In this subtitle the following words have the meanings indicated. “Breach of the security of a system” has the meaning stated in § 14–3504 of this title. “Commissioner” means the Commissioner of Financial Regulation of the Maryland Department of Labor. “Consumer” means an individual. “Consumer report” means any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer’s eligibility for: Credit or insurance to be used primarily for personal, family, or household purposes; Employment purposes; or Other purposes authorized under § 14–1202 of this subtitle. The term does not include: Any report containing information solely as to transactions or experiences between the consumer and the person making the report; Any authorization or approval of a specific extension of credit directly or indirectly by the issuer of a credit card or similar device; or Any report in which a person who has been requested by a third party to make a specific extension of credit directly or indirectly to a consumer conveys his decision with respect to the request, if the third party advises the consumer of the name and address of the person to whom the request was made and the person makes the disclosures to the consumer required under § 14–1212 of this subtitle. “Consumer reporting agency” means any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of commerce for the purpose of preparing or furnishing consumer reports. “Consumer reporting agency” does not include: A person licensed as a private detective agency or certified as a private detective under the Maryland Private Detectives Act; or A person who assembles and exchanges consumer credit information with an affiliated person or a person who is owned or controlled by the same entity, provided that, in the event of an adverse credit decision against a consumer based on that information, the entity making the decision shall comply with the notice requirements of § 14–1212(b) of this subtitle. “Eligible service member” means an individual who: Is an active service member, as defined in § 9–901 of the State Government Article; and Is assigned to service away from the usual station of duty of the individual. “Employment purposes” when used in connection with a consumer report means a report used for the purpose of evaluating a consumer for employment, promotion, reassignment, or retention as an employee. “File”, when used in connection with information on any consumer, means all of the information on that consumer recorded and retained by a consumer reporting agency regardless of how the information is stored. “Incarcerated person” means an incarcerated individual as defined in § 1–101 of the Correctional Services Article who has been sentenced to a correctional facility for a period of 1 year or more. “Investigative consumer report” means a consumer report or portion of it in which information on a consumer’s character, general reputation, personal characteristics, or mode of living is obtained through personal interviews with neighbors, friends, or associates of the consumer reported on or with others with whom he is acquainted or who may have knowledge concerning any items of information. However, the information does not include specific factual information on a consumer’s credit record obtained directly from a creditor of the consumer or from a consumer reporting agency when the information was obtained directly from a creditor of the consumer or from the consumer. “Medical information” means information or records obtained, with the consent of the individual to whom it relates, from licensed physicians or medical practitioners, hospitals, clinics, or other medical or medically related facilities. “Nationwide Multistate Licensing System” or “NMLS” has the meaning stated in § 1–101 of the Financial Institutions Article. “Person” includes an individual, corporation, government or governmental subdivision or agency, business trust, statutory trust, estate, trust, partnership, association, two or more persons having a joint or common interest, and any other legal or commercial entity. “State correctional facility” has the meaning stated in § 1–101 of the Correctional Services Article.

Subject to subsection (b) of this section and § 14–1205 of this subtitle, a consumer reporting agency may furnish a consumer report under the following circumstances and no other: In response to the order of a court having jurisdiction to issue the order; In accordance with the written instructions of the consumer to whom it relates; or To a person which the agency has reason to believe: Intends to use the information in connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer; Intends to use the information for employment purposes; Intends to use the information in connection with the underwriting of insurance involving the consumer; Intends to use the information in connection with a determination of the consumer’s eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant’s financial responsibility or status; or Otherwise has a legitimate business need for the information in connection with a business transaction involving the consumer. If the consumer reporting agency receives written notice from the consumer restricting the sale or other transfer of information in the consumer’s file, the consumer reporting agency may not sell, offer to sell, or furnish information in the consumer’s file to: A mail–service organization; A marketing firm; or Any other similar organization that obtains information about a consumer for marketing purposes.

Except as authorized under subsection (b) of this section, no consumer reporting agency may make any consumer report containing any of the following items of information: Bankruptcies which, from date of adjudication of the most recent bankruptcy, antedate the report by more than 10 years; Suits and judgments which, from date of entry, antedate the report by more than seven years or until the governing statute of limitations has expired, whichever is the longer period; Paid tax liens which, from date of payment, antedate the report by more than seven years; Accounts placed for collection or charged to profit and loss which antedate the report by more than seven years; Records of arrest, indictment, or conviction of crime which, from date of disposition, release, or parole, antedate the report by more than seven years; or Any other adverse item of information which antedates the report by more than seven years. The provisions of subsection (a) of this section are not applicable in the case of any consumer credit report to be used in connection with: A credit transaction involving, or which may reasonably be expected to involve, a principal amount of $150,000 or more; The underwriting of life insurance involving, or which may reasonably be expected to involve, a face amount of $150,000 or more; or The employment of any individual at an annual salary which equals, or which may reasonably be expected to equal, $75,000 or more.

A consumer reporting agency may not include in a consumer report: Any record of a criminal proceeding concerning the consumer: In which the consumer was falsely accused, acquitted, or exonerated; In which a nolle prosequi was entered as to a charge concerning the consumer; or That did not result in a guilty verdict for or guilty plea by the consumer; or Any criminal records concerning the consumer that have been expunged. A consumer reporting agency may not rely on the information contained in records listed under subsection (a) of this section to make a determination regarding the creditworthiness of a consumer.

A person may not procure or cause to be prepared an investigative consumer report on any consumer unless: It is clearly and accurately disclosed to the consumer that an investigative consumer report including information as to his character, general reputation, personal characteristics, and mode of living, whichever are applicable, may be made, and the disclosure: Is made in a writing mailed, or otherwise delivered, to the consumer, not later than three days after the date on which the report was first requested; and Includes a statement informing the consumer of his right to request the additional disclosures provided for under subsection (b) of this section; or The report is to be used for employment purposes for which the consumer has not specifically applied. Any person who procures or causes to be prepared an investigative consumer report on any consumer shall make, upon written request made by the consumer within a reasonable period of time after the receipt by him of the disclosure required by subsection (a)(1) of this section, a complete and accurate disclosure of the nature and scope of the investigation requested. This disclosure shall be made in a writing mailed, or otherwise delivered, to the consumer not later than five days after the date on which the request for the disclosure was received from the consumer or the report was first requested, whichever is the later. No person may be held liable for any violation of subsection (a) or (b) of this section if he shows by a preponderance of the evidence that at the time of the violation he maintained reasonable procedures to assure compliance with subsection (a) or (b) of this section.

