Bill 136 adds a new Section 13A to Nova Scotia’s Consumer Reporting Act to give consumers two tools: a security alert (a notice to consumers when their file is pulled) and a security freeze (a prohibition on furnishing a consumer report). The bill requires consumer reporting agencies to place, suspend or revoke an alert or freeze on written request, at no charge, during normal business hours and after verifying the consumer’s identity.
Alerts and freezes remain in effect until revoked.
The bill builds operational duties into statute: agencies must notify consumers of any request for a report under an alert within two hours, refuse to provide reports when a freeze is in place and supply trained personnel to explain the process. It also bars agencies from requiring waivers or undertakings as a condition of placing or lifting a measure, while preserving court-order and narrow statutory exceptions.
For compliance officers and lenders, the measure creates immediate operational, verification and timing implications that will affect credit decisioning, identity-verification workflows and consumer-service resourcing.
At a Glance
What It Does
The bill requires consumer reporting agencies to allow, free of charge and on written request, placement, suspension and revocation of security alerts and security freezes on a consumer’s file. It defines the two tools, mandates identity verification, and makes alerts trigger consumer notification within two hours of a report request.
Who It Affects
Consumer reporting agencies operating in Nova Scotia, any third parties that request consumer reports (lenders, landlords, employers, insurers), and Nova Scotia consumers who want to block or monitor access to their credit files. Identity-verification vendors and customer-support teams will also be directly impacted.
Why It Matters
This shifts control over credit-file access to consumers in statute rather than industry practice, formalizes timing and notification obligations, and creates statutory protections against coerced waivers — potentially changing the operational and legal baseline for provincial consumer reporting in Nova Scotia.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The bill inserts a new Section 13A into the Consumer Reporting Act to create two distinct consumer controls. A security alert requires the consumer reporting agency to tell the consumer when any third party obtains a consumer report about them.
A security freeze stops the agency from providing a consumer report at all to a third party. Both tools are available on a consumer’s written request and stay active until the consumer suspends or revokes them.
Placement, suspension or revocation must be done without charge and during normal business hours; the agency must require “sufficient identification” before acting. The bill obliges agencies to notify consumers of report requests tied to an alert by phone or the consumer’s chosen email “forthwith” and in any event within two hours.
If a freeze is in place and a third party requests a report, the agency must inform that third party that a freeze exists and withhold the report.Operational duties are explicit: agencies must provide trained personnel to explain the processes and effects, and they cannot require consumers to sign waivers or give undertakings as a precondition for placing or removing a freeze or alert. The statute also clarifies that these consumer controls do not override valid court orders or the Act’s existing subsections 9(3) and 9(3A).
Finally, the bill permits a consumer to hold both an alert and a freeze at the same time, which creates a layered control strategy for consumers and distinct workflow implications for agencies and report-requesting entities.
The Five Things You Need to Know
Placement, suspension and revocation of a security alert or security freeze must be accepted on a consumer’s written request and provided free of charge during normal business hours.
A security alert triggers notification to the consumer by phone or the consumer’s specified email immediately and, in any event, within two hours of any third‑party request for their consumer report.
A security freeze prohibits the consumer reporting agency from providing the consumer report to a third party and requires the agency to notify the requester that a freeze exists.
Agencies must verify a consumer’s identity before placing or revoking an alert or freeze and must provide trained personnel to explain the process and effects to consumers.
The bill prohibits agencies from conditioning an alert or freeze on any undertaking or waiver, while preserving exceptions for court orders and the Act’s subsection 9(3) and 9(3A) disclosures.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Definitions for 'security alert' and 'security freeze'
This subsection defines the two core concepts the rest of the provision uses. The alert is a notification duty tied to any dissemination of a consumer report; the freeze is an affirmative prohibition on providing the report to a third party. Precise statutory definitions matter because the obligations that follow — who gets notified, when, and whether a report may be furnished — hinge entirely on these labels.
Placement, revocation, verification and duration
These paragraphs require agencies to accept written requests to place, suspend or revoke alerts and freezes, at no cost and during normal business hours; they also require agencies to obtain sufficient identification before acting. The measures remain in effect until the consumer revokes or suspends them, creating an open-ended block or monitoring status that agencies must track against any future report requests.
