issue
Summarize the state’s credit freeze law. This report updates OLR Report 2006-R-0211. This report has been updated by OLR Report 2025-R-0145.
Summary
Credit freeze laws generally prohibit a credit rating agency from releasing any information in a consumer’s credit report without the consumer’s express authorization.
Connecticut’s law requires an agency to “freeze” a consumer’s credit report within five business days after a consumer’s request. It creates ways for a consumer to release the report permanently, temporarily, or to a specific third party.
Under the law, credit rating agencies may charge certain consumers up to $10 for each freeze or release and up to $12 for a temporary removal for a third party. Victims of domestic violence or identity theft, anyone under age 18 or at least 62, or anyone with a court-appointed guardian or conservator are exempt from the fees.
The law allows an agency to deny a request to implement a freeze, or to remove one, if it has a good faith belief the request involves fraud or misrepresentation.
It authorizes most types of businesses to deem a credit application incomplete, and insurers to deny an application, if they find a consumer’s credit is frozen. Certain disclosures are exempt from a freeze.
credit freeze law
Connecticut law allows a consumer to ask a credit rating agency to place a security freeze on his or her credit report (CGS §§ 36a-701 & 36a-701a, as amended by PA 15-53).
A consumer request to freeze a report must be made in writing by certified mail or by another secure method the agency authorizes. An agency must keep the freeze in effect unless temporarily or permanently removed at the consumer’s request.
The law requires an agency to freeze the report within five business days after receiving the request. The agency must then send the consumer a written confirmation within 10 business days of the security freeze with a unique personal identification number or password, unless it has a good faith reason not to do so.
Under the law, an agency may generally charge a consumer a fee of up to (1) $10 for each freeze or for a temporary or permanent release of the freeze and (2) $12 for a temporary release to a third party. It exempts from these fees the following people:
1. an identity theft victim, or his or her spouse, who submits a copy of a police report to the agency;
2. a person who submits a copy of a police report to the agency and is covered by the identity theft victim’s health insurance policy for certain services;
3. anyone under age 18 or at least age 62;
4. anyone with a court-appointed guardian or conservator; or
5. a person who provides evidence to the agency that he or she is a domestic violence victim.
The law also prohibits agencies from charging a fee the first time a consumer requests a replacement identification number.
Removing or Suspending a Security Freeze
The law allows a consumer to use the unique personal identifier or password sent by a credit rating agency to authorize a permanent or temporary removal of a freeze or to release a credit report to a specific third party.
If a consumer wants to remove the freeze, he or she must provide the agency with (1) proper identification and (2) the unique identifier or password. And if the consumer wants to disclose his or her credit report for a period of time or to a third party, the consumer must also give proper information about the time period during which the credit report will be available or the third party to receive the report.
The law requires an agency that receives a request to remove a freeze, either temporarily or permanently, to do so within three business days after receiving the request. It allows agencies to develop procedures for receiving and processing these requests. The procedures must allow consumers to send their requests by fax, letter, or e-mail.
Denying a Request to Implement or Remove a Freeze
The law allows a credit agency to remove a credit freeze or refuse to implement one if the agency believes in good faith that the (1) request was part of a fraud that the consumer participated in or knew about and can be shown by circumstantial evidence or (2) report was frozen due to a material misrepresentation of fact by the consumer.
It requires a credit agency to promptly notify the consumer in writing within five business days after refusing to implement a freeze or, if removing a freeze, prior to removing the freeze on the credit report.
Requests for Information from Frozen Credit Reports
Under the law, an insurer may deny an application if an applicant’s credit report is frozen and the applicant has not authorized the report’s disclosure to the insurer. The law also permits other third parties to deem a credit application incomplete if the party requests access to a consumer’s frozen credit report related to a credit application, or for another use, and the consumer has not authorized disclosure to the third party.
Exempted Disclosures
The law allows credit rating agencies to disclose frozen credit reports to:
1. a person, or the person’s subsidiary, affiliate, agent, or assignee with who the consumer has or had an account, contract, or debtor-creditor relationship, to review the account or collect a debt;
2. a subsidiary, affiliate, agent, assignee, or prospective assignee of someone to whom access was granted to facilitate extending credit or for another permissible use;
3. anyone acting according to a court order, warrant, or subpoena;
4. anyone for “prescreening” as allowed under the federal Fair Credit Reporting Act;
5. anyone solely to provide credit file monitoring subscription services to which a consumer subscribes;
6. a credit rating agency solely to provide a consumer with a copy of his or her own credit report on request; or
7. a governmental entity, including a law enforcement agency, or court, or their agents or assignees pursuant to their statutory or regulatory duties.
Businesses Exempt from Placing a Freeze
Under the law, the following businesses are not required to freeze a consumer’s report, but they are subject to a freeze placed on a report by another agency:
1. credit services or fraud prevention services companies that report on incidents of fraud or issue authorizations to approve or process negotiable instruments, electronic fund transfers, or similar payment methods;
2. deposit account information service companies that issue reports on account closures due to fraud, substantial overdrafts, automated teller machine abuse, or similar information to inquiring banks or other financial institutions to use solely for reviewing a consumer’s request to open a deposit account; or
3. credit rating agencies that (a) only resell credit information by assembling and merging it from a database of one or more credit reporting agencies and (b) do not keep a permanent database of credit information from which new credit reports are made.
KLM:tjo