# Title 51 — Sales and Exchanges

## Chapter 51-33 — Consumer Credit Report Security Freezes

### § 51-33-01. Definitions.

In this chapter, unless the context or subject matter otherwise requires:
1. "Consumer report" has the same meaning as provided in 15 U.S.C. 1681(a)(d).
2. "Consumer reporting agency" means any person that for monetary fees or dues, or on
a cooperative nonprofit basis, regularly engages in the practice of assembling or
evaluating consumer credit information or other information on consumers for the
purpose of furnishing consumer reports to third parties, and which uses any means or
facility of interstate commerce for the purpose of preparing or furnishing consumer
reports.
3. "Proper identification" means information sufficient to verify identity. Only if the
consumer is unable to sufficiently provide self-identifying information may a consumer
reporting agency require additional information concerning the consumer's
employment and personal or family history in order to verify the consumer's identity.
4. "Security freeze" means a notice placed in a consumer's consumer report, at the
request of the consumer and subject to certain exceptions, that prohibits the consumer
reporting agency from releasing the consumer credit file or any information derived
from it, without the express authorization of the consumer. If a security freeze is in
place, information from a consumer's consumer credit file may not be released to a
third party without prior express authorization from the consumer. A security freeze
does not prevent a consumer reporting agency from advising a third party that a
security freeze is in effect with respect to the consumer report.
5. "Victim of identity theft" means a consumer who has a copy of a valid police report,
investigative report, or complaint to law enforcement evidencing that the consumer has
alleged to be a victim of identity theft.
### § 51-33-02. Right to obtain security freeze.

A consumer may elect to place a security freeze on the consumer's consumer credit file by
making a request to a consumer reporting agency. The consumer may make the request:
1. By mail;
2. By telephone by providing proper identification or certain personal identification
required by the consumer reporting agency; or
3. Directly to the consumer reporting agency through a secure electronic mail connection
if the connection is made available by the consumer reporting agency.
### § 51-33-03. Response of consumer reporting agency.

1. A consumer reporting agency shall place a security freeze on a consumer's consumer
credit file no later than three business days after receiving from the consumer a
request under section 51-33-02 which includes proper identification. If a victim of
identity theft requests a security freeze, a consumer reporting agency shall place a
security freeze on the consumer's credit report no later than forty-eight hours after
receiving:
a. A notice under section 51-33-02; and
b. A copy of a valid police report, investigative report, or complaint to law
enforcement evidencing the identity theft victim has alleged being a victim of
identity theft. The copy may be transmitted to the consumer reporting agency by
mail, facsimile, or secure electronic mail connection, if the connection is made
available by the consumer reporting agency.
2. Effective August 1, 2009, if a victim of identity theft requests a security freeze, a
consumer reporting agency shall place a security freeze on the consumer's credit
report no later than twenty-four hours after receiving:
a. A notice under section 51-33-02; and

b. A copy of a valid police report, investigative report, or complaint to law
enforcement evidencing the identity theft victim has alleged being a victim of
identity theft. The copy may be transmitted to the consumer reporting agency by
mail, facsimile, or secure electronic mail connection, if the connection is made
available by the consumer reporting agency.
3. The consumer reporting agency, within five business days after receiving the request,
shall send a written confirmation of the security freeze to the consumer and provide
the consumer with a unique personal identification number or password to be used by
the consumer when providing authorization for the release of the consumer's
consumer report for a specific party or period of time.
4. When a consumer requests a security freeze, the consumer reporting agency shall
disclose the process of placing and temporarily lifting a freeze, including the process
for allowing access to information from the consumer's consumer report for a specific
party or period of time while the freeze is in place.
### § 51-33-04. Temporary lifting or permanent removal of the freeze.

1. If the consumer wishes to allow the consumer's consumer credit file to be accessed for
a specific party or period of time while a freeze is in place, the consumer shall contact
the consumer reporting agency, request that the freeze be temporarily lifted, and
provide the following:
a. Proper identification;
b. The unique personal identification number or password provided by the credit
reporting agency under section 51-33-03;
c. The proper information regarding the third party who is to receive the consumer
report or access the credit file or the time period for which the report or credit file
is to be available to users of the consumer credit file; and
d. A fee if applicable.
2. a. A consumer reporting agency that receives a request by mail from a consumer to
temporarily lift a freeze on a consumer credit file under this section shall comply
with the request no later than two business days after receiving the request
unless the consumer fails to provide proper identification and the unique personal
identification number or password provided by the credit reporting agency under
section 51-33-03.
b. A consumer reporting agency that receives a request by telephone or through a
secure electronic connection from a consumer to temporarily lift a freeze on a
consumer credit file under this section shall comply with the request no later than
fifteen minutes after receiving the request unless the consumer fails to provide
proper identification and the unique personal identification number or password
provided by the credit reporting agency under section 51-33-03 or the consumer
reporting agency's ability to remove the security freeze within fifteen minutes is
prevented by:
(1) A natural disaster or act of God, including fire, earthquake, or hurricane;
(2) Unauthorized or illegal acts by a third party, including terrorism, sabotage,
riot, vandalism, or a labor strike or similar labor dispute disrupting
operations;
(3) Operational interruption, including electrical failure, unanticipated delay in
equipment or replacement part delivery, or computer hardware or software
failures inhibiting response time;
(4) Governmental action, including emergency orders or regulations or judicial
or law enforcement action;
(5) Receipt of a removal request outside of normal business hours; or
(6) Maintenance of, updates to, or repair of the consumer reporting agency's
systems, whether regularly scheduled, unscheduled, or unexpected.
c. For the purposes of this section, "normal business hours" means from six a.m. to
nine-thirty p.m., central standard time or central daylight time, seven days a
week, excluding holidays other than Sundays.

