Section 62A: Consumer requested security freeze on consumer report
Section 62A. If a consumer requests a security freeze, the consumer reporting agency shall disclose to the consumer the process of placing, removing and lifting a security freeze. A consumer reporting agency shall require proper identification of the person making a request to place, lift or remove a security freeze.
A consumer may request that a security freeze be placed on his consumer report by sending a request to a consumer reporting agency by certified mail, overnight mail or regular stamped mail to an address designated by the consumer reporting agency to receive such requests, or by a method otherwise permitted by regulation. If a security freeze is in place, the information from a consumer report shall not be released to a third party without prior express authorization from the consumer. This section shall not prohibit a consumer reporting agency from advising a third party that a security freeze is in effect with respect to the consumer report.
A consumer reporting agency shall place a security freeze on a consumer report not later than 3 business days after receiving a request from the consumer. The consumer reporting agency shall send a written confirmation of the security freeze to the consumer within 5 business days after receiving the request and shall provide the consumer with a unique personal identification number or a unique password, or both, to be used by the consumer for the purpose of providing authorization for the removal or lifting of the security freeze.
If the consumer wishes to lift a security freeze that is in place, he shall contact the consumer reporting agency, request that the freeze be lifted, and provide proper identification, the personal identification number or password, or both, provided by the consumer reporting agency, and the third party who is to receive the consumer report or the specified period of time for which the report shall be available to authorized users of the consumer report.
A consumer reporting agency that receives a request from a consumer to lift a security freeze on a consumer report pursuant to this chapter shall comply with the request as soon as practicable and without unreasonable delay, but under no circumstances not later than 3 business days after receiving the request.
A security freeze shall remain in place until the consumer requests that the security freeze be lifted or removed in accordance with this section; provided, however, that a consumer reporting agency may remove a security freeze if the consumer report was frozen due to a material misrepresentation of fact. If a consumer reporting agency intends to remove a freeze on a consumer report due to a material misrepresentation of fact by the consumer, the consumer reporting agency shall notify the consumer in writing 5 business days prior to removing the freeze on the consumer report.
While a security freeze is in place, a consumer reporting agency shall not change any of the following official information in a consumer report without sending a written confirmation of the change to the consumer within 30 days of the change being posted to the consumer report: name, date of birth, social security number, and address. Written confirmation shall not be required for technical modifications of information contained in a consumer report, including name and street abbreviations, complete spellings, or transposition of numbers or letters. In the case of an address change, the written confirmation shall be sent to both the new address and to the former address.
If a third party requests access to a consumer report on which a security freeze is in effect, and this request is submitted in connection with an application for credit or any other use, and the consumer does not allow his or her consumer report to be accessed for that specific party or for that specified period of time, the third party shall treat the application as incomplete.
A consumer reporting agency shall remove a security freeze within 3 business days of receiving a request for removal from a consumer who provides both proper identification and the personal identification number or password provided by the consumer reporting agency pursuant to this section.
This section shall not apply to the use of a consumer report by any of the following:--
(a) a person or agent thereof, or an assignee of a financial obligation owing by the consumer to such person or agent thereof, or a prospective assignee of a financial obligation owing by the consumer to that person or agent thereof in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had, prior to assignment, an account or contract, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract or negotiable instrument. For purposes of this paragraph, "reviewing the account'' shall include activities related to account maintenance, monitoring, credit line increases and account upgrades and enhancements; or access to said account by a subsidiary, affiliate, agent, assignee or prospective assignee of a person, or agent thereof, to whom access has been granted for purposes of facilitating the extension of credit or other permissible use;
(b) any federal, state or local agency, law enforcement agency, or trial court acting pursuant to a court order, warrant or subpoena;
(c) the Massachusetts child support agency under Title IV-D of the Social Security Act, 42 U.S.C. et seq;
(d) the executive office of health and human services or its agents or assigns acting to investigate Medicaid fraud;
(e) the department of revenue or its agents or assigns acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities;
(f) a person using credit information for the purposes of prescreening as provided for by the federal Fair Credit Reporting Act;
(g) any person administering a credit file monitoring subscription service to which the consumer has subscribed;
(h) any person acting solely for the purpose of providing a consumer with a copy of his consumer report upon the consumer's request; or
(i) to the extent otherwise allowed by statute, any property and casualty insurer licensed by the commonwealth for use in rating or underwriting insurance policies.
In accordance with 15 U.S.C section 1681c-1 and to the extent permitted by federal law, a consumer reporting agency shall not charge a fee to any consumer who elects to place, lift or remove a security freeze from a consumer report.
The following persons shall not be required to place a security freeze on a consumer report:--
(a) a check services or fraud prevention services company, which issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers or similar methods of payments;
(b) a deposit account information service company, which issues reports regarding account closures due to fraud, substantial overdrafts, ATM abuse, or similar negative information regarding a consumer, to inquiring banks or other financial institutions for use only in reviewing a consumer request for a demand deposit account at the inquiring bank; or
(c) a consumer reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or multiple consumer reporting agencies, and does not maintain a permanent database of credit information from which new consumer reports are produced, except that such financial institution or consumer reporting agency shall be subject to any security freeze placed on a consumer report by another consumer reporting agency from which it obtains information.
[ Thirteenth paragraph effective until May 30, 2023. For text effective May 30, 2023, see below.]
Notwithstanding any general or special law to the contrary, the director of consumer affairs and business regulation, in consultation with the secretary of housing and economic development, shall promulgate rules and regulations for the purpose of expediting the methods of requesting, lifting and removing security freezes through technological advancements, consistent with this section and designed to benefit consumers.
[ Thirteenth paragraph as amended by 2023, 7, Sec. 240 effective May 30, 2023. See 2023, 7, Sec. 298. For text effective until May 30, 2023, see above.]
Notwithstanding any general or special law to the contrary, the director of consumer affairs and business regulation, in consultation with the secretary of economic development, shall promulgate rules and regulations for the purpose of expediting the methods of requesting, lifting and removing security freezes through technological advancements, consistent with this section and designed to benefit consumers.