{"data":{"id":"us-ky/krs-367.365","jurisdiction":"us-ky","citation":"KRS 367.365","heading":"Consumer's election regarding security freeze on consumer report --","body":"Subsequent access -- Duties of consumer reporting agency -- Duration of\nsecurity freeze -- Removal and temporary lifting -- Inapplicability to certain\nconsumer reports -- Permitted charges for security freeze -- Changes to official\nconsumer report information -- Penalties for section's violation.\n(1) (a) A consumer may elect to place a security freeze on the consumer's consumer\nreport by written request, sent by certified mail, to a consumer reporting\nagency at an address designated by the consumer reporting agency to receive\nsecurity freeze requests, or by the use of telephone, fax, or Web-based or other\nelectronic method that the consumer reporting agency has established to\nreceive security freeze requests. A request made pursuant to this subsection\nshall include clear and proper identification. A consumer reporting agency\nshall place a security freeze on a consumer's consumer report no later than ten\n(10) business days after re ceiving a request made pursuant to this subsection\nfor the placement of a security freeze from the consumer.\n(b) When a security freeze is in place, information from a consumer's consumer\nreport shall not be released to a third party without prior express authorization\nfrom the consumer. This subsection does not prevent a consumer reporting\nagency from advising a third party that a security freeze is in effect with\nrespect to the consumer's consumer report.\n(2) The consumer reporting agency shall, no later than ten (10) business days after the\ndate the agency receives the request for a security freeze, provide the consumer with\na unique personal identification number or password to be used by the consumer\nwhen providing authorization for the access to his or  her credit file for a specific\nperiod of time. In addition, the consumer reporting agency shall simultaneously\nprovide to the consumer in writing the process of placing, removing, and\ntemporarily lifting a security freeze and the process for allowing acce ss to\ninformation from the consumer's credit file for a specific period while the security\nfreeze is in effect.\n(3) A consumer may request a replacement personal identification number or password\nin the same manner utilized in subsection (1) of this sectio n to request the initial\nsecurity freeze and shall also include clear and proper identification. No later than\nten (10) business days after the date the consumer reporting agency receives the\nrequest for a replacement personal identification number or password, the consumer\nreporting agency shall provide the consumer with a new, unique personal\nidentification number or password to be used by the consumer instead of the\nnumber or password that was provided under subsection (2) of this section.\n(4) If a third party requests access to a consumer report on which a security freeze is in\neffect, and this request is in connection with an application for credit, the third party\nmay treat the application as incomplete.\n(5) If the consumer wishes to allow his or her c onsumer report or credit score to be\naccessed for a specific period of time while a freeze is in place, the consumer shall\ncontact the consumer reporting agency and request that the freeze be temporarily\nlifted and provide the following:\n(a) Clear and proper identification;\n(b) The unique personal identification number or password provided by the\nconsumer reporting agency pursuant to subsection (2) or (3) of this section;\nand\n(c) The proper information regarding the time period for which the report shall be\navailable to users of the consumer report.\n(6) A consumer reporting agency that receives a request from a consumer to\ntemporarily lift a freeze on a consumer report pursuant to subsection (5) of this\nsection shall comply with the request no later than thr ee (3) business days after\nreceiving the request. A consumer reporting agency may develop procedures\ninvolving the use of telephone, fax, the Internet, or other electronic media to receive\nand process a request from a consumer to temporarily lift a freeze on a consumer\nreport or credit score pursuant to subsection (5) of this section in an expedited\nmanner.\n(7) A consumer reporting agency shall remove or temporarily lift a freeze placed on a\nconsumer's consumer report only:\n(a) Upon the consumer's request m ade pursuant to subsection (5) or (8) of this\nsection; or\n(b) If the consumer's consumer report was frozen due to a material\nmisrepresentation of fact by the consumer. If a consumer reporting agency\nintends to remove a freeze upon a consumer's consumer report pursuant to this\nparagraph, the consumer reporting agency shall notify the consumer in writing\nprior to removing the freeze on the consumer's consumer report.\n(8) A security freeze shall remain in place until the consumer requests that the security\nfreeze be removed, or the consumer reporting agency has notified the consumer in\nwriting that it is removing the freeze due to a misrepresentation of fact by the\nconsumer pursuant to subsection (7)(b) of this section. A consumer reporting\nagency shall remove a security freeze within three (3) business days of receiving:\n(a) A request for removal from the consumer; and\n(b) Both of the following:\n1. Clear and proper identification; and\n2. The unique personal identification number or password provided by the\nconsumer reporting agency.