2023 New York Laws › GBS - General Business › Article 25 - Fair Credit Reporting Act › 380-T - Security Freeze.

§ 380-t.  Security  freeze. (a) A consumer may request that a security
freeze be placed on his or her  consumer  credit  report  by  sending  a
request  in  writing  with  confirmation  of  delivery  requested or via
telephone, secure electronic means, or other methods  developed  by  the
consumer  credit  reporting agency to a consumer credit reporting agency
at an address, telephone number or secure  website  designated  by  such
agency  to  receive  such  requests.  Consumer credit reporting agencies
shall have a secure website and a separately dedicated toll-free  number
to  offer  information,  to  process  requests  and deliver the services
provided for under this section.
(b) A consumer credit reporting agency that receives from a consumer a
request in accordance  with  subdivision  (a)  of  this  section  shall,
provided  such  request is accompanied by proper identification, place a
security freeze on the consumer credit report of  or  relating  to  such
consumer  no later than four business days after receiving such request,
provided further, however,  that  for  requests  received  on  or  after
January  first, two thousand nine, such consumer credit reporting agency
shall place a security freeze  on  the  consumer  credit  report  of  or
relating  to  such  consumer  no  later  than  three business days after
receiving such request and for requests received  on  or  after  January
first,  two  thousand  ten,  such consumer credit reporting agency shall
place a security freeze on the consumer credit report of or relating  to
such  consumer  no  later  than  one  business  day after receiving such
request. Nothing in this subdivision shall be  construed  to  prevent  a
consumer  credit  reporting  agency  from  advising a third party that a
security freeze is in effect with respect to the consumer credit  report
of  or  relating  to  such consumer. No consumer credit reporting agency
shall advise in any manner a third party, of the fact that the  consumer
requesting  the freeze is alleging to be the victim of domestic violence
or identity theft, without the written authorization of the consumer.
(c)  The  consumer  credit  reporting  agency  shall  send  a  written
confirmation  of  the  placement  of  a  security freeze to the consumer
within five business days of  placing  such  freeze.  Upon  placing  the
security  freeze  on  the  consumer credit report of or relating to such
consumer,  the  consumer  credit  reporting  agency  shall  provide  the
consumer  with  a  unique personal identification number or password, or
other device which shall only be used by  the  consumer  when  providing
authorization for the release of his or her consumer credit report for a
specific   party  or  specific  period  of  time.  The  unique  personal
identification number or password, or other device to  be  used  by  the
consumer  shall  not be a social security number or a sequential portion
thereof. Any  use  of  the  unique  personal  identification  number  or
password  or  other  device  other  than provided for in this section is
prohibited.
(d) If the consumer wishes to allow his or her consumer credit  report
to be accessed for a specific party or a specific period of time while a
freeze  is  in  place,  he  or  she  shall  contact  the consumer credit
reporting agency via mail  with  confirmation  of  delivery,  telephone,
secure  electronic  means  or  other  method  developed by such consumer
credit reporting agency pursuant to  subdivision  (f)  of  this  section
using  a  point  of contact designated by such consumer credit reporting
agency, request that the freeze be temporarily lifted, and  provide  the
following:
(1) proper identification;
(2)  the unique personal identification number or password provided by
the consumer credit reporting agency pursuant to subdivision (c) of this
section; and
(3) the proper information regarding the party to which  the  consumer
credit  report  should  be  available  or  the time period for which the
consumer credit report shall be available to users of such report.
(e)  (1)  A  consumer  credit reporting agency that receives a request
from a consumer to temporarily lift a freeze on a consumer credit report
pursuant to subdivision (d) of  this  section,  shall  comply  with  the
request:  (i)  no  later  than  three business days after receiving such
request; (ii) as of September  first,  two  thousand  nine,  a  consumer
credit  reporting  agency  that  receives  a  request  via  the use of a
telephone or secure electronic method provided by the  agency,  pursuant
to  subdivision  (d)  of this section, shall release a consumer's credit
report as requested by the consumer within  fifteen  minutes  after  the
request is received by the consumer credit reporting agency.
