                                 CODE OF VIRGINIA

SECURITY FREEZES (§ 59.1-444.2)

A. As used in this section, &#8220;security freeze&#8221; means a notice placed
in a consumer&#8217;s credit report, at the request of the consumer and subject
to certain exceptions, that prohibits the consumer reporting agency from
releasing the consumer&#8217;s credit report or score relating to the extension
of credit.

B. A consumer may request that a security freeze be placed on his or her credit
report by sending a request in writing by certified mail, or such other secure
method authorized by a consumer reporting agency, to a consumer reporting agency
at an address designated by the consumer reporting agency to receive such
requests. This subsection does not prevent a consumer reporting agency from
advising a third party that a security freeze is in effect with respect to the
consumer&#8217;s credit report.

C. A consumer reporting agency shall place a security freeze on a
consumer&#8217;s credit report no later than three business days after receiving
from the consumer:

   1. A written request described in subsection B; and

   2. Proper identification.
   				A consumer reporting agency shall place a security freeze on a
   consumer&#8217;s credit report no later than one business day after receiving
   such a request, if such request is made electronically at an address
   designated by the consumer reporting agency to receive such requests.

D. The consumer reporting agency shall send a written confirmation of the
placement of the security freeze to the consumer within 10 business days. Upon
placing the security freeze on the consumer&#8217;s credit report, the consumer
reporting agency shall provide the consumer with a unique personal
identification number or password, or similar device to be used by the consumer
when providing authorization for the release of his credit report for a specific
period of time or for a specific party.

E. If the consumer wishes to allow his credit report to be accessed for a
specific period of time or for a specific party while a freeze is in place, he
shall contact the consumer reporting agency using a point of contact designated
by the consumer reporting agency, request that the freeze be temporarily lifted,
and provide the following:

   1. Proper identification;

   2. The unique personal identification number or password provided by the
   consumer reporting agency pursuant to subsection D; and

   3. The proper information regarding the time period or the specific party for
   which the report shall be available to users of the credit report.

F. A consumer reporting agency:

   1. Shall comply with a request made under subsection E:
   				a. Within three business days after receiving the request if the request
   is made at a postal address designated by the agency to receive such requests;
   or
   				b. Within 15 minutes after the consumer&#8217;s request is received by the
   consumer reporting agency through the electronic contact method chosen by the
   consumer reporting agency in accordance with this section;

   2. Is not required to temporarily lift a security freeze within the time
   provided in subdivision 1 b if:
   				a. The consumer fails to meet the requirements of subsection E; or
   				b. The consumer reporting agency&#8217;s ability to temporarily lift the
   security freeze within 15 minutes is prevented by:

      1. An act of God, including fire, earthquakes, hurricanes, storms, or
      similar natural disaster or phenomena;

      2. Unauthorized or illegal acts by a third party, including terrorism,
      sabotage, riot, vandalism, labor strikes or disputes disrupting operations,
      or similar occurrence;

      3. Operational interruption, including electrical failure, unanticipated
      delay in equipment or replacement part delivery, computer hardware or
      software failures inhibiting response time, or similar disruption;

      4. Governmental action, including emergency orders or regulations, judicial
      or law-enforcement action, or similar directives;

      5. Regularly scheduled maintenance, during other than normal business hours,
      of, or updates to, the consumer reporting agency&#8217;s systems; or

      6. Commercially reasonable maintenance of, or repair to, the consumer
      reporting agency&#8217;s systems that is unexpected or unscheduled; and

   3. May develop procedures involving the use of telephone, fax, the Internet,
   or other electronic media to receive and process a request from a consumer to
   temporarily lift a freeze on a credit report pursuant to subsection E in an
   expedited manner.

G. A consumer reporting agency shall remove or temporarily lift a freeze placed
on a consumer&#8217;s credit report only in the following cases:

   1. Upon a consumer request, pursuant to subsection E or subsection J; or

   2. If the consumer&#8217;s credit report was frozen due to a material
   misrepresentation of fact by the consumer. If a consumer reporting agency
   intends to remove a freeze upon a consumer&#8217;s credit report pursuant to
   this subdivision, the consumer reporting agency shall notify the consumer in
   writing prior to removing the freeze on the consumer&#8217;s credit report.

H. If a third party requests access to a consumer credit report on which a
security freeze is in effect, and this request is in connection with an
application for credit or any other use, and the consumer does not allow his or
her credit report to be accessed for that period of time, the third party may
treat the application as incomplete.

