Consumer complaint: My sensitive personal data was released as part of a data breach at XXXX XXXX XXXX , XXXX ; its servers stored data for XXXX XXXX ; the breach was discovered on XXXX/XXXX/XXXX. 

As a resident of the State of Nevada who satisfied the statutory criterion pursuant to NRS 205.4651 ( 1 ) ( a ), I am defined to be a " victim of identity theft ''. Pursuant to NRS 598C.300 ( 1 ), I requested to have a security freeze placed in my files with the consumer reporting agencies ( CRAs ), including TransUnion , LLC ( " TransUnion '' ). Additionally, I sought to have the security freeze placed without charge, pursuant to NRS 598C.320 ( 2 ) ( b ). 

Each CRAs honored my request with the exception of TransUnion. I received a letter from it, dated XXXX/XXXX/XXXX, which stated, " in order to receive your Security Freeze, you must supply our office with a copy of a Law Enforcement report alleging identity theft that has been filed with your local law enforcement department ... '' I contacted TransUnion by telephone on XXXX/XXXX/XXXX to discuss the issue. During my conversation with XXXX different representatives, including XXXX in the Special Handling Department, I made the following points : 1 ) It is not possible to provide a report of identity theft filed with my local law enforcement department, the reason being that as part of filing a report, my local law enforcement department, the City of XXXX Police Department, requires, " this incident occurred within the XXXX City limits. If you live within the City of XXXX but the incident occurred outside the City of XXXX, please file a report with the jurisdiction where the incident occurred. '' 2 ) Since the crime had been perpetrated by entities unknown to me and since the companies involved in the data breach are both headquartered in states other than Nevada, then reporting of my incident of identity theft falls under the jurisdiction of the Federal Bureau of Investigation ( FBI ). As such, on XXXX/XXXX/XXXX, I contacted the FBI 's Internet Crime Complaint Center ( IC3 ) and, providing the facts of the case, submitted a complaint using the Center 's complaint referral form ( Complaint ID # XXXX ) and receiving a copy of my complaint by e-mail. Additionally, on XXXX/XXXX/XXXX, I contacted the Federal Trade Commission ( FTC ) and, providing the facts of the case, submitted a complaint using the FTC Complaint Assistant ( Reference # XXXX ) and retaining a copy of such. 

3 ) As part of my request to have a security freeze placed in my TransUnion file at no fee, I included a valid, completed, and notarized copy of my Identity Theft Victim 's Complaint and Affidavit form, furnished proof of my identity and residence, copies of the reports ( and report numbers ) for the complaints I had filed, as well as additional documentation. 

4 ) The governing law, the Nevada Revised Statutes, in particular NRS 598C.320 ( 2 ) ( b ) stipulates that I need only provide a " valid copy '' of a " complaint ... filed with a law enforcement agency '', not a " local agency ''. Since my complaints were filed with the FBI and the FTC, both federal law enforcement agencies, and since I provided TransUnion with valid copies of the complaints, then my request satisfied NRS 598C.320 ( 2 ) ( b ), prohibiting TransUnion from charging a fee. 

5 ) By not having placed the security freeze on my file not later than 5 business days after receiving my request and by demanding that I pay a fee so to do, TransUnion is in violation of NRS 598C.300 ( 2 ), NRS 598C.300 ( 3 ) ( a ), NRS 598C.300 ( 3 ) ( b ), NRS 598C.300 ( 3 ) ( c ), and NRS 598C.320 ( 2 ) ( b ). 

Nevertheless, at the conclusion of the telephone conversations, I was advised that my choices were to either pay a {$10.00} fee to place the security freeze, violating NRS 598C.320 ( 2 ) ( b ) or qualify for a no fee security freeze by filing a report with a local law enforcement agency, an act which is both not required under NRS 598C.320 ( 2 ) ( b ) and impossible for me to do. 

Company response: Company has responded to the consumer and the CFPB and chooses not to provide a public response