A consumer reporting agency shall maintain reasonable procedures designed to avoid violations of § 14–1203 of this subtitle and to limit the furnishing of consumer reports to the purposes listed under § 14–1202 of this subtitle. The procedures at a minimum shall require that prospective users of the information identify themselves, certify the purposes for which the information is sought, and certify that the information will be used for no other purpose. A consumer reporting agency shall make a reasonable effort to verify the identity of a new prospective user and the uses certified by the prospective user prior to furnishing the user a consumer report. No consumer reporting agency may furnish a consumer report to any person if it has reasonable grounds for believing that the consumer report will not be used for a purpose listed in § 14–1202 of this subtitle. Whenever a consumer reporting agency prepares a consumer report it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates. Notwithstanding the provisions of § 14–1202 of this subtitle, a consumer reporting agency may furnish identifying information respecting any consumer, limited to his name, address, former addresses, places of employment, or former places of employment, to a governmental agency.

A consumer reporting agency shall, upon request and proper identification of a consumer, provide the consumer: An exact copy of any file on that consumer except any part of the file which contains medical information; A written explanation of codes or trade language used; A description of the rights of the consumer under this subtitle; and The name, address, and telephone number of the Commissioner. Whenever access to a file or a copy of a file has been furnished to a consumer, the consumer reporting agency may delete the sources of information acquired solely for use in an investigative report and used for no other purpose. If any action is brought by the consumer under this subtitle, the consumer reporting agency shall make such sources available to the plaintiff under appropriate discovery procedures.

A consumer reporting agency shall make the disclosures required under § 14–1206(a) of this subtitle during normal business hours and on reasonable notice. The disclosures required under § 14–1206(a) of this subtitle shall be made to the consumer: In person if he appears in person and furnishes proper identification; By telephone if he has made a written request, with proper identification, for telephone disclosure and the toll charge, if any, for the telephone call is prepaid by or charged directly to the consumer; or In writing if the consumer makes a written request and furnishes proper identification. Any consumer reporting agency shall provide trained personnel to explain to the consumer any information furnished to him pursuant to § 14–1206 of this subtitle. The consumer shall be permitted to be accompanied by one other person of his choosing, who shall furnish reasonable identification. A consumer reporting agency may require the consumer to furnish a written statement granting permission to the consumer reporting agency to discuss the consumer’s file in the person’s presence. Except as provided in § 14–1221 of this subtitle, no consumer may: Except as to false information furnished with malice or willful intent to injure the consumer, bring any action or proceeding in the nature of defamation, invasion of privacy, or negligence with respect to the reporting of information against any consumer reporting agency, any user of information, based on information disclosed pursuant to this section or § 14–1206 or § 14–1212 of this subtitle; or Bring any action or proceeding against a person who furnishes information to a consumer reporting agency in the nature of defamation, invasion of privacy, or negligence for unintentional error.

If the completeness or accuracy of any item of information contained in his file is disputed by a consumer, and the dispute is directly conveyed to the consumer reporting agency in writing by the consumer, the consumer reporting agency shall within 30 days reinvestigate and record the current status of that information unless it has reasonable grounds to believe that the dispute by the consumer is frivolous or irrelevant. If after reinvestigation the information is found to be inaccurate or can no longer be verified, the consumer reporting agency shall within 7 business days delete the information and mail: Written notice of the correction to the consumer and to each person to whom the erroneous information was furnished; and A statement of the rights of the consumer under this subtitle. If after reinvestigation the information is found to be accurate or is verified, the consumer reporting agency shall within 7 business days mail: Written notice of the finding to the consumer; and A statement of the rights of the consumer under this subtitle. Within 60 days after receiving the notice under paragraphs (2) and (3) of this subsection, the consumer may request in writing that the consumer reporting agency disclose the name, address, and telephone number of each person contacted during the reinvestigation. Within 30 days after receiving the consumer’s written request under this paragraph, the consumer reporting agency shall make the requested disclosure. A person contacted during the reinvestigation who determines that the information was inaccurate shall correct the information in the person’s records within 12 business days after the determination occurs. The presence of contradictory information in the consumer’s file does not in and of itself constitute reasonable grounds for believing the dispute is frivolous or irrelevant. If a consumer reporting agency finds that a dispute is frivolous or irrelevant, the agency within 7 business days shall mail: Written notice of the finding, including the reasons for the finding, to the consumer; and A statement of the rights of the consumer under this subtitle. If the reinvestigation does not resolve the dispute, the consumer may file a brief statement setting forth the nature of the dispute. The consumer reporting agency may limit statements to not more than 100 words if it provides the consumer with assistance in writing a clear summary of the dispute. Whenever a statement of a dispute is filed, unless there is reasonable grounds to believe that it is frivolous or irrelevant, the consumer reporting agency shall, in any subsequent consumer report containing the information in question, clearly note that it is disputed by the consumer and provide either the consumer’s statement or a clear and accurate codification or summary of it. Following any deletion of information which is found to be inaccurate or whose accuracy can no longer be verified or any notation as to disputed information, the consumer reporting agency shall, at the request of the consumer, furnish notification that the item has been deleted or the statement, codification or summary pursuant to subsection (c) or (d) of this section to any person specifically designated by the consumer who has within 2 years prior received a consumer report for employment purposes, or within 1 year prior received a consumer report for any other purpose, which contained the deleted or disputed information. The consumer reporting agency shall clearly and conspicuously disclose to the consumer his rights to make such a request. The disclosure shall be made at or prior to the time the information is deleted or the consumer’s statement regarding the disputed information is received.

Notwithstanding the provisions of subsection (b) of this section, a consumer reporting agency may not impose a fee for: A consumer report provided under § 14-1206(a) of this subtitle one time during a 12-month period; A consumer report or disclosure provided under §§ 14-1206(a) and 14-1208(e) of this subtitle if the consumer makes a request for the report within 30 days after receipt by the consumer of a notification under § 14-1212 of this subtitle or notification from a debt collection agency affiliated with a consumer reporting agency stating that the consumer’s credit rating may be or has been adversely affected; or A disclosure made under § 14-1208(e) of this subtitle to a person designated by the consumer of the deletion from the consumer report of information that is found to be inaccurate or can no longer be verified. A consumer reporting agency may charge a consumer a reasonable fee: For a second or subsequent report made during a 12-month period under § 14-1206(a) of this subtitle, not exceeding $5; and For furnishing information under § 14-1208(e) of this subtitle, not exceeding the fee that the consumer reporting agency would impose on each designated recipient for a consumer report. The consumer reporting agency shall indicate the amount of the fee to the consumer before providing the report or furnishing the information.

