13-45 - Consumer Credit Protection Act
Title 13 > 13-45
Sections (16)
General Provisions
13-45-101 - Title.
This chapter is known as the “Consumer Credit Protection Act.”
Enacted by Chapter 344, 2006 General Session
13-45-102 - Definitions.
As used in this chapter:
(1) “Consumer” means an individual who is not a protected consumer.
(2) “Consumer reporting agency” means a person who, for a monetary fee, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing credit or consumer reports to third persons.
(3) “Consumer who is subject to a protected consumer security freeze” means an individual:for whom a credit reporting agency placed a security freeze under Section 13-45-503; andwho, on the day on which a request for the removal of the security freeze is submitted under Section 13-45-504, is not a protected consumer.
(4) “Credit report” means a consumer report, as defined in the Fair Credit Reporting Act, 15 U.S.C. Sec. 1681a, that is used or collected in whole or part for the purpose of serving as a factor in establishing a consumer’s eligibility for credit for personal, family, or household purposes.
(5) “File” means the same as that term is defined in 15 U.S.C. Sec. 1681a.
(6) “Incapacitated person” means an individual who is incapacitated, as defined in Section 75-1-201.
(7) “Normal business hours” means Sunday through Saturday, between the hours of 6:00 a.m. and 9:30 p.m., Mountain Standard or Mountain Daylight Time.
(8) “Personal information” means personally identifiable financial information:provided by a consumer to another person;resulting from any transaction with the consumer or any service performed for the consumer; orotherwise obtained by another person.”Personal information” does not include:publicly available information, as that term is defined in Section 13-61-101; orany list, description, or other grouping of consumers, and publicly available information relating to a consumer, that is derived without using any nonpublic personal information.Notwithstanding Subsection (8)(b), “personal information” includes any list, description, or other grouping of consumers, and publicly available information relating to a consumer, that is derived using any nonpublic personal information other than publicly available information.
(9) “Proper identification” means the same as that term is defined in 15 U.S.C. Sec. 1681h(a)(1);“Proper identification” includes:the consumer’s full name, including first, last, and middle names and any suffix;any name the consumer previously used;the consumer’s current and recent full addresses, including street address, any apartment number, city, state, and ZIP code;the consumer’s Social Security number; andthe consumer’s date of birth.
(10) “Protected consumer” means an individual who, at the time a request for a security freeze is made, is:under 16 years old;an incapacitated person; ora protected person.
(11) “Protected person” means the same as that term is defined in Section 75-5b-102.
(12) “Record” means a compilation of information that:identifies a protected consumer;is created by a consumer reporting agency solely for the purpose of complying with this section; andmay not be created or used to consider the protected consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living.
(13) “Representative” means a person that provides to a consumer reporting agency sufficient proof of authority to act on behalf of a protected consumer.
(14) “Sufficient proof of authority” means documentation that shows that a person has authority to act on behalf of a protected consumer.”Sufficient proof of authority” includes:a court order;a lawfully executed power of attorney; ora written, notarized statement signed by the person that expressly describes the person’s authority to act on behalf of the protected consumer.
(15) “Sufficient proof of identification” means information or documentation that identifies a protected consumer or a representative.”Sufficient proof of identification” includes:a Social Security number or a copy of a Social Security card issued by the United States Social Security Administration;a certified or official copy of a birth certificate; ora copy of a government issued driver license or identification card.
Amended by Chapter 415, 2025 General Session
Security Freeze
13-45-201 - Security freeze.
(1) As used in this part: “Security freeze” means a prohibition, consistent with the provisions of this section, on a consumer reporting agency’s furnishing of a consumer’s credit report to a third party intending to use the credit report to determine the consumer’s eligibility for credit.”Unique personal identifier” means a personal identification number, password, or other secure form of identity verification accepted by a consumer reporting agency and intended for use by a consumer to place, remove, or temporarily remove a security freeze in accordance with this chapter.
(2) A consumer may request a security freeze on a consumer’s credit report by:submitting a request for a security freeze to the consumer reporting agency by: certified mail to the postal address identified by the consumer reporting agency in accordance with Subsection (5); orelectronic means developed by the consumer reporting agency in accordance with Subsection (5); andproviding proper identification to the consumer reporting agency.Upon receipt of a request described in Subsection (2)(a), the consumer reporting agency shall:place a security freeze on the consumer’s credit report: if the consumer submits the request by certified mail, as soon as practicable but no later than five business days after the business day on which the consumer reporting agency receives the request and the consumer’s proper identification;if the consumer submits the request by a contact method described in Subsection (5)(b)(ii) or (iii) that is not a mobile application, as soon as practicable but no later than 24 hours after the consumer reporting agency receives the request and the consumer’s proper identification; orif the consumer submits the request by mobile application, within 15 minutes after the consumer reporting agency receives the request and the consumer’s proper identification;provide the consumer a unique personal identifier, unless the consumer reporting agency previously provided the consumer a unique personal identifier; andwithin five business days after the business day on which the consumer reporting agency places the security freeze, provide the consumer confirmation that the consumer reporting agency placed the security freeze.
