{"formats":[{"name":"JSON","format":"json","url":"\/downloads\/2025\/code-json\/59.1-444.2.json"},{"name":"Plain Text","format":"text","url":"\/downloads\/2025\/code-text\/59.1-444.2.txt"},{"name":"XML","format":"xml","url":"\/downloads\/2025\/code-xml\/59.1-444.2.xml"},{"name":"HTML","format":"html","url":"\/downloads\/2025\/code-html\/59.1-444.2.html"}],"law_id":76739,"edition_id":1,"section_id":76739,"structure_id":16371,"section_number":"59.1-444.2","catch_line":"Security freezes","history":"2008, cc. 480, 496; 2009, c. 406; 2014, c. 570; 2018, cc. 264, 303; 2020, c. 243.","full_text":"A\n\nAs used in this section, &#8220;security freeze&#8221; means a notice placed in a consumer&#8217;s credit report, at the request of the consumer and subject to certain exceptions, that prohibits the consumer reporting agency from releasing the consumer&#8217;s credit report or score relating to the extension of credit.B\n\nA consumer may request that a security freeze be placed on his or her credit report by sending a request in writing by certified mail, or such other secure method authorized by a consumer reporting agency, to a consumer reporting agency at an address designated by the consumer reporting agency to receive such requests. This subsection does not prevent a consumer reporting agency from advising a third party that a security freeze is in effect with respect to the consumer&#8217;s credit report.C\n\nA consumer reporting agency shall place a security freeze on a consumer&#8217;s credit report no later than three business days after receiving from the consumer:1\n\nA written request described in subsection B; and2\n\nProper identification.\n\t\t\t\tA consumer reporting agency shall place a security freeze on a consumer&#8217;s credit report no later than one business day after receiving such a request, if such request is made electronically at an address designated by the consumer reporting agency to receive such requests.D\n\nThe consumer reporting agency shall send a written confirmation of the placement of the security freeze to the consumer within 10 business days. Upon placing the security freeze on the consumer&#8217;s credit report, the consumer reporting agency shall provide the consumer with a unique personal identification number or password, or similar device to be used by the consumer when providing authorization for the release of his credit report for a specific period of time or for a specific party.E\n\nIf the consumer wishes to allow his credit report to be accessed for a specific period of time or for a specific party while a freeze is in place, he shall contact the consumer reporting agency using a point of contact designated by the consumer reporting agency, request that the freeze be temporarily lifted, and provide the following:1\n\nProper identification;2\n\nThe unique personal identification number or password provided by the consumer reporting agency pursuant to subsection D; and3\n\nThe proper information regarding the time period or the specific party for which the report shall be available to users of the credit report.F\n\nA consumer reporting agency:1\n\nShall comply with a request made under subsection E:\n\t\t\t\ta. Within three business days after receiving the request if the request is made at a postal address designated by the agency to receive such requests; or\n\t\t\t\tb. Within 15 minutes after the consumer&#8217;s request is received by the consumer reporting agency through the electronic contact method chosen by the consumer reporting agency in accordance with this section;2\n\nIs not required to temporarily lift a security freeze within the time provided in subdivision 1 b if:\n\t\t\t\ta. The consumer fails to meet the requirements of subsection E; or\n\t\t\t\tb. The consumer reporting agency&#8217;s ability to temporarily lift the security freeze within 15 minutes is prevented by:1\n\nAn act of God, including fire, earthquakes, hurricanes, storms, or similar natural disaster or phenomena;2\n\nUnauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrence;3\n\nOperational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruption;4\n\nGovernmental action, including emergency orders or regulations, judicial or law-enforcement action, or similar directives;5\n\nRegularly scheduled maintenance, during other than normal business hours, of, or updates to, the consumer reporting agency&#8217;s systems; or6\n\nCommercially reasonable maintenance of, or repair to, the consumer reporting agency&#8217;s systems that is unexpected or unscheduled; and3\n\nMay develop procedures involving the use of telephone, fax, the Internet, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze on a credit report pursuant to subsection E in an expedited manner.G\n\nA consumer reporting agency shall remove or temporarily lift a freeze placed on a consumer&#8217;s credit report only in the following cases:1\n\nUpon a consumer request, pursuant to subsection E or subsection J; or2\n\nIf the consumer&#8217;s credit report was frozen due to a material misrepresentation of fact by the consumer. If a consumer reporting agency intends to remove a freeze upon a consumer&#8217;s credit report pursuant to this subdivision, the consumer reporting agency shall notify the consumer in writing prior to removing the freeze on the consumer&#8217;s credit report.H\n\nIf a third party requests access to a consumer credit report on which a security freeze is in effect, and this request is in connection with an application for credit or any other use, and the consumer does not allow his or her credit report to be accessed for that period of time, the third party may treat the application as incomplete.I\n\nIf a consumer requests a security freeze, the consumer reporting agency shall disclose the process of placing and temporarily lifting a freeze and the process for allowing access to information from the consumer&#8217;s credit report for a period of time while the freeze is in place.J\n\nA security freeze shall remain in place until the consumer requests, using a point of contact designated by the consumer reporting agency, that the security freeze be removed. A consumer reporting agency shall remove a security freeze within three business days of receiving a request for removal from the consumer, who provides:1\n\nProper identification; and2\n\nThe unique personal identification number or password or similar device provided by the consumer reporting agency pursuant to subsection D.K\n\nA consumer reporting agency shall require proper identification of the person making a request to place or remove a security freeze.L\n\nThe provisions of this section do not apply to the use of a consumer credit report by any of the following:1\n\nA person or entity, or a subsidiary, affiliate, or agent of that person or entity, or an assignee of a financial obligation owing by the consumer to that person or entity, or a prospective assignee of a financial obligation owing by the consumer to that person or entity in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment an account or contract, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument. For purposes of this paragraph, &#8220;reviewing the account&#8221; includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements;2\n\nA subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted for purposes of facilitating the extension of credit or other permissible use;3\n\nAny state or local agency, law-enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena;4\n\nA child support agency acting pursuant to Title IV-D of the Social Security Act (42 U.S.C. &#xA7; 654 et seq.);5\n\nThe Commonwealth or its agents or assigns acting to investigate fraud or acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities provided such responsibilities are consistent with a permissible purpose under 15 U.S.C. &#xA7; 1681b;6\n\nThe use of credit information for the purposes of prescreening or postscreening as provided for by the federal Fair Credit Reporting Act;7\n\nAny person or entity administering a credit file monitoring subscription or similar service to which the consumer has subscribed;8\n\nAny person or entity for the purpose of providing a consumer with a copy of his credit report or score upon the consumer&#8217;s request;9\n\nAny person or entity for use in setting or adjusting a rate, adjusting a claim, or underwriting for insurance purposes; or10\n\nAny employer in connection with any application for employment with the employer.M\n\nA consumer reporting agency shall not charge a fee for any service performed under this section.N\n\nIf a security freeze is in place, a consumer reporting agency shall not change any of the following official information in a consumer credit report without sending a written confirmation of the change to the consumer within 30 days of the change being posted to the consumer&#8217;s file: name, date of birth, social security number, and address. Written confirmation is not required for technical modifications of a consumer&#8217;s official information, including name and street abbreviations, complete spellings, or transposition of numbers or letters. In the case of an address change, the written confirmation shall be sent to both the new address and to the former address.O\n\nThe following entities are not required to place a security freeze on a credit report:1\n\nA consumer reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or multiple consumer credit reporting agencies, and does not maintain a permanent database of credit information from which new consumer credit reports are produced. However, a consumer reporting agency acting as a reseller shall honor any security freeze placed on a consumer credit report by another consumer reporting agency;2\n\nA check services or fraud prevention services company, which issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments;3\n\nA deposit account information service company, which issues reports regarding account closures due to fraud, substantial overdrafts, ATM abuse, or similar negative information regarding a consumer, to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution; and4\n\nA consumer reporting agency&#8217;s database or file that consists of information concerning, and used for, one or more of the following: criminal record information, fraud prevention or detection, personal loss history information, and employment, tenant, or background screening.P\n\nAt any time a consumer is required to receive a summary of rights required under 15 U.S.C. \u00a7 1681g(d), the following notice shall be included:\n\t\t\t&#8220;Virginia Consumers Have the Right to Obtain a Security Freeze.\n\t\t\tYou have a right to place a &#8220;security freeze&#8221; on your credit report, which will prohibit a consumer reporting agency from releasing information in your credit report without your express authorization. A security freeze must be requested in writing by certified mail. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, government services or payments, rental housing, employment, investment, license, cellular phone, utilities, digital signature, Internet credit card transaction, or other services, including an extension of credit at point of sale. When you place a security freeze on your credit report, you will be provided a personal identification number or password to use if you choose to remove the freeze on your credit report or authorize the release of your credit report for a period of time or for a specific party after the freeze is in place. To provide that authorization you must contact the consumer reporting agency and provide all of the following:1\n\nThe personal identification number or password;2\n\nProper identification to verify your identity; and3\n\nThe proper information regarding the period of time or the specific party for which the report shall be available.