(a) A Tennessee consumer may place a security freeze on the consumer report of the Tennessee consumer by making a request in writing by certified mail. Beginning on January 31, 2009, a credit reporting agency shall make available an electronic method for requesting a security freeze. A security freeze shall prohibit the consumer reporting agency from releasing the requesting party's consumer report or credit score relating to the extension of credit without the express authorization of the Tennessee consumer. Nothing in this section shall prevent a consumer reporting agency from advising a third party that a security freeze is in effect with respect to a particular consumer report. (b) A consumer reporting agency shall place a security freeze on a consumer report no later than three (3) business days after receiving the written or electronic request from the Tennessee consumer. (c) The consumer reporting agency shall send a written confirmation of the security freeze to the Tennessee consumer within ten (10) business days of placing the security freeze on the consumer report, and shall provide the Tennessee consumer with a unique personal identification number or password, other than the Tennessee consumer's federal social security number, to be used by the Tennessee consumer when providing authorization for the release of the consumer report for a specific period of time or for permanently removing the security freeze. (d) If the Tennessee consumer wishes to allow the consumer report to be accessed for a specific period of time while a freeze is in place, the Tennessee consumer shall contact the consumer reporting agency, request that the freeze be temporarily lifted, and provide the following: (1) Proper identification; (2) The unique personal identification number or password provided by the consumer reporting agency to the Tennessee consumer pursuant to this section; and (3) The information requested by the consumer reporting agency about the period for which the consumer report is to be available. (e) A consumer reporting agency shall develop procedures involving the use of telephone, the Internet, or other electronic method to receive and process a request from a Tennessee consumer to temporarily lift a freeze on a credit report pursuant to this section in an expedited manner. A consumer reporting agency may develop procedures involving the use of facsimile for this purpose. (f) A consumer reporting agency shall comply with a request to temporarily lift a freeze previously placed on a consumer report no later than fifteen (15) minutes after receiving the request through an electronic contact method in accordance with this section and the request is received between six o'clock a.m. (6:00 a.m.) and nine-thirty p.m. (9:30 p.m.), seven (7) days per week, eastern or central standard or daylight time as applicable to the consumer. In requesting a temporary removal of the security freeze, a Tennessee consumer shall provide both of the following: (1) Proper identification; and (2) The unique personal identification number or password provided by the consumer reporting agency to the Tennessee consumer pursuant to this section. (g) A consumer reporting agency is not required to temporarily lift a security freeze within the time provided in subsection (f) if: (1) The consumer fails to meet the requirements of subsection (d); or (2) The consumer reporting agency's ability to temporarily lift the security freeze within fifteen (15) minutes is prevented by: (A) An act of God, including fire, earthquakes, hurricanes, storms, or similar natural disaster or phenomenon; (B) Unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrence; (C) Operational interruption including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruption; (D) Governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar directives; (E) Regularly scheduled maintenance, during other than normal business hours, of, or updates to, the consumer reporting agency's systems; or (F) Commercially reasonable maintenance of or repair to, the consumer reporting agency's systems that is unexpected or unscheduled. (h) If a third party requests access to a consumer report on which a security freeze is in effect and the Tennessee consumer does not allow the third party access to the consumer report, the third party may treat any applicable credit application made by the consumer as incomplete. (i) If a Tennessee consumer requests a security freeze pursuant to this section, the consumer reporting agency shall disclose to the Tennessee consumer the process of placing and temporarily lifting a security freeze and the process for allowing access to information from the consumer report for a specific period of time while the security freeze is in place. (j) Except as provided in subsections (d), (e), and (f), a security freeze shall remain in place until the Tennessee consumer requests that the security freeze be removed permanently. A consumer reporting agency shall permanently remove a security freeze no later than two (2) business days from the receipt of a request by the agency when a Tennessee consumer makes the request by means involving the use of telephone, the Internet, or other electronic media as provided by the consumer reporting agency. In making the request, the Tennessee consumer shall provide both of the following: (1) Proper identification; and (2) The unique personal identification number or password provided by the consumer reporting agency to the Tennessee consumer pursuant to this section. (k) If a security freeze is in place, a consumer credit reporting agency shall not change any of the following official information in a consumer credit report without sending a written confirmation of the change to the consumer not later than thirty (30) days of the change being posted to the consumer's file: name, date of birth, social security number, and address. Written confirmation is not required for technical modifications of a consumer's official information, including name and street abbreviations, complete spellings or transposition of numbers or letters. In the case of an address change, the written confirmation shall be sent to both the new address and to the former address. (l) A consumer report agency shall not charge a Tennessee consumer to place, temporarily lift, or permanently remove a security freeze. (m) This section, including the security freeze, does not apply to the use of a consumer report by the following: (1) A person, or that person's subsidiary, affiliate, agent or assignee, if