a security freeze on a protected consumer's credit report or records if:

(1) The consumer credit reporting agency receives a request from the protected consumer's representative for the placement of the security freeze under this section; and

(2) The protected consumer's representative:

(A) Submits the request to the consumer credit reporting agency at the address or other point of contact specified by the consumer credit reporting agency;

(B) Provides to the consumer credit reporting agency sufficient proof of identification of the protected consumer and the protected consumer's representative; and

(C) Provides to the consumer credit reporting agency sufficient proof of authority to act on behalf of the protected consumer.

(b) If a consumer credit reporting agency does not have a credit file pertaining to the protected consumer when the consumer credit reporting agency receives a request pursuant to this section, the consumer credit reporting agency shall create a record for the protected consumer.

(c) Within thirty days after receiving a request that meets the requirements of this section, a consumer credit reporting agency shall place a security freeze for the protected consumer.

(d) Unless a security freeze for a protected consumer is removed in accordance with this section, a consumer credit reporting agency may not release the protected consumer's credit report, any information derived from the protected consumer's credit report, or any record created for the protected consumer.

(e) A security freeze for a protected consumer placed under subsection (a) shall remain in effect until the security freeze is removed in accordance with subsection (f) or (i).

(f) If a protected consumer or a protected consumer's representative wishes to remove a security freeze for the protected consumer, the protected consumer or the protected consumer's representative shall:

(1) Submit a request for the removal of the security freeze to the consumer credit reporting agency at the address or other point of contact specified by the consumer credit reporting agency; and

(2) Provide to the consumer credit reporting agency:

(A) In the case of a request by the protected consumer:

(i) Proof that the sufficient proof of authority for the protected consumer's representative to act on behalf of the protected consumer is no longer valid; and

(ii) Sufficient proof of identification of the protected consumer; or

(B) In the case of a request by the representative of a protected consumer:

(i) Sufficient proof of identification of the protected consumer and the representative; and

(ii) Sufficient proof of authority to act on behalf of the protected consumer.

(g) Within thirty business days after receiving a request that meets the requirements of subsection (f), the consumer credit reporting agency shall remove the security freeze for the protected consumer.

(h) A consumer credit reporting agency shall not charge a fee for placing or removing a security freeze on a credit report or records for a protected consumer.

(i) A consumer credit reporting agency may remove a security freeze for a protected consumer or delete a record of a protected consumer if the security freeze was placed or the record was created based on a material misrepresentation of fact by the protected consumer or the protected consumer's representative.

(j) This section shall not apply to:

(1) A person administering a credit file monitoring subscription service to which:

(A) The protected consumer has subscribed; or

(B) The representative of the protected consumer has subscribed on behalf of the protected consumer;

(2) A person providing the protected consumer or the protected consumer's representative with a copy of the protected consumer's credit report or records at the request of the protected consumer or the protected consumer's representative;

(3) An entity or purpose listed in section 489P-3(l)(8), (9), or (10) or section 489P-5; or

(4) A consumer reporting agency database or file that consists entirely of consumer information concerning, and used solely for:

(A) Criminal record information;

(B) Personal loss history information;

(C) Fraud prevention or detection;

(D) Employment screening; or

(E) Tenant screening.

(k) A person who violates this section shall be subject to the penalties set forth in section 489P-6.

(l) As used in this section, unless the context otherwise requires:

"Protected consumer" means an individual who is:

(1) Under the age of sixteen at the time a request for the placement of a security freeze is made; or

(2) Incapacitated or for whom a court or other authority has appointed a guardian or conservator.

"Record" means a compilation of information that:

(1) Identifies a protected consumer;

(2) Is created by a consumer credit reporting agency solely for the purpose of complying with this section; and

(3) May not be created or used to consider the protected consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living for any purposes listed in title 15 United States Code section 1681b.

"Representative" means a person who provides to a consumer credit reporting agency sufficient proof of authority to act on behalf of a protected consumer.

"Security freeze" means:

(1) If a consumer credit reporting agency does not have a file pertaining to a protected consumer, a restriction that:

(A) Is placed on the protected consumer's record in accordance with this section; and

(B) Prohibits the consumer credit reporting agency from releasing the protected consumer's record, except as provided in this section; or

(2) If a consumer credit reporting agency has a file pertaining to the protected consumer, a restriction that:

(A) Is placed on the protected consumer's credit report in accordance with this section; and

(B) Prohibits the consumer credit reporting agency from releasing the protected consumer's credit report or any information derived from the protected consumer's credit report, except as provided in this section.

"Sufficient proof of authority" means clear and proper information regarding the representative's authority to act on the protected consumer's behalf including but not limited to:

(1) A court order that identifies or describes the relationship between the representative and the protected consumer;

(2) A duly executed power of attorney that permits the representative to act on the protected consumer's behalf; or

(3) A notarized affidavit of the representative, stating the relationship between the representative and the protected consumer and the representative's authority to act on the protected consumer's behalf.

"Sufficient proof of identification" means information or documentation that identifies a protected consumer or a representative of a protected consumer, including any one of the following:

(1) A social security number or a copy of a social security card issued by the Social Security Administration;

(2) A certified or official copy of a birth certificate issued by the entity authorized to issue the birth certificate;

(3) A copy of a driver's license, a civil identification card issued by the examiner of drivers, or any other government-issued identification; or

(4) A copy of a bill, including a bill for telephone, sewer, septic tank, water, electric, oil, or natural gas services, that shows a name and home address. [L 2017, c 92, §2; am L 2018, c 22, §5]