\n\t\t\t\tA consumer reporting agency must authorize the release of your credit report no later than three business days after receiving the above information. A consumer credit reporting agency must authorize the release of your credit report no later than 15 minutes after receiving the request.\n\t\t\t\tA security freeze does not apply to a person or entity, or its affiliates, or collection agencies acting on behalf of the person or entity, with which you have an existing account, that requests information in your credit report for the purposes of reviewing or collecting the account. Reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.\n\t\t\t\tYou have a right to bring civil action against anyone, including a consumer reporting agency, who improperly obtains access to a file, knowingly or willfully misuses file data, or fails to correct inaccurate file data.\n\t\t\t\tA consumer reporting agency does not have the right to charge you a fee to place a freeze on your credit report.&#8221;Q\n\nAny person who willfully fails to comply with any requirement imposed under this section or \u00a7 59.1-444.3 with respect to any consumer is liable to that consumer in an amount equal to the sum of:1\n\nAny actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000;2\n\nSuch amount of punitive damages as the court may allow; and3\n\nIn the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney fees as determined by the court.R\n\nAny person who obtains a consumer report, requests a security freeze, requests the temporary lift of a freeze, or requests the removal of a security freeze from a consumer reporting agency under false pretenses or in an attempt to violate federal or state law shall be liable to the consumer reporting agency for actual damages sustained by the consumer reporting agency or $1,000, whichever is greater.S\n\nAny person who is negligent in failing to comply with any requirement imposed under this section with respect to any consumer is liable to that consumer in an amount equal to the sum of:1\n\nAny actual damages sustained by the consumer as a result of the failure; and2\n\nIn the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney fees as determined by the court.T\n\nUpon a finding by the court that an unsuccessful pleading, motion, or other paper filed in connection with an action under this section was filed in bad faith or for purposes of harassment, the court shall award to the prevailing party attorney fees reasonable in relation to the work expended in responding to the pleading, motion, or other paper.U\n\nNotwithstanding any other provision of law:1\n\nThe exclusive authority to bring an action for any violation of subdivision F 1 b shall be with the Attorney General. In any action brought under this subsection, the Attorney General may cause an action to be brought in the name of the Commonwealth to enjoin the violation and to recover damages for aggrieved consumers consistent with the limits stated in subsections Q and S for such violations.2\n\nIn any action brought under this subsection, if the court finds a willful violation, the court may, in its discretion, also award a civil penalty of not more than $1,000 per violation, to be deposited in the Literary Fund of the Commonwealth.3\n\nIn any action brought under this subsection, the Attorney General may recover any costs, the reasonable expenses incurred in investigating and preparing the case, and attorney fees.","order_by":null,"text":{"0":{"id":275498,"text":"As used in this section, &#8220;security freeze&#8221; means a notice placed in a consumer&#8217;s credit report, at the request of the consumer and subject to certain exceptions, that prohibits the consumer reporting agency from releasing the consumer&#8217;s credit report or score relating to the extension of credit.","type":"section","prefixes":["A"],"prefix":"A","entire_prefix":"A","prefix_anchor":"A","level":1,"next_prefix":"B"},"1":{"id":275499,"text":"A consumer may request that a security freeze be placed on his or her credit report by sending a request in writing by certified mail, or such other secure method authorized by a consumer reporting agency, to a consumer reporting agency at an address designated by the consumer reporting agency to receive such requests. This subsection does not prevent a consumer reporting agency from advising a third party that a security freeze is in effect with respect to the consumer&#8217;s credit report.","type":"section","prefixes":["B"],"prefix":"B","entire_prefix":"B","prefix_anchor":"B","level":1,"prior_prefix":"A","next_prefix":"C"},"2":{"id":275500,"text":"A consumer reporting agency shall place a security freeze on a consumer&#8217;s credit report no later than three business days after receiving from the consumer:","type":"section","prefixes":["C"],"prefix":"C","entire_prefix":"C","prefix_anchor":"C","level":1,"prior_prefix":"B","next_prefix":"C1"},"3":{"id":275501,"text":"A written request described in subsection B; and","type":"section","prefixes":["C","1"],"prefix":"1","entire_prefix":"C1","prefix_anchor":"C1","level":2,"prior_prefix":"C","next_prefix":"C2"},"4":{"id":275502,"text":"Proper identification.\n\t\t\t\tA consumer reporting agency shall place a security freeze on a consumer&#8217;s credit report no later than one business day after receiving such a request, if such request is made electronically at an address designated by the consumer reporting agency to receive such requests.","type":"section","prefixes":["C","2"],"prefix":"2","entire_prefix":"C2","prefix_anchor":"C2","level":2,"prior_prefix":"C1","next_prefix":"D"},"5":{"id":275503,"text":"The consumer reporting agency shall send a written confirmation of the placement of the security freeze to the consumer within 10 business days. Upon placing the security freeze on the consumer&#8217;s credit report, the consumer reporting agency shall provide the consumer with a unique personal identification number or password, or similar device to be used by the consumer when providing authorization for the release of his credit report for a specific period of time or for a specific party.","type":"section","prefixes":["D"],"prefix":"D","entire_prefix":"D","prefix_anchor":"D","level":1,"prior_prefix":"C2","next_prefix":"E"},"6":{"id":275504,"text":"If the consumer wishes to allow his credit report to be accessed for a specific period of time or for a specific party while a freeze is in place, he shall contact the consumer reporting agency using a point of contact designated by the consumer reporting agency, request that the freeze be temporarily lifted, and provide the following:","type":"section","prefixes":["E"],"prefix":"E","entire_prefix":"E","prefix_anchor":"E","level":1,"prior_prefix":"D","next_prefix":"E1"},"7":{"id":275505,"text":"Proper identification;","type":"section","prefixes":["E","1"],"prefix":"1","entire_prefix":"E1","prefix_anchor":"E1","level":2,"prior_prefix":"E","next_prefix":"E2"},"8":{"id":275506,"text":"The unique personal identification number or password provided by the consumer reporting agency pursuant to subsection D; and","type":"section","prefixes":["E","2"],"prefix":"2","entire_prefix":"E2","prefix_anchor":"E2","level":2,"prior_prefix":"E1","next_prefix":"E3"},"9":{"id":275507,"text":"The proper information regarding the time period or the specific party for which the report shall be available to users of the credit report.","type":"section","prefixes":["E","3"],"prefix":"3","entire_prefix":"E3","prefix_anchor":"E3","level":2,"prior_prefix":"E2","next_prefix":"F"},"10":{"id":275508,"text":"A consumer reporting agency:","type":"section","prefixes":["F"],"prefix":"F","entire_prefix":"F","prefix_anchor":"F","level":1,"prior_prefix":"E3","next_prefix":"F1"},"11":{"id":275509,"text":"Shall comply with a request made under subsection E:\n\t\t\t\ta. Within three business days after receiving the request if the request is made at a postal address designated by the agency to receive such requests; or\n\t\t\t\tb. Within 15 minutes after the consumer&#8217;s request is received by the consumer reporting agency through the electronic contact method chosen by the consumer reporting agency in accordance with this section;","type":"section","prefixes":["F","1"],"prefix":"1","entire_prefix":"F1","prefix_anchor":"F1","level":2,"prior_prefix":"F","next_prefix":"F2"},"12":{"id":275510,"text":"Is not required to temporarily lift a security freeze within the time provided in subdivision 1 b if:\n\t\t\t\ta. The consumer fails to meet the requirements of subsection E; or\n\t\t\t\tb. The consumer reporting agency&#8217;s ability to temporarily lift the security freeze within 15 minutes is prevented by:","type":"section","prefixes":["F","2"],"prefix":"2","entire_prefix":"F2","prefix_anchor":"F2","level":2,"prior_prefix":"F1","next_prefix":"F21"},"13":{"id":275511,"text":"An act of God, including fire, earthquakes, hurricanes, storms, or similar natural disaster or phenomena;","type":"section","prefixes":["F","2","1"],"prefix":"1","entire_prefix":"F21","prefix_anchor":"F21","level":3,"prior_prefix":"F2","next_prefix":"F22"},"14":{"id":275512,"text":"Unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrence;","type":"section","prefixes":["F","2","2"],"prefix":"2","entire_prefix":"F22","prefix_anchor":"F22","level":3,"prior_prefix":"F21","next_prefix":"F23"},"15":{"id":275513,"text":"Operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruption;","type":"section","prefixes":["F","2","3"],"prefix":"3","entire_prefix":"F23","prefix_anchor":"F23","level":3,"prior_prefix":"F22","next_prefix":"F24"},"16":{"id":275514,"text":"Governmental action, including emergency orders or regulations, judicial or law-enforcement action, or similar directives;","type":"section","prefixes":["F","2","4"],"prefix":"4","entire_prefix":"F24","prefix_anchor":"F24","level":3,"prior_prefix":"F23","next_prefix":"F25"},"17":{"id":275515,"text":"Regularly scheduled maintenance, during other than normal business hours, of, or updates to, the consumer reporting agency&#8217;s systems; or","type":"section","prefixes":["F","2","5"],"prefix":"5","entire_prefix":"F25","prefix_anchor":"F25","level":3,"prior_prefix":"F24","next_prefix":"F26"},"18":{"id":275516,"text":"Commercially reasonable maintenance of, or repair to, the consumer reporting agency&#8217;s systems that is unexpected or unscheduled; and","type":"section","prefixes":["F","2","6"],"prefix":"6","entire_prefix":"F26","prefix_anchor":"F26","level":3,"prior_prefix":"F25","next_prefix":"F3"},"19":{"id":275517,"text":"May develop procedures involving the use of telephone, fax, the Internet, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze on a credit report pursuant to subsection E in an expedited manner.","type":"section","prefixes":["F","3"],"prefix":"3","entire_prefix":"F3","prefix_anchor":"F3","level":2,"prior_prefix":"F26","next_prefix":"G"},"20":{"id":275518,"text":"A consumer reporting agency shall remove or temporarily lift a freeze placed on a consumer&#8217;s credit report only in the following cases:","type":"section","prefixes":["G"],"prefix":"G","entire_prefix":"G","prefix_anchor":"G","level":1,"prior_prefix":"F3","next_prefix":"G1"},"21":{"id":275519,"text":"Upon a consumer request, pursuant to subsection E or subsection J; or","type":"section","prefixes":["G","1"],"prefix":"1","entire_prefix":"G1","prefix_anchor":"G1","level":2,"prior_prefix":"G","next_prefix":"G2"},"22":{"id":275520,"text":"If the consumer&#8217;s credit report was frozen due to a material misrepresentation of fact by the consumer. If a consumer reporting agency intends to remove a freeze upon a consumer&#8217;s credit report pursuant to this subdivision, the consumer reporting agency shall notify the consumer in writing prior to removing the freeze on the consumer&#8217;s credit report.","type":"section","prefixes":["G","2"],"prefix":"2","entire_prefix":"G2","prefix_anchor":"G2","level":2,"prior_prefix":"G1","next_prefix":"H"},"23":{"id":275521,"text":"If a