§ 380-T — Security freeze

§ 380-t. Security freeze. (a) A consumer may request that a security\nfreeze be placed on his or her consumer credit report by sending a\nrequest in writing with confirmation of delivery requested or via\ntelephone, secure electronic means, or other methods developed by the\nconsumer credit reporting agency to a consumer credit reporting agency\nat an address, telephone number or secure website designated by such\nagency to receive such requests. Consumer credit reporting agencies\nshall have a secure website and a separately dedicated toll-free number\nto offer information, to process requests and deliver the services\nprovided for under this section.\n (b) A consumer credit reporting agency that receives from a consumer a\nrequest in accordance with subdivision (a) of this section shall,\nprovided such request is accompanied by proper identification, place a\nsecurity freeze on the consumer credit report of or relating to such\nconsumer no later than four business days after receiving such request,\nprovided further, however, that for requests received on or after\nJanuary first, two thousand nine, such consumer credit reporting agency\nshall place a security freeze on the consumer credit report of or\nrelating to such consumer no later than three business days after\nreceiving such request and for requests received on or after January\nfirst, two thousand ten, such consumer credit reporting agency shall\nplace a security freeze on the consumer credit report of or relating to\nsuch consumer no later than one business day after receiving such\nrequest. Nothing in this subdivision shall be construed to prevent a\nconsumer credit reporting agency from advising a third party that a\nsecurity freeze is in effect with respect to the consumer credit report\nof or relating to such consumer. No consumer credit reporting agency\nshall advise in any manner a third party, of the fact that the consumer\nrequesting the freeze is alleging to be the victim of domestic violence\nor identity theft, without the written authorization of the consumer.\n (c) The consumer credit reporting agency shall send a written\nconfirmation of the placement of a security freeze to the consumer\nwithin five business days of placing such freeze. Upon placing the\nsecurity freeze on the consumer credit report of or relating to such\nconsumer, the consumer credit reporting agency shall provide the\nconsumer with a unique personal identification number or password, or\nother device which shall only be used by the consumer when providing\nauthorization for the release of his or her consumer credit report for a\nspecific party or specific period of time. The unique personal\nidentification number or password, or other device to be used by the\nconsumer shall not be a social security number or a sequential portion\nthereof. Any use of the unique personal identification number or\npassword or other device other than provided for in this section is\nprohibited.\n (d) If the consumer wishes to allow his or her consumer credit report\nto be accessed for a specific party or a specific period of time while a\nfreeze is in place, he or she shall contact the consumer credit\nreporting agency via mail with confirmation of delivery, telephone,\nsecure electronic means or other method developed by such consumer\ncredit reporting agency pursuant to subdivision (f) of this section\nusing a point of contact designated by such consumer credit reporting\nagency, request that the freeze be temporarily lifted, and provide the\nfollowing:\n (1) proper identification;\n (2) the unique personal identification number or password provided by\nthe consumer credit reporting agency pursuant to subdivision (c) of this\nsection; and\n (3) the proper information regarding the party to which the consumer\ncredit report should be available or the time period for which the\nconsumer credit report shall be available to users of such report.