§ 24-5-24-7 — Releasing the consumer report upon authorization; developing secure procedures; time requirements; exceptions

(a) Except as provided in section 10 of this
chapter, if a security freeze has been placed on a consumer's consumer
report, the consumer reporting agency that placed the security freeze
on the consumer report shall not release the consumer's consumer
report unless the consumer authorizes the consumer reporting agency
to:
(1) release the consumer's consumer report to one (1) or more
specified third parties; or
(2) temporarily lift the security freeze for a specified period.
(b) A consumer who seeks to authorize the release of the consumer's
consumer report under subsection (a)(1) or (a)(2) shall request the
release by contacting the consumer reporting agency by any method:
(1) described in section 5(a) of this chapter; or
(2) developed by the consumer reporting agency under subsection
(d).
(c) A request by a consumer under subsection (b) must include the
following:
(1) Information sufficient to identify the consumer, as specified
by the consumer reporting agency in the instructions provided to
the consumer under section 6(a)(2) of this chapter.
(2) The unique personal identification number or password
assigned to the consumer under section 6(a)(1) or 6(a)(3) of this
chapter.
(3) If the consumer seeks to authorize the release of the
consumer's consumer report under subsection (a)(1), information
sufficient to identify the parties to whom the consumer report is
to be released, as specified by the consumer reporting agency in
the instructions provided to the consumer under section 6(a)(2) of
this chapter.
(4) If the consumer seeks to authorize the consumer reporting
agency to temporarily lift a security freeze under subsection
(a)(2), the period during which the security freeze is to be
temporarily lifted.
(d) Not later than January 1, 2009, a consumer reporting agency
shall develop and make available to consumers secure procedures to
authorize the release of a consumer's consumer report under subsection
(a)(1), or to authorize the temporary lifting of a security freeze under
subsection (a)(2), within fifteen (15) minutes of receiving a request
under subsection (b), by any of the following methods:
(1) Telephone.
(2) The Internet.
(3) Other electronic media, if provided by the consumer reporting
agency.
The procedures developed by a consumer reporting agency under this
subsection must require the consumer to provide the information set
forth in subsection (c).
(e) A consumer reporting agency that receives a request from a
consumer under this section shall comply with the request within the
following time frames:
(1) Not later than three (3) business days after receiving the
request, if the consumer makes the request by the method
described in section 5(a)(1) of this chapter.
(2) Not later than fifteen (15) minutes after receiving the request,
if the consumer makes the request using the method described in
section 5(a)(2) of this chapter or by any method developed by the
consumer reporting agency under subsection (d). However, a
consumer reporting agency is not required to comply with a
consumer's request within the fifteen (15) minute time frame set
forth in this subdivision if:
(A) the consumer does not provide one (1) or more of the items
listed in subsection (c); or
(B) the consumer reporting agency's ability to comply with the
request within the fifteen (15) minute time frame set forth in
this subdivision is prevented by any of the following:
(i) An act of God, including fire, an earthquake, a hurricane,
a storm, or a similar natural disaster or phenomenon.
(ii) Unauthorized or illegal acts by a third party, including
terrorism, sabotage, riot, vandalism, labor strikes or disputes
disrupting operations, or similar occurrences.
(iii) An operational interruption, including an electrical
failure, an unanticipated delay in the delivery of equipment
or replacement parts, computer hardware or software failures
inhibiting response time, or similar disruptions.
(iv) A governmental action, including an emergency order or
regulation, a judicial action, a law enforcement action, or a
similar directive.
(v) Regularly scheduled maintenance of, or updates to, the
consumer reporting agency's computer systems, if the
maintenance activities or updates occur other than during
normal business hours.
(vi) Commercially reasonable maintenance of, or repairs to,
the consumer reporting agency's computer systems, if the
maintenance activities or repairs are unexpected or are
necessitated by unanticipated conditions or malfunctions.
(vii) For a request made by telephone, receipt of a request
under this section other than during the consumer reporting
agency's normal business hours, including any extended
business hours observed by the consumer reporting agency.
The exemption provided by this item does not apply to a
request made by a consumer through the Internet or other
electronic media. A consumer reporting agency must comply
with a request made by a consumer through the Internet or
other electronic media within the fifteen (15) minute time
frame set forth in this subdivision, even if the request is made
at a time other than during the consumer reporting agency's
normal or extended business hours.

Legislative History

As added by P.L.104-2007, SEC.1.