CHAPTER 714G
CONSUMER CREDIT SECURITY

  714G.1  Definitions.
  For the purposes of this chapter, unless the context otherwise requires:
  1.  “Consumer” means an individual who is a resident of this state.
  2.  “Consumer credit report” means a consumer report, as defined in 15 U.S.C. §  1681a, that is used or collected in whole or in part for the purpose of serving as a factor in establishing a consumer’s eligibility for credit for personal, family, or household purposes.
  3.  “Consumer reporting agency” means the same as defined in 15 U.S.C. §  1681a(f). A consumer reporting agency does not include any of the following:
  a.  A check service or fraud prevention service company that reports on incidents of fraud or issues authorizations for the purpose of approving or processing negotiable instruments, electronic fund transfers, or similar methods of payment.
  b.  A deposit account information service company that issues reports regarding account closures due to fraud, overdrafts, automated teller machine abuse, or similar negative information regarding a consumer to inquiring financial institutions for use only in reviewing the consumer’s request for a deposit account at the inquiring financial institution.
  c.  Any person or entity engaged in the practice of assembling and merging information contained in a database of one or more consumer reporting agencies and does not maintain a permanent database of credit information from which new consumer reports are produced.
  4.  “Identification information” means as defined in section 715A.8.
  5.  “Identity theft” means as used in section 715A.8.
  6.  “Normal business hours” means Sunday through Saturday, between the hours of 6:00 a.m. and 9:30 p.m., central standard time or central daylight saving time.
  7.  “Proper identification” means the same as defined in 15 U.S.C. §  1681h(a)(1).
  8.  “Security freeze” means a notice placed in a consumer credit report, at the request of the consumer and subject to certain exceptions, that prohibits a consumer reporting agency from releasing the consumer credit report or score relating to the extension of credit.
2008 Acts, ch 1063, §1

  714G.2  Security freeze.
  A consumer may submit by certified mail to a consumer reporting agency a written request for a security freeze. The consumer must submit proper identification and the applicable fee with the request. Within five business days after receiving the request, the consumer reporting agency shall commence the security freeze. Within ten business days after commencing the security freeze, the consumer reporting agency shall send a written confirmation to the consumer of the security freeze, a personal identification number or password, other than the consumer’s social security number, for the consumer to use in authorizing the suspension or removal of the security freeze, including information on how the security freeze may be temporarily suspended.
2008 Acts, ch 1063, §2

  714G.3  Temporary suspension.
  1.  A consumer may request that a security freeze be temporarily suspended to allow the consumer reporting agency to release the consumer credit report for a specific time period. The consumer reporting agency may develop procedures to expedite the receipt and processing of requests which may involve the use of telephones, facsimile transmissions, the internet, or other electronic media. The consumer reporting agency shall comply with the request within three business days after receiving the consumer’s written request, or within fifteen minutes after the consumer’s request is received by the consumer reporting agency through facsimile, the internet, or other electronic contact method chosen by the consumer reporting agency, or the use of a telephone, during normal business hours. The consumer’s request shall include all of the following:
  a.  Proper identification.
  b.  The personal identification number or password provided by the consumer reporting agency.
  c.  Explicit instructions of the specific time period designated for suspension of the security freeze.
  d.  Payment of the applicable fee.
  2.  A consumer reporting agency need not remove a security freeze within the time frames provided in subsection 1 if the consumer fails to meet the requirements of subsection 1, or the ability of the consumer reporting agency to remove the security freeze within fifteen minutes is prevented by one of the following:
  a.  An act of God, including a fire, earthquake, hurricane, storm, or similar natural disaster or phenomenon.
  b.  Unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrences.
  c.  Operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruption.
  d.  Governmental action, including emergency orders or regulations, judicial law enforcement action, or similar directives.
  e.  Regularly scheduled maintenance, during other than normal business hours, of the consumer reporting agency’s systems, or updates to the consumer reporting agency’s systems.
  f.  Commercially reasonable maintenance of, or repair to, the consumer reporting agency’s systems that is unexpected or unscheduled.
  g.  Receipt of a removal request outside of normal business hours.
2008 Acts, ch 1063, §3

