50-723. Security freeze on consumer report; requirements; procedure; damages. (a) A consumer may elect to place a security freeze on the consumer's consumer report by written request, sent by certified mail or regular mail, through a secure website if made available by a consumer reporting agency, or by telephone, if the consumer reporting agency does not have an available secure website. A consumer reporting agency shall place a security freeze on a consumer's consumer report no later than five business days after receiving:

(1) A request provided by this subsection; and

(2) proper identification.

(b) When a security freeze is in place, information from a consumer report shall not be released to a third party without prior express authorization from the consumer. This subsection shall not prevent a consumer reporting agency from advising a third party that a security freeze is in effect with respect to a consumer report.

(c) The consumer reporting agency, no later than 10 business days after the date the agency places a security freeze, shall provide the consumer with a unique personal identification number, password or similar device to be used by the consumer when providing authorization for the access to the consumer's consumer report for a specific period of time. In addition, the consumer reporting agency shall simultaneously provide to the consumer in writing the process of placing, removing and temporarily lifting a security freeze and the process for allowing access to information from the consumer's consumer report for a specific period while the security freeze is in effect.

(d) If, in connection with an application for credit or any other use, a third party requests access to a consumer report on which a security freeze is in effect, the third party may treat the application as incomplete if the consumer does not allow the consumer's consumer report to be accessed for that specific period of time.

(e) If the consumer wishes to allow the consumer's consumer report or score to be accessed for a specific period of time while a freeze is in place, the consumer shall contact the consumer reporting agency, request that the freeze be temporarily lifted and provide the following:

(1) Clear and proper identification;

(2) the unique personal identification number or password provided by the consumer reporting agency in accordance with subsection (c); and

(3) the proper information regarding the time period for which the report shall be available to users of the consumer report.

(f) (1) A consumer reporting agency that receives a request from a consumer to temporarily lift a freeze on a consumer report pursuant to subsection (e) shall comply with the request:

(A) No later than three business days after receiving the request if the request is made at a postal address designated by the agency to receive such requests; or

(B) fifteen minutes after the request is received by the consumer reporting agency through the electronic contact method chosen by the consumer reporting agency in accordance with this section and such request is received between 6:00 a.m. and 9:30 p.m. in the central time zone.

(2) A consumer reporting agency is not required to temporarily lift a security freeze within the time provided in subsection (f)(1)(B) if the consumer fails to meet the requirements of subsection (e) or the consumer reporting agency's ability to temporarily lift the security freeze within 15 minutes is prevented by:

(A) An act of God, including, but not limited to, fire, earthquake, hurricane, storm or similar natural disaster or phenomena;

(B) unauthorized or illegal acts by a third party, including, but not limited to, terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations or similar occurrence;

(C) operational interruption, including, but not limited to, electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time or similar disruption;

(D) governmental action, including, but not limited to, emergency orders or regulations, judicial or law enforcement action or similar directives;

(E) regularly scheduled maintenance, other than during normal business hours, of or updates to the consumer reporting agency's systems; or

(F) commercially reasonable maintenance of or repair to the consumer reporting agency's systems that is unexpected or unscheduled.

(g) A consumer reporting agency shall remove or temporarily lift a freeze placed on a consumer's consumer report only in the following cases:

(1) Upon consumer request as provided in this section; or

(2) if the consumer's consumer report was frozen due to a material misrepresentation of fact by the consumer, in which case, if a consumer reporting agency intends to remove a freeze upon the consumer's consumer report, the consumer reporting agency shall notify the consumer in writing prior to removing the freeze on the consumer's consumer report.

(h) A security freeze shall remain in place until the consumer requests that the security freeze be removed. A consumer reporting agency shall remove a security freeze within three business days after receiving a request for removal from the consumer, who shall be required to provide:

(1) Clear and proper identification; and

(2) the unique personal identification number or password provided by the consumer reporting agency in accordance with subsection (c).