3. A consumer reporting agency may develop procedures involving the use of telephone,
fax, internet, or other electronic media to receive and process a request from a
consumer to temporarily lift a freeze on a consumer report under this section in an
expedited manner, with the goal of processing a request within fifteen minutes after the
request.
4. A consumer reporting agency shall remove or temporarily lift a freeze placed on a
consumer report only in the following cases:
a. Upon consumer request under this section; or
b. When the consumer credit file was frozen due to a material misrepresentation of
fact by the consumer. When a consumer reporting agency intends to remove a
freeze on a consumer credit file under this section, the consumer reporting
agency shall notify the consumer in writing at least three business days prior to
removing the freeze on the consumer credit file.
5. A security freeze remains in place until the consumer requests that the security freeze
be removed. A consumer reporting agency shall remove a security freeze within three
business days of receiving a request for removal from the consumer, who provides
both of the following:
a. Proper identification; and
b. The unique personal identification number or password provided by the credit
reporting agency under section 51-33-03.
### § 51-33-05. Response by third party to denial of access.

When a third party requests access to a consumer report on which a security freeze is in
effect, and this request is in connection with an application for credit or the opening of an
account and the consumer does not allow the consumer's consumer report to be accessed for
that specific party or period of time, the third party may treat the application as incomplete.
### § 51-33-06. Nonapplicability.

Sections 51-33-01 through 51-33-05 do not apply to the use of a consumer report by any of
the following:
1. A person or entity, or a subsidiary, affiliate, or agent of that person or entity, or an
assignee of a financial obligation owing by the consumer to that person or entity, or a
prospective assignee of a financial obligation owing by the consumer to that person or
entity in conjunction with the proposed purchase of the financial obligation, with which
the consumer has or had prior to assignment an account or contract, including a
demand deposit account, or to whom the consumer issued a negotiable instrument, for
the purposes of reviewing the account or collecting the financial obligation owing for
the account, contract, or negotiable instrument. For purposes of this subsection,
"reviewing the account" includes activities related to account maintenance, monitoring,
credit line increases, and account upgrades and enhancements;
2. A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom
access has been granted under section 51-33-04 for purposes of facilitating the
extension of credit or other permissible use;
3. Any federal, state, or local governmental entity, including a law enforcement agency,
court, or its agents or assigns;
4. A private collection agency acting under a court order, warrant, or subpoena;
5. Any person or entity for the purposes of prescreening as provided for by the Fair
Credit Reporting Act [15 U.S.C. 1681 et seq.];
6. Any person or entity administering a credit file monitoring subscription service to which
the consumer has subscribed;
7. Any person or entity for the purpose of providing a consumer with a copy of the
consumer's consumer report upon the consumer's request;
8. Any person or entity for use in setting or adjusting a rate, adjusting a claim, or
underwriting for insurance purposes. This exemption does not determine or affect
whether these uses are permitted under other law; and

9. A consumer reporting agency for its database or file that consists entirely of
information concerning, and used solely for, one or more of the following:
a. Criminal record information;
b. Tenant screening;
c. Employment screening; and
d. Fraud prevention or detection.
### § 51-33-07. Information to government agencies not affected.

Sections 51-33-01 through 51-33-06 do not prohibit a consumer reporting agency from
furnishing to a governmental agency a consumer's name, address, former address, places of
employment, or former places of employment.
### § 51-33-08. Fees.

1. A consumer reporting agency may charge a fee not to exceed five dollars for placing
or temporarily lifting a security freeze unless:
a. The consumer is a victim of identity theft; and
b. The consumer provides, or has already provided in connection with the security
freeze, the consumer reporting agency with a valid copy of a police report or a
police case number documenting the identity theft, investigative report, or
complaint to a law enforcement agency.
2. In addition to the charge, if any, permitted under this section, a consumer may be
charged no more than five dollars if the consumer fails to retain the original personal
identification number given to the consumer by the agency, but the consumer may not
be charged for a one-time reissue of the same or a new personal identification
number. The consumer may be charged no more than five dollars for subsequent
instances of loss of the personal identification number. No other fees may be imposed
in connection with the security freeze.
### § 51-33-09. Changes to information - Written confirmation required.

