Except as provided in section 14, if a security freeze is in place, a consumer reporting agency may not release a consumer's credit report or any information derived from a consumer's credit report without the express prior authorization of the consumer.