KRS 367.365: Consumer's election regarding security freeze on consumer report --

Subsequent access -- Duties of consumer reporting agency -- Duration of

security freeze -- Removal and temporary lifting -- Inapplicability to certain

consumer reports -- Permitted charges for security freeze -- Changes to official

consumer report information -- Penalties for section's violation.

(1) (a) A consumer may elect to place a security freeze on the consumer's consumer

report by written request, sent by certified mail, to a consumer reporting

agency at an address designated by the consumer reporting agency to receive

security freeze requests, or by the use of telephone, fax, or Web-based or other

electronic method that the consumer reporting agency has established to

receive security freeze requests. A request made pursuant to this subsection

shall include clear and proper identification. A consumer reporting agency

shall place a security freeze on a consumer's consumer report no later than ten

(10) business days after re ceiving a request made pursuant to this subsection

for the placement of a security freeze from the consumer.

(b) When a security freeze is in place, information from a consumer's consumer

report shall not be released to a third party without prior express authorization

from the consumer. This subsection does not prevent a consumer reporting

agency from advising a third party that a security freeze is in effect with

respect to the consumer's consumer report.

(2) The consumer reporting agency shall, no later than ten (10) business days after the

date the agency receives the request for a security freeze, provide the consumer with

a unique personal identification number or password to be used by the consumer

when providing authorization for the access to his or her credit file for a specific

period of time. In addition, the consumer reporting agency shall simultaneously

provide to the consumer in writing the process of placing, removing, and

temporarily lifting a security freeze and the process for allowing acce ss to

information from the consumer's credit file for a specific period while the security

freeze is in effect.

(3) A consumer may request a replacement personal identification number or password

in the same manner utilized in subsection (1) of this sectio n to request the initial

security freeze and shall also include clear and proper identification. No later than

ten (10) business days after the date the consumer reporting agency receives the

request for a replacement personal identification number or password, the consumer

reporting agency shall provide the consumer with a new, unique personal

identification number or password to be used by the consumer instead of the

number or password that was provided under subsection (2) of this section.

(4) If a third party requests access to a consumer report on which a security freeze is in

effect, and this request is in connection with an application for credit, the third party

may treat the application as incomplete.

(5) If the consumer wishes to allow his or her c onsumer report or credit score to be

accessed for a specific period of time while a freeze is in place, the consumer shall

contact the consumer reporting agency and request that the freeze be temporarily

lifted and provide the following:

(a) Clear and proper identification;

(b) The unique personal identification number or password provided by the

consumer reporting agency pursuant to subsection (2) or (3) of this section;

and

(c) The proper information regarding the time period for which the report shall be

available to users of the consumer report.

(6) A consumer reporting agency that receives a request from a consumer to

temporarily lift a freeze on a consumer report pursuant to subsection (5) of this

section shall comply with the request no later than thr ee (3) business days after

receiving the request. A consumer reporting agency may develop procedures

involving the use of telephone, fax, the Internet, or other electronic media to receive

and process a request from a consumer to temporarily lift a freeze on a consumer

report or credit score pursuant to subsection (5) of this section in an expedited

manner.

(7) A consumer reporting agency shall remove or temporarily lift a freeze placed on a

consumer's consumer report only:

(a) Upon the consumer's request m ade pursuant to subsection (5) or (8) of this

section; or

(b) If the consumer's consumer report was frozen due to a material

misrepresentation of fact by the consumer. If a consumer reporting agency

intends to remove a freeze upon a consumer's consumer report pursuant to this

paragraph, the consumer reporting agency shall notify the consumer in writing

prior to removing the freeze on the consumer's consumer report.

(8) A security freeze shall remain in place until the consumer requests that the security

freeze be removed, or the consumer reporting agency has notified the consumer in

writing that it is removing the freeze due to a misrepresentation of fact by the

consumer pursuant to subsection (7)(b) of this section. A consumer reporting

agency shall remove a security freeze within three (3) business days of receiving:

(a) A request for removal from the consumer; and

(b) Both of the following:

1. Clear and proper identification; and

2. The unique personal identification number or password provided by the

consumer reporting agency.