\n (e) (1) A consumer credit reporting agency that receives a request\nfrom a consumer to temporarily lift a freeze on a consumer credit report\npursuant to subdivision (d) of this section, shall comply with the\nrequest: (i) no later than three business days after receiving such\nrequest; (ii) as of September first, two thousand nine, a consumer\ncredit reporting agency that receives a request via the use of a\ntelephone or secure electronic method provided by the agency, pursuant\nto subdivision (d) of this section, shall release a consumer's credit\nreport as requested by the consumer within fifteen minutes after the\nrequest is received by the consumer credit reporting agency.\n (2) A consumer credit reporting agency is not required to temporarily\nlift a security freeze within the time provided in subparagraph (ii) of\nparagraph one of this subdivision if:\n (i) the consumer fails to meet the requirements of subdivision (b) of\nthis section; or\n (ii) the consumer credit reporting agency's ability to temporarily\nlift the security freeze within fifteen minutes is prevented by:\n (A) an act of God, including fire, earthquakes, hurricanes, storms, or\nsimilar natural disaster or phenomena;\n (B) unauthorized or illegal acts by a third party, including\nterrorism, sabotage, riot, vandalism, labor strikes or disputes\ndisrupting operations, or similar occurrence;\n (C) operational interruption, including electrical failure,\nunanticipated delay in equipment or replacement part delivery, computer\nhardware or software failures inhibiting response time, or similar\ndisruption;\n (D) governmental action, including emergency orders or regulations,\njudicial or law enforcement action, or similar directives;\n (E) regularly scheduled maintenance, during other than normal business\nhours, of, or updates to, the consumer reporting agency's systems; or\n (F) commercially reasonable maintenance of, or repair to, the consumer\nreporting agency's systems that is unexpected or unscheduled.\n (f) A consumer credit reporting agency may develop procedures\ninvolving other secure methods of communication, including the use of\nthe internet, or other electronic media to receive and process a request\nfrom a consumer to temporarily lift a freeze on a consumer credit report\npursuant to subdivision (d) of this section in an expedited manner.\n (g) The department of state shall monitor the state of technology\nrelating to the means available to process requests for the lifting or\nremoval of a security freeze, and shall report to the legislature when\nit is determined that the technology to process requests for the lifting\nor removal of a security freeze in a shorter period of time than that\nset forth in subdivision (e) of this section is available.\n (h) A consumer credit reporting agency shall remove or temporarily\nlift a freeze placed on the consumer credit report of or relating to a\nconsumer only in the following cases:\n (1) upon consumer request, pursuant to subdivision (d) or (k) of this\nsection; or\n (2) if the consumer credit report of or relating to such consumer was\nfrozen due to a material misrepresentation of fact by the consumer. If a\nconsumer credit reporting agency intends to remove a freeze upon a\nconsumer credit report pursuant to this paragraph, the consumer credit\nreporting agency shall notify the consumer in writing, by first class\nmail, within three business days prior to removing the freeze on such\nconsumer credit report.\n (i) If a third party requests access to a consumer credit report on\nwhich a security freeze is in effect, and this request is in connection\nwith an application for credit or any other use, and the consumer does\nnot allow his or her consumer credit report to be accessed for that\nperiod of time, the third party may treat the application as incomplete.\n (j) If a consumer requests a security freeze, the consumer credit\nreporting agency shall disclose the process of placing and temporarily\nlifting a freeze, and the process for allowing access to information\nfrom such consumer credit report for a specific party or a period of\ntime while the freeze is in place.\n (k) (1) A security freeze shall remain in place until the consumer\nrequests, using a point of contact designated by the consumer credit\nreporting agency, that the security freeze be removed and provides the\nfollowing:\n (i) proper identification; and\n (ii) the unique personal identification number or password or similar\ndevice provided by the consumer credit reporting agency pursuant to\nsubdivision (c) of this section.