Security Breach Notification Act
Summary: The Security Breach Notification Act requires companies to notify customers when personal data has been lost or stolen, making customers susceptible to identity theft.
SECTION 1. SHORT TITLE
This Act shall be called the “Security Breach Notification Act.”
SECTION 2. FINDINGS AND PURPOSE
(A) FINDINGS—The legislature finds that:
1. Identity theft is one of the fastest growing crimes in America.
2. Businesses and individuals alike lose billions of dollars each year because of fraud associated with identity theft.
3. Identity theft is made possible by security breaches—most commonly when personal financial data such as social security, bank account, and credit card numbers are lost by, or stolen from, businesses.
4. It is crucial that customers be notified of security breaches so they can take precautions with their credit reports and credit accounts.
(B) PURPOSE—This law is enacted to protect individuals and businesses from crimes resulting from identity theft.
SECTION 3. SECURITY BREACH NOTIFICATION
(A) DEFINITIONS—In this section:
1. “Data collector” means a person, corporation or other entity that handles personal information.
2. “Breach of the security of the data” means unauthorized acquisition of computerized or non-computerized data that compromises the security, confidentiality or integrity of personal information maintained by the data collector. Good faith acquisition of personal information by an employee or agent of the data collector for a legitimate purpose of the data collector is not a breach of the security of the data, provided that the personal information is not used for a purpose unrelated to the data collector or subject to further unauthorized disclosure.
3. “Personal information” means an individual’s last name, address or phone number in combination with any of the following data elements, when either the name or the data elements are not encrypted or redacted, or are encrypted with an encryption key that was also acquired:
a. Social security number.
b. Driver’s license number or state identification card number.
c. Account number, credit or debit card number, if circumstances exist wherein such a number could be used without additional identifying information, access codes, or passwords.
d. Account passwords or personal identification numbers (PINs) or other access codes.
e. Biometric data.
“Personal information” includes the data elements listed above, when not in connection with the individual’s last name, address or phone number, if the information compromised would be sufficient to perform or attempt to perform identity theft against the person whose information was compromised.
“Personal information” does not include information that is lawfully made available to the general public from federal, state or local government records, provided that such publicly available information has not been aggregated or consolidated into an electronic database or similar system by the governmental agency or by another person.
(B) NOTICE OF BREACH
1. A data collector that owns or uses personal information concerning a [State] resident shall, as quickly as possible, notify the resident if there is a breach of the security of the data.
2. The notification required by this section shall be delayed if a law enforcement agency informs the data collector in writing that the notification may seriously impede a criminal investigation.
3. Notice of a breach of the security of the data shall be provided in writing by first-class mail, or by electronic mail if it complies with the requirements of Title 15, Section 7001 of the United States Code.
4. If the data collector demonstrates that the cost of providing notice would exceed $250,000, or that the data collector does not have sufficient contact information to notify affected residents, the data collector shall:
a. Post the notice conspicuously on the data collector’s Internet site; and
b. Deliver notice by first-class mail to every licensed television and radio station, and every general circulation daily newspaper in the state.
5. The notice of a breach of the security of the data shall include:
a. A description of the types of information that were, or were reasonably believed to have been, acquired by an unauthorized person, such as social security, driver’s license, and credit card numbers;
b. A toll-free telephone number that residents may use to learn whether their personal information was compromised and what data was lost or stolen; and
c. The telephone numbers and addresses of the major credit reporting agencies.
6. After a notification of a breach of the security of the data, a data collector shall make available, free of charge to affected residents, credit reports from at least one of the major credit reporting agencies, beginning not later than two months following the breach of security, and continuing on a quarterly basis for a period of two years.
(C) WAIVER—Any waiver of the provisions of this title is contrary to public policy, and is void and unenforceable.
(D) ENFORCEMENT
1. The Department of [Consumer Affairs] shall promulgate such regulations as are necessary to enforce this section.
2. A resident of [State] injured by a violation of this section may initiate a civil action to recover damages.
3. A data collector that violates, proposes to violate, or has violated this section may be enjoined.
4. The rights and remedies available under this section do not preempt any other rights and remedies available under law.
