§489P-3  Security freeze by consumer
reporting agency.  (a)  Any consumer who is a resident of this State may
place a security freeze on the consumer's credit report.  A consumer credit
reporting agency shall not charge a victim of identity theft a fee for placing,
lifting, or removing a security freeze on a credit report but may charge any
other consumer a fee not to exceed $5 for each request by the consumer to
place, lift, or remove a security freeze from the consumer's credit report.



A consumer who is a resident of this State and
has been the victim of identity theft may place a security freeze on the
consumer's credit report by making a request in writing by certified mail to a
consumer credit reporting agency, at an address designated by the agency to
receive such requests, with a valid copy of a police report, investigative
report, or complaint the consumer has filed with a law enforcement agency about
unlawful use of the consumer's personal information by another person.  A
consumer who has not been the victim of identity theft may place a security
freeze on the consumer's credit report by making a request in writing by
certified mail to a consumer credit reporting agency.



A security freeze shall prohibit the consumer
credit reporting agency from releasing the consumer's credit report or any
information from it without the express authorization of the consumer.  This
subsection shall not prevent a consumer credit reporting agency from advising a
third party that a security freeze is in effect with respect to the consumer's
credit report.



(b)  A consumer reporting agency shall place a
security freeze on a consumer's credit report no later than five business days
after receiving a written request from the consumer.



(c)  The consumer reporting agency shall send a
written confirmation of the security freeze to the consumer within ten business
days of placing the security freeze and shall provide the consumer with a
unique personal identification number or password, other than the consumer's
social security number, to be used by the consumer when providing authorization
for the release of the consumer's credit report for a specific party, parties,
or period of time.



(d)  If the consumer wishes to allow access to
the consumer's credit report for a specific party, parties, or period of time
while a freeze is in place, the consumer shall contact the consumer reporting
agency at a point of contact designated by the agency using the procedures that
may be developed by the consumer reporting agency, request that the freeze be
temporarily lifted, and provide the following:



(1)  Clear and proper identification;



(2)  The unique personal identification number or
password provided by the consumer reporting agency; and



(3)  Clear and proper information regarding the third
party, parties, or time period for which the report shall be available to users
of the credit report.



(e)  A consumer reporting agency may develop
procedures involving the use of telephone, fax, the Internet, or other
electronic media to receive and process a request from a consumer to
temporarily lift a freeze on a credit report in an expedited manner.



(f)  A consumer reporting agency that receives
a request from a consumer to temporarily lift a freeze on a credit report shall
comply with the request no later than three business days after receiving the
request.



(g)  A consumer reporting agency shall remove
or temporarily lift a freeze placed on a consumer's credit report only in the
following cases:



(1)  Upon consumer request; or



(2)  When the consumer's credit report was frozen due
to a material misrepresentation of fact by the consumer.



If a consumer reporting agency intends to remove a
freeze upon a consumer's credit report pursuant to this subsection, the
consumer reporting agency shall notify the consumer in writing prior to
removing the freeze on the consumer's credit report.



(h)  If a third party requests access to a
credit report on which a security freeze is in effect and this request is in
connection with an application for credit or any other use and the consumer
does not allow the consumer's credit report to be accessed by that specific
party or for that period of time, the third party may treat the application as
incomplete.



(i)  If a consumer requests a security freeze,
the consumer reporting agency shall disclose to the consumer the process of
placing and temporarily lifting a security freeze and the process for allowing
access to information from the consumer's credit report for a specific party,
parties, or period of time while the security freeze is in place.



(j)  A security freeze shall remain in place
until the consumer requests that the security freeze be removed.  A consumer
reporting agency shall remove a security freeze within three business days of
receiving a request for removal at a point of contact designated by the agency
using procedures that may be developed by the consumer reporting agency;
provided that the consumer shall provide the following:



(1)  Clear and proper identification; and



(2)  The unique personal identification number or
password provided by the consumer reporting agency pursuant to subsection (c).



(k)  A consumer reporting agency shall require
clear and proper identification of the person making a request to place or
remove a security freeze.



(l)  The provisions of this section, including
the security freeze, do not apply to the use of a consumer’s credit report by
the following:



(1)  A person, or the person's subsidiary, affiliate,
agent, or assignee with which the consumer has or, prior to assignment, had an
account, contract, or debtor-creditor relationship for the purposes of
reviewing the account or collecting the financial obligation owing for the
account, contract, or debt, or extending credit to a consumer with a prior or
existing account, contract, or debtor-creditor relationship.  For purposes of
this subsection, "reviewing the account" includes activities related
to account maintenance, monitoring, credit line increases, and account upgrades
and enhancements;



(2)  A subsidiary, affiliate, agent, assignee, or
prospective assignee of a person to whom access has been granted for purposes
of facilitating the extension of credit or other permissible use;



(3)  Any person acting pursuant to a court order,
warrant, or subpoena;



(4)  A child support enforcement agency when
investigating a child support case pursuant to Title IV-D of the Social
Security Act (42 U.S.C. sections 651 to 669b);



(5)  The department of the attorney general or county
prosecuting attorneys or their agents or assignees acting to investigate
medicaid fraud;



(6)  The department of taxation, county taxing
authorities, or any of their agents or assignees, acting to investigate or
collect delinquent taxes or assessments, including interest and penalties,
unpaid court orders, or to fulfill any of their other statutory or charter
responsibilities;



(7)  The use of credit information for the purposes of
prescreening as provided by the federal Fair Credit Reporting Act (15 U.S.C. sections
1681 to 1681x);



(8)  Any person for the sole purpose of providing a
credit file monitoring subscription service to which the consumer has
subscribed;



(9)  A person for the sole purpose of providing a
consumer with a copy of the consumer's credit report upon the consumer's
request; and



(10)  Any person or entity using a credit report in
setting or adjusting a rate, adjusting a claim, or underwriting for insurance
purposes. [L 2006, c 138, pt of §1; am L 2007, c 189, §1]