(1) (a) A
consumer may elect to place a security freeze on his or her consumer report by
making a request in writing by certified mail to a consumer reporting agency.
(b) Except as provided in subsections (6)(b) and (11) of this section, if a
security freeze is in place, information from a consumer report may not be released
to a third party without prior, express authorization from the consumer.
(c) This section does not prevent a consumer reporting agency from advising
a third party that a security freeze is in effect with respect to the consumer report.
(2) (a) A consumer reporting agency shall place a security freeze on a
consumer report no later than five business days after receiving the request from
the consumer.
(b) The consumer reporting agency shall send a written confirmation of the
security freeze to the consumer within ten business days and, with the
confirmation, shall provide the consumer with a unique personal identification
number or password to be used by the consumer when providing authorization for
the release of his or her consumer report to a specific party or for a specific period
of time.
(3) If a consumer wishes to allow his or her consumer report to be accessed
by a specific party or for a specific period of time while a freeze is in place, he or
she shall contact the consumer reporting agency, request that the freeze be
temporarily lifted, and provide the following:
(a) Proper identification;
(b) The unique personal identification number or password provided by the
consumer reporting agency pursuant to subsection (2)(b) of this section; and
(c) The proper information regarding the third party who is to receive the
consumer report or the time period that the report shall be available to users of the
consumer report.
(4) A consumer reporting agency that receives a request from a consumer to
temporarily lift a freeze on a consumer report pursuant to subsection (3) of this
section, shall comply with the request no later than three business days after
receiving the request.
(5) A consumer reporting agency may develop procedures involving the use
of telephone, fax, internet, or other electronic media to receive and process a
request from a consumer to place a freeze or to temporarily lift a freeze on a
consumer report pursuant to subsection (3) of this section in an expedited manner.
(6) A consumer reporting agency shall remove or temporarily lift a freeze
placed on a consumer report only in the following cases:
(a) Upon consumer request, pursuant to subsection (3) or (9) of this section;
or
(b) If the consumer report was frozen due to a material misrepresentation of
fact by the consumer or somebody purporting to be the consumer. If a consumer
reporting agency intends to remove a freeze on a consumer report pursuant to this
subsection (6)(b), the consumer reporting agency shall notify the consumer in
writing prior to removing the freeze placed on the consumer report.
(7) If a third party requests access to a consumer report on which a security
freeze is in effect, and the request is in connection with an application for credit or
other use, and the consumer does not allow his or her consumer report to be
accessed by that specific party or during that period of time, the third party may
treat the application as incomplete.
(8) If a consumer requests a security freeze, the consumer reporting agency
shall disclose the process of placing and temporarily lifting a freeze and the
process for allowing access to information from the consumer report to a specific
party or for a specific period of time while the freeze is in place.
(9) Except as otherwise provided pursuant to subsection (6)(b) of this
section, a security freeze shall remain in place until the consumer requests that the
security freeze be removed. A consumer reporting agency shall remove a security
freeze within three business days of receiving a request for removal from the
consumer, who provides both of the following:
(a) Proper identification; and
(b) The unique personal identification number or password provided by the
consumer reporting agency pursuant to subsection (2)(b) of this section.
(10) A consumer reporting agency shall require proper identification of the
person making a request to place a security freeze in a manner consistent with the
requirements of this section.
(11) The provisions of this section shall not apply to the use of a consumer
report by or for any of the following:
(a) A person or entity, or a subsidiary, affiliate, or agent of that person or
entity that owns a financial obligation owing by the consumer to that person or
entity, including a demand deposit account, or to whom the consumer issued a
negotiable instrument, for the purposes of reviewing the account or collecting the
financial obligation owing for the account, contract, debt, or negotiable instrument,
and lawful associated costs;
(b) An assignee or a prospective assignee of a financial obligation owing by
the consumer to a person or entity in subsection (11)(a) of this section;
(c) A subsidiary, affiliate, agent, assignee, or prospective assignee of a
person to whom access has been granted under subsection (3) of this section for
purposes of facilitating the extension of credit or other permissible use;
(d) A state or local agency, law enforcement agency, trial court, private
collection agency, or person acting pursuant to a court order, warrant, or subpoena
authorizing the use of the consumer report;
(e) A child support enforcement agency acting to enforce child support
obligations;
(f) The department of health care policy and financing or its agents or
assigns acting to investigate fraud;
(g) The department of human services or its agents or assignees acting to
investigate fraud;
(h) The department of revenue or its agents or assigns acting to investigate
or collect delinquent taxes or unpaid court orders or to fulfill any of its other
statutory responsibilities or exercise any of its statutory authority;
(i) The use of credit information for the purposes of prescreening as provided
for by the federal Fair Credit Reporting Act, 15 U.S.C. sec. 1681 et seq.;
(j) Any person or entity administering a credit file monitoring subscription
service to which the consumer has subscribed;
(k) Any person or entity for the purpose of providing a consumer with a copy
of his or her consumer report upon the consumer's request;
(l) Any person or entity for use in setting or adjusting a rate, adjusting a
claim, or underwriting for insurance purposes;
(m) A pension plan acting to determine the consumer's eligibility for plan
benefits or payments authorized by law or to investigate fraud;
(n) A person conducting a pre-sentence investigation in a criminal matter or
a probation officer using this information for supervision of an offender;
(o) A collections investigator or other person engaged in the collecting of
fees, fines, or restitution assessed in a court proceeding;
(p) A licensed hospital with which the consumer has or had a contract, or a
debtor-creditor relationship for the purposes of reviewing the account or collecting
the financial obligation owing for the contract, account, or debt;
(q) A law enforcement agency or its agents acting to investigate a crime or
conducting a criminal background check.
(12) (a) Fees for requesting a security freeze, temporarily lifting a security
freeze, and permanently removing a security freeze from consumer reports may be
charged only in accordance with this subsection (12).
(b) A consumer reporting agency may not charge a fee for a consumer's first
request to place a security freeze on his or her consumer report.
(c) Except as provided for in subsections (12)(a) and (12)(b) of this section, a
consumer reporting agency may charge a consumer a reasonable fee of no more
than ten dollars for:
(I) A temporary lift for a period of time or permanent removal of a security
freeze from the consumer report; or
(II) A subsequent request for a security freeze of the consumer report after
the consumer's first request for a security freeze has been permanently removed
from his or her consumer report.
(d) Except as provided for in subsections (12)(a) and (12)(b) of this section, a
consumer reporting agency may charge a fee not to exceed twelve dollars for
temporarily lifting a security freeze on the consumer report for a specific party.