2013 Maryland Code
COMMERCIAL LAW
§ 14-1212 - Duty of user of consumer report to notify consumer

§14-1212.

(a) Whenever credit or insurance for personal, family, or household purposes, or employment involving a consumer is denied or the charge for credit or insurance is increased either wholly or partly because of information contained in a consumer report from a consumer reporting agency, the user of the consumer report shall so advise the consumer against whom the adverse action has been taken and supply the name and address of the consumer reporting agency making the report.

(b) Whenever credit for personal, family, or household purposes involving a consumer is denied or the charge for credit is increased either wholly or partly because of information obtained from a person other than a consumer reporting agency bearing upon the consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living, the user of the information shall, within a reasonable period of time not to exceed 30 days, upon the consumer’s written request for the reasons for the adverse action received within 60 days after learning of the adverse action disclose the nature of the information to the consumer. The user of the information shall clearly and accurately disclose to the consumer his right to make the written request at the time the adverse action is communicated to the consumer.

(c) A person may not be held liable for any violation of this section if he shows by a preponderance of the evidence that at the time of the alleged violation he maintained reasonable procedures to assure compliance with the provisions of subsections (a) and (b) of this section.

§ 14-1212 - 1. Security freeze by consumer

(a) Definitions. --

(1) In this section the following words have the meanings indicated.

(2) "Account review" includes activities related to account maintenance, account monitoring, credit line increases, and account upgrades and enhancements.

(3) "Security freeze" means a restriction placed on a consumer's consumer report at the request of the consumer that prohibits a consumer reporting agency from releasing the consumer's consumer report or any information derived from the consumer's consumer report without the express authorization of the consumer.

(b) Applicability. --

(1) This section does not apply to the use of a consumer's consumer report by:

(i) A person, or a subsidiary, affiliate, agent, or assignee of the person, with which the consumer has, or prior to assignment had, an account, contract, or debtor-creditor relationship, for the purpose of account review or collecting the financial obligation owing for the account, contract, or debt;

(ii) A person that was given access to the consumer's consumer report under subsection (e) of this section for the purpose of facilitating an extension of credit to the consumer or another permissible use;

(iii) A person acting in accordance with a court order, warrant, or subpoena;

(iv) A unit of State or local government that administers a program for establishing and enforcing child support obligations;

(v) The Department of Health and Mental Hygiene in connection with a fraud investigation conducted by the Department;

(vi) The State Department of Assessments and Taxation, the Comptroller, or any other State or local taxing authority in connection with:

1. An investigation conducted by the Department, Comptroller, or taxing authority;

2. The collection of delinquent taxes or unpaid court orders by the Department, Comptroller, or taxing authority; or

3. The performance of any other duty provided for by law;

(vii) A person for the purpose of prescreening, as defined by the federal Fair Credit Reporting Act;

(viii) A person administering a credit file monitoring subscription service to which the consumer has subscribed;

(ix) A person providing a consumer with a copy of the consumer's consumer report on request of the consumer; or

(x) To the extent not prohibited by other State law, a person only for the purpose of setting or adjusting an insurance rate, adjusting an insurance claim, or underwriting an insurance risk.

(2) This section does not apply to:

(i) A check services or fraud prevention services company that issues:

1. Reports on incidents of fraud; or

2. Authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar payment methods;

(ii) A deposit account information service company that issues reports regarding account closures due to fraud, substantial overdrafts, automated teller machine abuse, or similar negative information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution; or

(iii) A consumer reporting agency database or file that consists entirely of consumer information concerning, and used solely for:

1. Criminal record information;

2. Personal loss history information;

3. Fraud prevention or detection;

4. Employment screening; or

5. Tenant screening.

(c) Methods; written confirmation. --

(1) A consumer may elect to place a security freeze on the consumer's consumer report by:

(i) Written request sent by certified mail;

(ii) Subject to paragraph (6) of this subsection, telephone, by providing certain personal information that the consumer reporting agency may require to verify the identity of the consumer;

(iii) Electronic mail using an electronic postmark if a secure electronic mail connection is made available by the consumer reporting agency; or

(iv) If the consumer reporting agency makes a secure connection available on its website, an electronic request through that secure connection.

