A security freeze remains in effect until the consumer requests that the security freeze be removed. A consumer reporting agency shall remove a security freeze within three business days after receiving a request for removal that includes proper identification of the consumer, and the personal identification number or password provided by the consumer reporting agency.