A consumer reporting agency which furnishes a consumer report for employment purposes and which for that purpose compiles and reports items of information on consumers which are matters of public record and are likely to have an adverse effect upon a consumer’s ability to obtain employment shall: At the time public record information is reported to the user of the consumer report, notify the consumer of the fact that public record information is being reported by the consumer reporting agency, together with the name and address of the person to whom the information is being reported; or Maintain strict procedures designed to insure that whenever public record information which is likely to have an adverse effect on a consumer’s ability to obtain employment is reported it is complete and up to date. For purposes of this paragraph, items of public record relating to arrests, indictments, convictions, suits, tax liens, and outstanding judgments shall be considered up to date if the current public record status of the item at the time of the report is reported.

Whenever a consumer reporting agency prepares an investigative consumer report, any adverse information in the consumer report (other than information which is a matter of public record) may not be included in a subsequent consumer report unless the adverse information has been verified in the process of making the subsequent consumer report or the adverse information was received within the three-month period preceding the date the subsequent report is furnished.

Whenever credit or insurance for personal, family, or household purposes, or employment involving a consumer is denied or the charge for credit or insurance is increased either wholly or partly because of information contained in a consumer report from a consumer reporting agency, the user of the consumer report shall so advise the consumer against whom the adverse action has been taken and supply the name and address of the consumer reporting agency making the report. Whenever credit for personal, family, or household purposes involving a consumer is denied or the charge for credit is increased either wholly or partly because of information obtained from a person other than a consumer reporting agency bearing upon the consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living, the user of the information shall, within a reasonable period of time not to exceed 30 days, upon the consumer’s written request for the reasons for the adverse action received within 60 days after learning of the adverse action disclose the nature of the information to the consumer. The user of the information shall clearly and accurately disclose to the consumer his right to make the written request at the time the adverse action is communicated to the consumer. A person may not be held liable for any violation of this section if he shows by a preponderance of the evidence that at the time of the alleged violation he maintained reasonable procedures to assure compliance with the provisions of subsections (a) and (b) of this section.

