SECURITY FREEZE ACT
Act 229 of 2013
AN ACT to require certain consumer reporting agencies to place security freezes for consumers under certain circumstances; to provide for the removal of those security freezes; to prescribe the powers and duties of certain state agencies and officials; and to provide remedies.

History: 2013, Act 229, Eff. Jan. 1, 2014 ;-- Am. 2018, Act 76, Eff. June 17, 2018

The People of the State of Michigan enact: ARTICLE 1

445.2511 Short title.

Sec. 1.

This act shall be known and may be cited as the "security freeze act".

History: 2013, Act 229, Eff. Jan. 1, 2014

445.2512 Definitions.

Sec. 2.

As used in this act:

(a) "Consumer" means an individual who resides in this state.

(b) "Consumer reporting agency" means any person that, for monetary fees or dues or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing credit reports to third parties and that uses any means or facility of interstate commerce for the purpose of preparing or furnishing credit reports.

(c) "Credit report" means any written, oral, or other communication of any information by a consumer reporting agency that is related to a consumer's creditworthiness, credit standing, or credit capacity, and is issued or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for credit.

(d) "File" means all of the information about a consumer that is recorded and retained by a consumer reporting agency regardless of how the information is stored.

(e) "Protected consumer" means either of the following:

(i) An individual who is under 16 years of age at the time a request for the placement of a security freeze is made.

(ii) An incapacitated person or a protected person for whom a guardian or conservator has been appointed has been appointed under article V of the estates and protected individuals code, 1998 PA 386, MCL 700.5101 to 700.5520.

(f) "Record" means a compilation of information that meets all of the following:

(i) Identifies a protected consumer.

(ii) Is created by a consumer reporting agency solely for the purpose of complying with article 3.

(iii) May not be created or used to consider the protected consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living for any purpose authorized under section 604 of the fair credit reporting act, 15 USC 1681b.

(g) "Representative" means an individual who provides to a consumer reporting agency sufficient proof of authority to act on behalf of a protected consumer.

(h) "Security freeze" means a restriction placed on a consumer's credit report at the request of the consumer that prohibits a consumer reporting agency from releasing the consumer's credit report or any information derived from the consumer's credit report without the express authorization of or on behalf of the consumer.

(i) "Security freeze for a protected consumer" means any of the following:

(i) If a consumer reporting agency does not have a file pertaining to a protected consumer, a security freeze that meets both of the following:

(A) Is placed on the protected consumer's record under this

act.

(B) Prohibits the consumer reporting agency from releasing the protected consumer's record except as provided in this act.

(ii) If a consumer reporting agency has a file pertaining to the protected consumer, a security freeze that meets both of the following:

(A) Is placed on the protected consumer's credit report under this act.

(B) Prohibits the consumer reporting agency from releasing the protected consumer's credit report or any information derived from the protected consumer's credit report except as provided in this act.

(j) "Sufficient proof of authority" means documentation that shows that a representative has authority to act on behalf of a protected consumer, including, but not limited to, any of the following:

(i) An order issued by a court of law.

(ii) A lawfully executed and valid power of attorney.

(iii) A written, notarized statement signed by a representative that expressly describes the authority of the representative to act on behalf of a protected consumer.

(k) "Sufficient proof of identification" means information or documentation that identifies a consumer, a protected consumer, or a representative of a protected consumer, including, but not limited to, any of the following:

(i) A social security number or a copy of a social security card issued by the social security administration.

(ii) A certified or official copy of a birth certificate issued by the entity authorized to issue the birth certificate.

(iii) A copy of an operator's license or chauffeur's license issued under the Michigan vehicle code, 1949 PA 300, MCL 257.1 to 257.923, an official state personal identification card issued under 1972 PA 222, MCL 28.291 to 28.300, or any other government–issued identification.

History: 2013, Act 229, Eff. Jan. 1, 2014

445.2513 Inapplicability of Article 2 to certain entities or uses.

Sec. 3.

Article 2 does not apply to any of the following entities or uses:

(a) A person, or a subsidiary, affiliate, agent, or assignee of a person, with which the consumer has, or before assignment had, an account, contract, or debtor-creditor relationship, for the purpose of account review or collecting the financial obligation owing for the account, contract, or debt.

