Sections 8-2601 to 8-2615 shall be known and may be cited as the Credit Report Protection Act.

For purposes of the Credit Report Protection Act:

(1) Consumer reporting agency means any person which, for monetary fees, for dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports;

(2) Credit report has the same meaning as consumer report as defined in 15 U.S.C. 1681a(d);

(3) File, when used in connection with information on any consumer or protected consumer, means all of the information on that consumer or protected consumer recorded and retained by a consumer reporting agency regardless of how the information is stored. File does not include a record;

(4) Protected consumer means an individual who is (a) under sixteen years of age at the time a request for the placement of a security freeze is made or (b) an incapacitated person for whom a guardian or guardian ad litem has been appointed;

(5) Record means a compilation of information that (a) identifies a protected consumer, (b) is created by a consumer reporting agency solely for the purpose of complying with section 8-2603.01, and (c) may not be created or used to consider the protected consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living;

(6) Representative means a person who provides to a consumer reporting agency sufficient proof of authority to act on behalf of a protected consumer;

(7) Security freeze means:

(a) A notice placed in a consumer's file as provided in section 8-2603 that prohibits the consumer reporting agency from releasing a credit report, or any other information derived from the file, in connection with the extension of credit or the opening of a new account, without the express authorization of the consumer;

(b) If a consumer reporting agency does not have a file pertaining to a protected consumer, a restriction that:

(i) Is placed on the protected consumer’s record in accordance with section 8-2603.01; and

(ii) Prohibits the consumer reporting agency from releasing the protected consumer’s record except as provided in the Credit Report Protection Act; or

(c) If a consumer reporting agency has a file pertaining to the protected consumer, a restriction that:

(i) Is placed on the protected consumer’s credit report in accordance with section 8-2603.01; and

(ii) Prohibits the consumer reporting agency from releasing the protected consumer’s credit report or any information derived from the protected consumer’s credit report except as provided in section 8-2608.01;

(8) Substantially similar type of security product means any product that provides the same level of protection to a consumer's or protected consumer's credit report as that provided under the Credit Report Protection Act regardless of the contact method used by a consumer or protected consumer to request, temporarily lift, or remove a restriction placed on the consumer’s or protected consumer's credit report;

(9) Sufficient proof of authority means documentation that shows a representative has authority to act on behalf of a protected consumer. Sufficient proof of authority includes, but is not limited to, an order issued by a court of law, a lawfully executed and valid power of attorney, or a written notarized statement signed by a representative that expressly describes the authority of the representative to act on behalf of a protected consumer. A representative who is a parent may establish sufficient proof of authority by providing a certified or official copy of the protected consumer’s birth certificate;

(10) Sufficient proof of identification means information or documentation that identifies a consumer, a protected consumer, or a representative of a protected consumer. Sufficient proof of identification includes, but is not limited to, a social security number or a copy of a social security card, a certified or official copy of a birth certificate, a copy of a valid driver's license, or any other government-issued identification; and

(11) Victim of identity theft means a consumer or protected consumer who has a copy of an official police report evidencing that the consumer or protected consumer has alleged to be a victim of identity theft.

A consumer may elect to place a security freeze on his or her file by submitting a request at the address or other point of contact and in the manner specified by the consumer reporting agency.

(1) A consumer reporting agency shall place a security freeze for a protected consumer if:

(a) The consumer reporting agency receives a request from the representative for the placement of the security freeze under this section; and

(b) The representative:

(i) Submits the request to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency; and

(ii) Provides to the consumer reporting agency:

(A) Sufficient proof of identification of the protected consumer and the representative; and

(B) Sufficient proof of authority to act on behalf of the protected consumer.

(2) If a consumer reporting agency does not have a file pertaining to a protected consumer when the consumer reporting agency receives a request described in subdivision (1)(a) of this section, the consumer reporting agency shall create a record for the protected consumer.

(3) Within thirty days after receiving a request that meets the requirements of this section, a consumer reporting agency shall place a security freeze for the protected consumer.

If a security freeze is in place with respect to a consumer's or protected consumer's file, the consumer reporting agency shall not release a credit report or any other information derived from the file to a third party without the prior express authorization of the consumer, protected consumer, or representative. This section does not prevent a consumer reporting agency from advising a third party that a security freeze is in effect with respect to a consumer's or protected consumer's file.

(1) A consumer reporting agency shall place a security freeze on a file no later than three business days after receiving a request under section 8-2603.

(2) Until July 1, 2008, a consumer reporting agency shall, within ten business days after receiving a request under section 8-2603, send a written confirmation of the security freeze to the consumer and provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of a credit report or any other information derived from his or her file for a specified period of time. Beginning July 1, 2008, a consumer reporting agency shall send such confirmation and provide such identification number or password to the consumer within five business days after receiving a request under section 8-2603.