In this section the following words have the meanings indicated. “Account review” includes activities related to account maintenance, account monitoring, credit line increases, and account upgrades and enhancements. “Security freeze” means a restriction placed on a consumer’s consumer report at the request of the consumer that prohibits a consumer reporting agency from releasing the consumer’s consumer report or any information derived from the consumer’s consumer report without the express authorization of the consumer. This section does not apply to the use of a consumer’s consumer report by: A person, or a subsidiary, affiliate, agent, or assignee of the person, with which the consumer has, or prior to assignment had, an account, contract, or debtor–creditor relationship, for the purpose of account review or collecting the financial obligation owing for the account, contract, or debt; A person that was given access to the consumer’s consumer report under subsection (e) of this section for the purpose of facilitating an extension of credit to the consumer or another permissible use; A person acting in accordance with a court order, warrant, or subpoena; A unit of State or local government that administers a program for establishing and enforcing child support obligations; The Maryland Department of Health in connection with a fraud investigation conducted by the Department; The State Department of Assessments and Taxation, the Comptroller, or any other State or local taxing authority in connection with: An investigation conducted by the Department, Comptroller, or taxing authority; The collection of delinquent taxes or unpaid court orders by the Department, Comptroller, or taxing authority; or The performance of any other duty provided for by law; A person for the purpose of prescreening, as defined by the federal Fair Credit Reporting Act; A person administering a credit file monitoring subscription service to which the consumer has subscribed; A person providing a consumer with a copy of the consumer’s consumer report on request of the consumer; or To the extent not prohibited by other State law, a person only for the purpose of setting or adjusting an insurance rate, adjusting an insurance claim, or underwriting an insurance risk. This section does not apply to: A check services or fraud prevention services company that issues: Reports on incidents of fraud; or Authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar payment methods; A deposit account information service company that issues reports regarding account closures due to fraud, substantial overdrafts, automated teller machine abuse, or similar negative information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution; or A consumer reporting agency database or file that consists entirely of consumer information concerning, and used solely for: Criminal record information; Personal loss history information; Fraud prevention or detection; Employment screening; or Tenant screening. A consumer may elect to place a security freeze on the consumer’s consumer report by: Written request sent by certified mail; Subject to paragraph (6) of this subsection, telephone, by providing certain personal information that the consumer reporting agency may require to verify the identity of the consumer; or An electronic request transmitted through a secure connection made available by the consumer reporting agency on the website of the consumer reporting agency. A consumer reporting agency shall require a consumer to provide proper identifying information when requesting a security freeze. Except as provided in paragraph (5) of this subsection, a consumer reporting agency shall place a security freeze on a consumer’s consumer report within 3 business days after receiving a request under paragraph (1) of this subsection. Within 5 business days after placing a security freeze on a consumer’s consumer report, the consumer reporting agency shall: Send a written confirmation of the security freeze to the consumer; Provide the consumer with a unique personal identification number or password to be used by the consumer when authorizing the release of the consumer’s consumer report to a specific person or for a specific period of time; and Provide the consumer with a written statement of the procedures for requesting the consumer reporting agency to remove or temporarily lift a security freeze. Subject to subparagraph (ii) of this paragraph, a consumer reporting agency is not required to place a security freeze on a consumer report if the consumer reporting agency: Acts only as a reseller of credit information by assembling and merging information contained in a database of another consumer reporting agency or multiple consumer reporting agencies; and Does not maintain a permanent database of credit information from which new consumer reports are produced. A consumer reporting agency that acts as a reseller of credit information shall honor a security freeze placed on a consumer report by another consumer reporting agency. If a consumer requests placement of a security freeze by telephone under paragraph (1)(ii) of this subsection, the consumer reporting agency may require the consumer to confirm the request in writing on a form that the consumer reporting agency provides to the consumer with the materials sent in accordance with paragraph (4) of this subsection. If the consumer fails to return written confirmation that the consumer reporting agency requires under subparagraph (i) of this paragraph, the consumer reporting agency may remove the security freeze in accordance with subsection (g)(2) of this section. A consumer reporting agency shall develop procedures involving the use of secure connections to receive and process, in an expedited manner, an electronic request from a consumer to place a security freeze on the consumer’s consumer report. A consumer reporting agency may develop additional secure electronic methods to comply with paragraph (1) of this subsection. While a security freeze is in place, a consumer reporting agency may not release a consumer’s consumer report or any information derived from a consumer’s consumer report without the express prior authorization of the consumer. A consumer reporting agency may advise a person that a security freeze is in effect with respect to a consumer’s consumer report. A consumer reporting agency may not state or imply to any person that a security freeze on a consumer’s consumer report reflects a negative credit score, credit history, or credit rating. If a consumer wants to temporarily lift a security freeze to allow the consumer’s consumer report to be accessed by a specific person or for a specific period of time while a security freeze is in place, the consumer shall: Contact the consumer reporting agency by: Mail in the manner prescribed by the consumer reporting agency; Telephone in the manner prescribed by the consumer reporting agency; or An electronic request transmitted through a secure connection made available by the consumer reporting agency on the website of the consumer reporting agency; Request that the security freeze be temporarily lifted; and Provide the following to the consumer reporting agency: Proper identifying information; The unique personal identification number or password provided to the consumer under subsection (c)(4)(ii) of this section; and The proper information regarding the person that is to receive the consumer report or the time period during which the consumer report is to be available to users of the consumer report. Except as provided in subparagraph (ii) of this paragraph, a consumer reporting agency shall comply with a request made under paragraph (1) of this subsection within 3 business days after receiving the request. A consumer reporting agency shall comply with a request made under paragraph (1) of this subsection within 15 minutes after the consumer’s request is received by the consumer reporting agency if the request is made by telephone or by electronic request transmitted through a secure connection made available by the consumer reporting agency on the website of the consumer reporting agency. A consumer reporting agency that is unable to temporarily lift a security freeze under subsubparagraph 1 of this subparagraph shall lift the security freeze as soon as it is reasonably capable of doing so. A consumer reporting agency shall develop procedures involving the use of secure connections to receive and process, in an expedited manner, an electronic request from a consumer to temporarily lift or remove a security freeze on the consumer’s consumer report. If, in connection with an application for credit or for any other use, a person requests access to a consumer’s consumer report while a security freeze is in place and the consumer does not authorize access to the consumer report, the person may treat the application as incomplete. Except as provided in paragraph (2) of this subsection, a consumer reporting agency may remove or temporarily lift a security freeze placed on a consumer’s consumer report only on request of the consumer made under subsection (e) or (h) of this section. A consumer reporting agency may remove a security freeze placed on a consumer’s consumer report if: Placement of the security freeze was based on a material misrepresentation of fact by the consumer; or The consumer: Made the request to place the security freeze by telephone under subsection (c)(1)(ii) of this section; and Failed to confirm the request in writing if required in accordance with subsection (c)(6) of this section. If a consumer reporting agency intends to remove a security freeze under subparagraph (i) of this paragraph, the consumer reporting agency shall notify the consumer in writing of its intent at least 5 business days before removing the security freeze. Subject to subsection (g)(2) of this section, a security freeze shall remain in place until the consumer requests that the security freeze be removed. If a consumer wants to remove a security freeze from the consumer’s consumer report, the consumer shall: Contact the consumer reporting agency by: Mail in the manner prescribed by the consumer reporting agency; Telephone in the manner prescribed by the consumer reporting agency; or An electronic request transmitted through a secure connection made available by the consumer reporting agency on the website of the consumer reporting agency; Request that the security freeze be removed; and Provide the following to the consumer reporting agency: Proper identifying information; and The unique personal identification number or password provided by the consumer reporting agency under subsection (c)(4)(ii) of this section. A consumer reporting agency shall remove a security freeze within 3 business days after receiving a request for removal. A consumer reporting agency shall develop procedures involving the use of secure connections to receive and process, in an expedited manner, an electronic request from a consumer to remove a security freeze on the consumer’s consumer report. A consumer may not be charged for any service relating to a security freeze. At any time that a consumer is entitled to receive a summary of rights under § 609 of the federal Fair Credit Reporting Act or § 14–1206 of this subtitle, the following notice shall be included: “NOTICE You have a right, under § 14–1212.1 of the Commercial Law Article of the Annotated Code of Maryland, to place a security freeze on your credit report. The security freeze will prohibit a consumer reporting agency from releasing your credit report or any information derived from your credit report without your express authorization. The purpose of a security freeze is to prevent credit, loans, and services from being approved in your name without your consent. A consumer reporting agency may not charge you a fee for any service relating to a security freeze, including for any placement, temporary lift, or removal of a security freeze. You may elect to have a consumer reporting agency place a security freeze on your credit report by written request sent by certified mail or by electronic mail or the Internet if the consumer reporting agency provides a secure electronic connection. The consumer reporting agency must place a security freeze on your credit report within 3 business days after your request is received. Within 5 business days after a security freeze is placed on your credit report, you will be provided with a unique personal identification number or password to use if you want to remove the security freeze or temporarily lift the security freeze to release your credit report to a specific person or for a specific period of time. You also will receive information on the procedures for removing or temporarily lifting a security freeze. If you want to temporarily lift the security freeze on your credit report, you must contact the consumer reporting agency and provide all of the following: The unique personal identification number or password provided by the consumer reporting agency; The proper identifying information to verify your identity; and The proper information regarding the person who is to receive the credit report or the period of time for which the credit report is to be available to users of the credit report. A consumer reporting agency must comply with a request to temporarily lift a security freeze on a credit report within 3 business days after the request is received, or within 15 minutes for certain requests. A consumer reporting agency must comply with a request to remove a security freeze on a credit report within 3 business days after the request is received. If you are actively seeking credit, you should be aware that the procedures involved in lifting a security freeze may slow your own applications for credit. You should plan ahead and lift a security freeze, either completely if you are seeking credit from a number of sources, or just for a specific creditor if you are applying only to that creditor, a few days before actually applying for new credit. A security freeze does not apply if you have an existing account relationship and a copy of your credit report is requested by your existing creditor or its agents or affiliates for certain types of account review, collection, fraud control, or similar activities.” If a consumer reporting agency violates a security freeze by releasing a consumer’s consumer report subject to a security freeze or any information derived from a consumer’s consumer report subject to a security freeze without authorization, the consumer reporting agency, within 5 business days after discovering or being notified of the release, shall notify the consumer in writing of: The specific information released; and The name and address of, or other available contact information for, the recipient of the consumer report or the information released. The exclusive remedy for a violation of subsection (e)(2)(ii) of this section shall be a complaint filed with the Commissioner under § 14–1225 of this subtitle.

