(a) A consumer reporting agency shall place a security freeze for a protected consumer if the consumer reporting agency receives a request from the protected consumer’s representative for the placement of the security freeze and the protected consumer’s representative:

(1) Submits the request to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency;

(2) provides to the consumer reporting agency sufficient proof of identification of the protected consumer and the representative; and

(3) provides to the consumer reporting agency sufficient proof of authority to act on behalf of the protected consumer.

(b) If a consumer reporting agency does not have a record pertaining to a protected consumer when the consumer reporting agency receives a request under subsection (a), the consumer reporting agency shall create a record for the protected consumer.

(c) Within 30 days after receiving a request that meets the requirements of subsection (a), a consumer reporting agency shall place a security freeze for the protected consumer.

(d) Unless a security freeze for a protected consumer is removed in accordance with subsection (f) or (i), a consumer reporting agency shall not release the protected consumer’s consumer report, any information derived from the protected consumer’s consumer report, or any record created for the protected consumer.

(e) A security freeze for a protected consumer placed under subsection (c) shall remain in effect until:

(1) The protected consumer or the protected consumer’s representative requests the consumer reporting agency to remove the security freeze in accordance with subsection (f); or

(2) the security freeze is removed in accordance with subsection (i).

(f) If a protected consumer or a protected consumer’s representative wishes to remove a security freeze for a protected consumer, the protected consumer or the protected consumer’s representative shall:

(1) Submit a request for the removal of the security freeze to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency; and

(2) provide to the consumer reporting agency sufficient proof of identification of the protected consumer and:

(A) For a request by the protected consumer, proof that the sufficient proof of authority for the protected consumer’s representative to act on behalf of the protected consumer is no longer valid; or

(B) for a request by the representative of a protected consumer, sufficient proof of identification of the representative and sufficient proof of authority to act on behalf of the protected consumer.

(g) A consumer reporting agency shall not charge a fee for any service performed under this section.

(h) This section shall not apply to:

(1) A person administering a credit file monitoring subscription service to which the protected consumer has subscribed or the representative of the protected consumer has subscribed on behalf of the protected consumer;

(2) a person providing the protected consumer or the protected consumer’s representative with a copy of the protected consumer’s consumer report on request of the protected consumer or the protected consumer’s representative; or

(3) a person or entity listed in Kan. Stat. Ann. 2023 Supp. 50-723(i)(1) and (6) through (12) or 50-724(a)(1) through (5), and amendments thereto.

(i) A consumer reporting agency may remove a security freeze for a protected consumer or delete a record of a protected consumer if such security freeze was placed or the record was created based on a material misrepresentation of a fact by the protected consumer or the protected consumer’s representative.

(j) Any person who fails to comply with any requirement imposed under this section with respect to any protected consumer shall be liable pursuant to the provisions of the fair credit reporting act.

(k) This section shall be part of and supplemental to the fair credit reporting act.