Security Freeze

Utah Code tit. 13, ch. 13-45, pt. 13-45-P2

in effect

Utah Code § 13-45-201 Security freeze.

13-45-201. Security freeze. (1) As used in this part: (a) "Security freeze" means a prohibition, consistent with the provisions of this section, on a consumer reporting agency's furnishing of a consumer's credit report to a third party intending to use the credit report to determine the consumer's eligibility for credit. (b) "Unique personal identifier" means a personal identification number, password, or other secure form of identity verification accepted by a consumer reporting agency and intended for use by a consumer to place, remove, or temporarily remove a security freeze in accordance with this chapter. (2) (a) A consumer may request a security freeze on a consumer's credit report by: (i) submitting a request for a security freeze to the consumer reporting agency by: (A) certified mail to the postal address identified by the consumer reporting agency in accordance with Subsection (5); or (B) electronic means developed by the consumer reporting agency in accordance with Subsection (5); and (ii) providing proper identification to the consumer reporting agency. (b) Upon receipt of a request described in Subsection (2)(a), the consumer reporting agency shall: (i) place a security freeze on the consumer's credit report: (A) if the consumer submits the request by certified mail, as soon as practicable but no later than five business days after the business day on which the consumer reporting agency receives the request and the consumer's proper identification; (B) if the consumer submits the request by a contact method described in Subsection (5)(b)(ii) or (iii) that is not a mobile application, as soon as practicable but no later than 24 hours after the consumer reporting agency receives the request and the consumer's proper identification; or (C) if the consumer submits the request by mobile application, within 15 minutes after the consumer reporting agency receives the request and the consumer's proper identification; (ii) provide the consumer a unique personal identifier, unless the consumer reporting agency previously provided the consumer a unique personal identifier; and (iii) within five business days after the business day on which the consumer reporting agency places the security freeze, provide the consumer confirmation that the consumer reporting agency placed the security freeze. (3) If a security freeze is in place, a consumer reporting agency may not release a consumer's credit report, or information from the credit report, to a third party that intends to use the information to determine a consumer's eligibility for credit without prior authorization from the consumer. (4) (a) Notwithstanding Subsection (3), a consumer reporting agency may communicate to a third party requesting a consumer's credit report that a security freeze is in effect on the consumer's credit report. (b) If a third party requesting a consumer's credit report in connection with the consumer's application for credit is notified of the existence of a security freeze under Subsection (4)(a), the third party may treat the consumer's application as incomplete. (5) (a) A consumer reporting agency shall develop a contact method to receive and process a consumer's request to place, remove, or temporarily remove a security freeze. (b) A contact method under Subsection (5)(a) shall include: (i) a postal address; (ii) an electronic contact method chosen by the consumer reporting agency, which may include the use of fax, Internet, or other electronic means; and (iii) the use of telephone in a manner that is consistent with any federal requirements placed on the consumer reporting agency. (6) A security freeze placed under this section may be removed only in accordance with Section 13-45-202. (7) (a) The time requirement described in Subsection (2)(b)(i)(B) or (C), as applicable, does not apply if the consumer reporting agency's ability to place the security freeze is prevented by: (i) an act of God, including fire, earthquakes, hurricanes, storms, or similar natural disaster or phenomena; (ii) unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrence; (iii) operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruption; (iv) governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar directives; (v) regularly scheduled maintenance, during other than normal business hours, of, or updates to, the consumer reporting agency's systems; or (vi) commercially reasonable maintenance of, or repair to, the consumer reporting agency's systems that is unexpected or unscheduled. (b) In the event of a circumstance described in Subsection (7)(a), the consumer reporting agency shall place the security freeze as soon as practicable. Amended by Chapter 36, 2018 General Session

Utah Code § 13-45-202 Removal of security freeze -- Requirements and timing.

13-45-202. Removal of security freeze -- Requirements and timing. (1) A consumer reporting agency shall remove a security freeze from a consumer's credit report only if: (a) (i) the consumer reporting agency receives the consumer's request through the contact method established and required in accordance with Subsection 13-45-201(5); and (ii) the consumer reporting agency receives the consumer's proper identification or unique personal identifier; or (b) the consumer makes a material misrepresentation of fact in connection with the placement of the security freeze and the consumer reporting agency notifies the consumer in writing before removing the security freeze. (2) A consumer reporting agency shall temporarily remove a security freeze upon receipt of: (a) the consumer's request through the contact method established by the consumer reporting agency in accordance with Subsection 13-45-201(5); (b) the consumer's proper identification or unique personal identifier; and (c) a specific designation of the period of time for which the security freeze is to be removed. (3) A consumer reporting agency shall remove or temporarily remove a security freeze from a consumer's credit report within: (a) three business days after the business day on which the consumer's written request to remove the security freeze is received by the consumer reporting agency at the postal address chosen by the consumer reporting agency in accordance with Subsection 13-45-201(5)(b)(i); or (b) 15 minutes after the consumer's request is received by the consumer reporting agency through a contact method described in Subsection 13-45-201(5)(b)(ii) or (iii), and includes the consumer's unique personal identifier. (4) (a) The time requirement described in Subsection (3)(b) does not apply if the consumer reporting agency's ability to remove the security freeze is prevented by: (i) an act of God, including fire, earthquakes, hurricanes, storms, or similar natural disaster or phenomena; (ii) unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrence; (iii) operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruption; (iv) governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar directives; (v) regularly scheduled maintenance, during other than normal business hours, of, or updates to, the consumer reporting agency's systems; or (vi) commercially reasonable maintenance of, or repair to, the consumer reporting agency's systems that is unexpected or unscheduled. (b) In the event of a circumstance described in Subsection (4)(a), the consumer reporting agency shall remove the security freeze as soon as practicable. Amended by Chapter 36, 2018 General Session

Utah Code § 13-45-203 Exceptions.

