CHAPTER 24. SECURITY FREEZES FOR CONSUMER REPORTS
IC 24-5-24
Chapter 24. Security Freezes for Consumer Reports
IC 24-5-24-1
"Consumer"
Sec. 1. As used in this chapter, "consumer" means an individual:
(1) whose principal residence is in Indiana; and
(2) whose credit information and history is recorded in aconsumer report.
As added by P.L.104-2007, SEC.1.
IC 24-5-24-2
"Consumer report"
Sec. 2. (a) As used in this chapter, "consumer report" means anywritten, oral, or other communication of any information that:
(1) is made by a consumer reporting agency;
(2) bears on a consumer's creditworthiness, credit standing,credit capacity, character, general reputation, personalcharacteristics, or mode of living; and
(3) is used or expected to be used or collected in whole or inpart for the purpose of serving as a factor in establishing aconsumer's eligibility for credit to be used primarily forpersonal, family, or household purposes.
(b) The term includes a consumer's credit score.
As added by P.L.104-2007, SEC.1.
IC 24-5-24-3
"Consumer reporting agency"
Sec. 3. (a) As used in this chapter, "consumer reporting agency"means any person that, for monetary fees or dues, or on a cooperativenonprofit basis, regularly engages in whole or in part in the practiceof assembling or evaluating information concerning a consumer'scredit or other information for the purpose of furnishing a consumerreport to another person.
(b) The term does not include an entity designated as acommercially reasonable private consumer credit reporting entityunder IC 24-4.5-7-404(5).
As added by P.L.104-2007, SEC.1.
IC 24-5-24-4
"Security freeze"
Sec. 4. As used in this chapter, "security freeze" means adesignation placed on a consumer's consumer report:
(1) by a consumer reporting agency; and
(2) at the request of the consumer;
that prohibits the consumer reporting agency from releasing theconsumer report without the authorization of the consumer.
As added by P.L.104-2007, SEC.1.
IC 24-5-24-5 Requesting and placing a security freeze; requirements; exception;electronic mail connection
Sec. 5. (a) A consumer may place a security freeze on theconsumer's consumer report by:
(1) sending a written request by United States mail to anaddress designated by the consumer reporting agency; or
(2) subject to subsection (d), making a request to a consumerreporting agency through a secure electronic mail connectionprovided by the consumer reporting agency.
(b) Except as provided in subsection (c) and section 11 of thischapter, a consumer reporting agency that receives a request undersubsection (a) shall place a security freeze on the consumer'sconsumer report not later than five (5) business days after receipt ofthe request.
(c) A consumer reporting agency is not required to place asecurity freeze on a consumer report under this section if theconsumer reporting agency determines that the request for a securityfreeze:
(1) is materially false; or
(2) does not clearly identify the person making the request asthe consumer.
(d) Not later than January 1, 2009, a consumer reporting agencyshall develop and make available to consumers a secure electronicmail connection by which a consumer can request:
(1) the placement of a security freeze on the consumer'sconsumer report under this section; or
(2) the same or a new personal identification number orpassword under section 6(b) of this chapter.
As added by P.L.104-2007, SEC.1.
IC 24-5-24-6
Written confirmation of security freeze; unique personalidentification number or password; instructions; timerequirements
Sec. 6. (a) Not later than ten (10) business days after receiving arequest for a security freeze under section 5 of this chapter, aconsumer reporting agency shall issue to the consumer a writtenconfirmation that a security freeze has been placed on the consumer'sconsumer report. The confirmation required by this section mustinclude the following:
(1) A unique:
(A) personal identification number; or
(B) password;
other than the consumer's Social Security number, or anymultiple digit segment of the consumer's Social Securitynumber, to be used by the consumer to perform any of the actsdescribed in subdivision (2).
(2) Written instructions explaining how the consumer may:
(A) release the consumer's consumer report to one (1) ormore specified third parties; (B) temporarily lift the security freeze for a specified period;or
(C) remove the security freeze.
