(a) A consumer-reporting agency shall permit a consumer to place a security freeze on his or her credit report by the consumer selecting either of the following:

(1) A request in writing by certified or overnight mail to a consumer-reporting agency; or

(2) Making a request directly to the consumer-reporting agency through a secure electronic method, if available: Provided, That by January 31, 2009, a secure electronic method shall be made available to the consumer by the consumer-reporting agency.

(b) A consumer-reporting agency shall place a security freeze on a credit report no later than five business days after receiving a written request from the consumer. If a security freeze is in place, a report or information may not be distributed to a third party without prior express authorization from the consumer. This subdivision does not prevent a consumer-reporting agency from advising a third party that a security freeze is in effect with respect to the consumer's credit report. A consumer-reporting agency may, regardless of the existence of a security freeze, distribute information contained in a consumer file to the extent otherwise permitted by law if the information was lawfully obtained by or for a consumer-reporting agency from an open public record, without respect to the existence of a security freeze. Nothing herein prevents a consumer-reporting agency from choosing to apply the security freeze to the entire contents of the credit reporting file that is subject to the security freeze.

(c) The consumer-reporting agency shall send a written confirmation of the security freeze to the consumer within five business days of placing the freeze and at the same time shall provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the distribution of his or her credit information.

(d) If the consumer wishes to allow his or her credit report to be accessed for a period of time while a freeze is in place, he or she shall contact the consumer-reporting agency by regular mail or a procedure developed under subsection (f) of this section and request that the freeze be temporarily lifted, providing all of the following:

(1) Proper identification;

(2) The unique personal identification number or password provided by the consumer-reporting agency pursuant to subsection (c) of this section; and

(3) The time period for which the credit report shall be available to users of the credit report.

(e) A consumer-reporting agency that receives a request from a consumer to temporarily lift a freeze on a credit report pursuant to subsection (d) of this section shall comply with the request no later than three business days after receiving the request.

(f) A consumer-reporting agency shall develop procedures involving the use of telephone, fax, the Internet or other electronic media to receive and process a request from a consumer pursuant to subsection (d) of this section to temporarily lift a freeze on a credit report in an expedited manner.

(g) (1) Beginning on September 1, 2008, a consumer-reporting agency shall temporarily lift a security freeze from a consumer's credit report within fifteen minutes after the consumer's request is received pursuant to subsection (f) of this section by the consumer-reporting agency.

(2) A consumer-reporting agency does not have to remove a security freeze within the time provided in this subsection if:

(A) The consumer fails to meet the requirements of subsection (d) of this section; or

(B) The consumer-reporting agency's ability to remove the security freeze within fifteen minutes is prevented by:

(i) An act of God, including fire, earthquakes, hurricanes, storms or similar natural disasters or phenomena;

(ii) Unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations or similar occurrence;

(iii) Operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time or similar disruption;

(iv) Governmental action, including emergency orders or regulations, judicial or law-enforcement action or similar directives;(v) Regularly scheduled maintenance, during other than normal business hours, of, or updates to, the consumer-reporting agency's systems; or

(v) Regularly scheduled maintenance, during other than normal business hours, of, or updates to, the consumer-reporting agency's systems; or

(vi) Commercially reasonable maintenance of, or repair to, the consumer-reporting agency's systems that is unexpected or unscheduled.

(h) A consumer-reporting agency shall remove or temporarily lift a freeze placed on a credit report only upon the request of the consumer, pursuant to subsection (d) or (j) of this section.

(i) If a third party requests access to a credit report on which a security freeze is in effect, and this request is in connection with an application for credit or any other use, and the consumer has not allowed his or her credit report to be accessed for a period of time, the third party may treat the application as incomplete.

(j) A security freeze shall remain in place until the consumer requests that the security freeze be removed. A consumer-reporting agency shall remove a security freeze within three business days of receiving a request for removal from the consumer who provides the following:

(1) Proper identification; and

(2) The unique personal identification number or password provided by the consumer-reporting agency pursuant to subsection (c) of this section.

(k) A consumer-reporting agency shall require proper identification of the person making a request to place or remove a security freeze.

(l) The provisions of this section do not apply to the distribution of a consumer credit report to any of the following:

(1) A person or the person's subsidiary, affiliate, agent or assignee with whom the consumer has or, prior to assignment, had an account, contract or debtor-creditor relationship for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract or debt;

(2) A subsidiary, affiliate, agent, assignee or prospective assignee of a person to whom access has been granted under this section for purposes of facilitating the extension of credit or other permissible use;

(3) A person acting pursuant to a court order, warrant or subpoena;

(4) A state or local agency that administers a program for establishing and enforcing child support obligations;

(5) The West Virginia Department of Health and Human Resources or its agents or assigns acting to investigate fraud;

(6) The West Virginia Department of Revenue or its agents or assigns acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities;

(7) A person for the purposes of prescreening as defined by the federal Fair Credit Reporting Act;

(8) A person or entity administering a credit file monitoring subscription service to which the consumer has subscribed; and

(9) A person or entity for the purpose of providing a consumer with a copy of his or her credit report upon the consumer's request.

(10) Any person or entity for use in setting or adjusting a rate, adjusting a claim or underwriting for insurance purposes to the extent not otherwise prohibited by law.

(m) The provisions of this section do not apply to any of the following:

(1) A consumer-reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer-reporting agency or multiple consumer credit-reporting agencies and does not maintain a permanent database of credit information from which new consumer credit reports are produced. A consumer-reporting agency acting as a reseller shall honor any security freeze placed on a consumer credit report by another consumer-reporting agency.

(2) A check services or fraud prevention services company which issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers or similar methods of payments.

(3) A deposit account information service company which issues reports regarding account closures due to fraud, a substantial number of overdrafts, ATM abuse or similar negative information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution.

(4) A consumer-reporting agency's database or file which consists of information concerning, and used for, criminal record information, fraud prevention or detection, personal loss history information and employment, tenant or background screening.

(n) Except as prohibited by subsection (o) of this section, a consumer-reporting agency may charge a reasonable fee, not to exceed $5, to a consumer who elects to place, remove or temporarily lift a security freeze on the consumer's credit report. No fees except those authorized by this subsection and subsection (p) of this section may be charged in connection with a security freeze.

(o) A consumer-reporting agency may not charge a fee for security freeze services to a consumer who is a victim of identity theft and who provides a copy of a police report, an investigative report or a written complaint made to the Federal Trade Commission, to the office of the Attorney General of West Virginia or to a law-enforcement agency concerning the identity theft.

(p) A consumer may be charged a reasonable fee, not to exceed $5, if the consumer fails to retain the original unique personal identification number or password provided by the consumer-reporting agency and must be reissued the same or a new unique personal identification number or password.