\n (2) A consumer credit reporting agency shall remove a security freeze\nwithin three business days of receiving a request for removal from the\nconsumer pursuant to paragraph one of this subdivision.\n (l) A consumer credit reporting agency shall require proper\nidentification of the person making a request to place or remove a\nsecurity freeze.\n (m) The provisions of this section do not apply to the use of a\nconsumer credit report by any of the following:\n (1) a person or entity, or a subsidiary, affiliate, or agent of that\nperson or entity, or an assignee of a financial obligation owing by the\nconsumer to that person or entity, or a prospective assignee of a\nfinancial obligation owing by the consumer to that person or entity in\nconjunction with the proposed purchase of the financial obligation, with\nwhich the consumer has or had prior to assignment an account or\ncontract, including a demand deposit account, or to whom the consumer\nissued a negotiable instrument, for the purposes of reviewing the\naccount or collecting the financial obligation owing for the account,\ncontract, or negotiable instrument. For purposes of this paragraph,\n"reviewing the account" includes activities related to account\nmaintenance, monitoring, credit line increases, and account upgrades and\nenhancements;\n (2) a subsidiary, affiliate, agent, assignee, or prospective assignee\nof a person to whom access has been granted for purposes of facilitating\nthe extension of credit or other permissible use;\n (3) any state or local agency, law enforcement agency, court, private\ncollection agency, or person acting pursuant to a court order, warrant,\nor subpoena;\n (4) a child support agency acting pursuant to title iv-d of the social\nsecurity act (42 U.S.C. et seq.);\n (5) the state or its political subdivisions or its agents or assigns\nacting to investigate fraud or acting to investigate or collect\ndelinquent taxes or unpaid court orders or to fulfill any of its other\nstatutory responsibilities provided such responsibilities are consistent\nwith a permissible purpose under 15 U.S.C. section 1681b;\n (6) the use of credit information for the purposes of prescreening as\nprovided for by the federal fair credit reporting act;\n (7) any person or entity administering a credit file monitoring\nsubscription or similar service to which the consumer has subscribed; or\n (8) any person or entity for the purpose of providing a consumer with\na copy of his or her consumer credit report or score upon the request of\nsuch consumer.\n (n) No consumer credit reporting agency shall charge a fee to any\nconsumer for the placement of any security freeze, the removal of any\nsecurity freeze, the temporary lift of any security freeze for a\nspecific party or period of time, or the issuance of any replacement\npersonal identification number or password when the consumer fails to\nretain the personal identification number or password provided to such\nconsumer by such consumer credit reporting agency pursuant to\nsubdivision (c) of this section.\n (3)(i) Upon a breach of the security of the system of a consumer\ncredit reporting agency which includes any social security number, such\nagency shall offer to each consumer, whose information, including social\nsecurity number, was breached or is reasonably believed to have been\nbreached, reasonable identity theft prevention services and, if\napplicable, identify theft mitigation services for a period not to\nexceed five years at no cost to such consumers. Such agency shall\nprovide all information necessary for such consumers to enroll in such\nservices and shall include information on how such consumers can request\na security freeze. A consumer credit reporting agency shall not be\nrequired to offer such services if, after an appropriate investigation,\nthe agency reasonably determines that the breach of security is unlikely\nto result in harm to the consumers whose information has been breached.