(b) A person that was given access to a consumer's credit report for the purpose of facilitating an extension of credit to the consumer or another permissible use.

(d) A unit of state or local government that administers a program for establishing and enforcing child support obligations.

(e) The department of human services in connection with a fraud investigation conducted by that department.

(f) Any state or local taxing authority in connection with any of the following:

(i) An investigation conducted by that taxing authority.

(ii) The collection of delinquent taxes or unpaid court orders by the taxing authority.

(iii) The performance of any other duty provided for by law.

(g) A person that furnishes a credit report, or requests that a credit report be furnished, that relates to a consumer in connection with a credit or insurance transaction not initiated by a consumer, if the requirements of 15 USC 1681b(c) are met.

(h) A person that administers a credit file monitoring subscription service to which a consumer or protected consumer has subscribed.

(i) A person that provides a consumer or the consumer's representative with a copy of the consumer's credit report on request of the consumer or the representative.

(j) To the extent not prohibited by another law of this state, a person engaged solely in setting or adjusting an insurance rate, adjusting an insurance claim, or underwriting an insurance risk.

(k) A check services or fraud prevention services company that issues any of the following:

(i) Reports on incidents of fraud.

(ii) Authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar payment methods.

(l) A deposit account information service company that issues reports regarding account closures due to fraud, substantial overdrafts, or automated teller machine abuse or provides similar information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution.

(m) A consumer reporting agency database or file that consists entirely of consumer information concerning, and used solely for, 1 or more of the following:

(i) Criminal record information.

(ii) Personal loss history information.

(iii) Fraud prevention or detection.

(iv) Employment screening.

(v) Tenant screening.

(n) A consumer reporting agency that meets both of the following:

(i) It is only engaged in reselling resell credit information by assembling and merging information contained in a database of 1 or more consumer reporting agencies.

(ii) It does not maintain a permanent database of credit information it obtains for purposes of subparagraph (i).

History: 2013, Act 229, Eff. Jan. 1, 2014

445.2514 Inapplicability of Article 3 to certain entities or uses.

Sec. 4.

Article 3 does not apply to any of the following entities or uses:

(a) A person that is acting under a court order, warrant, or subpoena.

(b) A person that administers a credit file monitoring subscription service to which a consumer or protected consumer has subscribed.

(c) A person that provides a consumer or the consumer's representative with a copy of the consumer's credit report on request of the consumer or the representative.

(d) A check services or fraud prevention services company that issues any of the following:

(i) Reports on incidents of fraud.

(ii) Authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar payment methods.

(e) A deposit account information service company that issues reports regarding account closures due to fraud, substantial overdrafts, or automated teller machine abuse or provides similar information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution.

(f) A consumer reporting agency database or file that consists entirely of consumer information concerning, and used solely for, 1 or more of the following:

(i) Criminal record information.

(ii) Personal loss history information.

(iii) Fraud prevention or detection.

(iv) Employment screening.

(v) Tenant screening.

(g) A consumer reporting agency that meets both of the following:

(i) It is only engaged in reselling resell credit information by assembling and merging information contained in a database of 1 or more consumer reporting agencies.

(ii) It does not maintain a permanent database of credit information it obtains for purposes of subparagraph (i).

History: 2013, Act 229, Eff. Jan. 1, 2014

ARTICLE 2

445.2521 Placement of security freeze on consumer's credit report; conditions; days.

Sec. 11.

(1) A consumer reporting agency shall place a security freeze on a consumer's credit report if all of the following are met:

(a) The consumer reporting agency receives a request from the consumer for the placement of the security freeze under this act.

(b) The consumer does all of the following:

(i) Submits the request described in subdivision (a) to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency.

(ii) Provides to the consumer reporting agency sufficient proof of identification of the consumer.

(2) Within 5 business days after receiving a request that meets the requirements of subsection (1), a consumer reporting agency shall place a security freeze for the consumer.

History: 2013, Act 229, Eff. Jan. 1, 2014 ;-- Am. 2018, Act 76, Eff. June 17, 2018

445.2522 Placement of security freeze on consumer's credit report; duties of consumer reporting agency.

Sec. 12.

Within 5 business days after placing a security freeze on a consumer's credit report under section 11, the consumer reporting agency shall do all of the following:

(a) Send a written confirmation of the security freeze to the consumer.

