(2) If the consumer or protected consumer is the victim of identity theft or has reported a theft of personal information to a law enforcement agency, the consumer or representative may include a copy of the police report, incident report or identity theft declaration.

(3)(a) The consumer or representative must provide proper identification.

(b)(A) In addition to the information described in paragraph (a) of this subsection, a representative who seeks to place a security freeze on a protected consumer’s consumer report or protective record shall provide sufficient proof of the representative’s authority to act on the protected consumer’s behalf.

(B) For purposes of subparagraph (A) of this paragraph, sufficient proof of authority consists of:

(i) A court order that identifies or describes the relationship between the representative and the protected consumer;

(ii) A valid and lawfully executed power of attorney that permits the representative to act on the protected consumer’s behalf; or

(iii) A written affidavit that the representative signs and has notarized in which the representative expressly describes the relationship between the representative and the protected consumer and the representative’s authority to act on the protected consumer’s behalf.

(4)(a) Except as provided in ORS 646A.614, if a security freeze is in place for a consumer report, information from the consumer report may not be released without prior express authorization from the consumer.

(b) Information from a protective record may not be released until the protected consumer for whom the consumer reporting agency created the protective record, or a representative of the protected consumer, removes the security freeze.

(5) This section does not prevent a consumer reporting agency from advising a third party that a security freeze is in effect with respect to the consumer report or protective record. [2007 c.759 §4; 2013 c.415 §2; 2018 c.10 §3]