\n (ii) "Breach of the security of the system" as used in this paragraph\nshall have the same definition as in paragraph (c) of subdivision one of\nsection eight hundred ninety-nine-aa of this chapter.\n (o) If a security freeze is in place, a consumer credit reporting\nagency shall not change any of the following official information in a\nconsumer credit report without sending a written confirmation of the\nchange to the consumer within thirty days of the change being posted to\nthe file of or relating to such consumer: name, date of birth, social\nsecurity number, and address. Written confirmation is not required for\ntechnical modifications of the official information of or relating to\nsuch consumer, including name and street abbreviations, complete\nspellings, or transposition of numbers or letters. In the case of an\naddress change, the written confirmation shall be sent to both the new\naddress and to the former address.\n (p) The following entities are not required to place a security freeze\non a consumer credit report:\n (1) a consumer credit reporting agency that acts only as a reseller of\ncredit information by assembling and merging information contained in\nthe data base of another consumer credit reporting agency or multiple\nconsumer credit reporting agencies, and does not maintain a permanent\ndata base of credit information from which new consumer credit reports\nare produced. However, a consumer credit reporting agency acting as a\nreseller shall honor any security freeze placed on a consumer credit\nreport by another consumer credit reporting agency;\n (2) a check services or fraud prevention services company, which\nissues reports on incidents of fraud or authorizations for the purpose\nof approving or processing negotiable instruments, electronic funds\ntransfers, or similar methods of payments; or\n (3) a deposit account information service company, which issues\nreports regarding account closures due to fraud, substantial overdrafts,\nATM abuse, or similar negative information regarding a consumer, to\ninquiring banks or other financial institutions for use only in\nreviewing a consumer request for a deposit account at the inquiring bank\nor financial institution.\n (q) (1) Any time a consumer credit reporting agency is required to\nsend a summary of rights required under 15 U.S.C. section 1681g, to a\nconsumer residing in this state the following notice shall be included\nwith such summary of rights:\n "NEW YORK CONSUMERS HAVE THE RIGHT TO OBTAIN A SECURITY FREEZE.\n YOU HAVE A RIGHT TO PLACE A "SECURITY FREEZE" ON YOUR CREDIT REPORT,\nWHICH WILL PROHIBIT A CONSUMER CREDIT REPORTING AGENCY FROM RELEASING\nINFORMATION IN YOUR CREDIT REPORT WITHOUT YOUR EXPRESS AUTHORIZATION. A\nCONSUMER CREDIT REPORTING AGENCY IS PROHIBITED FROM CHARGING YOU A FEE\nFOR THE PLACEMENT, REMOVAL, OR TEMPORARY LIFT OF A SECURITY FREEZE, OR\nFOR THE ISSUANCE OF A REPLACEMENT PERSONAL IDENTIFICATION NUMBER (PIN)\nOR PASSWORD IN THE EVENT THAT YOU FAIL TO RETAIN THE ORIGINAL PIN OR\nPASSWORD PROVIDED TO YOU BY SUCH CONSUMER CREDIT REPORTING AGENCY. A\nSECURITY FREEZE MUST BE REQUESTED IN WRITING DELIVERY CONFIRMATION\nREQUESTED OR VIA TELEPHONE, SECURE ELECTRONIC MEANS, OR OTHER METHODS\nDEVELOPED BY THE CONSUMER CREDIT REPORTING AGENCY. THE SECURITY FREEZE\nIS DESIGNED TO PREVENT CREDIT, LOANS, AND SERVICES FROM BEING APPROVED\nIN YOUR NAME WITHOUT YOUR CONSENT. HOWEVER, YOU SHOULD BE AWARE THAT\nUSING A SECURITY FREEZE TO TAKE CONTROL OVER WHO GETS ACCESS TO THE\nPERSONAL AND FINANCIAL INFORMATION IN YOUR CREDIT REPORT MAY DELAY,\nINTERFERE WITH, OR PROHIBIT THE TIMELY APPROVAL OF ANY SUBSEQUENT\nREQUEST OR APPLICATION YOU MAKE REGARDING A NEW LOAN, CREDIT, MORTGAGE,\nGOVERNMENT SERVICES OR PAYMENTS, INSURANCE, RENTAL HOUSING, EMPLOYMENT,\nINVESTMENT, LICENSE, CELLULAR PHONE, UTILITIES, DIGITAL SIGNATURE,\nINTERNET CREDIT CARD TRANSACTION, OR OTHER SERVICES, INCLUDING AN\nEXTENSION OF CREDIT AT POINT OF SALE. WHEN YOU PLACE A SECURITY FREEZE\nON YOUR CREDIT REPORT, YOU WILL BE PROVIDED A PERSONAL IDENTIFICATION\nNUMBER OR PASSWORD TO USE IF YOU CHOOSE TO REMOVE THE FREEZE ON YOUR\nCREDIT REPORT OR AUTHORIZE THE RELEASE OF YOUR CREDIT REPORT TO A\nSPECIFIC PARTY OR FOR A PERIOD OF TIME AFTER THE FREEZE IS IN PLACE. TO\nPROVIDE THAT AUTHORIZATION YOU MUST CONTACT THE CONSUMER CREDIT\nREPORTING AGENCY AND PROVIDE ALL OF THE FOLLOWING:\n (1) THE PERSONAL IDENTIFICATION NUMBER OR PASSWORD;\n (2) PROPER IDENTIFICATION TO VERIFY YOUR IDENTITY; AND\n (3) THE PROPER INFORMATION REGARDING THE PARTY OR PARTIES WHO ARE TO\nRECEIVE THE CREDIT REPORT OR THE PERIOD OF TIME FOR WHICH THE REPORT\nSHALL BE AVAILABLE TO USERS OF THE CREDIT REPORT.