Section 380-T. Security freeze

(a) A consumer may request that a security
  freeze be placed on his or her  consumer  credit  report  by  sending  a
  request  in  writing  with  confirmation  of  delivery  requested or via
  telephone, secure electronic means, or other methods  developed  by  the
  consumer  credit  reporting agency to a consumer credit reporting agency
  at an address, telephone number or secure  website  designated  by  such
  agency  to  receive  such  requests.  Consumer credit reporting agencies
  shall have a secure website and a separately dedicated toll-free  number
  to  offer  information,  to  process  requests  and deliver the services
  provided for under this section.
    (b) A consumer credit reporting agency that receives from a consumer a
  request in accordance  with  subdivision  (a)  of  this  section  shall,
  provided  such  request  is  accompanied  by  proper  identification and
  payment of any applicable fee, place a security freeze on  the  consumer
  credit  report  of  or  relating  to  such  consumer  no later than four
  business days after receiving such request, provided  further,  however,
  that for requests received on or after January first, two thousand nine,
  such  consumer  credit reporting agency shall place a security freeze on
  the consumer credit report of or relating to such consumer no later than
  three business days  after  receiving  such  request  and  for  requests
  received  on  or  after  January  first, two thousand ten, such consumer
  credit reporting agency shall place a security freeze  on  the  consumer
  credit report of or relating to such consumer no later than one business
  day  after  receiving such request. Nothing in this subdivision shall be
  construed to prevent a consumer credit reporting agency from advising  a
  third  party  that  a  security  freeze is in effect with respect to the
  consumer credit report of or relating  to  such  consumer.  No  consumer
  credit reporting agency shall advise in any manner a third party, of the
  fact  that  the  consumer  requesting  the  freeze is alleging to be the
  victim of domestic violence  or  identity  theft,  without  the  written
  authorization of the consumer.
    (c)  The  consumer  credit  reporting  agency  shall  send  a  written
  confirmation of the placement of  a  security  freeze  to  the  consumer
  within  five  business  days  of  placing  such freeze. Upon placing the
  security freeze on the consumer credit report of  or  relating  to  such
  consumer,  the  consumer  credit  reporting  agency  shall  provide  the
  consumer with a unique personal identification number  or  password,  or
  other  device  which  shall  only be used by the consumer when providing
  authorization for the release of his or her consumer credit report for a
  specific  party  or  specific  period  of  time.  The  unique   personal
  identification  number  or  password,  or other device to be used by the
  consumer shall not be a social security number or a  sequential  portion
  thereof.  Any  use  of  the  unique  personal  identification  number or
  password or other device other than provided  for  in  this  section  is
  prohibited.
    (d)  If the consumer wishes to allow his or her consumer credit report
  to be accessed for a specific party or a specific period of time while a
  freeze is in  place,  he  or  she  shall  contact  the  consumer  credit
  reporting  agency  via  mail  with  confirmation of delivery, telephone,
  secure electronic means or  other  method  developed  by  such  consumer
  credit  reporting  agency  pursuant  to  subdivision (f) of this section
  using a point of contact designated by such  consumer  credit  reporting
  agency,  request  that the freeze be temporarily lifted, and provide the
  following:
    (1) proper identification;
    (2) the unique personal identification number or password provided  by
  the consumer credit reporting agency pursuant to subdivision (c) of this
  section;

    (3)  the  proper information regarding the party to which the consumer
  credit report should be available or  the  time  period  for  which  the
  consumer credit report shall be available to users of such report; and
    (4) payment of any applicable fee.
    (e)  (1)  A  consumer  credit reporting agency that receives a request
  from a consumer to temporarily lift a freeze on a consumer credit report
  pursuant to subdivision (d) of  this  section,  shall  comply  with  the
  request:  (i)  no  later  than  three business days after receiving such
  request; (ii) as of September  first,  two  thousand  nine,  a  consumer
  credit  reporting  agency  that  receives  a  request  via  the use of a
  telephone or secure electronic method provided by the  agency,  pursuant
  to  subdivision  (d)  of this section, shall release a consumer's credit
  report as requested by the consumer within  fifteen  minutes  after  the
  request is received by the consumer credit reporting agency.