Notification timing and third‑party handling
Section 13A(6) imposes a tight timing rule: where an alert is set, the agency must notify the consumer by phone or chosen email 'forthwith' and within two hours after any third party requests a report. Section 13A(7) mandates that, when a freeze exists, the agency must tell the requester about the freeze and refuse to furnish the report. These rules create time-bound service-level obligations for agencies and potential transactional delays for report requesters.
Consumer assistance, waiver ban, and dual placement
Agencies must make trained staff available to explain how to place, suspend or revoke a freeze or alert and what those actions mean. They also cannot require any undertaking or waiver from a consumer as a prerequisite to providing the protections. The statute allows a consumer to hold both an alert and a freeze simultaneously, which means agencies must support both monitoring and blocking workflows for the same file.
Preserved exceptions: court orders and existing disclosures
This subsection clarifies that the new measures do not override court orders requiring disclosure or the Act’s existing subsection 9(3) and 9(3A) provisions. Practically, that means certain legal, statutory or narrowly enumerated disclosures remain possible despite a freeze or alert; agencies and requesters will need to map those exceptions when designing compliance processes.
This bill is one of many.
Codify tracks hundreds of bills on this topic across all five countries.
Explore this topic in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Nova Scotia consumers at risk of identity theft — the bill gives them a statutory right to block or monitor access to their consumer reports, reducing the likelihood of new credit fraud appearing on a file without their knowledge.
- Victims of fraud and identity misuse — they gain a free, statutory tool to stop further report-based credit checks, which can limit fraudulent account openings while they remediate damage.
- Consumer advocates and regulators — the statute formalizes practices many have sought, enabling clearer enforcement and standardized expectations across reporting agencies.
Who Bears the Cost
- Consumer reporting agencies — they must implement identity‑verification processes, real‑time notification systems (including two‑hour windows), staff training programs and recordkeeping for freezes and alerts, all with no fee recovery for the core service.
- Third‑party report requesters (lenders, landlords, insurers, employers) — they face more frequent denials or delays when a freeze exists and may need to adapt decisioning systems and customer workflows to handle notification and alternative verification.
- Small credit pullers and automated services — businesses that perform high volumes of instantaneous credit checks may see operational friction and will need to implement exception-handling for frozen files, potentially increasing time-to-decision or requiring manual intervention.
Key Issues
The Core Tension
The bill’s central tension is between strengthening consumer control over credit‑file access to prevent fraud and the resulting friction on legitimate, time-sensitive credit and screening activities: granting robust, durable freezes and rapid alerting protects individuals but imposes verification, notification and delay costs on agencies and requesters—trade-offs that the statute addresses in part but leaves unresolved in crucial implementation details.
The bill leaves several operational and legal questions unresolved. It requires a "written request" but does not define acceptable formats (wet signature, secure electronic signature, email or web form), which affects onboarding and accessibility.
Agencies must obtain "sufficient identification," but the statute gives no standard to measure sufficiency; that creates risk for both under‑ and over‑enforcement—either letting impostors slip through or imposing onerous proof requirements on legitimate consumers.
The two‑hour notification requirement for alerts is operationally demanding. For manual verification or for report requests originating from automated systems outside normal business hours, meeting a two‑hour window could force agencies to extend staffing or build real‑time notification pipelines.
That creates costs that the statute bars agencies from passing through to consumers for placing or lifting protections. The preservation of court-order and subsection 9(3)/9(3A) exceptions is sensible on its face but raises practical questions: agencies and requesters will need clear rules to identify and document exception-based disclosures to avoid liability and service disruptions.
Finally, the statute increases the potential for legitimate denials that block time-sensitive transactions (mortgages, rentals, employment background checks). The bill gives consumers control but does not create a fast-track, authenticated exception path for urgent legitimate requests.
Absent additional procedural safe harbors or standardized verification protocols, businesses and agencies will likely adopt conservative approaches that may frustrate consumers and commerce in some instances.
There's more to this law than the bill.
Codify Laws traces every connection across the legislative lifecycle.