(2) A consumer reporting agency shall require a consumer to provide proper identifying information when requesting a security freeze.

(3) Except as provided in paragraph (5) of this subsection, a consumer reporting agency shall place a security freeze on a consumer's consumer report within 3 business days after receiving a request under paragraph (1) of this subsection.

(4) Within 5 business days after placing a security freeze on a consumer's consumer report, the consumer reporting agency shall:

(i) Send a written confirmation of the security freeze to the consumer;

(ii) Provide the consumer with a unique personal identification number or password to be used by the consumer when authorizing the release of the consumer's consumer report to a specific person or for a specific period of time; and

(iii) Provide the consumer with a written statement of the procedures for requesting the consumer reporting agency to remove or temporarily lift a security freeze.

(5) (i) Subject to subparagraph (ii) of this paragraph, a consumer reporting agency is not required to place a security freeze on a consumer report if the consumer reporting agency:

1. Acts only as a reseller of credit information by assembling and merging information contained in a database of another consumer reporting agency or multiple consumer reporting agencies; and

2. Does not maintain a permanent database of credit information from which new consumer reports are produced.

(ii) A consumer reporting agency that acts as a reseller of credit information shall honor a security freeze placed on a consumer report by another consumer reporting agency.

(6) (i) If a consumer requests placement of a security freeze by telephone under paragraph (1)(ii) of this subsection, the consumer reporting agency may require the consumer to confirm the request in writing on a form that the consumer reporting agency provides to the consumer with the materials sent in accordance with paragraph (4) of this subsection.

(ii) If the consumer fails to return written confirmation that the consumer reporting agency requires under subparagraph (i) of this paragraph, the consumer reporting agency may remove the security freeze in accordance with subsection (g)(2) of this section.

(d) Release of consumer report during freeze prohibited. --

(1) While a security freeze is in place, a consumer reporting agency may not release a consumer's consumer report or any information derived from a consumer's consumer report without the express prior authorization of the consumer.

(2) A consumer reporting agency may advise a person that a security freeze is in effect with respect to a consumer's consumer report.

(3) A consumer reporting agency may not state or imply to any person that a security freeze on a consumer's consumer report reflects a negative credit score, credit history, or credit rating.

(e) Temporary lift of freeze. --

(1) If a consumer wants to temporarily lift a security freeze to allow the consumer's consumer report to be accessed by a specific person or for a specific period of time while a security freeze is in place, the consumer shall:

(i) Contact the consumer reporting agency by:

1. Mail in the manner prescribed by the consumer reporting agency;

2. Telephone in the manner prescribed by the consumer reporting agency;

3. Electronic mail using an electronic postmark if a secure electronic mail connection is made available to the consumer by the consumer reporting agency; or

4. Electronic request if a secure connection is made available on the website of the consumer reporting agency;

(ii) Request that the security freeze be temporarily lifted; and

(iii) Provide the following to the consumer reporting agency:

1. Proper identifying information;

2. The unique personal identification number or password provided to the consumer under subsection (c)(4)(ii) of this section; and

3. The proper information regarding the person that is to receive the consumer report or the time period during which the consumer report is to be available to users of the consumer report.

(2) (i) Except as provided in subparagraph (ii) of this paragraph, a consumer reporting agency shall comply with a request made under paragraph (1) of this subsection within 3 business days after receiving the request.

(ii) 1. A consumer reporting agency shall comply with a request made under paragraph (1) of this subsection within 15 minutes after the consumer's request is received by the consumer reporting agency if the request is made by telephone, by electronic mail, or by secure connection on the website of the consumer reporting agency.

2. A consumer reporting agency that is unable to temporarily lift a security freeze under subsubparagraph 1 of this subparagraph shall lift the security freeze as soon as it is reasonably capable of doing so.

(3) A consumer reporting agency may develop procedures involving the use of facsimile or other electronic media to receive and process, in an expedited manner, a request from a consumer to temporarily lift or remove a security freeze on the consumer's consumer report.