(3) If a security freeze is in place, a consumer reporting agency may not release a consumer’s credit report, or information from the credit report, to a third party that intends to use the information to determine a consumer’s eligibility for credit without prior authorization from the consumer.
(4) Notwithstanding Subsection (3), a consumer reporting agency may communicate to a third party requesting a consumer’s credit report that a security freeze is in effect on the consumer’s credit report.If a third party requesting a consumer’s credit report in connection with the consumer’s application for credit is notified of the existence of a security freeze under Subsection (4)(a), the third party may treat the consumer’s application as incomplete.
(5) A consumer reporting agency shall develop a contact method to receive and process a consumer’s request to place, remove, or temporarily remove a security freeze.A contact method under Subsection (5)(a) shall include:a postal address;an electronic contact method chosen by the consumer reporting agency, which may include the use of fax, Internet, or other electronic means; andthe use of telephone in a manner that is consistent with any federal requirements placed on the consumer reporting agency.
(6) A security freeze placed under this section may be removed only in accordance with Section 13-45-202.
(7) The time requirement described in Subsection (2)(b)(i)(B) or (C), as applicable, does not apply if the consumer reporting agency’s ability to place the security freeze is prevented by:an act of God, including fire, earthquakes, hurricanes, storms, or similar natural disaster or phenomena;unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrence;operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruption;governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar directives;regularly scheduled maintenance, during other than normal business hours, of, or updates to, the consumer reporting agency’s systems; orcommercially reasonable maintenance of, or repair to, the consumer reporting agency’s systems that is unexpected or unscheduled.In the event of a circumstance described in Subsection (7)(a), the consumer reporting agency shall place the security freeze as soon as practicable.
Amended by Chapter 36, 2018 General Session
13-45-202 - Removal of security freeze — Requirements and timing.
(1) A consumer reporting agency shall remove a security freeze from a consumer’s credit report only if: the consumer reporting agency receives the consumer’s request through the contact method established and required in accordance with Subsection 13-45-201(5); andthe consumer reporting agency receives the consumer’s proper identification or unique personal identifier; orthe consumer makes a material misrepresentation of fact in connection with the placement of the security freeze and the consumer reporting agency notifies the consumer in writing before removing the security freeze.
(2) A consumer reporting agency shall temporarily remove a security freeze upon receipt of: the consumer’s request through the contact method established by the consumer reporting agency in accordance with Subsection 13-45-201(5);the consumer’s proper identification or unique personal identifier; anda specific designation of the period of time for which the security freeze is to be removed.
(3) A consumer reporting agency shall remove or temporarily remove a security freeze from a consumer’s credit report within: three business days after the business day on which the consumer’s written request to remove the security freeze is received by the consumer reporting agency at the postal address chosen by the consumer reporting agency in accordance with Subsection 13-45-201(5)(b)(i); or15 minutes after the consumer’s request is received by the consumer reporting agency through a contact method described in Subsection 13-45-201(5)(b)(ii) or (iii), and includes the consumer’s unique personal identifier.
(4) The time requirement described in Subsection (3)(b) does not apply if the consumer reporting agency’s ability to remove the security freeze is prevented by:an act of God, including fire, earthquakes, hurricanes, storms, or similar natural disaster or phenomena;unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrence;operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruption;governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar directives;regularly scheduled maintenance, during other than normal business hours, of, or updates to, the consumer reporting agency’s systems; orcommercially reasonable maintenance of, or repair to, the consumer reporting agency’s systems that is unexpected or unscheduled.In the event of a circumstance described in Subsection (4)(a), the consumer reporting agency shall remove the security freeze as soon as practicable.
Amended by Chapter 36, 2018 General Session
13-45-203 - Exceptions.