third party requests access to a consumer credit report on which a security freeze is in effect, and this request is in connection with an application for credit or any other use, and the consumer does not allow his or her credit report to be accessed for that period of time, the third party may treat the application as incomplete.","type":"section","prefixes":["H"],"prefix":"H","entire_prefix":"H","prefix_anchor":"H","level":1,"prior_prefix":"G2","next_prefix":"I"},"24":{"id":275522,"text":"If a consumer requests a security freeze, the consumer reporting agency shall disclose the process of placing and temporarily lifting a freeze and the process for allowing access to information from the consumer&#8217;s credit report for a period of time while the freeze is in place.","type":"section","prefixes":["I"],"prefix":"I","entire_prefix":"I","prefix_anchor":"I","level":1,"prior_prefix":"H","next_prefix":"J"},"25":{"id":275523,"text":"A security freeze shall remain in place until the consumer requests, using a point of contact designated by the consumer reporting agency, that the security freeze be removed. A consumer reporting agency shall remove a security freeze within three business days of receiving a request for removal from the consumer, who provides:","type":"section","prefixes":["J"],"prefix":"J","entire_prefix":"J","prefix_anchor":"J","level":1,"prior_prefix":"I","next_prefix":"J1"},"26":{"id":275524,"text":"Proper identification; and","type":"section","prefixes":["J","1"],"prefix":"1","entire_prefix":"J1","prefix_anchor":"J1","level":2,"prior_prefix":"J","next_prefix":"J2"},"27":{"id":275525,"text":"The unique personal identification number or password or similar device provided by the consumer reporting agency pursuant to subsection D.","type":"section","prefixes":["J","2"],"prefix":"2","entire_prefix":"J2","prefix_anchor":"J2","level":2,"prior_prefix":"J1","next_prefix":"K"},"28":{"id":275526,"text":"A consumer reporting agency shall require proper identification of the person making a request to place or remove a security freeze.","type":"section","prefixes":["K"],"prefix":"K","entire_prefix":"K","prefix_anchor":"K","level":1,"prior_prefix":"J2","next_prefix":"L"},"29":{"id":275527,"text":"The provisions of this section do not apply to the use of a consumer credit report by any of the following:","type":"section","prefixes":["L"],"prefix":"L","entire_prefix":"L","prefix_anchor":"L","level":1,"prior_prefix":"K","next_prefix":"L1"},"30":{"id":275528,"text":"A person or entity, or a subsidiary, affiliate, or agent of that person or entity, or an assignee of a financial obligation owing by the consumer to that person or entity, or a prospective assignee of a financial obligation owing by the consumer to that person or entity in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment an account or contract, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or negotiable instrument. For purposes of this paragraph, &#8220;reviewing the account&#8221; includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements;","type":"section","prefixes":["L","1"],"prefix":"1","entire_prefix":"L1","prefix_anchor":"L1","level":2,"prior_prefix":"L","next_prefix":"L2"},"31":{"id":275529,"text":"A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted for purposes of facilitating the extension of credit or other permissible use;","type":"section","prefixes":["L","2"],"prefix":"2","entire_prefix":"L2","prefix_anchor":"L2","level":2,"prior_prefix":"L1","next_prefix":"L3"},"32":{"id":275530,"text":"Any state or local agency, law-enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena;","type":"section","prefixes":["L","3"],"prefix":"3","entire_prefix":"L3","prefix_anchor":"L3","level":2,"prior_prefix":"L2","next_prefix":"L4"},"33":{"id":275531,"text":"A child support agency acting pursuant to Title IV-D of the Social Security Act (42 U.S.C. &#xA7; 654 et seq.);","type":"section","prefixes":["L","4"],"prefix":"4","entire_prefix":"L4","prefix_anchor":"L4","level":2,"prior_prefix":"L3","next_prefix":"L5"},"34":{"id":275532,"text":"The Commonwealth or its agents or assigns acting to investigate fraud or acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities provided such responsibilities are consistent with a permissible purpose under 15 U.S.C. &#xA7; 1681b;","type":"section","prefixes":["L","5"],"prefix":"5","entire_prefix":"L5","prefix_anchor":"L5","level":2,"prior_prefix":"L4","next_prefix":"L6"},"35":{"id":275533,"text":"The use of credit information for the purposes of prescreening or postscreening as provided for by the federal Fair Credit Reporting Act;","type":"section","prefixes":["L","6"],"prefix":"6","entire_prefix":"L6","prefix_anchor":"L6","level":2,"prior_prefix":"L5","next_prefix":"L7"},"36":{"id":275534,"text":"Any person or entity administering a credit file monitoring subscription or similar service to which the consumer has subscribed;","type":"section","prefixes":["L","7"],"prefix":"7","entire_prefix":"L7","prefix_anchor":"L7","level":2,"prior_prefix":"L6","next_prefix":"L8"},"37":{"id":275535,"text":"Any person or entity for the purpose of providing a consumer with a copy of his credit report or score upon the consumer&#8217;s request;","type":"section","prefixes":["L","8"],"prefix":"8","entire_prefix":"L8","prefix_anchor":"L8","level":2,"prior_prefix":"L7","next_prefix":"L9"},"38":{"id":275536,"text":"Any person or entity for use in setting or adjusting a rate, adjusting a claim, or underwriting for insurance purposes; or","type":"section","prefixes":["L","9"],"prefix":"9","entire_prefix":"L9","prefix_anchor":"L9","level":2,"prior_prefix":"L8","next_prefix":"L10"},"39":{"id":275537,"text":"Any employer in connection with any application for employment with the employer.","type":"section","prefixes":["L","10"],"prefix":"10","entire_prefix":"L10","prefix_anchor":"L10","level":2,"prior_prefix":"L9","next_prefix":"M"},"40":{"id":275538,"text":"A consumer reporting agency shall not charge a fee for any service performed under this section.","type":"section","prefixes":["M"],"prefix":"M","entire_prefix":"M","prefix_anchor":"M","level":1,"prior_prefix":"L10","next_prefix":"N"},"41":{"id":275539,"text":"If a security freeze is in place, a consumer reporting agency shall not change any of the following official information in a consumer credit report without sending a written confirmation of the change to the consumer within 30 days of the change being posted to the consumer&#8217;s file: name, date of birth, social security number, and address. Written confirmation is not required for technical modifications of a consumer&#8217;s official information, including name and street abbreviations, complete spellings, or transposition of numbers or letters. In the case of an address change, the written confirmation shall be sent to both the new address and to the former address.","type":"section","prefixes":["N"],"prefix":"N","entire_prefix":"N","prefix_anchor":"N","level":1,"prior_prefix":"M","next_prefix":"O"},"42":{"id":275540,"text":"The following entities are not required to place a security freeze on a credit report:","type":"section","prefixes":["O"],"prefix":"O","entire_prefix":"O","prefix_anchor":"O","level":1,"prior_prefix":"N","next_prefix":"O1"},"43":{"id":275541,"text":"A consumer reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer reporting agency or multiple consumer credit reporting agencies, and does not maintain a permanent database of credit information from which new consumer credit reports are produced. However, a consumer reporting agency acting as a reseller shall honor any security freeze placed on a consumer credit report by another consumer reporting agency;","type":"section","prefixes":["O","1"],"prefix":"1","entire_prefix":"O1","prefix_anchor":"O1","level":2,"prior_prefix":"O","next_prefix":"O2"},"44":{"id":275542,"text":"A check services or fraud prevention services company, which issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments;","type":"section","prefixes":["O","2"],"prefix":"2","entire_prefix":"O2","prefix_anchor":"O2","level":2,"prior_prefix":"O1","next_prefix":"O3"},"45":{"id":275543,"text":"A deposit account information service company, which issues reports regarding account closures due to fraud, substantial overdrafts, ATM abuse, or similar negative information regarding a consumer, to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution; and","type":"section","prefixes":["O","3"],"prefix":"3","entire_prefix":"O3","prefix_anchor":"O3","level":2,"prior_prefix":"O2","next_prefix":"O4"},"46":{"id":275544,"text":"A consumer reporting agency&#8217;s database or file that consists of information concerning, and used for, one or more of the following: criminal record information, fraud prevention or detection, personal loss history information, and employment, tenant, or background screening.","type":"section","prefixes":["O","4"],"prefix":"4","entire_prefix":"O4","prefix_anchor":"O4","level":2,"prior_prefix":"O3","next_prefix":"P"},"47":{"id":275545,"text":"At any time a consumer is required to receive a summary of rights required under 15 U.S.C. \u00a7 1681g(d), the following notice shall be included:\n\t\t\t&#8220;Virginia Consumers Have the Right to Obtain a Security Freeze.\n\t\t\tYou have a right to place a &#8220;security freeze&#8221; on your credit report, which will prohibit a consumer reporting agency from releasing information in your credit report without your express authorization. A security freeze must be requested in writing by certified mail. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, government services or payments, rental housing, employment, investment, license, cellular phone, utilities, digital signature, Internet credit card transaction, or other services, including an extension of credit at point of sale. When you place a security freeze on your credit report, you will be provided a personal identification number or password to use if you choose to remove the freeze on your credit report or authorize the release of your credit report for a period of time or for a specific party after the freeze is in place. To provide that authorization you must contact the consumer reporting agency and provide all of the following:","type":"section","prefixes":["P"],"prefix":"P","entire_prefix":"P","prefix_anchor":"P","level":1,"prior_prefix":"O4","next_prefix":"P1"},"48":{"id":275546,"text":"The personal identification number or password;","type":"section","prefixes":["P","1"],"prefix":"1","entire_prefix":"P1","prefix_anchor":"P1","level":2,"prior_prefix":"P","next_prefix":"P2"},"49":{"id":275547,"text":"Proper identification to verify your identity; and","type":"section","prefixes":["P","2"],"prefix":"2","entire_prefix":"P2","prefix_anchor":"P2","level":2,"prior_prefix":"P1","next_prefix":"P3"},"50":{"id":275548,"text":"The proper information regarding the period of time or the specific party for which the report shall be available.\n\t\t\t\tA consumer reporting agency must authorize the release of your credit report no later than three business days after receiving the above information. A consumer credit reporting agency must authorize the release of your credit report no later than 15 minutes after receiving the request.\n\t\t\t\tA security freeze does not apply to a person or entity, or its affiliates, or collection agencies acting on behalf of the person or entity, with which you have an existing account, that requests information in your credit report for the purposes of reviewing or collecting the account. Reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.\n\t\t\t\tYou have a right to bring civil action against anyone, including a consumer reporting agency, who improperly obtains access to a file, knowingly or willfully misuses file data, or fails to correct inaccurate file data.\n\t\t\t\tA consumer reporting agency does not have the right to charge you a fee to place a freeze on your credit report.