SECTION 4. SEVERABILITY
The provisions of this Act shall be severable, and if any phrase, clause, sentence or provision is declared to be invalid or is preempted by federal law or regulation, the validity of the remainder of this Act shall not be affected.
SECTION 5. EFFECTIVE DATE
This Act shall take effect on July 1, 2007.
Security Freeze Identity Protection Act
Summary: The Security Freeze Identity Protection Act protects consumers from identity theft by giving them control over the release of their credit reports.
SECTION 1. SHORT TITLE
This Act shall be called the “Security Freeze Identity Protection Act.”
SECTION 2. FINDINGS AND PURPOSE
(A) FINDINGS—The legislature finds that:
1. Identity theft is one of the fastest growing crimes in America.
2. Businesses and individuals alike lose billions of dollars each year because of fraud associated with identity theft.
3. If empowered to place a security freeze on their credit reports, customers could prevent new account fraud.
(B) PURPOSE—This law is enacted to protect individuals and businesses from crimes resulting from identity theft.
SECTION 3. SECURITY FREEZE IDENTITY PROTECTION
(A) DEFINITIONS—In this section:
1. “Credit reporting agency” means a person, corporation or other entity that regularly engages in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing credit reports to third parties.
2. “Credit report” means information that bears on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used, or serves as a factor, in establishing a consumer’s eligibility for credit or insurance.
3. “Security freeze” means a consumer’s directive that prohibits a credit reporting agency from releasing any part of the consumer’s credit report or any information derived from it to a third party without prior express authorization from the consumer.
(B) SECURITY FREEZE
1. A consumer may direct a credit reporting agency to place a security freeze on his or her credit report. Such a directive may be delivered to the credit reporting agency in writing, by telephone, or through a secure Internet connection. By January 1, 2007, credit reporting agencies shall make a secure Internet connection available to customers for this purpose.
2. A credit reporting agency shall implement the customer’s security freeze no later than five business days after it receives a directive in writing or by telephone, and no later than three business days after it receives a directive through a secure Internet connection. By July 1, 2007, a credit reporting agency shall implement a customer’s security freeze no later than three business days after it receives a directive in writing or by telephone, and no later than one business day after it receives a directive through secure Internet connection. By July 1, 2008, a credit reporting agency shall implement a consumer’s security freeze no later than one business day after it receives a directive in writing, by telephone, or through a secure Internet connection.
3. No later than five business days after it implements a security freeze, a credit reporting agency shall send to the consumer, by first-class mail, a unique personal identification number or password to be used by the consumer to authorize the release of his or her credit record. By July 1, 2007, a credit reporting agency shall send the unique personal identification number or password no later than one business day after it implements a security freeze.
4. After a security freeze is implemented, the consumer may authorize release of his or her credit report by contacting a credit reporting agency in writing, by telephone, or through a secure Internet connection and providing:
a. The consumer’s name, address and date of birth;
b. The consumer’s unique personal identification number or password; and
c. Instructions that specify: the third party that is to receive the credit report, a limited time period during which the credit report shall be available to any user of credit reports, or that the security freeze is permanently removed. No fewer than five days before a security freeze is permanently removed, the credit reporting agency shall notify the consumer, by first-class mail, of the impending removal.
5. A credit reporting agency shall release a consumer’s credit report no later than three business days after a consumer authorizes the release. By July 1, 2007, a credit reporting agency shall release a consumer’s credit report no later than one business day after a consumer authorizes the release. By July 1, 2008, a credit reporting agency shall release a consumer’s credit report no later than 15 minutes after a consumer authorizes the release.
6. A credit reporting agency shall not state or imply to a third party that the consumer’s security freeze reflects a negative credit score, history, report or rating.
