N.Y. General Business Law § 380-t: Security freeze

§ 380-t. Security freeze. (a) A consumer may request that a security

freeze be placed on his or her consumer credit report by sending a

request in writing with confirmation of delivery requested or via

telephone, secure electronic means, or other methods developed by the

consumer credit reporting agency to a consumer credit reporting agency

at an address, telephone number or secure website designated by such

agency to receive such requests. Consumer credit reporting agencies

shall have a secure website and a separately dedicated toll-free number

to offer information, to process requests and deliver the services

provided for under this section.

(b) A consumer credit reporting agency that receives from a consumer a

request in accordance with subdivision (a) of this section shall,

provided such request is accompanied by proper identification, place a

security freeze on the consumer credit report of or relating to such

consumer no later than four business days after receiving such request,

provided further, however, that for requests received on or after

January first, two thousand nine, such consumer credit reporting agency

shall place a security freeze on the consumer credit report of or

relating to such consumer no later than three business days after

receiving such request and for requests received on or after January

first, two thousand ten, such consumer credit reporting agency shall

place a security freeze on the consumer credit report of or relating to

such consumer no later than one business day after receiving such

request. Nothing in this subdivision shall be construed to prevent a

consumer credit reporting agency from advising a third party that a

security freeze is in effect with respect to the consumer credit report

of or relating to such consumer. No consumer credit reporting agency

shall advise in any manner a third party, of the fact that the consumer

requesting the freeze is alleging to be the victim of domestic violence

or identity theft, without the written authorization of the consumer.

(c) The consumer credit reporting agency shall send a written

confirmation of the placement of a security freeze to the consumer

within five business days of placing such freeze. Upon placing the

security freeze on the consumer credit report of or relating to such

consumer, the consumer credit reporting agency shall provide the

consumer with a unique personal identification number or password, or

other device which shall only be used by the consumer when providing

authorization for the release of his or her consumer credit report for a

specific party or specific period of time. The unique personal

identification number or password, or other device to be used by the

consumer shall not be a social security number or a sequential portion

thereof. Any use of the unique personal identification number or

password or other device other than provided for in this section is

prohibited.

(d) If the consumer wishes to allow his or her consumer credit report

to be accessed for a specific party or a specific period of time while a

freeze is in place, he or she shall contact the consumer credit

reporting agency via mail with confirmation of delivery, telephone,

secure electronic means or other method developed by such consumer

credit reporting agency pursuant to subdivision (f) of this section

using a point of contact designated by such consumer credit reporting

agency, request that the freeze be temporarily lifted, and provide the

following:

(1) proper identification;

(2) the unique personal identification number or password provided by

the consumer credit reporting agency pursuant to subdivision (c) of this

section; and

(3) the proper information regarding the party to which the consumer

credit report should be available or the time period for which the

consumer credit report shall be available to users of such report.

(e) (1) A consumer credit reporting agency that receives a request

from a consumer to temporarily lift a freeze on a consumer credit report

pursuant to subdivision (d) of this section, shall comply with the

request: (i) no later than three business days after receiving such

request; (ii) as of September first, two thousand nine, a consumer

credit reporting agency that receives a request via the use of a

telephone or secure electronic method provided by the agency, pursuant

to subdivision (d) of this section, shall release a consumer's credit

report as requested by the consumer within fifteen minutes after the

request is received by the consumer credit reporting agency.

(2) A consumer credit reporting agency is not required to temporarily

lift a security freeze within the time provided in subparagraph (ii) of

paragraph one of this subdivision if:

(i) the consumer fails to meet the requirements of subdivision (b) of

this section; or

(ii) the consumer credit reporting agency's ability to temporarily

lift the security freeze within fifteen minutes is prevented by:

(A) an act of God, including fire, earthquakes, hurricanes, storms, or

similar natural disaster or phenomena;

(B) unauthorized or illegal acts by a third party, including

terrorism, sabotage, riot, vandalism, labor strikes or disputes

disrupting operations, or similar occurrence;

(C) operational interruption, including electrical failure,

unanticipated delay in equipment or replacement part delivery, computer

hardware or software failures inhibiting response time, or similar

disruption;

(D) governmental action, including emergency orders or regulations,

judicial or law enforcement action, or similar directives;

(E) regularly scheduled maintenance, during other than normal business

hours, of, or updates to, the consumer reporting agency's systems; or

(F) commercially reasonable maintenance of, or repair to, the consumer

reporting agency's systems that is unexpected or unscheduled.

(f) A consumer credit reporting agency may develop procedures

involving other secure methods of communication, including the use of

the internet, or other electronic media to receive and process a request

from a consumer to temporarily lift a freeze on a consumer credit report

pursuant to subdivision (d) of this section in an expedited manner.

