                                 CODE OF VIRGINIA

SECURITY FREEZES FOR PROTECTED CONSUMERS (§ 59.1-444.3)

A. As used in this section, unless the context requires a different meaning:
			&#8220;Protected consumer&#8221; means a consumer who is either:

   1. Under the age of 16 years at the time a request for the placement of a
   security freeze is made; or

   2. An incapacitated person for whom a guardian or conservator has been
   appointed in accordance with Chapter 20 (&#xA7; 64.2-2000 et seq.) of Title
   64.2.
   				&#8220;Record&#8221; means a compilation of information regarding a
   specific identified protected consumer, which compilation is created by a
   consumer reporting agency solely for the purpose of complying with the
   requirement for a record&#8217;s establishment set forth in subsection D.
   				&#8220;Representative&#8221; means a person who provides to a consumer
   reporting agency sufficient proof of authority to act on behalf of a protected
   consumer.
   				&#8220;Security freeze&#8221; means:

   1. If a consumer reporting agency does not have a file pertaining to a
   protected consumer, a restriction that (i) is placed on the protected
   consumer&#8217;s record in accordance with this section and (ii) prohibits the
   consumer reporting agency from releasing the protected consumer&#8217;s record
   except as provided in this section; or

   2. If a consumer reporting agency has a file pertaining to the protected
   consumer, a restriction that (i) is placed on the protected consumer&#8217;s
   credit report in accordance with this section and (ii) prohibits the consumer
   reporting agency from releasing the protected consumer&#8217;s credit report
   or any information derived from the protected consumer&#8217;s credit report
   except as provided in this section.
   				&#8220;Sufficient proof of authority&#8221; means documentation that shows
   a representative has authority to act on behalf of a protected consumer.
   &#8220;Sufficient proof of authority&#8221; includes (i) an order issued by a
   court of law, (ii) a lawfully executed and valid power of attorney, (iii) a
   birth certification; or (iv) a written, notarized statement signed by a
   representative that expressly describes the authority of the representative to
   act on behalf of the protected consumer.
   				&#8220;Sufficient proof of identification&#8221; means information or
   documentation that identifies a protected consumer or a representative of a
   protected consumer. &#8220;Sufficient proof of identification&#8221; includes
   (i) a social security number or a copy of a social security card issued by the
   U.S. Social Security Administration; (ii) a certified or official copy of a
   birth certificate issued by the entity authorized to issue the birth
   certificate; (iii) a copy of a driver&#8217;s license, an identification card
   issued by the Department of Motor Vehicles, or any other government-issued
   identification; or (iv) a copy of a bill, including a bill for telephone,
   sewer, septic tank, water, electric, oil, or natural gas services, that shows
   a name and home address.

B. This section does not apply to the use of a protected consumer&#8217;s credit
report or record by:

   1. A person administering a credit file monitoring subscription service to
   which the protected consumer has subscribed or the representative of the
   protected consumer has subscribed on behalf of the protected consumer;

   2. A person providing the protected consumer or the protected consumer&#8217;s
   representative with a copy of the protected consumer&#8217;s credit report on
   request of the protected consumer or the protected consumer&#8217;s
   representative; or

   3. An entity listed in subsection O of &#xA7; 59.1-444.2.

C. A consumer reporting agency shall place a security freeze for a protected
consumer if:

   1. The consumer reporting agency receives a request from the protected
   consumer&#8217;s representative for the placement of the security freeze under
   this section; and

   2. The protected consumer&#8217;s representative:
   				a. Submits the request to the consumer reporting agency at the address or
   other point of contact and in the manner specified by the consumer reporting
   agency;
   				b. Provides to the consumer reporting agency sufficient proof of
   identification of the protected consumer and the representative; and
   				c. Provides to the consumer reporting agency sufficient proof of authority
   to act on behalf of the protected consumer.

D. If a consumer reporting agency does not have a file pertaining to a protected
consumer when the consumer reporting agency receives a request under subsection
C from the protected consumer&#8217;s representative for the placement of a
security freeze, the consumer reporting agency shall create a record for the
protected consumer. A record may not be created or used to consider the
protected consumer&#8217;s creditworthiness, credit standing, credit capacity,
character, general reputation, personal characteristics, or mode of living for
the purpose of serving as a factor in establishing the consumer&#8217;s
eligibility for (i) credit or insurance to be used primarily for personal,
family, or household purposes or (ii) employment.

E. Within 30 days after receiving a request that meets the requirements of
subsection C, a consumer reporting agency shall place a security freeze for the
protected consumer.

F. Unless a security freeze for a protected consumer is removed in accordance
with subsection H or K, a consumer reporting agency may not release the
protected consumer&#8217;s credit report, any information derived from the
protected consumer&#8217;s credit report, or any record created for the
protected consumer.

G. A security freeze for a protected consumer placed under subsection E shall
remain in effect until:

   1. The protected consumer or the protected consumer&#8217;s representative
   requests the consumer reporting agency to remove the security freeze in
   accordance with subsection H; or

   2. The security freeze is removed in accordance with subsection K.

H. If a protected consumer or a protected consumer&#8217;s representative wishes
to remove a security freeze for the protected consumer, the protected consumer
or the protected consumer&#8217;s representative shall:

   1. Submit a request for the removal of the security freeze to the consumer
   reporting agency at the address or other point of contact and in the manner
   specified by the consumer reporting agency; and

   2. Provide to the consumer reporting agency:
   				a. In the case of a request by the protected consumer:

      1. Proof that the sufficient proof of authority for the protected
      consumer&#8217;s representative to act on behalf of the protected consumer
      is no longer valid; and

      2. Sufficient proof of identification of the protected consumer; or
      					b. In the case of a request by the representative of a protected
      consumer:

      1. Sufficient proof of identification of the protected consumer and the
      representative; and

      2. Sufficient proof of authority to act on behalf of the protected consumer.

I. Within 30 days after receiving a request that meets the requirements of
subsection H, the consumer reporting agency shall remove the security freeze for
the protected consumer.

J. A consumer reporting agency shall not charge a fee for any service performed
under this section.

K. A consumer reporting agency may remove a security freeze for a protected
consumer or delete a record of a protected consumer if the security freeze was
placed or the record was created based on a material misrepresentation of fact
by the protected consumer or the protected consumer&#8217;s representative.

L. Any person who obtains a consumer report, requests a security freeze,
requests the temporary lift of a freeze, or requests the removal of a security
freeze from a consumer reporting agency under false pretenses or in an attempt
to violate federal or state law shall be liable to the consumer reporting agency
for damages sustained by the consumer reporting agency as provided in subsection
R of &#xA7; 59.1-444.2.

M. Notwithstanding any other provision of law:

   1. The exclusive authority to bring an action for any violation of subsection
   E shall be with the Attorney General. In any action brought under this
   subsection, the Attorney General may cause an action to be brought in the name
   of the Commonwealth to enjoin the violation and to recover damages for
   aggrieved protected consumers.

   2. In any action brought under this subsection, if the court finds a willful
   violation, the court may, in its discretion, also award a civil penalty of not
   more than $1,000 per violation, to be deposited in the Literary Fund.

   3. In any action brought under this subsection, the Attorney General may
   recover any costs, the reasonable expenses incurred in investigating and
   preparing the case, and attorney fees.

HISTORY: 2014, c. 570; 2018, cc. 264, 303, 480; 2020, c. 243.