25:8FB367DB-587F-469E-88B0-EEB4A71E3E00714GCONSUMER CREDIT SECURITY714G.1Definitions.For the purposes of this chapter, unless the context otherwise requires:1“Consumer” means an individual who is a resident of this state sixteen years of age or older who does not otherwise meet the definition of a protected consumer and who is not subject to a protected consumer security freeze.2“Consumer credit report” means a consumer report, as defined in 15 U.S.C. §1681a, that is used or collected in whole or in part for the purpose of serving as a factor in establishing a consumer’s eligibility for credit for personal, family, or household purposes.3“Consumer reporting agency” means the same as defined in 15 U.S.C. §1681a(f). A consumer reporting agency does not include any of the following:aA check service or fraud prevention service company that reports on incidents of fraud or issues authorizations for the purpose of approving or processing negotiable instruments, electronic fund transfers, or similar methods of payment.bA deposit account information service company that issues reports regarding account closures due to fraud, overdrafts, automated teller machine abuse, or similar negative information regarding a consumer to inquiring financial institutions for use only in reviewing the consumer’s request for a deposit account at the inquiring financial institution.cAny person or entity engaged in the practice of assembling and merging information contained in a database of one or more consumer reporting agencies and does not maintain a permanent database of credit information from which new consumer reports are produced.dA company that maintains a database or file that consists of any of the following information which is used for purposes unrelated to the granting of credit:1Criminal history information.2Information relating to employment, rental history, or a background check.4“Identification information” means as defined in section 715A.8.5“Identity theft” means as used in section 715A.8.6“Normal business hours” means Sunday through Saturday, between the hours of 6:00 a.m. and 9:30 p.m., central standard time or central daylight saving time.7“Proper identification” means the same as defined in 15 U.S.C. §1681h(a)(1).8“Protected consumer” means an individual who is either under sixteen years of age at the time a request for a protected consumer security freeze is made for the individual or is an incapacitated person or a protected person for whom a guardian or conservator has been appointed.9“Protected consumer security freeze” means one of the following:aIf a consumer reporting agency does not have a file pertaining to a protected consumer, a restriction that is placed on the protected consumer’s record in accordance with section 714G.8A that prohibits the consumer reporting agency from releasing the protected consumer’s record except as provided in that section.bIf a consumer reporting agency has a file pertaining to a protected consumer, a restriction that is placed on the protected consumer’s consumer credit report in accordance with section 714G.8A that prohibits the consumer reporting agency from releasing the protected consumer’s consumer credit report or any information derived from the protected consumer’s consumer credit report except as provided in that section. 10“Record” means a compilation of information that includes or satisfies all of the following:aIdentifies a protected consumer.bIs created by a consumer reporting agency solely for the purpose of complying with section 714G.8A.cIs not created or used to consider the protected consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living.11“Representative” means a protected consumer’s parent, guardian, or custodian who provides to a consumer reporting agency sufficient proof of authority to act on behalf of a protected consumer.12“Security freeze” means a notice placed in a consumer credit report, at the request of the consumer and subject to certain exceptions, that prohibits a consumer reporting agency from releasing the consumer credit report or score relating to the extension of credit.13“Sufficient proof of authority” means documentation that shows a representative has authority to act on behalf of a protected consumer, which may be demonstrated in the form of an order issued by a court of law, a lawfully executed and valid power of attorney, or a written notarized statement signed by the representative that expressly describes the authority of the representative to act on behalf of a protected consumer.14“Sufficient proof of identification” means one or more of the following:aA protected consumer’s social security number or a copy of a social security card issued by the federal social security administration.bA certified or official copy of a protected consumer’s birth certificate issued by the entity authorized to issue the birth certificate.cA copy of a protected consumer’s driver’s license, a protected consumer’s nonoperator’s identification card issued by the state department of transportation, or any other federal or state government-issued form of identification pertaining to a protected consumer.2008 Acts, ch 1063, §1; 2014 Acts, ch 1041, §1 – 3, 6714G.2Security freeze.1A consumer may submit a written request for a security freeze to a consumer reporting agency by first-class mail, telephone, secure internet connection, or other secure electronic contact method designated by the consumer reporting agency. The consumer must submit proper identification with the request. Within three business days after receiving the request, the consumer reporting agency shall commence the security freeze. Within three business days after commencing the security freeze, the consumer reporting agency shall send a written confirmation to the consumer of the security freeze, a