(3) The written confirmation required under subsection (2) of this section shall include a warning which shall read as follows: WARNING TO PERSONS SEEKING A CREDIT FREEZE AS PERMITTED BY THE CREDIT REPORT PROTECTION ACT: YOU MAY BE DENIED CREDIT AS A RESULT OF A FREEZE PLACED ON YOUR CREDIT.

(1) When a consumer requests a security freeze under section 8-2603, the consumer reporting agency shall disclose the process of placing and temporarily lifting the security freeze, including the process for allowing access to his or her credit report or any other information derived from his or her file for a specified period of time by temporarily lifting the security freeze.

(2) If a consumer wishes to allow his or her credit report or any other information derived from his or her file to be accessed for a specified period of time by temporarily lifting the security freeze placed under section 8-2603, the consumer shall contact the consumer reporting agency, request that the freeze be temporarily lifted, and provide the following:

(a) Sufficient proof of identification of the consumer;

(b) The unique personal identification number or password provided by the consumer reporting agency under section 8-2605; and

(c) The proper information regarding the specified time period.

(3)(a) Until January 1, 2009, a consumer reporting agency that receives a request from a consumer to temporarily lift a security freeze placed under section 8-2603 on his or her file shall comply with the request no later than three business days after receiving the request.

(b) A consumer reporting agency shall develop procedures involving the use of a telephone, the Internet, or other electronic media to receive and process a request from a consumer to temporarily lift a security freeze placed under section 8-2603 on his or her file in an expedited manner. By January 1, 2009, a consumer reporting agency shall comply with a request to temporarily lift a security freeze within fifteen minutes after receiving such request by telephone or through a secure electronic method.

(4) A consumer reporting agency is not required to temporarily lift a security freeze within the time provided in subsection (3) of this section if:

(a) The consumer fails to meet the requirements of subsection (2) of this section; or

(b) The consumer reporting agency's ability to temporarily lift the security freeze within the time provided in subsection (3) of this section is prevented by:

(i) An act of God, including fire, earthquake, hurricane, storm, or similar natural disaster or phenomena;

(ii) An unauthorized or illegal act by a third party, including terrorism, sabotage, riot, vandalism, labor strike or dispute disrupting operations, or similar occurrence;

(iii) Operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failure inhibiting response time, or similar disruption;

(iv) Governmental action, including an emergency order or regulation, judicial or law enforcement action, or similar directive;

(v) Regularly scheduled maintenance, during other than normal business hours, of the consumer reporting agency's system or updates to such system;

(vi) Commercially reasonable maintenance of, or repair to, the consumer reporting agency's system that is unexpected or unscheduled; or

(vii) Receipt of a removal request outside of normal business hours.

For purposes of this subsection, normal business hours means Sunday through Saturday, between the hours of 6:00 a.m. and 9:30 p.m., in the applicable time zone in this state.

(1) A security freeze shall remain in place, subject to being put on hold or temporarily lifted as otherwise provided in this section, until the consumer reporting agency receives a request from the consumer to remove the freeze under section 8-2608.

(2) A consumer reporting agency may place a hold on a file due to a material misrepresentation of fact by the consumer. When a consumer reporting agency intends to release a hold on a file, the consumer reporting agency shall notify the consumer in writing three business days prior to releasing the hold on the file.

(3) A consumer reporting agency shall temporarily lift a security freeze only upon request by the consumer under section 8-2606.

(4) A consumer reporting agency shall remove a security freeze upon the date that the consumer reporting agency receives a request from the consumer to remove the freeze under section 8-2608.

A consumer reporting agency shall remove a security freeze placed under section 8-2603 within three business days after receiving a request for removal from the consumer who provides both of the following:

(1) Sufficient proof of identity of the consumer; and

(2) The unique personal identification number or password referred to in subdivision (2)(b) of section 8-2606.

A security freeze for a protected consumer shall remain in effect unless removed in accordance with section 8-2608.02 or 8-2608.03. A consumer reporting agency may not release the protected consumer’s credit report, any information derived from the protected consumer’s credit report, or any record created for the protected consumer.

If a protected consumer or the representative wishes to remove a security freeze placed under section 8-2603.01 for the protected consumer, the protected consumer or the representative shall:

(1) Submit a request for the removal of the security freeze to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency; and

(2) Provide to the consumer reporting agency:

(a) In the case of a request by the protected consumer:

(i) Proof that the sufficient proof of authority for the representative to act on behalf of the protected consumer is no longer valid; and

(ii) Sufficient proof of identification of the protected consumer; or

(b) In the case of a request by the representative:

(i) Sufficient proof of identification of the protected consumer and the representative; and

(ii) Sufficient proof of authority to act on behalf of the protected consumer.

Within thirty days after receiving a request that meets the requirements of this section, the consumer reporting agency shall remove the security freeze for the protected consumer.

A consumer reporting agency may remove a security freeze for a protected consumer or delete a record of a protected consumer if the security freeze was placed or the record was created based on a material misrepresentation of fact by the protected consumer or the protected consumer’s representative.