(b) Provide the consumer with a unique personal identification number or password to be used by the consumer when authorizing the release of the consumer's credit report to a specific person or for a specific period of time.

(c) Provide the consumer with a written statement of the procedures for requesting the consumer reporting agency to remove or temporarily lift a security freeze.

History: 2013, Act 229, Eff. Jan. 1, 2014

445.2523 Release of credit report or information; express prior authorization required.

Sec. 13.

Except as provided in section 14, if a security freeze is in place, a consumer reporting agency may not release a consumer's credit report or any information derived from a consumer's credit report without the express prior authorization of the consumer.

History: 2013, Act 229, Eff. Jan. 1, 2014

445.2524 Temporary lifting of security freeze.

Sec. 14.

(1) A consumer who does all of the following may temporarily lift a security freeze to allow access to the consumer's credit report by a specific person or for a specific period of time while the security freeze is in place:

(a) Contacts the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency for making a request under subdivision (b).

(b) Requests that the consumer reporting agency temporarily lift the security freeze.

(d) Includes with the request under subdivision (b) the unique personal identification number or password provided to the consumer under section 12(b).

(e) Provides the proper information regarding the person that is to receive the credit report or the time period during which the credit report is to be available to users of the credit report.

(2) Except as provided in subsection (3), a consumer reporting agency that receives a request to temporarily lift a security freeze under subsection (1) shall comply with the request within 3 business days after receiving the request.

(3) If a consumer reporting agency receives a request to temporarily lift a security freeze under subsection (1) by telephone, by electronic mail, or by secure connection on the website of the consumer reporting agency, the consumer reporting agency shall comply with the request within 15 minutes after receiving the request. However, a consumer reporting agency is not required to temporarily lift a security freeze within 15 minutes if a delay in complying with the request is caused by any of the following:

(a) An act of God, including, but not limited to, a fire, earthquake, hurricane, storm, or similar natural disaster or phenomena.

(b) An unauthorized or illegal act by a third party, including, but not limited to, an act of terrorism, sabotage, riot, or vandalism, a labor strike or other labor dispute that disrupts the consumer reporting agency's operations, or a similar occurrence.

(c) An interruption of the consumer reporting agency's operations, including, but not limited to, an electrical failure, an unanticipated delay in equipment or replacement part delivery, a computer hardware or software failure that inhibits response time, or a similar disruption.

(d) Governmental action, including, but not limited to, an emergency order or regulation, judicial or law enforcement action, or a similar directive.

(e) Regularly scheduled maintenance of, or updates to, the consumer reporting agency's systems that occurs outside of normal business hours.

(f) Commercially reasonable maintenance of, or repair to, the consumer reporting agency's systems that is unexpected or unscheduled.

History: 2013, Act 229, Eff. Jan. 1, 2014 ;-- Am. 2018, Act 76, Eff. June 17, 2018

445.2525 Incomplete credit application.

Sec. 15.

If, in connection with an application for credit or for any other use, a person requests access to a consumer's credit report while a security freeze is in place and the consumer does not authorize access to the consumer's credit report, the person may treat the application as incomplete.

History: 2013, Act 229, Eff. Jan. 1, 2014

445.2526 Duration of security freeze.

Sec. 16.

A security freeze on a consumer's credit report shall remain in place until 1 of the following occurs:

(a) The freeze is temporarily lifted at the consumer's request under section 14.

(b) The freeze is removed at the consumer's request under section 17.

(c) The freeze is removed by the consumer reporting agency because the freeze was placed based on a material misrepresentation of fact by the consumer. However, if a consumer reporting agency intends to remove a security freeze under this subdivision, the consumer reporting agency must notify the consumer in writing of its intent at least 5 business days before removing the security freeze.

History: 2013, Act 229, Eff. Jan. 1, 2014

445.2527 Removal of security freeze.

Sec. 17.

(1) A consumer reporting agency shall remove a security freeze on a consumer's credit report if the consumer does all of the following:

(a) Contacts the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency for making a request to remove a security freeze.

(b) Requests the removal of the security freeze on his or her credit report.

(d) Includes with the request under subdivision (b) the unique personal identification number or password provided to the consumer under section 12(b).

(2) A consumer reporting agency that receives a request for removal of a security freeze under subsection (1) shall comply with the request within 3 business days after receiving the request.

