§ 380-u. Security record freeze for protected minors. (a) A consumer
credit reporting agency shall place a security freeze for a protected
consumer if:

(1) The consumer credit reporting agency receives a request from the
protected consumer's representative for the placement of the security
freeze under this section; and

(2) The protected consumer's representative (i) submits the request to
the consumer credit reporting agency at the address or other point of
contact and in the manner specified by the consumer credit reporting
agency; (ii) provides to the consumer credit reporting agency sufficient
proof of identification of the protected consumer and the
representative; (iii) provides to the consumer credit reporting agency
sufficient proof of authority to act on behalf of the protected
consumer; and (iv) pays to the consumer credit reporting agency a fee,
if any, as provided in this section.

(b) If a consumer credit reporting agency does not have a file
pertaining to a protected consumer when the consumer credit reporting
agency receives a request under subdivision (a) of this section, the
consumer credit reporting agency shall create a record for the protected
consumer.

(c) Within thirty days after receiving a request that meets the
requirements of paragraph two of subdivision (a) of this section, a
consumer credit reporting agency shall place a security freeze for the
protected consumer on the record created for the protected consumer or
on the file pertaining to the protected consumer in the event that the
consumer reporting agency already has a file pertaining to the protected
consumer.

(d) Unless a security freeze for a protected consumer is removed in
accordance with this section, a consumer credit reporting agency may not
release the protected consumer's consumer credit report, any information
derived from the protected consumer's consumer report, or any record
created for the protected consumer.

(e) A security freeze for a protected consumer placed under this
section shall remain in effect until:

(1) The protected consumer or the protected consumer's representative
requests the consumer credit reporting agency to remove the security
freeze for a protected consumer in accordance with subdivision (f) of
this section; or

(2) The security freeze is removed in accordance with subdivision (i)
of this section.

(f) If a protected consumer or a protected consumer's representative
wishes to remove a security freeze for the protected consumer, the
protected consumer or the protected consumer's representative shall:

(1) Submit a request for the removal of the security freeze to the
consumer credit reporting agency at the address or other point of
contact and in the manner specified by the consumer credit reporting
agency;

(2) Provide to the consumer credit reporting agency: (i) in the case
of a request by the protected consumer: (A) proof that the sufficient
proof of authority for the protected consumer's representative to act on
behalf of the protected consumer is no longer valid or that the
protected consumer has attained the age of sixteen; and (B) sufficient
proof of identification of the protected consumer; or (ii) in the case
of a request by the representative of a protected consumer: (A)
sufficient proof of identification of the protected consumer and the
representative; and (B) sufficient proof of authority to act on behalf
of the protected consumer; and (C) payment to the consumer credit
reporting agency of a fee, if any, as provided in subdivision (h) of
this section.

(g) Within thirty days after receiving a request that meets the
requirements of subdivision (f) of this section, the consumer credit
reporting agency shall remove the security freeze for the protected
consumer.

(h)(1) A consumer credit reporting agency may charge a reasonable fee,
not exceeding fifteen dollars, for each placement or removal of a
security freeze for a protected consumer as provided for in subparagraph
(iv) of paragraph two of subdivision (a) or clause (C) of subparagraph
(ii) of paragraph two of subdivision (f) of this section. A consumer
credit reporting agency shall not charge a fee for any other service
performed under this section.

(2) Notwithstanding paragraph one of this subdivision, a consumer
credit reporting agency may not charge any fee under this section if;
(i) the protected consumer's representative: (A) has obtained a report
of alleged identity theft or fraud against the protected consumer; and
(B) provides a copy of the report to the consumer credit reporting
agency; or (ii) the consumer credit reporting agency has a consumer
credit report pertaining to the protected consumer.

(i) A consumer credit reporting agency shall remove a security freeze
for a protected consumer, or delete a record of a protected consumer, if
the security freeze was placed or the record was created based on a
material misrepresentation of fact by the protected consumer or the
protected consumer's representative.

(j) This section does not apply to:

(1) A person administering a credit file monitoring subscription
service to which: (i) the protected consumer has subscribed; or (ii) the
representative of the protected consumer has subscribed on behalf of the
protected consumer;

(2) A person providing the protected consumer or the protected
consumer's representative with a copy of the protected consumer's
consumer credit report upon the request of the protected consumer or the
protected consumer's representative;

(3)(i) An entity listed in paragraphs three through eight of
subdivision (m) of section three hundred eighty-t of this article; (ii)
an entity listed in subdivision (p) of section three hundred eighty-t of
this article; or (iii) a consumer credit reporting agency's database or
file that consists of information concerning, and used for, one or more
of the following: criminal record information, fraud prevention or
detection, personal loss history information, and employment, tenant, or
background screening.

(k) Notwithstanding any other provision of law, the exclusive remedy
for a violation of this section shall be in an action commenced by the
attorney general.