    (2)  A consumer credit reporting agency is not required to temporarily
  lift a security freeze within the time provided in subparagraph (ii)  of
  paragraph one of this subdivision if:
    (i)  the consumer fails to meet the requirements of subdivision (b) of
  this section; or
    (ii) the consumer credit reporting  agency's  ability  to  temporarily
  lift the security freeze within fifteen minutes is prevented by:
    (A) an act of God, including fire, earthquakes, hurricanes, storms, or
  similar natural disaster or phenomena;
    (B)   unauthorized  or  illegal  acts  by  a  third  party,  including
  terrorism,  sabotage,  riot,  vandalism,  labor  strikes   or   disputes
  disrupting operations, or similar occurrence;
    (C)    operational   interruption,   including   electrical   failure,
  unanticipated delay in equipment or replacement part delivery,  computer
  hardware  or  software  failures  inhibiting  response  time, or similar
  disruption;
    (D) governmental action, including emergency  orders  or  regulations,
  judicial or law enforcement action, or similar directives;
    (E) regularly scheduled maintenance, during other than normal business
  hours, of, or updates to, the consumer reporting agency's systems; or
    (F) commercially reasonable maintenance of, or repair to, the consumer
  reporting agency's systems that is unexpected or unscheduled.
    (f)   A  consumer  credit  reporting  agency  may  develop  procedures
  involving other secure methods of communication, including  the  use  of
  the internet, or other electronic media to receive and process a request
  from a consumer to temporarily lift a freeze on a consumer credit report
  pursuant to subdivision (d) of this section in an expedited manner.
    (g)   The  consumer  protection  board  shall  monitor  the  state  of
  technology relating to the means available to process requests  for  the
  lifting  or  removal  of  a  security  freeze,  and  shall report to the
  legislature when  it  is  determined  that  the  technology  to  process
  requests  for  the  lifting or removal of a security freeze in a shorter
  period of time than that set forth in subdivision (e) of this section is
  available.
    (h) A consumer credit reporting agency  shall  remove  or  temporarily
  lift  a  freeze placed on the consumer credit report of or relating to a
  consumer only in the following cases:
    (1) upon consumer request, pursuant to subdivision (d) or (k) of  this
  section; or
    (2)  if the consumer credit report of or relating to such consumer was
  frozen due to a material misrepresentation of fact by the consumer. If a
  consumer credit reporting agency intends  to  remove  a  freeze  upon  a
  consumer  credit  report pursuant to this paragraph, the consumer credit
  reporting agency shall notify the consumer in writing,  by  first  class

  mail,  within  three  business days prior to removing the freeze on such
  consumer credit report.
    (i)  If  a  third party requests access to a consumer credit report on
  which a security freeze is in effect, and this request is in  connection
  with  an  application for credit or any other use, and the consumer does
  not allow his or her consumer credit report  to  be  accessed  for  that
  period of time, the third party may treat the application as incomplete.
    (j)  If  a  consumer  requests  a security freeze, the consumer credit
  reporting agency shall disclose the process of placing  and  temporarily
  lifting  a  freeze,  and  the process for allowing access to information
  from such consumer credit report for a specific party  or  a  period  of
  time while the freeze is in place.
    (k)  (1)  A  security  freeze shall remain in place until the consumer
  requests, using a point of contact designated  by  the  consumer  credit
  reporting  agency,  that the security freeze be removed and provides the
  following:
    (i) proper identification;
    (ii) the unique personal identification number or password or  similar
  device  provided  by  the  consumer  credit reporting agency pursuant to
  subdivision (c) of this section; and
    (iii) a fee, if applicable.
    (2) A consumer credit reporting agency shall remove a security  freeze
  within  three  business days of receiving a request for removal from the
  consumer pursuant to paragraph one of this subdivision.
    (l)  A  consumer  credit  reporting  agency   shall   require   proper
  identification  of  the  person  making  a  request to place or remove a
  security freeze.