(2)  A consumer credit reporting agency is not required to temporarily
lift a security freeze within the time provided in subparagraph (ii)  of
paragraph one of this subdivision if:
(i)  the consumer fails to meet the requirements of subdivision (b) of
this section; or
(ii) the consumer credit reporting  agency's  ability  to  temporarily
lift the security freeze within fifteen minutes is prevented by:
(A) an act of God, including fire, earthquakes, hurricanes, storms, or
similar natural disaster or phenomena;
(B)   unauthorized  or  illegal  acts  by  a  third  party,  including
terrorism,  sabotage,  riot,  vandalism,  labor  strikes   or   disputes
disrupting operations, or similar occurrence;
(C)    operational   interruption,   including   electrical   failure,
unanticipated delay in equipment or replacement part delivery,  computer
hardware  or  software  failures  inhibiting  response  time, or similar
disruption;
(D) governmental action, including emergency  orders  or  regulations,
judicial or law enforcement action, or similar directives;
(E) regularly scheduled maintenance, during other than normal business
hours, of, or updates to, the consumer reporting agency's systems; or
(F) commercially reasonable maintenance of, or repair to, the consumer
reporting agency's systems that is unexpected or unscheduled.
(f)   A  consumer  credit  reporting  agency  may  develop  procedures
involving other secure methods of communication, including  the  use  of
the internet, or other electronic media to receive and process a request
from a consumer to temporarily lift a freeze on a consumer credit report
pursuant to subdivision (d) of this section in an expedited manner.
(g)  The  department  of  state  shall monitor the state of technology
relating to the means available to process requests for the  lifting  or
removal  of  a security freeze, and shall report to the legislature when
it is determined that the technology to process requests for the lifting
or removal of a security freeze in a shorter period of  time  than  that
set forth in subdivision (e) of this section is available.
(h)  A  consumer  credit  reporting agency shall remove or temporarily
lift a freeze placed on the consumer credit report of or relating  to  a
consumer only in the following cases:
(1)  upon consumer request, pursuant to subdivision (d) or (k) of this
section; or
(2) if the consumer credit report of or relating to such consumer  was
frozen due to a material misrepresentation of fact by the consumer. If a
consumer  credit  reporting  agency  intends  to  remove a freeze upon a
consumer credit report pursuant to this paragraph, the  consumer  credit
reporting  agency  shall  notify the consumer in writing, by first class
mail, within three business days prior to removing the  freeze  on  such
consumer credit report.
(i)  If  a  third party requests access to a consumer credit report on
which a security freeze is in effect, and this request is in  connection
with  an  application for credit or any other use, and the consumer does
not allow his or her consumer credit report  to  be  accessed  for  that
period of time, the third party may treat the application as incomplete.
(j)  If  a  consumer  requests  a security freeze, the consumer credit
reporting agency shall disclose the process of placing  and  temporarily
lifting  a  freeze,  and  the process for allowing access to information
from such consumer credit report for a specific party  or  a  period  of
time while the freeze is in place.
(k)  (1)  A  security  freeze shall remain in place until the consumer
requests, using a point of contact designated  by  the  consumer  credit
reporting  agency,  that the security freeze be removed and provides the
following:
(i) proper identification; and
(ii) the unique personal identification number or password or  similar
device  provided  by  the  consumer  credit reporting agency pursuant to
subdivision (c) of this section.
(2) A consumer credit reporting agency shall remove a security  freeze
within  three  business days of receiving a request for removal from the
consumer pursuant to paragraph one of this subdivision.
(l)  A  consumer  credit  reporting  agency   shall   require   proper
identification  of  the  person  making  a  request to place or remove a
security freeze.
