(A) The request described in ORS 646A.606 (1); and

(B) Proper identification.

(b) If a consumer report does not exist for a protected consumer on behalf of whom a representative seeks to place a security freeze, a consumer reporting agency shall create a protective record after receiving from the representative the request described in ORS 646A.606 (1), proper identification for both the representative and the protected consumer and sufficient proof of authority, as described in ORS 646A.606 (3)(b). After creating a protective record for a protected consumer under this paragraph, the consumer reporting agency shall place the security freeze that the representative requested on the protected consumer’s protective record.

(c) The protective record that the consumer reporting agency creates under paragraph (b) of this subsection does not need to contain any information other than the protected consumer’s personal information, if other information for the protected consumer is not available. Except as provided in ORS 646A.614, a consumer reporting agency may not use or release to another person the information in a protective record for the purpose of assessing a protected consumer’s eligibility or capacity for an extension of credit, as a basis for evaluating a protected consumer’s character, reputation or personal characteristics or for other purposes that are not related to protecting the protected consumer from identity theft.

(2)(a) A consumer reporting agency shall send a written confirmation of a security freeze on a consumer’s consumer report to the consumer at the last known address for the consumer shown in the consumer report that the consumer reporting agency maintains, within 10 business days after placing the security freeze and, with the confirmation, shall provide the consumer with a unique personal identification number or password or similar device the consumer must use to authorize the consumer reporting agency to release the consumer’s consumer report for a specific period of time or to permanently remove the security freeze. The consumer reporting agency shall include with the written confirmation information that describes how to remove a security freeze and how to temporarily lift a security freeze on a consumer report, other than a consumer report for a protected consumer, in order to allow access to information from the consumer’s consumer report for a period of time while the security freeze is in place.

(b) This subsection does not require a consumer reporting agency to provide a consumer or representative with a personal identification number or password for the consumer or representative to use to authorize the consumer reporting agency to release information from a protective record.

(3)(a) If a consumer wishes to allow the consumer’s consumer report to be accessed for a specific period of time while a security freeze is in effect, the consumer shall contact the consumer reporting agency using a point of contact the consumer reporting agency designates, request that the security freeze be temporarily lifted and provide the following:

(A) Proper identification;

(B) The unique personal identification number or password or similar device the consumer reporting agency provided under subsection (2) of this section; and

(C) An indication of the period of time during which the consumer report must be available to users of the consumer report.

(b) A protective record is not subject to a temporary lift of a security freeze.

(c) Except as provided in ORS 646A.612 (2)(a), a consumer report for a protected consumer is not subject to a temporary lift of a security freeze.

(4) A consumer reporting agency that receives a request from a consumer to temporarily lift a security freeze on a consumer report, other than a consumer report for a protected consumer, under subsection (3) of this section shall comply with the request not later than three business days after receiving from the consumer:

(a) Proper identification;

(b) The unique personal identification number or password or similar device the consumer reporting agency provided under subsection (2) of this section; and

(c) An indication of the period of time during which the consumer report must be available to users of the consumer report.

(5)(a) A security freeze for a consumer report must remain in place until the consumer requests, using a point of contact the consumer reporting agency designates, that the security freeze be removed. A consumer reporting agency shall remove a security freeze within three business days after receiving a request for removal from the consumer, who provides:

(A) Proper identification; and

(B) The unique personal identification number or password or similar device the consumer reporting agency provided under subsection (2) of this section.

(b) A security freeze for a protective record must remain in place until the protected consumer or a representative requests, using a point of contact the consumer reporting agency designates, that the security freeze be removed or that the protective record be deleted. The consumer reporting agency does not have an affirmative duty to notify the protected consumer or the representative that a security freeze is in place or to remove the security freeze or delete the protective record once the protected consumer is no longer a protected consumer. A protected consumer or a representative has the affirmative duty to request that the consumer reporting agency remove the security freeze or delete the protective record. A consumer reporting agency shall remove a security freeze or delete a protective record within 30 business days after receiving a request for removal or deletion from the protected consumer or a representative, who provides:

(A) Proper identification;

(B) Sufficient proof of authority, as described in ORS 646A.606 (3)(b), if the representative seeks to remove the security freeze or delete the protective record; and

(C) Proof that the representative’s authority to act on the protected consumer’s behalf is no longer valid or applicable, if the protected consumer seeks to remove the security freeze or delete the protective record. [2007 c.759 §5; 2013 c.415 §3; 2018 c.10 §4]