    (m) The provisions of this section do  not  apply  to  the  use  of  a
  consumer credit report by any of the following:
    (1)  a  person or entity, or a subsidiary, affiliate, or agent of that
  person or entity, or an assignee of a financial obligation owing by  the
  consumer  to  that  person  or  entity,  or  a prospective assignee of a
  financial obligation owing by the consumer to that person or  entity  in
  conjunction with the proposed purchase of the financial obligation, with
  which  the  consumer  has  or  had  prior  to  assignment  an account or
  contract, including a demand deposit account, or to  whom  the  consumer
  issued  a  negotiable  instrument,  for  the  purposes  of reviewing the
  account or collecting the financial obligation owing  for  the  account,
  contract,  or  negotiable  instrument.  For  purposes of this paragraph,
  "reviewing  the  account"  includes  activities   related   to   account
  maintenance, monitoring, credit line increases, and account upgrades and
  enhancements;
    (2)  a subsidiary, affiliate, agent, assignee, or prospective assignee
  of a person to whom access has been granted for purposes of facilitating
  the extension of credit or other permissible use;
    (3) any state or local agency, law enforcement agency, court,  private
  collection  agency, or person acting pursuant to a court order, warrant,
  or subpoena;
    (4) a child support agency acting pursuant to title iv-d of the social
  security act (42 U.S.C. et seq.);
    (5) the state or its political subdivisions or its agents  or  assigns
  acting  to  investigate  fraud  or  acting  to  investigate  or  collect
  delinquent taxes or unpaid court orders or to fulfill any of  its  other
  statutory responsibilities provided such responsibilities are consistent
  with a permissible purpose under 15 U.S.C. section 1681b;
    (6)  the use of credit information for the purposes of prescreening as
  provided for by the federal fair credit reporting act;

    (7) any person  or  entity  administering  a  credit  file  monitoring
  subscription or similar service to which the consumer has subscribed; or
    (8)  any person or entity for the purpose of providing a consumer with
  a copy of his or her consumer credit report or score upon the request of
  such consumer.
    (n) (1) (i) No consumer credit reporting agency shall charge a fee  to
  a  victim of identity theft who submits a copy of a signed federal trade
  commission ID theft victim's affidavit, or a report of ID theft  from  a
  law enforcement agency to such consumer credit reporting agency.
    (ii)  No  consumer  credit  reporting  agency  shall charge a fee to a
  domestic violence victim who  has  submitted  to  such  consumer  credit
  reporting agency:
    (A)  a  valid  domestic  violence incident report form as such term is
  defined in subdivision fifteen of section eight hundred thirty-seven  of
  the executive law;
    (B) a valid police report;
    (C) a valid order of protection; or
    (D)  a  signed affidavit from a licensed medical or mental health care
  provider, employee of a court acting within the  scope  of  his  or  her
  employment, social worker, a rape crisis counselor as defined in section
  forty-five  hundred ten of the civil practice law and rules, or advocate
  acting on behalf of an agency that assists domestic violence victims.
    For the purposes of this  subdivision,  the  term  "domestic  violence
  victim"  means  an  individual  who  is a victim of a family offense, as
  described in subdivision one of section 530.11 of the criminal procedure
  law, or an offense committed by a member of such individual's  immediate
  family,  as  defined  in subdivision four of section 120.40 of the penal
  law.
    (2) No consumer credit reporting  agency  shall  charge  a  fee  to  a
  consumer  requesting  the  placement  of  a  security  freeze  when such
  consumer has not previously requested the placement of a security freeze
  from such consumer credit reporting agency. Except as  provided  for  in
  paragraph  one  of  this subdivision, a consumer credit reporting agency
  may charge a consumer a fee not to exceed five dollars for the placement
  of a second or subsequent freeze or for the removal of a freeze  or  the
  temporary lift of a freeze for a specific party or period of time or for
  the issuance of a replacement personal identification number or password
  when  the consumer fails to retain the personal identification number or
  password provided to such consumer by  such  consumer  credit  reporting
  agency pursuant to subdivision (c) of this section.
    (o)  If  a  security  freeze  is in place, a consumer credit reporting
  agency shall not change any of the following official information  in  a
  consumer  credit  report  without  sending a written confirmation of the
  change to the consumer within thirty days of the change being posted  to
  the  file  of  or relating to such consumer: name, date of birth, social
  security number, and address. Written confirmation is not  required  for
  technical  modifications  of  the official information of or relating to
  such  consumer,  including  name  and  street  abbreviations,   complete
  spellings,  or  transposition  of  numbers or letters. In the case of an
  address change, the written confirmation shall be sent to both  the  new
  address and to the former address.
    (p) The following entities are not required to place a security freeze
  on a consumer credit report:
    (1) a consumer credit reporting agency that acts only as a reseller of
  credit  information  by  assembling and merging information contained in
  the data base of another consumer credit reporting  agency  or  multiple
  consumer  credit  reporting  agencies, and does not maintain a permanent
  data base of credit information from which new consumer  credit  reports

  are  produced.  However,  a consumer credit reporting agency acting as a
  reseller shall honor any security freeze placed  on  a  consumer  credit
  report by another consumer credit reporting agency;
    (2)  a  check  services  or  fraud  prevention services company, which
  issues reports on incidents of fraud or authorizations for  the  purpose
  of  approving  or  processing  negotiable  instruments, electronic funds
  transfers, or similar methods of payments; or
    (3) a  deposit  account  information  service  company,  which  issues
  reports regarding account closures due to fraud, substantial overdrafts,
  ATM  abuse,  or  similar  negative  information regarding a consumer, to
  inquiring  banks  or  other  financial  institutions  for  use  only  in
  reviewing a consumer request for a deposit account at the inquiring bank
  or financial institution.