the Tennessee consumer has an account, contract, or debtor-creditor relationship with that person, for the purposes of reviewing the account, collecting the financial obligation of the consumer, fraud control or extending additional credit to the Tennessee consumer. For purposes of this subdivision (m)(1), "reviewing the account" includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements; (2) A subsidiary, affiliate, agent or assignee of a party or parties for whom a security freeze has been temporarily lifted pursuant to this section for the purpose of facilitating the extension of credit or other permissible use; (3) Any person, including, but not limited to, a law enforcement entity, collections officer or private collection agency, acting pursuant to a court order, warrant or subpoena authorizing the use of the consumer report, or acting pursuant to a civil investigative demand or request for consumer protection information; (4) Any department or division of the state that is acting to investigate a child support case, medicaid or TennCare fraud, delinquent taxes or assessments, unpaid court orders or settlements of any sort or type, or to fulfill any of their statutory or other duties; (5) For the purposes of prescreening as provided by the federal Fair Credit Reporting Act, codified in 15 U.S.C. § 1681 ; (6) Any person for the purpose of providing a credit file monitoring subscription service to which the Tennessee consumer has subscribed; (7) A consumer reporting agency for the sole purpose of providing a Tennessee consumer with a copy of the consumer report upon the Tennessee consumer's request; (8) Any person or entity for the purpose of setting or adjusting a rate, adjusting a claim, or underwriting for insurance purposes; (9) A pension plan acting to determine the Tennessee consumer's eligibility for plan benefits or payments authorized by law or to investigate fraud; (10) Any law enforcement entity or its agent acting to investigate a crime or civil law violation, conduct a criminal background check, conduct a presentence investigation in a criminal matter or use the information for supervision of a paroled offender; (11) A licensed hospital with which the Tennessee consumer has or had a contract or a debtor-creditor relationship for the purpose of reviewing the account or collecting the financial obligation owing for the contract, account, or debt; or (12) An attorney at law duly licensed in Tennessee representing any person, subsidiary, affiliate, agent, assignee, department, division, or other entity to whom this section does not apply. (n) The following entities are not subject to the requirements of this section; provided, however, that each such entity shall be subject to any security freeze placed on a consumer report by a consumer reporting agency from which it obtains information: (1) A consumer reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or multiple consumer credit reporting agencies, and does not maintain a permanent data base of credit information from which new consumer credit reports are produced; however, a consumer reporting agency acting as a reseller shall honor any security freeze placed on a consumer credit report by another consumer reporting agency; (2) A check services or fraud prevention services company that issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments; (3) A deposit account information service company that issues reports regarding account closures due to fraud, substantial overdrafts, ATM abuse, or similar negative information regarding a Tennessee consumer, to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution; and (4) A consumer reporting agency's database or file that consists of information concerning, and used for, one (1) or more of the following: criminal record information, fraud prevention or detection, personal loss history information, and employment, tenant, or individual background screening. (o) Exclusive of all other private and nongovernmental remedies that may be imposed, any person who fails to comply with any requirement imposed under this section with respect to any Tennessee consumer is liable to that Tennessee consumer in an amount equal to the sum of: (1) (A) Any ascertainable losses sustained by the Tennessee consumer as a result of the failure, or damages of not less than one hundred dollars ($100) nor more than one thousand dollars ($1,000), whichever is greater, in addition to any other governmental remedies available at law; or (B) In the case of liability of a natural person for obtaining a consumer report under false pretenses without a permissible purpose, ascertainable losses sustained by the consumer as a result of the failure or one thousand dollars ($1,000), whichever is greater, in addition to any other governmental remedies available at law; (2) An amount of punitive damages that the court may allow in a private right of action or other nongovernmental action; and (3) In the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorneys' fees as determined by the court. (p) Any person who obtains a consumer report, requests a security freeze, requests the temporary lift of a freeze, or the removal of a security freeze from a consumer reporting agency under false pretenses or in an attempt to violate federal or state law shall be liable to the consumer reporting agency for ascertainable losses sustained by the consumer reporting agency or one thousand dollars ($1,000), whichever is greater, in addition to any other governmental remedies available at law. (q) In addition to any other governmental remedies available at law, any person who is negligent in failing to comply with any requirement imposed under this section with respect to any Tennessee consumer is liable to that Tennessee consumer in an amount equal to the sum of: (1) Any ascertainable losses sustained by the Tennessee consumer as a result of the failure; and (2) In the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorneys' fees as determined by the court. (r) Upon a finding by the court that an unsuccessful, nongovernmental pleading, motion, or other paper filed in connection with an action under this section was filed in bad faith or for purposes of harassment, the court shall award to the prevailing party attorneys' fees reasonable in relation to the work expended in responding to the pleading, motion, or other paper. (s) Notwithstanding any other provision of this section, the sole power to enforce violations of subsection (f) shall be with the attorney general and reporter.