If a security freeze is in place, a consumer reporting agency may not change any of the
following official information in a consumer report without sending a written confirmation of the
change to the consumer within thirty days of the change being posted to the consumer's file:
name, date of birth, social security number, and address. Written confirmation is not required for
technical modifications of a consumer's official information, including name and street
abbreviations, complete spellings, or transposition of numbers or letters. In the case of an
address change, the written confirmation shall be sent to both the new address and to the
former address.
### § 51-33-10. Security freeze not applicable to certain consumer reporting agencies.

A consumer reporting agency is not required to place a security freeze in a consumer credit
file under this chapter if it acts only as a reseller of credit information by assembling and
merging information contained in the database of another consumer reporting agency or
multiple consumer reporting agencies and does not maintain a permanent database of credit
information from which new consumer reports are produced. However, a consumer reporting
agency must honor any security freeze placed on a consumer credit file by another consumer
reporting agency.
### § 51-33-11. Exempt entities.

The following entities are not required to place a security freeze on a consumer credit file
under this chapter:
1. A check services or fraud prevention services company that issues reports on
incidents of fraud or authorizations for the purpose of approving or processing
negotiable instruments, electronic funds transfers, or similar methods of payments;
and

2. A deposit account information service company that issues reports regarding account
closures due to fraud, substantial overdrafts, ATM abuse, or similar negative
information regarding a consumer, to inquiring banks or other financial institutions for
use only in reviewing a consumer's request for a deposit account at the inquiring bank
or financial institution.
### § 51-33-12. Notice of rights.

At any time that a consumer is required to receive a summary of rights required under 15
U.S.C. 1681g or under North Dakota law, the following notice shall be included:
North Dakota Consumers Have the Right to Obtain a Security Freeze
You may obtain a security freeze on your consumer credit file at no charge to protect your
privacy and ensure that credit is not granted in your name without your knowledge. You have a
right to place a "security freeze" on your consumer credit file pursuant to North Dakota law.
The security freeze will prohibit a consumer reporting agency from releasing any information
in your consumer credit file without your express authorization or approval.
The security freeze is designed to prevent credit, loans, and services from being approved
in your name without your consent. When you place a security freeze on your credit file, within
five business days you will be provided a personal identification number or password to use if
you choose to remove the freeze on your credit file or to temporarily authorize the release of
your credit report or credit score for a specific party, parties, or period of time after the freeze is
in place. To provide that authorization, you must contact the consumer reporting agency and
provide all of the following:
1. The unique personal identification number or password provided by the consumer
reporting agency.
2. Proper identification to verify your identity.
3. The proper information regarding the third party or parties who are to receive the credit
report or the period of time for which the report shall be available to users of the credit
report.
A consumer reporting agency that receives a request from a consumer to lift temporarily a
freeze shall comply with the request no later than three business days after receiving the
request.
A consumer reporting agency may charge you up to five dollars each time you freeze or
temporarily lift the freeze, except a consumer reporting agency may not charge any amount to a
victim of identity theft who has submitted a copy of a valid investigative report or complaint to a
law enforcement agency about the unlawful use of the victim's information by another person.
A security freeze does not apply to circumstances where you have an existing account
relationship and a copy of your report is requested by your existing creditor or its agents or
affiliates for certain types of account review, collection, fraud control, or similar activities.
If you are actively seeking a new credit, loan, utility, or telephone account, you should
understand that the procedures involved in lifting a security freeze may slow your own
applications for credit. You should plan ahead and lift a freeze - either completely if you are
shopping around, or specifically for a certain creditor - with enough advance notice before you
apply for new credit for the lifting to take effect.
You have a right to bring a civil action against someone who violates your rights under the
credit reporting laws. The action can be brought against a consumer reporting agency or a user
of your credit report.
### § 51-33-13. Private enforcement.

1. If a consumer reporting agency erroneously releases a consumer's credit file or any
information derived from the file, the consumer reporting agency shall send written
notification to the affected consumer within five business days following discovery or
notification of the erroneous release, including specificity as to the information
released and the third-party recipient of the information. In addition, the affected
consumer in a civil action against the consumer reporting agency may recover:
a. Injunctive relief to prevent or restrain further violation of the security freeze;

b. The greater of actual damages or two thousand dollars in civil penalties for each
violation; and
c. Reasonable expenses, court costs, investigative costs, and attorney's fees.
2. Each violation of the security freeze shall be counted as a separate incident for
purposes of imposing penalties under this section.
### § 51-33-14. Enforcement by attorney general - Powers - Remedies - Separate violations

- Venue.
The attorney general may enforce this chapter. In enforcing this chapter, the attorney
general has all the powers provided in chapter 51-15 and may seek all the remedies in chapter
51-15. A violation of this chapter is a violation of chapter 51-15. Each violation of the security
freeze shall be counted as a separate violation. The remedies, duties, prohibitions, and
penalties of this chapter are not exclusive and are in addition to all other causes of action,
remedies, and penalties under chapter 51-15 and as otherwise provided by law. The attorney
general may bring an action pursuant to this section in either the county of the consumer's
residence or Burleigh County.
