A consumer reporting agency shall remove a security freeze placed under section 8-2603 within three business days after receiving a request for removal from the consumer who provides both of the following:

(1) Sufficient proof of identity of the consumer; and

(2) The unique personal identification number or password referred to in subdivision (2)(b) of section 8-2606.