(g) The department of state shall monitor the state of technology

relating to the means available to process requests for the lifting or

removal of a security freeze, and shall report to the legislature when

it is determined that the technology to process requests for the lifting

or removal of a security freeze in a shorter period of time than that

set forth in subdivision (e) of this section is available.

(h) A consumer credit reporting agency shall remove or temporarily

lift a freeze placed on the consumer credit report of or relating to a

consumer only in the following cases:

(1) upon consumer request, pursuant to subdivision (d) or (k) of this

section; or

(2) if the consumer credit report of or relating to such consumer was

frozen due to a material misrepresentation of fact by the consumer. If a

consumer credit reporting agency intends to remove a freeze upon a

consumer credit report pursuant to this paragraph, the consumer credit

reporting agency shall notify the consumer in writing, by first class

mail, within three business days prior to removing the freeze on such

consumer credit report.

(i) If a third party requests access to a consumer credit report on

which a security freeze is in effect, and this request is in connection

with an application for credit or any other use, and the consumer does

not allow his or her consumer credit report to be accessed for that

period of time, the third party may treat the application as incomplete.

(j) If a consumer requests a security freeze, the consumer credit

reporting agency shall disclose the process of placing and temporarily

lifting a freeze, and the process for allowing access to information

from such consumer credit report for a specific party or a period of

time while the freeze is in place.

(k) (1) A security freeze shall remain in place until the consumer

requests, using a point of contact designated by the consumer credit

reporting agency, that the security freeze be removed and provides the

following:

(i) proper identification; and

(ii) the unique personal identification number or password or similar

device provided by the consumer credit reporting agency pursuant to

subdivision (c) of this section.

(2) A consumer credit reporting agency shall remove a security freeze

within three business days of receiving a request for removal from the

consumer pursuant to paragraph one of this subdivision.

(l) A consumer credit reporting agency shall require proper

identification of the person making a request to place or remove a

security freeze.

(m) The provisions of this section do not apply to the use of a

consumer credit report by any of the following:

(1) a person or entity, or a subsidiary, affiliate, or agent of that

person or entity, or an assignee of a financial obligation owing by the

consumer to that person or entity, or a prospective assignee of a

financial obligation owing by the consumer to that person or entity in

conjunction with the proposed purchase of the financial obligation, with

which the consumer has or had prior to assignment an account or

contract, including a demand deposit account, or to whom the consumer

issued a negotiable instrument, for the purposes of reviewing the

account or collecting the financial obligation owing for the account,

contract, or negotiable instrument. For purposes of this paragraph,

"reviewing the account" includes activities related to account

maintenance, monitoring, credit line increases, and account upgrades and

enhancements;

(2) a subsidiary, affiliate, agent, assignee, or prospective assignee

of a person to whom access has been granted for purposes of facilitating

the extension of credit or other permissible use;

(3) any state or local agency, law enforcement agency, court, private

collection agency, or person acting pursuant to a court order, warrant,

or subpoena;

(4) a child support agency acting pursuant to title iv-d of the social

security act (42 U.S.C. et seq.);

(5) the state or its political subdivisions or its agents or assigns

acting to investigate fraud or acting to investigate or collect

delinquent taxes or unpaid court orders or to fulfill any of its other

statutory responsibilities provided such responsibilities are consistent

with a permissible purpose under 15 U.S.C. section 1681b;

(6) the use of credit information for the purposes of prescreening as

provided for by the federal fair credit reporting act;

(7) any person or entity administering a credit file monitoring

subscription or similar service to which the consumer has subscribed; or

(8) any person or entity for the purpose of providing a consumer with

a copy of his or her consumer credit report or score upon the request of

such consumer.

(n) No consumer credit reporting agency shall charge a fee to any

consumer for the placement of any security freeze, the removal of any

security freeze, the temporary lift of any security freeze for a

specific party or period of time, or the issuance of any replacement

personal identification number or password when the consumer fails to

retain the personal identification number or password provided to such

consumer by such consumer credit reporting agency pursuant to

subdivision (c) of this section.

(3)(i) Upon a breach of the security of the system of a consumer

credit reporting agency which includes any social security number, such

agency shall offer to each consumer, whose information, including social

security number, was breached or is reasonably believed to have been

breached, reasonable identity theft prevention services and, if

applicable, identify theft mitigation services for a period not to

exceed five years at no cost to such consumers. Such agency shall

provide all information necessary for such consumers to enroll in such

services and shall include information on how such consumers can request

a security freeze. A consumer credit reporting agency shall not be

required to offer such services if, after an appropriate investigation,

the agency reasonably determines that the breach of security is unlikely

to result in harm to the consumers whose information has been breached.

(ii) "Breach of the security of the system" as used in this paragraph

shall have the same definition as in paragraph (c) of subdivision one of

section eight hundred ninety-nine-aa of this chapter.

