(1) A consumer reporting agency shall place a security freeze on a file no later than three business days after receiving a request under section 8-2603.

(2) Until July 1, 2008, a consumer reporting agency shall, within ten business days after receiving a request under section 8-2603, send a written confirmation of the security freeze to the consumer and provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of a credit report or any other information derived from his or her file for a specified period of time. Beginning July 1, 2008, a consumer reporting agency shall send such confirmation and provide such identification number or password to the consumer within five business days after receiving a request under section 8-2603.

(3) The written confirmation required under subsection (2) of this section shall include a warning which shall read as follows: WARNING TO PERSONS SEEKING A CREDIT FREEZE AS PERMITTED BY THE CREDIT REPORT PROTECTION ACT: YOU MAY BE DENIED CREDIT AS A RESULT OF A FREEZE PLACED ON YOUR CREDIT.