To enact sections 1349.55 to 1349.60 of the Revised Code to allow a consumer to place a security freeze on the consumer's credit report.

Section 1. That sections 1349.55, 1349.56, 1349.57, 1349.58, 1349.59, and 1349.60 of the Revised Code be enacted to read as follows:

Sec. 1349.55.  As used in sections 1349.55 to 1349.60 of the Revised Code:

(A) "Consumer reporting agency" has the same meaning as in section 4712.01 of the Revised Code.

(B) "Security freeze" means a notice placed in a consumer's credit report that prohibits a consumer reporting agency from releasing the consumer's credit report or information contained in the consumer's credit report without authorization from the consumer.

Sec. 1349.56.  (A) A consumer may request a consumer reporting agency to place a security freeze on the consumer's credit report. A consumer reporting agency shall not charge the consumer a fee for placing or removing a security freeze, or for temporarily releasing a credit report from a security freeze. Except as otherwise allowed under section 1349.59 of the Revised Code, once a security freeze is in place, a consumer reporting agency shall not release a consumer's credit report or information from a consumer credit report to a third party without prior, express authorization from the consumer. Nothing in this section prohibits a consumer reporting agency from advising a third party that a security freeze is in place with respect to a consumer's credit report.

(B) A consumer who elects to place a security freeze on the consumer's credit report shall send a request in writing to a consumer reporting agency asking to have a security freeze placed on the consumer's credit report. The consumer shall send the request via certified mail. A consumer reporting agency shall place a security freeze on a consumer's credit report not later than seven days after the consumer reporting agency receives the security freeze request. The consumer reporting agency shall send the consumer written confirmation of the security freeze, a unique personal identification number or password, and the written disclosure described in division (C) of this section within fourteen days after receiving the consumer's request. The consumer reporting agency shall not assign the consumer's social security number as the consumer's personal identification number. A consumer may request to change the personal identification number or password that the consumer reporting agency assigned by submitting a written request to the consumer reporting agency that includes the original personal identification number or password assigned to the consumer and the desired personal identification number or password. The consumer reporting agency shall change the consumer's personal identification number or password to the requested personal identification number or password not later than seven days after the agency receives the consumer's request.

(C) A consumer reporting agency shall send to a consumer who requests a security freeze a copy of the following statement disclosing the consumer's rights:

"You have a right to place a security freeze on your credit report that will prohibit a consumer reporting agency from releasing any information concerning your credit report without your express authorization. A security freeze must be requested in writing by certified mail. The security freeze is designed to prevent a consumer reporting agency from releasing your credit report without your consent. However, you should be aware that using a security freeze to limit access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, insurance, government services or payments, rental housing, employment, investment, license, cellular telephone, utilities, digital signature, internet credit card transaction, or other services, including an extension of credit at point of sale. When you place a security freeze on your credit report, you will be provided a personal identification number or password to use if you choose to remove the security freeze from your credit report or to authorize the temporary release of your credit report to a specific person or for a specific time period after the security freeze is in place. To provide that authorization, you must contact the consumer reporting agency and provide all the following:

(1) Sufficient identification to verify your identity.

(2) Your personal identification number or password provided by the consumer reporting agency.

(3) A statement that you choose to remove the security freeze from your credit report or that you authorize the reporting agency to temporarily release your credit report. If you authorize the temporary release of your credit report, you must specify the name and address of the person who is to receive your credit report or the period for which your credit report must be available. A consumer reporting agency must remove the security freeze from your credit or authorize the temporary release of your credit report not later than three business days after receiving the above information. A security freeze does not apply to certain persons, including a person, or a collection agency acting on behalf of a person, with whom you have an existing account that requests information in your credit report for the purposes of reviewing or collecting the account."

(D) In the event a third party requests access to a credit report upon which a consumer reporting agency has placed a security freeze, and the third party request is made in connection with an application for credit or any other use, if the consumer has not authorized the disclosure of the consumer's credit report to the third party, the third party may consider the credit application as incomplete.

(E) The placement of a security freeze on a consumer's credit report shall not be considered an adverse factor in the consumer's creditworthiness, credit standing, or credit capacity.