\n A CONSUMER CREDIT REPORTING AGENCY MUST AUTHORIZE THE RELEASE OF YOUR\nCREDIT REPORT NO LATER THAN THREE BUSINESS DAYS AFTER RECEIVING THE\nABOVE INFORMATION. EFFECTIVE SEPTEMBER FIRST, TWO THOUSAND NINE, A\nCONSUMER CREDIT REPORTING AGENCY THAT RECEIVES A REQUEST VIA TELEPHONE\nOR SECURE ELECTRONIC METHOD SHALL RELEASE A CONSUMER'S CREDIT REPORT\nWITHIN FIFTEEN MINUTES WHEN THE REQUEST IS RECEIVED.\n A SECURITY FREEZE DOES NOT APPLY TO CIRCUMSTANCES IN WHICH YOU HAVE AN\nEXISTING ACCOUNT RELATIONSHIP AND A COPY OF YOUR REPORT IS REQUESTED BY\nYOUR EXISTING CREDITOR OR ITS AGENTS OR AFFILIATES FOR CERTAIN TYPES OF\nACCOUNT REVIEW, COLLECTION, FRAUD CONTROL OR SIMILAR ACTIVITIES.\n IF YOU ARE ACTIVELY SEEKING CREDIT, YOU SHOULD UNDERSTAND THAT THE\nPROCEDURES INVOLVED IN LIFTING A SECURITY FREEZE MAY SLOW YOUR\nAPPLICATION FOR CREDIT. YOU SHOULD PLAN AHEAD AND LIFT A FREEZE, EITHER\nCOMPLETELY IF YOU ARE SHOPPING AROUND, OR SPECIFICALLY FOR A CERTAIN\nCREDITOR, BEFORE APPLYING FOR NEW CREDIT. WHEN SEEKING CREDIT OR\nPURSUING ANOTHER TRANSACTION REQUIRING ACCESS TO YOUR CREDIT REPORT, IT\nIS NOT NECESSARY TO RELINQUISH YOUR PIN OR PASSWORD TO THE CREDITOR OR\nBUSINESS; YOU CAN CONTACT THE CONSUMER CREDIT REPORTING AGENCY DIRECTLY.\nIF YOU CHOOSE TO GIVE OUT YOUR PIN OR PASSWORD TO THE CREDITOR OR\nBUSINESS, IT IS RECOMMENDED THAT YOU OBTAIN A NEW PIN OR PASSWORD FROM\nTHE CONSUMER CREDIT REPORTING AGENCY."\n (2) If a consumer requests information about a security freeze, such\nconsumer shall be provided with the notice set forth in paragraph one of\nthis subdivision and with any other information necessary to place,\ntemporarily lift or permanently lift a security freeze, including but\nnot limited to the address, telephone number or point of contact at\nwhich the consumer credit reporting agency receives such requests.\n (r) When a consumer credit reporting agency erroneously releases a\nconsumer credit report subject to a security freeze or any information\ncontained in such consumer credit report, the consumer credit reporting\nagency shall send written notification to the affected consumer within\nthree business days following discovery or notification of such\nerroneous release. Such notification shall also inform the consumer of\nthe nature of the information released and identify and provide contact\ninformation for the recipient of such information or consumer credit\nreport.\n (s) Whenever there shall be a violation of this section, application\nmay be made by the attorney general in the name of the people of the\nstate of New York to a court or justice having jurisdiction by a special\nproceeding to issue an injunction, and upon notice to the defendant of\nnot less than five days, to enjoin and restrain the continuance of such\nviolations; and if it shall appear to the satisfaction of the court or\njustice that the defendant has, in fact, violated this section, an\ninjunction may be issued by such court or justice, enjoining and\nrestraining any further violation, without requiring proof that any\nperson has, in fact, been injured or damaged thereby. In any such\nproceeding, the court may make allowances to the attorney general as\nprovided in paragraph six of subdivision (a) of section eighty-three\nhundred three of the civil practice law and rules, and direct\nrestitution. Whenever the court shall determine that a violation of this\nsection has occurred, the court may impose a civil penalty of not more\nthan five thousand dollars for each violation. In connection with any\nsuch proposed application, the attorney general is authorized to take\nproof and make a determination of the relevant facts and to issue\nsubpoenas in accordance with the civil practice law and rules.\n