In this section the following words have the meanings indicated. “Protected consumer” means an individual who is: Under the age of 16 years; An incapacitated person or a protected person for whom a guardian or conservator has been appointed in accordance with Title 13 of the Estates and Trusts Article; 85 years old or older; A service member; or An incarcerated person in a State correctional facility. “Record” means a compilation of information that: Identifies a protected consumer; Is created by a consumer reporting agency solely for the purpose of complying with this section; and May not be created or used to consider the protected consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living for any purpose listed in § 14–1201(e)(1) of this subtitle. “Representative” means a person who provides to a consumer reporting agency sufficient proof of authority to act on behalf of a protected consumer. “Security freeze” means: If a consumer reporting agency does not have a file pertaining to a protected consumer, a restriction that: Is placed on the protected consumer’s record in accordance with this section; and Prohibits the consumer reporting agency from releasing the protected consumer’s record except as provided in this section; or If a consumer reporting agency has a file pertaining to the protected consumer, a restriction that: Is placed on the protected consumer’s consumer report in accordance with this section; and Prohibits the consumer reporting agency from releasing the protected consumer’s consumer report or any information derived from the protected consumer’s consumer report except as provided in this section. “Sufficient proof of authority” means documentation that shows a representative has authority to act on behalf of a protected consumer. “Sufficient proof of authority” includes: An order issued by a court of law; A lawfully executed and valid power of attorney; and A written, notarized statement signed by a representative that expressly describes the authority of the representative to act on behalf of a protected consumer. “Sufficient proof of identification” means information or documentation that identifies a protected consumer or a representative of a protected consumer. “Sufficient proof of identification” includes: A Social Security number or a copy of a Social Security card issued by the Social Security Administration; A certified or official copy of a birth certificate issued by the entity authorized to issue the birth certificate; A copy of a driver’s license, an identification card issued by the Motor Vehicle Administration, or any other government–issued identification; or A copy of a bill, including a bill for telephone, sewer, septic tank, water, electric, oil, or natural gas services, that shows a name and home address. This section does not apply to the use of a protected consumer’s consumer report or record by: A person administering a credit file monitoring subscription service to which: The protected consumer has subscribed; or The representative of the protected consumer has subscribed on behalf of the protected consumer; A person providing the protected consumer or the protected consumer’s representative with a copy of the protected consumer’s consumer report on request of the protected consumer or the protected consumer’s representative; or An entity listed in § 14–1212.1(b)(2)(i) or (ii) or (c)(5) of this subtitle. A consumer reporting agency shall place a security freeze for a protected consumer if: The consumer reporting agency receives a request from the protected consumer’s representative for the placement of the security freeze under this section; and The protected consumer’s representative: Submits the request to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency; Provides to the consumer reporting agency sufficient proof of identification of the protected consumer and the representative; and Provides to the consumer reporting agency sufficient proof of authority to act on behalf of the protected consumer. If a consumer reporting agency does not have a file pertaining to a protected consumer when the consumer reporting agency receives a request under paragraph (1) of this subsection, the consumer reporting agency shall create a record for the protected consumer. Within 30 days after receiving a request that meets the requirements of subsection (c)(1) of this section, a consumer reporting agency shall place a security freeze for the protected consumer. Unless a security freeze for a protected consumer is removed in accordance with subsection (g) or (j) of this section, a consumer reporting agency may not release the protected consumer’s consumer report, any information derived from the protected consumer’s consumer report, or any record created for the protected consumer. A security freeze for a protected consumer placed under subsection (d) of this section shall remain in effect until: The protected consumer or the protected consumer’s representative requests the consumer reporting agency to remove the security freeze in accordance with subsection (g) of this section; or The security freeze is removed in accordance with subsection (j) of this section. If a protected consumer or a protected consumer’s representative wishes to remove a security freeze for the protected consumer, the protected consumer or the protected consumer’s representative shall: Submit a request for the removal of the security freeze to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency; and Provide to the consumer reporting agency: In the case of a request by the protected consumer: Proof that the sufficient proof of authority for the protected consumer’s representative to act on behalf of the protected consumer is no longer valid; and Sufficient proof of identification of the protected consumer; or In the case of a request by the representative of a protected consumer: Sufficient proof of identification of the protected consumer and the representative; and Sufficient proof of authority to act on behalf of the protected consumer. Within 30 days after receiving a request that meets the requirements of subsection (g) of this section, the consumer reporting agency shall remove the security freeze for the protected consumer. A consumer reporting agency may not charge a fee for any service performed under this section. A consumer reporting agency may remove a security freeze for a protected consumer or delete a record of a protected consumer if the security freeze was placed or the record was created based on a material misrepresentation of fact by the protected consumer or the protected consumer’s representative. Notwithstanding any other provision of law, the exclusive remedy for a violation of this section shall be a complaint filed with the Commissioner under § 14–1225 of this subtitle. In this section the following words have the meanings indicated. “Protected consumer” means an individual who is: Under the age of 16 years; An incapacitated person or a protected person for whom a guardian or conservator has been appointed in accordance with Title 13 of the Estates and Trusts Article; 85 years old or older; An eligible service member; or An incarcerated person in a State correctional facility. “Record” means a compilation of information that: Identifies a protected consumer; Is created by a consumer reporting agency solely for the purpose of complying with this section; and May not be created or used to consider the protected consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living for any purpose listed in § 14–1201(e)(1) of this subtitle. “Representative” means a person who provides to a consumer reporting agency sufficient proof of authority to act on behalf of a protected consumer. “Security freeze” means: If a consumer reporting agency does not have a file pertaining to a protected consumer, a restriction that: Is placed on the protected consumer’s record in accordance with this section; and Prohibits the consumer reporting agency from releasing the protected consumer’s record except as provided in this section; or If a consumer reporting agency has a file pertaining to the protected consumer, a restriction that: Is placed on the protected consumer’s consumer report in accordance with this section; and Prohibits the consumer reporting agency from releasing the protected consumer’s consumer report or any information derived from the protected consumer’s consumer report except as provided in this section. “Sufficient proof of authority” means documentation that shows a representative has authority to act on behalf of a protected consumer. “Sufficient proof of authority” includes: An order issued by a court of law; A lawfully executed and valid power of attorney; and A written, notarized statement signed by a representative that expressly describes the authority of the representative to act on behalf of a protected consumer. “Sufficient proof of identification” means information or documentation that identifies a protected consumer or a representative of a protected consumer. “Sufficient proof of identification” includes: A Social Security number or a copy of a Social Security card issued by the Social Security Administration; A certified or official copy of a birth certificate issued by the entity authorized to issue the birth certificate; A copy of a driver’s license, an identification card issued by the Motor Vehicle Administration, or any other government–issued identification; or A copy of a bill, including a bill for telephone, sewer, septic tank, water, electric, oil, or natural gas services, that shows a name and home address.

