Identity Theft Laws: State Penalties and Remedies and Pending Federal Bills1

Order Code RS22484
January 11, 2007
Identity Theft Laws: State Penalties and
Remedies and Pending Federal Bills1
Tara Rainson
Law Librarian
Knowledge Services Group
Summary
This report provides an overview of state laws on identity theft.2 State laws to
penalize identity theft are discussed, as well as state laws to assist identity theft victims,
including those that permit the consumers to block unauthorized persons from obtaining
their credit information or “security freezes.” The report concludes with a survey of state
credit freeze statutes. This report will be updated as relevant legislation is introduced
in the 110th Congress.
State Criminal Penalties Aimed at Identity Theft. Forty-eight states have
criminal identity theft statutes.3 Many of these include both monetary penalties and
imprisonment. For example, in California imposters are subject to a fine and confinement
in jail for up to one year.4 In Louisiana, imposters are subject to a fine of up to $10,000
and confinement in jail for up to ten years.5 Several state statutes include restitution
provisions. In Texas, Virginia, and Maryland, the court may order the imposter to
1 This report was originally prepared by Kristin Thornblad, a law clerk in the American Law
Division.
2 For further information, see Gail Hillebrand, After the FACTA: State Power to Prevent Identity
Theft, 17 Loy. Consumer L. Rev 53 (2004); New Data Security Laws Take Effect in Several
States, 75 U.S.L.W. 25 (2007); Catherine Pastrikos, Identity Theft Statutes: Which Will Protect
Americans the Most?, 67 Alb. L. Rev. 1137 (2004); Holly K. Towle, Identity Theft: Myths,
Methods and New Law, 30 Rutgers Computer & Tech. L.J. 237 (2004); Gary M. Victor, Identity
Theft, Its Environment and Proposals for Change, 18 Loy. Consumer L. Rev. 273 (2006).
3 To date, Colorado and Vermont have not enacted criminal identity theft statutes. For a
complete list of state criminal identity theft statutes, see [http://www.consumer.gov/idtheft
/law_laws_state_criminal.htm] (accessed Jan. 11, 2007).
4 Cal. Penal Code §§ 530.5-530.7.
5 La. Rev. Stat. Ann. § 14:67.16.

---

CRS-2
reimburse the victim for expenses incurred because of the theft, such as lost income.6
Other states impose civil penalties for identity theft activities and provide victims with
judicial recourse for damages incurred as a result of the theft. In Washington, imposters
are liable for civil damages of $1,000 or actual damages, whichever is greater.7 The
definition of identity theft varies across state codes. Idaho, for example, simply
criminalizes the use of “identifying information.”8 In Oregon and Maine, the criminal
identity theft includes fraudulent use of credit cards.9 Massachusetts and Illinois
criminalize fraudulent credit card use, but also specifically address the fraudulent use of
a credit card number or other identifying number.10
State Credit Freeze Laws.11 Twenty-six states currently have “security freeze”
laws (also “credit freeze” laws) as a form of identity theft victim assistance.12 A survey
of these laws is provided at the conclusion of this report. A security freeze law allows a
customer to block unauthorized third parties from obtaining his or her credit report or
score. A consumer who places a security freeze on his or her credit report or score
receives a personal identification number to gain access to credit information or to
authorize the dissemination of credit information.
Benefits of security freeze laws include increased consumer control over access to
personal information and corresponding decreased opportunities for imposters to obtain
access to credit. Critics of security freeze laws argue that security freezes may cause
consumers unwanted delays when they must provide third party institutions access to
credit histories for such purposes as qualifying for loans, applying for rental property
6 Tex. Penal Code § 32.51; Va. Code Ann. § 18.2-186.3, et seq; Md. Crim. Law Code Ann. § 8-
301.
7 Rev. Code Wash. 9.35.020(3).
8 Idaho Code Ann. § 18-3126.
9 Ore. Rev. Stat. § 165.055; Me. Rev. Stat. Ann. tit. 17-A, § 905-A.
10 720 Ill. Comp. Stat. 5/16G-10; Mass. Gen. Laws ch. 266, § 37E.
11 Pursuant to recent Fair and Accurate Credit Transactions Act (FACT) amendments to the Fair
Credit Reporting Act (FCRA), federal law may preempt some state provisions relating to identity
theft. P.L. 108-159, 117 Stat. 1952. For effective dates, see 68 Fed. Reg. 74,467 and 68 Fed. Reg.
74,529 (December 24, 2003). The preemption of these provisions in state law does not apply to
any state law in effect on the date of enactment of the Consumer Credit Reporting Reform Act
of 1996. 15 U.S.C. 1681t(b)(1)(E). The FCRA, as amended, includes several provisions aimed
at preventing identity theft or assisting victims. These new provisions preempt similar state laws
relating to the blocking of information in a consumer’s credit report resulting from identity theft,
with some exceptions. For more information see CRS Report RS21449, Fair Credit Reporting
Act: Preemption of State Law.
12 The states with enacted security freeze laws are: California, Colorado, Connecticut, Delaware,
Florida, Hawaii, Illinois, Kansas, Kentucky, Louisiana, Maine, Minnesota, Nevada, New
Hampshire, New Jersey, New York, Oklahoma, North Carolina, Rhode Island, South Dakota,
Texas, Utah, Vermont, Washington, and Wisconsin. See State Security Freeze Laws
[http://www.consumersunion.org/campaigns/learn_more/003484indiv.html] (accessed Jan. 11,
2007).

