(a) Any consumer may submit a written request, by certified mail or such other secure method as authorized by a credit rating agency, to a credit rating agency to place a security freeze on such consumer’s credit report. Such credit rating agency shall place a security freeze on a consumer’s credit report as soon as practicable, but not later than five business days after receipt of such request. Not later than ten business days after placing a security freeze on a consumer’s credit report, such credit rating agency shall send a written confirmation of such security freeze to such consumer that provides the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of such consumer’s report to a third party or for a period of time. Nothing in this subsection shall be deemed to require a consumer reporting agency to provide to a minor child or the parent or legal guardian of a minor child, on behalf of the minor child, a unique personal identification number, password or similar device to be used to authorize the consumer reporting agency to release such minor child’s credit report.

(b) In the event such consumer, other than a minor child or the parent or legal guardian of a minor child, wishes to authorize the disclosure of such consumer’s credit report to a third party, or for a period of time, while such security freeze is in effect, such consumer shall contact such credit rating agency and provide: (1) Proper identification, (2) the unique personal identification number or password described in subsection (a) of this section, and (3) proper information regarding the third party who is to receive the credit report or the time period for which the credit report shall be available. Any credit rating agency that receives a request from a consumer pursuant to this section shall lift such security freeze not later than three business days after receipt of such request.

(c) Except for the temporary lifting of a security freeze as provided in subsection (b) of this section, any security freeze authorized pursuant to the provisions of this section shall remain in effect until such time as such consumer requests such security freeze to be removed. A credit rating agency shall remove such security freeze as soon as practicable, but not later than three business days after receipt of such request provided such consumer provides proper identification to such credit rating agency and the unique personal identification number or password described in subsection (a) of this section at the time of such request for removal of the security freeze. In the case of a minor child, the credit rating agency shall remove such security freeze not later than fifteen business days after receipt of such request, provided the minor child or the parent or legal guardian of the minor child uses the unique personal identification number, password or similar device provided under subsection (a) of this section at the time of such request, if applicable.

(d) Any credit rating agency may develop procedures to receive and process such request from a consumer to temporarily lift or remove a security freeze on a credit report pursuant to subsection (b) of this section. Such procedures, at a minimum, shall include, but not be limited to, the ability of a consumer to send such temporary lift or removal request by electronic means, letter or facsimile.

(e) In the event that a third party requests access to a consumer’s credit report that has such a security freeze in place and such third party request is made in connection with an application for credit or any other use and such consumer has not authorized the disclosure of such consumer’s credit report to such third party, such third party may deem such credit application as incomplete.

(f) Any credit rating agency may refuse to implement or may remove such security freeze if such agency believes, in good faith, that: (1) The request for a security freeze was made as part of a fraud that the consumer participated in, had knowledge of, or that can be demonstrated by circumstantial evidence, or (2) the consumer credit report was frozen due to a material misrepresentation of fact by the consumer. In the event any such credit rating agency refuses to implement or removes a security freeze pursuant to this subsection, such credit rating agency shall promptly notify such consumer in writing of such refusal not later than five business days after such refusal or, in the case of a removal of a security freeze, prior to removing the freeze on the consumer’s credit report.

(g) Nothing in this section shall be construed to prohibit disclosure of a consumer’s credit report to: (1) A person, or the person’s subsidiary, affiliate, agent or assignee with which the consumer has or, prior to assignment, had an account, contract or debtor-creditor relationship for the purpose of reviewing the account or collecting the financial obligation owing for the account, contract or debt; (2) a subsidiary, affiliate, agent, assignee or prospective assignee of a person to whom access has been granted under subsection (b) of this section for the purpose of facilitating the extension of credit or other permissible use; (3) any person acting pursuant to a court order, warrant or subpoena; (4) any person for the purpose of using such credit information to prescreen as provided by the federal Fair Credit Reporting Act; (5) any person for the sole purpose of providing a credit file monitoring subscription service to which the consumer has subscribed; (6) a credit rating agency for the sole purpose of providing a consumer with a copy of his or her credit report upon the consumer’s request; or (7) a federal, state or local governmental entity, including a law enforcement agency, or court, or their agents or assignees pursuant to their statutory or regulatory duties. For purposes of this subsection, “reviewing the account” includes activities related to account maintenance, monitoring, credit line increases and account upgrades and enhancements.

(h) The following persons shall not be required to place a security freeze on a consumer’s credit report, provided such persons shall be subject to any security freeze placed on a credit report by another credit rating agency: (1) A check services or fraud prevention services company that reports on incidents of fraud or issues authorizations for the purpose of approving or processing negotiable instruments, electronic fund transfers or similar methods of payment; (2) a deposit account information service company that issues reports regarding account closures due to fraud, substantial overdrafts, automated teller machine abuse, or similar information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution; or (3) a credit rating agency that: (A) Acts only to resell credit information by assembling and merging information contained in a database of one or more credit reporting agencies; and (B) does not maintain a permanent database of credit information from which new credit reports are produced.

(i) (1) A credit rating agency shall not (A) charge a fee to a consumer for a security freeze, removal of such freeze, temporary lift of such freeze for a period of time or a temporary lift of such freeze for a specific party, or (B) require as a condition for placing a security freeze that a consumer enter into an agreement that limits any claim the consumer may have against such credit rating agency.

(2) No credit rating agency shall charge a fee to a consumer for a personal identification number.

(j) The parent or legal guardian of a minor child may place a security freeze on the credit report of a minor child by submitting a written request to the credit rating agency in the manner described in this section and subject to the same conditions and by providing the credit rating agency with proper identification and sufficient proof of authority to act on behalf of the minor child. The credit rating agency shall place the security freeze on the credit report of a minor child as soon as practicable, but not later than five business days after receipt of such request. If the credit rating agency does not have any information in its files pertaining to the minor child at the time the credit rating agency receives a request pursuant to this subsection, the credit rating agency shall create a record for the minor child and place a security freeze on such record. Such record shall consist of a compilation of information created by a credit rating agency that identifies a minor child. A credit rating agency shall not create or use such record to consider the minor child’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living. A credit rating agency shall not release a minor child’s credit report, any information derived from a minor child’s credit report or any record created for a minor child.

(k) The parent or legal guardian of a minor child may request the removal of a security freeze placed on the credit report or record of a minor child by submitting a written request to the credit rating agency in the manner described in this section and subject to the same conditions and by providing the credit rating agency with proper identification and sufficient proof of authority to act on behalf of the minor child. The credit rating agency shall remove the security freeze on the credit report or record of a minor child not later than fifteen business days after receipt of such request.

(l) An insurer, as defined in § 38a-1, may deny an application for insurance if an applicant has placed a security freeze on such applicant’s credit report and fails to authorize the disclosure of such applicant’s credit report to such insurer pursuant to the provisions of subsection (b) of this section.

(m) Any security freeze in a credit report in effect as of October 1, 2016, shall continue to be in effect until the consumer or the parent or legal guardian of a minor child requests the removal of the security freeze.