(a) (1) In this section the following words have the meanings indicated.

(2) “Department” means the Department of Human Services.

(3) “Foster care” has the meaning stated in § 5-501(c) of the Family Law Article.

(4) “Local department” means:

(i) A local department of social services created or continued in a county of the State or in Baltimore City under § 3-201 of the Human Services Article; or

(ii) In Montgomery County, the Montgomery County Department of Health and Human Services.

(5) “Protected consumer” means an individual who:

(i) Is in the custody of a local department; and

(ii) Has been placed in a foster care setting.

(6) “Record” means a compilation of information that:

(i) Identifies a protected consumer;

(ii) Is created by a consumer reporting agency solely for the purpose of complying with this section; and

(iii) May not be created or used to consider the protected consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living for any purpose listed in § 14-1201(e)(1) of this subtitle.

(7) (i) “Representative” means a person who provides to a consumer reporting agency sufficient proof of authority to act on behalf of a protected consumer.

(ii) “Representative” includes a local department.

(8) “Security freeze” means:

(i) If a consumer reporting agency does not have a file pertaining to a protected consumer, a restriction that:

1. Is placed on the protected consumer’s record in accordance with this section; and

2. Prohibits the consumer reporting agency from releasing the protected consumer’s record except as provided in this section; or

(ii) If a consumer reporting agency has a file pertaining to the protected consumer, a restriction that:

1. Is placed on the protected consumer’s consumer report in accordance with this section; and

2. Prohibits the consumer reporting agency from releasing the protected consumer’s consumer report or any information derived from the protected consumer’s consumer report except as provided in this section.

(9) (i) “Sufficient proof of identification” means information or documentation that identifies a protected consumer or a representative of a protected consumer.

(ii) “Sufficient proof of identification” includes:

1. A Social Security number or a copy of a Social Security card issued by the Social Security Administration;

2. A certified or official copy of a birth certificate issued by the entity authorized to issue the birth certificate;

3. A copy of a driver’s license, an identification card issued by the Motor Vehicle Administration, or any other government-issued identification; or

4. A copy of a bill, including a bill for telephone, sewer, septic tank, water, electric, oil, or natural gas services, that shows a name and home address.

(b) This section does not apply to the use of a protected consumer’s consumer report or record by:

(1) A person administering a credit file monitoring subscription service to which:

(i) The protected consumer has subscribed; or

(ii) The representative of the protected consumer has subscribed on behalf of the protected consumer;

(2) A person providing the protected consumer or the protected consumer’s representative a copy of the protected consumer’s consumer report on request of the protected consumer or the protected consumer’s representative; or

(3) An entity listed in § 14-1212.1(b)(2)(i) or (ii) or (c)(5) of this subtitle.

(c) (1) A consumer reporting agency shall place a security freeze for a protected consumer if the consumer reporting agency receives a request from the Department for the placement of the security freeze as provided in subsection (j) of this section.

(2) The Department shall submit the request to the consumer reporting agency by electronic transmission to the electronic mail address or other point of contact in the manner specified by the consumer reporting agency.

(3) If a consumer reporting agency does not have a file pertaining to a protected consumer when the consumer reporting agency receives a request under subsection (j) of this section, the consumer reporting agency shall create a record for the protected consumer.

(4) If a consumer reporting agency has a file pertaining to a protected consumer, the local department shall act as the protected consumer’s representative to resolve any issues with the file.

(d) Within 30 days after receiving a request that meets the requirements of subsection (c) of this section, a consumer reporting agency shall place a security freeze for the protected consumer.

(e) Unless a security freeze for a protected consumer is removed in accordance with subsection (g) or (k) of this section, a consumer reporting agency may not release the protected consumer’s consumer report, any information derived from the protected consumer’s consumer report, or any record created for the protected consumer.

(f) A security freeze for a protected consumer placed under subsection (d) of this section shall remain in effect until:

(1) The protected consumer or the Department requests the consumer reporting agency to remove the security freeze in accordance with subsection (g) of this section; or

(2) The security freeze is removed in accordance with subsection (k) of this section.

(g) If a protected consumer or the Department wishes to remove a security freeze for the protected consumer, the protected consumer or the Department shall:

(1) Submit a request for the removal of the security freeze to the consumer reporting agency at the address or other point of contact in the manner specified by the consumer reporting agency; and

(2) Provide to the consumer reporting agency:

(i) In the case of a request by the protected consumer:

1. Proof that the authority of the Department to act on behalf of the protected consumer is no longer valid; and

2. Sufficient proof of identification of the protected consumer; or

(ii) In the case of a request by the Department, sufficient proof of identification of the protected consumer.

(h) Within 30 days after receiving a request that meets the requirements of subsection (g) of this section, the consumer reporting agency shall remove the security freeze for the protected consumer.

(i) A consumer reporting agency may not charge a fee for any service performed under this section.

(j) (1) At least annually, the Department shall send to each consumer reporting agency by electronic transmission a list of children who are in the custody of a local department and have been placed in a foster care setting for the first time.

(2) The Department shall request a security freeze for each child on the list specified under paragraph (1) of this subsection on behalf of the protected consumer.

(3) The Department may enter into an agreement with a consumer reporting agency concerning the transmission of information between the Department and a consumer reporting agency to facilitate the implementation of this subsection.

(k) A consumer reporting agency may remove a security freeze for a protected consumer or delete a record of a protected consumer if the security freeze was placed or the record was created based on a material misrepresentation of fact by the protected consumer or the protected consumer’s representative.

(l) Notwithstanding any other provision of law, the exclusive remedy for a violation of this section shall be a complaint filed with the Commissioner under § 14-1225 of this subtitle.

(m) (1) On the entry of an order for the adoption of a child who was in the custody of a local department under Title 5 of the Family Law Article, the Department shall provide notice to the adoptive parent of the provisions of § 14-1212.2 of this subtitle relating to the authority of the adoptive parent to request a security freeze by consumer reporting agencies.

(2) The Department shall notify a protected consumer who becomes an adult of the provisions of § 14-1212.2 of this subtitle, including providing contact information of organizations that may provide assistance to the protected consumer in removing a security freeze.