30-14-1728. Consumer reporting agency requirements. (1) Except as provided in subsection (2), a consumer reporting agency shall place a security freeze on a consumer's credit report no later than 5 business days after receiving from the consumer:

(a) a written or electronic request, as provided in 30-14-1727;

(b) proper identification; and

(c) a fee, if applicable.

(2) If a consumer who has been the victim of identity theft, as prescribed by 45-6-332, requests a security freeze, the consumer reporting agency shall place a security freeze on the consumer's credit report no later than 24 hours after receiving notice as provided in 30-14-1727 and a valid police report, investigative report, or complaint that the consumer has filed with a law enforcement agency.

(3) The consumer reporting agency shall send a written confirmation of the security freeze to the consumer within 5 business days of placing the security freeze and at the same time shall provide the consumer with a unique personal identification number, password, or similar device to be used by the consumer when providing authorization for a release of the consumer's credit for a specific party or period of time, as provided in 30-14-1729.

(4) A consumer reporting agency may not suggest or otherwise state or imply to a third party that the consumer's security freeze reflects a negative credit score, history, report, or rating.