44-1698

44-1698. Security freeze on credit reports and
credit scores; fees; definitions

A. A consumer may request in writing or in a form acceptable to the consumer
reporting agency that a consumer reporting agency place a security freeze on the
consumer's credit report. If a security freeze is in place, a consumer reporting agency
shall not release a consumer's credit report or consumer's credit score to a third party
without the consumer's prior express authorization. This subsection does not prevent a
consumer reporting agency from advising a specific party that a security freeze is in
effect with respect to the consumer's credit report.

B. A consumer reporting agency shall place a security freeze on a consumer's credit
report not later than ten business days after receiving a written request from the
consumer.

C. The consumer reporting agency shall send a written confirmation of the security
freeze to the consumer within ten business days after placing the security freeze on the
consumer's credit report and shall provide the consumer with a unique personal
identification number or password, other than the consumer's social security number, that
the consumer may use to provide authorization for the release of the consumer's credit
report for a specific period of time and to remove the security freeze.

D. A security freeze remains in effect until the consumer requests that the
security freeze be removed or temporarily lifted as provided in this section. A consumer
may request that a security freeze be removed or temporarily lifted by mail, telephone,
internet or other electronic contact method in a form acceptable to the consumer
reporting agency. A consumer reporting agency shall require proper identification of any
person who makes a request to place or remove a security freeze.

E. On requesting removal, the consumer shall provide the following information:

1. Proper identification.

2. The unique personal identification number or password that the consumer
reporting agency provided to the consumer.

F. On requesting a temporary lift to allow a credit report to be accessed for a
specific period of time, the consumer shall contact the consumer reporting agency and
shall request that the security freeze be temporarily lifted and shall provide the
following information:

1. Proper identification.

2. The unique personal identification number or password that the consumer
reporting agency provided to the consumer.

3. The proper information regarding the specific time period for which the credit
report shall be available to users of the credit report.

G. A consumer reporting agency shall remove or temporarily lift a security freeze
from a consumer's credit report within:

1. Three business days after receiving the consumer's request for the removal or
temporary lift by mail.

2. Fifteen minutes after receiving the consumer's request through the use of
telephone, internet or other electronic contact method in a form acceptable to the
consumer reporting agency, during normal business hours. The consumer reporting agency is
not required to remove or temporarily lift the security freeze within the fifteen minute
time limit if the agency's ability is prevented by any of the following:

(a) An act of God, including fire, earthquakes, hurricanes, storms or similar
natural disaster or phenomena.

(b) Unauthorized or illegal acts by a third party, including terrorism, sabotage,
riot, vandalism, labor strikes or disputes disrupting operations or similar occurrence.

(c) Operational interruption, including electrical failure, unanticipated delay in
equipment or replacement part delivery, computer hardware or software failures inhibiting
response time or similar disruption.

(d) Governmental action, including emergency orders or regulations, judicial or law
enforcement action or similar directives.

(e) Regularly scheduled maintenance, during other than normal business hours of, or
updates to, the consumer reporting agency's systems.

(f) Commercially reasonable maintenance of, or repair to, the consumer reporting
agency's systems that is unexpected or unscheduled.

(g) Receipt of a removal or temporary lift request outside of normal business
hours.

H. A consumer reporting agency shall remove or temporarily lift a security freeze
placed on a consumer's credit report only in the following cases:

1. If the consumer requests removal pursuant to subsection E or a temporary lift
pursuant to subsection F.

2. If the consumer's credit report was frozen as a result of a material
misrepresentation of fact. If a consumer reporting agency intends to remove a security
freeze on a consumer's credit report pursuant to this paragraph, the consumer reporting
agency shall notify by mail, telephone, internet or other electronic contact method the
consumer before removing the security freeze on the consumer's credit report.

I. When a consumer requests a security freeze, the consumer reporting agency shall
disclose the process for placing and for removing or temporarily lifting a freeze and the
process for allowing access to information from the consumer's credit report for a
specific period of time while the security freeze is in place.

J. If a third party requests access to a credit report on which a security freeze
is in effect, the request is in connection with an application for credit or any other
use and the consumer does not allow the consumer's credit report to be accessed for a
specific period of time, the third party may treat the application as incomplete.

K. A consumer reporting agency may charge a five dollar fee for each security
freeze, removal of the freeze or temporary lift of the freeze for a period of time on the
consumer's credit report. A consumer reporting agency shall not charge a fee to a victim
of identity theft who submits a valid police report that alleges a violation of section
13-2008, 13-2009 or 13-2010.