&#8221;","type":"section","prefixes":["P","3"],"prefix":"3","entire_prefix":"P3","prefix_anchor":"P3","level":2,"prior_prefix":"P2","next_prefix":"Q"},"51":{"id":275549,"text":"Any person who willfully fails to comply with any requirement imposed under this section or \u00a7 59.1-444.3 with respect to any consumer is liable to that consumer in an amount equal to the sum of:","type":"section","prefixes":["Q"],"prefix":"Q","entire_prefix":"Q","prefix_anchor":"Q","level":1,"prior_prefix":"P3","next_prefix":"Q1"},"52":{"id":275550,"text":"Any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000;","type":"section","prefixes":["Q","1"],"prefix":"1","entire_prefix":"Q1","prefix_anchor":"Q1","level":2,"prior_prefix":"Q","next_prefix":"Q2"},"53":{"id":275551,"text":"Such amount of punitive damages as the court may allow; and","type":"section","prefixes":["Q","2"],"prefix":"2","entire_prefix":"Q2","prefix_anchor":"Q2","level":2,"prior_prefix":"Q1","next_prefix":"Q3"},"54":{"id":275552,"text":"In the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney fees as determined by the court.","type":"section","prefixes":["Q","3"],"prefix":"3","entire_prefix":"Q3","prefix_anchor":"Q3","level":2,"prior_prefix":"Q2","next_prefix":"R"},"55":{"id":275553,"text":"Any person who obtains a consumer report, requests a security freeze, requests the temporary lift of a freeze, or requests the removal of a security freeze from a consumer reporting agency under false pretenses or in an attempt to violate federal or state law shall be liable to the consumer reporting agency for actual damages sustained by the consumer reporting agency or $1,000, whichever is greater.","type":"section","prefixes":["R"],"prefix":"R","entire_prefix":"R","prefix_anchor":"R","level":1,"prior_prefix":"Q3","next_prefix":"S"},"56":{"id":275554,"text":"Any person who is negligent in failing to comply with any requirement imposed under this section with respect to any consumer is liable to that consumer in an amount equal to the sum of:","type":"section","prefixes":["S"],"prefix":"S","entire_prefix":"S","prefix_anchor":"S","level":1,"prior_prefix":"R","next_prefix":"S1"},"57":{"id":275555,"text":"Any actual damages sustained by the consumer as a result of the failure; and","type":"section","prefixes":["S","1"],"prefix":"1","entire_prefix":"S1","prefix_anchor":"S1","level":2,"prior_prefix":"S","next_prefix":"S2"},"58":{"id":275556,"text":"In the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney fees as determined by the court.","type":"section","prefixes":["S","2"],"prefix":"2","entire_prefix":"S2","prefix_anchor":"S2","level":2,"prior_prefix":"S1","next_prefix":"T"},"59":{"id":275557,"text":"Upon a finding by the court that an unsuccessful pleading, motion, or other paper filed in connection with an action under this section was filed in bad faith or for purposes of harassment, the court shall award to the prevailing party attorney fees reasonable in relation to the work expended in responding to the pleading, motion, or other paper.","type":"section","prefixes":["T"],"prefix":"T","entire_prefix":"T","prefix_anchor":"T","level":1,"prior_prefix":"S2","next_prefix":"U"},"60":{"id":275558,"text":"Notwithstanding any other provision of law:","type":"section","prefixes":["U"],"prefix":"U","entire_prefix":"U","prefix_anchor":"U","level":1,"prior_prefix":"T","next_prefix":"U1"},"61":{"id":275559,"text":"The exclusive authority to bring an action for any violation of subdivision F 1 b shall be with the Attorney General. In any action brought under this subsection, the Attorney General may cause an action to be brought in the name of the Commonwealth to enjoin the violation and to recover damages for aggrieved consumers consistent with the limits stated in subsections Q and S for such violations.","type":"section","prefixes":["U","1"],"prefix":"1","entire_prefix":"U1","prefix_anchor":"U1","level":2,"prior_prefix":"U","next_prefix":"U2"},"62":{"id":275560,"text":"In any action brought under this subsection, if the court finds a willful violation, the court may, in its discretion, also award a civil penalty of not more than $1,000 per violation, to be deposited in the Literary Fund of the Commonwealth.","type":"section","prefixes":["U","2"],"prefix":"2","entire_prefix":"U2","prefix_anchor":"U2","level":2,"prior_prefix":"U1","next_prefix":"U3"},"63":{"id":275561,"text":"In any action brought under this subsection, the Attorney General may recover any costs, the reasonable expenses incurred in investigating and preparing the case, and attorney fees.","type":"section","prefixes":["U","3"],"prefix":"3","entire_prefix":"U3","prefix_anchor":"U3","level":2,"prior_prefix":"U2"}},"ancestry":[{"id":16371,"edition_id":1,"name":"Consumer Reporting Agencies","identifier":"35.1","label":"chapter","depth":2,"order_by":1,"parent_id":12809,"metadata":{},"date_created":"2026-06-26 04:15:27","date_modified":"2026-06-26 04:15:27","permalink":{"id":261549,"object_type":"structure","relational_id":16371,"identifier":"35.1","token":"59.1\/35.1","url":"\/59.1\/35.1\/","edition_id":1,"permalink":0,"preferred":1}},{"id":12809,"edition_id":1,"name":"Trade and Commerce","identifier":"59.1","label":"title","depth":1,"order_by":1,"parent_id":null,"metadata":{},"date_created":"2026-06-26 03:43:54","date_modified":"2026-06-26 03:43:54","permalink":{"id":259521,"object_type":"structure","relational_id":12809,"identifier":"59.1","token":"59.1","url":"\/59.1\/","edition_id":1,"permalink":0,"preferred":1}}],"structure_contents":[{"id":72869,"structure_id":16371,"section_number":"59.1-444.1","catch_line":"Definitions","url":"\/59.1-444.1\/","token":"59.1\/35.1\/59.1-444.1","metadata":false},{"id":76739,"structure_id":16371,"section_number":"59.1-444.2","catch_line":"Security freezes","url":"\/59.1-444.2\/","token":"59.1\/35.1\/59.1-444.2","metadata":false},{"id":67425,"structure_id":16371,"section_number":"59.1-444.3","catch_line":"Security freezes for protected consumers","url":"\/59.1-444.3\/","token":"59.1\/35.1\/59.1-444.3","metadata":false},{"id":76508,"structure_id":16371,"section_number":"59.1-444.4","catch_line":"Reporting of medical debt prohibited; civil penalty","url":"\/59.1-444.4\/","token":"59.1\/35.1\/59.1-444.4","metadata":false}],"previous_section":{"id":72869,"structure_id":16371,"section_number":"59.1-444.1","catch_line":"Definitions","url":"\/59.1-444.1\/","token":"59.1\/35.1\/59.1-444.1","metadata":false},"next_section":{"id":67425,"structure_id":16371,"section_number":"59.1-444.3","catch_line":"Security freezes for protected consumers","url":"\/59.1-444.3\/","token":"59.1\/35.1\/59.1-444.3","metadata":false},"metadata":false,"official_url":"https:\/\/law.lis.virginia.gov\/vacode\/59.1-444.2\/","history_text":"<p>This law was first created in 2008. The record of its establishment is cataloged in chapters <a href=\"https:\/\/legacylis.virginia.gov\/cgi-bin\/legp604.exe?081+ful+CHAP0480\">480<\/a> and <a href=\"https:\/\/legacylis.virginia.gov\/cgi-bin\/legp604.exe?081+ful+CHAP0496\">496<\/a> of that year\u2019s edition of \u201cActs of Assembly,\u201d the annual state publication listing all changes made to the Code of Virginia in that year. It has been modified 4 times. Those modifications are cataloged by \u201cThe Acts of Assembly,\u201d a state publication, by year and chapter. Those modifications that can be read on the General Assembly\u2019s website will be linked accordingly. Those modifications are as follows: in 2009, chapter <a href=\"https:\/\/legacylis.virginia.gov\/cgi-bin\/legp604.exe?091+ful+CHAP0406\">406<\/a>; in 2014, chapter <a href=\"https:\/\/legacylis.virginia.gov\/cgi-bin\/legp604.exe?141+ful+CHAP0570\">570<\/a>; in 2018, chapters <a href=\"https:\/\/legacylis.virginia.gov\/cgi-bin\/legp604.exe?181+ful+CHAP0264\">264<\/a> and <a href=\"https:\/\/legacylis.virginia.gov\/cgi-bin\/legp604.exe?181+ful+CHAP0303\">303<\/a>; in 2020, chapter <a href=\"https:\/\/legacylis.virginia.gov\/cgi-bin\/legp604.exe?201+ful+CHAP0243\">243<\/a>.<\/p>","references":false,"refers_to":[{"id":67425,"section_number":"59.1-444.3","catch_line":"Security freezes for protected consumers","order_by":null,"url":"\/59.1-444.3\/"}],"permalink":{"id":261555,"object_type":"law","relational_id":76739,"identifier":"59.1-444.2","token":"59.1\/35.1\/59.1-444.2","url":"\/59.1-444.2\/","edition_id":1,"permalink":0,"preferred":1},"url":"\/59.1-444.2\/","token":"59.1\/35.1\/59.1-444.2","dublin_core":{"Title":"Security freezes","Type":"Text","Format":"text\/html","Identifier":"\u00a7 59.1-444.2","Relation":"Code of Virginia"},"html":"\n\t\t\t\t\t\t<section id=\"A\"><p><span class=\"prefix-number\">A.<\/span> As used in this section, &#8220;<span class=\"dictionary\">security freeze<\/span>&#8221; means a notice placed in a consumer&#8217;s <span class=\"dictionary\">credit report<\/span>, at the request of the consumer and subject to certain exceptions, that prohibits the <span class=\"dictionary\">consumer reporting agency<\/span> from releasing the consumer&#8217;s <span class=\"dictionary\">credit report<\/span> or score relating to the extension of credit. <a id=\"paragraph-275498\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#A\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"B\"><p><span class=\"prefix-number\">B.<\/span> A consumer may request that a <span class=\"dictionary\">security freeze<\/span> be placed on his or her <span class=\"dictionary\">credit report<\/span> by sending a request in writing by certified mail, or such other secure method authorized by a <span class=\"dictionary\">consumer reporting agency<\/span>, to a <span class=\"dictionary\">consumer reporting agency<\/span> at an address designated by the <span class=\"dictionary\">consumer reporting agency<\/span> to receive such requests. This subsection does not prevent a <span class=\"dictionary\">consumer reporting agency<\/span> from advising a third <span class=\"dictionary\">party<\/span> that a <span class=\"dictionary\">security freeze<\/span> is in effect with respect to the consumer&#8217;s <span class=\"dictionary\">credit report<\/span>. <a id=\"paragraph-275499\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#B\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"C\"><p><span class=\"prefix-number\">C.<\/span> A <span class=\"dictionary\">consumer reporting agency<\/span> shall place a <span class=\"dictionary\">security freeze<\/span> on a consumer&#8217;s <span class=\"dictionary\">credit report<\/span> no later than three business days after receiving from the consumer: <a id=\"paragraph-275500\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#C\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"C1\" class=\"indent-1\"><p><span class=\"prefix-number\">1.<\/span> A written request described in subsection B; and <a id=\"paragraph-275501\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#C1\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"C2\" class=\"indent-1\"><p><span class=\"prefix-number\">2.<\/span> <span class=\"dictionary\">Proper identification<\/span>.\n\t\t\t\tA <span class=\"dictionary\">consumer reporting agency<\/span> shall place a <span class=\"dictionary\">security freeze<\/span> on a consumer&#8217;s <span class=\"dictionary\">credit report<\/span> no later than one business day after receiving such a request, if such request is made electronically at an address designated by the <span class=\"dictionary\">consumer reporting agency<\/span> to receive such requests. <a id=\"paragraph-275502\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#C2\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"D\"><p><span class=\"prefix-number\">D.