Sec. 7. (a) Except as provided in section 10 of this chapter, if a security freeze has been placed on a consumer's consumer report, the consumer reporting agency that placed the security freeze on the consumer report shall not release the consumer's consumer report unless the consumer authorizes the consumer reporting agency to:

(1) release the consumer's consumer report to one (1) or more specified third parties; or

(2) temporarily lift the security freeze for a specified period.

(b) A consumer who seeks to authorize the release of the consumer's consumer report under subsection (a)(1) or (a)(2) shall request the release by contacting the consumer reporting agency by any method:

(1) described in section 5(a) of this chapter; or

(2) developed by the consumer reporting agency under subsection (d).

(c) A request by a consumer under subsection (b) must include the following:

(1) Information sufficient to identify the consumer, as specified by the consumer reporting agency in the instructions provided to the consumer under section 6(a)(2) of this chapter.

(2) The unique personal identification number or password assigned to the consumer under section 6(a)(1) or 6(a)(3) of this chapter.

(3) If the consumer seeks to authorize the release of the consumer's consumer report under subsection (a)(1), information sufficient to identify the parties to whom the consumer report is to be released, as specified by the consumer reporting agency in the instructions provided to the consumer under section 6(a)(2) of this chapter.

(4) If the consumer seeks to authorize the consumer reporting agency to temporarily lift a security freeze under subsection (a)(2), the period during which the security freeze is to be temporarily lifted.

(d) Not later than January 1, 2009, a consumer reporting agency shall develop and make available to consumers secure procedures to authorize the release of a consumer's consumer report under subsection (a)(1), or to authorize the temporary lifting of a security freeze under subsection (a)(2), within fifteen (15) minutes of receiving a request under subsection (b), by any of the following methods:

(1) Telephone.

(2) The Internet.

(3) Other electronic media, if provided by the consumer reporting agency.

The procedures developed by a consumer reporting agency under this subsection must require the consumer to provide the information set forth in subsection (c).

(e) A consumer reporting agency that receives a request from a consumer under this section shall comply with the request within the following time frames:

(1) Not later than three (3) business days after receiving the request, if the consumer makes the request by the method described in section 5(a)(1) of this chapter.

(2) Not later than fifteen (15) minutes after receiving the request, if the consumer makes the request using the method described in section 5(a)(2) of this chapter or by any method developed by the consumer reporting agency under subsection (d). However, a consumer reporting agency is not required to comply with a consumer's request within the fifteen (15) minute time frame set forth in this subdivision if:

(A) the consumer does not provide one (1) or more of the items listed in subsection (c); or

(B) the consumer reporting agency's ability to comply with the request within the fifteen (15) minute time frame set forth in this subdivision is prevented by any of the following:

(i) An act of God, including fire, an earthquake, a hurricane, a storm, or a similar natural disaster or phenomenon.

(ii) Unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrences.

(iii) An operational interruption, including an electrical failure, an unanticipated delay in the delivery of equipment or replacement parts, computer hardware or software failures inhibiting response time, or similar disruptions.

(iv) A governmental action, including an emergency order or regulation, a judicial action, a law enforcement action, or a similar directive.

(v) Regularly scheduled maintenance of, or updates to, the consumer reporting agency's computer systems, if the maintenance activities or updates occur other than during normal business hours.

(vi) Commercially reasonable maintenance of, or repairs to, the consumer reporting agency's computer systems, if the maintenance activities or repairs are unexpected or are necessitated by unanticipated conditions or malfunctions.

(vii) For a request made by telephone, receipt of a request under this section other than during the consumer reporting agency's normal business hours, including any extended business hours observed by the consumer reporting agency. The exemption provided by this item does not apply to a request made by a consumer through the Internet or other electronic media. A consumer reporting agency must comply with a request made by a consumer through the Internet or other electronic media within the fifteen (15) minute time frame set forth in this subdivision, even if the request is made at a time other than during the consumer reporting agency's normal or extended business hours.

As added by P.L.104-2007, SEC.1.