(a) (1) In this section the following words have the meanings indicated.

(2) “Account review” includes activities related to account maintenance, account monitoring, credit line increases, and account upgrades and enhancements.

(3) “Security freeze” means a restriction placed on a consumer’s consumer report at the request of the consumer that prohibits a consumer reporting agency from releasing the consumer’s consumer report or any information derived from the consumer’s consumer report without the express authorization of the consumer.

(b) (1) This section does not apply to the use of a consumer’s consumer report by:

(i) A person, or a subsidiary, affiliate, agent, or assignee of the person, with which the consumer has, or prior to assignment had, an account, contract, or debtor-creditor relationship, for the purpose of account review or collecting the financial obligation owing for the account, contract, or debt;

(ii) A person that was given access to the consumer’s consumer report under subsection (e) of this section for the purpose of facilitating an extension of credit to the consumer or another permissible use;

(iii) A person acting in accordance with a court order, warrant, or subpoena;

(iv) A unit of State or local government that administers a program for establishing and enforcing child support obligations;

(v) The Maryland Department of Health in connection with a fraud investigation conducted by the Department;

(vi) The State Department of Assessments and Taxation, the Comptroller, or any other State or local taxing authority in connection with:

1. An investigation conducted by the Department, Comptroller, or taxing authority;

2. The collection of delinquent taxes or unpaid court orders by the Department, Comptroller, or taxing authority; or

3. The performance of any other duty provided for by law;

(vii) A person for the purpose of prescreening, as defined by the federal Fair Credit Reporting Act;

(viii) A person administering a credit file monitoring subscription service to which the consumer has subscribed;

(ix) A person providing a consumer with a copy of the consumer’s consumer report on request of the consumer; or

(x) To the extent not prohibited by other State law, a person only for the purpose of setting or adjusting an insurance rate, adjusting an insurance claim, or underwriting an insurance risk.

(2) This section does not apply to:

(i) A check services or fraud prevention services company that issues:

1. Reports on incidents of fraud; or

2. Authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar payment methods;

(ii) A deposit account information service company that issues reports regarding account closures due to fraud, substantial overdrafts, automated teller machine abuse, or similar negative information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution; or

(iii) A consumer reporting agency database or file that consists entirely of consumer information concerning, and used solely for:

1. Criminal record information;

2. Personal loss history information;

3. Fraud prevention or detection;

4. Employment screening; or

5. Tenant screening.

(c) (1) A consumer may elect to place a security freeze on the consumer’s consumer report by:

(i) Written request sent by certified mail;

(ii) Subject to paragraph (6) of this subsection, telephone, by providing certain personal information that the consumer reporting agency may require to verify the identity of the consumer; or

(iii) An electronic request transmitted through a secure connection made available by the consumer reporting agency on the website of the consumer reporting agency.

(2) A consumer reporting agency shall require a consumer to provide proper identifying information when requesting a security freeze.

(3) Except as provided in paragraph (5) of this subsection, a consumer reporting agency shall place a security freeze on a consumer’s consumer report within 3 business days after receiving a request under paragraph (1) of this subsection.

(4) Within 5 business days after placing a security freeze on a consumer’s consumer report, the consumer reporting agency shall:

(i) Send a written confirmation of the security freeze to the consumer;

(ii) Provide the consumer with a unique personal identification number or password to be used by the consumer when authorizing the release of the consumer’s consumer report to a specific person or for a specific period of time; and

(iii) Provide the consumer with a written statement of the procedures for requesting the consumer reporting agency to remove or temporarily lift a security freeze.

(5) (i) Subject to subparagraph (ii) of this paragraph, a consumer reporting agency is not required to place a security freeze on a consumer report if the consumer reporting agency:

1. Acts only as a reseller of credit information by assembling and merging information contained in a database of another consumer reporting agency or multiple consumer reporting agencies; and

2. Does not maintain a permanent database of credit information from which new consumer reports are produced.

(ii) A consumer reporting agency that acts as a reseller of credit information shall honor a security freeze placed on a consumer report by another consumer reporting agency.

