Request for security freeze on protected person's record or consumer report -- Effect of security freeze -- Removal of security freeze -- Fees -- Liability for willful noncompliance or acting under false pretenses -- Nonapplicability to specified circumstances
KRS 367.3645
in effect367.3645. Request for security freeze on protected person's record or consumer report -- Effect of security freeze -- Removal of security freeze -- Fees -- Liability for willful noncompliance or acting under false pretenses -- Nonapplicability to specified circumstances
(1) For the purposes of this section:
(a) "Protected person" means an individual who is under sixteen (16) years of age at the time a request for the placement of a security freeze is made, or who is an incapacitated person or other person for whom a guardian or conservator has been appointed;
(b) "Record" means a compilation of information which: 1. Identifies a protected person; 2. Is created by a consumer reporting agency solely for the purpose of complying with this section; and 3. Is not created or used to consider the protected person's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living;
(c) "Representative" means a person who provides to a consumer reporting agency sufficient proof of authority to act on behalf of a protected person; and
(d) "Sufficient proof of authority" means documentation that shows a representative has authority to act on behalf of a protected person, including but not limited to: 1. A court order granting custodianship, guardianship, or conservatorship; 2. A birth certificate; 3. A lawfully executed and valid power of attorney; or 4. A written, notarized statement signed by a representative that expressly describes the authority of the representative to act on behalf of a protected person.
(2) A consumer reporting agency shall place a security freeze on a protected person's record or consumer report if:
(a) The consumer reporting agency receives a request from the protected person's representative for the placement of the security freeze; and
(b) The protected person's representative: 1. Submits the request to the consumer reporting agency at the address designated by the consumer reporting agency to receive the request; 2. Provides to the consumer reporting agency clear and proper identification of the protected person and the representative; 3. Provides to the consumer reporting agency sufficient proof of authority to act on behalf of the protected person; and 4. Pays to the consumer reporting agency a fee as prescribed in subsection (8) of this section.
(3) If a consumer reporting agency does not have a file pertaining to a protected person when the consumer reporting agency receives a request pursuant to subsection (2) of this section, the consumer reporting agency shall create a record for the protected person.
(4) Within thirty (30) days after receiving a request pursuant to this section, a consumer reporting agency shall place a security freeze on the protected person's record or consumer report.
(5) Unless a security freeze is removed pursuant to subsection (7) or (10) of this section, a consumer reporting agency may not release the protected person's consumer report, any information derived from the protected person's consumer report, or any record created for the protected person.
(6) A security freeze that is placed on a protected person's record or consumer report placed under this section remains in effect until either:
(a) The protected person or the protected person's representative requests that the consumer reporting agency remove the security freeze pursuant to subsection (7) of this section; or
(b) The security freeze is removed pursuant to subsection (10) of this section.
(7) (a) To remove a security freeze for a protected person, the protected person or the protected person's representative shall submit a request for the removal of the security freeze to the consumer reporting agency at the address designated by the consumer reporting agency to receive the request, and pay a fee as prescribed in subsection (8) of this section. In addition: 1. If the protected person requested the removal of the security freeze, the protected person shall provide to the consumer reporting agency both of the following: a. Proof that the protected person's representative no longer has sufficient proof of authority to act on behalf of the protected person; and b. Clear and proper identification of the protected person; and 2. If the protected person's representative requested the removal of the security freeze on behalf of the protected person, the protected person's representative shall provide to the consumer reporting agency both of the following: a. Clear and proper identification of the protected person and the representative; and b. Sufficient proof of authority to act on behalf of the protected person.
(b) Within thirty (30) days after receiving a request to remove a security freeze placed pursuant to subsection (2) of this section, the consumer reporting agency shall remove the security freeze for the protected person.
(8) A consumer reporting agency may charge a fee for each placement or removal of a security freeze on a protected person's record or consumer report. The fee may not exceed ten dollars ($10).
(9) Notwithstanding subsection (8) of this section, a consumer reporting agency may not charge any fee under this section if:
(a) The protected person's representative provides a copy of a police report to the consumer reporting agency alleging that the protected person has been a victim of an offense involving identity theft; or
(b) A request for the placement or removal of a security freeze is for a protected person who is under sixteen (16) years of age at the time of the request and the consumer reporting agency has a consumer report pertaining to the protected person.
(10) A consumer reporting agency may remove a security freeze for a protected person or may delete a protected person's record if the security freeze was placed or the record was created based on a material misrepresentation of fact by the protected person or the protected person's representative.
(11) Any person who willfully fails to comply with any requirement imposed under this section with respect to any protected person is liable to that person in an amount equal to the sum of:
(a) Any actual damages sustained by the consumer as a result of the failure;
(b) Any liquidated damages of not less than one hundred dollars ($100) and not more than one thousand dollars ($1,000);
(c) Any punitive damages as the court may allow; and
(d) In the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney's fees as determined by the court.
(12) Any person, other than the named individual or individuals in the report, who obtains a consumer report, requests a security freeze, requests the temporary lift of a freeze, or requests the removal of a security freeze from a consumer reporting agency under false pretenses or in an attempt to violate federal or state law shall be liable to the consumer reporting agency for actual damages sustained by the consumer reporting agency or one thousand dollars ($1,000), whichever is greater.
(13) This section does not apply to a protected person's consumer report or record provided to:
(a) A federal, state, or local governmental entity, including a law enforcement agency, or court, or their agents or assigns;
(b) A private collection agency for the sole purpose of assisting in the collection of an existing debt of the consumer who is the subject of the consumer report requested;
(c) A person or entity, or a subsidiary, affiliate, or agent of that person or entity, or an assignee of a financial obligation owing by the consumer to that person or entity, or a prospective assignee of a financial obligation owing by the consumer to that person or entity in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment an account or contract, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument. For purposes of this paragraph, "reviewing the account" includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements;
(d) A person, for the purposes of prescreening as provided by the federal Fair Credit Reporting Act, 15 U.S.C. secs. 1681 et seq.;
(e) A consumer reporting agency for the purposes of providing a consumer with a copy of his or her own report on his or her request;
(f) A child support enforcement agency;
(g) A consumer reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or multiple credit reporting agencies and does not maintain a permanent database of credit information from which new consumer reports are produced. However, a consumer reporting agency acting as a reseller shall honor any security freeze placed on a consumer report by another consumer reporting agency;
(h) A check services or fraud prevention services company, which issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments;
(i) A deposit account information service company, which issues reports regarding account closures due to fraud, substantial overdrafts, ATM abuse, or similar negative information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution;
(j) Any person or entity using a consumer report in preparation for a civil or criminal action, or an insurance company in investigation of a claim; or
(k) 1. Any insurance company for setting or adjusting a rate or underwriting for property and casualty insurance purposes; or 2. Any consumer reporting agency database or file which consists solely of consumer information concerning, and used solely for: a. Criminal record information; b. Personal loss history information; c. Fraud prevention or detection; d. Employment screening; or e. Tenant screening.
Effective: March 30, 2018
History: Amended 2018 Ky. Acts ch. 41, sec. 2, effective March 30, 2018. -- Created 2017 Ky. Acts ch. 119, sec. 1, effective January 1, 2018
Source: Kentucky Legislative Research Commission (legislature.ky.gov)URL: https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=47192Fetched: 10/20/2026