Law / United States / 
Kentucky
Consumer report security freeze
In force since .
A data subject rights rule binding private bodies.
- Obligation class
- Data subject rights, Consent
- Audit expectation
- none
As of .
What it requires
- If you are a consumer reporting agency, place a security freeze on a consumer's consumer report no later than ten business days after you receive the consumer's request with clear and proper identification, and within the same period give the consumer a unique personal identification number or password and a written explanation of how to place, remove and temporarily lift a freeze (KRS 367.365(1)(a), (2)).
- While a freeze is in place, do not release information from the consumer report to a third party without the consumer's prior express authorization, except to a person or for a purpose KRS 367.365(9) lists (KRS 367.365(1)(b), (9)).
- Comply with a request to temporarily lift a freeze no later than three business days after you receive it, and remove a freeze within three business days after you receive a removal request that carries clear and proper identification and the personal identification number or password (KRS 367.365(6), (8)).
- While a freeze is in place, send the consumer written confirmation within 30 days of posting a change to the consumer's name, date of birth, Social Security number or address, to both the new and the former address for an address change (KRS 367.365(11)).
- Charge no more than ten dollars, adjusted each January 1 under the consumer price index, for placing, temporarily lifting or removing a freeze (KRS 367.365(10)).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Logging duty
KRS 367.365 requires a consumer reporting agency to place, lift and remove a security freeze on a consumer's request, to issue a personal identification number or password, and to confirm certain changes to official information in writing. A consumer's freeze request is not a log, and the sections name no duty to keep a log or a record of requests and give no body a power to inspect one.
- Kind
- None
- As of
What this law does
A consumer may elect to place a security freeze on the consumer's consumer report by a written request sent by certified mail, or by a telephone, fax, web-based or other electronic method the consumer reporting agency has established. A consumer reporting agency must place the freeze no later than ten business days after receiving the request.
While a freeze is in place, information from the consumer report may not be released to a third party without the consumer's prior express authorization, although the agency may tell a third party that a freeze is in effect. The agency must comply with a request to temporarily lift a freeze no later than three business days after receiving it.
The agency must remove a freeze within three business days of receiving the consumer's request with clear and proper identification and the personal identification number or password. The agency may charge a reasonable fee for placing, temporarily lifting or removing a freeze, and the fee may not exceed ten dollars, adjusted each January 1 under the consumer price index.
A person who willfully fails to comply is liable to the consumer for actual damages, liquidated damages of not less than $100 and not more than $1,000, any punitive damages the court allows, and costs and reasonable attorney's fees.
Kentucky defines a security freeze as a notice placed on a consumer file, at the request of the consumer and subject to certain exceptions, that prohibits a consumer reporting agency from releasing the consumer's consumer report or credit score relating to the extension of credit without the consumer's express authorization.
When LexLint raises it
When your app profile says your app provides financial services.