<\/span> The <span class=\"dictionary\">consumer reporting agency<\/span> shall send a written confirmation of the placement of the <span class=\"dictionary\">security freeze<\/span> to the consumer within 10 business days. Upon placing the <span class=\"dictionary\">security freeze<\/span> on the consumer&#8217;s <span class=\"dictionary\">credit report<\/span>, the <span class=\"dictionary\">consumer reporting agency<\/span> shall provide the consumer with a unique personal identification number or password, or similar device to be used by the consumer when providing authorization for the release of his <span class=\"dictionary\">credit report<\/span> for a specific period of time or for a specific <span class=\"dictionary\">party<\/span>. <a id=\"paragraph-275503\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#D\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"E\"><p><span class=\"prefix-number\">E.<\/span> If the consumer wishes to allow his <span class=\"dictionary\">credit report<\/span> to be accessed for a specific period of time or for a specific <span class=\"dictionary\">party<\/span> while a freeze is in place, he shall contact the <span class=\"dictionary\">consumer reporting agency<\/span> using a point of contact designated by the <span class=\"dictionary\">consumer reporting agency<\/span>, request that the freeze be temporarily lifted, and provide the following: <a id=\"paragraph-275504\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#E\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"E1\" class=\"indent-1\"><p><span class=\"prefix-number\">1.<\/span> <span class=\"dictionary\">Proper identification<\/span>; <a id=\"paragraph-275505\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#E1\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"E2\" class=\"indent-1\"><p><span class=\"prefix-number\">2.<\/span> The unique personal identification number or password provided by the <span class=\"dictionary\">consumer reporting agency<\/span> pursuant to subsection D; and <a id=\"paragraph-275506\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#E2\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"E3\" class=\"indent-1\"><p><span class=\"prefix-number\">3.<\/span> The proper information regarding the time period or the specific <span class=\"dictionary\">party<\/span> for which the report shall be available to users of the <span class=\"dictionary\">credit report<\/span>. <a id=\"paragraph-275507\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#E3\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"F\"><p><span class=\"prefix-number\">F.<\/span> A <span class=\"dictionary\">consumer reporting agency<\/span>: <a id=\"paragraph-275508\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#F\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"F1\" class=\"indent-1\"><p><span class=\"prefix-number\">1.<\/span> Shall comply with a request made under subsection E:\n\t\t\t\ta. Within three business days after receiving the request if the request is made at a postal address designated by the agency to receive such requests; or\n\t\t\t\tb. Within 15 minutes after the consumer&#8217;s request is received by the <span class=\"dictionary\">consumer reporting agency<\/span> through the electronic contact method chosen by the <span class=\"dictionary\">consumer reporting agency<\/span> in accordance with this section; <a id=\"paragraph-275509\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#F1\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"F2\" class=\"indent-1\"><p><span class=\"prefix-number\">2.<\/span> Is not required to temporarily lift a <span class=\"dictionary\">security freeze<\/span> within the time provided in subdivision 1 b if:\n\t\t\t\ta. The consumer fails to meet the requirements of subsection E; or\n\t\t\t\tb. The <span class=\"dictionary\">consumer reporting agency<\/span>&#8217;s ability to temporarily lift the <span class=\"dictionary\">security freeze<\/span> within 15 minutes is prevented by: <a id=\"paragraph-275510\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#F2\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"F21\" class=\"indent-2\"><p><span class=\"prefix-number\">1.<\/span> An act of God, including fire, earthquakes, hurricanes, storms, or similar natural disaster or phenomena; <a id=\"paragraph-275511\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#F21\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"F22\" class=\"indent-2\"><p><span class=\"prefix-number\">2.<\/span> Unauthorized or illegal acts by a third <span class=\"dictionary\">party<\/span>, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrence; <a id=\"paragraph-275512\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#F22\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"F23\" class=\"indent-2\"><p><span class=\"prefix-number\">3.<\/span> Operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruption; <a id=\"paragraph-275513\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#F23\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"F24\" class=\"indent-2\"><p><span class=\"prefix-number\">4.<\/span> Governmental action, including emergency <span class=\"dictionary\">orders<\/span> or regulations, judicial or <span class=\"dictionary\">law<\/span>-enforcement action, or similar directives; <a id=\"paragraph-275514\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#F24\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"F25\" class=\"indent-2\"><p><span class=\"prefix-number\">5.<\/span> Regularly scheduled maintenance, during other than normal business hours, of, or updates to, the <span class=\"dictionary\">consumer reporting agency<\/span>&#8217;s systems; or <a id=\"paragraph-275515\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#F25\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"F26\" class=\"indent-2\"><p><span class=\"prefix-number\">6.<\/span> Commercially reasonable maintenance of, or repair to, the <span class=\"dictionary\">consumer reporting agency<\/span>&#8217;s systems that is unexpected or unscheduled; and <a id=\"paragraph-275516\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#F26\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"F3\" class=\"indent-1\"><p><span class=\"prefix-number\">3.<\/span> May develop procedures involving the use of telephone, fax, the Internet, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze on a <span class=\"dictionary\">credit report<\/span> pursuant to subsection E in an expedited manner. <a id=\"paragraph-275517\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#F3\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"G\"><p><span class=\"prefix-number\">G.<\/span> A <span class=\"dictionary\">consumer reporting agency<\/span> shall remove or temporarily lift a freeze placed on a consumer&#8217;s <span class=\"dictionary\">credit report<\/span> only in the following cases: <a id=\"paragraph-275518\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#G\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"G1\" class=\"indent-1\"><p><span class=\"prefix-number\">1.<\/span> Upon a consumer request, pursuant to subsection E or subsection J; or <a id=\"paragraph-275519\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#G1\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"G2\" class=\"indent-1\"><p><span class=\"prefix-number\">2.<\/span> If the consumer&#8217;s <span class=\"dictionary\">credit report<\/span> was frozen due to a <span class=\"dictionary\">material<\/span> misrepresentation of <span class=\"dictionary\">fact<\/span> by the consumer. If a <span class=\"dictionary\">consumer reporting agency<\/span> intends to remove a freeze upon a consumer&#8217;s <span class=\"dictionary\">credit report<\/span> pursuant to this subdivision, the <span class=\"dictionary\">consumer reporting agency<\/span> shall notify the consumer in writing prior to removing the freeze on the consumer&#8217;s <span class=\"dictionary\">credit report<\/span>. <a id=\"paragraph-275520\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#G2\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"H\"><p><span class=\"prefix-number\">H.<\/span> If a third <span class=\"dictionary\">party<\/span> requests access to a consumer <span class=\"dictionary\">credit report<\/span> on which a <span class=\"dictionary\">security freeze<\/span> is in effect, and this request is in connection with an application for credit or any other use, and the consumer does not allow his or her <span class=\"dictionary\">credit report<\/span> to be accessed for that period of time, the third <span class=\"dictionary\">party<\/span> may treat the application as incomplete. <a id=\"paragraph-275521\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#H\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"I\"><p><span class=\"prefix-number\">I.<\/span> If a consumer requests a <span class=\"dictionary\">security freeze<\/span>, the <span class=\"dictionary\">consumer reporting agency<\/span> shall disclose the process of placing and temporarily lifting a freeze and the process for allowing access to information from the consumer&#8217;s <span class=\"dictionary\">credit report<\/span> for a period of time while the freeze is in place. <a id=\"paragraph-275522\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#I\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"J\"><p><span class=\"prefix-number\">J.<\/span> A <span class=\"dictionary\">security freeze<\/span> shall remain in place until the consumer requests, using a point of contact designated by the <span class=\"dictionary\">consumer reporting agency<\/span>, that the <span class=\"dictionary\">security freeze<\/span> be removed. A <span class=\"dictionary\">consumer reporting agency<\/span> shall remove a <span class=\"dictionary\">security freeze<\/span> within three business days of receiving a request for removal from the consumer, who provides: <a id=\"paragraph-275523\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#J\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"J1\" class=\"indent-1\"><p><span class=\"prefix-number\">1.<\/span> <span class=\"dictionary\">Proper identification<\/span>; and <a id=\"paragraph-275524\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#J1\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"J2\" class=\"indent-1\"><p><span class=\"prefix-number\">2.<\/span> The unique personal identification number or password or similar device provided by the <span class=\"dictionary\">consumer reporting agency<\/span> pursuant to subsection D. <a id=\"paragraph-275525\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#J2\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"K\"><p><span class=\"prefix-number\">K.<\/span> A <span class=\"dictionary\">consumer reporting agency<\/span> shall require <span class=\"dictionary\">proper identification<\/span> of the person making a request to place or remove a <span class=\"dictionary\">security freeze<\/span>. <a id=\"paragraph-275526\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#K\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"L\"><p><span class=\"prefix-number\">L.<\/span> The provisions of this section do not apply to the use of a consumer <span class=\"dictionary\">credit report<\/span> by any of the following: <a id=\"paragraph-275527\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#L\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"L1\" class=\"indent-1\"><p><span class=\"prefix-number\">1.<\/span> A person or entity, or a subsidiary, affiliate, or agent of that person or entity, or an assignee of a financial obligation owing by the consumer to that person or entity, or a prospective assignee of a financial obligation owing by the consumer to that person or entity in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment an account or <span class=\"dictionary\">contract<\/span>, including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of <span class=\"dictionary\">reviewing the account<\/span> or collecting the financial obligation owing for the account, <span class=\"dictionary\">contract<\/span>, or negotiable instrument. For purposes of this paragraph, &#8220;<span class=\"dictionary\">reviewing the account<\/span>&#8221; includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements; <a id=\"paragraph-275528\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#L1\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"L2\" class=\"indent-1\"><p><span class=\"prefix-number\">2.