30-14-1729. (Temporary) Temporary lifting of security freeze -- consumer requirements -- consumer reporting agency duties -- notification. (1) A consumer who wishes to allow access to the consumer's own credit report by a specific party or for a specific period of time while a security freeze is in place shall contact each consumer reporting agency, using a point of contact designated by the consumer reporting agency by regular or certified mail, telephone, or a secure electronic connection, request that the security freeze be temporarily lifted, and provide all of the following:

(a) proper identification;

(b) the unique personal identification number, password, or device provided by the consumer reporting agency pursuant to 30-14-1728(3);

(c) the proper information regarding the third party who is to receive the credit report or the time period for which the credit report is to be available to users of the credit report; and

(d) a fee, if applicable.

(2) (a) Except as provided in subsection (2)(b), a consumer reporting agency that receives a request from a consumer to temporarily lift a security freeze on a credit report as provided in subsection (1) shall comply with the request no later than 3 business days after receiving the request.

(b) By no later than January 31, 2009, a consumer reporting agency shall honor a request for the temporary lifting of a security freeze made by telephone or through a secure electronic connection designated by the consumer reporting agency within 15 minutes of receiving the request unless one of the following circumstances applies:

(i) the consumer fails to meet the requirements of subsections (1)(a) through (1)(c); or

(ii) the consumer reporting agency's ability to remove the security freeze within 15 minutes is prevented by:

(A) a natural disaster or act of God, including fire, earthquake, or hurricane;

(B) unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, or a labor strike or similar labor dispute disrupting operations;

(C) operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, or computer hardware or software failures inhibiting response time;

(D) governmental action, including emergency orders or regulations or judicial or law enforcement action;

(E) receipt of a removal request outside of normal business hours; or

(F) maintenance of, updates to, or repair of the consumer reporting agency's systems, whether regularly scheduled or unexpected or unscheduled.

(c) For the purposes of this section, "normal business hours" means from 6 a.m. to 9:30 p.m., mountain standard time or mountain daylight time, 7 days a week, excluding holidays.

(3) A consumer reporting agency shall:

(a) designate the contact address and telephone number along with a telefax number or appropriate electronic access address when providing the unique personal identification number, password, or other device as provided in 30-14-1728(3); and

(b) develop procedures to implement this section by January 31, 2009, involving the use of telephone, telefax, or electronic connection, using a process for legally required notices provided for in the Electronic Signatures in Global and National Commerce Act, 15 U.S.C. 7001.

(4) Only the attorney general may enforce the provisions of this section related to a failure to comply with the 15-minute requirement for the temporary lifting of a security freeze.

30-14-1729. (Effective on occurrence of contingency) Temporary lifting of security freeze -- consumer requirements -- consumer reporting agency duties -- notification. (1) A consumer who wishes to allow access to the consumer's own credit report by a specific party or for a specific period of time while a security freeze is in place shall contact each consumer reporting agency, using a point of contact designated by the consumer reporting agency by regular or certified mail, telephone, or a secure electronic connection, request that the security freeze be temporarily lifted, and provide all of the following:

(a) proper identification;

(b) the unique personal identification number, password, or device provided by the consumer reporting agency pursuant to 30-14-1728(3);

(c) the proper information regarding the third party who is to receive the credit report or the time period for which the credit report is to be available to users of the credit report; and

(d) a fee, if applicable.

(2) (a) Except as provided in subsection (2)(b), a consumer reporting agency that receives a request from a consumer to temporarily lift a security freeze on a credit report as provided in subsection (1) shall comply with the request no later than 3 business days after receiving the request.

(b) By no later than January 31, 2009, a consumer reporting agency shall honor a request for the temporary lifting of a security freeze made by telephone or through a secure electronic connection designated by the consumer reporting agency within 15 minutes of receiving the request unless one of the following circumstances applies:

(i) the consumer fails to meet the requirements of subsections (1)(a) through (1)(c); or

(ii) the consumer reporting agency's ability to remove the security freeze within 15 minutes is prevented by:

(A) a natural disaster or act of God, including fire, earthquake, or hurricane;

(B) unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, or a labor strike or similar labor dispute disrupting operations;

(C) operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, or computer hardware or software failures inhibiting response time;

(D) governmental action, including emergency orders or regulations or judicial or law enforcement action;

(E) receipt of a removal request outside of normal business hours; or

(F) maintenance of, updates to, or repair of the consumer reporting agency's systems, whether regularly scheduled or unexpected or unscheduled.

(c) For the purposes of this section, "normal business hours" means from 6 a.m. to 9:30 p.m., mountain daylight time, 7 days a week, excluding holidays.

(3) A consumer reporting agency shall:

(a) designate the contact address and telephone number along with a telefax number or appropriate electronic access address when providing the unique personal identification number, password, or other device as provided in 30-14-1728(3); and

(b) develop procedures to implement this section by January 31, 2009, involving the use of telephone, telefax, or electronic connection, using a process for legally required notices provided for in the Electronic Signatures in Global and National Commerce Act, 15 U.S.C. 7001.

(4) Only the attorney general may enforce the provisions of this section related to a failure to comply with the 15-minute requirement for the temporary lifting of a security freeze.