75-63.1. Security freeze for protected consumers.

(a) Obligation to Place Security Freeze. - A consumer reporting agency shall place a protected consumer security freeze on the protected consumer's credit report or on the protected consumer's file in accordance with subsection (b) of this section within 30 days of all of the following conditions being satisfied:

(1) The consumer reporting agency receives a request under this section from the protected consumer's representative for the placement of the protected consumer security freeze by any of the following methods:

a. First-class mail.

b. Telephone call.

c. Secure Web site or secure electronic mail connection.

(2) The protected consumer's representative does all of the following:

a. Submits the request to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency.

b. Provides to the consumer reporting agency sufficient proof of identification for both the protected consumer and the representative.

c. Provides to the consumer reporting agency sufficient proof of authority to act on behalf of the protected consumer.

d. Pays to the consumer reporting agency a fee as provided in subsection (d) of this section.

(b) Action Required. - If the placement of a protected consumer security freeze is required under subsection (a) of this section, a consumer reporting agency shall do one of the following, as applicable:

(1) If no consumer report exists. - If the consumer reporting agency does not have a consumer report pertaining to the protected consumer, the consumer reporting agency shall create a protected consumer's file and place a restriction in the protected consumer's file that prohibits the release of the protected consumer's file, any consumer report subsequently created for the consumer, and any information contained in either document except as provided in this section.

(2) If a consumer report exists. - If the consumer reporting agency has a consumer report pertaining to the protected consumer, the consumer reporting agency shall place a restriction on the report that prohibits the release of the consumer report and any information contained in the report except as provided in this section.

(c) Duration of Freeze. - A protected consumer security freeze shall remain in effect until one of the following occurs, in which case the protected consumer security freeze shall be removed within 30 days:

(1) The protected consumer or the protected consumer's representative requests the consumer reporting agency to remove the protected consumer security freeze by doing all of the following:

a. Submitting a request for the removal of the protected consumer security freeze to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency.

b. If the request is being made by the protected consumer, providing to the consumer reporting agency (i) proof that the sufficient proof of authority for the protected consumer's representative is no longer valid and (ii) sufficient proof of identification for the protected consumer.

c. If the request is being made by the representative of a protected consumer, providing to the consumer reporting agency (i) sufficient proof of identification of the protected consumer and the representative and (ii) sufficient proof of authority to act on behalf of the protected consumer.

d. Providing to the consumer reporting agency a fee as provided in subsection (d) of this section.

(2) The consumer reporting agency determines that the protected consumer security freeze was placed based on a material misrepresentation of fact by the protected consumer or the protected consumer's representative.

(d) Fees. - A consumer reporting agency may charge a reasonable fee for each placement or removal of a protected consumer security freeze in accordance with the following:

(1) Fee allowed in certain cases. - Except as provided in subdivision (2) of this subsection, a consumer reporting agency may charge a fee to a consumer not to exceed five dollars ($5.00) for placement or removal of a protected consumer security freeze.

(2) No fee allowed in certain cases. - A fee may not be charged for the placement or removal of a protected consumer security freeze under this section if any of the following conditions are satisfied:

a. The protected consumer's representative has submitted a copy of a valid investigative or incident report or complaint with a law enforcement agency about the unlawful use of the protected consumer's identifying information by another person.

b. A request for placement or removal of a protected consumer security freeze is for a protected consumer who is under the age of 16 at the time of the request and the consumer reporting agency has a consumer report pertaining to the protected consumer.

c. The protected consumer is over the age of 62.

(3) No other fees allowed. - No fee other than those authorized under this subsection may be charged for placement or removal of a protected consumer security freeze.

(e) Exceptions. - This section does not apply to the use of a consumer credit report by any of the following:

(1) A person or the person's subsidiary, affiliate, agent, subcontractor, or assignee with whom the consumer has, or prior to assignment had, an account, contract, or debtor-creditor relationship for the purposes of reviewing the active account or collecting the financial obligation owing for the account, contract, or debt.

(2) Any person acting pursuant to a court order, warrant, or subpoena.

(3) A State or local agency, or its agents or assigns, that administers a program for establishing and enforcing child support obligations.

(4) A State or local agency, or its agents or assigns, acting to investigate fraud, including Medicaid fraud, or acting to investigate or collect delinquent taxes or assessments, including interest and penalties, unpaid court orders, or to fulfill any of its other statutory responsibilities.

(5) A federal, State, or local governmental entity, including a law enforcement agency, court, or its agent or assigns.

(6) A person for the purposes of prescreening as defined by the Fair Credit Reporting Act, 15 U.S.C. 1681, et seq.

(7) Any person for the sole purpose of providing for a credit file monitoring subscription service to which the protected consumer has subscribed or the representative of the protected consumer has subscribed on behalf of the protected consumer.

(8) A consumer reporting agency for the purpose of providing a protected consumer or representative of a protected consumer with a copy of the protected consumer's credit report upon the request of the protected consumer or the protected consumer's representative.

(9) Any depository financial institution for checking, savings, and investment accounts.

(10) Any property and casualty insurance company for use in setting or adjusting a rate, adjusting a claim, or underwriting for property and casualty insurance purposes.

(11) A person for the purpose of furnishing or using credit reports for employment purposes pursuant to 15 U.S.C. 1681b(b) or tenant screening pursuant to 15 U.S.C. 1681b(a)(3)(F).

(12) A person for the purpose of criminal background record information.

(f) The following persons are not required to place a security freeze on a credit report pursuant to this section; provided, however, that any person that is not required to place a security freeze on a credit report under the provisions of subdivision (3) of this subsection shall be subject to any security freeze placed on a credit report by another consumer reporting agency from which it obtains information:

(1) A check services or fraud prevention services company, which reports on incidents of fraud or issues authorizations for the purpose of approving or processing negotiable instruments, electronic fund transfers, or similar methods of payment.

(2) A deposit account information service company, which issues reports regarding account closures due to fraud, substantial overdrafts, ATM abuse, or other similar negative information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution.

(3) A consumer reporting agency that does all of the following:

a. Acts only to resell credit information by assembling and merging information contained in a database of one or more credit reporting agencies.

b. Does not maintain a permanent database of credit information from which new credit reports are produced.

(4) A consumer reporting agency that maintains a database or file that consists of information used for any of the following purposes but that is not used for credit granting purposes:

a. Reporting of criminal record information.

b. Fraud prevention or detection.

c. Reporting personal loss history information.

d. Employment, tenant, or other individual background screening.

(g) Violation. - A violation of this section is a violation of G.S. 75-1.1.