In this section the following words have the meanings indicated. “Department” means the Department of Human Services. “Foster care” has the meaning stated in § 5–501(c) of the Family Law Article. “Local department” means: A local department of social services created or continued in a county of the State or in Baltimore City under § 3–201 of the Human Services Article; or In Montgomery County, the Montgomery County Department of Health and Human Services. “Protected consumer” means an individual who: Is in the custody of a local department; and Has been placed in a foster care setting. “Record” means a compilation of information that: Identifies a protected consumer; Is created by a consumer reporting agency solely for the purpose of complying with this section; and May not be created or used to consider the protected consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living for any purpose listed in § 14–1201(e)(1) of this subtitle. “Representative” means a person who provides to a consumer reporting agency sufficient proof of authority to act on behalf of a protected consumer. “Representative” includes a local department. “Security freeze” means: If a consumer reporting agency does not have a file pertaining to a protected consumer, a restriction that: Is placed on the protected consumer’s record in accordance with this section; and Prohibits the consumer reporting agency from releasing the protected consumer’s record except as provided in this section; or If a consumer reporting agency has a file pertaining to the protected consumer, a restriction that: Is placed on the protected consumer’s consumer report in accordance with this section; and Prohibits the consumer reporting agency from releasing the protected consumer’s consumer report or any information derived from the protected consumer’s consumer report except as provided in this section. “Sufficient proof of identification” means information or documentation that identifies a protected consumer or a representative of a protected consumer. “Sufficient proof of identification” includes: A Social Security number or a copy of a Social Security card issued by the Social Security Administration; A certified or official copy of a birth certificate issued by the entity authorized to issue the birth certificate; A copy of a driver’s license, an identification card issued by the Motor Vehicle Administration, or any other government–issued identification; or A copy of a bill, including a bill for telephone, sewer, septic tank, water, electric, oil, or natural gas services, that shows a name and home address. This section does not apply to the use of a protected consumer’s consumer report or record by: A person administering a credit file monitoring subscription service to which: The protected consumer has subscribed; or The representative of the protected consumer has subscribed on behalf of the protected consumer; A person providing the protected consumer or the protected consumer’s representative a copy of the protected consumer’s consumer report on request of the protected consumer or the protected consumer’s representative; or An entity listed in § 14–1212.1(b)(2)(i) or (ii) or (c)(5) of this subtitle. A consumer reporting agency shall place a security freeze for a protected consumer if the consumer reporting agency receives a request from the Department for the placement of the security freeze as provided in subsection (j) of this section. The Department shall submit the request to the consumer reporting agency by electronic transmission to the electronic mail address or other point of contact in the manner specified by the consumer reporting agency. If a consumer reporting agency does not have a file pertaining to a protected consumer when the consumer reporting agency receives a request under subsection (j) of this section, the consumer reporting agency shall create a record for the protected consumer. If a consumer reporting agency has a file pertaining to a protected consumer, the local department shall act as the protected consumer’s representative to resolve any issues with the file. Within 30 days after receiving a request that meets the requirements of subsection (c) of this section, a consumer reporting agency shall place a security freeze for the protected consumer. Unless a security freeze for a protected consumer is removed in accordance with subsection (g) or (k) of this section, a consumer reporting agency may not release the protected consumer’s consumer report, any information derived from the protected consumer’s consumer report, or any record created for the protected consumer. A security freeze for a protected consumer placed under subsection (d) of this section shall remain in effect until: The protected consumer or the Department requests the consumer reporting agency to remove the security freeze in accordance with subsection (g) of this section; or The security freeze is removed in accordance with subsection (k) of this section. If a protected consumer or the Department wishes to remove a security freeze for the protected consumer, the protected consumer or the Department shall: Submit a request for the removal of the security freeze to the consumer reporting agency at the address or other point of contact in the manner specified by the consumer reporting agency; and Provide to the consumer reporting agency: In the case of a request by the protected consumer: Proof that the authority of the Department to act on behalf of the protected consumer is no longer valid; and Sufficient proof of identification of the protected consumer; or In the case of a request by the Department, sufficient proof of identification of the protected consumer. Within 30 days after receiving a request that meets the requirements of subsection (g) of this section, the consumer reporting agency shall remove the security freeze for the protected consumer. A consumer reporting agency may not charge a fee for any service performed under this section. At least annually, the Department shall send to each consumer reporting agency by electronic transmission a list of children who are in the custody of a local department and have been placed in a foster care setting for the first time. The Department shall request a security freeze for each child on the list specified under paragraph (1) of this subsection on behalf of the protected consumer. The Department may enter into an agreement with a consumer reporting agency concerning the transmission of information between the Department and a consumer reporting agency to facilitate the implementation of this subsection. A consumer reporting agency may remove a security freeze for a protected consumer or delete a record of a protected consumer if the security freeze was placed or the record was created based on a material misrepresentation of fact by the protected consumer or the protected consumer’s representative. Notwithstanding any other provision of law, the exclusive remedy for a violation of this section shall be a complaint filed with the Commissioner under § 14–1225 of this subtitle. On the entry of an order for the adoption of a child who was in the custody of a local department under Title 5 of the Family Law Article, the Department shall provide notice to the adoptive parent of the provisions of § 14–1212.2 of this subtitle relating to the authority of the adoptive parent to request a security freeze by consumer reporting agencies. The Department shall notify a protected consumer who becomes an adult of the provisions of § 14–1212.2 of this subtitle, including providing contact information of organizations that may provide assistance to the protected consumer in removing a security freeze.