    (q)  (1)  Any  time  a consumer credit reporting agency is required to
  send a summary of rights required under 15 U.S.C. section  1681g,  to  a
  consumer  residing  in this state the following notice shall be included
  with such summary of rights:
    "NEW YORK CONSUMERS HAVE THE RIGHT TO OBTAIN A SECURITY FREEZE.
    YOU HAVE A RIGHT TO PLACE A "SECURITY FREEZE" ON YOUR  CREDIT  REPORT,
  WHICH  WILL  PROHIBIT  A CONSUMER CREDIT REPORTING AGENCY FROM RELEASING
  INFORMATION IN YOUR CREDIT REPORT WITHOUT YOUR EXPRESS AUTHORIZATION.  A
  SECURITY  FREEZE  MUST  BE  REQUESTED  IN  WRITING DELIVERY CONFIRMATION
  REQUESTED OR VIA TELEPHONE, SECURE ELECTRONIC MEANS,  OR  OTHER  METHODS
  DEVELOPED  BY  THE CONSUMER CREDIT REPORTING AGENCY. THE SECURITY FREEZE
  IS DESIGNED TO PREVENT CREDIT, LOANS, AND SERVICES FROM  BEING  APPROVED
  IN  YOUR  NAME  WITHOUT  YOUR CONSENT. HOWEVER, YOU SHOULD BE AWARE THAT
  USING A SECURITY FREEZE TO TAKE CONTROL OVER  WHO  GETS  ACCESS  TO  THE
  PERSONAL  AND  FINANCIAL  INFORMATION  IN  YOUR CREDIT REPORT MAY DELAY,
  INTERFERE WITH, OR  PROHIBIT  THE  TIMELY  APPROVAL  OF  ANY  SUBSEQUENT
  REQUEST  OR APPLICATION YOU MAKE REGARDING A NEW LOAN, CREDIT, MORTGAGE,
  GOVERNMENT SERVICES OR PAYMENTS, INSURANCE, RENTAL HOUSING,  EMPLOYMENT,
  INVESTMENT,  LICENSE,  CELLULAR  PHONE,  UTILITIES,  DIGITAL  SIGNATURE,
  INTERNET CREDIT  CARD  TRANSACTION,  OR  OTHER  SERVICES,  INCLUDING  AN
  EXTENSION  OF  CREDIT AT POINT OF SALE. WHEN YOU PLACE A SECURITY FREEZE
  ON YOUR CREDIT REPORT, YOU WILL BE PROVIDED  A  PERSONAL  IDENTIFICATION
  NUMBER  OR  PASSWORD  TO  USE IF YOU CHOOSE TO REMOVE THE FREEZE ON YOUR
  CREDIT REPORT OR AUTHORIZE THE  RELEASE  OF  YOUR  CREDIT  REPORT  TO  A
  SPECIFIC  PARTY OR FOR A PERIOD OF TIME AFTER THE FREEZE IS IN PLACE. TO
  PROVIDE  THAT  AUTHORIZATION  YOU  MUST  CONTACT  THE  CONSUMER   CREDIT
  REPORTING AGENCY AND PROVIDE ALL OF THE FOLLOWING:
    (1) THE PERSONAL IDENTIFICATION NUMBER OR PASSWORD;
    (2) PROPER IDENTIFICATION TO VERIFY YOUR IDENTITY;
    (3)  THE  PROPER INFORMATION REGARDING THE PARTY OR PARTIES WHO ARE TO
  RECEIVE THE CREDIT REPORT OR THE PERIOD OF TIME  FOR  WHICH  THE  REPORT
  SHALL BE AVAILABLE TO USERS OF THE CREDIT REPORT; AND
    (4) PAYMENT OF ANY APPLICABLE FEE.