(o) If a security freeze is in place, a consumer credit reporting

agency shall not change any of the following official information in a

consumer credit report without sending a written confirmation of the

change to the consumer within thirty days of the change being posted to

the file of or relating to such consumer: name, date of birth, social

security number, and address. Written confirmation is not required for

technical modifications of the official information of or relating to

such consumer, including name and street abbreviations, complete

spellings, or transposition of numbers or letters. In the case of an

address change, the written confirmation shall be sent to both the new

address and to the former address.

(p) The following entities are not required to place a security freeze

on a consumer credit report:

(1) a consumer credit reporting agency that acts only as a reseller of

credit information by assembling and merging information contained in

the data base of another consumer credit reporting agency or multiple

consumer credit reporting agencies, and does not maintain a permanent

data base of credit information from which new consumer credit reports

are produced. However, a consumer credit reporting agency acting as a

reseller shall honor any security freeze placed on a consumer credit

report by another consumer credit reporting agency;

(2) a check services or fraud prevention services company, which

issues reports on incidents of fraud or authorizations for the purpose

of approving or processing negotiable instruments, electronic funds

transfers, or similar methods of payments; or

(3) a deposit account information service company, which issues

reports regarding account closures due to fraud, substantial overdrafts,

ATM abuse, or similar negative information regarding a consumer, to

inquiring banks or other financial institutions for use only in

reviewing a consumer request for a deposit account at the inquiring bank

or financial institution.

(q) (1) Any time a consumer credit reporting agency is required to

send a summary of rights required under 15 U.S.C. section 1681g, to a

consumer residing in this state the following notice shall be included

with such summary of rights:

"NEW YORK CONSUMERS HAVE THE RIGHT TO OBTAIN A SECURITY FREEZE.

YOU HAVE A RIGHT TO PLACE A "SECURITY FREEZE" ON YOUR CREDIT REPORT,

WHICH WILL PROHIBIT A CONSUMER CREDIT REPORTING AGENCY FROM RELEASING

INFORMATION IN YOUR CREDIT REPORT WITHOUT YOUR EXPRESS AUTHORIZATION. A

CONSUMER CREDIT REPORTING AGENCY IS PROHIBITED FROM CHARGING YOU A FEE

FOR THE PLACEMENT, REMOVAL, OR TEMPORARY LIFT OF A SECURITY FREEZE, OR

FOR THE ISSUANCE OF A REPLACEMENT PERSONAL IDENTIFICATION NUMBER (PIN)

OR PASSWORD IN THE EVENT THAT YOU FAIL TO RETAIN THE ORIGINAL PIN OR

PASSWORD PROVIDED TO YOU BY SUCH CONSUMER CREDIT REPORTING AGENCY. A

SECURITY FREEZE MUST BE REQUESTED IN WRITING DELIVERY CONFIRMATION

REQUESTED OR VIA TELEPHONE, SECURE ELECTRONIC MEANS, OR OTHER METHODS

DEVELOPED BY THE CONSUMER CREDIT REPORTING AGENCY. THE SECURITY FREEZE

IS DESIGNED TO PREVENT CREDIT, LOANS, AND SERVICES FROM BEING APPROVED

IN YOUR NAME WITHOUT YOUR CONSENT. HOWEVER, YOU SHOULD BE AWARE THAT

USING A SECURITY FREEZE TO TAKE CONTROL OVER WHO GETS ACCESS TO THE

PERSONAL AND FINANCIAL INFORMATION IN YOUR CREDIT REPORT MAY DELAY,

INTERFERE WITH, OR PROHIBIT THE TIMELY APPROVAL OF ANY SUBSEQUENT

REQUEST OR APPLICATION YOU MAKE REGARDING A NEW LOAN, CREDIT, MORTGAGE,

GOVERNMENT SERVICES OR PAYMENTS, INSURANCE, RENTAL HOUSING, EMPLOYMENT,

INVESTMENT, LICENSE, CELLULAR PHONE, UTILITIES, DIGITAL SIGNATURE,

INTERNET CREDIT CARD TRANSACTION, OR OTHER SERVICES, INCLUDING AN

EXTENSION OF CREDIT AT POINT OF SALE. WHEN YOU PLACE A SECURITY FREEZE

ON YOUR CREDIT REPORT, YOU WILL BE PROVIDED A PERSONAL IDENTIFICATION

NUMBER OR PASSWORD TO USE IF YOU CHOOSE TO REMOVE THE FREEZE ON YOUR

CREDIT REPORT OR AUTHORIZE THE RELEASE OF YOUR CREDIT REPORT TO A

SPECIFIC PARTY OR FOR A PERIOD OF TIME AFTER THE FREEZE IS IN PLACE. TO

PROVIDE THAT AUTHORIZATION YOU MUST CONTACT THE CONSUMER CREDIT

REPORTING AGENCY AND PROVIDE ALL OF THE FOLLOWING:

(1) THE PERSONAL IDENTIFICATION NUMBER OR PASSWORD;

(2) PROPER IDENTIFICATION TO VERIFY YOUR IDENTITY; AND

(3) THE PROPER INFORMATION REGARDING THE PARTY OR PARTIES WHO ARE TO

RECEIVE THE CREDIT REPORT OR THE PERIOD OF TIME FOR WHICH THE REPORT

SHALL BE AVAILABLE TO USERS OF THE CREDIT REPORT.