(f) Effect of denial of access to consumer report during freeze. -- If, in connection with an application for credit or for any other use, a person requests access to a consumer's consumer report while a security freeze is in place and the consumer does not authorize access to the consumer report, the person may treat the application as incomplete.

(g) Removal of security freeze by consumer reporting agency. --

(1) Except as provided in paragraph (2) of this subsection, a consumer reporting agency may remove or temporarily lift a security freeze placed on a consumer's consumer report only on request of the consumer made under subsection (e) or (h) of this section.

(2) (i) A consumer reporting agency may remove a security freeze placed on a consumer's consumer report if:

1. Placement of the security freeze was based on a material misrepresentation of fact by the consumer; or

2. The consumer:

A. Made the request to place the security freeze by telephone under subsection (c)(1)(ii) of this section; and

B. Failed to confirm the request in writing if required in accordance with subsection (c)(6) of this section.

(ii) If a consumer reporting agency intends to remove a security freeze under subparagraph (i) of this paragraph, the consumer reporting agency shall notify the consumer in writing of its intent at least 5 business days before removing the security freeze.

(h) Removal of security freeze by consumer. --

(1) Subject to subsection (g)(2) of this section, a security freeze shall remain in place until the consumer requests that the security freeze be removed.

(2) If a consumer wants to remove a security freeze from the consumer's consumer report, the consumer shall:

(i) Contact the consumer reporting agency by:

1. Mail in the manner prescribed by the consumer reporting agency;

2. Telephone in the manner prescribed by the consumer reporting agency;

3. Electronic mail using an electronic postmark if a secure electronic mail connection is made available to the consumer by the consumer reporting agency; or

4. Electronic request if a secure connection is made available on the website of the consumer reporting agency;

(ii) Request that the security freeze be removed; and

(iii) Provide the following to the consumer reporting agency:

1. Proper identifying information; and

2. The unique personal identification number or password provided by the consumer reporting agency under subsection (c)(4)(ii) of this section.

(3) A consumer reporting agency shall remove a security freeze within 3 business days after receiving a request for removal.

(i) Charging of frees. --

(1) Except as provided in paragraph (2) of this subsection, a consumer may not be charged for any service relating to a security freeze.

(2) A consumer reporting agency may charge a reasonable fee, not exceeding $ 5, for each placement, temporary lift, or removal of a security freeze.

(3) Notwithstanding paragraph (2) of this subsection, a consumer reporting agency may not charge any fee under this section to a consumer who:

(i) Has obtained a report of alleged identity fraud against the consumer under § 8-304 of the Criminal Law Article or an identity theft passport under § 8-305 of the Criminal Law Article; and

(ii) Provides a copy of the report or passport to the consumer reporting agency.

(j) Notice of rights. -- At any time that a consumer is entitled to receive a summary of rights under § 609 of the federal Fair Credit Reporting Act or § 14-1206 of this subtitle, the following notice shall be included:

"NOTICE

You have a right, under § 14-1212.1 of the Commercial Law Article of the Annotated Code of Maryland, to place a security freeze on your credit report. The security freeze will prohibit a consumer reporting agency from releasing your credit report or any information derived from your credit report without your express authorization. The purpose of a security freeze is to prevent credit, loans, and services from being approved in your name without your consent.

You may elect to have a consumer reporting agency place a security freeze on your credit report by written request sent by certified mail or by electronic mail or the Internet if the consumer reporting agency provides a secure electronic connection. The consumer reporting agency must place a security freeze on your credit report within 3 business days after your request is received. Within 5 business days after a security freeze is placed on your credit report, you will be provided with a unique personal identification number or password to use if you want to remove the security freeze or temporarily lift the security freeze to release your credit report to a specific person or for a specific period of time. You also will receive information on the procedures for removing or temporarily lifting a security freeze.

If you want to temporarily lift the security freeze on your credit report, you must contact the consumer reporting agency and provide all of the following:

(1) The unique personal identification number or password provided by the consumer reporting agency;

(2) The proper identifying information to verify your identity; and

(3) The proper information regarding the person who is to receive the credit report or the period of time for which the credit report is to be available to users of the credit report.

