Section 301 of the Economic Growth, Regulatory Relief, Consumer Protection Act revised the Fair Credit Reporting Act to provide for new rules regarding national security freeze procedures for credit reports. A security freeze is a restriction that prohibits a consumer reporting agency from disclosing the contents of a consumer report that is subject to such security freeze to any person requesting the consumer report.

Placement of Security Freeze

A consumer may submit a direct request to a consumer reporting agency to place a security freeze on his or her credit report. Upon receiving proper identification from the consumer, the consumer reporting agency must, free of charge, place the security freeze not later than:

  • In the case of a request that is by toll-free telephone or secure electronic means, 1 business day after receiving the request directly from the consumer; or
  • In the case of a request that is by mail, 3 business days after receiving the request directly from the consumer.

Not later than five business days after placing a security freeze, a consumer reporting agency must send a confirmation of the placement to the consumer and inform the consumer of the process by which the consumer may remove the security freeze (including a mechanism to authenticate the consumer) and that the consumer has a right to prohibit information contained in the consumer’s file with any consumer reporting agency from being used in connection with any credit or insurance transaction that is not initiated by the consumer.

A consumer reporting agency may advise a third party that a security freeze has been placed with respect to a consumer.

Removal of Security Freeze

A consumer reporting agency shall remove a security freeze placed on the consumer report of a consumer only in the following cases:

  • Upon the direct request of the consumer. Generally, a security freeze will remain in place until the consumer directly requests that the security freeze be removed. Once a consumer submits a direct request to remove a security freeze, and upon receiving proper identification from the consumer, the consumer reporting agency must, free of charge, remove the security freeze not later than: in the case of a request that is by toll-free telephone or secure electronic means, 1 hour after receiving the request for removal; or in the case of a request that is by mail, 3 business days after receiving the request for removal.

A consumer may request a temporary removal of a security freeze. The consumer reporting agency must remove the security freeze for the period of time specified by the consumer.

  • The security freeze was placed due to a material misrepresentation of fact by the consumer. The consumer reporting agency will notify the consumer in writing prior to removing the security freeze.

Third-Party Requests

If a third party requests access to a consumer report of a consumer with respect to which a security freeze is in effect, where such request is in connection with an application for credit, and the consumer does not allow such consumer report to be accessed, the third party may treat the application as incomplete.

Exceptions

A security freeze will not apply to the making of a consumer report for use in certain circumstances, including, among others:

  • A person (or affiliate of such person) with which the consumer has or had prior to assignment an account or contract including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account (e.g., account maintenance, monitoring, credit line increases, etc) or collecting the financial obligation owed for the account, contract, or negotiable instrument;
  • Any person or entity administering a credit file monitoring subscription or similar service to which the consumer has subscribed; or,
  • Any person or entity for the purpose of providing a consumer with a copy of the consumer’s consumer report or credit score, upon the request of the consumer; or,
  • Any person using the information for employment, tenant, or background screening purposes.

Notice of Rights

At any time a consumer is required to receive a summary of rights under section 609 (15 USC 1681g(c)), the consumer reporting agency must include a notice regarding a consumer’s right to obtain a security freeze.

Webpage

Consumer reporting agencies must establish a webpage that:

  • Allows a consumer to request a security freeze;
  • Allows a consumer to request an initial fraud alert;
  • Allows a consumer to request an extended fraud alert;
  • Allows a consumer to request an active duty fraud alert;
  • Allows a consumer to opt-out of the use of information in a consumer report to send the consumer a solicitation of credit or insurance; and
  • Shall not be the only mechanism by which a consumer may request a security freeze.

Credit Freezes for Minors and Others (“Protected Consumers”)

Importantly, Section 301 of the EGRRCPA also included provisions by which national credit report freezes could be placed on minors under the age of 16 (at the time of the request for the placement of a security freeze) or on incapacitated person or a protected person for whom a guardian or conservator has been appointed. Such a protected consumer will be represented by a person who provides to a consumer reporting agency sufficient proof of authority to act on behalf of a protected consumer(e.g., a birth certificate or an order issued by a court).

For protected consumers, a “security freeze” means a restriction that prohibits a consumer reporting agency from disclosing the contents of a consumer report that is the subject of such security freeze or, in the case of a protected consumer for whom the consumer reporting agency does not have a file, a record that is subject to such security freeze to any person requesting the consumer report for the purpose of opening a new account involving the extension of credit. A “record” is information identifies a protected consumer, created by a consumer reporting agency, which may not be created or used to consider the protected consumer’s credit.

Placement of a protected consumer security freeze – The process for placing the security freeze on a protected consumer is similar to the process above. A protected consumer’s representative submits a direct request that a consumer reporting agency place a security freeze and provides sufficient proof of authority and sufficient proof of identification that identifies the protected consumer and the representative (e.g., social security number, birth certificate, and driver’s license). Upon receiving the request, the consumer reporting agency will place the security freeze and will provide confirmation in the same manner above (except that a notice of rights is not required).

If a consumer reporting agency does not have a file pertaining to a protected consumer when the consumer reporting agency receives a direct request to place a security freeze, the consumer reporting agency will create a re- cord for the protected consumer. After a security freeze has been placed, and unless the security freeze is removed, a consumer reporting agency may not release the protected consumer’s consumer report, any information derived from the protected consumer’s consumer report, or any record created for the protected consumer.

Removal of a protected consumer security freeze – A consumer reporting agency will remove a security freeze placed on the consumer report of a protected consumer in the same manner as above. That is, a consumer reporting agency will remove the security freeze upon the direct request of the protected consumer’s representative or of the protected consumer (who is not under the age of 16 years at the time of the request), not later than 1 hour if done by telephone or secure electronic means or 3 business days if done by mail. A protected consumer or representative can request a temporary freeze. The consumer reporting agency must remove the security freeze for the period of time specified by the consumer. The consumer reporting agency also will remove a security freeze if the freeze was placed due to a material misrepresentation of fact by the consumer. The consumer reporting agency will notify the consumer in writing prior to removing the security freeze.

 

SUBSCRIBE TODAY: INCOMPLIANCE NEWSLETTER