A CONSUMER CREDIT REPORTING AGENCY MUST AUTHORIZE THE RELEASE OF YOUR

CREDIT REPORT NO LATER THAN THREE BUSINESS DAYS AFTER RECEIVING THE

ABOVE INFORMATION. EFFECTIVE SEPTEMBER FIRST, TWO THOUSAND NINE, A

CONSUMER CREDIT REPORTING AGENCY THAT RECEIVES A REQUEST VIA TELEPHONE

OR SECURE ELECTRONIC METHOD SHALL RELEASE A CONSUMER'S CREDIT REPORT

WITHIN FIFTEEN MINUTES WHEN THE REQUEST IS RECEIVED.

A SECURITY FREEZE DOES NOT APPLY TO CIRCUMSTANCES IN WHICH YOU HAVE AN

EXISTING ACCOUNT RELATIONSHIP AND A COPY OF YOUR REPORT IS REQUESTED BY

YOUR EXISTING CREDITOR OR ITS AGENTS OR AFFILIATES FOR CERTAIN TYPES OF

ACCOUNT REVIEW, COLLECTION, FRAUD CONTROL OR SIMILAR ACTIVITIES.

IF YOU ARE ACTIVELY SEEKING CREDIT, YOU SHOULD UNDERSTAND THAT THE

PROCEDURES INVOLVED IN LIFTING A SECURITY FREEZE MAY SLOW YOUR

APPLICATION FOR CREDIT. YOU SHOULD PLAN AHEAD AND LIFT A FREEZE, EITHER

COMPLETELY IF YOU ARE SHOPPING AROUND, OR SPECIFICALLY FOR A CERTAIN

CREDITOR, BEFORE APPLYING FOR NEW CREDIT. WHEN SEEKING CREDIT OR

PURSUING ANOTHER TRANSACTION REQUIRING ACCESS TO YOUR CREDIT REPORT, IT

IS NOT NECESSARY TO RELINQUISH YOUR PIN OR PASSWORD TO THE CREDITOR OR

BUSINESS; YOU CAN CONTACT THE CONSUMER CREDIT REPORTING AGENCY DIRECTLY.

IF YOU CHOOSE TO GIVE OUT YOUR PIN OR PASSWORD TO THE CREDITOR OR

BUSINESS, IT IS RECOMMENDED THAT YOU OBTAIN A NEW PIN OR PASSWORD FROM

THE CONSUMER CREDIT REPORTING AGENCY."

(2) If a consumer requests information about a security freeze, such

consumer shall be provided with the notice set forth in paragraph one of

this subdivision and with any other information necessary to place,

temporarily lift or permanently lift a security freeze, including but

not limited to the address, telephone number or point of contact at

which the consumer credit reporting agency receives such requests.

(r) When a consumer credit reporting agency erroneously releases a

consumer credit report subject to a security freeze or any information

contained in such consumer credit report, the consumer credit reporting

agency shall send written notification to the affected consumer within

three business days following discovery or notification of such

erroneous release. Such notification shall also inform the consumer of

the nature of the information released and identify and provide contact

information for the recipient of such information or consumer credit

report.

(s) Whenever there shall be a violation of this section, application

may be made by the attorney general in the name of the people of the

state of New York to a court or justice having jurisdiction by a special

proceeding to issue an injunction, and upon notice to the defendant of

not less than five days, to enjoin and restrain the continuance of such

violations; and if it shall appear to the satisfaction of the court or

justice that the defendant has, in fact, violated this section, an

injunction may be issued by such court or justice, enjoining and

restraining any further violation, without requiring proof that any

person has, in fact, been injured or damaged thereby. In any such

proceeding, the court may make allowances to the attorney general as

provided in paragraph six of subdivision (a) of section eighty-three

hundred three of the civil practice law and rules, and direct

restitution. Whenever the court shall determine that a violation of this

section has occurred, the court may impose a civil penalty of not more

than five thousand dollars for each violation. In connection with any

such proposed application, the attorney general is authorized to take

proof and make a determination of the relevant facts and to issue

subpoenas in accordance with the civil practice law and rules.