Section 3. Security freeze.
(a) Request for freeze.--
(1) A consumer may elect to place a security freeze on
his consumer report by providing proper identification to a
consumer reporting agency. The consumer may make the request
directly to a consumer reporting agency:
(i) by certified mail using an address designated by
the consumer reporting agency; or
(ii) through a secure Internet connection if the
connection is made available by the consumer reporting
agency.
(2) Each consumer reporting agency covered by this act
shall have a toll-free telephone number available to allow a
consumer to receive information about how to request a
security freeze, which the consumer must return by certified
mail.
(3) A consumer reporting agency shall place a security
freeze on a consumer report no later than five business days
after receiving a request for the security freeze from the
consumer.
(4) The following entities are not required to place a
security freeze in a consumer report:
(i) A credit reporting agency that acts only as a
reseller of credit information by assembling and merging
information contained in the database of another credit
reporting agency or multiple credit reporting agencies
and does not maintain a permanent database of credit
information from which new credit reports are produced;
however, a credit reporting agency acting as a reseller
shall honor any security freeze placed on a credit report
by another credit reporting agency.
(ii) A check services or fraud prevention services
company which issues reports on incidents of fraud or
authorizations for the purpose of approving or processing
negotiable instruments, electronic funds transfers or
similar methods of payments.
(iii) A deposit account information service company
which issues reports regarding account closures due to
fraud, substantial overdrafts, automated teller machine
(ATM) abuse or similar negative information regarding a
consumer to inquiring banks or other financial
institutions for use only in reviewing a consumer request
for a deposit account at the inquiring bank or financial
institution.
(b) Effect of security freeze.--Except as provided in subsection (e), when a security freeze is in place, information from a consumer report shall not be released to a third party without prior express authorization from the consumer. This subsection shall not prevent a consumer reporting agency from advising a third party that a security freeze is in effect with respect to a consumer report.
(c) Third-party request.--If a third party requests access to a consumer report on which a security freeze is in effect and the consumer does not allow his or her consumer report to be accessed for that specific party or for a period of time, the third party shall treat the application as incomplete.
(d) Duration of freeze.--A security freeze shall remain in place until the earlier of the date the consumer reporting agency receives a request from the consumer to remove the security freeze or until seven years from the date that the security freeze was put in place by the consumer reporting agency.
(e) Applicability of freeze.--Notwithstanding a security freeze, the following entities may receive a consumer report:
(1) A Federal, State or local government entity,
including a law enforcement agency or court, or their agents
or assigns.
(2) A private collection agency for the sole purpose of
assisting in the collection of an existing debt of the
consumer who is the subject of the consumer report requested.
(3) A person or entity or a subsidiary, affiliate or
agent of that person or entity, or an assignee of a financial
obligation owed by the consumer to that person or entity, or
a prospective assignee of a financial obligation owed by the
consumer to that person or entity in conjunction with the
proposed purchase of the financial obligation, with which the
consumer has or had prior to assignment an account or
contract, including a demand deposit account, or to whom the
consumer issued a negotiable instrument, for the purposes of
reviewing the account or collecting the financial obligation
owing for the account, contract or negotiable instrument. For
purposes of this paragraph, "reviewing the account" includes
activities related to account maintenance, monitoring, credit
line increases and account upgrades and enhancements.
(4) A subsidiary, affiliate, agent, assignee or
prospective assignee of a person to whom access has been
granted under this section for the purposes of facilitating
the extension of credit.
(5) A person, for the purposes of prescreening as
provided by the Fair Credit Reporting Act (Public Law 91-508,
15 U.S.C. § 1681 et seq.).
(6) A consumer reporting agency for the purposes of
providing a consumer with a copy of his own consumer report
on his request.
(7) A child support enforcement agency.
(8) A consumer reporting agency that acts only as a
reseller of credit information by assembling and merging
information contained in the database of another consumer
reporting agency or multiple consumer reporting agencies and
does not maintain a permanent database of credit information
from which new consumer reports are produced. However, a
consumer reporting agency acting as a reseller shall honor
any security freeze placed on a consumer report by another
consumer reporting agency.
(9) A check services or fraud prevention services
company which issues reports on incidents of fraud or
authorizations for the purpose of approving or processing
negotiable instruments, electronic funds transfers or similar
methods of payments.
(10) A deposit account information service company which
issues reports regarding account closures due to fraud,
substantial overdrafts, automated teller machine (ATM) abuse
or similar negative information regarding a consumer to
inquiring banks or other financial institutions for use only
in reviewing a consumer request for a deposit account at the
inquiring bank or financial institution.
(11) Any person or entity for use in setting or
adjusting a rate, issuing or underwriting a policy, adjusting
a claim or servicing a policy for underwriting for property
and casualty insurance purposes.
(12) A person or entity administering a credit file
monitoring subscription service or similar service to which
the consumer has subscribed.