Download as PDF
367.365 Consumer's election regarding security freeze on consumer report -Subsequent access -- Duties of consumer reporting agency -- Duration of
security freeze -- Inapplicability to certain consumer reports -- Permitted
charges for security freeze -- Changes to official consumer report
information -- Penalties for section's violation.
(1)
(2)
(3)
(4)
(5)
(a)
A consumer may elect to place a security freeze on the consumer's
consumer report by written request, sent by certified mail, that includes
clear and proper identification, to a consumer reporting agency at an
address designated by the consumer reporting agency to receive such
request. A consumer reporting agency shall place a security freeze on a
consumer's consumer report no later than ten (10) business days after
receiving a written request for the security freeze from the consumer.
(b) When a security freeze is in place, information from a consumer's
consumer report shall not be released to a third party without prior
express authorization from the consumer. This subsection does not
prevent a consumer reporting agency from advising a third party that a
security freeze is in effect with respect to the consumer's consumer
report.
The consumer reporting agency shall, no later than ten (10) business days
after the date the agency receives the request for a security freeze, provide the
consumer with a unique personal identification number or password to be used
by the consumer when providing authorization for the access to his or her
credit file for a specific period of time. In addition, the consumer reporting
agency shall simultaneously provide to the consumer in writing the process of
placing, removing, and temporarily lifting a security freeze and the process for
allowing access to information from the consumer's credit file for a specific
period while the security freeze is in effect.
A consumer may request in writing a replacement personal identification
number or password. The request shall comply with the requirements for
requesting a security freeze under subsection (1) of this section. The consumer
reporting agency shall, not later than the tenth business day after the date the
agency receives the request for a replacement personal identification number
or password, provide the consumer with a new, unique personal identification
number or password to be used by the consumer instead of the number or
password that was provided under subsection (2) of this section.
If a third party requests access to a consumer report on which a security freeze
is in effect, and this request is in connection with an application for credit, the
third party may treat the application as incomplete.
If the consumer wishes to allow his consumer report or credit score to be
accessed for a specific period of time while a freeze is in place, the consumer
shall contact the consumer reporting agency and request that the freeze be
temporarily lifted and provide the following:
(a) Clear and proper identification;
(b) The unique personal identification number or password provided by the
consumer reporting agency pursuant to subsection (2) or (3) of this
section; and
(c)
(6)
(7)
(8)
(9)
The proper information regarding the time period for which the report
shall be available to users of the consumer report.
A consumer reporting agency that receives a request from a consumer to
temporarily lift a freeze on a consumer report pursuant to subsection (5) of this
section shall comply with the request no later than three (3) business days after
receiving the request. A consumer reporting agency may develop procedures
involving the use of telephone, fax, the Internet, or other electronic media to
receive and process a request from a consumer to temporarily lift a freeze on a
consumer report or credit score pursuant to subsection (5) of this section in an
expedited manner.
A consumer reporting agency shall remove or temporarily lift a freeze placed
on a consumer's consumer report only in the following cases:
(a) Upon consumer request as provided in this section; or
(b) If the consumer's consumer report was frozen due to a material
misrepresentation of fact by the consumer. If a consumer reporting
agency intends to remove a freeze upon a consumers consumer report
pursuant to this paragraph, the consumer reporting agency shall notify the
consumer in writing prior to removing the freeze on the consumer's
consumer report.
A security freeze shall remain in place until the consumer requests that the
security freeze be removed, but no longer than seven (7) years from the date
the security freeze was put in place. A consumer reporting agency shall
remove a security freeze within three (3) business days of receiving a request
for removal from the consumer, who provides both of the following:
(a) Clear and proper identification; and
(b) The unique personal identification number or password provided by the
consumer reporting agency.
