Unless a security freeze on a protected consumer’s consumer file or record is removed under § 20.28 or 20.30, a consumer reporting agency may not release any consumer report relating to the protected consumer, any information derived from the protected consumer’s consumer report, or any record created for the protected consumer.