In this section, “medical debt” means debt owed by a consumer to: A person whose primary business is providing medical services, products, or devices; or The person’s agent or assignee for the provision of medical services, products, or devices. “Medical debt” includes medical bills that: Are not past due; or Have already been paid. “Medical debt” does not include debt charged to a credit card unless the credit card is issued under an open–end or closed–end credit plan offered solely for the payment of health care services. A consumer reporting agency may not: Make, create, or furnish any consumer report containing, incorporating, or reflecting: Any adverse information that the consumer reporting agency knows or should know relates to medical debt incurred by the consumer; or Any collection action against a consumer to collect medical debt; or Maintain in a file on a consumer any information relating to: Medical debt incurred by the consumer; or Any collection action against the consumer to collect medical debt. The prohibitions established under paragraph (1) of this subsection apply regardless of when medical debt was incurred by a consumer. A person may not use medical debt information included in a consumer report to make a determination regarding the creditworthiness of the consumer.

A consumer reporting agency shall register each year with the Commissioner under this subtitle.

To submit a registration, a consumer reporting agency shall: Submit to the Commissioner a registration on the form that the Commissioner provides; Unless granted an exemption by the Commissioner, file with the Commissioner a bond or bond alternative as required under § 14–1217 of this subtitle; and Fulfill any other requirements for registration. The registration shall include any information that the Commissioner requires by regulation. A registration is not complete unless it meets the requirements of subsections (a) and (b) of this section. Except as provided in § 14–1226 of this subtitle, all fees and other revenues collected under this subtitle shall be deposited into the Non–Depository Special Fund established under § 2–120 of the Financial Institutions Article. The Commissioner may require a consumer reporting agency to register through NMLS or through other means specified by the Commissioner by regulation.

Unless the Commissioner grants an exemption in accordance with subsection (b)(9) of this section and except as provided in subsection (c) of this section, with a new or renewal registration filed on or after June 1, 2019, a consumer reporting agency shall file a surety bond or irrevocable letter of credit with the Commissioner. The bond shall run to the Commissioner, as obligee, for the benefit of: The State; Any consumer who is injured by a violation of this subtitle committed by a consumer reporting agency; and Any consumer who suffers actual damages as a result of the breach of the security of a system experienced by a consumer reporting agency. The bond shall be: In an amount not exceeding $1,000,000, as determined by the Commissioner by regulation; Issued by a surety company that: Is authorized to do business in the State; and Holds a certificate of authority issued by the Maryland Insurance Commissioner; and Conditioned that the consumer reporting agency shall comply with all State and federal laws and regulations governing consumer reporting agencies. The liability of the surety: Shall be continuous; May not be aggregated or cumulative, whether or not the bond is renewed, continued, replaced, or modified; May not be determined by adding together the penal sum of the bond, or any part of the penal sum of the bond, in existence at any two or more points in time; Shall be considered to be one continuous obligation, regardless of increases or decreases in the penal sum of the bond; May not be affected by: The insolvency or bankruptcy of the consumer reporting agency; Any misrepresentation, breach of warranty, failure to pay a premium, or any other act or omission of the consumer reporting agency or an agent of the consumer reporting agency; or The suspension of the consumer reporting agency’s registration; May not require an administrative enforcement action by the Commissioner as a prerequisite to liability; and Shall continue for 3 years after the later of the date on which: The bond is canceled; or The consumer reporting agency, for any reason, ceases to be registered. A bond may be canceled by the surety or the consumer reporting agency by giving notice of cancellation to the Commissioner. Notice under subparagraph (i) of this paragraph shall: Be in writing; and Be sent by certified mail, return receipt requested. A cancellation of a bond under this paragraph is not effective until 90 days after receipt of a notice of cancellation by the Commissioner. A claim against the bond may be filed with the surety by: A claimant; or The Commissioner for the benefit of a claimant or the State. If the amount of claims against a bond exceeds the amount of the bond, the surety: Shall pay the amount of the bond to the Commissioner for pro rata distribution to claimants; and Is relieved of liability under the bond. If the penal amount of a bond is reduced by payment of a claim or judgment, the consumer reporting agency shall file a new or additional bond with the Commissioner. A penalty imposed against a consumer reporting agency under § 14–1226 of this subtitle may be collected and paid from the proceeds of a bond required under this section. In granting an exemption from the bonding requirement under subsection (a) of this section, the Commissioner shall consider the conditions the Commissioner establishes by regulation. In determining the amount of the bond under paragraph (2)(i) of this subsection, the Commissioner shall consider the factors the Commissioner establishes by regulation. In lieu of the bonding requirement under subsection (a) of this section, a consumer reporting agency may file an irrevocable letter of credit from a financial institution insured by the Federal Deposit Insurance Corporation with the Commissioner. The irrevocable letter of credit shall be in an amount equal to the bond required under subsection (b) of this section. The Commissioner shall adopt regulations establishing: The conditions under which the Commissioner may grant to a consumer reporting agency an exemption from the bonding requirement under subsection (a) of this section; and The factors the Commissioner shall consider in determining the amount of the bond under subsection (b)(2)(i) of this section.

A consumer who has reason to believe that this subtitle, or any other law regulating consumer credit reporting, has been violated by a person may file with the Commissioner a written complaint setting forth the details of the alleged violation. The Commissioner may initiate an investigation if the Commissioner has reason to believe that this subtitle, or any other law regulating consumer credit reporting, has been violated. After receipt of a written complaint or initiating an investigation under this section, the Commissioner may inspect the books, records, letters, and contracts of a consumer reporting agency, and of each person who has furnished information to the consumer reporting agency relating to the specific written complaint.