A consumer reporting agency must comply with a request to temporarily lift a security freeze on a credit report within 3 business days after the request is received, or within 15 minutes for certain requests. A consumer reporting agency must comply with a request to remove a security freeze on a credit report within 3 business days after the request is received.

If you are actively seeking credit, you should be aware that the procedures involved in lifting a security freeze may slow your own applications for credit. You should plan ahead and lift a security freeze, either completely if you are seeking credit from a number of sources, or just for a specific creditor if you are applying only to that creditor, a few days before actually applying for new credit.

A consumer reporting agency may charge a reasonable fee not exceeding $ 5 for each placement, temporary lift, or removal of a security freeze. However, a consumer reporting agency may not charge any fee to a consumer who, at the time of a request to place, temporarily lift, or remove a security freeze, presents to the consumer reporting agency a police report of alleged identity fraud against the consumer or an identity theft passport.

A security freeze does not apply if you have an existing account relationship and a copy of your credit report is requested by your existing creditor or its agents or affiliates for certain types of account review, collection, fraud control, or similar activities."

(k) Violation of security freeze; notice. -- If a consumer reporting agency violates a security freeze by releasing a consumer's consumer report subject to a security freeze or any information derived from a consumer's consumer report subject to a security freeze without authorization, the consumer reporting agency, within 5 business days after discovering or being notified of the release, shall notify the consumer in writing of:

(1) The specific information released; and

(2) The name and address of, or other available contact information for, the recipient of the consumer report or the information released.

(l) Exclusive remedy. -- The exclusive remedy for a violation of subsection (e)(2)(ii) of this section shall be a complaint filed with the Commissioner under § 14-1217 of this subtitle.

§ 14-1212 - 2. Security freeze by consumer reporting agency

(a) Definitions. --

(1) In this section the following words have the meanings indicated.

(2) "Protected consumer" means an individual who is:

(i) Under the age of 16 years at the time a request for the placement of a security freeze is made; or

(ii) An incapacitated person or a protected person for whom a guardian or conservator has been appointed in accordance with Title 13 of the Estates and Trusts Article.

(3) "Record" means a compilation of information that:

(i) Identifies a protected consumer;

(ii) Is created by a consumer reporting agency solely for the purpose of complying with this section; and

(iii) May not be created or used to consider the protected consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living for any purpose listed in § 14-1201(d)(1) of this subtitle.

(4) "Representative" means a person who provides to a consumer reporting agency sufficient proof of authority to act on behalf of a protected consumer.

(5) "Security freeze" means:

(i) If a consumer reporting agency does not have a file pertaining to a protected consumer, a restriction that:

1. Is placed on the protected consumer's record in accordance with this section; and

2. Prohibits the consumer reporting agency from releasing the protected consumer's record except as provided in this section; or

(ii) If a consumer reporting agency has a file pertaining to the protected consumer, a restriction that:

1. Is placed on the protected consumer's consumer report in accordance with this section; and

2. Prohibits the consumer reporting agency from releasing the protected consumer's consumer report or any information derived from the protected consumer's consumer report except as provided in this section.

(6) (i) "Sufficient proof of authority" means documentation that shows a representative has authority to act on behalf of a protected consumer.

(ii) "Sufficient proof of authority" includes:

1. An order issued by a court of law;

2. A lawfully executed and valid power of attorney; and

3. A written, notarized statement signed by a representative that expressly describes the authority of the representative to act on behalf of a protected consumer.

(7) (i) "Sufficient proof of identification" means information or documentation that identifies a protected consumer or a representative of a protected consumer.

(ii) "Sufficient proof of identification" includes:

1. A Social Security number or a copy of a Social Security card issued by the Social Security Administration;

2. A certified or official copy of a birth certificate issued by the entity authorized to issue the birth certificate;

3. A copy of a driver's license, an identification card issued by the Motor Vehicle Administration, or any other government-issued identification; or

4. A copy of a bill, including a bill for telephone, sewer, septic tank, water, electric, oil, or natural gas services, that shows a name and home address.