\n(9) A security freeze does not apply to a consumer report provided to:\n(a) A federal, state, or local governmental entity, including a law enforcement\nagency, or court, or their agents or assigns;\n(b) A private collection agency for the sole purpose of assisting in the collection\nof an existing debt of the consumer who is the subject of the consumer report\nrequested;\n(c) A person or entity, or a subsidiary, affiliate, or agent of that person or entity,\nor an assignee of a financial obligation owing by the consumer to that person\nor entity, or a prospective assignee of a financial obligation owing by the\nconsumer to that person or entity in conjunction with the proposed purchase of\nthe financial obligation, with which the consumer has or had prior to\nassignment an account or contract, including a demand deposit account, or to\nwhom the consumer issued a negotiable instrument, for the purposes of\nreviewing the account or collecting the financial obligation owing for the\naccount, contract, or negotiable instrument. For purposes of this paragraph,\n\"reviewing the account\" includes activities related to account maintenance,\nmonitoring, credit line increases, and account upgrades and enhancements;\n(d) A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to\nwhom access has been gran ted under subsection (5) of this section for the\npurposes of facilitating the extension of credit;\n(e) A person for the purposes of prescreening as provided by the federal Fair\nCredit Reporting Act;\n(f) A consumer reporting agency for the purposes of providing a consumer with a\ncopy of his or her own report on the consumer's request;\n(g) A child support enforcement agency;\n(h) A consumer reporting agency that acts only as a reseller of credit information\nby assembling and merging information contained in th e database of another\nconsumer reporting agency or multiple credit reporting agencies and does not\nmaintain a permanent database of credit information from which new\nconsumer reports are produced. However, a consumer reporting agency acting\nas a reseller s hall honor any security freeze placed on a consumer report by\nanother consumer reporting agency;\n(i) A check services or fraud prevention services company, which issues reports\non incidents of fraud or authorizations for the purpose of approving or\nprocessing negotiable instruments, electronic funds transfers, or similar\nmethods of payments;\n(j) A deposit account information service company, which issues reports\nregarding account closures due to fraud, substantial overdrafts, ATM abuse, or\nsimilar negative information regarding a consumer to inquiring banks or other\nfinancial institutions for use only in reviewing a consumer request for a\ndeposit account at the inquiring bank or financial institution;\n(k) Any person or entity using a consumer report in prepa ration for a civil or\ncriminal action, or an insurance company in investigation of a claim; or\n(l) Any insurance company for setting or adjusting a rate or underwriting for\nproperty and casualty insurance purposes.\n(10) A consumer reporting agency may impo se a reasonable charge on a consumer for\ninitially placing, temporarily lifting, or removing a security freeze on a consumer\nfile. The amount of the charge may not exceed ten dollars ($10). On January 1 of\neach year, a consumer reporting agency may increas e the charge for placing a\nsecurity freeze. The increase shall be based proportionally on changes to the\nConsumer Price Index for All Urban Consumers as determined by the United States\nDepartment of Labor with fractional changes rounded to the nearest twen ty-five\ncents ($0.25). A consumer shall not  be charged any fee by the consumer reporting\nagency for placing the security freeze if the consumer is a victim of identity theft\nand, upon the request of the consumer reporting agency, provides the consumer\nreporting agency with a valid police report.\n(11) If a security freeze is in place, a consumer reporting agency shall not change any of\nthe following official information in a consumer report without sending a written\nconfirmation of the change to the consume r within thirty (30) days of the change\nbeing posted to the consumer's file:\n(a) Name;\n(b) Date of birth;\n(c) Social Security number; and\n(d) Address.\nWritten confirmation is not required for technical modifications of a consumer's\nofficial information, including name and street abbreviations, complete spellings, or\ntransposition of numbers or letters. In the case of an address change, the written\nconfirmation shall be sent to both the new address and to the former address.\n(12) Any person who willfully fa ils to comply with any requirement imposed under this\nsection with respect to any consumer is liable to that consumer in an amount equal\nto the sum of:\n(a) Any actual damages sustained by the consumer as a result of the failure;\n(b) Any liquidated damages of not less than one hundred dollars ($100) and not\nmore than one thousand dollars ($1,000);\n(c) Any punitive damages as the court may allow; and\n(d) In the case of any successful action to enforce any liability under this section,\nthe costs of the action together with reasonable attorney's fees as determined\nby the court.\n(13) Any person, other than the named individual or individuals in the report, who\nobtains a consumer report, requests a security freeze, requests the temporary lift of a\nfreeze, or the removal of a security freeze from a consumer reporting agency under\nfalse pretenses or in an attempt to violate federal or state law shall be liable to the\nconsumer reporting agency for actual damages sustained by the consumer reporti ng\nagency or one thousand dollars ($1,000), whichever is greater.\n(14) Any person who is negligent in failing to comply with any requirement imposed\nunder this section with respect to any consumer is liable to that consumer in an\namount equal to the sum of:\n(a) Any actual damages sustained by the consumer as a result of the failure; and\n(b) In the case of any successful action to enforce any liability under this section,\nthe costs of the action together with reasonable attorney's fees as determined\nby the court.\n(15) Nothing in KRS 367.363 to 367.365 shall be construed to limit or restrict the\nexercise of powers or the performance of the duties of the Attorney General\nauthorized under any other provision of law to bring or seek redress for persons that\nviolate KRS 367.363 to 367.365.","path":["KRS Chapter 367"],"source_url":"https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=47191","current_through":"Includes enactments through the 2026 Regular Session","vintage":"09/05/2026","retrieved_at":"2026-09-05T20:59:03Z","sha256":"5fdabfb6d4bb26aa4cc7bf7da474525362f5db8d88fb58e10b859e5380b0477e","source_id":"us-ky","stale":false,"prev":"us-ky/krs-367.3645","next":"us-ky/krs-367.367"},"notice":"GroundRules: Original legal text. Not legal advice."}