  714G.4  Removal.
  A security freeze remains in effect until the consumer requests that the security freeze be removed. A consumer reporting agency shall remove a security freeze within three business days after receiving a request for removal that includes proper identification of the consumer, the personal identification number or password provided by the consumer reporting agency, and payment of the applicable fee.
2008 Acts, ch 1063, §4

  714G.5  Fees.
  1.  A consumer reporting agency shall not charge any fee to a consumer who is the victim of identity theft for commencing a security freeze, temporary suspension, or removal if with the initial security freeze request, the consumer submits a valid copy of the police report concerning the unlawful use of identification information by another person.
  2.  A consumer reporting agency may charge a fee not to exceed ten dollars to a consumer who is not the victim of identity theft for each security freeze, removal, or for reissuing a personal identification number or password if the consumer fails to retain the original number. The consumer reporting agency may charge a fee not to exceed twelve dollars for each temporary suspension of a security freeze.
2008 Acts, ch 1063, §5

  714G.6  Third parties.
  If a third party requests a consumer credit report that is subject to a security freeze, the consumer reporting agency may advise the third party that a security freeze is in effect. If the consumer does not expressly authorize the third party to have access to the consumer credit report through a temporary suspension of the security freeze, the third party shall not be given access to the consumer credit report but may treat a credit application as incomplete.
2008 Acts, ch 1063, §6

  714G.7  Misrepresentation of fact.
  A consumer reporting agency may suspend or remove a security freeze upon a material misrepresentation of fact by the consumer. However, the consumer reporting agency shall send notice to the consumer in writing prior to suspending or removing the security freeze.
2008 Acts, ch 1063, §7

  714G.8  Exceptions.
  A security freeze shall not apply to the following persons or entities:
  1.  A person or person’s subsidiary, affiliate, agent, or assignee with which the consumer has or prior to assignment had an account, contract, or debtor-creditor relationship for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or debt, or extending credit to a consumer with a prior or existing account, contract, or debtor-creditor relationship. “Reviewing the account” includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.
  2.  A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under a temporary suspension for purposes of facilitating the extension of credit or another permissible use.
  3.  A person acting pursuant to a court order, warrant, or subpoena.
  4.  Child support enforcement officials when investigating a child support case pursuant to  Tit. IV-D or  Tit. XIX of the federal Social Security Act.
  5.  The department of human services or its agents or assignees acting to investigate fraud under the medical assistance program.
  6.  The department of revenue or local taxing authorities, or any of their agents or assignees, acting to investigate or collect delinquent taxes or assessments, including interest and penalties and unpaid court orders, or to fulfill any of their other statutory or other responsibilities.
  7.  A person’s use of credit information for prescreening as provided by the federal Fair Credit Reporting Act.
  8.  A person for the sole purpose of providing a credit file monitoring subscription service to which the consumer has subscribed.
  9.  A consumer reporting agency for the sole purpose of providing a customer with a copy of the consumer credit report upon the consumer’s request.
  10.  A person’s use of a consumer credit report in connection with the business of insurance.
2008 Acts, ch 1063, §8; 2012 Acts, ch 1023, §85
Subsection 4 amended

  714G.9  Written confirmation.
  After a security freeze is in effect, a consumer reporting agency may post a name, date of birth, social security number, or address change in a consumer credit report provided written confirmation is sent to the consumer within thirty days of posting the change. For an address change, written confirmation shall be sent to both the new and former addresses. Written confirmation is not required to correct spelling and typographical errors.
2008 Acts, ch 1063, §9

  714G.10  Waiver void.
  A waiver by a consumer of the provisions of this chapter is contrary to public policy and is void and unenforceable.
2008 Acts, ch 1063, §10

  714G.11  Enforcement.
  A person who violates this chapter violates section 714.16, subsection 2, paragraph “a”. All powers conferred upon the attorney general to accomplish the objectives and carry out the duties prescribed in section 714.16 are also conferred upon the attorney general to enforce this chapter including but not limited to the power to issue subpoenas, adopt rules, and seek injunctive relief and a monetary award for civil penalties, attorney fees, and costs. Additionally, the attorney general may seek and recover the greater of five hundred dollars or actual damages for each customer injured by a violation of this chapter.
2008 Acts, ch 1063, §11