History: 2013, Act 229, Eff. Jan. 1, 2014 ;-- Am. 2018, Act 76, Eff. June 17, 2018

ARTICLE 3

445.2531 Placement of security freeze on protected consumer's credit report; requirements; record; days.

Sec. 21.

(1) A consumer reporting agency shall place a security freeze on a protected consumer's credit report if all of the following are met:

(a) The consumer reporting agency receives a request from the representative of the protected consumer for the placement of the security freeze.

(b) The protected consumer's representative does all of the following:

(i) Submits the request to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency.

(ii) Provides to the consumer reporting agency sufficient proof of identification for the protected consumer and the representative.

(iii) Provides to the consumer reporting agency his or her sufficient proof of authority.

(2) If a consumer reporting agency does not have a file pertaining to a protected consumer when the consumer reporting agency receives a request under subsection (1), the consumer reporting agency shall create a record for the protected consumer.

(3) Within 30 days after receiving a request that meets the requirements of subsection (1), a consumer reporting agency shall place a security freeze for the protected consumer.

History: 2013, Act 229, Eff. Jan. 1, 2014 ;-- Am. 2018, Act 76, Eff. June 17, 2018

445.2532 Release of protected consumer's credit report, information, or record; duration of security freeze.

Sec. 22.

(1) If a security freeze is in place, a consumer reporting agency may not release a protected consumer's credit report, any information derived from the protected consumer's credit report, or any record created for the protected consumer.

(2) A security freeze for a protected consumer shall remain in effect until 1 of the following is met:

(a) The protected consumer or the protected consumer's representative requests the consumer reporting agency to remove the security freeze under section 23.

(b) The security freeze is removed under section 25.

History: 2013, Act 229, Eff. Jan. 1, 2014

445.2533 Removal of security freeze for protected consumer.

Sec. 23.

A consumer reporting agency shall remove a security freeze for a protected consumer placed under section 21 within 30 days after the protected consumer or the protected consumer's representative does all of the following:

(a) Submits a request for the removal of the security freeze to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency.

(b) Provides 1 of the following to the consumer reporting agency:

(i) If the request for removal is submitted by the protected consumer, all of the following:

(A) Proof that the sufficient proof of authority for the protected consumer's representative to act on behalf of the protected consumer is no longer valid.

(B) Sufficient proof of identification of the protected consumer.

(ii) If the request for removal is submitted by the representative of a protected consumer, all of the following:

(A) Sufficient proof of identification of the protected consumer and the representative.

(B) Sufficient proof of authority to act on behalf of the protected consumer.

History: 2013, Act 229, Eff. Jan. 1, 2014 ;-- Am. 2018, Act 76, Eff. June 17, 2018

445.2534 Removal of security freeze for protected consumer; time requirement.

Sec. 24.

Within 30 days after receiving a request that meets the requirements of section 23, a consumer reporting agency shall remove a security freeze for the protected consumer.

History: 2013, Act 229, Eff. Jan. 1, 2014

445.2535 Removal of security freeze for protected consumer; material misrepresentation of fact.

Sec. 25.

A consumer reporting agency may remove a security freeze for a protected consumer or delete a record of a protected consumer if the security freeze was placed or the record was created based on a material misrepresentation of fact by the protected consumer or the protected consumer's representative.

History: 2013, Act 229, Eff. Jan. 1, 2014

ARTICLE 4

445.2541 Fee; prohibition.

Sec. 31.

A consumer reporting agency may not charge a fee for the placement, temporary lifting, or removal of a security freeze for a consumer under article 2 or for a protected consumer under article 3.

History: 2013, Act 229, Eff. Jan. 1, 2014 ;-- Am. 2018, Act 76, Eff. June 17, 2018

445.2542 Injunctive or judicial relief.

Sec. 32.

The attorney general may apply to the circuit court for Ingham county, or to the circuit court for the county in which a violation of this act is alleged to have occurred or in which the person that allegedly violated this act resides or is located, for injunctive or other appropriate judicial relief or remedy. However, this act does not create a private cause of action for a violation of this act.

History: 2013, Act 229, Eff. Jan. 1, 2014

Rendered 8/15/2025 12:04 AM
Michigan Compiled Laws Complete Through PA 5 of 2025
Courtesy of legislature.mi.gov