§ 13-45-201 — Security freeze.

(1) As used in this part:

(1)(a) "Security freeze" means a prohibition, consistent with the provisions of this section, on a consumer reporting agency's furnishing of a consumer's credit report to a third party intending to use the credit report to determine the consumer's eligibility for credit.
(1)(b) "Unique personal identifier" means a personal identification number, password, or other secure form of identity verification accepted by a consumer reporting agency and intended for use by a consumer to place, remove, or temporarily remove a security freeze in accordance with this chapter.
(2) (2)(a) A consumer may request a security freeze on a consumer's credit report by:
(2)(a)(i) submitting a request for a security freeze to the consumer reporting agency by:

(2)(a)(i)(A) certified mail to the postal address identified by the consumer reporting agency in accordance with Subsection (5); or
(2)(a)(i)(B) electronic means developed by the consumer reporting agency in accordance with Subsection (5); and
(2)(a)(ii) providing proper identification to the consumer reporting agency.
(2)(b) Upon receipt of a request described in Subsection (2)(a), the consumer reporting agency shall:
(2)(b)(i) place a security freeze on the consumer's credit report:

(2)(b)(i)(A) if the consumer submits the request by certified mail, as soon as practicable but no later than five business days after the business day on which the consumer reporting agency receives the request and the consumer's proper identification;
(2)(b)(i)(B) if the consumer submits the request by a contact method described in Subsection (5)(b)(ii) or (iii) that is not a mobile application, as soon as practicable but no later than 24 hours after the consumer reporting agency receives the request and the consumer's proper identification; or
(2)(b)(i)(C) if the consumer submits the request by mobile application, within 15 minutes after the consumer reporting agency receives the request and the consumer's proper identification;
(2)(b)(ii) provide the consumer a unique personal identifier, unless the consumer reporting agency previously provided the consumer a unique personal identifier; and
(2)(b)(iii) within five business days after the business day on which the consumer reporting agency places the security freeze, provide the consumer confirmation that the consumer reporting agency placed the security freeze.
(3) If a security freeze is in place, a consumer reporting agency may not release a consumer's credit report, or information from the credit report, to a third party that intends to use the information to determine a consumer's eligibility for credit without prior authorization from the consumer.
(4) (4)(a) Notwithstanding Subsection (3), a consumer reporting agency may communicate to a third party requesting a consumer's credit report that a security freeze is in effect on the consumer's credit report.
(4)(b) If a third party requesting a consumer's credit report in connection with the consumer's application for credit is notified of the existence of a security freeze under Subsection (4)(a), the third party may treat the consumer's application as incomplete.
(5) (5)(a) A consumer reporting agency shall develop a contact method to receive and process a consumer's request to place, remove, or temporarily remove a security freeze.
(5)(b) A contact method under Subsection (5)(a) shall include:
(5)(b)(i) a postal address;
(5)(b)(ii) an electronic contact method chosen by the consumer reporting agency, which may include the use of fax, Internet, or other electronic means; and
(5)(b)(iii) the use of telephone in a manner that is consistent with any federal requirements placed on the consumer reporting agency.
(6) A security freeze placed under this section may be removed only in accordance with Section 13-45-202.
(7) (7)(a) The time requirement described in Subsection (2)(b)(i)(B) or (C), as applicable, does not apply if the consumer reporting agency's ability to place the security freeze is prevented by:
(7)(a)(i) an act of God, including fire, earthquakes, hurricanes, storms, or similar natural disaster or phenomena;
(7)(a)(ii) unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrence;
(7)(a)(iii) operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruption;
(7)(a)(iv) governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar directives;
(7)(a)(v) regularly scheduled maintenance, during other than normal business hours, of, or updates to, the consumer reporting agency's systems; or
(7)(a)(vi) commercially reasonable maintenance of, or repair to, the consumer reporting agency's systems that is unexpected or unscheduled.
(7)(b) In the event of a circumstance described in Subsection (7)(a), the consumer reporting agency shall place the security freeze as soon as practicable.

Legislative History

Amended by Chapter 36, 2018 General Session