personal identification number or password, other than the consumer’s social security number, for the consumer to use in authorizing the suspension or removal of the security freeze, including information on how the security freeze may be temporarily suspended.2aIf a consumer requests a security freeze from a consumer reporting agency that compiles and maintains files on a nationwide basis, the consumer reporting agency shall identify, to the best of its knowledge, any other consumer reporting agency that compiles and maintains files on consumers on a nationwide basis and inform consumers of appropriate contact information that would permit the consumer to place, lift, or remove a security freeze from such other consumer reporting agency.bFor purposes of this subsection, “consumer reporting agency that compiles and maintains files on a nationwide basis” means the same as defined in 15 U.S.C. §1681a(p).2008 Acts, ch 1063, §2; 2018 Acts, ch 1091, §1, 10714G.3Temporary suspension.1A consumer may request that a security freeze be temporarily suspended to allow the consumer reporting agency to release the consumer credit report for a specific time period. The consumer reporting agency shall develop procedures to expedite the receipt and processing of requests by first-class mail, telephone, secure internet connection, or other secure electronic contact method designated by the consumer reporting agency. The consumer reporting agency shall comply with the request within three business days after receiving the consumer’s written request, or within fifteen minutes after the consumer’s request is received by the consumer reporting agency through secure internet connection or other secure electronic contact method designated by the consumer reporting agency, or the use of a telephone, during normal business hours. The consumer’s request shall include all of the following:aProper identification.bThe personal identification number or password provided by the consumer reporting agency.cExplicit instructions of the specific time period designated for suspension of the security freeze.2A consumer reporting agency need not remove a security freeze within the time frames provided in subsection 1 if the consumer fails to meet the requirements of subsection 1, or the ability of the consumer reporting agency to remove the security freeze within fifteen minutes is prevented by one of the following:aAn act of God, including a fire, earthquake, hurricane, storm, or similar natural disaster or phenomenon.bUnauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrences.cOperational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruption.dGovernmental action, including emergency orders or regulations, judicial law enforcement action, or similar directives.eRegularly scheduled maintenance, during other than normal business hours, of the consumer reporting agency’s systems, or updates to the consumer reporting agency’s systems.fCommercially reasonable maintenance of, or repair to, the consumer reporting agency’s systems that is unexpected or unscheduled.gReceipt of a removal request outside of normal business hours.2008 Acts, ch 1063, §3; 2018 Acts, ch 1091, §2, 10714G.4Removal.A security freeze remains in effect until the consumer requests that the security freeze be removed. A consumer reporting agency shall remove a security freeze within three business days after receiving a request for removal that includes proper identification of the consumer, and the personal identification number or password provided by the consumer reporting agency.2008 Acts, ch 1063, §4; 2018 Acts, ch 1091, §3, 10714G.5Fees prohibited.A consumer reporting agency shall not charge a fee to a consumer for providing any service pursuant to this chapter, including but not limited to placing, removing, temporarily suspending, or reinstating a security freeze.2008 Acts, ch 1063, §5; 2018 Acts, ch 1091, §4714G.6Third parties.If a third party requests a consumer credit report that is subject to a security freeze, the consumer reporting agency may advise the third party that a security freeze is in effect. If the consumer does not expressly authorize the third party to have access to the consumer credit report through a temporary suspension of the security freeze, the third party shall not be given access to the consumer credit report but may treat a credit application as incomplete.2008 Acts, ch 1063, §6714G.7Misrepresentation of fact.A consumer reporting agency may suspend or remove a security freeze upon a material misrepresentation of fact by the consumer. However, the consumer reporting agency shall send notice to the consumer in writing prior to suspending or removing the security freeze.2008 Acts, ch 1063, §7714G.8Exceptions.A security freeze or protected consumer security freeze shall not apply to the following persons or entities:1A person or person’s subsidiary, affiliate, agent, or assignee with which the consumer has or prior to assignment had an account, contract, or debtor-creditor relationship for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or debt, or extending credit to a consumer with a prior or existing account, contract, or debtor-creditor relationship. “Reviewing the account” includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.2A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under a temporary suspension for purposes of facilitating the extension of credit or another permissible use.3A person acting pursuant to a court order, warrant, or subpoena.4Child support enforcement officials when investigating a child support case pursuant to Tit. IV-D or Tit. XIX of the federal Social Security Act.5The department of health and human services or its agents or assignees acting to investigate fraud under the medical assistance program.6The department of