Summary Of State Laws

Summary of State Security Freeze and Security Breach Notification Laws

(updated 18 July 2006)

In response to numerous security breaches, and to the failure of credit bureaus and creditors to give consumers control over their confidential consumer information that leads to credit card fraud, debit card/checking account fraud and identity theft, states are enacting laws to protect consumers. This page summarizes state activity in two important areas. Security freeze laws allow consumers to prevent identity theft by freezing their credit reports from access for new credit. Security breach notification laws require companies and other entities that have lost data to notify affected consumers. These laws are based on the state PIRG/Consumers Union Clean Credit and Identity Theft Model Act.

State Security Freeze and Security Breach Notification Laws

Generally, fees listed, if any, are for "any consumer." Victims of identity theft, and in some cases, senior citizens, do not pay fees, even in states with fees for others. Generally, victims must provide either a "police report" or an "identity theft report" to prove their victim status. Not all police departments take "police reports" from identity theft victims. To obtain a security freeze right, you can generally instead file a simpler identity theft report (more information available here from FTC). Ask the credit bureau for a form to fill out and send in.

Security freezes protecting you from identity theft can be temporarily lifted, unfrozen or thawed, when you seek credit yourself. The terms mean the same thing.

California: available for all consumers.
Passed: September 2001.
Effective: January 1, 2003.
Freeze Fee: none for victims, others pay up to $10 per freeze.
Thaw (or Temporary Lift) Fee: $10 for temporary lifting for a given period, $12 for temporary lift for one creditor.

Colorado: available for all consumers.
Passed: June 2005
Effective: July 1, 2006.
Freeze Fee: none for first freeze, $10 per subsequent freeze.
Thaw (or Temporary Lift) Fee: $10 for temporary lifting for a given period, $12 for temporary lift for one creditor.

Connecticut: available for all consumers.
Passed: June 24, 2005.
Effective: January 1, 2006.
Freeze Fee: $10.
Thaw (or Temporary Lift) Fee: $10 for temporary lifting for a given period, $12 for temporary lift for one creditor.

Delaware: available for all consumers.
Passed: June 24, 2005.
Effective: September 28, 2006
Freeze Fee: $20.
Thaw (or Temporary Lift) Fee: free to temporarily lift for a given period or for a specific creditor.

Florida: available for all consumers.
Passed: April 2006.
Effective: July 1, 2006.
Freeze Fee: none for victims of identity theft with investigative report or seniors aged 65+.  For others, the fee is $10.
Thaw (or Temporary Lift) Fee: $10 to temporarily lift or remove.

Hawaii: available only for victims of identity theft with a police investigative report or complaint filed with a law enforcement agency.
Passed: April 2006.
Effective: January 1, 2007.
Freeze Fee: none.
Thaw (or Temporary Lift) Fee: none.

Illinois: After January 1, 2007, the freeze will be available for all consumers.  Prior to this date, the law only applies to identity theft victims.
Passed: May 24, 2006
Effective: January 1, 2007.
Freeze Fee: none for seniors 65+, $10 for others.
Thaw (or Temporary Lift) Fee: none for seniors 65+, $10 for others to remove or temporarily thaw.

Kansas: available only for victims of identity theft with a policy investigative report or a complaint filed with a law enforcement agency.
Passed: April 2006.
Effective: January 1, 2007.
Freeze Fee: none.
Thaw (or Temporary Lift) Fee: none.

Kentucky: available for all consumers.
Passed: March 24, 2006.
Effective: July 1, 2006.
Freeze Fee: none for victims of identity theft with a police report, $10 for others.  Note: the freeze expires 7 years from date of placement.
Thaw (or Temporary Lift) Fee: none for victims of identity theft with a police report, $10 for others to remove, temporarily thaw, or have PIN reissued.

Louisiana: available for all consumers.
Passed: 2004.
Effective: July 1, 2005.
Freeze Fee: none for victims of identity theft or individuals age 62 or older, $10 for others.
Thaw (or Temporary Lift) Fee: none for victims of identity theft, $8 for others.

Maine: available for all consumers.
Passed: May 2005.
Effective: February 1, 2006.
Freeze Fee: none for victims of identity theft who provide a police report, $10 for others.
Thaw (or Temporary Lift) Fee: none for victims of identity theft who provide a police report, $10 to remove, temporarily thaw, or have PIN reissued, and $12 to lift for a specific creditor.