(i) A security freeze does not apply to a consumer report provided to:

(1) A federal, state or local governmental entity, including a law enforcement agency or court, or agents or assigns thereof;

(2) a private collection agency for the sole purpose of assisting in the collection of an existing debt of the consumer who is the subject of the consumer report requested;

(3) a person or entity, or a subsidiary, affiliate or agent of such person or entity, or an assignee of a financial obligation owing by the consumer to such person or entity, or a prospective assignee of a financial obligation owing by the consumer to such person or entity in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment of an account or contract, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument. For purposes of this paragraph, "reviewing the account" includes activities related to account maintenance, monitoring, credit line increases and account upgrades and enhancements;

(4) a subsidiary, affiliate, agent, assignee or prospective assignee of a person to whom access has been granted under subsection (e) for the purposes of facilitating the extension of credit;

(5) a person providing a credit report for the purposes permitted under 15 U.S.C. § 1681b(c);

(6) any person providing a consumer with a copy of the consumer's own report at such consumer's request;

(7) a child support enforcement agency;

(8) a consumer reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or multiple consumer reporting agencies and does not maintain a permanent database of credit information from which new consumer reports are produced; however, a consumer reporting agency acting as a reseller shall honor any security freeze placed on a consumer report by another consumer reporting agency;

(9) a check services or fraud prevention services company, which issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers or similar methods of payments;

(10) a deposit account information service company which issues to inquiring banks or other financial institutions, for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution, reports regarding account closures due to fraud, substantial overdrafts, ATM abuse or similar negative information regarding a consumer;

(11) an employer in connection with any application for employment with the employer;

(12) any person administering a credit file monitoring subscription service to which the consumer has subscribed; or

(13) any person or entity for use in setting or adjusting a rate, adjusting a claim or underwriting for insurance purposes.

(j) A consumer reporting agency shall not charge a fee for placing, temporarily lifting or removing each freeze or for replacing a previously requested personal identification number.

(1) A person who has learned or reasonably suspects that the person has been a victim of identity theft may contact the local law enforcement agency that has jurisdiction over the person's actual residence, which shall take a police report of the matter, and provide the complainant with a copy of that report. Notwithstanding the fact the jurisdiction may be elsewhere for investigation and prosecution of a crime of identity theft, any local or state law enforcement agency shall take the complaint and provide the complainant with a copy of the complaint and may refer the complainant to a law enforcement agency in a different jurisdiction.

(2) Nothing in this section shall be construed to interfere with the discretion of a law enforcement agency to allocate resources for investigation of crimes. A complaint filed under this section is not required to be counted as an open case for statistical reporting purposes.

(k) If a security freeze is in place, a consumer reporting agency shall not change any of the following official information in the consumer report without sending a written confirmation of the change to the consumer within 30 days after the change is posted to the consumer's file: Name, date of birth, social security number and address. Written confirmation is not required for technical modifications of a consumer's official information, including name and street abbreviations, complete spellings or transposition of numbers or letters. In the case of an address change, the written confirmation shall be sent to both the new address and to the former address.

(l) Any person who willfully fails to comply with any requirement imposed under this subchapter [subsection] with respect to any consumer is liable to that consumer in an amount equal to the sum of:

(1) Actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000; or

(2) such amount of punitive damages as the court may allow; and

(3) in the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney's fees as determined by the court.

(m) Any person who obtains a consumer report, requests a security freeze, requests the temporary lift of a freeze, or the removal of a security freeze from a consumer reporting agency under false pretenses or in an attempt to violate federal or state law shall be liable to the consumer reporting agency for actual damages sustained by the consumer reporting agency or $1,000, whichever is greater.

(n) Any person who is negligent in failing to comply with any requirement imposed under this section with respect to any consumer, is liable to that consumer in an amount equal to the sum of:

(1) Any actual damages sustained by the consumer as a result of the failure; and

(2) in the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney's fees as determined by the court.

(o) Upon a finding by the court that an unsuccessful pleading, motion or other paper filed in connection with an action under this section was filed in bad faith or for purposes of harassment, the court shall award to the prevailing party attorney's fees reasonable in relation to the work expended in responding to the pleading, motion or other paper.

(p) This section shall be part of and supplemental to the fair credit reporting act.

(q) This section shall take effect and be in force on and after January 1, 2007.

(r) Notwithstanding any other provision of law to the contrary, the exclusive authority to bring an action for any violation of subsection (f)(1)(B) shall be with the attorney general.

History: L. 2006, ch. 149, § 12; L. 2009, ch. 112, § 2; L. 2018, ch. 44, § 2; July 1.