Any consumer reporting agency or user of information which willfully fails to comply with any requirement imposed under this subtitle with respect to any consumer is liable to that consumer in an amount equal to the sum of: Any actual damages sustained by the consumer as a result of the failure; Such amount of punitive damages as the court may allow; and In the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney’s fees as determined by the court. Any consumer reporting agency or user of information which is negligent in failing to comply with any requirement imposed under this subtitle with respect to any consumer is liable to that consumer in an amount equal to the sum of: Any actual damages sustained by the consumer as a result of the failure; and In the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney’s fees as determined by the court. A person who furnishes information to a consumer reporting agency or a user of information has no liability under this subtitle for any failure to comply with any requirement imposed under this subtitle with respect to any consumer if, within 30 days after discovering such failure to comply and prior to institution of an action under this subtitle or the receipt of written notice of the failure to comply from the consumer, such person or user notifies the consumer of the failure to comply and makes whatever adjustments are necessary to correct the noncompliance. A person who furnishes information to a consumer reporting agency or a user of information has no liability under this subtitle for any failure to comply with any requirement imposed under this subtitle where such person or user: Unintentionally and in good faith fails to comply with any requirement imposed under this subtitle; and Makes whatever adjustments are necessary to correct the noncompliance within 30 days after such person or user receives written notice of the failure. A person who furnishes information to a consumer reporting agency or a user of information may not be held liable in an action brought under this subtitle for any failure to comply with any requirement imposed under this subtitle if such person or user shows by a preponderance of the evidence that the failure to comply was unintentional and resulted from a bona fide error, notwithstanding the maintenance of procedures reasonably adapted to avoid any such error. The burden shall be on the person who furnishes information to a consumer reporting agency or user of information to show that the failure to comply with any requirement under this subtitle was unintentional and in good faith.

An action to enforce any liability created under this subtitle may be brought within two years from the date on which the liability arises, except that where a defendant has materially and willfully misrepresented any information required under this subtitle to be disclosed to an individual and the information so misrepresented is material to the establishment of the defendant’s liability to that individual under this subtitle, the action may be brought at any time within two years after discovery by the individual of the misrepresentation.

Any person who knowingly and willfully obtains information on a consumer from a consumer reporting agency under false pretenses shall be fined not more than $5,000 or imprisoned not more than one year or both.

Any officer or employee of a consumer reporting agency who knowingly and willfully provides information concerning an individual from the agency’s files to a person not authorized to receive that information shall be fined not more than $5,000 or imprisoned not more than one year or both.

Any consumer who has reason to believe that this subtitle, or any other law regulating consumer credit reporting, has been violated by any person may file with the Commissioner a complaint setting forth the details of an alleged violation. After receipt of the complaint, the Commissioner may inspect the pertinent books, records, letters and contracts of any agency, and of any person who has furnished information to the agency relating to the specific written complaint.

The Commissioner, in addition to taking any other action authorized by law, may: Hold a hearing on the complaint at a time and place in this State reasonably convenient to the parties involved; Subpoena and take depositions of witnesses; Conduct investigations that the Commissioner considers necessary; Administer oaths; Issue orders for compliance with this subtitle; and Issue cease and desist orders, if after a hearing the Commissioner finds a violation of this subtitle. Instead of or in addition to any other action the Commissioner may take under this section or any other provision of law, the Commissioner may impose a civil penalty not exceeding: $1,000 for a first violation; and $2,500 for each subsequent violation. In determining the amount of civil penalty to be imposed under this subsection, the Commissioner shall consider: The seriousness of the violation; The good faith of the violator; The violator’s history of previous violations; The deleterious effect of the violation on the public and the credit granting industry; The assets and financial status of the violator; and Any other factors relevant to the determination of the financial penalty. The Commissioner shall pay all fines and penalties collected by the Commissioner under this subsection into the General Fund of the State. If a person fails to comply with any lawful order of the Commissioner or if any witness fails to appear and testify to any matter regarding which the witness may be lawfully interrogated, on petition of the Commissioner setting forth the facts, the circuit court of any county shall: Compel obedience to the requirements of the subpoena or order; Compel the production of contracts, forms, files, and other evidence; and Order compliance with any lawful order issued by the Commissioner. If a person fails, refuses, or neglects to comply with the order of the court, the court may punish that person for contempt of court. The Administrative Procedure Act, including its provisions for judicial review of a final decision in a contested case, applies to proceedings before the Commissioner pursuant to this subtitle. The Commissioner shall adopt regulations necessary to administer the provisions of this subtitle. The regulations shall include procedures for: Achieving accuracy in information collected and maintained in consumer files; Developing a system to facilitate correction of information in a consumer file at each credit reporting agency on correction at one consumer reporting agency; Periodically distributing to the public a current listing of the names, addresses, and telephone numbers of consumer reporting agencies that maintain information or provide consumer reports on residents of the State; and Calculating the required bond amounts under this subtitle. A consumer reporting agency shall pay to the Commissioner a per–day fee set by the Commissioner for each of the Commissioner’s employees engaged in any investigation of the consumer reporting agency conducted under this section that the Commissioner considers necessary.

The requirements under any federal law and Title 4, Subtitles 1 through 5 of the General Provisions Article regarding the privacy or confidentiality of information or material provided to NMLS, and any privilege arising under federal or state law, including the rules of any federal or state court with respect to that information or material, shall continue to apply to that information or material after the information or material has been disclosed to NMLS. The information and material may be shared with all state and federal regulatory officials having authority over persons required to be registered under this subtitle, including the Financial Crimes Enforcement Network and the Office of Foreign Assets Control, without the loss of privilege or the loss of confidentiality protections provided by federal law or Title 4, Subtitles 1 through 5 of the General Provisions Article. The Commissioner may: Enter into information–sharing agreements with any federal or state regulatory agency having authority over consumer reporting agencies or with any federal or state law enforcement agency, including the Financial Crimes Enforcement Network and the Office of Foreign Assets Control, and any successor to these agencies if the agreements prohibit the agencies from disclosing any shared information without prior written consent from the Commissioner regarding disclosure of the particular information; and Exchange information about a consumer reporting agency, including information obtained or generated during an investigation, with: Any federal or state regulatory agency having authority over consumer reporting agencies; or Any federal or state law enforcement agency. Information or material that is subject to a privilege or confidentiality under subsection (a) of this section may not be subject to: Disclosure under any federal or state law governing the disclosure to the public of information held by an officer or agency of the federal government or a state that has received the information or material; or Subpoena, discovery, or admission into evidence, in any private civil litigation or administrative process, unless, with respect to any privilege held by NMLS, the person to whom the information or material pertains waives, in whole or in part, that privilege. Any provisions of Title 4, Subtitles 1 through 5 of the General Provisions Article relating to the disclosure of any information or material described in subsection (a) of this section that are inconsistent with subsection (a) of this section shall be superseded by the requirements of this section. This section does not apply to information or material relating to publicly adjudicated disciplinary and enforcement actions against a consumer reporting agency that is included in NMLS and designated for access by the public.