(3) Written instructions explaining how the consumer mayrequest, using one (1) of the methods described in section 5(a)of this chapter, that the consumer reporting agency issue thesame or a new personal identification number or password tothe consumer if the consumer fails to retain the originalpersonal identification number or password issued by theconsumer reporting agency under subdivision (1).
(b) Upon receiving a request described in subsection (a)(3), theconsumer reporting agency shall issue the same or a new personalidentification number or password to the requesting consumer if theconsumer has provided information sufficient to identify theconsumer, as specified by the consumer reporting agency in theinstructions provided to the consumer under subsection (a)(3). If theconsumer's request is made using the method described in section5(a)(1) of this chapter, the consumer reporting agency shall send, byUnited States mail, the personal identification number or passwordto the consumer not later than five (5) business days after receivingthe consumer's request. If the consumer's request is made using themethod described in section 5(a)(2) of this chapter, the consumerreporting agency shall issue the personal identification number orpassword not later than:
(1) subject to the exceptions set forth in sections 7(e)(2) and9(c)(2) of this chapter, as applicable, fifteen (15) minutes afterreceiving the request, if the consumer reporting agency electsto issue the personal identification number or password by asecure electronic mail connection provided by the consumerreporting agency under section 5(d) of this chapter; or
(2) five (5) business days after receiving the request, if theconsumer reporting agency elects to issue the personalidentification number or password by United States mail.
As added by P.L.104-2007, SEC.1.
IC 24-5-24-7
Releasing the consumer report upon authorization; developingsecure procedures; time requirements; exceptions
Sec. 7. (a) Except as provided in section 10 of this chapter, if asecurity freeze has been placed on a consumer's consumer report, theconsumer reporting agency that placed the security freeze on theconsumer report shall not release the consumer's consumer reportunless the consumer authorizes the consumer reporting agency to:
(1) release the consumer's consumer report to one (1) or morespecified third parties; or
(2) temporarily lift the security freeze for a specified period.
(b) A consumer who seeks to authorize the release of theconsumer's consumer report under subsection (a)(1) or (a)(2) shallrequest the release by contacting the consumer reporting agency byany method: (1) described in section 5(a) of this chapter; or
(2) developed by the consumer reporting agency undersubsection (d).
(c) A request by a consumer under subsection (b) must include thefollowing:
(1) Information sufficient to identify the consumer, as specifiedby the consumer reporting agency in the instructions providedto the consumer under section 6(a)(2) of this chapter.
(2) The unique personal identification number or passwordassigned to the consumer under section 6(a)(1) or 6(a)(3) of thischapter.
(3) If the consumer seeks to authorize the release of theconsumer's consumer report under subsection (a)(1),information sufficient to identify the parties to whom theconsumer report is to be released, as specified by the consumerreporting agency in the instructions provided to the consumerunder section 6(a)(2) of this chapter.
(4) If the consumer seeks to authorize the consumer reportingagency to temporarily lift a security freeze under subsection(a)(2), the period during which the security freeze is to betemporarily lifted.
(d) Not later than January 1, 2009, a consumer reporting agencyshall develop and make available to consumers secure procedures toauthorize the release of a consumer's consumer report undersubsection (a)(1), or to authorize the temporary lifting of a securityfreeze under subsection (a)(2), within fifteen (15) minutes ofreceiving a request under subsection (b), by any of the followingmethods:
(1) Telephone.
(2) The Internet.
(3) Other electronic media, if provided by the consumerreporting agency.
The procedures developed by a consumer reporting agency under thissubsection must require the consumer to provide the information setforth in subsection (c).
(e) A consumer reporting agency that receives a request from aconsumer under this section shall comply with the request within thefollowing time frames:
(1) Not later than three (3) business days after receiving therequest, if the consumer makes the request by the methoddescribed in section 5(a)(1) of this chapter.
(2) Not later than fifteen (15) minutes after receiving therequest, if the consumer makes the request using the methoddescribed in section 5(a)(2) of this chapter or by any methoddeveloped by the consumer reporting agency under subsection(d). However, a consumer reporting agency is not required tocomply with a consumer's request within the fifteen (15) minutetime frame set forth in this subdivision if:
(A) the consumer does not provide one (1) or more of theitems listed in subsection (c); or (B) the consumer reporting agency's ability to comply withthe request within the fifteen (15) minute time frame setforth in this subdivision is prevented by any of thefollowing:
(i) An act of God, including fire, an earthquake, ahurricane, a storm, or a similar natural disaster orphenomenon.
(ii) Unauthorized or illegal acts by a third party, includingterrorism, sabotage, riot, vandalism, labor strikes ordisputes disrupting operations, or similar occurrences.
(iii) An operational interruption, including an electricalfailure, an unanticipated delay in the delivery ofequipment or replacement parts, computer hardware orsoftware failures inhibiting response time, or similardisruptions.
(iv) A governmental action, including an emergency orderor regulation, a judicial action, a law enforcement action,or a similar directive.
(v) Regularly scheduled maintenance of, or updates to, theconsumer reporting agency's computer systems, if themaintenance activities or updates occur other than duringnormal business hours.
(vi) Commercially reasonable maintenance of, or repairsto, the consumer reporting agency's computer systems, ifthe maintenance activities or repairs are unexpected or arenecessitated by unanticipated conditions or malfunctions.
(vii) For a request made by telephone, receipt of a requestunder this section other than during the consumerreporting agency's normal business hours, including anyextended business hours observed by the consumerreporting agency. The exemption provided by this itemdoes not apply to a request made by a consumer throughthe Internet or other electronic media. A consumerreporting agency must comply with a request made by aconsumer through the Internet or other electronic mediawithin the fifteen (15) minute time frame set forth in thissubdivision, even if the request is made at a time otherthan during the consumer reporting agency's normal orextended business hours.
As added by P.L.104-2007, SEC.1.
IC 24-5-24-8
Application treated as incomplete by third party; notification ofsecurity freeze
Sec. 8. (a) A third party that requests a consumer's consumerreport in connection with an application by the consumer for creditshall treat the application for credit as incomplete if:
(1) a security freeze has been placed on the consumer'sconsumer report;
(2) the consumer has not authorized the release of the
consumer's consumer report under section 7 of this chapter; and
(3) the consumer reporting agency refuses to release theconsumer report to the third party based on subdivisions (1) and(2).
(b) A consumer reporting agency that refuses under subsection(a)(3) to release a consumer report shall notify the third partyrequesting the consumer report of the existence of a security freezeas the basis for the refusal to release the consumer report to the thirdparty.
(c) A consumer reporting agency shall not:
(1) state; or
(2) otherwise imply;
to a third party that the consumer's security freeze under this chapterreflects a negative credit score, history, report, or rating.
As added by P.L.104-2007, SEC.1.
IC 24-5-24-9
Security freeze remains in effect; requesting removal;requirements; time requirements; exceptions
Sec. 9. (a) A security freeze remains in effect until the consumerwho requested the security freeze requests that the security freeze beremoved. A consumer who seeks to authorize a consumer reportingagency to remove a security freeze shall request the removal bycontacting the consumer reporting agency by any method:
(1) described in section 5(a) of this chapter; or
(2) developed by a consumer reporting agency under section7(d) of this chapter for receiving a consumer's request toauthorize the release of a consumer report or the temporarylifting of a security freeze.
(b) A request by a consumer under subsection (a) must include thefollowing:
(1) Information sufficient to identify the consumer, as specifiedby the consumer reporting agency in the instructions providedto the consumer under section 6(a)(2) of this chapter.
(2) The unique personal identification number or passwordassigned to the consumer under section 6(a)(1) or 6(a)(3) of thischapter.
(c) Subject to subsection (d), a consumer reporting agency mustremove a security freeze within the following time frames:
(1) Not later than three (3) business days after receiving arequest under subsection (a), if the consumer makes the requestby the method described in section 5(a)(1) of this chapter.
(2) Not later than fifteen (15) minutes after receiving a requestunder subsection (a), if the consumer makes the request usingthe method described in section 5(a)(2) of this chapter or by anymethod developed by the consumer reporting agency undersection 7(d) of this chapter. However, a consumer reportingagency is not required to comply with a consumer's requestwithin the fifteen (15) minute time frame set forth in thissubdivision if: (A) the consumer does not provide one (1) or more of theitems listed in subsection (b); or
(B) the consumer reporting agency's ability to comply withthe request within the fifteen (15) minute time frame setforth in this subdivision is prevented by any of thefollowing:
(i) An act of God, including fire, an earthquake, ahurricane, a storm, or a similar natural disaster orphenomenon.
(ii) Unauthorized or illegal acts by a third party, includingterrorism, sabotage, riot, vandalism, labor strikes ordisputes disrupting operations, or similar occurrences.
(iii) An operational interruption, including an electricalfailure, an unanticipated delay in the delivery ofequipment or replacement parts, computer hardware orsoftware failures inhibiting response time, or similardisruptions.
(iv) A governmental action, including an emergency orderor regulation, a judicial action, a law enforcement action,or a similar directive.
(v) Regularly scheduled maintenance of, or updates to, theconsumer reporting agency's computer systems, if themaintenance activities or updates occur other than duringnormal business hours.
(vi) Commercially reasonable maintenance of, or repairsto, the consumer reporting agency's computer systems, ifthe maintenance activities or repairs are unexpected or arenecessitated by unanticipated conditions or malfunctions.
(vii) For a request made by telephone, receipt of a requestunder this section other than during the consumerreporting agency's normal business hours, including anyextended business hours observed by the consumerreporting agency. The exemption provided by this itemdoes not apply to a request made by a consumer throughthe Internet or other electronic media. A consumerreporting agency must comply with a request made by aconsumer through the Internet or other electronic mediawithin the fifteen (15) minute time frame set forth in thissubdivision, even if the request is made at a time otherthan during the consumer reporting agency's normal orextended business hours.
(d) A consumer reporting agency is not required to remove asecurity freeze under this section if the consumer reporting agencydetermines that the request to remove the security freeze:
(1) is materially false; or
(2) does not clearly identify the person making the request asthe consumer.
As added by P.L.104-2007, SEC.1.
IC 24-5-24-10 Persons excluded from security freeze restrictions
Sec. 10. The placement of a security freeze on a consumer'sconsumer report does not prohibit a consumer reporting agency fromproviding the consumer's consumer report to the following personswithout the authorization of the consumer:
(1) A person, including a subsidiary, an affiliate, an agent, anassignee of a financial obligation owed by the consumer to theperson, or a prospective assignee of a financial obligation owedby the consumer to the person in connection with the proposedpurchase of the financial obligation, to whom the consumerowes a financial obligation in connection with any of thefollowing:
(A) An account, including a demand deposit account, thatthe consumer has with the person, for the purpose of:
(i) reviewing the account, including activities related toaccount maintenance, monitoring, credit line increases,and account upgrades and enhancements; or
(ii) collecting the obligation owed in connection with theaccount.
(B) A contract, for the purpose of collecting the obligationowed in connection with the contract.
(C) A negotiable instrument that the consumer has issued tothe person, for the purpose of collecting the obligation owedin connection with the negotiable instrument.
(2) A person, including a subsidiary, an affiliate, an agent, or anassignee of a financial obligation owed by the consumer to theperson, to whom the consumer has authorized the release of theconsumer's consumer report under section 7(a)(1) of thischapter, for the purpose of facilitating the extension of credit orfor any permissible purpose under subdivision (1).
(3) A law enforcement agency.
(4) Any person for the purpose of prescreening, as provided inthe federal Fair Credit Reporting Act (15 U.S.C. 1681 et seq.).
(5) Any person administering a credit monitoring subscriptionservice to which the consumer has subscribed.
(6) The consumer, upon the consumer's request, or any otherperson for the purpose of providing the consumer with a copyof the consumer's consumer report, upon the consumer'srequest.
(7) Any of the following that provides services to a consumer:
(A) An insurer licensed under IC 27.
(B) An insurance producer licensed under IC 27.
(C) An agent, a vendor, or an employee of:
(i) an insurer licensed under IC 27; or
(ii) an insurance producer licensed under IC 27;
while acting on behalf of the insurer or the insuranceproducer.
As added by P.L.104-2007, SEC.1.
IC 24-5-24-11 "Energy utility"; "specialized credit reporting tool"; personsexcluded from security freeze requirements
Sec. 11. (a) As used in this section, "energy utility" has themeaning set forth in IC 8-1-2.5-2.
(b) As used in this section, "specialized credit reporting tool"means a scoring model that:
(1) is available only to an energy utility; and
(2) is used by the energy utility to validate a consumer's identityand creditworthiness.
(c) The following persons are not required to place a securityfreeze on a consumer's consumer report:
(1) A consumer reporting agency that acts only as a reseller (asdefined in 15 U.S.C. 1681a(u)) of information. However, aconsumer reporting agency must honor any security freezeplaced on a consumer's consumer report by another consumerreporting agency.
(2) A:
(A) check services; or
(B) fraud prevention services;
company that reports on incidents of fraud or issuesauthorizations for the purpose of approving or processingnegotiable instruments, electronic fund transfers, or similarmethods of payment.
(3) A deposit account information service company that issuesreports concerning account closures due to:
(A) fraud;
(B) substantial overdrafts;
(C) ATM abuse; or
(D) similar negative information concerning a consumer;
to inquiring financial institutions for use only in reviewing aconsumer's request for a deposit account at the inquiringfinancial institution.
(4) A consumer reporting agency that furnishes specializedcredit reporting tools to an energy utility.
As added by P.L.104-2007, SEC.1.
IC 24-5-24-12
Written confirmation of change to official information; exceptionfor technical modification
Sec. 12. (a) Except as provided in subsection (b), if a securityfreeze is in place with respect to a consumer's consumer report, aconsumer reporting agency may not change any of the followingofficial information on the consumer's consumer report withoutsending written confirmation of the change to the consumer not laterthan thirty (30) days after the change is posted to the consumer'sconsumer report:
(1) Name.
(2) Date of birth.
(3) Social Security number.
(4) Address.In the case of an address change, the written confirmation requiredunder this section shall be sent to both the new address and the oldaddress.
(b) Written confirmation is not required under this section fortechnical modifications of a consumer's official information,including changes involving:
(1) the use of name or street:
(A) abbreviations; or
(B) complete spellings; or
(2) transpositions of numbers or letters in a consumer's name oraddress.
As added by P.L.104-2007, SEC.1.
IC 24-5-24-13
Notice with written disclosure; content
Sec. 13. A consumer reporting agency shall provide to a consumernotice with each written disclosure by the consumer reporting agencyas required under Section 609 of the federal Fair Credit ReportingAct (15 U.S.C. 1681g) that the consumer may place a security freezeon the consumer's consumer report. The notice under this sectionmust be in the following form:
"UNDER IC 24-5-24, YOU MAY OBTAIN A SECURITYFREEZE ON YOUR CONSUMER REPORT TO PROTECTYOUR PRIVACY AND ENSURE THAT CREDIT IS NOTGRANTED IN YOUR NAME WITHOUT YOURKNOWLEDGE. THE SECURITY FREEZE WILL PROHIBITA CONSUMER REPORTING AGENCY FROM RELEASINGANY INFORMATION IN YOUR CONSUMER REPORTWITHOUT YOUR EXPRESS AUTHORIZATION ORAPPROVAL. THE SECURITY FREEZE IS DESIGNED TOPREVENT CREDIT LOANS AND SERVICES FROM BEINGAPPROVED IN YOUR NAME WITHOUT YOURCONSENT. WHEN YOU PLACE A SECURITY FREEZE ONYOUR CONSUMER REPORT, WITHIN TEN (10)BUSINESS DAYS YOU WILL BE PROVIDED APERSONAL IDENTIFICATION NUMBER TO USE IF YOUCHOOSE TO REMOVE THE SECURITY FREEZE OR TOTEMPORARILY AUTHORIZE THE RELEASE OF YOURCONSUMER REPORT FOR A PERIOD OF TIME OR TO ASPECIFIC PERSON AFTER THE SECURITY FREEZE IS INPLACE. A SECURITY FREEZE DOES NOT APPLY TOPERSONS OR ENTITIES LISTED IN IC 24-5-24-11. IF YOUARE ACTIVELY SEEKING CREDIT, YOU SHOULDUNDERSTAND THAT THE PROCEDURES INVOLVED INLIFTING A SECURITY FREEZE MAY SLOW YOUR OWNAPPLICATIONS FOR CREDIT. YOU HAVE A RIGHT TOBRING A CIVIL ACTION AGAINST SOMEONE WHOVIOLATES YOUR RIGHTS UNDER IC 24-5-24.".
As added by P.L.104-2007, SEC.1.
IC 24-5-24-14
Fee prohibited
Sec. 14. A consumer reporting agency may not impose a chargeon a consumer for a request from the consumer to do any of thefollowing:
(1) Place a security freeze on a consumer's consumer reportunder section 5 of this chapter.
(2) Issue the same or a new personal identification number orpassword to a consumer under section 6 of this chapter.
(3) Release a consumer's consumer report to a third party uponrequest of the consumer under section 7(a)(1) of this chapter. Inaddition a consumer reporting agency may not impose a chargeon the third party to whom the consumer's consumer report isreleased under section 7(a)(1) of this chapter in connection withthe release.
(4) Temporarily lift a security freeze under section 7(a)(2) ofthis chapter.
(5) Remove a security freeze under section 9 of this chapter.
As added by P.L.104-2007, SEC.1.
IC 24-5-24-15
Civil action; liability
Sec. 15. (a) A consumer who suffers injury by an act of aconsumer reporting agency that violates this chapter may bring acivil action against the consumer reporting agency in a circuit orsuperior court in the county in which the consumer resides.
(b) A person who knowingly or intentionally fails to comply withany requirement imposed under this chapter with respect to aconsumer is liable to that consumer in an amount equal to the sum ofthe following:
(1) The greater of:
(A) the amount of actual damages sustained by the consumeras a result of the failure to comply; or
(B) five hundred dollars ($500).
However, the amount awarded to a consumer under thissubdivision may not exceed six thousand dollars ($6,000),regardless of the consumer's actual damages.
(2) Such punitive damages as the court may allow.
(3) In the case of a successful action by a consumer under thissection, the costs of the action together with reasonableattorney's fees as determined by the court.
As added by P.L.104-2007, SEC.1.
IC 24-5-24-16
Civil penalty
Sec. 16. (a) The attorney general may bring an action to recoverfrom a person on behalf of the state a civil penalty described insubsection (b).
(b) A person who knowingly or intentionally violates this chapteris subject to a civil penalty of: (1) not more than two thousand five hundred dollars ($2,500)for a violation or series of violations concerning one (1)consumer; or
(2) not more than a total of one hundred thousand dollars($100,000) for related violations concerning more than one (1)consumer.
As added by P.L.104-2007, SEC.1.
IC 24-5-24-17
Severability
Sec. 17. The provisions of this chapter are severable as providedin IC 1-1-1-8(b).
As added by P.L.104-2007, SEC.1.