A security freeze does not apply to a consumer report provided to:
(a) A federal, state, or local governmental entity, including a law enforcement
agency, or court, or their agents or assigns;
(b) A private collection agency for the sole purpose of assisting in the
collection of an existing debt of the consumer who is the subject of the
consumer report requested;
(c) A person or entity, or a subsidiary, affiliate, or agent of that person or
entity, or an assignee of a financial obligation owing by the consumer to
that person or entity, or a prospective assignee of a financial obligation
owing by the consumer to that person or entity in conjunction with the
proposed purchase of the financial obligation, with which the consumer
has or had prior to assignment an account or contract, including a
demand deposit account, or to whom the consumer issued a negotiable
instrument, for the purposes of reviewing the account or collecting the
financial obligation owing for the account, contract, or negotiable
instrument. For purposes of this paragraph, "reviewing the account"
includes activities related to account maintenance, monitoring, credit line
increases, and account upgrades and enhancements;
(d) A subsidiary, affiliate, agent, assignee, or prospective assignee of a
person to whom access has been granted under subsection (5) of this
section for the purposes of facilitating the extension of credit;
(e) A person, for the purposes of prescreening as provided by the federal
Fair Credit Reporting Act;
(f) A consumer reporting agency for the purposes of providing a consumer
with a copy of his own report on his request;
(g) A child support enforcement agency;
(h) A consumer reporting agency that acts only as a reseller of credit
information by assembling and merging information contained in the
database of another consumer reporting agency or multiple credit
reporting agencies and does not maintain a permanent database of credit
information from which new consumer reports are produced. However, a
consumer reporting agency acting as a reseller shall honor any security
freeze placed on a consumer report by another consumer reporting
agency;
(i) A check services or fraud prevention services company, which issues
reports on incidents of fraud or authorizations for the purpose of
approving or processing negotiable instruments, electronic funds
transfers, or similar methods of payments;
(j) A deposit account information service company, which issues reports
regarding account closures due to fraud, substantial overdrafts, ATM
abuse, or similar negative information regarding a consumer to inquiring
banks or other financial institutions for use only in reviewing a consumer
request for a deposit account at the inquiring bank or financial institution;
(k) Any person or entity using a consumer report in preparation for a civil or
criminal action, or an insurance company in investigation of a claim; or
(l) Any insurance company for setting or adjusting a rate or underwriting for
property and casualty insurance purposes.
(10) A consumer reporting agency may impose a reasonable charge on a consumer
for initially placing, temporarily lifting, or removing a security freeze on a
consumer file. The amount of the charge may not exceed ten dollars ($10). On
January 1 of each year, a consumer reporting agency may increase the charge
for placing a security alert. The increase shall be based proportionally on
changes to the Consumer Price Index for All Urban Consumers as determined
by the United States Department of Labor with fractional changes rounded to
the nearest twenty-five cents ($0.25). An exception shall be allowed whereby
the consumer will be charged zero dollars by the consumer reporting agency
placing the security freeze if the consumer is a victim of identity theft and, upon
the request of the consumer reporting agency, provides the consumer reporting
agency with a valid police report.
(11) If a security freeze is in place, a consumer reporting agency shall not change
any of the following official information in a consumer report without sending a
written confirmation of the change to the consumer within thirty (30) days of the
change being posted to the consumer's file:
(a) Name;
(b) Date of birth;
(12)
(13)
(14)
(15)
(c) Social Security number; and
(d) Address.
Written confirmation is not required for technical modifications of a consumer's
official information, including name and street abbreviations, complete
spellings, or transposition of numbers or letters. In the case of an address
change, the written confirmation shall be sent to both the new address and to
the former address.
Any person who willfully fails to comply with any requirement imposed under
this section with respect to any consumer is liable to that consumer in an
amount equal to the sum of:
(a) Any actual damages sustained by the consumer as a result of the failure;
(b) Any liquidated damages of not less than one hundred dollars ($100) and
not more than one thousand dollars ($1,000);
(c) Any punitive damages as the court may allow; and
(d) In the case of any successful action to enforce any liability under this
section, the costs of the action together with reasonable attorney's fees
as determined by the court.
Any person, other than the named individual or individuals in the report, who
obtains a consumer report, requests a security freeze, requests the temporary
lift of a freeze, or the removal of a security freeze from a consumer reporting
agency under false pretenses or in an attempt to violate federal or state law
shall be liable to the consumer reporting agency for actual damages sustained
by the consumer reporting agency or one thousand dollars ($1,000), whichever
is greater.
Any person who is negligent in failing to comply with any requirement imposed
under this section with respect to any consumer is liable to that consumer in an
amount equal to the sum of:
(a) Any actual damages sustained by the consumer as a result of the failure;
and
(b) In the case of any successful action to enforce any liability under this
section, the costs of the action together with reasonable attorney's fees
as determined by the court.
Nothing in KRS 367.363 to 367.365 shall be construed to limit or restrict the
exercise of powers or the performance of the duties of the Attorney General
authorized under any other provision of law to bring or seek redress for
persons that violate KRS 367.363 to 367.365.
Effective:July 12, 2006
History: Created 2006 Ky. Acts ch. 42, sec. 3, effective July 12, 2006.
Disclaimer: These codes may not be the most recent version. Kentucky may have more current or accurate information. We make no warranties or guarantees about the accuracy, completeness, or adequacy of the information contained on this site or the information linked to on the state site. Please check official sources.