(6) (i) If a consumer requests placement of a security freeze by telephone under paragraph (1)(ii) of this subsection, the consumer reporting agency may require the consumer to confirm the request in writing on a form that the consumer reporting agency provides to the consumer with the materials sent in accordance with paragraph (4) of this subsection.

(ii) If the consumer fails to return written confirmation that the consumer reporting agency requires under subparagraph (i) of this paragraph, the consumer reporting agency may remove the security freeze in accordance with subsection (g)(2) of this section.

(7) (i) A consumer reporting agency shall develop procedures involving the use of secure connections to receive and process, in an expedited manner, an electronic request from a consumer to place a security freeze on the consumer’s consumer report.

(ii) A consumer reporting agency may develop additional secure electronic methods to comply with paragraph (1) of this subsection.

(d) (1) While a security freeze is in place, a consumer reporting agency may not release a consumer’s consumer report or any information derived from a consumer’s consumer report without the express prior authorization of the consumer.

(2) A consumer reporting agency may advise a person that a security freeze is in effect with respect to a consumer’s consumer report.

(3) A consumer reporting agency may not state or imply to any person that a security freeze on a consumer’s consumer report reflects a negative credit score, credit history, or credit rating.

(e) (1) If a consumer wants to temporarily lift a security freeze to allow the consumer’s consumer report to be accessed by a specific person or for a specific period of time while a security freeze is in place, the consumer shall:

(i) Contact the consumer reporting agency by:

1. Mail in the manner prescribed by the consumer reporting agency;

2. Telephone in the manner prescribed by the consumer reporting agency; or

3. An electronic request transmitted through a secure connection made available by the consumer reporting agency on the website of the consumer reporting agency;

(ii) Request that the security freeze be temporarily lifted; and

(iii) Provide the following to the consumer reporting agency:

1. Proper identifying information;

2. The unique personal identification number or password provided to the consumer under subsection (c)(4)(ii) of this section; and

3. The proper information regarding the person that is to receive the consumer report or the time period during which the consumer report is to be available to users of the consumer report.

(2) (i) Except as provided in subparagraph (ii) of this paragraph, a consumer reporting agency shall comply with a request made under paragraph (1) of this subsection within 3 business days after receiving the request.

(ii) 1. A consumer reporting agency shall comply with a request made under paragraph (1) of this subsection within 15 minutes after the consumer’s request is received by the consumer reporting agency if the request is made by telephone or by electronic request transmitted through a secure connection made available by the consumer reporting agency on the website of the consumer reporting agency.

2. A consumer reporting agency that is unable to temporarily lift a security freeze under subsubparagraph 1 of this subparagraph shall lift the security freeze as soon as it is reasonably capable of doing so.

(3) A consumer reporting agency shall develop procedures involving the use of secure connections to receive and process, in an expedited manner, an electronic request from a consumer to temporarily lift or remove a security freeze on the consumer’s consumer report.

(f) If, in connection with an application for credit or for any other use, a person requests access to a consumer’s consumer report while a security freeze is in place and the consumer does not authorize access to the consumer report, the person may treat the application as incomplete.

(g) (1) Except as provided in paragraph (2) of this subsection, a consumer reporting agency may remove or temporarily lift a security freeze placed on a consumer’s consumer report only on request of the consumer made under subsection (e) or (h) of this section.

(2) (i) A consumer reporting agency may remove a security freeze placed on a consumer’s consumer report if:

1. Placement of the security freeze was based on a material misrepresentation of fact by the consumer; or

2. The consumer:

A. Made the request to place the security freeze by telephone under subsection (c)(1)(ii) of this section; and

B. Failed to confirm the request in writing if required in accordance with subsection (c)(6) of this section.

(ii) If a consumer reporting agency intends to remove a security freeze under subparagraph (i) of this paragraph, the consumer reporting agency shall notify the consumer in writing of its intent at least 5 business days before removing the security freeze.

