359-B:24 Security Freeze by Consumer Reporting Agency. –
I. A consumer may place a security freeze on the consumer's consumer report by making a request to a consumer reporting agency in accordance with this section. A security freeze shall prohibit, subject to exceptions in RSA 359-B:26, the consumer reporting agency from releasing the consumer's credit report or any information from it without the express authorization of the consumer. When a security freeze is in place, a consumer reporting agency may not release the consumer's credit report or information to a third party without prior express authorization from the consumer. This section does not prevent a consumer reporting agency from advising a third party that a security freeze is in effect with respect to the consumer report, provided that the consumer reporting agency does not state or otherwise imply to the third party that the consumer's security freeze reflects a negative credit score, history, report, or rating. A consumer reporting agency shall place a security freeze on a consumer report if the consumer requests a security freeze by any of the following methods:
(a) First-class mail.
(b) Telephone call.
(c) Secure website or secure electronic mail connection.
II. A consumer reporting agency shall place a security freeze on a consumer report no later than 3 business days after receiving a written request from the consumer by mail. A consumer reporting agency that receives such a request electronically or by telephone shall comply with the request within 24 hours of receiving the request.
III. The consumer reporting agency shall send a written confirmation of the security freeze to the consumer within 3 business days of placing the freeze and at the same time shall provide the consumer with a unique personal identification number or password, other than the consumer's social security number, to be used by the consumer when providing authorization for the release of the consumer's credit report for a specific period of time, or to a specific party, or for permanently lifting the freeze.
IV. If the consumer wishes to allow the consumer report to be accessed for a specific period of time or by a specific party while a freeze is in place, the consumer shall contact the consumer reporting agency by mail, by telephone, or electronically, request that the freeze be lifted or lifted with respect to a specific party, and provide all of the following:
(a) Proper identification.
(b) The unique personal identification number or password provided by the consumer reporting agency pursuant to paragraph III.
(c) The proper information regarding the third party who is authorized to receive the consumer report or the time period for which the report shall be available to users of the consumer report.
V. A consumer reporting agency that receives a request by mail from a consumer to lift a freeze on a consumer report pursuant to paragraph IV shall comply with the request no later than 3 business days after receiving the request. A consumer reporting agency that receives such a request electronically or by telephone shall comply with the request within 15 minutes of receiving the request.
VI. A consumer reporting agency shall remove, temporarily lift, or lift with respect to a specific third party a freeze placed on a consumer report only in the following cases:
(a) Upon the consumer's request, pursuant to paragraph IV or IX.
(b) If the consumer's credit report was frozen due to a material misrepresentation of fact by the consumer. If a consumer reporting agency intends to remove a freeze upon a consumer report pursuant to this section, the consumer reporting agency shall notify the consumer in writing prior to removing the freeze on the consumer report.
VII. If a third party requests access to a consumer report on which a security freeze is in effect and this request is in connection with an application for credit or any other use and the consumer does not allow the consumer's credit report to be accessed for that specific period of time, the third party may treat the application as incomplete.
VIII. If a consumer requests a security freeze pursuant to this section, the consumer reporting agency shall disclose to the consumer the process of placing and temporarily lifting a security freeze and the process for allowing access to information from the consumer report for a specific period of time or to a specific third party while the security freeze is in place.
IX. A security freeze shall remain in place until the consumer requests that the security freeze be temporarily lifted for a specific period of time or to a specific third party or removed. A consumer reporting agency shall remove a security freeze within 15 minutes of receiving an electronic request for removal from the consumer or within 3 business days of receiving a written or telephonic request for removal from the consumer, who provides all of the following:
(a) Proper identification.
(b) The unique personal identification number or password provided by the consumer reporting agency pursuant to paragraph III.
X. A consumer reporting agency shall require proper identification of the person making a request to place or remove a security freeze.
XI. If a security freeze is in place, a consumer reporting agency shall not change any of the following official information in a credit report without sending a written confirmation of the change to the consumer within 30 days of the change being posted to the consumer's file: name, date of birth, social security number, and address. Written confirmation is not required for technical modifications of a consumer's official information, including name and street abbreviations, complete spellings, or transposition of numbers or letters. In the case of an address change, the written confirmation shall be sent to both the new address and the former address.
XII. A consumer reporting agency shall not charge a fee to put a security freeze in place, remove a security freeze, or lift a security freeze for a specific period of time or to a specific third party. Nor shall a consumer reporting agency charge a consumer to issue or replace a personal identification number.