(1) Notwithstanding Section 13-45-201, a consumer reporting agency may furnish a consumer’s credit report to a third party if: the purpose of the credit report is to: use the credit report for purposes permitted under 15 U.S.C. Sec. 1681b(c); orreview the consumer’s account with the third party, including for account maintenance or monitoring, credit line increases, or other upgrades or enhancements; orcollect on a financial obligation owed by the consumer to the third party requesting the credit report; orthe purpose of the credit report is to:review the consumer’s account with another person; orcollect on a financial obligation owed by the consumer to another person; anduse the credit report for purposes permitted under 15 U.S.C. Sec. 1681b(c); orthe third party requesting the credit report is a subsidiary, affiliate, agent, assignee, or prospective assignee of the person holding the consumer’s account or to whom the consumer owes a financial obligation.
(2) The consumer’s request for a security freeze does not prohibit the consumer reporting agency from disclosing the consumer’s credit report for other than credit related purposes consistent with the definition of credit report found in Section 13-45-102.The following list identifies the types of credit report disclosures by consumer reporting agencies to third parties that are not prohibited by a security freeze:the third party does not use the credit report for the purpose of serving as a factor in establishing a consumer’s eligibility for credit;the third party is acting under a court order, warrant, or subpoena requiring release of the credit report;the third party is a child support agency, or its agent or assignee, acting under Part D, Title IV of the Social Security Act or a similar state law;the federal Department of Health and Human Services or a similar state agency, or its agent or assignee, investigating Medicare or Medicaid fraud;the purpose of the credit report is to investigate or collect delinquent taxes, assessments, or unpaid court orders; andthe third party is:the federal Internal Revenue Service;a state taxing authority;the Department of Motor Vehicles;a county, municipality, or other entity with taxing authority;a federal, state, or local law enforcement agency; orthe agent or assignee of any entity listed in Subsections (1)(b) and (2)(b)(v)(B);the third party is administering a credit file monitoring subscription to which the consumer has subscribed; orthe third party requests the credit report for the sole purpose of providing the consumer with a copy of the consumer’s credit report or credit score upon the consumer’s request.
(3) Section 13-45-201 does not apply to: a consumer reporting agency, the sole purpose of which is to resell credit information by assembling and merging information contained in the database of another consumer reporting agency and that does not maintain a permanent database of credit information from which a consumer’s credit report is produced;a check services or fraud prevention services company that issues:reports on incidents of fraud; orauthorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payment; ora deposit account information service company that issues reports concerning account closures based on fraud, substantial overdrafts, automated teller machine abuse, or similar information concerning a consumer to a requesting financial institution for the purpose of evaluating a consumer’s request to create a deposit account.
(4) Nothing in this chapter prohibits a person from obtaining, aggregating, or using information lawfully obtained from public records in a manner that does not otherwise violate this chapter.
Enacted by Chapter 344, 2006 General Session
13-45-204 - Fees for security freeze.
(1) A consumer reporting agency may not charge a fee for placing, removing, or temporarily removing a security freeze.
(2) A consumer reporting agency may not charge a fee to download or install a mobile application through which a person places or removes a security freeze.
Amended by Chapter 36, 2018 General Session
13-45-205 - Changes to information in a credit report subject to a security freeze.
(1) If a credit report is subject to a security freeze, a consumer reporting agency shall notify the consumer who is the subject of the credit report within 30 days if the consumer reporting agency changes the consumer’s: name;date of birth;Social Security number; oraddress.
(2) Notwithstanding Subsection (1), a consumer reporting agency may make technical modifications to information in a credit report that is subject to a security freeze without providing notification to the consumer.Technical modifications under Subsection (2)(a) include:the addition or subtraction of abbreviations to names and addresses; andtranspositions or corrections of incorrect numbering or spelling.
(3) When providing notice of a change of address under Subsection (1), the consumer reporting agency shall provide notice to the consumer at both the new address and the former address.
Enacted by Chapter 344, 2006 General Session
Protection of Personal Information
13-45-301 - Protection of personal information.
(1) Except as allowed by other law, a person may not display a Social Security number in a manner or location that is likely to be open to public view.
(2) The state, or a branch, agency, or political subdivision of the state, may not employ or contract for the employment of an inmate in any Department of Corrections facility or county jail in any capacity that would allow any inmate access to any other person’s personal information.
Enacted by Chapter 344, 2006 General Session
Enforcement
13-45-401 - Enforcement — Confidentiality agreement — Penalties.
(1) The attorney general may enforce the provisions of this chapter.
(2) A person who violates a provision of this chapter is subject to a civil fine of:no greater than 100,000 in the aggregate for related violations concerning more than one consumer, unless:the violations concern:10,000 or more consumers who are residents of the state; and10,000 or more consumers who are residents of other states; orthe person agrees to settle for a greater amount.
