§ 28–3862. Security freeze.

(a) A credit reporting agency shall place a security freeze on a consumer’s credit report if a consumer, providing proper identification, makes a request to the credit reporting agency by certified mail. In addition, on or before January 31, 2009, a credit reporting agency shall make available an Internet-based method of requesting a security freeze and shall accept requests by one of the following methods: telephone or regular mail.

(b) A credit reporting agency shall place the security freeze on the consumer’s credit report no later than 3 business days after receiving the request.

(c) The credit reporting agency shall send a written confirmation of the security freeze to the consumer within 5 business days of placing the freeze and at the same time shall provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of his or her credit report to a specific party or for a specific period of time.

(d) A consumer may thereafter request that a credit reporting agency allow his or her credit report to be accessed by a specific party or for a specific period of time by providing the following:

(1) Proper identification;

(2) The unique personal identification number or password provided by the credit reporting agency pursuant to subsection (c) of this section; and

(3) The identity of the third party to receive the credit report or the time period for which the report shall be available to users of the credit report, if applicable.

(e)(1) A credit reporting agency that receives a request pursuant to subsection (d) of this section shall comply with the request no later than 3 business days after receiving the request.

(2) On or before September 1, 2008, the consumer reporting agency shall develop the capability, and offer the option to the consumer, of honoring a request under subsection (d) of this section, through Internet-based and telephonic methods, within 15 minutes after the consumer’s request is received by the consumer reporting agency. A consumer reporting agency shall not be required to lift a security freeze within 15 minutes if:

(A) The consumer fails to meet the requirements of subsection (d) of this section; or

(B) The consumer reporting agency is unable to lift the security freeze because of:

(i) An act of God, including fire, earthquakes, hurricanes or storms;

(ii) Unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes, or disputes disrupting operations;

(iii) Operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, or computer hardware or software failures inhibiting response time;

(iv) Governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar directives;

(v) Regularly scheduled maintenance during other than normal business hours of, or updates to, the consumer reporting agency’s systems; or

(vi) Commercially reasonable maintenance of, or repair to, the consumer reporting agency’s systems that is unexpected or unscheduled.

(f) A credit reporting agency may develop procedures involving the use of telephone, fax, or, upon the consent of the consumer in the manner required by the Electronic Signatures in Global and National Commerce Act, approved June 30, 2000 (114 Stat. 464; 15 U.S.C. § 7001 et seq.), for legally required notices, by the Internet, e-mail, or other electronic media, to receive and process a request from a consumer to temporarily lift a freeze on a credit report pursuant to subsection (d) of this section.

(g) A credit reporting agency may permanently remove a freeze placed on a credit report, without a request from the consumer, if the credit reporting agency placed the freeze as a result of a material misrepresentation of fact by the consumer.

(h) A credit reporting agency shall send written notification to the consumer 5 business days prior to permanently removing a freeze on a credit report pursuant to subsection (g) of this section.

(i) If a third party requests access to a credit report on which a security freeze is in effect in connection with an application for credit and the consumer does not allow his or her consumer report to be accessed by that specific party or for that period of time, the third party may treat the application as incomplete.

(j) If a security freeze is in place, a credit report shall not be released to a third party without prior express authorization from the consumer. A credit reporting agency may advise a third party that a security freeze is in effect with respect to the credit report.

(k) A security freeze shall remain in place until the consumer requests its permanent removal in writing. On or before January 31, 2009, a credit reporting agency shall remove a security freeze within 3 business days of receiving a request for permanent removal from the consumer.

(l) A credit reporting agency shall not suggest or otherwise state or imply to a third party that the consumer’s security freeze reflects a negative credit score, history, report, or rating.

(m) Nothing in this section shall prevent the lawful use of a credit report by any of the following:

(1)(A) A person or entity (including a subsidiary, affiliate, or agent of that person or entity; an assignee of a financial obligation owing by the consumer to that person or entity; or a prospective assignee of a financial obligation owing by the consumer to that person or entity), with which the consumer has or had prior to assignment an account or contract, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account in conjunction with the proposed purchase of a financial obligation or collecting the financial obligation owing for the account, contract, or negotiable instrument.

(B) For purposes of this paragraph, the term “reviewing the account” includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements;

(2) A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under subsection (d) of this section for purposes of facilitating the extension of credit or other permissible use;

(3) A person or entity acting pursuant to a court order, warrant, subpoena, or other compulsory process;

(4) A state or local agency that administers a program for establishing and enforcing child support obligations;

(5) A third party for the purposes of prescreening under section 604(e) of the Fair Credit Reporting Act, approved October 26, 1970 (84 Stat. 1129; 15 U.S.C. § 1681b(e));

(6) A person or entity for the purpose of providing a consumer with a copy of his or her credit report upon the consumer’s request;

(7) An insurance company, licensed in the District, for the purpose of setting or adjusting a rate or premium, adjusting a claim, or underwriting for property and casualty insurance purposes;

(8) A person or entity administering a credit file monitoring subscription service to which the consumer has subscribed; or

(9) A state, local, or federal government agency and its agents acting pursuant to a lawful investigation or to fulfill any of its other official duties.

(n) The following persons are not required to place a security freeze on a credit report:

(1) A person or entity that acts only as a reseller of credit information by assembling and merging information contained in the database of another person or entity, or multiple persons or entities, and does not maintain a permanent database of credit information from which new credit reports are produced; provided, that a person or entity acting as a reseller shall honor any security freeze placed on a credit report by a credit reporting agency;

(2) A check services or fraud prevention services company which issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments; and

(3) A deposit account information service company which issues reports regarding account closures due to fraud, substantial overdrafts, ATM abuse, or similar negative information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution.

(o) A consumer reporting agency may charge a consumer for a security freeze service only as follows:

(1) For the initial application for the consumer’s first personal identification number or password, the consumer may be charged $10.

(2) If the consumer fails to retain the original personal identification number or password provided by the agency, the consumer may not be charged for a one-time reissue of the same or a new personal identification number or password, but may be charged an amount not to exceed $10 for subsequent instances of loss and reissuance of a new personal identification number or password.

(3) Notwithstanding the foregoing, a consumer who has been a victim of identity theft shall not be charged any fee, but may be charged an amount not to exceed $10 for second or subsequent instances of loss and reissuance of a new personal identification number or password, for placement of a security freeze on his or her report.