revenue or local taxing authorities, or any of their agents or assignees, acting to investigate or collect delinquent taxes or assessments, including interest and penalties and unpaid court orders, or to fulfill any of their other statutory or other responsibilities.7A person’s use of credit information for prescreening as provided by the federal Fair Credit Reporting Act.8A person for the sole purpose of providing a credit file monitoring subscription service to which the consumer has subscribed.9A consumer reporting agency for the sole purpose of providing a customer with a copy of the consumer credit report upon the consumer’s request.10A person’s use of a consumer credit report in connection with the business of insurance.2008 Acts, ch 1063, §8; 2012 Acts, ch 1023, §85; 2014 Acts, ch 1041, §4, 6; 2023 Acts, ch 19, §1304714G.8AProtected consumer security freeze.1A consumer reporting agency shall implement a protected consumer security freeze for a protected consumer if the consumer reporting agency receives a request from the protected consumer’s representative for the placement of the protected consumer security freeze pursuant to this section and the protected consumer’s representative complies with all of the following:aSubmits the request to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency.bProvides sufficient proof of identification of the protected consumer and proof of the identity of the representative.cProvides sufficient proof of authority to act on behalf of the protected consumer.2aA protected consumer security freeze requested pursuant to subsection 1 shall commence within thirty days after the request is received. If a consumer reporting agency does not have a file pertaining to a protected consumer when the consumer reporting agency receives the request, the consumer reporting agency shall create a record for the protected consumer within thirty days after the request is received. bWhile a protected consumer security freeze is in effect, a consumer reporting agency shall not release the protected consumer’s consumer credit report, any information derived from the protected consumer’s consumer credit report, or any information contained in the record created for the protected consumer. The protected consumer security freeze shall remain in effect until the protected consumer or the protected consumer’s representative requests the consumer reporting agency to remove the protected consumer security freeze pursuant to subsection 3, or the consumer reporting agency removes the protected consumer security freeze pursuant to subsection 6.3A consumer reporting agency shall remove a protected consumer security freeze if the consumer reporting agency receives a request from the protected consumer or the protected consumer’s representative to remove the protected consumer’s security freeze that complies with all of the following:aThe request is submitted to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency.bIn the case of a request by a protected consumer, the request includes proof that previously submitted sufficient proof of authority for the protected consumer’s representative to act on behalf of the protected consumer is no longer valid, and sufficient proof of identification of the protected consumer.cIn the case of a request by the representative of a protected consumer, the request includes sufficient proof of identification of the protected consumer, proof of the identity of the representative, and sufficient proof of authority to act on behalf of the protected consumer.4A protected consumer security freeze shall be removed by the consumer reporting agency within thirty days after the request for removal pursuant to subsection 3 is received by the consumer reporting agency.5A consumer reporting agency shall not charge a fee for the placement, removal, or reinstatement of a protected consumer security freeze. A consumer reporting agency may not charge any other fee for a service performed pursuant to this section.6A consumer reporting agency may remove a protected consumer security freeze for a protected consumer or delete a record of a protected consumer if the protected consumer security freeze was commenced or the record was created based on a material misrepresentation of fact by the protected consumer or the protected consumer’s representative.7The provisions of sections 714G.8, 714G.10, and 714G.11 shall be applicable to a protected consumer security freeze. 2014 Acts, ch 1041, §5, 6; 2018 Acts, ch 1091, §5 – 7714G.9Written confirmation.After a security freeze is in effect, a consumer reporting agency may post a name, date of birth, social security number, or address change in a consumer credit report provided written confirmation is sent to the consumer within thirty days of posting the change. For an address change, written confirmation shall be sent to both the new and former addresses. Written confirmation is not required to correct spelling and typographical errors.2008 Acts, ch 1063, §9714G.10Waiver void.A waiver by a consumer of the provisions of this chapter is contrary to public policy and is void and unenforceable.2008 Acts, ch 1063, §10714G.11Enforcement.A person who violates this chapter violates section 714.16, subsection 2, paragraph “a”. All powers conferred upon the attorney general to accomplish the objectives and carry out the duties prescribed in section 714.16 are also conferred upon the attorney general to enforce this chapter including but not limited to the power to issue subpoenas, adopt rules, and seek injunctive relief and a monetary award for civil penalties, attorney fees, and costs. Additionally, the attorney general may seek and recover the greater of five hundred dollars or actual damages for each customer injured by a violation of this chapter.2008 Acts, ch 1063, §11