Minnesota: available for all consumers.
Passed: May 2006.
Effective: August 1, 2006.
Freeze Fee: none for victims of identity theft who provide a police report, $5 for others.
Thaw (or Temporary Lift) Fee: none for victims of identity theft who provide a police report; for others, $5 to remove, temporarily thaw, have PIN reissued, or lift for a specific creditor.

Nevada: available for all consumers.
Passed: June 2005.
Effective: October 1, 2005.
Freeze Fee: none for victims of identity theft who provide a police report, $15 for others.
Thaw (or Temporary Lift) Fee: none for victims of identity theft who provide a police report; for others, $18 to remove and $20 to lift for a specific creditor.

New Hampshire: available for all consumers.
Passed: May 2006.
Effective: January 1, 2007.
Freeze Fee: none for victims of identity theft who provide a police report, investigative report, or complaint to a law enforcement agency, and $10 for others.
Thaw (or Temporary Lift) Fee: none for victims of identity theft who provide a police report, investigative report, or complaint to a law enforcement agency, and $10 for others.

New Jersey: available for all consumers.
Passed: September 22, 2005.
Effective: January 1, 2006.
Freeze Fee: none for initial freeze
Thaw (or Temporary Lift) Fee: up to $5 to remove, thaw, or have PIN reissued.
Note: requested can be made directly to consumer reporting agencies via email.

New York: available for all consumers.
Passed: June 2006.
Effective: November 1, 2006.
Freeze Fee: none for initial freeze, and, for non-victims, $5 for subsequent freezes.
Thaw (or Temporary Lift) Fee: none for victims of identity theft, $5 for others. 

Oklahoma: available for all consumers.
Passed: May 2006.
Effective: January 1, 2007.
Freeze Fee: none for victims of identity theft or seniors 65+, $10 for others.
Thaw (or Temporary Lift) Fee: none for victims of identity theft or seniors 65+, $10 for others.
Note: to find the bill, click “Oklahoma,” select Senate, 2006 Regular Session and Enrolled—then click search.  Scroll to SB 1748.

North Carolina: available for all consumers.
Passed: September 21, 2005.
Effective: December 1, 2005.
Freeze Fee: none for victims of identity theft, $10 for others.
Thaw (or Temporary Lift) Fee: none for victims of identity theft, $10 for others to remove or temporarily thaw.

Rhode Island: available for all consumers.
Passed: June 30, 2006.
Effective: September 28, 2006.
Freeze Fee: none for victims of identity theft or seniors 65+, $10 for others.
Thaw (or Temporary Lift) Fee: none for victims of identity theft or seniors 65+, $10 for others to remove or temporarily thaw.

South Dakota: available for victims of identity theft with a police report.
Passed: March 2006.
Effective: July 1, 2006.
Freeze Fee: none.
Thaw (or Temporary Lift) Fee: none.
Note: the freeze expires 7 years from the date of placement or upon consumer’s request.

Texas: available for victims of identity theft with a police report.
Passed: June 2003.
Effective: September 1, 2003.
Freeze Fee: none.
Thaw (or Temporary Lift) Fee: none.

Utah: available for all consumers.
Passed: March 2006.
Effective: September 1, 2008.
Freeze Fee: “reasonable” rates.
Thaw (or Temporary Lift) Fee: “reasonable” rates.

Vermont: now is available for all consumers (before July 1, 2006, only for identity theft victims).
Passed: originally approved June 2004.
Effective: originally July 1, 2005.
Freeze Fee: None for victims, up to $10 others
Thaw (or Temporary Lift) Fee: None for victims, up to $5 others

Washington: available for identity theft victims, including persons who receive a notice of a security breach of computerized personal information.
Passed: May 2005.
Effective: July 24, 2005.
Freeze Fee: none.
Thaw (or Temporary Lift) Fee: none.

Wisconsin: available for all consumers.
Passed: March 16, 2006.
Effective: January 1, 2007.
Freeze Fee: none for an “individual who submits evidence satisfactory to the CRAs that the individual made a report to a law enforcement agency,” and up to $10 for others.
Thaw (or Temporary Lift) Fee: none for an “individual who submits evidence satisfactory to the CRAs that the individual made a report to a law enforcement agency,” and up to $10 for others to remove or temporarily thaw.

State Security Breach Laws

We only know about the ChoicePoint security breach because of a California law requiring businesses, nonprofits, and state public institutions to notify consumers when their personal information has been compromised.   As of July 18, 2006 at least 34 states have passed security breach notification laws. Had a weaker, "risk-based" trigger law been in place in California, it is likely we would not have learned about ChoicePoint or other subsequent breaches.

"Acquisition-based trigger" means strong consumer-oriented notification requirement based on loss of information.