I. If a consumer requests a security freeze, the consumer reporting agency shall
disclose the process of placing and temporarily lifting a freeze and the process
for allowing access to information from the consumer&#8217;s credit report for a
period of time while the freeze is in place.

J. A security freeze shall remain in place until the consumer requests, using a
point of contact designated by the consumer reporting agency, that the security
freeze be removed. A consumer reporting agency shall remove a security freeze
within three business days of receiving a request for removal from the consumer,
who provides:

   1. Proper identification; and

   2. The unique personal identification number or password or similar device
   provided by the consumer reporting agency pursuant to subsection D.

K. A consumer reporting agency shall require proper identification of the person
making a request to place or remove a security freeze.

L. The provisions of this section do not apply to the use of a consumer credit
report by any of the following:

   1. A person or entity, or a subsidiary, affiliate, or agent of that person or
   entity, or an assignee of a financial obligation owing by the consumer to that
   person or entity, or a prospective assignee of a financial obligation owing by
   the consumer to that person or entity in conjunction with the proposed
   purchase of the financial obligation, with which the consumer has or had prior
   to assignment an account or contract, including a demand deposit account, or
   to whom the consumer issued a negotiable instrument, for the purposes of
   reviewing the account or collecting the financial obligation owing for the
   account, contract, or negotiable instrument. For purposes of this paragraph,
   &#8220;reviewing the account&#8221; includes activities related to account
   maintenance, monitoring, credit line increases, and account upgrades and
   enhancements;

   2. A subsidiary, affiliate, agent, assignee, or prospective assignee of a
   person to whom access has been granted for purposes of facilitating the
   extension of credit or other permissible use;

   3. Any state or local agency, law-enforcement agency, trial court, or private
   collection agency acting pursuant to a court order, warrant, or subpoena;

   4. A child support agency acting pursuant to Title IV-D of the Social Security
   Act (42 U.S.C. &#xA7; 654 et seq.);

   5. The Commonwealth or its agents or assigns acting to investigate fraud or
   acting to investigate or collect delinquent taxes or unpaid court orders or to
   fulfill any of its other statutory responsibilities provided such
   responsibilities are consistent with a permissible purpose under 15 U.S.C.
   &#xA7; 1681b;

   6. The use of credit information for the purposes of prescreening or
   postscreening as provided for by the federal Fair Credit Reporting Act;

   7. Any person or entity administering a credit file monitoring subscription or
   similar service to which the consumer has subscribed;

   8. Any person or entity for the purpose of providing a consumer with a copy of
   his credit report or score upon the consumer&#8217;s request;

   9. Any person or entity for use in setting or adjusting a rate, adjusting a
   claim, or underwriting for insurance purposes; or

   10. Any employer in connection with any application for employment with the
   employer.

M. A consumer reporting agency shall not charge a fee for any service performed
under this section.

N. If a security freeze is in place, a consumer reporting agency shall not
change any of the following official information in a consumer credit report
without sending a written confirmation of the change to the consumer within 30
days of the change being posted to the consumer&#8217;s file: name, date of
birth, social security number, and address. Written confirmation is not required
for technical modifications of a consumer&#8217;s official information,
including name and street abbreviations, complete spellings, or transposition of
numbers or letters. In the case of an address change, the written confirmation
shall be sent to both the new address and to the former address.

O. The following entities are not required to place a security freeze on a
credit report:

   1. A consumer reporting agency that acts only as a reseller of credit
   information by assembling and merging information contained in the database of
   another consumer reporting agency or multiple consumer credit reporting
   agencies, and does not maintain a permanent database of credit information
   from which new consumer credit reports are produced. However, a consumer
   reporting agency acting as a reseller shall honor any security freeze placed
   on a consumer credit report by another consumer reporting agency;

   2. A check services or fraud prevention services company, which issues reports
   on incidents of fraud or authorizations for the purpose of approving or
   processing negotiable instruments, electronic funds transfers, or similar
   methods of payments;

   3. A deposit account information service company, which issues reports
   regarding account closures due to fraud, substantial overdrafts, ATM abuse, or
   similar negative information regarding a consumer, to inquiring banks or other
   financial institutions for use only in reviewing a consumer request for a
   deposit account at the inquiring bank or financial institution; and

   4. A consumer reporting agency&#8217;s database or file that consists of
   information concerning, and used for, one or more of the following: criminal
   record information, fraud prevention or detection, personal loss history
   information, and employment, tenant, or background screening.

