Sec. 9. (a) A security freeze remains in effect until the consumer who requested the security freeze requests that the security freeze be removed. A consumer who seeks to authorize a consumer reporting agency to remove a security freeze shall request the removal by contacting the consumer reporting agency by any method:

(1) described in section 5(a) of this chapter; or

(2) developed by a consumer reporting agency under section 7(d) of this chapter for receiving a consumer's request to authorize the release of a consumer report or the temporary lifting of a security freeze.

(b) A request by a consumer under subsection (a) must include the following:

(1) Information sufficient to identify the consumer, as specified by the consumer reporting agency in the instructions provided to the consumer under section 6(a)(2) of this chapter.

(2) The unique personal identification number or password assigned to the consumer under section 6(a)(1) or 6(a)(3) of this chapter.

(c) Subject to subsection (d), a consumer reporting agency must remove a security freeze within the following time frames:

(1) Not later than three (3) business days after receiving a request under subsection (a), if the consumer makes the request by the method described in section 5(a)(1) of this chapter.

(2) Not later than fifteen (15) minutes after receiving a request under subsection (a), if the consumer makes the request using the method described in section 5(a)(2) of this chapter or by any method developed by the consumer reporting agency under section 7(d) of this chapter. However, a consumer reporting agency is not required to comply with a consumer's request within the fifteen (15) minute time frame set forth in this subdivision if:

(A) the consumer does not provide one (1) or more of the items listed in subsection (b); or

(B) the consumer reporting agency's ability to comply with the request within the fifteen (15) minute time frame set forth in this subdivision is prevented by any of the following:

(i) An act of God, including fire, an earthquake, a hurricane, a storm, or a similar natural disaster or phenomenon.

(ii) Unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrences.

(iii) An operational interruption, including an electrical failure, an unanticipated delay in the delivery of equipment or replacement parts, computer hardware or software failures inhibiting response time, or similar disruptions.

(iv) A governmental action, including an emergency order or regulation, a judicial action, a law enforcement action, or a similar directive.

(v) Regularly scheduled maintenance of, or updates to, the consumer reporting agency's computer systems, if the maintenance activities or updates occur other than during normal business hours.

(vi) Commercially reasonable maintenance of, or repairs to, the consumer reporting agency's computer systems, if the maintenance activities or repairs are unexpected or are necessitated by unanticipated conditions or malfunctions.

(vii) For a request made by telephone, receipt of a request under this section other than during the consumer reporting agency's normal business hours, including any extended business hours observed by the consumer reporting agency. The exemption provided by this item does not apply to a request made by a consumer through the Internet or other electronic media. A consumer reporting agency must comply with a request made by a consumer through the Internet or other electronic media within the fifteen (15) minute time frame set forth in this subdivision, even if the request is made at a time other than during the consumer reporting agency's normal or extended business hours.

(d) A consumer reporting agency is not required to remove a security freeze under this section if the consumer reporting agency determines that the request to remove the security freeze:

(1) is materially false; or

(2) does not clearly identify the person making the request as the consumer.

As added by P.L.104-2007, SEC.1.