A consumer reporting agency is not required to place a security freeze in a consumer report under section 13C.016 if it acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or multiple consumer reporting agencies, and does not maintain a permanent database of credit information from which new consumer reports are produced. However, a consumer reporting agency must honor any security freeze placed on a consumer report by another consumer reporting agency.