A consumer reporting agency is not required to place a security freeze in a consumer credit file under this chapter if it acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or multiple consumer reporting agencies and does not maintain a permanent database of credit information from which new consumer reports are produced. However, a consumer reporting agency must honor any security freeze placed on a consumer credit file by another consumer reporting agency.