(m) The provisions of this section do  not  apply  to  the  use  of  a
consumer credit report by any of the following:
(1)  a  person or entity, or a subsidiary, affiliate, or agent of that
person or entity, or an assignee of a financial obligation owing by  the
consumer  to  that  person  or  entity,  or  a prospective assignee of a
financial obligation owing by the consumer to that person or  entity  in
conjunction with the proposed purchase of the financial obligation, with
which  the  consumer  has  or  had  prior  to  assignment  an account or
contract, including a demand deposit account, or to  whom  the  consumer
issued  a  negotiable  instrument,  for  the  purposes  of reviewing the
account or collecting the financial obligation owing  for  the  account,
contract,  or  negotiable  instrument.  For  purposes of this paragraph,
"reviewing  the  account"  includes  activities   related   to   account
maintenance, monitoring, credit line increases, and account upgrades and
enhancements;
(2)  a subsidiary, affiliate, agent, assignee, or prospective assignee
of a person to whom access has been granted for purposes of facilitating
the extension of credit or other permissible use;
(3) any state or local agency, law enforcement agency, court,  private
collection  agency, or person acting pursuant to a court order, warrant,
or subpoena;
(4) a child support agency acting pursuant to title iv-d of the social
security act (42 U.S.C. et seq.);
(5) the state or its political subdivisions or its agents  or  assigns
acting  to  investigate  fraud  or  acting  to  investigate  or  collect
delinquent taxes or unpaid court orders or to fulfill any of  its  other
statutory responsibilities provided such responsibilities are consistent
with a permissible purpose under 15 U.S.C. section 1681b;
(6)  the use of credit information for the purposes of prescreening as
provided for by the federal fair credit reporting act;
(7) any person  or  entity  administering  a  credit  file  monitoring
subscription or similar service to which the consumer has subscribed; or
(8)  any person or entity for the purpose of providing a consumer with
a copy of his or her consumer credit report or score upon the request of
such consumer.
(n)  No  consumer  credit  reporting  agency shall charge a fee to any
consumer for the placement of any security freeze, the  removal  of  any
security  freeze,  the  temporary  lift  of  any  security  freeze for a
specific party or period of time, or the  issuance  of  any  replacement
personal  identification  number  or password when the consumer fails to
retain the personal identification number or password provided  to  such
consumer   by   such   consumer  credit  reporting  agency  pursuant  to
subdivision (c) of this section.
(3)(i) Upon a breach of the security  of  the  system  of  a  consumer
credit  reporting agency which includes any social security number, such
agency shall offer to each consumer, whose information, including social
security number, was breached or is reasonably  believed  to  have  been
breached,   reasonable   identity  theft  prevention  services  and,  if
applicable, identify theft mitigation  services  for  a  period  not  to
exceed  five  years  at  no  cost  to  such consumers. Such agency shall
provide all information necessary for such consumers to enroll  in  such
services and shall include information on how such consumers can request
a  security  freeze.  A  consumer  credit  reporting agency shall not be
required to offer such services if, after an appropriate  investigation,
the agency reasonably determines that the breach of security is unlikely
to result in harm to the consumers whose information has been breached.
(ii)  "Breach of the security of the system" as used in this paragraph
shall have the same definition as in paragraph (c) of subdivision one of
section eight hundred ninety-nine-aa of this chapter.
(o) If a security freeze is in  place,  a  consumer  credit  reporting
agency  shall  not change any of the following official information in a
consumer credit report without sending a  written  confirmation  of  the
change  to the consumer within thirty days of the change being posted to
the file of or relating to such consumer: name, date  of  birth,  social
security  number,  and address. Written confirmation is not required for
technical modifications of the official information of  or  relating  to
such   consumer,  including  name  and  street  abbreviations,  complete
spellings, or transposition of numbers or letters. In  the  case  of  an
address  change,  the written confirmation shall be sent to both the new
address and to the former address.
(p) The following entities are not required to place a security freeze
on a consumer credit report:
(1) a consumer credit reporting agency that acts only as a reseller of
credit information by assembling and merging  information  contained  in
the  data  base  of another consumer credit reporting agency or multiple
consumer credit reporting agencies, and does not  maintain  a  permanent
data  base  of credit information from which new consumer credit reports
are produced. However, a consumer credit reporting agency  acting  as  a
reseller  shall  honor  any  security freeze placed on a consumer credit
report by another consumer credit reporting agency;
(2) a check services  or  fraud  prevention  services  company,  which
issues  reports  on incidents of fraud or authorizations for the purpose
of approving or  processing  negotiable  instruments,  electronic  funds
transfers, or similar methods of payments; or
(3)  a  deposit  account  information  service  company,  which issues
reports regarding account closures due to fraud, substantial overdrafts,
ATM abuse, or similar negative  information  regarding  a  consumer,  to
inquiring  banks  or  other  financial  institutions  for  use  only  in
reviewing a consumer request for a deposit account at the inquiring bank
or financial institution.