(h) (1) Subject to subsection (g)(2) of this section, a security freeze shall remain in place until the consumer requests that the security freeze be removed.

(2) If a consumer wants to remove a security freeze from the consumer’s consumer report, the consumer shall:

(i) Contact the consumer reporting agency by:

1. Mail in the manner prescribed by the consumer reporting agency;

2. Telephone in the manner prescribed by the consumer reporting agency; or

3. An electronic request transmitted through a secure connection made available by the consumer reporting agency on the website of the consumer reporting agency;

(ii) Request that the security freeze be removed; and

(iii) Provide the following to the consumer reporting agency:

1. Proper identifying information; and

2. The unique personal identification number or password provided by the consumer reporting agency under subsection (c)(4)(ii) of this section.

(3) A consumer reporting agency shall remove a security freeze within 3 business days after receiving a request for removal.

(4) A consumer reporting agency shall develop procedures involving the use of secure connections to receive and process, in an expedited manner, an electronic request from a consumer to remove a security freeze on the consumer’s consumer report.

(i) A consumer may not be charged for any service relating to a security freeze.

(j) At any time that a consumer is entitled to receive a summary of rights under § 609 of the federal Fair Credit Reporting Act or § 14-1206 of this subtitle, the following notice shall be included:

“NOTICE

You have a right, under § 14-1212.1 of the Commercial Law Article of the Annotated Code of Maryland, to place a security freeze on your credit report. The security freeze will prohibit a consumer reporting agency from releasing your credit report or any information derived from your credit report without your express authorization. The purpose of a security freeze is to prevent credit, loans, and services from being approved in your name without your consent. A consumer reporting agency may not charge you a fee for any service relating to a security freeze, including for any placement, temporary lift, or removal of a security freeze.

You may elect to have a consumer reporting agency place a security freeze on your credit report by written request sent by certified mail or by electronic mail or the Internet if the consumer reporting agency provides a secure electronic connection. The consumer reporting agency must place a security freeze on your credit report within 3 business days after your request is received. Within 5 business days after a security freeze is placed on your credit report, you will be provided with a unique personal identification number or password to use if you want to remove the security freeze or temporarily lift the security freeze to release your credit report to a specific person or for a specific period of time. You also will receive information on the procedures for removing or temporarily lifting a security freeze.

If you want to temporarily lift the security freeze on your credit report, you must contact the consumer reporting agency and provide all of the following:

(1) The unique personal identification number or password provided by the consumer reporting agency;

(2) The proper identifying information to verify your identity; and

(3) The proper information regarding the person who is to receive the credit report or the period of time for which the credit report is to be available to users of the credit report.

A consumer reporting agency must comply with a request to temporarily lift a security freeze on a credit report within 3 business days after the request is received, or within 15 minutes for certain requests. A consumer reporting agency must comply with a request to remove a security freeze on a credit report within 3 business days after the request is received.

If you are actively seeking credit, you should be aware that the procedures involved in lifting a security freeze may slow your own applications for credit. You should plan ahead and lift a security freeze, either completely if you are seeking credit from a number of sources, or just for a specific creditor if you are applying only to that creditor, a few days before actually applying for new credit.

A security freeze does not apply if you have an existing account relationship and a copy of your credit report is requested by your existing creditor or its agents or affiliates for certain types of account review, collection, fraud control, or similar activities.”

(k) If a consumer reporting agency violates a security freeze by releasing a consumer’s consumer report subject to a security freeze or any information derived from a consumer’s consumer report subject to a security freeze without authorization, the consumer reporting agency, within 5 business days after discovering or being notified of the release, shall notify the consumer in writing of:

(1) The specific information released; and

(2) The name and address of, or other available contact information for, the recipient of the consumer report or the information released.

(l) The exclusive remedy for a violation of subsection (e)(2)(ii) of this section shall be a complaint filed with the Commissioner under § 14-1225 of this subtitle.