(1) A consumer reporting agency shall place a security freeze on a consumer's credit report if all of the following are met:

    (a) The consumer reporting agency receives a request from the consumer for the placement of the security freeze under this act.

    (b) The consumer does all of the following:

    (i) Submits the request described in subdivision (a) to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency.

    (ii) Provides to the consumer reporting agency sufficient proof of identification of the consumer.

    (2) Within 5 business days after receiving a request that meets the requirements of subsection (1), a consumer reporting agency shall place a security freeze for the consumer.

    Within 5 business days after placing a security freeze on a consumer's credit report under section 11, the consumer reporting agency shall do all of the following:

    (a) Send a written confirmation of the security freeze to the consumer.

    (b) Provide the consumer with a unique personal identification number or password to be used by the consumer when authorizing the release of the consumer's credit report to a specific person or for a specific period of time.

    (c) Provide the consumer with a written statement of the procedures for requesting the consumer reporting agency to remove or temporarily lift a security freeze.

    Except as provided in section 14, if a security freeze is in place, a consumer reporting agency may not release a consumer's credit report or any information derived from a consumer's credit report without the express prior authorization of the consumer.

    (1) A consumer who does all of the following may temporarily lift a security freeze to allow access to the consumer's credit report by a specific person or for a specific period of time while the security freeze is in place:

    (a) Contacts the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency for making a request under subdivision (b).

    (b) Requests that the consumer reporting agency temporarily lift the security freeze.

    (c) Provides to the consumer reporting agency sufficient proof of identification of the consumer.

    (d) Includes with the request under subdivision (b) the unique personal identification number or password provided to the consumer under section 12(b).

    (e) Provides the proper information regarding the person that is to receive the credit report or the time period during which the credit report is to be available to users of the credit report.

    (2) Except as provided in subsection (3), a consumer reporting agency that receives a request to temporarily lift a security freeze under subsection (1) shall comply with the request within 3 business days after receiving the request.

    (3) If a consumer reporting agency receives a request to temporarily lift a security freeze under subsection (1) by telephone, by electronic mail, or by secure connection on the website of the consumer reporting agency, the consumer reporting agency shall comply with the request within 15 minutes after receiving the request. However, a consumer reporting agency is not required to temporarily lift a security freeze within 15 minutes if a delay in complying with the request is caused by any of the following:

    (a) An act of God, including, but not limited to, a fire, earthquake, hurricane, storm, or similar natural disaster or phenomena.

    (b) An unauthorized or illegal act by a third party, including, but not limited to, an act of terrorism, sabotage, riot, or vandalism, a labor strike or other labor dispute that disrupts the consumer reporting agency's operations, or a similar occurrence.

    (c) An interruption of the consumer reporting agency's operations, including, but not limited to, an electrical failure, an unanticipated delay in equipment or replacement part delivery, a computer hardware or software failure that inhibits response time, or a similar disruption.

    (d) Governmental action, including, but not limited to, an emergency order or regulation, judicial or law enforcement action, or a similar directive.

    (e) Regularly scheduled maintenance of, or updates to, the consumer reporting agency's systems that occurs outside of normal business hours.

    (f) Commercially reasonable maintenance of, or repair to, the consumer reporting agency's systems that is unexpected or unscheduled.

    If, in connection with an application for credit or for any other use, a person requests access to a consumer's credit report while a security freeze is in place and the consumer does not authorize access to the consumer's credit report, the person may treat the application as incomplete.

    A security freeze on a consumer's credit report shall remain in place until 1 of the following occurs:

    (a) The freeze is temporarily lifted at the consumer's request under section 14.

    (b) The freeze is removed at the consumer's request under section 17.

    (c) The freeze is removed by the consumer reporting agency because the freeze was placed based on a material misrepresentation of fact by the consumer. However, if a consumer reporting agency intends to remove a security freeze under this subdivision, the consumer reporting agency must notify the consumer in writing of its intent at least 5 business days before removing the security freeze.

    (1) A consumer reporting agency shall remove a security freeze on a consumer's credit report if the consumer does all of the following:

    (a) Contacts the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency for making a request to remove a security freeze.

    (b) Requests the removal of the security freeze on his or her credit report.

    (c) Provides to the consumer reporting agency sufficient proof of identification of the consumer.

    (d) Includes with the request under subdivision (b) the unique personal identification number or password provided to the consumer under section 12(b).

    (2) A consumer reporting agency that receives a request for removal of a security freeze under subsection (1) shall comply with the request within 3 business days after receiving the request.