<\/span> A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted for purposes of facilitating the extension of credit or other permissible use; <a id=\"paragraph-275529\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#L2\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"L3\" class=\"indent-1\"><p><span class=\"prefix-number\">3.<\/span> Any state or local agency, <span class=\"dictionary\">law<\/span>-enforcement agency, <span class=\"dictionary\">trial<\/span> court, or private collection agency acting pursuant to a <span class=\"dictionary\">court order<\/span>, warrant, or <span class=\"dictionary\">subpoena<\/span>; <a id=\"paragraph-275530\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#L3\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"L4\" class=\"indent-1\"><p><span class=\"prefix-number\">4.<\/span> A child support agency acting pursuant to Title IV-D of the Social Security Act (42 U.S.C. &#xA7; 654 et seq.); <a id=\"paragraph-275531\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#L4\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"L5\" class=\"indent-1\"><p><span class=\"prefix-number\">5.<\/span> The Commonwealth or its agents or assigns acting to investigate <span class=\"dictionary\">fraud<\/span> or acting to investigate or collect delinquent taxes or unpaid <span class=\"dictionary\">court orders<\/span> or to fulfill any of its other statutory responsibilities provided such responsibilities are consistent with a permissible purpose under 15 U.S.C. &#xA7; 1681b; <a id=\"paragraph-275532\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#L5\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"L6\" class=\"indent-1\"><p><span class=\"prefix-number\">6.<\/span> The use of credit information for the purposes of prescreening or postscreening as provided for by the federal Fair Credit Reporting Act; <a id=\"paragraph-275533\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#L6\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"L7\" class=\"indent-1\"><p><span class=\"prefix-number\">7.<\/span> Any person or entity administering a credit file monitoring subscription or similar service to which the consumer has subscribed; <a id=\"paragraph-275534\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#L7\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"L8\" class=\"indent-1\"><p><span class=\"prefix-number\">8.<\/span> Any person or entity for the purpose of providing a consumer with a copy of his <span class=\"dictionary\">credit report<\/span> or score upon the consumer&#8217;s request; <a id=\"paragraph-275535\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#L8\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"L9\" class=\"indent-1\"><p><span class=\"prefix-number\">9.<\/span> Any person or entity for use in setting or adjusting a rate, adjusting a claim, or underwriting for insurance purposes; or <a id=\"paragraph-275536\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#L9\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"L10\" class=\"indent-1\"><p><span class=\"prefix-number\">10.<\/span> Any employer in connection with any application for employment with the employer. <a id=\"paragraph-275537\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#L10\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"M\"><p><span class=\"prefix-number\">M.<\/span> A <span class=\"dictionary\">consumer reporting agency<\/span> shall not charge a fee for any service performed under this section. <a id=\"paragraph-275538\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#M\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"N\"><p><span class=\"prefix-number\">N.<\/span> If a <span class=\"dictionary\">security freeze<\/span> is in place, a <span class=\"dictionary\">consumer reporting agency<\/span> shall not change any of the following official information in a consumer <span class=\"dictionary\">credit report<\/span> without sending a written confirmation of the change to the consumer within 30 days of the change being posted to the consumer&#8217;s file: name, date of birth, social security number, and address. Written confirmation is not required for technical modifications of a consumer&#8217;s official information, including name and street abbreviations, complete spellings, or transposition of numbers or letters. In the case of an address change, the written confirmation shall be sent to both the new address and to the former address. <a id=\"paragraph-275539\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#N\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"O\"><p><span class=\"prefix-number\">O.<\/span> The following entities are not required to place a <span class=\"dictionary\">security freeze<\/span> on a <span class=\"dictionary\">credit report<\/span>: <a id=\"paragraph-275540\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#O\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"O1\" class=\"indent-1\"><p><span class=\"prefix-number\">1.<\/span> A <span class=\"dictionary\">consumer reporting agency<\/span> that acts only as a reseller of credit information by assembling and merging information contained in the database of another <span class=\"dictionary\">consumer reporting agency<\/span> or multiple consumer credit reporting agencies, and does not maintain a permanent database of credit information from which new consumer <span class=\"dictionary\">credit reports<\/span> are produced. However, a <span class=\"dictionary\">consumer reporting agency<\/span> acting as a reseller shall honor any <span class=\"dictionary\">security freeze<\/span> placed on a consumer <span class=\"dictionary\">credit report<\/span> by another <span class=\"dictionary\">consumer reporting agency<\/span>; <a id=\"paragraph-275541\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#O1\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"O2\" class=\"indent-1\"><p><span class=\"prefix-number\">2.<\/span> A check services or <span class=\"dictionary\">fraud<\/span> prevention services company, which <span class=\"dictionary\">issues<\/span> reports on incidents of <span class=\"dictionary\">fraud<\/span> or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments; <a id=\"paragraph-275542\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#O2\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"O3\" class=\"indent-1\"><p><span class=\"prefix-number\">3.<\/span> A deposit account information service company, which <span class=\"dictionary\">issues<\/span> reports regarding account closures due to <span class=\"dictionary\">fraud<\/span>, substantial overdrafts, ATM abuse, or similar negative information regarding a consumer, to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution; and <a id=\"paragraph-275543\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#O3\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"O4\" class=\"indent-1\"><p><span class=\"prefix-number\">4.<\/span> A <span class=\"dictionary\">consumer reporting agency<\/span>&#8217;s database or file that consists of information concerning, and used for, one or more of the following: criminal record information, <span class=\"dictionary\">fraud<\/span> prevention or detection, personal loss history information, and employment, tenant, or background screening. <a id=\"paragraph-275544\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#O4\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"P\"><p><span class=\"prefix-number\">P.<\/span> At any time a consumer is required to receive a summary of rights required under 15 U.S.C. \u00a7&nbsp;1681g(d), the following notice shall be included:\n\t\t\t&#8220;Virginia <span class=\"dictionary\">Consumers<\/span> Have the Right to Obtain a <span class=\"dictionary\">Security Freeze<\/span>.\n\t\t\tYou have a right to place a &#8220;<span class=\"dictionary\">security freeze<\/span>&#8221; on your <span class=\"dictionary\">credit report<\/span>, which will prohibit a <span class=\"dictionary\">consumer reporting agency<\/span> from releasing information in your <span class=\"dictionary\">credit report<\/span> without your express authorization. A <span class=\"dictionary\">security freeze<\/span> must be requested in writing by certified mail. The <span class=\"dictionary\">security freeze<\/span> is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a <span class=\"dictionary\">security freeze<\/span> to take control over who gets access to the personal and financial information in your <span class=\"dictionary\">credit report<\/span> may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, government services or payments, rental housing, employment, investment, license, cellular phone, utilities, digital signature, Internet credit card transaction, or other services, including an extension of credit at point of sale. When you place a <span class=\"dictionary\">security freeze<\/span> on your <span class=\"dictionary\">credit report<\/span>, you will be provided a personal identification number or password to use if you choose to remove the freeze on your <span class=\"dictionary\">credit report<\/span> or authorize the release of your <span class=\"dictionary\">credit report<\/span> for a period of time or for a specific <span class=\"dictionary\">party<\/span> after the freeze is in place. To provide that authorization you must contact the <span class=\"dictionary\">consumer reporting agency<\/span> and provide all of the following: <a id=\"paragraph-275545\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#P\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"P1\" class=\"indent-1\"><p><span class=\"prefix-number\">1.<\/span> The personal identification number or password; <a id=\"paragraph-275546\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#P1\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"P2\" class=\"indent-1\"><p><span class=\"prefix-number\">2.<\/span> <span class=\"dictionary\">Proper identification<\/span> to verify your identity; and <a id=\"paragraph-275547\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#P2\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"P3\" class=\"indent-1\"><p><span class=\"prefix-number\">3.<\/span> The proper information regarding the period of time or the specific <span class=\"dictionary\">party<\/span> for which the report shall be available.\n\t\t\t\tA <span class=\"dictionary\">consumer reporting agency<\/span> must authorize the release of your <span class=\"dictionary\">credit report<\/span> no later than three business days after receiving the above information. A consumer credit reporting agency must authorize the release of your <span class=\"dictionary\">credit report<\/span> no later than 15 minutes after receiving the request.\n\t\t\t\tA <span class=\"dictionary\">security freeze<\/span> does not apply to a person or entity, or its affiliates, or collection agencies acting on behalf of the person or entity, with which you have an existing account, that requests information in your <span class=\"dictionary\">credit report<\/span> for the purposes of reviewing or collecting the account. <span class=\"dictionary\">Reviewing the account<\/span> includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.\n\t\t\t\tYou have a right to bring <span class=\"dictionary\">civil action<\/span> against anyone, including a <span class=\"dictionary\">consumer reporting agency<\/span>, who improperly obtains access to a file, knowingly or willfully misuses file data, or fails to correct inaccurate file data.