1. (a) Not later than ten (10) business days after receiving a request for a security freeze under section 5 of this chapter, a consumer reporting agency shall issue to the consumer a written confirmation that a security freeze has been placed on the consumer's consumer report. The confirmation required by this section must include the following:

   1. (1) A unique:

      1. (A) personal identification number; or

      2. (B) password;

         other than the consumer's Social Security number, or any multiple digit segment of the consumer's Social Security number, to be used by the consumer to perform any of the acts described in subdivision (2).

   2. (2) Written instructions explaining how the consumer may:

      1. (A) release the consumer's consumer report to one (1) or more specified third parties;
      2. (B) temporarily lift the security freeze for a specified period; or
      3. (C) remove the security freeze.
   3. (3) Written instructions explaining how the consumer may request, using one (1) of the methods described in section 5(a) of this chapter, that the consumer reporting agency issue the same or a new personal identification number or password to the consumer if the consumer fails to retain the original personal identification number or password issued by the consumer reporting agency under subdivision (1).

2. (b) Upon receiving a request described in subsection (a)(3), the consumer reporting agency shall issue the same or a new personal identification number or password to the requesting consumer if the consumer has provided information sufficient to identify the consumer, as specified by the consumer reporting agency in the instructions provided to the consumer under subsection (a)(3). If the consumer's request is made using the method described in section 5(a)(1) of this chapter, the consumer reporting agency shall send, by United States mail, the personal identification number or password to the consumer not later than five (5) business days after receiving the consumer's request. If the consumer's request is made using the method described in section 5(a)(2) of this chapter, the consumer reporting agency shall issue the personal identification number or password not later than:

   1. (1) subject to the exceptions set forth in sections 7(e)(2) and 9(c)(2) of this chapter, as applicable, fifteen (15) minutes after receiving the request, if the consumer reporting agency elects to issue the personal identification number or password by a secure electronic mail connection provided by the consumer reporting agency under section 5(d) of this chapter; or
   2. (2) five (5) business days after receiving the request, if the consumer reporting agency elects to issue the personal identification number or password by United States mail.

As added by P.L.104-2007, SEC.1.