(b) Applicability. -- This section does not apply to the use of a protected consumer's consumer report or record by:

(1) A person administering a credit file monitoring subscription service to which:

(i) The protected consumer has subscribed; or

(ii) The representative of the protected consumer has subscribed on behalf of the protected consumer;

(2) A person providing the protected consumer or the protected consumer's representative with a copy of the protected consumer's consumer report on request of the protected consumer or the protected consumer's representative; or

(3) An entity listed in § 14-1212.1(b)(2)(i) or (ii) or (c)(5) of this subtitle.

(c) In general. --

(1) A consumer reporting agency shall place a security freeze for a protected consumer if:

(i) The consumer reporting agency receives a request from the protected consumer's representative for the placement of the security freeze under this section; and

(ii) The protected consumer's representative:

1. Submits the request to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency;

2. Provides to the consumer reporting agency sufficient proof of identification of the protected consumer and the representative;

3. Provides to the consumer reporting agency sufficient proof of authority to act on behalf of the protected consumer; and

4. Pays to the consumer reporting agency a fee as provided in subsection (i) of this section.

(2) If a consumer reporting agency does not have a file pertaining to a protected consumer when the consumer reporting agency receives a request under paragraph (1) of this subsection, the consumer reporting agency shall create a record for the protected consumer.

(d) Timing. -- Within 30 days after receiving a request that meets the requirements of subsection (c)(1) of this section, a consumer reporting agency shall place a security freeze for the protected consumer.

(e) Release of consumer report prohibited. -- Unless a security freeze for a protected consumer is removed in accordance with subsection (g) or (j) of this section, a consumer reporting agency may not release the protected consumer's consumer report, any information derived from the protected consumer's consumer report, or any record created for the protected consumer.

(f) Period of security freeze. -- A security freeze for a protected consumer placed under subsection (d) of this section shall remain in effect until:

(1) The protected consumer or the protected consumer's representative requests the consumer reporting agency to remove the security freeze in accordance with subsection (g) of this section; or

(2) The security freeze is removed in accordance with subsection (j) of this section.

(g) Removal of security freeze. -- If a protected consumer or a protected consumer's representative wishes to remove a security freeze for the protected consumer, the protected consumer or the protected consumer's representative shall:

(1) Submit a request for the removal of the security freeze to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency;

(2) Provide to the consumer reporting agency:

(i) In the case of a request by the protected consumer:

1. Proof that the sufficient proof of authority for the protected consumer's representative to act on behalf of the protected consumer is no longer valid; and

2. Sufficient proof of identification of the protected consumer; or

(ii) In the case of a request by the representative of a protected consumer:

1. Sufficient proof of identification of the protected consumer and the representative; and

2. Sufficient proof of authority to act on behalf of the protected consumer; and

(3) Pay to the consumer reporting agency a fee as provided in subsection (i) of this section.

(h) Removal of security freeze -- Timing. -- Within 30 days after receiving a request that meets the requirements of subsection (g) of this section, the consumer reporting agency shall remove the security freeze for the protected consumer.

(i) Fees. --

(1) Except as provided in paragraph (2) of this subsection, a consumer reporting agency may not charge a fee for any service performed under this section.

(2) A consumer reporting agency may charge a reasonable fee, not exceeding $ 5, for each placement or removal of a security freeze for a protected consumer.

(3) Notwithstanding paragraph (2) of this subsection, a consumer reporting agency may not charge any fee under this section if:

(i) The protected consumer's representative:

1. Has obtained a report of alleged identity fraud against the protected consumer under § 8-304 of the Criminal Law Article or an identity theft passport under § 8-305 of the Criminal Law Article; and

2. Provides a copy of the report or passport to the consumer reporting agency; or

(ii) 1. A request for the placement or removal of a security freeze is for a protected consumer who is under the age of 16 years at the time of the request; and

2. The consumer reporting agency has a consumer report pertaining to the protected consumer.

(j) Effect of material misrepresentation of fact. -- A consumer reporting agency may remove a security freeze for a protected consumer or delete a record of a protected consumer if the security freeze was placed or the record was created based on a material misrepresentation of fact by the protected consumer or the protected consumer's representative.

(k) Remedy for violation of section. -- Notwithstanding any other provision of law, the exclusive remedy for a violation of this section shall be a complaint filed with the Commissioner under § 14-1217 of this subtitle.