A. A consumer reporting agency shall place a security freeze on a protected person's record or credit report if both of the following apply:
1. The consumer reporting agency receives a request from the protected person's representative for the placement of the security freeze.
2. The protected person's representative does all of the following:
(a) Submits the request to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency.
(b) Provides to the consumer reporting agency sufficient proof of identification of the protected person and the representative.
(c) Provides to the consumer reporting agency sufficient proof of authority to act on behalf of the protected person.
B. If a consumer reporting agency does not have a file pertaining to a protected person when the consumer reporting agency receives a request pursuant to subsection A, paragraph 1 of this section, the consumer reporting agency shall create a record for the protected person.
C. Within thirty days after receiving a request pursuant to this section, a consumer reporting agency shall place a security freeze on the protected person's record or credit report.
D. Unless a security freeze is removed pursuant to subsection F or I of this section, a consumer reporting agency may not release the protected person's credit report, any information derived from the protected person's credit report or any record created for the protected person.
E. A security freeze that is placed on a protected person's record or credit report under this section remains in effect until either:
1. The protected person or the protected person's representative requests that the consumer reporting agency remove the security freeze pursuant to subsection F of this section.
2. The security freeze is removed pursuant to subsection I of this section.
F. To remove a security freeze for a protected person, the protected person or the protected person's representative shall submit a request for the removal of the security freeze to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency. In addition:
1. If the protected person requested the removal of the security freeze, the protected person shall provide to the consumer reporting agency either of the following:
(a) Proof that the protected person's representative no longer has sufficient proof of authority to act on behalf of the protected person.
(b) Sufficient proof of identification of the protected person.
2. If the protected person's representative requested the removal of the security freeze on behalf of the protected person, the protected person's representative shall provide to the consumer reporting agency both of the following:
(a) Sufficient proof of identification of the protected person and the representative.
(b) Sufficient proof of authority to act on behalf of the protected person.
G. Within thirty days after receiving a request to remove a security freeze placed pursuant to subsection A of this section, the consumer reporting agency shall remove the security freeze for the protected person.
H. A consumer reporting agency may not charge a fee for each placement or removal of a security freeze on a protected person's record or credit report.
I. A consumer reporting agency may remove a security freeze for a protected person or may delete a protected person's record if the security freeze was placed or the record was created based on a material misrepresentation of fact by the protected person or the protected person's representative.
J. An act or practice in violation of this section is an unlawful practice under section 44-1522 and is subject to enforcement through a private action and by the attorney general. The attorney general may investigate and take appropriate action as prescribed by chapter 10, article 7 of this title. The remedies provided in this section are not intended to be the exclusive remedies available to a protected person.
K. This section does not apply to the use of a protected person's credit report or record by any of the following:
1. A person administering a credit file monitoring subscription service to which either:
(a) The protected person has subscribed.
(b) The protected person's representative has subscribed on behalf of the protected person.
2. A person providing the protected person or the protected person's representative with a copy of the protected person's credit report on the request of the protected person or the protected person's representative.
3. A check services or fraud prevention services company that issues either:
(a) Reports on incidents of fraud.
(b) Authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers or similar payment methods.
4. A deposit account information service company that issues reports relating to account closures due to fraud, substantial overdrafts, automated teller machine abuse or similar negative information about a protected person to inquiring banks or other financial institutions for use only in reviewing a protected person's request for a deposit account at the inquiring bank or financial institution.
5. An insurance company for the purpose of conducting its ordinary business.
6. A consumer reporting agency that both:
(a) Acts only to resell credit information by assembling and merging information contained in a database of another consumer reporting agency.
(b) Does not maintain a permanent database of credit information from which new credit reports are produced.
7. A consumer reporting agency's database or file that consists of information concerning and used for one or more of the following, but not for credit granting, purposes:
(a) Criminal record information.
(b) Fraud prevention or detection.
(c) Personal loss history information.
(d) Employment, tenant or individual background screening.
8. A governmental entity when carrying out its duties.
9. A person, a subsidiary, affiliate, agent or subcontractor of that person, an assignee of a financial obligation owed by the protected person to that person or a prospective assignee of a financial obligation owed by the protected person to that person in conjunction with the proposed purchase of the financial obligation with which the protected person has or had before assignment an account or contract, including a demand deposit account, or to whom the protected person issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owed for the account, contract or negotiable instrument. For the purposes of this paragraph, "reviewing the account" includes activities that are related to account maintenance, monitoring, credit line increases and account upgrades and enhancements.
L. For the purposes of this section:
1. "Protected person" means an individual who is under sixteen years of age at the time a request for the placement of a security freeze is made or who is an incapacitated person or a protected person for whom a guardian or conservator has been appointed.
2. "Record" means a compilation of information to which all of the following apply:
(a) The record identifies a protected person.
(b) The record is created by a consumer reporting agency solely for the purpose of complying with this section.
(c) The record is not created or used to consider the protected person's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living.
3. "Representative" means a person who provides to a consumer reporting agency sufficient proof of authority to act on behalf of a protected person.
4. "Security freeze" means:
(a) If a consumer reporting agency does not have a file pertaining to a protected person, a restriction that is placed on the protected person's record and that prohibits the consumer reporting agency from releasing the protected person's record.
(b) If a consumer reporting agency has a file pertaining to the protected person, a restriction that is placed on the protected person's credit report and that prohibits the consumer reporting agency from releasing the protected person's credit report or any information derived from the protected person's credit report.
5. "Sufficient proof of authority" means documentation that shows a representative has authority to act on behalf of a protected person and includes:
(a) A court order.
(b) A lawfully executed and valid power of attorney.
(c) A written, notarized statement signed by a representative that expressly describes the authority of the representative to act on behalf of a protected person.
6. "Sufficient proof of identification" means information or documentation that identifies a protected person or a representative of a protected person and includes:
(a) A social security number or a social security card issued by the social security administration.
(b) A certified or official copy of a birth certificate issued by the department of health services.
(c) A driver license or a nonoperating identification license issued by the department of transportation pursuant to title 28, chapter 8 or any other government issued identification.