13-45-203. Exceptions. (1) Notwithstanding Section 13-45-201, a consumer reporting agency may furnish a consumer's credit report to a third party if: (a) (i) the purpose of the credit report is to: (A) use the credit report for purposes permitted under 15 U.S.C. Sec. 1681b(c); or (B) review the consumer's account with the third party, including for account maintenance or monitoring, credit line increases, or other upgrades or enhancements; or (C) collect on a financial obligation owed by the consumer to the third party requesting the credit report; or (ii) (A) the purpose of the credit report is to: (I) review the consumer's account with another person; or (II) collect on a financial obligation owed by the consumer to another person; and (B) use the credit report for purposes permitted under 15 U.S.C. Sec. 1681b(c); or (b) the third party requesting the credit report is a subsidiary, affiliate, agent, assignee, or prospective assignee of the person holding the consumer's account or to whom the consumer owes a financial obligation. (2) (a) The consumer's request for a security freeze does not prohibit the consumer reporting agency from disclosing the consumer's credit report for other than credit related purposes consistent with the definition of credit report found in Section 13-45-102. (b) The following list identifies the types of credit report disclosures by consumer reporting agencies to third parties that are not prohibited by a security freeze: (i) the third party does not use the credit report for the purpose of serving as a factor in establishing a consumer's eligibility for credit; (ii) the third party is acting under a court order, warrant, or subpoena requiring release of the credit report; (iii) the third party is a child support agency, or its agent or assignee, acting under Part D, Title IV of the Social Security Act or a similar state law; (iv) the federal Department of Health and Human Services or a similar state agency, or its agent or assignee, investigating Medicare or Medicaid fraud; (v) (A) the purpose of the credit report is to investigate or collect delinquent taxes, assessments, or unpaid court orders; and (B) the third party is: (I) the federal Internal Revenue Service; (II) a state taxing authority; (III) the Department of Motor Vehicles; (IV) a county, municipality, or other entity with taxing authority; (V) a federal, state, or local law enforcement agency; or (VI) the agent or assignee of any entity listed in Subsections (1)(b) and (2)(b)(v)(B); (vi) the third party is administering a credit file monitoring subscription to which the consumer has subscribed; or (vii) the third party requests the credit report for the sole purpose of providing the consumer with a copy of the consumer's credit report or credit score upon the consumer's request. (3) Section 13-45-201 does not apply to: (a) a consumer reporting agency, the sole purpose of which is to resell credit information by assembling and merging information contained in the database of another consumer reporting agency and that does not maintain a permanent database of credit information from which a consumer's credit report is produced; (b) a check services or fraud prevention services company that issues: (i) reports on incidents of fraud; or (ii) authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payment; or (c) a deposit account information service company that issues reports concerning account closures based on fraud, substantial overdrafts, automated teller machine abuse, or similar information concerning a consumer to a requesting financial institution for the purpose of evaluating a consumer's request to create a deposit account. (4) Nothing in this chapter prohibits a person from obtaining, aggregating, or using information lawfully obtained from public records in a manner that does not otherwise violate this chapter. Enacted by Chapter 344, 2006 General Session

Utah Code § 13-45-204 Fees for security freeze.

13-45-204. Fees for security freeze. (1) A consumer reporting agency may not charge a fee for placing, removing, or temporarily removing a security freeze. (2) A consumer reporting agency may not charge a fee to download or install a mobile application through which a person places or removes a security freeze. Amended by Chapter 36, 2018 General Session

Utah Code § 13-45-205 Changes to information in a credit report subject to a security freeze.

13-45-205. Changes to information in a credit report subject to a security freeze. (1) If a credit report is subject to a security freeze, a consumer reporting agency shall notify the consumer who is the subject of the credit report within 30 days if the consumer reporting agency changes the consumer's: (a) name; (b) date of birth; (c) Social Security number; or (d) address. (2) (a) Notwithstanding Subsection (1), a consumer reporting agency may make technical modifications to information in a credit report that is subject to a security freeze without providing notification to the consumer. (b) Technical modifications under Subsection (2)(a) include: (i) the addition or subtraction of abbreviations to names and addresses; and (ii) transpositions or corrections of incorrect numbering or spelling. (3) When providing notice of a change of address under Subsection (1), the consumer reporting agency shall provide notice to the consumer at both the new address and the former address. Enacted by Chapter 344, 2006 General Session

Source: Utah Office of Legislative Research and General Counsel (le.utah.gov)URL: https://le.utah.gov/xcode/Title13/Chapter45/13-45-P2.html?v=C13-45-P2_1800010118000101Fetched: 10/26/2026