(9) A security freeze does not apply to a consumer report provided to:

(a) A federal, state, or local governmental entity, including a law enforcement

agency, or court, or their agents or assigns;

(b) A private collection agency for the sole purpose of assisting in the collection

of an existing debt of the consumer who is the subject of the consumer report

requested;

(c) A person or entity, or a subsidiary, affiliate, or agent of that person or entity,

or an assignee of a financial obligation owing by the consumer to that person

or entity, or a prospective assignee of a financial obligation owing by the

consumer to that person or entity in conjunction with the proposed purchase of

the financial obligation, with which the consumer has or had prior to

assignment an account or contract, including a demand deposit account, or to

whom the consumer issued a negotiable instrument, for the purposes of

reviewing the account or collecting the financial obligation owing for the

account, contract, or negotiable instrument. For purposes of this paragraph,

"reviewing the account" includes activities related to account maintenance,

monitoring, credit line increases, and account upgrades and enhancements;

(d) A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to

whom access has been gran ted under subsection (5) of this section for the

purposes of facilitating the extension of credit;

(e) A person for the purposes of prescreening as provided by the federal Fair

Credit Reporting Act;

(f) A consumer reporting agency for the purposes of providing a consumer with a

copy of his or her own report on the consumer's request;

(g) A child support enforcement agency;

(h) A consumer reporting agency that acts only as a reseller of credit information

by assembling and merging information contained in th e database of another

consumer reporting agency or multiple credit reporting agencies and does not

maintain a permanent database of credit information from which new

consumer reports are produced. However, a consumer reporting agency acting

as a reseller s hall honor any security freeze placed on a consumer report by

another consumer reporting agency;

(i) A check services or fraud prevention services company, which issues reports

on incidents of fraud or authorizations for the purpose of approving or

processing negotiable instruments, electronic funds transfers, or similar

methods of payments;

(j) A deposit account information service company, which issues reports

regarding account closures due to fraud, substantial overdrafts, ATM abuse, or

similar negative information regarding a consumer to inquiring banks or other

financial institutions for use only in reviewing a consumer request for a

deposit account at the inquiring bank or financial institution;

(k) Any person or entity using a consumer report in prepa ration for a civil or

criminal action, or an insurance company in investigation of a claim; or

(l) Any insurance company for setting or adjusting a rate or underwriting for

property and casualty insurance purposes.

(10) A consumer reporting agency may impo se a reasonable charge on a consumer for

initially placing, temporarily lifting, or removing a security freeze on a consumer

file. The amount of the charge may not exceed ten dollars ($10). On January 1 of

each year, a consumer reporting agency may increas e the charge for placing a

security freeze. The increase shall be based proportionally on changes to the

Consumer Price Index for All Urban Consumers as determined by the United States

Department of Labor with fractional changes rounded to the nearest twen ty-five

cents ($0.25). A consumer shall not be charged any fee by the consumer reporting

agency for placing the security freeze if the consumer is a victim of identity theft

and, upon the request of the consumer reporting agency, provides the consumer

reporting agency with a valid police report.

(11) If a security freeze is in place, a consumer reporting agency shall not change any of

the following official information in a consumer report without sending a written

confirmation of the change to the consume r within thirty (30) days of the change

being posted to the consumer's file:

(a) Name;

(b) Date of birth;

(c) Social Security number; and

(d) Address.

Written confirmation is not required for technical modifications of a consumer's

official information, including name and street abbreviations, complete spellings, or

transposition of numbers or letters. In the case of an address change, the written

confirmation shall be sent to both the new address and to the former address.

(12) Any person who willfully fa ils to comply with any requirement imposed under this

section with respect to any consumer is liable to that consumer in an amount equal

to the sum of:

(a) Any actual damages sustained by the consumer as a result of the failure;

(b) Any liquidated damages of not less than one hundred dollars ($100) and not

more than one thousand dollars ($1,000);

(c) Any punitive damages as the court may allow; and

(d) In the case of any successful action to enforce any liability under this section,

the costs of the action together with reasonable attorney's fees as determined

by the court.

(13) Any person, other than the named individual or individuals in the report, who

obtains a consumer report, requests a security freeze, requests the temporary lift of a

freeze, or the removal of a security freeze from a consumer reporting agency under

false pretenses or in an attempt to violate federal or state law shall be liable to the

consumer reporting agency for actual damages sustained by the consumer reporti ng

agency or one thousand dollars ($1,000), whichever is greater.

(14) Any person who is negligent in failing to comply with any requirement imposed

under this section with respect to any consumer is liable to that consumer in an

amount equal to the sum of:

(a) Any actual damages sustained by the consumer as a result of the failure; and

(b) In the case of any successful action to enforce any liability under this section,

the costs of the action together with reasonable attorney's fees as determined

by the court.

(15) Nothing in KRS 367.363 to 367.365 shall be construed to limit or restrict the

exercise of powers or the performance of the duties of the Attorney General

authorized under any other provision of law to bring or seek redress for persons that

violate KRS 367.363 to 367.365.