A. As used in this section, “security freeze” means a notice placed in a consumer’s credit report, at the request of the consumer and subject to certain exceptions, that prohibits the consumer reporting agency from releasing the consumer’s credit report or score relating to the extension of credit.
B. A consumer may request that a security freeze be placed on his or her credit report by sending a request in writing by certified mail, or such other secure method authorized by a consumer reporting agency, to a consumer reporting agency at an address designated by the consumer reporting agency to receive such requests. This subsection does not prevent a consumer reporting agency from advising a third party that a security freeze is in effect with respect to the consumer’s credit report.
3. Payment of a fee not to exceed $ 10, if applicable.A consumer reporting agency shall place a security freeze on a consumer’s credit report no later than one business day after receiving such a request, if such request is made electronically at an address designated by the consumer reporting agency to receive such requests.
D. The consumer reporting agency shall send a written confirmation of the placement of the security freeze to the consumer within 10 business days. Upon placing the security freeze on the consumer’s credit report, the consumer reporting agency shall provide the consumer with a unique personal identification number or password, or similar device to be used by the consumer when providing authorization for the release of his credit report for a specific period of time or for a specific party.
E. If the consumer wishes to allow his credit report to be accessed for a specific period of time or for a specific party while a freeze is in place, he shall contact the consumer reporting agency using a point of contact designated by the consumer reporting agency, request that the freeze be temporarily lifted, and provide the following:
b. Within 15 minutes after the consumer’s request is received by the consumer reporting agency through the electronic contact method chosen by the consumer reporting agency in accordance with this section;
(3. Operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruption;
3. May develop procedures involving the use of telephone, fax, the Internet, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze on a credit report pursuant to subsection E in an expedited manner.
2. If the consumer’s credit report was frozen due to a material misrepresentation of fact by the consumer. If a consumer reporting agency intends to remove a freeze upon a consumer’s credit report pursuant to this subdivision, the consumer reporting agency shall notify the consumer in writing prior to removing the freeze on the consumer’s credit report.
H. If a third party requests access to a consumer credit report on which a security freeze is in effect, and this request is in connection with an application for credit or any other use, and the consumer does not allow his or her credit report to be accessed for that period of time, the third party may treat the application as incomplete.
I. If a consumer requests a security freeze, the consumer reporting agency shall disclose the process of placing and temporarily lifting a freeze, and the process for allowing access to information from the consumer’s credit report for a period of time while the freeze is in place.
J. A security freeze shall remain in place until the consumer requests, using a point of contact designated by the consumer reporting agency, that the security freeze be removed. A consumer reporting agency shall remove a security freeze within three business days of receiving a request for removal from the consumer, who provides:
1. A person or entity, or a subsidiary, affiliate, or agent of that person or entity, or an assignee of a financial obligation owing by the consumer to that person or entity, or a prospective assignee of a financial obligation owing by the consumer to that person or entity in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment an account or contract, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument. For purposes of this paragraph, “reviewing the account” includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements;
5. The Commonwealth or its agents or assigns acting to investigate fraud or acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities provided such responsibilities are consistent with a permissible purpose under 15 U.S.C. § 1681b;
M. This section does not prevent a consumer reporting agency from charging a fee of no more than $ 10 to a consumer to place each freeze, except that a consumer reporting agency may not charge a fee to a victim of identity theft who has submitted a valid police report to the consumer reporting agency.
N. If a security freeze is in place, a consumer reporting agency shall not change any of the following official information in a consumer credit report without sending a written confirmation of the change to the consumer within 30 days of the change being posted to the consumer’s file: name, date of birth, social security number, and address. Written confirmation is not required for technical modifications of a consumer’s official information, including name and street abbreviations, complete spellings, or transposition of numbers or letters. In the case of an address change, the written confirmation shall be sent to both the new address and to the former address.
1. A consumer reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or multiple consumer credit reporting agencies, and does not maintain a permanent database of credit information from which new consumer credit reports are produced. However, a consumer reporting agency acting as a reseller shall honor any security freeze placed on a consumer credit report by another consumer reporting agency;
2. A check services or fraud prevention services company, which issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments;
3. A deposit account information service company, which issues reports regarding account closures due to fraud, substantial overdrafts, ATM abuse, or similar negative information regarding a consumer, to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution; and
4. A consumer reporting agency’s database or file that consists of information concerning, and used for, one or more of the following: criminal record information, fraud prevention or detection, personal loss history information, and employment, tenant, or background screening.
P. At any time a consumer is required to receive a summary of rights required under 15 U.S.C. § 1681g(d), the following notice shall be included:”Virginia Consumers Have the Right to Obtain a Security Freeze.You have a right to place a “security freeze” on your credit report, which will prohibit a consumer reporting agency from releasing information in your credit report without your express authorization. A security freeze must be requested in writing by certified mail. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, government services or payments, rental housing, employment, investment, license, cellular phone, utilities, digital signature, Internet credit card transaction, or other services, including an extension of credit at point of sale. When you place a security freeze on your credit report, you will be provided a personal identification number or password to use if you choose to remove the freeze on your credit report or authorize the release of your credit report for a period of time or for a specific party after the freeze is in place. To provide that authorization you must contact the consumer reporting agency and provide all of the following:
3. The proper information regarding the period of time or the specific party for which the report shall be available.A consumer reporting agency must authorize the release of your credit report no later than three business days after receiving the above information. A consumer credit reporting agency must authorize the release of your credit report no later than 15 minutes after receiving the request.A security freeze does not apply to a person or entity, or its affiliates, or collection agencies acting on behalf of the person or entity, with which you have an existing account, that requests information in your credit report for the purposes of reviewing or collecting the account. Reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.You have a right to bring civil action against anyone, including a consumer reporting agency, who improperly obtains access to a file, knowingly or willfully misuses file data, or fails to correct inaccurate file data.Unless you are a victim of identity theft with a police report to verify the crimes, a consumer reporting agency has the right to charge you up to $ 10 to place a freeze on your credit report.”
Q. Any person who willfully fails to comply with any requirement imposed under this section or § 59.1-444.3 with respect to any consumer is liable to that consumer in an amount equal to the sum of:
R. Any person who obtains a consumer report, requests a security freeze, requests the temporary lift of a freeze, or the removal of a security freeze from a consumer reporting agency under false pretenses or in an attempt to violate federal or state law shall be liable to the consumer reporting agency for actual damages sustained by the consumer reporting agency or $ 1,000, whichever is greater.
T. Upon a finding by the court that an unsuccessful pleading, motion, or other paper filed in connection with an action under this section was filed in bad faith or for purposes of harassment, the court shall award to the prevailing party attorney fees reasonable in relation to the work expended in responding to the pleading, motion, or other paper.
1. The exclusive authority to bring an action for any violation of subdivision F 1 b shall be with the Attorney General. In any action brought under this subsection, the Attorney General may cause an action to be brought in the name of the Commonwealth to enjoin the violation and to recover damages for aggrieved consumers consistent with the limits stated in subsections Q and S for such violations.
2. In any action brought under this subsection, if the court finds a willful violation, the court may, in its discretion, also award a civil penalty of not more than $ 1,000 per violation, to be deposited in the Literary Fund of the Commonwealth.
2008, cc. 480, 496; 2009, c. 406; 2014, c. 570.