    A  CONSUMER CREDIT REPORTING AGENCY MUST AUTHORIZE THE RELEASE OF YOUR
  CREDIT REPORT NO LATER THAN THREE  BUSINESS  DAYS  AFTER  RECEIVING  THE
  ABOVE  INFORMATION.  EFFECTIVE  SEPTEMBER  FIRST,  TWO  THOUSAND NINE, A
  CONSUMER CREDIT REPORTING AGENCY THAT RECEIVES A REQUEST  VIA  TELEPHONE
  OR  SECURE  ELECTRONIC  METHOD  SHALL RELEASE A CONSUMER'S CREDIT REPORT
  WITHIN FIFTEEN MINUTES WHEN THE REQUEST IS RECEIVED.
    A SECURITY FREEZE DOES NOT APPLY TO CIRCUMSTANCES IN WHICH YOU HAVE AN
  EXISTING ACCOUNT RELATIONSHIP AND A COPY OF YOUR REPORT IS REQUESTED  BY
  YOUR  EXISTING CREDITOR OR ITS AGENTS OR AFFILIATES FOR CERTAIN TYPES OF
  ACCOUNT REVIEW, COLLECTION, FRAUD CONTROL OR SIMILAR ACTIVITIES.
    IF YOU ARE ACTIVELY SEEKING CREDIT, YOU  SHOULD  UNDERSTAND  THAT  THE
  PROCEDURES   INVOLVED  IN  LIFTING  A  SECURITY  FREEZE  MAY  SLOW  YOUR

  APPLICATION FOR CREDIT. YOU SHOULD PLAN AHEAD AND LIFT A FREEZE,  EITHER
  COMPLETELY  IF  YOU  ARE  SHOPPING AROUND, OR SPECIFICALLY FOR A CERTAIN
  CREDITOR, BEFORE  APPLYING  FOR  NEW  CREDIT.  WHEN  SEEKING  CREDIT  OR
  PURSUING  ANOTHER TRANSACTION REQUIRING ACCESS TO YOUR CREDIT REPORT, IT
  IS NOT NECESSARY TO RELINQUISH YOUR PIN OR PASSWORD TO THE  CREDITOR  OR
  BUSINESS; YOU CAN CONTACT THE CONSUMER CREDIT REPORTING AGENCY DIRECTLY.
  IF  YOU  CHOOSE  TO  GIVE  OUT  YOUR  PIN OR PASSWORD TO THE CREDITOR OR
  BUSINESS, IT IS RECOMMENDED THAT YOU OBTAIN A NEW PIN OR  PASSWORD  FROM
  THE CONSUMER CREDIT REPORTING AGENCY."
    (2)  If  a consumer requests information about a security freeze, such
  consumer shall be provided with the notice set forth in paragraph one of
  this subdivision and with any  other  information  necessary  to  place,
  temporarily  lift  or  permanently lift a security freeze, including but
  not limited to the address, telephone number  or  point  of  contact  at
  which the consumer credit reporting agency receives such requests.
    (r)  When  a  consumer  credit reporting agency erroneously releases a
  consumer credit report subject to a security freeze or  any  information
  contained  in such consumer credit report, the consumer credit reporting
  agency shall send written notification to the affected  consumer  within
  three   business  days  following  discovery  or  notification  of  such
  erroneous release. Such notification shall also inform the  consumer  of
  the  nature of the information released and identify and provide contact
  information for the recipient of such  information  or  consumer  credit
  report.
    (s)  Whenever  there shall be a violation of this section, application
  may be made by the attorney general in the name of  the  people  of  the
  state of New York to a court or justice having jurisdiction by a special
  proceeding  to  issue an injunction, and upon notice to the defendant of
  not less than five days, to enjoin and restrain the continuance of  such
  violations;  and  if it shall appear to the satisfaction of the court or
  justice that the defendant has,  in  fact,  violated  this  section,  an
  injunction  may  be  issued  by  such  court  or  justice, enjoining and
  restraining any further violation,  without  requiring  proof  that  any
  person  has,  in  fact,  been  injured  or  damaged thereby. In any such
  proceeding, the court may make allowances to  the  attorney  general  as
  provided  in  paragraph  six  of subdivision (a) of section eighty-three
  hundred  three  of  the  civil  practice  law  and  rules,  and   direct
  restitution. Whenever the court shall determine that a violation of this
  section  has  occurred, the court may impose a civil penalty of not more
  than five thousand dollars for each violation. In  connection  with  any
  such  proposed  application,  the attorney general is authorized to take
  proof and make a determination  of  the  relevant  facts  and  to  issue
  subpoenas in accordance with the civil practice law and rules.