(F) After a security freeze has been placed on a consumer's credit report, a consumer reporting agency shall not make changes to the consumer's credit report concerning the consumer's name, birth date, social security number, or address without sending written confirmation of the change to the consumer within thirty days after making the change. If the consumer reporting agency changes the address of the consumer, the consumer reporting agency shall send confirmation of the change to both the new address and the old address. A consumer reporting agency is not required to send written confirmation to the consumer concerning technical corrections to the consumer's credit report, including but not limited to, technical corrections involving the abbreviation of a name or street, the transposition of numbers or letters, or misspelling of a word.

Sec. 1349.57.  (A) After a consumer reporting agency places a security freeze on a consumer's credit report, if the consumer wishes to authorize the temporary release of the consumer's credit report to a third party or for a specific period of time, the consumer shall contact the consumer reporting agency and provide all of the following information:

(1) Proper identification;

(2) The personal identification number or password assigned to the consumer as required under section 1349.56 of the Revised Code;

(3) The name and address of the third party who is to receive the consumer's credit report or the time period for which the consumer's credit report shall be available.

(B) A consumer reporting agency that receives a request from a consumer to release the consumer's credit report to a third party shall release the credit report to the third party immediately after the consumer reporting agency receives the request. A consumer reporting agency that receives a temporary release request from a consumer to release the consumer's credit report for a specific period of time shall release the credit report for the time period requested.

(C) A consumer reporting agency may develop procedures to receive and process a consumer's request to temporarily release a consumer's credit report from a security freeze. The procedures shall include, but are not limited to, the ability of a consumer to send a request by electronic mail, letter, or facsimile.

Sec. 1349.58.  (A) A security freeze placed on a consumer's credit report shall remain in effect until the consumer requests the freeze to be removed. To remove a security freeze, the consumer shall submit a request to remove the security freeze to the consumer reporting agency containing both of the following:

(1) Proper identification;

(2) The personal identification number or password assigned to the consumer as required under section 1349.56 of the Revised Code.

(B) A consumer reporting agency shall remove the security freeze within five days after receiving a consumer's request that satisfies the requirements of division (A) of this section.

Sec. 1349.59.  A consumer reporting agency may release a consumer credit report on which a security freeze has been placed to the following entities:

(A) A subsidiary, affiliate, agent, assignee, or prospective assignee of a third party to whom access has been granted pursuant to section 1349.57 of the Revised Code for the purpose of facilitating the extension of credit.

(B)(1) A person with whom the consumer has or prior to an assignment had a contract or an account, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purpose of allowing the person to review the account or collect the financial obligation owed for the account, contract, or negotiable instrument.

(2) A subsidiary, affiliate, or agent of a person described in division (B)(1) of this section; an assignee of a financial obligation that a consumer owes to a person described in division (B)(1) of this section; or a prospective assignee of a financial obligation that the consumer owes to a person described in division (B)(1) of this section in conjunction with a proposed purchase of a financial obligation, for the purpose of allowing the entity to review the account or collect the financial obligation owed for an account, contract, or negotiable instrument.

For the purposes of division (B) of this section, "review the account" includes activities related to maintaining, monitoring, upgrading, and enhancing the account and increasing credit lines.

(C) A person seeking to use the information contained in a consumer's credit report for the purpose of prescreening pursuant to the federal "Fair Credit Reporting Act," 15 U.S.C. 1681, et seq.

(D) Any person administering a credit report monitoring subscription service to which the consumer has subscribed.

(E) Any person for the purpose of providing a consumer with a copy of the consumer's credit report upon the consumer's request.

(F) Any federal, state, or local governmental entity, agency, or instrumentality that is acting within the entity's, agency's, or instrumentality's authority.

(G) A state or local government agency, law enforcement agency, court, or private collection agency acting pursuant to a court order, warrant, or subpoena.

(H) A child support enforcement agency acting pursuant to Chapter 3121. of the Revised Code or Title IV-D of the "Social Security Act," 42 U.S.C. 651, et seq.

Sec. 1349.60.  (A) A consumer reporting agency may refuse to implement a security freeze or may remove a security freeze if the consumer reporting agency, in good faith, believes either of the following has occurred:

(1) The request for a security freeze was made as part of a fraud in which the consumer participated or of which the consumer had knowledge;

(2) The security freeze was placed on a consumer's credit report based on a misrepresentation of the consumer.

(B) In the event a consumer reporting agency refuses to implement a security freeze or removes a security freeze for a reason specified in division (A) of this section, the consumer reporting agency promptly shall notify the consumer in writing of the refusal to place a security freeze on a consumer's credit report or the removal of a security freeze not later than seven days after the refusal or removal.