(q) (1) Any time a consumer credit reporting  agency  is  required  to
send  a  summary  of rights required under 15 U.S.C. section 1681g, to a
consumer residing in this state the following notice shall  be  included
with such summary of rights:
"NEW YORK CONSUMERS HAVE THE RIGHT TO OBTAIN A SECURITY FREEZE.
YOU  HAVE  A RIGHT TO PLACE A "SECURITY FREEZE" ON YOUR CREDIT REPORT,
WHICH WILL PROHIBIT A CONSUMER CREDIT REPORTING  AGENCY  FROM  RELEASING
INFORMATION  IN YOUR CREDIT REPORT WITHOUT YOUR EXPRESS AUTHORIZATION. A
CONSUMER CREDIT REPORTING AGENCY IS PROHIBITED FROM CHARGING YOU  A  FEE
FOR  THE  PLACEMENT, REMOVAL, OR TEMPORARY LIFT OF A SECURITY FREEZE, OR
FOR THE ISSUANCE OF A REPLACEMENT PERSONAL IDENTIFICATION  NUMBER  (PIN)
OR  PASSWORD  IN  THE  EVENT THAT YOU FAIL TO RETAIN THE ORIGINAL PIN OR
PASSWORD PROVIDED TO YOU BY SUCH CONSUMER  CREDIT  REPORTING  AGENCY.  A
SECURITY  FREEZE  MUST  BE  REQUESTED  IN  WRITING DELIVERY CONFIRMATION
REQUESTED OR VIA TELEPHONE, SECURE ELECTRONIC MEANS,  OR  OTHER  METHODS
DEVELOPED  BY  THE CONSUMER CREDIT REPORTING AGENCY. THE SECURITY FREEZE
IS DESIGNED TO PREVENT CREDIT, LOANS, AND SERVICES FROM  BEING  APPROVED
IN  YOUR  NAME  WITHOUT  YOUR CONSENT. HOWEVER, YOU SHOULD BE AWARE THAT
USING A SECURITY FREEZE TO TAKE CONTROL OVER  WHO  GETS  ACCESS  TO  THE
PERSONAL  AND  FINANCIAL  INFORMATION  IN  YOUR CREDIT REPORT MAY DELAY,
INTERFERE WITH, OR  PROHIBIT  THE  TIMELY  APPROVAL  OF  ANY  SUBSEQUENT
REQUEST  OR APPLICATION YOU MAKE REGARDING A NEW LOAN, CREDIT, MORTGAGE,
GOVERNMENT SERVICES OR PAYMENTS, INSURANCE, RENTAL HOUSING,  EMPLOYMENT,
INVESTMENT,  LICENSE,  CELLULAR  PHONE,  UTILITIES,  DIGITAL  SIGNATURE,
INTERNET CREDIT  CARD  TRANSACTION,  OR  OTHER  SERVICES,  INCLUDING  AN
EXTENSION  OF  CREDIT AT POINT OF SALE. WHEN YOU PLACE A SECURITY FREEZE
ON YOUR CREDIT REPORT, YOU WILL BE PROVIDED  A  PERSONAL  IDENTIFICATION
NUMBER  OR  PASSWORD  TO  USE IF YOU CHOOSE TO REMOVE THE FREEZE ON YOUR
CREDIT REPORT OR AUTHORIZE THE  RELEASE  OF  YOUR  CREDIT  REPORT  TO  A
SPECIFIC  PARTY OR FOR A PERIOD OF TIME AFTER THE FREEZE IS IN PLACE. TO
PROVIDE  THAT  AUTHORIZATION  YOU  MUST  CONTACT  THE  CONSUMER   CREDIT
REPORTING AGENCY AND PROVIDE ALL OF THE FOLLOWING:
(1) THE PERSONAL IDENTIFICATION NUMBER OR PASSWORD;
(2) PROPER IDENTIFICATION TO VERIFY YOUR IDENTITY; AND
(3)  THE  PROPER INFORMATION REGARDING THE PARTY OR PARTIES WHO ARE TO
RECEIVE THE CREDIT REPORT OR THE PERIOD OF TIME  FOR  WHICH  THE  REPORT
SHALL BE AVAILABLE TO USERS OF THE CREDIT REPORT.
