(1) A consumer reporting agency may remove a security freeze from a consumer's credit report only if:

1. (a)

   1. (i) the consumer reporting agency receives the consumer's request through a contact method established and required in accordance with Subsection 13-45-201(6); and

   2. (ii) the consumer reporting agency receives the consumer's proper identification and:

      1. (A) other information sufficient to identify the consumer; or
      2. (B) the consumer provides the consumer's personal identification number or password; or
2. (b) the consumer makes a material misrepresentation of fact in connection with the placement of the security freeze and the consumer reporting agency notifies the consumer in writing before removing the security freeze.

(2)

1. (a) A consumer reporting agency shall temporarily remove a security freeze upon receipt of:

   1. (i) the consumer's request through the contact method established by the consumer reporting agency in accordance with Subsection 13-45-201(6);

   2. (ii) the consumer's proper identification and:

      1. (A) other information sufficient to identify the consumer; or
      2. (B) personal identification number or password;
   3. (iii) a specific designation of the period of time for which the security freeze is to be removed; and
   4. (iv) the consumer reporting agency receives the payment of any fee required under Section 13-45-204.

2. (b) A consumer reporting agency shall remove a security freeze from a consumer's credit report within:

   1. (i) three business days after the business day on which the consumer's written request to remove the security freeze is received by the consumer reporting agency at the postal address chosen by the consumer reporting agency in accordance with Subsection 13-45-201(6); or
   2. (ii) 15 minutes after the consumer's request is received by the consumer reporting agency through the electronic contact method chosen by the consumer reporting agency in accordance with Subsection 13-45-201(6), or the use of telephone, during normal business hours and includes the consumer's proper identification and correct personal identification number or password.

(3) A consumer reporting agency need not remove a security freeze within the time provided in Subsection (2)(b)(ii) if:

1. (a) the consumer fails to meet the requirements of Subsection 13-45-202(1); or

2. (b) the consumer reporting agency's ability to remove the security freeze within 15 minutes is prevented by:

   1. (i) an act of God, including fire, earthquakes, hurricanes, storms, or similar natural disaster or phenomena;
   2. (ii) unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrence;
   3. (iii) operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruption;
   4. (iv) governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar directives;
   5. (v) regularly scheduled maintenance, during other than normal business hours, of, or updates to, the consumer reporting agency's systems;
   6. (vi) commercially reasonable maintenance of, or repair to, the consumer reporting agency's systems that is unexpected or unscheduled; or
   7. (vii) receipt of a removal request outside of normal business hours.