15 U.S.C. § 1681c–2 — Block of information resulting from identity theft

(a) Block. Unless this section provides otherwise, within 4 business days after receiving (1) appropriate proof of the consumer’s identity, (2) an identity-theft report, (3) the consumer’s identification of the information, and (4) the consumer’s statement that the information does not relate to a transaction by the consumer^*, an agency must block reporting of information in the consumer’s file that the consumer identifies as resulting from alleged identity theft.
(b) Notice. The agency must promptly tell the furnisher that the information may result from identity theft, an identity-theft report was filed, a block was requested, and the block’s effective dates.
(c) Declining or rescinding a block. (1) The agency may decline or rescind a block if it reasonably determines that the information or request was erroneous, the request or block was based on the consumer’s material factual misrepresentation relevant to it, or the consumer obtained goods, services, or money from the blocked transaction. (2) The agency must promptly notify the affected consumer in the same way consumers are notified when information is reinserted under § 1681i(a)(5)(B). (3) If a block is rescinded, the fact that the information was in the file before blocking does not show that the consumer knew or should have known that the consumer obtained goods, services, or money from the transaction.
(d) Resellers. (1) This section does not apply to a reseller that is not furnishing or reselling a report about the identified information when the consumer requests the block and that tells the consumer, by any means, that the consumer may report the identity theft to the Bureau for information about identity theft. (2) If a reseller does maintain the identified information, its only duty is to block its report from later use when the consumer makes the subsection (a) identification and the reseller is the reseller of that information. (3) The reseller must promptly tell the consumer that it blocked the file and give the name, address, and telephone number of every agency from which it obtained the information for resale.
(e) Check-services companies. This section does not apply to a check-services company acting as such to authorize or process negotiable instruments, electronic transfers, or similar payments. But beginning 4 business days after receiving the information described in subsection (a)(1) through (3), it may not report to a nationwide agency any information identified in the identity-theft report as resulting from identity theft.
(f) Law enforcement. Nothing here requires an agency to stop a Federal, State^*, or local law-enforcement agency from accessing blocked information that the agency could otherwise access under this subchapter.