Subdivision 1. Definitions. (a) For purposes of this section and sections 13C.017 to 13C.019, the terms defined in this section have the meanings given.

(b) "Security freeze" means a notice placed in a consumer's consumer report, at the request of the consumer and subject to certain exceptions, that prohibits the consumer reporting agency from releasing the consumer report or any information from it, in connection with the extension of credit or the opening of a new account, without the express authorization of the consumer. If a security freeze is in place, information from a consumer's consumer report may not be released to a third party, in connection with the extension of credit or the opening of an account, without prior express authorization from the consumer. This paragraph does not prevent a consumer reporting agency from advising a third party that a security freeze is in effect with respect to the consumer report.

(c) "Victim of identity theft" means a consumer who has a copy of a valid police report evidencing that the consumer has alleged to be a victim of identity theft as defined in section 609.527.

Subd. 2. Right to obtain security freeze. A consumer may elect to place a security freeze on the consumer's consumer report by making a request to a consumer reporting agency. The consumer may make the request:

(1) by certified mail;

(2) by telephone by providing certain personal identification required by the consumer reporting agency; or

(3) directly to the consumer reporting agency through a secure electronic mail connection if the connection is made available by the consumer reporting agency.

Subd. 3. Response of consumer reporting agency. (a) A consumer reporting agency shall place a security freeze on a consumer's consumer report no later than three business days after receiving a request under subdivision 2 from the consumer.

(b) The consumer reporting agency, within ten business days after receiving the request, shall send a written confirmation of the security freeze to the consumer and provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of the consumer's consumer report for a specific party or period of time.

(c) When a consumer requests a security freeze, the consumer reporting agency shall disclose the process of placing and temporarily lifting a freeze, including the process for allowing access to information from the consumer's consumer report for a specific party or period of time while the freeze is in place.

Subd. 4. Temporary lifting or permanent removal of freeze. (a) If the consumer wishes to allow the consumer's consumer report to be accessed for a specific party or period of time while a freeze is in place, the consumer shall contact the consumer reporting agency, request that the freeze be temporarily lifted, and provide the following:

(1) proper identification, which means that information generally deemed sufficient to identify a person. Only if the consumer is unable to sufficiently provide self-identifying information may a consumer reporting agency require additional information concerning the consumer's employment and personal or family history in order to verify the consumer's identity;

(2) the unique personal identification number or password provided by the credit reporting agency under subdivision 3, paragraph (b); and

(3) the proper information regarding the third party who is to receive the consumer report or the time period for which the report is to be available to users of the consumer report.

(b) A consumer reporting agency that receives a request from a consumer to temporarily lift a freeze on a consumer report under paragraph (a) shall comply with the request no later than three business days after receiving the request.

(c) A consumer reporting agency may develop procedures involving the use of telephone, fax, the Internet, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze on a consumer report under paragraph (a) in an expedited manner, with the goal of processing a request within 15 minutes after the request.

(d) A consumer reporting agency shall remove or temporarily lift a freeze placed on a consumer report only in the following cases:

(1) upon consumer request under paragraph (a) or (e); or

(2) when the consumer report was frozen due to a material misrepresentation of fact by the consumer. When a consumer reporting agency intends to remove a freeze on a consumer report under this clause, the consumer reporting agency shall notify the consumer in writing three business days prior to removing the freeze on the consumer report.

(e) A security freeze remains in place until the consumer requests that the security freeze be removed. A consumer reporting agency shall remove a security freeze within three business days of receiving a request for removal from the consumer, who provides both of the following:

(1) proper identification, as defined in paragraph (a), clause (1); and

(2) the unique personal identification number or password referenced in paragraph (a), clause (2).

Subd. 5. Response by third party to denial of access. When a third party requests access to a consumer report on which a security freeze is in effect, and this request is in connection with an application for credit or the opening of an account and the consumer does not allow the consumer's consumer report to be accessed for that specific party or period of time, the third party may treat the application as incomplete.

Subd. 6. Nonapplicability. This section does not apply to the use of a consumer report by any of the following:

(1) a person or entity, or a subsidiary, affiliate, or agent of that person or entity, or an assignee of a financial obligation owing by the consumer to that person or entity, or a prospective assignee of a financial obligation owing by the consumer to that person or entity in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment an account or contract, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument. For purposes of this clause, "reviewing the account" includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements;

(2) a subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under subdivision 4 for purposes of facilitating the extension of credit or other permissible use;

(3) any federal, state, or local governmental entity, including but not limited to a law enforcement agency, court, or its agents or assigns;

(4) a private collection agency acting under a court order, warrant, or subpoena;

(5) any person or entity for the purposes of prescreening as provided for by the federal Fair Credit Reporting Act;

(6) any person or entity administering a credit file monitoring subscription service to which the consumer has subscribed; and

(7) any person or entity for the purpose of providing a consumer with a copy of the consumer's consumer report upon the consumer's request.

Subd. 7. Information to government agencies not affected. This section does not prohibit a consumer reporting agency from furnishing to a governmental agency a consumer's name, address, former address, places of employment, or former places of employment.

Subd. 8. Fees. (a) A consumer reporting agency may not charge a fee for placing, temporarily lifting, or removing a security freeze.

(b) A consumer may be charged no more than $5 if the consumer fails to retain the original personal identification number given to the consumer by the agency, but the consumer may not be charged for a onetime reissue of the same or a new personal identification number. The consumer may be charged no more than $5 for subsequent instances of loss of the personal identification number.

(c) A consumer who makes a written request by mail may pay any fee charged pursuant to this subdivision by check, money order, or credit card. A consumer who makes a request by telephone or other electronic media may pay any fee charged pursuant to this subdivision by credit card.

History: 2006 c 233 s 2; 2008 c 211 s 1; 2018 c 158 s 1