L. A consumer reporting agency may charge a five dollar fee if the consumer fails
to retain the original unique personal identification number or password provided by the
consumer reporting agency and the consumer reporting agency must reissue the unique
personal identification number or password or provide a new unique personal
identification number or password to the consumer.

M. If a security freeze is in place, a consumer reporting agency shall not change a
consumer's name, date of birth, social security number or address in the consumer's
credit report without sending a written confirmation of the change to the consumer within
thirty days after the change is posted to the consumer's file. Written confirmation is
not required for technical modifications of a consumer's official information, including
name and street abbreviations, complete spellings or transposition of numbers or letters.
For the purposes of address changes, the consumer reporting agency shall send the written
confirmation to both the new address and the former address.

N. This section does not apply to the use of a credit report or credit score by any
of the following:

1. A person, a subsidiary, affiliate, agent or subcontractor of that person, an
assignee of a financial obligation owed by the consumer to that person or a prospective
assignee of a financial obligation owed by the consumer to that person in conjunction
with the proposed purchase of the financial obligation with which the consumer has or had
before assignment an account or contract, including a demand deposit account, or to whom
the consumer issued a negotiable instrument, for the purposes of reviewing the account or
collecting the financial obligation owed for the account, contract or negotiable
instrument. For the purposes of this paragraph, "reviewing the account" includes
activities that are related to account maintenance, monitoring, credit line increases and
account upgrades and enhancements.

2. A subsidiary, affiliate, agent, assignee or prospective assignee of a person to
whom access has been granted under this section for the purpose of facilitating the
extension of credit or other permissible use.

3. Any state or local agency, law enforcement agency, trial court or private
collection agency acting pursuant to a court order, warrant or subpoena.

4. A child support agency acting pursuant to title 25, chapter 3, article 2 or
title IV-D of the social security act.

5. The department of health services or its agents or assigns acting to investigate
fraud.

6. The department of revenue or its agents or assigns acting to investigate or
collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory
responsibilities.

7. The department of transportation or its agents or assigns acting to investigate
or collect delinquent taxes or unpaid court orders or to fulfill any of its other
statutory responsibilities.

8. The administrative office of the courts to conduct audits or investigate fraud
or for applicant screening.

9. Any agency or entity for the purposes of prescreening or postscreening as
provided for by the federal fair credit reporting act (15 United States Code section
1681b).

10. Any person or entity that administers a credit file monitoring subscription
service to which the consumer has subscribed.

11. Any person or entity for the purpose of providing a consumer with a copy of the
consumer's credit report or consumer's credit score on the consumer's request.

12. Except as otherwise provided by law, a person setting or adjusting a rate or
claim or underwriting for insurance purposes.

13. Any person who uses a consumer reporting agency's database or file that consists
entirely of information concerning, and is used solely for, one or more of the following:

(a) Criminal record information.

(b) Fraud prevention or detection.

(c) Tenant screening.

(d) Employment screening.

14. Any state or federally regulated bank or financial institution for checking,
savings and investment accounts.

O. The following entities are not required to place a security freeze on a credit
report:

1. A check services or fraud prevention services company that issues reports on
incidents of fraud or authorizations for the purpose of approving or processing
negotiable instruments, electronic funds transfers or similar methods of payments.

2. A deposit account information service company that issues reports regarding
account closures due to fraud, substantial overdrafts, automated teller machine abuse or
similar negative information regarding a consumer to inquiring banks or financial
institutions for use only in reviewing a consumer request for a deposit account at the
inquiring bank or financial institution.

3. A consumer reporting agency that acts only as a reseller of credit information
by assembling and merging information contained in the database of another consumer
reporting agency or multiple consumer reporting agencies and that does not maintain a
permanent database of credit information from which new credit reports or credit scores
are produced.

P. An act or practice in violation of this section is an unlawful practice under
section 44-1522 and is subject to enforcement through a private action and by the
attorney general. Injunctive relief may be sought to prevent future violations of this
section. The remedies provided in this section are not intended to be the exclusive
remedies available to a consumer. This subsection does not apply to subsection G,
paragraph 2 of this section.

Q. For the purposes of this section:

1. "Proper identification" means information that is generally deemed to be
sufficient to identify a person under the circumstances.

2. "Security freeze" means a notice that is placed in a consumer's credit report at
the request of the consumer and that prohibits the consumer reporting agency from
releasing the consumer's credit report without the express authorization of the consumer.