\n\t\t\t\tA <span class=\"dictionary\">consumer reporting agency<\/span> does not have the right to charge you a fee to place a freeze on your <span class=\"dictionary\">credit report<\/span>.&#8221; <a id=\"paragraph-275548\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#P3\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"Q\"><p><span class=\"prefix-number\">Q.<\/span> Any person who willfully fails to comply with any requirement imposed under this section or \u00a7&nbsp;<a class=\"law\" title=\"Security freezes for protected consumers\" href=\"\/59.1-444.3\/\">59.1-444.3<\/a> with respect to any consumer is liable to that consumer in an amount equal to the sum of: <a id=\"paragraph-275549\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#Q\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"Q1\" class=\"indent-1\"><p><span class=\"prefix-number\">1.<\/span> Any actual <span class=\"dictionary\">damages<\/span> sustained by the consumer as a result of the failure or <span class=\"dictionary\">damages<\/span> of not less than $100 and not more than $1,000; <a id=\"paragraph-275550\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#Q1\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"Q2\" class=\"indent-1\"><p><span class=\"prefix-number\">2.<\/span> Such amount of punitive <span class=\"dictionary\">damages<\/span> as the court may allow; and <a id=\"paragraph-275551\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#Q2\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"Q3\" class=\"indent-1\"><p><span class=\"prefix-number\">3.<\/span> In the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney fees as determined by the court. <a id=\"paragraph-275552\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#Q3\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"R\"><p><span class=\"prefix-number\">R.<\/span> Any person who obtains a <span class=\"dictionary\">consumer report<\/span>, requests a <span class=\"dictionary\">security freeze<\/span>, requests the temporary lift of a freeze, or requests the removal of a <span class=\"dictionary\">security freeze<\/span> from a <span class=\"dictionary\">consumer reporting agency<\/span> under <span class=\"dictionary\">false pretenses<\/span> or in an attempt to violate federal or state <span class=\"dictionary\">law<\/span> shall be liable to the <span class=\"dictionary\">consumer reporting agency<\/span> for actual <span class=\"dictionary\">damages<\/span> sustained by the <span class=\"dictionary\">consumer reporting agency<\/span> or $1,000, whichever is greater. <a id=\"paragraph-275553\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#R\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"S\"><p><span class=\"prefix-number\">S.<\/span> Any person who is negligent in failing to comply with any requirement imposed under this section with respect to any consumer is liable to that consumer in an amount equal to the sum of: <a id=\"paragraph-275554\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#S\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"S1\" class=\"indent-1\"><p><span class=\"prefix-number\">1.<\/span> Any actual <span class=\"dictionary\">damages<\/span> sustained by the consumer as a result of the failure; and <a id=\"paragraph-275555\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#S1\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"S2\" class=\"indent-1\"><p><span class=\"prefix-number\">2.<\/span> In the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney fees as determined by the court. <a id=\"paragraph-275556\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#S2\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"T\"><p><span class=\"prefix-number\">T.<\/span> Upon a <span class=\"dictionary\">finding<\/span> by the court that an unsuccessful pleading, <span class=\"dictionary\">motion<\/span>, or other paper filed in connection with an action under this section was filed in bad faith or for purposes of harassment, the court shall award to the prevailing <span class=\"dictionary\">party<\/span> attorney fees reasonable in relation to the work expended in responding to the pleading, <span class=\"dictionary\">motion<\/span>, or other paper. <a id=\"paragraph-275557\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#T\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"U\"><p><span class=\"prefix-number\">U.<\/span> Notwithstanding any other provision of <span class=\"dictionary\">law<\/span>: <a id=\"paragraph-275558\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#U\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"U1\" class=\"indent-1\"><p><span class=\"prefix-number\">1.<\/span> The exclusive authority to bring an action for any violation of subdivision F 1 b shall be with the <span class=\"dictionary\">Attorney General<\/span>. In any action brought under this subsection, the <span class=\"dictionary\">Attorney General<\/span> may cause an action to be brought in the name of the Commonwealth to enjoin the violation and to recover <span class=\"dictionary\">damages<\/span> for aggrieved <span class=\"dictionary\">consumers<\/span> consistent with the limits stated in subsections Q and S for such violations. <a id=\"paragraph-275559\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#U1\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"U2\" class=\"indent-1\"><p><span class=\"prefix-number\">2.<\/span> In any action brought under this subsection, if the court finds a willful violation, the court may, in its discretion, also award a civil <span class=\"dictionary\">penalty<\/span> of not more than $1,000 per violation, to be deposited in the Literary Fund of the Commonwealth. <a id=\"paragraph-275560\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#U2\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t<section id=\"U3\" class=\"indent-1\"><p><span class=\"prefix-number\">3.<\/span> In any action brought under this subsection, the <span class=\"dictionary\">Attorney General<\/span> may recover any costs, the reasonable expenses incurred in investigating and preparing the case, and attorney fees. <a id=\"paragraph-275561\" class=\"section-permalink\" href=\"https:\/\/vacode.org\/59.1-444.2\/#U3\"><i class=\"fa fa-link\"><\/i><\/a><\/p><\/section>","plain_text":"                                 CODE OF VIRGINIA\n\nSECURITY FREEZES (\u00a7 59.1-444.2)\n\nA. As used in this section, &#8220;security freeze&#8221; means a notice placed\nin a consumer&#8217;s credit report, at the request of the consumer and subject\nto certain exceptions, that prohibits the consumer reporting agency from\nreleasing the consumer&#8217;s credit report or score relating to the extension\nof credit.\n\nB. A consumer may request that a security freeze be placed on his or her credit\nreport by sending a request in writing by certified mail, or such other secure\nmethod authorized by a consumer reporting agency, to a consumer reporting agency\nat an address designated by the consumer reporting agency to receive such\nrequests. This subsection does not prevent a consumer reporting agency from\nadvising a third party that a security freeze is in effect with respect to the\nconsumer&#8217;s credit report.\n\nC. A consumer reporting agency shall place a security freeze on a\nconsumer&#8217;s credit report no later than three business days after receiving\nfrom the consumer:\n\n   1. A written request described in subsection B; and\n\n   2. Proper identification.\n   \t\t\t\tA consumer reporting agency shall place a security freeze on a\n   consumer&#8217;s credit report no later than one business day after receiving\n   such a request, if such request is made electronically at an address\n   designated by the consumer reporting agency to receive such requests.\n\nD. The consumer reporting agency shall send a written confirmation of the\nplacement of the security freeze to the consumer within 10 business days. Upon\nplacing the security freeze on the consumer&#8217;s credit report, the consumer\nreporting agency shall provide the consumer with a unique personal\nidentification number or password, or similar device to be used by the consumer\nwhen providing authorization for the release of his credit report for a specific\nperiod of time or for a specific party.\n\nE. If the consumer wishes to allow his credit report to be accessed for a\nspecific period of time or for a specific party while a freeze is in place, he\nshall contact the consumer reporting agency using a point of contact designated\nby the consumer reporting agency, request that the freeze be temporarily lifted,\nand provide the following:\n\n   1. Proper identification;\n\n   2. The unique personal identification number or password provided by the\n   consumer reporting agency pursuant to subsection D; and\n\n   3. The proper information regarding the time period or the specific party for\n   which the report shall be available to users of the credit report.\n\nF. A consumer reporting agency:\n\n   1. Shall comply with a request made under subsection E:\n   \t\t\t\ta. Within three business days after receiving the request if the request\n   is made at a postal address designated by the agency to receive such requests;\n   or\n   \t\t\t\tb. Within 15 minutes after the consumer&#8217;s request is received by the\n   consumer reporting agency through the electronic contact method chosen by the\n   consumer reporting agency in accordance with this section;\n\n   2. Is not required to temporarily lift a security freeze within the time\n   provided in subdivision 1 b if:\n   \t\t\t\ta. The consumer fails to meet the requirements of subsection E; or\n   \t\t\t\tb. The consumer reporting agency&#8217;s ability to temporarily lift the\n   security freeze within 15 minutes is prevented by:\n\n      1. An act of God, including fire, earthquakes, hurricanes, storms, or\n      similar natural disaster or phenomena;\n\n      2. Unauthorized or illegal acts by a third party, including terrorism,\n      sabotage, riot, vandalism, labor strikes or disputes disrupting operations,\n      or similar occurrence;\n\n      3. Operational interruption, including electrical failure, unanticipated\n      delay in equipment or replacement part delivery, computer hardware or\n      software failures inhibiting response time, or similar disruption;\n\n      4. Governmental action, including emergency orders or regulations, judicial\n      or law-enforcement action, or similar directives;\n\n      5. Regularly scheduled maintenance, during other than normal business hours,\n      of, or updates to, the consumer reporting agency&#8217;s systems; or\n\n      6. Commercially reasonable maintenance of, or repair to, the consumer\n      reporting agency&#8217;s systems that is unexpected or unscheduled; and\n\n   3. May develop procedures involving the use of telephone, fax, the Internet,\n   or other electronic media to receive and process a request from a consumer to\n   temporarily lift a freeze on a credit report pursuant to subsection E in an\n   expedited manner.\n\nG. A consumer reporting agency shall remove or temporarily lift a freeze placed\non a consumer&#8217;s credit report only in the following cases:\n\n   1. Upon a consumer request, pursuant to subsection E or subsection J; or\n\n   2. If the consumer&#8217;s credit report was frozen due to a material\n   misrepresentation of fact by the consumer. If a consumer reporting agency\n   intends to remove a freeze upon a consumer&#8217;s credit report pursuant to\n   this subdivision, the consumer reporting agency shall notify the consumer in\n   writing prior to removing the freeze on the consumer&#8217;s credit report.\n\nH. If a third party requests access to a consumer credit report on which a\nsecurity freeze is in effect, and this request is in connection with an\napplication for credit or any other use, and the consumer does not allow his or\nher credit report to be accessed for that period of time, the third party may\ntreat the application as incomplete.