A  CONSUMER CREDIT REPORTING AGENCY MUST AUTHORIZE THE RELEASE OF YOUR
CREDIT REPORT NO LATER THAN THREE  BUSINESS  DAYS  AFTER  RECEIVING  THE
ABOVE  INFORMATION.  EFFECTIVE  SEPTEMBER  FIRST,  TWO  THOUSAND NINE, A
CONSUMER CREDIT REPORTING AGENCY THAT RECEIVES A REQUEST  VIA  TELEPHONE
OR  SECURE  ELECTRONIC  METHOD  SHALL RELEASE A CONSUMER'S CREDIT REPORT
WITHIN FIFTEEN MINUTES WHEN THE REQUEST IS RECEIVED.
A SECURITY FREEZE DOES NOT APPLY TO CIRCUMSTANCES IN WHICH YOU HAVE AN
EXISTING ACCOUNT RELATIONSHIP AND A COPY OF YOUR REPORT IS REQUESTED  BY
YOUR  EXISTING CREDITOR OR ITS AGENTS OR AFFILIATES FOR CERTAIN TYPES OF
ACCOUNT REVIEW, COLLECTION, FRAUD CONTROL OR SIMILAR ACTIVITIES.
IF YOU ARE ACTIVELY SEEKING CREDIT, YOU  SHOULD  UNDERSTAND  THAT  THE
PROCEDURES   INVOLVED  IN  LIFTING  A  SECURITY  FREEZE  MAY  SLOW  YOUR
APPLICATION FOR CREDIT. YOU SHOULD PLAN AHEAD AND LIFT A FREEZE,  EITHER
COMPLETELY  IF  YOU  ARE  SHOPPING AROUND, OR SPECIFICALLY FOR A CERTAIN
CREDITOR, BEFORE  APPLYING  FOR  NEW  CREDIT.  WHEN  SEEKING  CREDIT  OR
PURSUING  ANOTHER TRANSACTION REQUIRING ACCESS TO YOUR CREDIT REPORT, IT
IS NOT NECESSARY TO RELINQUISH YOUR PIN OR PASSWORD TO THE  CREDITOR  OR
BUSINESS; YOU CAN CONTACT THE CONSUMER CREDIT REPORTING AGENCY DIRECTLY.
IF  YOU  CHOOSE  TO  GIVE  OUT  YOUR  PIN OR PASSWORD TO THE CREDITOR OR
BUSINESS, IT IS RECOMMENDED THAT YOU OBTAIN A NEW PIN OR  PASSWORD  FROM
THE CONSUMER CREDIT REPORTING AGENCY."
(2)  If  a consumer requests information about a security freeze, such
consumer shall be provided with the notice set forth in paragraph one of
this subdivision and with any  other  information  necessary  to  place,
temporarily  lift  or  permanently lift a security freeze, including but
not  limited  to  the  address,  telephone number or point of contact at
which the consumer credit reporting agency receives such requests.
(r) When a consumer credit reporting  agency  erroneously  releases  a
consumer  credit  report subject to a security freeze or any information
contained in such consumer credit report, the consumer credit  reporting
agency  shall  send written notification to the affected consumer within
three  business  days  following  discovery  or  notification  of   such
erroneous  release.  Such notification shall also inform the consumer of
the nature of the information released and identify and provide  contact
information  for  the  recipient  of such information or consumer credit
report.
(s) Whenever there shall be a violation of this  section,  application
may  be  made  by  the attorney general in the name of the people of the
state of New York to a court or justice having jurisdiction by a special
proceeding to issue an injunction, and upon notice to the  defendant  of
not  less than five days, to enjoin and restrain the continuance of such
violations; and if it shall appear to the satisfaction of the  court  or
justice  that  the  defendant  has,  in  fact, violated this section, an
injunction may be  issued  by  such  court  or  justice,  enjoining  and
restraining  any  further  violation,  without  requiring proof that any
person has, in fact, been  injured  or  damaged  thereby.  In  any  such
proceeding,  the  court  may  make allowances to the attorney general as
provided in paragraph six of subdivision  (a)  of  section  eighty-three
hundred   three  of  the  civil  practice  law  and  rules,  and  direct
restitution. Whenever the court shall determine that a violation of this
section has occurred, the court may impose a civil penalty of  not  more
than  five  thousand  dollars for each violation. In connection with any
such proposed application, the attorney general is  authorized  to  take
proof  and  make  a  determination  of  the  relevant facts and to issue
subpoenas in accordance with the civil practice law and rules.