(3) In addition to the penalties provided in Subsection (2), the attorney general may seek, in an action brought under this chapter:injunctive relief to prevent future violations of this chapter; andattorney fees and costs.Notwithstanding Title 78B, Chapter 3a, Venue for Civil Actions, if the attorney general brings an action under this chapter in the district court, the attorney general shall bring the action in:Salt Lake City; orthe county in which resides a consumer who is the subject of a credit report on which a violation occurs.
(4) The attorney general shall deposit any amount received under Subsection (2) or (3) into the Attorney General Litigation Fund created in Section 67-5-40.
(5) If the attorney general has reasonable cause to believe that an individual is in possession, custody, or control of information that is relevant to enforcing this chapter, the attorney general may enter into a confidentiality agreement with the individual.In a civil action brought under this chapter, a court may issue a confidentiality order that incorporates the confidentiality agreement described in Subsection (5)(a).A confidentiality agreement entered into under Subsection (5)(a) or a confidentiality order issued under Subsection (5)(b) may:address a procedure;address testimony taken, a document produced, or material produced under this section;provide whom may access testimony taken, a document produced, or material produced under this section;provide for safeguarding testimony taken, a document produced, or material produced under this section; orrequire that the attorney general:return a document or material to an individual; ornotwithstanding Section 63A-12-105 or a retention schedule created in accordance with Section 63G-2-604, destroy the document or material at a designated time.
(6) Subject to Subsection (6)(c), the attorney general shall keep confidential a procedure agreed to, testimony taken, a document produced, or material produced under this section pursuant to a subpoena, confidentiality agreement, or confidentiality order, unless the individual who agreed to the procedure, provided testimony, or produced the document or material waives confidentiality in writing.Subject to Subsections (6)(c) and (6)(d), the attorney general may use, in an enforcement action taken under this section, testimony taken, a document produced, or material produced under this section to the extent the use is not restricted or prohibited by a confidentiality agreement or a confidentiality order.The attorney general may use, in an enforcement action taken under this section, testimony taken, a document produced, or material produced under this section that is restricted or prohibited from use by a confidentiality agreement or a confidentiality order if the individual who provided testimony, produced the document, or produced the material waives the restriction or prohibition in writing.The attorney general may disclose testimony taken, a document produced, or material produced under this section, without consent of the individual who provided the testimony, produced the document, or produced the material, or without the consent of an individual being investigated, to:a grand jury; ora federal or state law enforcement officer, if the person from whom the information was obtained is notified 20 days or greater before the day on which the information is disclosed, and the federal or state law enforcement officer certifies that the federal or state law enforcement officer will:maintain the confidentiality of the testimony, document, or material; anduse the testimony, document, or material solely for an official law enforcement purpose.
(7) A civil action filed under this chapter shall be commenced no later than five years after the day on which the alleged violation last occurred.
Amended by Chapter 173, 2025 General Session
Credit Report Protection for Minors
13-45-501 - Title.
This part is known as “Credit Report Protection for Minors.”
Enacted by Chapter 191, 2015 General Session
13-45-502 - Definitions.
As used in this part, “security freeze” means:
(1) if a consumer reporting agency does not have a file that pertains to a protected consumer, a restriction that: is placed on the protected consumer’s record in accordance with this part; andexcept as otherwise provided in this part, prohibits the consumer reporting agency from releasing the protected consumer’s record; or
(2) if a consumer reporting agency has a file that pertains to the protected consumer, a restriction that: is placed on the protected consumer’s credit report in accordance with this part; andexcept as otherwise provided in this part, prohibits the consumer reporting agency from releasing the protected consumer’s credit report or any information derived from the protected consumer’s credit report.
Enacted by Chapter 191, 2015 General Session
13-45-503 - Applicability.
This part does not apply to the use of a protected consumer’s credit report or record by:
(1) a person administering a credit file monitoring subscription service to which: the protected consumer has subscribed; orthe protected consumer’s representative has subscribed on the protected consumer’s behalf;
(2) a person who, upon request from the protected consumer or the protected consumer’s representative, provides the protected consumer or the protected consumer’s representative with a copy of the protected consumer’s credit report;
(3) a check services or fraud prevention services company that issues: reports on incidents of fraud; orauthorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar payment methods;
(4) a deposit account information service company that issues reports regarding account closures due to fraud, substantial overdrafts, automated teller machine abuse, or similar information regarding an individual to inquiring banks or other financial institutions for use only in reviewing an individual’s request for a deposit account at the inquiring bank or financial institution;
(5) an insurance company for the purpose of conducting the insurance company’s ordinary business;
(6) a consumer reporting agency that: only resells credit information by assembling and merging information contained in a database of another consumer reporting agency or multiple consumer reporting agencies; anddoes not maintain a permanent database of credit information from which new credit reports are produced; or
(7) a consumer reporting agency’s database or file that consists of information that: concerns and is used for:criminal record information;fraud prevention or detection;personal loss history information; oremployment, tenant, or individual background screening; andis not used for credit granting purposes.