\n\nI. If a consumer requests a security freeze, the consumer reporting agency shall\ndisclose the process of placing and temporarily lifting a freeze and the process\nfor allowing access to information from the consumer&#8217;s credit report for a\nperiod of time while the freeze is in place.\n\nJ. A security freeze shall remain in place until the consumer requests, using a\npoint of contact designated by the consumer reporting agency, that the security\nfreeze be removed. A consumer reporting agency shall remove a security freeze\nwithin three business days of receiving a request for removal from the consumer,\nwho provides:\n\n   1. Proper identification; and\n\n   2. The unique personal identification number or password or similar device\n   provided by the consumer reporting agency pursuant to subsection D.\n\nK. A consumer reporting agency shall require proper identification of the person\nmaking a request to place or remove a security freeze.\n\nL. The provisions of this section do not apply to the use of a consumer credit\nreport by any of the following:\n\n   1. A person or entity, or a subsidiary, affiliate, or agent of that person or\n   entity, or an assignee of a financial obligation owing by the consumer to that\n   person or entity, or a prospective assignee of a financial obligation owing by\n   the consumer to that person or entity in conjunction with the proposed\n   purchase of the financial obligation, with which the consumer has or had prior\n   to assignment an account or contract, including a demand deposit account, or\n   to whom the consumer issued a negotiable instrument, for the purposes of\n   reviewing the account or collecting the financial obligation owing for the\n   account, contract, or negotiable instrument. For purposes of this paragraph,\n   &#8220;reviewing the account&#8221; includes activities related to account\n   maintenance, monitoring, credit line increases, and account upgrades and\n   enhancements;\n\n   2. A subsidiary, affiliate, agent, assignee, or prospective assignee of a\n   person to whom access has been granted for purposes of facilitating the\n   extension of credit or other permissible use;\n\n   3. Any state or local agency, law-enforcement agency, trial court, or private\n   collection agency acting pursuant to a court order, warrant, or subpoena;\n\n   4. A child support agency acting pursuant to Title IV-D of the Social Security\n   Act (42 U.S.C. &#xA7; 654 et seq.);\n\n   5. The Commonwealth or its agents or assigns acting to investigate fraud or\n   acting to investigate or collect delinquent taxes or unpaid court orders or to\n   fulfill any of its other statutory responsibilities provided such\n   responsibilities are consistent with a permissible purpose under 15 U.S.C.\n   &#xA7; 1681b;\n\n   6. The use of credit information for the purposes of prescreening or\n   postscreening as provided for by the federal Fair Credit Reporting Act;\n\n   7. Any person or entity administering a credit file monitoring subscription or\n   similar service to which the consumer has subscribed;\n\n   8. Any person or entity for the purpose of providing a consumer with a copy of\n   his credit report or score upon the consumer&#8217;s request;\n\n   9. Any person or entity for use in setting or adjusting a rate, adjusting a\n   claim, or underwriting for insurance purposes; or\n\n   10. Any employer in connection with any application for employment with the\n   employer.\n\nM. A consumer reporting agency shall not charge a fee for any service performed\nunder this section.\n\nN. If a security freeze is in place, a consumer reporting agency shall not\nchange any of the following official information in a consumer credit report\nwithout sending a written confirmation of the change to the consumer within 30\ndays of the change being posted to the consumer&#8217;s file: name, date of\nbirth, social security number, and address. Written confirmation is not required\nfor technical modifications of a consumer&#8217;s official information,\nincluding name and street abbreviations, complete spellings, or transposition of\nnumbers or letters. In the case of an address change, the written confirmation\nshall be sent to both the new address and to the former address.\n\nO. The following entities are not required to place a security freeze on a\ncredit report:\n\n   1. A consumer reporting agency that acts only as a reseller of credit\n   information by assembling and merging information contained in the database of\n   another consumer reporting agency or multiple consumer credit reporting\n   agencies, and does not maintain a permanent database of credit information\n   from which new consumer credit reports are produced. However, a consumer\n   reporting agency acting as a reseller shall honor any security freeze placed\n   on a consumer credit report by another consumer reporting agency;\n\n   2. A check services or fraud prevention services company, which issues reports\n   on incidents of fraud or authorizations for the purpose of approving or\n   processing negotiable instruments, electronic funds transfers, or similar\n   methods of payments;\n\n   3. A deposit account information service company, which issues reports\n   regarding account closures due to fraud, substantial overdrafts, ATM abuse, or\n   similar negative information regarding a consumer, to inquiring banks or other\n   financial institutions for use only in reviewing a consumer request for a\n   deposit account at the inquiring bank or financial institution; and\n\n   4. A consumer reporting agency&#8217;s database or file that consists of\n   information concerning, and used for, one or more of the following: criminal\n   record information, fraud prevention or detection, personal loss history\n   information, and employment, tenant, or background screening.\n\nP. At any time a consumer is required to receive a summary of rights required\nunder 15 U.S.C. \u00a7 1681g(d), the following notice shall be included:\n\t\t\t&#8220;Virginia Consumers Have the Right to Obtain a Security Freeze.\n\t\t\tYou have a right to place a &#8220;security freeze&#8221; on your credit\nreport, which will prohibit a consumer reporting agency from releasing\ninformation in your credit report without your express authorization. A security\nfreeze must be requested in writing by certified mail. The security freeze is\ndesigned to prevent credit, loans, and services from being approved in your name\nwithout your consent. However, you should be aware that using a security freeze\nto take control over who gets access to the personal and financial information\nin your credit report may delay, interfere with, or prohibit the timely approval\nof any subsequent request or application you make regarding a new loan, credit,\nmortgage, government services or payments, rental housing, employment,\ninvestment, license, cellular phone, utilities, digital signature, Internet\ncredit card transaction, or other services, including an extension of credit at\npoint of sale. When you place a security freeze on your credit report, you will\nbe provided a personal identification number or password to use if you choose to\nremove the freeze on your credit report or authorize the release of your credit\nreport for a period of time or for a specific party after the freeze is in\nplace. To provide that authorization you must contact the consumer reporting\nagency and provide all of the following:\n\n   1. The personal identification number or password;\n\n   2. Proper identification to verify your identity; and\n\n   3. The proper information regarding the period of time or the specific party\n   for which the report shall be available.\n   \t\t\t\tA consumer reporting agency must authorize the release of your credit\n   report no later than three business days after receiving the above\n   information. A consumer credit reporting agency must authorize the release of\n   your credit report no later than 15 minutes after receiving the request.\n   \t\t\t\tA security freeze does not apply to a person or entity, or its affiliates,\n   or collection agencies acting on behalf of the person or entity, with which\n   you have an existing account, that requests information in your credit report\n   for the purposes of reviewing or collecting the account. Reviewing the account\n   includes activities related to account maintenance, monitoring, credit line\n   increases, and account upgrades and enhancements.\n   \t\t\t\tYou have a right to bring civil action against anyone, including a\n   consumer reporting agency, who improperly obtains access to a file, knowingly\n   or willfully misuses file data, or fails to correct inaccurate file data.\n   \t\t\t\tA consumer reporting agency does not have the right to charge you a fee to\n   place a freeze on your credit report.&#8221;\n\nQ. Any person who willfully fails to comply with any requirement imposed under\nthis section or \u00a7 59.1-444.3 with respect to any consumer is liable to that\nconsumer in an amount equal to the sum of:\n\n   1. Any actual damages sustained by the consumer as a result of the failure or\n   damages of not less than $100 and not more than $1,000;\n\n   2. Such amount of punitive damages as the court may allow; and\n\n   3. In the case of any successful action to enforce any liability under this\n   section, the costs of the action together with reasonable attorney fees as\n   determined by the court.\n\nR. Any person who obtains a consumer report, requests a security freeze,\nrequests the temporary lift of a freeze, or requests the removal of a security\nfreeze from a consumer reporting agency under false pretenses or in an attempt\nto violate federal or state law shall be liable to the consumer reporting agency\nfor actual damages sustained by the consumer reporting agency or $1,000,\nwhichever is greater.\n\nS. Any person who is negligent in failing to comply with any requirement imposed\nunder this section with respect to any consumer is liable to that consumer in an\namount equal to the sum of:\n\n   1. Any actual damages sustained by the consumer as a result of the failure;\n   and\n\n   2. In the case of any successful action to enforce any liability under this\n   section, the costs of the action together with reasonable attorney fees as\n   determined by the court.\n\nT. Upon a finding by the court that an unsuccessful pleading, motion, or other\npaper filed in connection with an action under this section was filed in bad\nfaith or for purposes of harassment, the court shall award to the prevailing\nparty attorney fees reasonable in relation to the work expended in responding to\nthe pleading, motion, or other paper.\n\nU. Notwithstanding any other provision of law:\n\n   1. The exclusive authority to bring an action for any violation of subdivision\n   F 1 b shall be with the Attorney General. In any action brought under this\n   subsection, the Attorney General may cause an action to be brought in the name\n   of the Commonwealth to enjoin the violation and to recover damages for\n   aggrieved consumers consistent with the limits stated in subsections Q and S\n   for such violations.\n\n   2. In any action brought under this subsection, if the court finds a willful\n   violation, the court may, in its discretion, also award a civil penalty of not\n   more than $1,000 per violation, to be deposited in the Literary Fund of the\n   Commonwealth.\n\n   3. In any action brought under this subsection, the Attorney General may\n   recover any costs, the reasonable expenses incurred in investigating and\n   preparing the case, and attorney fees.\n\nHISTORY: 2008, cc. 480, 496; 2009, c. 406; 2014, c. 570; 2018, cc. 264, 303;\n2020, c. 243.","edition":{"id":1,"name":"2025","slug":"2025","date_created":"2026-06-21 22:39:22","date_modified":"2026-06-21 22:39:22","current":1,"order_by":1,"last_import":null}}