(1) A consumer reporting agency shall not charge any fee for placing, temporarily lifting, or removing a security freeze placed under section 8-2603 or for placing, temporarily lifting, or removing any other substantially similar type of security product. This subsection does not apply if the substantially similar type of security product, alone or in combination with another product, provides greater protection to the consumer than a security freeze.

(2) A consumer reporting agency shall reissue the same or a new personal identification number or password required under section 8-2605 one time without charge and may charge a fee of no more than five dollars for subsequent reissuance of the personal identification number or password.

A consumer reporting agency shall not charge any fee for placement or removal of a security freeze or for placement or removal of any other substantially similar type of security product for a protected consumer. This section does not apply if the substantially similar type of security product, alone or in combination with another product, provides greater protection to the protected consumer than a security freeze.

If a security freeze is in place, a consumer reporting agency may not change any of the following official information in a file without sending a written confirmation of the change to the consumer, protected consumer, or representative within thirty days after the change is made: Name, date of birth, social security number, and address. In the case of an address change, the written confirmation shall be sent to both the new address and the former address. Written confirmation is not required for technical modifications of a consumer's or protected consumer's official information, including name and street abbreviations, complete spellings, or transposition of numbers or letters.

(1) A consumer reporting agency may not suggest or otherwise state or imply to a third party that a security freeze on a consumer's or protected consumer's file reflects a negative credit score, history, report, or rating.

(2) If a third party requests access to a credit report or any other information derived from a file in connection with an application for credit or the opening of an account and the consumer, protected consumer, or representative has placed a security freeze on his or her file and does not allow his or her file to be accessed during that specified period of time, the third party may treat the application as incomplete.

The Credit Report Protection Act does not prohibit a consumer reporting agency from furnishing to a governmental agency a consumer's or protected consumer's name, address, former address, place of employment, or former place of employment.

The Credit Report Protection Act does not apply to the use of a credit report or any information derived from the file by any of the following:

(1) A person or entity, a subsidiary, affiliate, or agent of that person or entity, an assignee of a financial obligation owing by the consumer or protected consumer to that person or entity, or a prospective assignee of a financial obligation owing by the consumer or protected consumer to that person or entity in conjunction with the proposed purchase of the financial obligation, with which the consumer or protected consumer has or had prior to assignment an account or contract, including a demand deposit account, or to whom the consumer or protected consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument. For purposes of this subdivision, reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements;

(2) A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under section 8-2606 for purposes of facilitating the extension of credit or other permissible use;

(3) Any federal, state, or local governmental entity, including, but not limited to, a law enforcement agency, a court, or an agent or assignee of a law enforcement agency or court;

(4) A private collection agency acting under a court order, warrant, or subpoena;

(5) Any person or entity for the purposes of prescreening as provided for by the federal Fair Credit Reporting Act, 15 U.S.C. 1681, as such act existed on September 1, 2007;

(6) Any person or entity administering a credit file monitoring subscription service to which the consumer or protected consumer has subscribed;

(7) Any person or entity for the purpose of providing a consumer, protected consumer, or representative with a copy of the consumer's or protected consumer's credit report or any other information derived from his or her file upon the consumer's, protected consumer's, or representative's request; and

(8) Any person or entity for use in setting or adjusting a rate, adjusting a claim, or underwriting for insurance purposes.

The following entities are not consumer reporting agencies for purposes of the Credit Report Protection Act and are not required to place a security freeze under section 8-2603 or 8-2603.01:

(1) A check services or fraud prevention services company that issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payment;

(2) A deposit account information service company that issues reports regarding account closures due to fraud, substantial overdrafts, automatic teller machine abuse, or similar negative information regarding a consumer or protected consumer, to inquiring banks or other financial institutions for use only in reviewing a consumer's, protected consumer's, or representative's request for a deposit account at the inquiring bank or financial institution; and

(3) A consumer reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency, or multiple consumer reporting agencies, and does not maintain a permanent database of credit information from which new credit reports are produced. A consumer reporting agency shall honor any security freeze placed on a file by another consumer reporting agency.

Sections 8-2603.01, 8-2608.01, 8-2608.02, 8-2608.03, and 8-2609.01 shall not apply to any person or entity that maintains a database used solely for the following:

(1) Criminal record information;

(2) Personal loss history information;

(3) Fraud prevention or detection;

(4) Employment screening; or

(5) Tenant screening.

The Attorney General shall enforce the Credit Report Protection Act. For purposes of the act, the Attorney General may issue subpoenas, adopt and promulgate rules and regulations, and seek injunctive relief and a monetary award for civil penalties, attorney's fees, and costs. Any person who violates the act shall be subject to a civil penalty of not more than two thousand dollars for each violation. The Attorney General may also seek and recover actual damages for each consumer or protected consumer injured by a violation of the act.