Enacted by Chapter 191, 2015 General Session
13-45-504 - Security freeze for protected consumer.
(1) A consumer reporting agency shall place a security freeze for a protected consumer if: the consumer reporting agency receives a request from the protected consumer’s representative for the placement of the security freeze; andthe protected consumer’s representative:submits the request described in Subsection (1)(a): to the address or other point of contact provided by the consumer reporting agency; andin the manner specified by the consumer reporting agency;submits to the consumer reporting agency: sufficient proof of identification of the protected consumer;sufficient proof of identification of the protected consumer’s representative; andsufficient proof of authority to act on behalf of the protected consumer; andif applicable, pays the consumer reporting agency a fee described in Subsection 13-45-506(2).
(2) If a consumer reporting agency does not have a file that pertains to a protected consumer when the consumer reporting agency receives a request described in Subsection (1), the consumer reporting agency shall create a record for the protected consumer.
(3) A consumer reporting agency shall place a security freeze for a protected consumer within 30 days after the day on which the consumer reporting agency receives a request described in Subsection (1).
(4) After a consumer reporting agency places a security freeze under this section, the consumer reporting agency may not release the protected consumer’s credit report, any information derived from the protected consumer’s credit report, or any record created for the protected consumer, unless the security freeze for the protected consumer is removed in accordance with Section 13-45-505.
(5) A security freeze that is placed in accordance with this section shall remain in effect until: the protected consumer’s representative or the consumer who is subject to a protected consumer security freeze requests the consumer reporting agency remove the security freeze in accordance with Subsection 13-45-505(1); orthe security freeze is removed in accordance with Subsection 13-45-505(3).
Enacted by Chapter 191, 2015 General Session
13-45-505 - Removal of security freeze for protected consumer.
(1) To remove a security freeze that is placed under this part, the protected consumer’s representative or the consumer who is subject to a protected consumer security freeze shall: submit a request for the removal of the security freeze to the consumer reporting agency:at the address or other point of contact provided by the consumer reporting agency; andin the manner specified by the consumer reporting agency;provide to the consumer reporting agency:in the case of a request by a protected consumer’s representative: sufficient proof of identification of the protected consumer;sufficient proof of identification of the protected consumer’s representative; andsufficient proof of authority to act on behalf of the protected consumer; orin the case of a request by the consumer who is subject to a protected consumer security freeze: sufficient proof of identification of the consumer who is subject to a protected consumer security freeze; andproof that the consumer who is subject to a protected consumer security freeze is not a protected consumer; andif applicable, pay the consumer reporting agency a fee described in Subsection 13-45-506(2).
(2) Within 30 days after the day on which a consumer reporting agency receives a request under Subsection (1), the consumer reporting agency shall remove the security freeze.
(3) A consumer reporting agency may remove a security freeze for a protected consumer or delete a record of a protected consumer if the security freeze was placed or the record was created based on a material misrepresentation of fact by the protected consumer or the protected consumer’s representative.
Enacted by Chapter 191, 2015 General Session
13-45-506 - Fees.
(1) Except as provided in Subsection (2), a consumer reporting agency may not charge a fee for any service performed under this part.
(2) A consumer reporting agency may charge a reasonable fee, which does not exceed $5, for each placement or removal of a security freeze under this part, unless: the protected consumer’s representative:has obtained a police report that states the protected consumer is the alleged victim of identity fraud; andprovides a copy of the report to the consumer reporting agency; orthe protected consumer is less than 16 years of age at the time the request is submitted to the consumer reporting agency; andthe consumer reporting agency has a file that pertains to the protected consumer.
Enacted by Chapter 191, 2015 General Session
Prohibitions
13-45-601 - Consumer reporting agency — Prohibitions.
(1) Except as provided in Subsection (2), a consumer reporting agency may not report information relating to:an arrest not resulting in a conviction;a criminal charge not resulting in a conviction;an expunged conviction; ora pardoned conviction.
(2) A consumer reporting agency may report:a pending criminal charge; oran arrest that has not reached a final disposition.
Enacted by Chapter 415, 2025 General Session