7. This section shall not apply to the receipt of a credit report by:
a. A person, corporation or other entity, or its subsidiary, affiliate, agent or assignee, that is a creditor of the consumer and that is receiving the credit report for the purpose of reviewing an existing account or collecting an existing financial obligation.
b. A subsidiary, affiliate, agent or assignee of a third party that was authorized by the consumer to receive his or her credit report pursuant to paragraph 4.
c. A person acting pursuant to a court order, warrant or subpoena.
d. A state or local agency which administers a program to establish and enforce child support obligations.
e. The [State health department] or its agents or assignees acting to investigate fraud.
f. The [State tax authority] or its agents or assignees acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities.
g. A person for the purposes of prescreening as defined by the federal Fair Credit Reporting Act.
h. A person who administers a credit file monitoring subscription service to which the consumer has subscribed.
i. A person for the purpose of providing a consumer with a copy of his or her credit report upon the consumer’s request.
8. A consumer shall not be charged for any services associated with a security freeze, except the replacement of a unique personal identification number or password, for which the customer may be charged not more than five dollars.
9. If a credit reporting agency wrongly releases information that is subject to a security freeze, the credit reporting agency shall notify the affected consumer within five business days, and shall specify the information that was released and the third party that received it.
(C) NOTICE OF RIGHTS—At any time that a consumer is required to receive a summary of rights under Section 609 of the federal Fair Credit Reporting Act or under [cite state law], the following notice shall be included:
“[State] Consumers Have the Right to Obtain a Security Freeze
You may obtain a security freeze on your credit report at no charge to protect your privacy and ensure that credit is not granted in your name without your knowledge. You have a right to place a security freeze on your credit report pursuant to [cite state law].
The security freeze will prohibit a credit reporting agency from releasing any information in your credit report without your express authorization or approval.
The security freeze is designed to prevent credit, loans and services from being approved in your name without your consent. When you place a security freeze on your credit report, you will be provided a personal identification number or password to use if you choose to remove the security freeze on your credit report or to temporarily authorize the release of your credit report to a specific party or for a specific period of time after the freeze is in place. To provide that authorization, you must contact the credit reporting agency and provide all of the following:
1. The unique personal identification number or password provided by the credit reporting agency.
2. Proper identification to verify your identity.
3. Proper information regarding the third party or parties who are to receive the credit report or the period of time for which the report shall be available to users of the credit report.
A security freeze does not apply to circumstances in which you have an existing account relationship and a copy of your report is requested by your existing creditor or its agents or affiliates for account review, collection, fraud control or similar activities.
If you are actively seeking a new credit, loan, utility, telephone, or insurance account, you should understand that the procedures involved in lifting a security freeze may slow your own applications for credit. You should plan ahead and lift a freeze—either completely or specifically for a certain creditor—with enough advance notice before you apply for new credit for the lift to take effect. Until July 1, 2008, you should lift the freeze at least three business days before applying; between July 1, 2008 and July 1, 2009 you should lift the freeze at least one business day before applying; and after July 1, 2009 you should lift the freeze at least 15 minutes before applying for a new account.
You have a right to bring a civil action against someone who violates your rights under the credit reporting laws. The action can be brought against a consumer reporting agency or a user of your credit report.”
(D) ENFORCEMENT
1. The Secretary of the [Department of Consumer Affairs] shall promulgate such regulations as are necessary to enforce this section. Regulations shall include procedures to receive, investigate and attempt to resolve complaints; issue civil penalties when warranted, not to exceed $10,000 for each violation; and bring actions for damages and injunctive relief, when necessary, in any court of competent jurisdiction.
2. An aggrieved consumer may bring a private cause of action for damages caused by violation of this section, and injunctive relief from future violations. If the consumer wins damages or injunctive relief, he or she may be awarded reasonable attorney’s fees, investigative expenses, and court costs.
3. Each violation of a security freeze shall be counted as a separate incident for purposes of imposing penalties under this section.
SECTION 4. SEVERABILITY
The provisions of this Act shall be severable, and if any phrase, clause, sentence or provision is declared to be invalid or is preempted by federal law or regulation, the validity of the remainder of this Act shall not be affected.
SECTION 5. EFFECTIVE DATE
This Act shall take effect on July 1, 2007.