P. At any time a consumer is required to receive a summary of rights required
under 15 U.S.C. § 1681g(d), the following notice shall be included:
			&#8220;Virginia Consumers Have the Right to Obtain a Security Freeze.
			You have a right to place a &#8220;security freeze&#8221; on your credit
report, which will prohibit a consumer reporting agency from releasing
information in your credit report without your express authorization. A security
freeze must be requested in writing by certified mail. The security freeze is
designed to prevent credit, loans, and services from being approved in your name
without your consent. However, you should be aware that using a security freeze
to take control over who gets access to the personal and financial information
in your credit report may delay, interfere with, or prohibit the timely approval
of any subsequent request or application you make regarding a new loan, credit,
mortgage, government services or payments, rental housing, employment,
investment, license, cellular phone, utilities, digital signature, Internet
credit card transaction, or other services, including an extension of credit at
point of sale. When you place a security freeze on your credit report, you will
be provided a personal identification number or password to use if you choose to
remove the freeze on your credit report or authorize the release of your credit
report for a period of time or for a specific party after the freeze is in
place. To provide that authorization you must contact the consumer reporting
agency and provide all of the following:

   1. The personal identification number or password;

   2. Proper identification to verify your identity; and

   3. The proper information regarding the period of time or the specific party
   for which the report shall be available.
   				A consumer reporting agency must authorize the release of your credit
   report no later than three business days after receiving the above
   information. A consumer credit reporting agency must authorize the release of
   your credit report no later than 15 minutes after receiving the request.
   				A security freeze does not apply to a person or entity, or its affiliates,
   or collection agencies acting on behalf of the person or entity, with which
   you have an existing account, that requests information in your credit report
   for the purposes of reviewing or collecting the account. Reviewing the account
   includes activities related to account maintenance, monitoring, credit line
   increases, and account upgrades and enhancements.
   				You have a right to bring civil action against anyone, including a
   consumer reporting agency, who improperly obtains access to a file, knowingly
   or willfully misuses file data, or fails to correct inaccurate file data.
   				A consumer reporting agency does not have the right to charge you a fee to
   place a freeze on your credit report.&#8221;

Q. Any person who willfully fails to comply with any requirement imposed under
this section or § 59.1-444.3 with respect to any consumer is liable to that
consumer in an amount equal to the sum of:

   1. Any actual damages sustained by the consumer as a result of the failure or
   damages of not less than $100 and not more than $1,000;

   2. Such amount of punitive damages as the court may allow; and

   3. In the case of any successful action to enforce any liability under this
   section, the costs of the action together with reasonable attorney fees as
   determined by the court.

R. Any person who obtains a consumer report, requests a security freeze,
requests the temporary lift of a freeze, or requests the removal of a security
freeze from a consumer reporting agency under false pretenses or in an attempt
to violate federal or state law shall be liable to the consumer reporting agency
for actual damages sustained by the consumer reporting agency or $1,000,
whichever is greater.

S. Any person who is negligent in failing to comply with any requirement imposed
under this section with respect to any consumer is liable to that consumer in an
amount equal to the sum of:

   1. Any actual damages sustained by the consumer as a result of the failure;
   and

   2. In the case of any successful action to enforce any liability under this
   section, the costs of the action together with reasonable attorney fees as
   determined by the court.

T. Upon a finding by the court that an unsuccessful pleading, motion, or other
paper filed in connection with an action under this section was filed in bad
faith or for purposes of harassment, the court shall award to the prevailing
party attorney fees reasonable in relation to the work expended in responding to
the pleading, motion, or other paper.

U. Notwithstanding any other provision of law:

   1. The exclusive authority to bring an action for any violation of subdivision
   F 1 b shall be with the Attorney General. In any action brought under this
   subsection, the Attorney General may cause an action to be brought in the name
   of the Commonwealth to enjoin the violation and to recover damages for
   aggrieved consumers consistent with the limits stated in subsections Q and S
   for such violations.

   2. In any action brought under this subsection, if the court finds a willful
   violation, the court may, in its discretion, also award a civil penalty of not
   more than $1,000 per violation, to be deposited in the Literary Fund of the
   Commonwealth.

   3. In any action brought under this subsection, the Attorney General may
   recover any costs, the reasonable expenses incurred in investigating and
   preparing the case, and attorney fees.

HISTORY: 2008, cc. 480, 496; 2009, c. 406; 2014, c. 570; 2018, cc. 264, 303;
2020, c. 243.