1. A consumer may request that a consumer credit reporting agency place a security freeze on that consumer's credit report, if that request is made:
(1) In writing, where delivery by standard U.S. Postal Service mail service shall be sufficient; or
(2) By other reliable means, including, but not limited to, internet, telephone, facsimile, or other electronic means if any such other means are provided by the consumer credit reporting agency; and
(3) Proper identification is presented to adequately identify the requestor as the consumer subject to the credit report.
2. A consumer credit reporting agency shall honor a consumer's request for a security freeze within five business days of receipt of such request. A consumer credit reporting agency may assess a fee of up to five dollars for the first request by a consumer to place a security freeze, and up to ten dollars for any subsequent request to place a security freeze made by the same consumer, except that at no time shall a fee be assessed for a request to place a security freeze if the request is accompanied by an incident report as defined under section 595.232 * .
3. A consumer credit reporting agency shall, within ten business days of placing a security freeze on the consumer's credit report, send the consumer:
(1) Written confirmation of compliance with the consumer's request;
(2) Instructions explaining the process of placing, temporarily lifting, or permanently removing a security freeze and the process for allowing access to information from the consumer's credit report for a specific requestor or period of time;
(3) A unique personal identification number or password to be used by the consumer to temporarily lift or permanently remove the security freeze or designate a specific requestor for receipt of the credit report despite the security freeze.
4. A consumer credit reporting agency shall not furnish a credit report to any person if the consumer who is subject to the credit report has requested a security freeze be placed on that report unless the credit report:
(1) Is requested by the consumer who is subject to the report;
(2) Is furnished under a court order;
(3) Is furnished during a period in which the consumer has temporarily lifted the freeze;
(4) Is requested for the purposes of prescreening as provided by the Fair Credit Reporting Act under 15 U.S.C. 1681, et seq.;
(5) Is requested by a child support enforcement agency;
(6) Is requested for use in setting or adjusting a rate, underwriting, adjusting a claim, or servicing a policy for insurance purposes;
(7) Is requested by a specific person, or the subsidiary, affiliate, agent, or assignee of such person, whom the consumer has identified as eligible for receipt of the credit report under subsection 6 of this section, despite the consumer's request for a security freeze;
(8) Is furnished to a person, or the subsidiary, affiliate, agent, or assignee of such person, with whom the consumer has a debtor-creditor relationship for the purpose of account review or collecting the financial obligation owing for the account contract or debt;
(9) Is requested by the state or its agents or assigns for the purpose of investigating fraud or investigating or collecting delinquent taxes to the extent consistent with a permissible purpose under 15 U.S.C. 1681; or
(10) Is requested by a person or entity administering a credit file monitoring service or similar service to which the consumer has subscribed.
5. If a security freeze is in place, a consumer credit reporting agency shall not change any of the following official information in a consumer credit report without sending a written confirmation of the change to the consumer within thirty days of the change being posted to the consumer's file: name, date of birth, Social Security number, and address. Written confirmation is not required for technical modifications of a consumer's official information, including name and street abbreviations, complete spellings, or transposition of numbers or letters. In the case of an address change, the written confirmation shall be sent to both the new address and to the former address.
6. A consumer may request that the consumer credit reporting agency temporarily lift a security freeze for a specific requestor or period of time despite the consumer request for a security freeze under subsection 1 of this section, if that request is made:
(1) In writing, where delivery by standard U.S. Postal Service mail service shall be sufficient; or
(2) By other reliable means, including, but not limited to, internet, telephone, facsimile, or other electronic means if any such other means are provided by the consumer credit reporting agency; and
(3) Proper identification is presented to adequately identify the requestor as the consumer subject to the credit report, which shall include the unique personal identification number or password issued to the consumer under subsection 3 of this section; and
(4) The time period is specified for which the freeze shall be temporarily lifted.
7. (1) A consumer credit reporting agency shall temporarily lift a security freeze within fifteen minutes of receiving such a request from a consumer, if that request is received during normal business hours and is made in accordance with subdivisions (2), (3), and (4) of subsection 6 of this section. If such a lift request is received outside of normal business hours, the consumer credit reporting agency shall lift the security freeze within fifteen minutes of the start of the next normal business day.
(2) A consumer credit reporting agency shall temporarily lift a security freeze within three days of receiving such a request from a consumer, if that request is made in accordance with subdivisions (1), (3), and (4) of subsection 6 of this section.
(3) The time frame in which a consumer credit reporting agency shall comply with a request to lift a security freeze under this subsection may be extended in the event of an act of God, an unauthorized or illegal act by a third party, operational interruption due to electrical failure or hardware or software failure, government action, or reasonable unexpected maintenance of the agency's systems, provided that the lifting of a security freeze shall occur within a reasonable time after resumption of normal business operations.
8. A consumer credit reporting agency shall permanently remove a security freeze within three days of receiving such a request from a consumer, if that request is made:
(1) In writing, where delivery by standard U.S. Postal Service mail service shall be sufficient; or
(2) By reliable means, including, but not limited to, internet, telephone, facsimile, or other electronic means if any such other means are provided by the consumer credit reporting agency; and
(3) Proper identification is presented to adequately identify the requestor as the consumer subject to the credit report, which shall include the unique personal identification number or password issued to the consumer under subsection 3 of this section.
9. A consumer credit reporting agency may assess a fee of up to five dollars to temporarily lift a security freeze, except that at no time shall a fee be assessed for a request to temporarily lift a security freeze that was placed in conjunction with an incident report under subsection 2 of this section. No fee shall be assessed for a request to permanently remove a security freeze.
10. At any time a consumer is required to receive a summary of rights under 15 U.S.C. Section 1681g(d), the following notice shall be included: