IC 24-5-24
Chapter 24. Security Freezes for Consumer Reports
IC 24-5-24-1 "Consumer"
Sec. 1. As used in this chapter, "consumer" means an individual:
(1) whose principal residence is in Indiana; and
(2) whose credit information and history is recorded in a
consumer report. As added by P.L.104-2007, SEC.1.
IC 24-5-24-2 "Consumer report"
Sec. 2. (a) As used in this chapter, "consumer report" means any
written, oral, or other communication of any information that:
(1) is made by a consumer reporting agency;
(2) bears on a consumer's creditworthiness, credit standing,
credit capacity, character, general reputation, personal
characteristics, or mode of living; and
(3) is used or expected to be used or collected in whole or in
part for the purpose of serving as a factor in establishing a
consumer's eligibility for credit to be used primarily for
personal, family, or household purposes.
(b) The term includes a consumer's credit score. As added by P.L.104-2007, SEC.1.
IC 24-5-24-3 "Consumer reporting agency"
Sec. 3. (a) As used in this chapter, "consumer reporting agency"
means any person that, for monetary fees or dues, or on a cooperative
nonprofit basis, regularly engages in whole or in part in the practice
of assembling or evaluating information concerning a consumer's
credit or other information for the purpose of furnishing a consumer
report to another person.
(b) The term does not include an entity designated as a
commercially reasonable private consumer credit reporting entity
under IC 24-4.5-7-404(5). As added by P.L.104-2007, SEC.1.
IC 24-5-24-4 "Security freeze"
Sec. 4. As used in this chapter, "security freeze" means a
designation placed on a consumer's consumer report:
(1) by a consumer reporting agency; and
(2) at the request of the consumer;
that prohibits the consumer reporting agency from releasing the
consumer report without the authorization of the consumer. As added by P.L.104-2007, SEC.1.
IC 24-5-24-5 Requesting and placing a security freeze; requirements; exception;
electronic mail connection
Sec. 5. (a) A consumer may place a security freeze on the
consumer's consumer report by:
(1) sending a written request by United States mail to an
address designated by the consumer reporting agency; or
(2) subject to subsection (d), making a request to a consumer
reporting agency through a secure electronic mail connection
provided by the consumer reporting agency.
(b) Except as provided in subsection (c) and section 11 of this
chapter, a consumer reporting agency that receives a request under
subsection (a) shall place a security freeze on the consumer's
consumer report not later than five (5) business days after receipt of
the request.
(c) A consumer reporting agency is not required to place a
security freeze on a consumer report under this section if the
consumer reporting agency determines that the request for a security
freeze:
(1) is materially false; or
(2) does not clearly identify the person making the request as
the consumer.
(d) Not later than January 1, 2009, a consumer reporting agency
shall develop and make available to consumers a secure electronic
mail connection by which a consumer can request:
(1) the placement of a security freeze on the consumer's
consumer report under this section; or
(2) the same or a new personal identification number or
password under section 6(b) of this chapter. As added by P.L.104-2007, SEC.1.
IC 24-5-24-6 Written confirmation of security freeze; unique personal
identification number or password; instructions; time
requirements
Sec. 6. (a) Not later than ten (10) business days after receiving a
request for a security freeze under section 5 of this chapter, a
consumer reporting agency shall issue to the consumer a written
confirmation that a security freeze has been placed on the consumer's
consumer report. The confirmation required by this section must
include the following:
(1) A unique:
(A) personal identification number; or
(B) password;
other than the consumer's Social Security number, or any
multiple digit segment of the consumer's Social Security
number, to be used by the consumer to perform any of the acts
described in subdivision (2).
(2) Written instructions explaining how the consumer may:
(A) release the consumer's consumer report to one (1) or
more specified third parties;
(B) temporarily lift the security freeze for a specified period;
or
(C) remove the security freeze.
(3) Written instructions explaining how the consumer may
request, using one (1) of the methods described in section 5(a)
of this chapter, that the consumer reporting agency issue the
same or a new personal identification number or password to
the consumer if the consumer fails to retain the original
personal identification number or password issued by the
consumer reporting agency under subdivision (1).
(b) Upon receiving a request described in subsection (a)(3), the
consumer reporting agency shall issue the same or a new personal
identification number or password to the requesting consumer if the
consumer has provided information sufficient to identify the
consumer, as specified by the consumer reporting agency in the
instructions provided to the consumer under subsection (a)(3). If the
consumer's request is made using the method described in section
5(a)(1) of this chapter, the consumer reporting agency shall send, by
United States mail, the personal identification number or password
to the consumer not later than five (5) business days after receiving
the consumer's request. If the consumer's request is made using the
method described in section 5(a)(2) of this chapter, the consumer
reporting agency shall issue the personal identification number or
password not later than:
(1) subject to the exceptions set forth in sections 7(e)(2) and
9(c)(2) of this chapter, as applicable, fifteen (15) minutes after
receiving the request, if the consumer reporting agency elects
to issue the personal identification number or password by a
secure electronic mail connection provided by the consumer
reporting agency under section 5(d) of this chapter; or
(2) five (5) business days after receiving the request, if the
consumer reporting agency elects to issue the personal
identification number or password by United States mail. As added by P.L.104-2007, SEC.1.
IC 24-5-24-7 Releasing the consumer report upon authorization; developing
secure procedures; time requirements; exceptions
Sec. 7. (a) Except as provided in section 10 of this chapter, if a
security freeze has been placed on a consumer's consumer report, the
consumer reporting agency that placed the security freeze on the
consumer report shall not release the consumer's consumer report
unless the consumer authorizes the consumer reporting agency to:
(1) release the consumer's consumer report to one (1) or more
specified third parties; or
(2) temporarily lift the security freeze for a specified period.
(b) A consumer who seeks to authorize the release of the
consumer's consumer report under subsection (a)(1) or (a)(2) shall
request the release by contacting the consumer reporting agency by
any method:
(1) described in section 5(a) of this chapter; or
(2) developed by the consumer reporting agency under
subsection (d).
(c) A request by a consumer under subsection (b) must include the
following:
(1) Information sufficient to identify the consumer, as specified
by the consumer reporting agency in the instructions provided
to the consumer under section 6(a)(2) of this chapter.
(2) The unique personal identification number or password
assigned to the consumer under section 6(a)(1) or 6(a)(3) of this
chapter.
(3) If the consumer seeks to authorize the release of the
consumer's consumer report under subsection (a)(1),
information sufficient to identify the parties to whom the
consumer report is to be released, as specified by the consumer
reporting agency in the instructions provided to the consumer
under section 6(a)(2) of this chapter.
(4) If the consumer seeks to authorize the consumer reporting
agency to temporarily lift a security freeze under subsection
(a)(2), the period during which the security freeze is to be
temporarily lifted.
(d) Not later than January 1, 2009, a consumer reporting agency
shall develop and make available to consumers secure procedures to
authorize the release of a consumer's consumer report under
subsection (a)(1), or to authorize the temporary lifting of a security
freeze under subsection (a)(2), within fifteen (15) minutes of
receiving a request under subsection (b), by any of the following
methods:
(1) Telephone.
(2) The Internet.
(3) Other electronic media, if provided by the consumer
reporting agency.
The procedures developed by a consumer reporting agency under this
subsection must require the consumer to provide the information set
forth in subsection (c).
(e) A consumer reporting agency that receives a request from a
consumer under this section shall comply with the request within the
following time frames:
(1) Not later than three (3) business days after receiving the
request, if the consumer makes the request by the method
described in section 5(a)(1) of this chapter.
(2) Not later than fifteen (15) minutes after receiving the
request, if the consumer makes the request using the method
described in section 5(a)(2) of this chapter or by any method
developed by the consumer reporting agency under subsection
(d). However, a consumer reporting agency is not required to
comply with a consumer's request within the fifteen (15) minute
time frame set forth in this subdivision if:
(A) the consumer does not provide one (1) or more of the
items listed in subsection (c); or
(B) the consumer reporting agency's ability to comply with
the request within the fifteen (15) minute time frame set
forth in this subdivision is prevented by any of the
following:
(i) An act of God, including fire, an earthquake, a
hurricane, a storm, or a similar natural disaster or
phenomenon.
(ii) Unauthorized or illegal acts by a third party, including
terrorism, sabotage, riot, vandalism, labor strikes or
disputes disrupting operations, or similar occurrences.
(iii) An operational interruption, including an electrical
failure, an unanticipated delay in the delivery of
equipment or replacement parts, computer hardware or
software failures inhibiting response time, or similar
disruptions.
(iv) A governmental action, including an emergency order
or regulation, a judicial action, a law enforcement action,
or a similar directive.
(v) Regularly scheduled maintenance of, or updates to, the
consumer reporting agency's computer systems, if the
maintenance activities or updates occur other than during
normal business hours.
(vi) Commercially reasonable maintenance of, or repairs
to, the consumer reporting agency's computer systems, if
the maintenance activities or repairs are unexpected or are
necessitated by unanticipated conditions or malfunctions.
(vii) For a request made by telephone, receipt of a request
under this section other than during the consumer
reporting agency's normal business hours, including any
extended business hours observed by the consumer
reporting agency. The exemption provided by this item
does not apply to a request made by a consumer through
the Internet or other electronic media. A consumer
reporting agency must comply with a request made by a
consumer through the Internet or other electronic media
within the fifteen (15) minute time frame set forth in this
subdivision, even if the request is made at a time other
than during the consumer reporting agency's normal or
extended business hours. As added by P.L.104-2007, SEC.1.
IC 24-5-24-8 Application treated as incomplete by third party; notification of
security freeze
Sec. 8. (a) A third party that requests a consumer's consumer
report in connection with an application by the consumer for credit
shall treat the application for credit as incomplete if:
(1) a security freeze has been placed on the consumer's
consumer report;
(2) the consumer has not authorized the release of the
consumer's consumer report under section 7 of this chapter; and
(3) the consumer reporting agency refuses to release the
consumer report to the third party based on subdivisions (1) and
(2).
(b) A consumer reporting agency that refuses under subsection
(a)(3) to release a consumer report shall notify the third party
requesting the consumer report of the existence of a security freeze
as the basis for the refusal to release the consumer report to the third
party.
(c) A consumer reporting agency shall not:
(1) state; or
(2) otherwise imply;
to a third party that the consumer's security freeze under this chapter
reflects a negative credit score, history, report, or rating. As added by P.L.104-2007, SEC.1.
IC 24-5-24-9 Security freeze remains in effect; requesting removal;
requirements; time requirements; exceptions
Sec. 9. (a) A security freeze remains in effect until the consumer
who requested the security freeze requests that the security freeze be
removed. A consumer who seeks to authorize a consumer reporting
agency to remove a security freeze shall request the removal by
contacting the consumer reporting agency by any method:
(1) described in section 5(a) of this chapter; or
(2) developed by a consumer reporting agency under section
7(d) of this chapter for receiving a consumer's request to
authorize the release of a consumer report or the temporary
lifting of a security freeze.
(b) A request by a consumer under subsection (a) must include the
following:
(1) Information sufficient to identify the consumer, as specified
by the consumer reporting agency in the instructions provided
to the consumer under section 6(a)(2) of this chapter.
(2) The unique personal identification number or password
assigned to the consumer under section 6(a)(1) or 6(a)(3) of this
chapter.
(c) Subject to subsection (d), a consumer reporting agency must
remove a security freeze within the following time frames:
(1) Not later than three (3) business days after receiving a
request under subsection (a), if the consumer makes the request
by the method described in section 5(a)(1) of this chapter.
(2) Not later than fifteen (15) minutes after receiving a request
under subsection (a), if the consumer makes the request using
the method described in section 5(a)(2) of this chapter or by any
method developed by the consumer reporting agency under
section 7(d) of this chapter. However, a consumer reporting
agency is not required to comply with a consumer's request
within the fifteen (15) minute time frame set forth in this
subdivision if:
(A) the consumer does not provide one (1) or more of the
items listed in subsection (b); or
(B) the consumer reporting agency's ability to comply with
the request within the fifteen (15) minute time frame set
forth in this subdivision is prevented by any of the
following:
(i) An act of God, including fire, an earthquake, a
hurricane, a storm, or a similar natural disaster or
phenomenon.
(ii) Unauthorized or illegal acts by a third party, including
terrorism, sabotage, riot, vandalism, labor strikes or
disputes disrupting operations, or similar occurrences.
(iii) An operational interruption, including an electrical
failure, an unanticipated delay in the delivery of
equipment or replacement parts, computer hardware or
software failures inhibiting response time, or similar
disruptions.
(iv) A governmental action, including an emergency order
or regulation, a judicial action, a law enforcement action,
or a similar directive.
(v) Regularly scheduled maintenance of, or updates to, the
consumer reporting agency's computer systems, if the
maintenance activities or updates occur other than during
normal business hours.
(vi) Commercially reasonable maintenance of, or repairs
to, the consumer reporting agency's computer systems, if
the maintenance activities or repairs are unexpected or are
necessitated by unanticipated conditions or malfunctions.
(vii) For a request made by telephone, receipt of a request
under this section other than during the consumer
reporting agency's normal business hours, including any
extended business hours observed by the consumer
reporting agency. The exemption provided by this item
does not apply to a request made by a consumer through
the Internet or other electronic media. A consumer
reporting agency must comply with a request made by a
consumer through the Internet or other electronic media
within the fifteen (15) minute time frame set forth in this
subdivision, even if the request is made at a time other
than during the consumer reporting agency's normal or
extended business hours.
(d) A consumer reporting agency is not required to remove a
security freeze under this section if the consumer reporting agency
determines that the request to remove the security freeze:
(1) is materially false; or
(2) does not clearly identify the person making the request as
the consumer. As added by P.L.104-2007, SEC.1.
IC 24-5-24-10 Persons excluded from security freeze restrictions
Sec. 10. The placement of a security freeze on a consumer's
consumer report does not prohibit a consumer reporting agency from
providing the consumer's consumer report to the following persons
without the authorization of the consumer:
(1) A person, including a subsidiary, an affiliate, an agent, an
assignee of a financial obligation owed by the consumer to the
person, or a prospective assignee of a financial obligation owed
by the consumer to the person in connection with the proposed
purchase of the financial obligation, to whom the consumer
owes a financial obligation in connection with any of the
following:
(A) An account, including a demand deposit account, that
the consumer has with the person, for the purpose of:
(i) reviewing the account, including activities related to
account maintenance, monitoring, credit line increases,
and account upgrades and enhancements; or
(ii) collecting the obligation owed in connection with the
account.
(B) A contract, for the purpose of collecting the obligation
owed in connection with the contract.
(C) A negotiable instrument that the consumer has issued to
the person, for the purpose of collecting the obligation owed
in connection with the negotiable instrument.
(2) A person, including a subsidiary, an affiliate, an agent, or an
assignee of a financial obligation owed by the consumer to the
person, to whom the consumer has authorized the release of the
consumer's consumer report under section 7(a)(1) of this
chapter, for the purpose of facilitating the extension of credit or
for any permissible purpose under subdivision (1).
(3) A law enforcement agency.
(4) Any person for the purpose of prescreening, as provided in
the federal Fair Credit Reporting Act (15 U.S.C. 1681 et seq.).
(5) Any person administering a credit monitoring subscription
service to which the consumer has subscribed.
(6) The consumer, upon the consumer's request, or any other
person for the purpose of providing the consumer with a copy
of the consumer's consumer report, upon the consumer's
request.
(7) Any of the following that provides services to a consumer:
(A) An insurer licensed under IC 27.
(B) An insurance producer licensed under IC 27.
(C) An agent, a vendor, or an employee of:
(i) an insurer licensed under IC 27; or
(ii) an insurance producer licensed under IC 27;
while acting on behalf of the insurer or the insurance
producer. As added by P.L.104-2007, SEC.1.
IC 24-5-24-11 "Energy utility"; "specialized credit reporting tool"; persons
excluded from security freeze requirements
Sec. 11. (a) As used in this section, "energy utility" has the
meaning set forth in IC 8-1-2.5-2.
(b) As used in this section, "specialized credit reporting tool"
means a scoring model that:
(1) is available only to an energy utility; and
(2) is used by the energy utility to validate a consumer's identity
and creditworthiness.
(c) The following persons are not required to place a security
freeze on a consumer's consumer report:
(1) A consumer reporting agency that acts only as a reseller (as
defined in 15 U.S.C. 1681a(u)) of information. However, a
consumer reporting agency must honor any security freeze
placed on a consumer's consumer report by another consumer
reporting agency.
(2) A:
(A) check services; or
(B) fraud prevention services;
company that reports on incidents of fraud or issues
authorizations for the purpose of approving or processing
negotiable instruments, electronic fund transfers, or similar
methods of payment.
(3) A deposit account information service company that issues
reports concerning account closures due to:
(A) fraud;
(B) substantial overdrafts;
(C) ATM abuse; or
(D) similar negative information concerning a consumer;
to inquiring financial institutions for use only in reviewing a
consumer's request for a deposit account at the inquiring
financial institution.
(4) A consumer reporting agency that furnishes specialized
credit reporting tools to an energy utility. As added by P.L.104-2007, SEC.1.
IC 24-5-24-12 Written confirmation of change to official information; exception
for technical modification
Sec. 12. (a) Except as provided in subsection (b), if a security
freeze is in place with respect to a consumer's consumer report, a
consumer reporting agency may not change any of the following
official information on the consumer's consumer report without
sending written confirmation of the change to the consumer not later
than thirty (30) days after the change is posted to the consumer's
consumer report:
(1) Name.
(2) Date of birth.
(3) Social Security number.
(4) Address.
In the case of an address change, the written confirmation required
under this section shall be sent to both the new address and the old
address.
(b) Written confirmation is not required under this section for
technical modifications of a consumer's official information,
including changes involving:
(1) the use of name or street:
(A) abbreviations; or
(B) complete spellings; or
(2) transpositions of numbers or letters in a consumer's name or
address. As added by P.L.104-2007, SEC.1.
IC 24-5-24-13 Notice with written disclosure; content
Sec. 13. A consumer reporting agency shall provide to a consumer
notice with each written disclosure by the consumer reporting agency
as required under Section 609 of the federal Fair Credit Reporting
Act (15 U.S.C. 1681g) that the consumer may place a security freeze
on the consumer's consumer report. The notice under this section
must be in the following form:
"UNDER IC 24-5-24, YOU MAY OBTAIN A SECURITY
FREEZE ON YOUR CONSUMER REPORT TO PROTECT
YOUR PRIVACY AND ENSURE THAT CREDIT IS NOT
GRANTED IN YOUR NAME WITHOUT YOUR
KNOWLEDGE. THE SECURITY FREEZE WILL PROHIBIT
A CONSUMER REPORTING AGENCY FROM RELEASING
ANY INFORMATION IN YOUR CONSUMER REPORT
WITHOUT YOUR EXPRESS AUTHORIZATION OR
APPROVAL. THE SECURITY FREEZE IS DESIGNED TO
PREVENT CREDIT LOANS AND SERVICES FROM BEING
APPROVED IN YOUR NAME WITHOUT YOUR
CONSENT. WHEN YOU PLACE A SECURITY FREEZE ON
YOUR CONSUMER REPORT, WITHIN TEN (10)
BUSINESS DAYS YOU WILL BE PROVIDED A
PERSONAL IDENTIFICATION NUMBER TO USE IF YOU
CHOOSE TO REMOVE THE SECURITY FREEZE OR TO
TEMPORARILY AUTHORIZE THE RELEASE OF YOUR
CONSUMER REPORT FOR A PERIOD OF TIME OR TO A
SPECIFIC PERSON AFTER THE SECURITY FREEZE IS IN
PLACE. A SECURITY FREEZE DOES NOT APPLY TO
PERSONS OR ENTITIES LISTED IN IC 24-5-24-11. IF YOU
ARE ACTIVELY SEEKING CREDIT, YOU SHOULD
UNDERSTAND THAT THE PROCEDURES INVOLVED IN
LIFTING A SECURITY FREEZE MAY SLOW YOUR OWN
APPLICATIONS FOR CREDIT. YOU HAVE A RIGHT TO
BRING A CIVIL ACTION AGAINST SOMEONE WHO
VIOLATES YOUR RIGHTS UNDER IC 24-5-24.". As added by P.L.104-2007, SEC.1.
IC 24-5-24-14 Fee prohibited
Sec. 14. A consumer reporting agency may not impose a charge
on a consumer for a request from the consumer to do any of the
following:
(1) Place a security freeze on a consumer's consumer report
under section 5 of this chapter.
(2) Issue the same or a new personal identification number or
password to a consumer under section 6 of this chapter.
(3) Release a consumer's consumer report to a third party upon
request of the consumer under section 7(a)(1) of this chapter. In
addition a consumer reporting agency may not impose a charge
on the third party to whom the consumer's consumer report is
released under section 7(a)(1) of this chapter in connection with
the release.
(4) Temporarily lift a security freeze under section 7(a)(2) of
this chapter.
(5) Remove a security freeze under section 9 of this chapter. As added by P.L.104-2007, SEC.1.
IC 24-5-24-15 Civil action; liability
Sec. 15. (a) A consumer who suffers injury by an act of a
consumer reporting agency that violates this chapter may bring a
civil action against the consumer reporting agency in a circuit or
superior court in the county in which the consumer resides.
(b) A person who knowingly or intentionally fails to comply with
any requirement imposed under this chapter with respect to a
consumer is liable to that consumer in an amount equal to the sum of
the following:
(1) The greater of:
(A) the amount of actual damages sustained by the consumer
as a result of the failure to comply; or
(B) five hundred dollars ($500).
However, the amount awarded to a consumer under this
subdivision may not exceed six thousand dollars ($6,000),
regardless of the consumer's actual damages.
(2) Such punitive damages as the court may allow.
(3) In the case of a successful action by a consumer under this
section, the costs of the action together with reasonable
attorney's fees as determined by the court. As added by P.L.104-2007, SEC.1.
IC 24-5-24-16 Civil penalty
Sec. 16. (a) The attorney general may bring an action to recover
from a person on behalf of the state a civil penalty described in
subsection (b).
(b) A person who knowingly or intentionally violates this chapter
is subject to a civil penalty of:
(1) not more than two thousand five hundred dollars ($2,500)
for a violation or series of violations concerning one (1)
consumer; or
(2) not more than a total of one hundred thousand dollars
($100,000) for related violations concerning more than one (1)
consumer. As added by P.L.104-2007, SEC.1.
IC 24-5-24-17 Severability
Sec. 17. The provisions of this chapter are severable as provided
in IC 1-1-1-8(b). As added by P.L.104-2007, SEC.1.
IC 24-5-24
Chapter 24. Security Freezes for Consumer Reports
IC 24-5-24-1 "Consumer"
Sec. 1. As used in this chapter, "consumer" means an individual:
(1) whose principal residence is in Indiana; and
(2) whose credit information and history is recorded in a
consumer report. As added by P.L.104-2007, SEC.1.
IC 24-5-24-2 "Consumer report"
Sec. 2. (a) As used in this chapter, "consumer report" means any
written, oral, or other communication of any information that:
(1) is made by a consumer reporting agency;
(2) bears on a consumer's creditworthiness, credit standing,
credit capacity, character, general reputation, personal
characteristics, or mode of living; and
(3) is used or expected to be used or collected in whole or in
part for the purpose of serving as a factor in establishing a
consumer's eligibility for credit to be used primarily for
personal, family, or household purposes.
(b) The term includes a consumer's credit score. As added by P.L.104-2007, SEC.1.
IC 24-5-24-3 "Consumer reporting agency"
Sec. 3. (a) As used in this chapter, "consumer reporting agency"
means any person that, for monetary fees or dues, or on a cooperative
nonprofit basis, regularly engages in whole or in part in the practice
of assembling or evaluating information concerning a consumer's
credit or other information for the purpose of furnishing a consumer
report to another person.
(b) The term does not include an entity designated as a
commercially reasonable private consumer credit reporting entity
under IC 24-4.5-7-404(5). As added by P.L.104-2007, SEC.1.
IC 24-5-24-4 "Security freeze"
Sec. 4. As used in this chapter, "security freeze" means a
designation placed on a consumer's consumer report:
(1) by a consumer reporting agency; and
(2) at the request of the consumer;
that prohibits the consumer reporting agency from releasing the
consumer report without the authorization of the consumer. As added by P.L.104-2007, SEC.1.
IC 24-5-24-5 Requesting and placing a security freeze; requirements; exception;
electronic mail connection
Sec. 5. (a) A consumer may place a security freeze on the
consumer's consumer report by:
(1) sending a written request by United States mail to an
address designated by the consumer reporting agency; or
(2) subject to subsection (d), making a request to a consumer
reporting agency through a secure electronic mail connection
provided by the consumer reporting agency.
(b) Except as provided in subsection (c) and section 11 of this
chapter, a consumer reporting agency that receives a request under
subsection (a) shall place a security freeze on the consumer's
consumer report not later than five (5) business days after receipt of
the request.
(c) A consumer reporting agency is not required to place a
security freeze on a consumer report under this section if the
consumer reporting agency determines that the request for a security
freeze:
(1) is materially false; or
(2) does not clearly identify the person making the request as
the consumer.
(d) Not later than January 1, 2009, a consumer reporting agency
shall develop and make available to consumers a secure electronic
mail connection by which a consumer can request:
(1) the placement of a security freeze on the consumer's
consumer report under this section; or
(2) the same or a new personal identification number or
password under section 6(b) of this chapter. As added by P.L.104-2007, SEC.1.
IC 24-5-24-6 Written confirmation of security freeze; unique personal
identification number or password; instructions; time
requirements
Sec. 6. (a) Not later than ten (10) business days after receiving a
request for a security freeze under section 5 of this chapter, a
consumer reporting agency shall issue to the consumer a written
confirmation that a security freeze has been placed on the consumer's
consumer report. The confirmation required by this section must
include the following:
(1) A unique:
(A) personal identification number; or
(B) password;
other than the consumer's Social Security number, or any
multiple digit segment of the consumer's Social Security
number, to be used by the consumer to perform any of the acts
described in subdivision (2).
(2) Written instructions explaining how the consumer may:
(A) release the consumer's consumer report to one (1) or
more specified third parties;
(B) temporarily lift the security freeze for a specified period;
or
(C) remove the security freeze.
(3) Written instructions explaining how the consumer may
request, using one (1) of the methods described in section 5(a)
of this chapter, that the consumer reporting agency issue the
same or a new personal identification number or password to
the consumer if the consumer fails to retain the original
personal identification number or password issued by the
consumer reporting agency under subdivision (1).
(b) Upon receiving a request described in subsection (a)(3), the
consumer reporting agency shall issue the same or a new personal
identification number or password to the requesting consumer if the
consumer has provided information sufficient to identify the
consumer, as specified by the consumer reporting agency in the
instructions provided to the consumer under subsection (a)(3). If the
consumer's request is made using the method described in section
5(a)(1) of this chapter, the consumer reporting agency shall send, by
United States mail, the personal identification number or password
to the consumer not later than five (5) business days after receiving
the consumer's request. If the consumer's request is made using the
method described in section 5(a)(2) of this chapter, the consumer
reporting agency shall issue the personal identification number or
password not later than:
(1) subject to the exceptions set forth in sections 7(e)(2) and
9(c)(2) of this chapter, as applicable, fifteen (15) minutes after
receiving the request, if the consumer reporting agency elects
to issue the personal identification number or password by a
secure electronic mail connection provided by the consumer
reporting agency under section 5(d) of this chapter; or
(2) five (5) business days after receiving the request, if the
consumer reporting agency elects to issue the personal
identification number or password by United States mail. As added by P.L.104-2007, SEC.1.
IC 24-5-24-7 Releasing the consumer report upon authorization; developing
secure procedures; time requirements; exceptions
Sec. 7. (a) Except as provided in section 10 of this chapter, if a
security freeze has been placed on a consumer's consumer report, the
consumer reporting agency that placed the security freeze on the
consumer report shall not release the consumer's consumer report
unless the consumer authorizes the consumer reporting agency to:
(1) release the consumer's consumer report to one (1) or more
specified third parties; or
(2) temporarily lift the security freeze for a specified period.
(b) A consumer who seeks to authorize the release of the
consumer's consumer report under subsection (a)(1) or (a)(2) shall
request the release by contacting the consumer reporting agency by
any method:
(1) described in section 5(a) of this chapter; or
(2) developed by the consumer reporting agency under
subsection (d).
(c) A request by a consumer under subsection (b) must include the
following:
(1) Information sufficient to identify the consumer, as specified
by the consumer reporting agency in the instructions provided
to the consumer under section 6(a)(2) of this chapter.
(2) The unique personal identification number or password
assigned to the consumer under section 6(a)(1) or 6(a)(3) of this
chapter.
(3) If the consumer seeks to authorize the release of the
consumer's consumer report under subsection (a)(1),
information sufficient to identify the parties to whom the
consumer report is to be released, as specified by the consumer
reporting agency in the instructions provided to the consumer
under section 6(a)(2) of this chapter.
(4) If the consumer seeks to authorize the consumer reporting
agency to temporarily lift a security freeze under subsection
(a)(2), the period during which the security freeze is to be
temporarily lifted.
(d) Not later than January 1, 2009, a consumer reporting agency
shall develop and make available to consumers secure procedures to
authorize the release of a consumer's consumer report under
subsection (a)(1), or to authorize the temporary lifting of a security
freeze under subsection (a)(2), within fifteen (15) minutes of
receiving a request under subsection (b), by any of the following
methods:
(1) Telephone.
(2) The Internet.
(3) Other electronic media, if provided by the consumer
reporting agency.
The procedures developed by a consumer reporting agency under this
subsection must require the consumer to provide the information set
forth in subsection (c).
(e) A consumer reporting agency that receives a request from a
consumer under this section shall comply with the request within the
following time frames:
(1) Not later than three (3) business days after receiving the
request, if the consumer makes the request by the method
described in section 5(a)(1) of this chapter.
(2) Not later than fifteen (15) minutes after receiving the
request, if the consumer makes the request using the method
described in section 5(a)(2) of this chapter or by any method
developed by the consumer reporting agency under subsection
(d). However, a consumer reporting agency is not required to
comply with a consumer's request within the fifteen (15) minute
time frame set forth in this subdivision if:
(A) the consumer does not provide one (1) or more of the
items listed in subsection (c); or
(B) the consumer reporting agency's ability to comply with
the request within the fifteen (15) minute time frame set
forth in this subdivision is prevented by any of the
following:
(i) An act of God, including fire, an earthquake, a
hurricane, a storm, or a similar natural disaster or
phenomenon.
(ii) Unauthorized or illegal acts by a third party, including
terrorism, sabotage, riot, vandalism, labor strikes or
disputes disrupting operations, or similar occurrences.
(iii) An operational interruption, including an electrical
failure, an unanticipated delay in the delivery of
equipment or replacement parts, computer hardware or
software failures inhibiting response time, or similar
disruptions.
(iv) A governmental action, including an emergency order
or regulation, a judicial action, a law enforcement action,
or a similar directive.
(v) Regularly scheduled maintenance of, or updates to, the
consumer reporting agency's computer systems, if the
maintenance activities or updates occur other than during
normal business hours.
(vi) Commercially reasonable maintenance of, or repairs
to, the consumer reporting agency's computer systems, if
the maintenance activities or repairs are unexpected or are
necessitated by unanticipated conditions or malfunctions.
(vii) For a request made by telephone, receipt of a request
under this section other than during the consumer
reporting agency's normal business hours, including any
extended business hours observed by the consumer
reporting agency. The exemption provided by this item
does not apply to a request made by a consumer through
the Internet or other electronic media. A consumer
reporting agency must comply with a request made by a
consumer through the Internet or other electronic media
within the fifteen (15) minute time frame set forth in this
subdivision, even if the request is made at a time other
than during the consumer reporting agency's normal or
extended business hours. As added by P.L.104-2007, SEC.1.
IC 24-5-24-8 Application treated as incomplete by third party; notification of
security freeze
Sec. 8. (a) A third party that requests a consumer's consumer
report in connection with an application by the consumer for credit
shall treat the application for credit as incomplete if:
(1) a security freeze has been placed on the consumer's
consumer report;
(2) the consumer has not authorized the release of the
consumer's consumer report under section 7 of this chapter; and
(3) the consumer reporting agency refuses to release the
consumer report to the third party based on subdivisions (1) and
(2).
(b) A consumer reporting agency that refuses under subsection
(a)(3) to release a consumer report shall notify the third party
requesting the consumer report of the existence of a security freeze
as the basis for the refusal to release the consumer report to the third
party.
(c) A consumer reporting agency shall not:
(1) state; or
(2) otherwise imply;
to a third party that the consumer's security freeze under this chapter
reflects a negative credit score, history, report, or rating. As added by P.L.104-2007, SEC.1.
IC 24-5-24-9 Security freeze remains in effect; requesting removal;
requirements; time requirements; exceptions
Sec. 9. (a) A security freeze remains in effect until the consumer
who requested the security freeze requests that the security freeze be
removed. A consumer who seeks to authorize a consumer reporting
agency to remove a security freeze shall request the removal by
contacting the consumer reporting agency by any method:
(1) described in section 5(a) of this chapter; or
(2) developed by a consumer reporting agency under section
7(d) of this chapter for receiving a consumer's request to
authorize the release of a consumer report or the temporary
lifting of a security freeze.
(b) A request by a consumer under subsection (a) must include the
following:
(1) Information sufficient to identify the consumer, as specified
by the consumer reporting agency in the instructions provided
to the consumer under section 6(a)(2) of this chapter.
(2) The unique personal identification number or password
assigned to the consumer under section 6(a)(1) or 6(a)(3) of this
chapter.
(c) Subject to subsection (d), a consumer reporting agency must
remove a security freeze within the following time frames:
(1) Not later than three (3) business days after receiving a
request under subsection (a), if the consumer makes the request
by the method described in section 5(a)(1) of this chapter.
(2) Not later than fifteen (15) minutes after receiving a request
under subsection (a), if the consumer makes the request using
the method described in section 5(a)(2) of this chapter or by any
method developed by the consumer reporting agency under
section 7(d) of this chapter. However, a consumer reporting
agency is not required to comply with a consumer's request
within the fifteen (15) minute time frame set forth in this
subdivision if:
(A) the consumer does not provide one (1) or more of the
items listed in subsection (b); or
(B) the consumer reporting agency's ability to comply with
the request within the fifteen (15) minute time frame set
forth in this subdivision is prevented by any of the
following:
(i) An act of God, including fire, an earthquake, a
hurricane, a storm, or a similar natural disaster or
phenomenon.
(ii) Unauthorized or illegal acts by a third party, including
terrorism, sabotage, riot, vandalism, labor strikes or
disputes disrupting operations, or similar occurrences.
(iii) An operational interruption, including an electrical
failure, an unanticipated delay in the delivery of
equipment or replacement parts, computer hardware or
software failures inhibiting response time, or similar
disruptions.
(iv) A governmental action, including an emergency order
or regulation, a judicial action, a law enforcement action,
or a similar directive.
(v) Regularly scheduled maintenance of, or updates to, the
consumer reporting agency's computer systems, if the
maintenance activities or updates occur other than during
normal business hours.
(vi) Commercially reasonable maintenance of, or repairs
to, the consumer reporting agency's computer systems, if
the maintenance activities or repairs are unexpected or are
necessitated by unanticipated conditions or malfunctions.
(vii) For a request made by telephone, receipt of a request
under this section other than during the consumer
reporting agency's normal business hours, including any
extended business hours observed by the consumer
reporting agency. The exemption provided by this item
does not apply to a request made by a consumer through
the Internet or other electronic media. A consumer
reporting agency must comply with a request made by a
consumer through the Internet or other electronic media
within the fifteen (15) minute time frame set forth in this
subdivision, even if the request is made at a time other
than during the consumer reporting agency's normal or
extended business hours.
(d) A consumer reporting agency is not required to remove a
security freeze under this section if the consumer reporting agency
determines that the request to remove the security freeze:
(1) is materially false; or
(2) does not clearly identify the person making the request as
the consumer. As added by P.L.104-2007, SEC.1.
IC 24-5-24-10 Persons excluded from security freeze restrictions
Sec. 10. The placement of a security freeze on a consumer's
consumer report does not prohibit a consumer reporting agency from
providing the consumer's consumer report to the following persons
without the authorization of the consumer:
(1) A person, including a subsidiary, an affiliate, an agent, an
assignee of a financial obligation owed by the consumer to the
person, or a prospective assignee of a financial obligation owed
by the consumer to the person in connection with the proposed
purchase of the financial obligation, to whom the consumer
owes a financial obligation in connection with any of the
following:
(A) An account, including a demand deposit account, that
the consumer has with the person, for the purpose of:
(i) reviewing the account, including activities related to
account maintenance, monitoring, credit line increases,
and account upgrades and enhancements; or
(ii) collecting the obligation owed in connection with the
account.
(B) A contract, for the purpose of collecting the obligation
owed in connection with the contract.
(C) A negotiable instrument that the consumer has issued to
the person, for the purpose of collecting the obligation owed
in connection with the negotiable instrument.
(2) A person, including a subsidiary, an affiliate, an agent, or an
assignee of a financial obligation owed by the consumer to the
person, to whom the consumer has authorized the release of the
consumer's consumer report under section 7(a)(1) of this
chapter, for the purpose of facilitating the extension of credit or
for any permissible purpose under subdivision (1).
(3) A law enforcement agency.
(4) Any person for the purpose of prescreening, as provided in
the federal Fair Credit Reporting Act (15 U.S.C. 1681 et seq.).
(5) Any person administering a credit monitoring subscription
service to which the consumer has subscribed.
(6) The consumer, upon the consumer's request, or any other
person for the purpose of providing the consumer with a copy
of the consumer's consumer report, upon the consumer's
request.
(7) Any of the following that provides services to a consumer:
(A) An insurer licensed under IC 27.
(B) An insurance producer licensed under IC 27.
(C) An agent, a vendor, or an employee of:
(i) an insurer licensed under IC 27; or
(ii) an insurance producer licensed under IC 27;
while acting on behalf of the insurer or the insurance
producer. As added by P.L.104-2007, SEC.1.
IC 24-5-24-11 "Energy utility"; "specialized credit reporting tool"; persons
excluded from security freeze requirements
Sec. 11. (a) As used in this section, "energy utility" has the
meaning set forth in IC 8-1-2.5-2.
(b) As used in this section, "specialized credit reporting tool"
means a scoring model that:
(1) is available only to an energy utility; and
(2) is used by the energy utility to validate a consumer's identity
and creditworthiness.
(c) The following persons are not required to place a security
freeze on a consumer's consumer report:
(1) A consumer reporting agency that acts only as a reseller (as
defined in 15 U.S.C. 1681a(u)) of information. However, a
consumer reporting agency must honor any security freeze
placed on a consumer's consumer report by another consumer
reporting agency.
(2) A:
(A) check services; or
(B) fraud prevention services;
company that reports on incidents of fraud or issues
authorizations for the purpose of approving or processing
negotiable instruments, electronic fund transfers, or similar
methods of payment.
(3) A deposit account information service company that issues
reports concerning account closures due to:
(A) fraud;
(B) substantial overdrafts;
(C) ATM abuse; or
(D) similar negative information concerning a consumer;
to inquiring financial institutions for use only in reviewing a
consumer's request for a deposit account at the inquiring
financial institution.
(4) A consumer reporting agency that furnishes specialized
credit reporting tools to an energy utility. As added by P.L.104-2007, SEC.1.
IC 24-5-24-12 Written confirmation of change to official information; exception
for technical modification
Sec. 12. (a) Except as provided in subsection (b), if a security
freeze is in place with respect to a consumer's consumer report, a
consumer reporting agency may not change any of the following
official information on the consumer's consumer report without
sending written confirmation of the change to the consumer not later
than thirty (30) days after the change is posted to the consumer's
consumer report:
(1) Name.
(2) Date of birth.
(3) Social Security number.
(4) Address.
In the case of an address change, the written confirmation required
under this section shall be sent to both the new address and the old
address.
(b) Written confirmation is not required under this section for
technical modifications of a consumer's official information,
including changes involving:
(1) the use of name or street:
(A) abbreviations; or
(B) complete spellings; or
(2) transpositions of numbers or letters in a consumer's name or
address. As added by P.L.104-2007, SEC.1.
IC 24-5-24-13 Notice with written disclosure; content
Sec. 13. A consumer reporting agency shall provide to a consumer
notice with each written disclosure by the consumer reporting agency
as required under Section 609 of the federal Fair Credit Reporting
Act (15 U.S.C. 1681g) that the consumer may place a security freeze
on the consumer's consumer report. The notice under this section
must be in the following form:
"UNDER IC 24-5-24, YOU MAY OBTAIN A SECURITY
FREEZE ON YOUR CONSUMER REPORT TO PROTECT
YOUR PRIVACY AND ENSURE THAT CREDIT IS NOT
GRANTED IN YOUR NAME WITHOUT YOUR
KNOWLEDGE. THE SECURITY FREEZE WILL PROHIBIT
A CONSUMER REPORTING AGENCY FROM RELEASING
ANY INFORMATION IN YOUR CONSUMER REPORT
WITHOUT YOUR EXPRESS AUTHORIZATION OR
APPROVAL. THE SECURITY FREEZE IS DESIGNED TO
PREVENT CREDIT LOANS AND SERVICES FROM BEING
APPROVED IN YOUR NAME WITHOUT YOUR
CONSENT. WHEN YOU PLACE A SECURITY FREEZE ON
YOUR CONSUMER REPORT, WITHIN TEN (10)
BUSINESS DAYS YOU WILL BE PROVIDED A
PERSONAL IDENTIFICATION NUMBER TO USE IF YOU
CHOOSE TO REMOVE THE SECURITY FREEZE OR TO
TEMPORARILY AUTHORIZE THE RELEASE OF YOUR
CONSUMER REPORT FOR A PERIOD OF TIME OR TO A
SPECIFIC PERSON AFTER THE SECURITY FREEZE IS IN
PLACE. A SECURITY FREEZE DOES NOT APPLY TO
PERSONS OR ENTITIES LISTED IN IC 24-5-24-11. IF YOU
ARE ACTIVELY SEEKING CREDIT, YOU SHOULD
UNDERSTAND THAT THE PROCEDURES INVOLVED IN
LIFTING A SECURITY FREEZE MAY SLOW YOUR OWN
APPLICATIONS FOR CREDIT. YOU HAVE A RIGHT TO
BRING A CIVIL ACTION AGAINST SOMEONE WHO
VIOLATES YOUR RIGHTS UNDER IC 24-5-24.". As added by P.L.104-2007, SEC.1.
IC 24-5-24-14 Fee prohibited
Sec. 14. A consumer reporting agency may not impose a charge
on a consumer for a request from the consumer to do any of the
following:
(1) Place a security freeze on a consumer's consumer report
under section 5 of this chapter.
(2) Issue the same or a new personal identification number or
password to a consumer under section 6 of this chapter.
(3) Release a consumer's consumer report to a third party upon
request of the consumer under section 7(a)(1) of this chapter. In
addition a consumer reporting agency may not impose a charge
on the third party to whom the consumer's consumer report is
released under section 7(a)(1) of this chapter in connection with
the release.
(4) Temporarily lift a security freeze under section 7(a)(2) of
this chapter.
(5) Remove a security freeze under section 9 of this chapter. As added by P.L.104-2007, SEC.1.
IC 24-5-24-15 Civil action; liability
Sec. 15. (a) A consumer who suffers injury by an act of a
consumer reporting agency that violates this chapter may bring a
civil action against the consumer reporting agency in a circuit or
superior court in the county in which the consumer resides.
(b) A person who knowingly or intentionally fails to comply with
any requirement imposed under this chapter with respect to a
consumer is liable to that consumer in an amount equal to the sum of
the following:
(1) The greater of:
(A) the amount of actual damages sustained by the consumer
as a result of the failure to comply; or
(B) five hundred dollars ($500).
However, the amount awarded to a consumer under this
subdivision may not exceed six thousand dollars ($6,000),
regardless of the consumer's actual damages.
(2) Such punitive damages as the court may allow.
(3) In the case of a successful action by a consumer under this
section, the costs of the action together with reasonable
attorney's fees as determined by the court. As added by P.L.104-2007, SEC.1.
IC 24-5-24-16 Civil penalty
Sec. 16. (a) The attorney general may bring an action to recover
from a person on behalf of the state a civil penalty described in
subsection (b).
(b) A person who knowingly or intentionally violates this chapter
is subject to a civil penalty of:
(1) not more than two thousand five hundred dollars ($2,500)
for a violation or series of violations concerning one (1)
consumer; or
(2) not more than a total of one hundred thousand dollars
($100,000) for related violations concerning more than one (1)
consumer. As added by P.L.104-2007, SEC.1.
IC 24-5-24-17 Severability
Sec. 17. The provisions of this chapter are severable as provided
in IC 1-1-1-8(b). As added by P.L.104-2007, SEC.1.
IC 24-5-24
Chapter 24. Security Freezes for Consumer Reports
IC 24-5-24-1 "Consumer"
Sec. 1. As used in this chapter, "consumer" means an individual:
(1) whose principal residence is in Indiana; and
(2) whose credit information and history is recorded in a
consumer report. As added by P.L.104-2007, SEC.1.
IC 24-5-24-2 "Consumer report"
Sec. 2. (a) As used in this chapter, "consumer report" means any
written, oral, or other communication of any information that:
(1) is made by a consumer reporting agency;
(2) bears on a consumer's creditworthiness, credit standing,
credit capacity, character, general reputation, personal
characteristics, or mode of living; and
(3) is used or expected to be used or collected in whole or in
part for the purpose of serving as a factor in establishing a
consumer's eligibility for credit to be used primarily for
personal, family, or household purposes.
(b) The term includes a consumer's credit score. As added by P.L.104-2007, SEC.1.
IC 24-5-24-3 "Consumer reporting agency"
Sec. 3. (a) As used in this chapter, "consumer reporting agency"
means any person that, for monetary fees or dues, or on a cooperative
nonprofit basis, regularly engages in whole or in part in the practice
of assembling or evaluating information concerning a consumer's
credit or other information for the purpose of furnishing a consumer
report to another person.
(b) The term does not include an entity designated as a
commercially reasonable private consumer credit reporting entity
under IC 24-4.5-7-404(5). As added by P.L.104-2007, SEC.1.
IC 24-5-24-4 "Security freeze"
Sec. 4. As used in this chapter, "security freeze" means a
designation placed on a consumer's consumer report:
(1) by a consumer reporting agency; and
(2) at the request of the consumer;
that prohibits the consumer reporting agency from releasing the
consumer report without the authorization of the consumer. As added by P.L.104-2007, SEC.1.
IC 24-5-24-5 Requesting and placing a security freeze; requirements; exception;
electronic mail connection
Sec. 5. (a) A consumer may place a security freeze on the
consumer's consumer report by:
(1) sending a written request by United States mail to an
address designated by the consumer reporting agency; or
(2) subject to subsection (d), making a request to a consumer
reporting agency through a secure electronic mail connection
provided by the consumer reporting agency.
(b) Except as provided in subsection (c) and section 11 of this
chapter, a consumer reporting agency that receives a request under
subsection (a) shall place a security freeze on the consumer's
consumer report not later than five (5) business days after receipt of
the request.
(c) A consumer reporting agency is not required to place a
security freeze on a consumer report under this section if the
consumer reporting agency determines that the request for a security
freeze:
(1) is materially false; or
(2) does not clearly identify the person making the request as
the consumer.
(d) Not later than January 1, 2009, a consumer reporting agency
shall develop and make available to consumers a secure electronic
mail connection by which a consumer can request:
(1) the placement of a security freeze on the consumer's
consumer report under this section; or
(2) the same or a new personal identification number or
password under section 6(b) of this chapter. As added by P.L.104-2007, SEC.1.
IC 24-5-24-6 Written confirmation of security freeze; unique personal
identification number or password; instructions; time
requirements
Sec. 6. (a) Not later than ten (10) business days after receiving a
request for a security freeze under section 5 of this chapter, a
consumer reporting agency shall issue to the consumer a written
confirmation that a security freeze has been placed on the consumer's
consumer report. The confirmation required by this section must
include the following:
(1) A unique:
(A) personal identification number; or
(B) password;
other than the consumer's Social Security number, or any
multiple digit segment of the consumer's Social Security
number, to be used by the consumer to perform any of the acts
described in subdivision (2).
(2) Written instructions explaining how the consumer may:
(A) release the consumer's consumer report to one (1) or
more specified third parties;
(B) temporarily lift the security freeze for a specified period;
or
(C) remove the security freeze.
(3) Written instructions explaining how the consumer may
request, using one (1) of the methods described in section 5(a)
of this chapter, that the consumer reporting agency issue the
same or a new personal identification number or password to
the consumer if the consumer fails to retain the original
personal identification number or password issued by the
consumer reporting agency under subdivision (1).
(b) Upon receiving a request described in subsection (a)(3), the
consumer reporting agency shall issue the same or a new personal
identification number or password to the requesting consumer if the
consumer has provided information sufficient to identify the
consumer, as specified by the consumer reporting agency in the
instructions provided to the consumer under subsection (a)(3). If the
consumer's request is made using the method described in section
5(a)(1) of this chapter, the consumer reporting agency shall send, by
United States mail, the personal identification number or password
to the consumer not later than five (5) business days after receiving
the consumer's request. If the consumer's request is made using the
method described in section 5(a)(2) of this chapter, the consumer
reporting agency shall issue the personal identification number or
password not later than:
(1) subject to the exceptions set forth in sections 7(e)(2) and
9(c)(2) of this chapter, as applicable, fifteen (15) minutes after
receiving the request, if the consumer reporting agency elects
to issue the personal identification number or password by a
secure electronic mail connection provided by the consumer
reporting agency under section 5(d) of this chapter; or
(2) five (5) business days after receiving the request, if the
consumer reporting agency elects to issue the personal
identification number or password by United States mail. As added by P.L.104-2007, SEC.1.
IC 24-5-24-7 Releasing the consumer report upon authorization; developing
secure procedures; time requirements; exceptions
Sec. 7. (a) Except as provided in section 10 of this chapter, if a
security freeze has been placed on a consumer's consumer report, the
consumer reporting agency that placed the security freeze on the
consumer report shall not release the consumer's consumer report
unless the consumer authorizes the consumer reporting agency to:
(1) release the consumer's consumer report to one (1) or more
specified third parties; or
(2) temporarily lift the security freeze for a specified period.
(b) A consumer who seeks to authorize the release of the
consumer's consumer report under subsection (a)(1) or (a)(2) shall
request the release by contacting the consumer reporting agency by
any method:
(1) described in section 5(a) of this chapter; or
(2) developed by the consumer reporting agency under
subsection (d).
(c) A request by a consumer under subsection (b) must include the
following:
(1) Information sufficient to identify the consumer, as specified
by the consumer reporting agency in the instructions provided
to the consumer under section 6(a)(2) of this chapter.
(2) The unique personal identification number or password
assigned to the consumer under section 6(a)(1) or 6(a)(3) of this
chapter.
(3) If the consumer seeks to authorize the release of the
consumer's consumer report under subsection (a)(1),
information sufficient to identify the parties to whom the
consumer report is to be released, as specified by the consumer
reporting agency in the instructions provided to the consumer
under section 6(a)(2) of this chapter.
(4) If the consumer seeks to authorize the consumer reporting
agency to temporarily lift a security freeze under subsection
(a)(2), the period during which the security freeze is to be
temporarily lifted.
(d) Not later than January 1, 2009, a consumer reporting agency
shall develop and make available to consumers secure procedures to
authorize the release of a consumer's consumer report under
subsection (a)(1), or to authorize the temporary lifting of a security
freeze under subsection (a)(2), within fifteen (15) minutes of
receiving a request under subsection (b), by any of the following
methods:
(1) Telephone.
(2) The Internet.
(3) Other electronic media, if provided by the consumer
reporting agency.
The procedures developed by a consumer reporting agency under this
subsection must require the consumer to provide the information set
forth in subsection (c).
(e) A consumer reporting agency that receives a request from a
consumer under this section shall comply with the request within the
following time frames:
(1) Not later than three (3) business days after receiving the
request, if the consumer makes the request by the method
described in section 5(a)(1) of this chapter.
(2) Not later than fifteen (15) minutes after receiving the
request, if the consumer makes the request using the method
described in section 5(a)(2) of this chapter or by any method
developed by the consumer reporting agency under subsection
(d). However, a consumer reporting agency is not required to
comply with a consumer's request within the fifteen (15) minute
time frame set forth in this subdivision if:
(A) the consumer does not provide one (1) or more of the
items listed in subsection (c); or
(B) the consumer reporting agency's ability to comply with
the request within the fifteen (15) minute time frame set
forth in this subdivision is prevented by any of the
following:
(i) An act of God, including fire, an earthquake, a
hurricane, a storm, or a similar natural disaster or
phenomenon.
(ii) Unauthorized or illegal acts by a third party, including
terrorism, sabotage, riot, vandalism, labor strikes or
disputes disrupting operations, or similar occurrences.
(iii) An operational interruption, including an electrical
failure, an unanticipated delay in the delivery of
equipment or replacement parts, computer hardware or
software failures inhibiting response time, or similar
disruptions.
(iv) A governmental action, including an emergency order
or regulation, a judicial action, a law enforcement action,
or a similar directive.
(v) Regularly scheduled maintenance of, or updates to, the
consumer reporting agency's computer systems, if the
maintenance activities or updates occur other than during
normal business hours.
(vi) Commercially reasonable maintenance of, or repairs
to, the consumer reporting agency's computer systems, if
the maintenance activities or repairs are unexpected or are
necessitated by unanticipated conditions or malfunctions.
(vii) For a request made by telephone, receipt of a request
under this section other than during the consumer
reporting agency's normal business hours, including any
extended business hours observed by the consumer
reporting agency. The exemption provided by this item
does not apply to a request made by a consumer through
the Internet or other electronic media. A consumer
reporting agency must comply with a request made by a
consumer through the Internet or other electronic media
within the fifteen (15) minute time frame set forth in this
subdivision, even if the request is made at a time other
than during the consumer reporting agency's normal or
extended business hours. As added by P.L.104-2007, SEC.1.
IC 24-5-24-8 Application treated as incomplete by third party; notification of
security freeze
Sec. 8. (a) A third party that requests a consumer's consumer
report in connection with an application by the consumer for credit
shall treat the application for credit as incomplete if:
(1) a security freeze has been placed on the consumer's
consumer report;
(2) the consumer has not authorized the release of the
consumer's consumer report under section 7 of this chapter; and
(3) the consumer reporting agency refuses to release the
consumer report to the third party based on subdivisions (1) and
(2).
(b) A consumer reporting agency that refuses under subsection
(a)(3) to release a consumer report shall notify the third party
requesting the consumer report of the existence of a security freeze
as the basis for the refusal to release the consumer report to the third
party.
(c) A consumer reporting agency shall not:
(1) state; or
(2) otherwise imply;
to a third party that the consumer's security freeze under this chapter
reflects a negative credit score, history, report, or rating. As added by P.L.104-2007, SEC.1.
IC 24-5-24-9 Security freeze remains in effect; requesting removal;
requirements; time requirements; exceptions
Sec. 9. (a) A security freeze remains in effect until the consumer
who requested the security freeze requests that the security freeze be
removed. A consumer who seeks to authorize a consumer reporting
agency to remove a security freeze shall request the removal by
contacting the consumer reporting agency by any method:
(1) described in section 5(a) of this chapter; or
(2) developed by a consumer reporting agency under section
7(d) of this chapter for receiving a consumer's request to
authorize the release of a consumer report or the temporary
lifting of a security freeze.
(b) A request by a consumer under subsection (a) must include the
following:
(1) Information sufficient to identify the consumer, as specified
by the consumer reporting agency in the instructions provided
to the consumer under section 6(a)(2) of this chapter.
(2) The unique personal identification number or password
assigned to the consumer under section 6(a)(1) or 6(a)(3) of this
chapter.
(c) Subject to subsection (d), a consumer reporting agency must
remove a security freeze within the following time frames:
(1) Not later than three (3) business days after receiving a
request under subsection (a), if the consumer makes the request
by the method described in section 5(a)(1) of this chapter.
(2) Not later than fifteen (15) minutes after receiving a request
under subsection (a), if the consumer makes the request using
the method described in section 5(a)(2) of this chapter or by any
method developed by the consumer reporting agency under
section 7(d) of this chapter. However, a consumer reporting
agency is not required to comply with a consumer's request
within the fifteen (15) minute time frame set forth in this
subdivision if:
(A) the consumer does not provide one (1) or more of the
items listed in subsection (b); or
(B) the consumer reporting agency's ability to comply with
the request within the fifteen (15) minute time frame set
forth in this subdivision is prevented by any of the
following:
(i) An act of God, including fire, an earthquake, a
hurricane, a storm, or a similar natural disaster or
phenomenon.
(ii) Unauthorized or illegal acts by a third party, including
terrorism, sabotage, riot, vandalism, labor strikes or
disputes disrupting operations, or similar occurrences.
(iii) An operational interruption, including an electrical
failure, an unanticipated delay in the delivery of
equipment or replacement parts, computer hardware or
software failures inhibiting response time, or similar
disruptions.
(iv) A governmental action, including an emergency order
or regulation, a judicial action, a law enforcement action,
or a similar directive.
(v) Regularly scheduled maintenance of, or updates to, the
consumer reporting agency's computer systems, if the
maintenance activities or updates occur other than during
normal business hours.
(vi) Commercially reasonable maintenance of, or repairs
to, the consumer reporting agency's computer systems, if
the maintenance activities or repairs are unexpected or are
necessitated by unanticipated conditions or malfunctions.
(vii) For a request made by telephone, receipt of a request
under this section other than during the consumer
reporting agency's normal business hours, including any
extended business hours observed by the consumer
reporting agency. The exemption provided by this item
does not apply to a request made by a consumer through
the Internet or other electronic media. A consumer
reporting agency must comply with a request made by a
consumer through the Internet or other electronic media
within the fifteen (15) minute time frame set forth in this
subdivision, even if the request is made at a time other
than during the consumer reporting agency's normal or
extended business hours.
(d) A consumer reporting agency is not required to remove a
security freeze under this section if the consumer reporting agency
determines that the request to remove the security freeze:
(1) is materially false; or
(2) does not clearly identify the person making the request as
the consumer. As added by P.L.104-2007, SEC.1.
IC 24-5-24-10 Persons excluded from security freeze restrictions
Sec. 10. The placement of a security freeze on a consumer's
consumer report does not prohibit a consumer reporting agency from
providing the consumer's consumer report to the following persons
without the authorization of the consumer:
(1) A person, including a subsidiary, an affiliate, an agent, an
assignee of a financial obligation owed by the consumer to the
person, or a prospective assignee of a financial obligation owed
by the consumer to the person in connection with the proposed
purchase of the financial obligation, to whom the consumer
owes a financial obligation in connection with any of the
following:
(A) An account, including a demand deposit account, that
the consumer has with the person, for the purpose of:
(i) reviewing the account, including activities related to
account maintenance, monitoring, credit line increases,
and account upgrades and enhancements; or
(ii) collecting the obligation owed in connection with the
account.
(B) A contract, for the purpose of collecting the obligation
owed in connection with the contract.
(C) A negotiable instrument that the consumer has issued to
the person, for the purpose of collecting the obligation owed
in connection with the negotiable instrument.
(2) A person, including a subsidiary, an affiliate, an agent, or an
assignee of a financial obligation owed by the consumer to the
person, to whom the consumer has authorized the release of the
consumer's consumer report under section 7(a)(1) of this
chapter, for the purpose of facilitating the extension of credit or
for any permissible purpose under subdivision (1).
(3) A law enforcement agency.
(4) Any person for the purpose of prescreening, as provided in
the federal Fair Credit Reporting Act (15 U.S.C. 1681 et seq.).
(5) Any person administering a credit monitoring subscription
service to which the consumer has subscribed.
(6) The consumer, upon the consumer's request, or any other
person for the purpose of providing the consumer with a copy
of the consumer's consumer report, upon the consumer's
request.
(7) Any of the following that provides services to a consumer:
(A) An insurer licensed under IC 27.
(B) An insurance producer licensed under IC 27.
(C) An agent, a vendor, or an employee of:
(i) an insurer licensed under IC 27; or
(ii) an insurance producer licensed under IC 27;
while acting on behalf of the insurer or the insurance
producer. As added by P.L.104-2007, SEC.1.
IC 24-5-24-11 "Energy utility"; "specialized credit reporting tool"; persons
excluded from security freeze requirements
Sec. 11. (a) As used in this section, "energy utility" has the
meaning set forth in IC 8-1-2.5-2.
(b) As used in this section, "specialized credit reporting tool"
means a scoring model that:
(1) is available only to an energy utility; and
(2) is used by the energy utility to validate a consumer's identity
and creditworthiness.
(c) The following persons are not required to place a security
freeze on a consumer's consumer report:
(1) A consumer reporting agency that acts only as a reseller (as
defined in 15 U.S.C. 1681a(u)) of information. However, a
consumer reporting agency must honor any security freeze
placed on a consumer's consumer report by another consumer
reporting agency.
(2) A:
(A) check services; or
(B) fraud prevention services;
company that reports on incidents of fraud or issues
authorizations for the purpose of approving or processing
negotiable instruments, electronic fund transfers, or similar
methods of payment.
(3) A deposit account information service company that issues
reports concerning account closures due to:
(A) fraud;
(B) substantial overdrafts;
(C) ATM abuse; or
(D) similar negative information concerning a consumer;
to inquiring financial institutions for use only in reviewing a
consumer's request for a deposit account at the inquiring
financial institution.
(4) A consumer reporting agency that furnishes specialized
credit reporting tools to an energy utility. As added by P.L.104-2007, SEC.1.
IC 24-5-24-12 Written confirmation of change to official information; exception
for technical modification
Sec. 12. (a) Except as provided in subsection (b), if a security
freeze is in place with respect to a consumer's consumer report, a
consumer reporting agency may not change any of the following
official information on the consumer's consumer report without
sending written confirmation of the change to the consumer not later
than thirty (30) days after the change is posted to the consumer's
consumer report:
(1) Name.
(2) Date of birth.
(3) Social Security number.
(4) Address.
In the case of an address change, the written confirmation required
under this section shall be sent to both the new address and the old
address.
(b) Written confirmation is not required under this section for
technical modifications of a consumer's official information,
including changes involving:
(1) the use of name or street:
(A) abbreviations; or
(B) complete spellings; or
(2) transpositions of numbers or letters in a consumer's name or
address. As added by P.L.104-2007, SEC.1.
IC 24-5-24-13 Notice with written disclosure; content
Sec. 13. A consumer reporting agency shall provide to a consumer
notice with each written disclosure by the consumer reporting agency
as required under Section 609 of the federal Fair Credit Reporting
Act (15 U.S.C. 1681g) that the consumer may place a security freeze
on the consumer's consumer report. The notice under this section
must be in the following form:
"UNDER IC 24-5-24, YOU MAY OBTAIN A SECURITY
FREEZE ON YOUR CONSUMER REPORT TO PROTECT
YOUR PRIVACY AND ENSURE THAT CREDIT IS NOT
GRANTED IN YOUR NAME WITHOUT YOUR
KNOWLEDGE. THE SECURITY FREEZE WILL PROHIBIT
A CONSUMER REPORTING AGENCY FROM RELEASING
ANY INFORMATION IN YOUR CONSUMER REPORT
WITHOUT YOUR EXPRESS AUTHORIZATION OR
APPROVAL. THE SECURITY FREEZE IS DESIGNED TO
PREVENT CREDIT LOANS AND SERVICES FROM BEING
APPROVED IN YOUR NAME WITHOUT YOUR
CONSENT. WHEN YOU PLACE A SECURITY FREEZE ON
YOUR CONSUMER REPORT, WITHIN TEN (10)
BUSINESS DAYS YOU WILL BE PROVIDED A
PERSONAL IDENTIFICATION NUMBER TO USE IF YOU
CHOOSE TO REMOVE THE SECURITY FREEZE OR TO
TEMPORARILY AUTHORIZE THE RELEASE OF YOUR
CONSUMER REPORT FOR A PERIOD OF TIME OR TO A
SPECIFIC PERSON AFTER THE SECURITY FREEZE IS IN
PLACE. A SECURITY FREEZE DOES NOT APPLY TO
PERSONS OR ENTITIES LISTED IN IC 24-5-24-11. IF YOU
ARE ACTIVELY SEEKING CREDIT, YOU SHOULD
UNDERSTAND THAT THE PROCEDURES INVOLVED IN
LIFTING A SECURITY FREEZE MAY SLOW YOUR OWN
APPLICATIONS FOR CREDIT. YOU HAVE A RIGHT TO
BRING A CIVIL ACTION AGAINST SOMEONE WHO
VIOLATES YOUR RIGHTS UNDER IC 24-5-24.". As added by P.L.104-2007, SEC.1.
IC 24-5-24-14 Fee prohibited
Sec. 14. A consumer reporting agency may not impose a charge
on a consumer for a request from the consumer to do any of the
following:
(1) Place a security freeze on a consumer's consumer report
under section 5 of this chapter.
(2) Issue the same or a new personal identification number or
password to a consumer under section 6 of this chapter.
(3) Release a consumer's consumer report to a third party upon
request of the consumer under section 7(a)(1) of this chapter. In
addition a consumer reporting agency may not impose a charge
on the third party to whom the consumer's consumer report is
released under section 7(a)(1) of this chapter in connection with
the release.
(4) Temporarily lift a security freeze under section 7(a)(2) of
this chapter.
(5) Remove a security freeze under section 9 of this chapter. As added by P.L.104-2007, SEC.1.
IC 24-5-24-15 Civil action; liability
Sec. 15. (a) A consumer who suffers injury by an act of a
consumer reporting agency that violates this chapter may bring a
civil action against the consumer reporting agency in a circuit or
superior court in the county in which the consumer resides.
(b) A person who knowingly or intentionally fails to comply with
any requirement imposed under this chapter with respect to a
consumer is liable to that consumer in an amount equal to the sum of
the following:
(1) The greater of:
(A) the amount of actual damages sustained by the consumer
as a result of the failure to comply; or
(B) five hundred dollars ($500).
However, the amount awarded to a consumer under this
subdivision may not exceed six thousand dollars ($6,000),
regardless of the consumer's actual damages.
(2) Such punitive damages as the court may allow.
(3) In the case of a successful action by a consumer under this
section, the costs of the action together with reasonable
attorney's fees as determined by the court. As added by P.L.104-2007, SEC.1.
IC 24-5-24-16 Civil penalty
Sec. 16. (a) The attorney general may bring an action to recover
from a person on behalf of the state a civil penalty described in
subsection (b).
(b) A person who knowingly or intentionally violates this chapter
is subject to a civil penalty of:
(1) not more than two thousand five hundred dollars ($2,500)
for a violation or series of violations concerning one (1)
consumer; or
(2) not more than a total of one hundred thousand dollars
($100,000) for related violations concerning more than one (1)
consumer. As added by P.L.104-2007, SEC.1.
IC 24-5-24-17 Severability
Sec. 17. The provisions of this chapter are severable as provided
in IC 1-1-1-8(b). As added by P.L.104-2007, SEC.1.