---

CRS-3
leases, and obtaining mortgage rate approval.13 In an effort to balance these interests of
security and accessibility, five states permit consumers to initiate security freezes only if
they have been victims of identity theft or attempted identity theft.14
State laws also differ regarding what fees, if any, a credit reporting agency may
charge consumers for requesting a security freeze. Fifteen states prohibit credit reporting
agencies (CRAs) from charging fees to an identity theft victim who requests a freeze. The
Wisconsin identity theft statute provides, for example, that there shall be no fee imposed
on an individual who submits “evidence satisfactory to the CRAs” that he or she has filed
an identity theft report with a law enforcement agency.15 In Vermont, CRAs may impose
fees when the requester believes he or she is an identity theft victim.16 Under the recently-
enacted Kansas identity theft statute, CRAs may not charge a security freeze fee to seniors
65 years of age or older.17 Most state laws specify the maximum fee a CRA may charge
per security freeze request. In California and Connecticut, CRAs may charge up to ten
dollars per security freeze request.18 The relevant Utah statute states only that security
freeze fees must be “reasonable.”19
In addition to security freeze statutes, five states have enacted “credit information
blocking” laws.20 Alabama, Colorado, Idaho, and Washington require consumer credit
reporting agencies to block false information resulting from identity theft from victims’
credit reports.21 California requires a debt collector to stop collection when the alleged
debtor provides evidence of his status as an identity theft victim.22
13 The Financial Services Industry’s Responsibilities and Role in Preventing Identity Theft and
Protecting the Sensitive Financial Information of their Customers: Hearing Before the Senate
Comm. on Banking, Housing, and Urban Affairs, 109th Cong., 1st Sess. (2005) (statement by
Stuart K. Pratt, President and Chief Executive Officer, Consumer Data Industry Association).
14 Haw. Rev. Stat. Ch. 489P; Kan. Sess. Laws 2006, Ch. 149; S.D. Codified Laws § 54-15-1, et
seq.; Tex. Bus. & Com. Code Ann. § 20.031-20.039; Rev. Code Wash. §§ 19.182.170 -
19.182.200.
15 Wis. Stat. § 138.25.
16 Vt. Stat. Ann. tit. 9, §§ 2480a-2480j.
17 Kan. Sess. Laws 2006, Ch. 149.
18 Conn. Gen. Stat. § 36a-701a; Cal. Civ. Code §§ 1785.11.2-1785.11.6.
19 Utah Code Ann. §§ 13-42-101 and 13-42-102; §§ 13-42-201 et seq.
20 For further information, see [http://www.consumer.gov/idtheft/law_laws_credit_info.htm]
(accessed Jan. 11, 2006).
21 Ala. Code § 13A-8-200; Colo. Rev. Stat. §§ 12-4.3-106.5 to 12-4.3-108 and 16-8.5-103; Idaho
Code § 28-51-102; Rev. Code Wash. § 19.182.160.
22 Cal. Civ. Code § 1788.18.

---

CRS-4
Social Security Numbers. Several state laws are intended to protect
consumers by preventing identity theft.23 Michigan’s Social Security Number Privacy
Act, the first state law of its kind, requires employers to adopt a policy to insure the
confidentiality of employee social security numbers (SSNs).24 The employer policy must
include document destruction protocols and impose penalties on persons who violate the
policy. The statute requires employers to publish the policy in an employee handbook
or through other means. California also has enacted a statute intended to protect the
integrity of employees’ SSNs.25 The statute prohibits employers from publicly displaying
SSNs or printing the numbers on employee identification cards or badges. Other states
have restricted the collection of SSNs for use in consumer transactions. In Rhode Island,
it is a misdemeanor to require a consumer to disclose his or her SSN, “incident to the sale
of consumer goods or services.”26 The law includes exceptions for insurance and
healthcare services and applications for consumer credit.
Survey of State Security Freeze Laws
Credit reporting
State Security
Applies to all
agency fees for
Effective date
Freeze Statute
consumers?
freeze requests?
California, Cal. Civ.
Yes
Yes. No fees for
Jan. 1, 2003
Code §§ 1785.11.2-
identity theft
(subsequently
1785.11.6
victims.
amended)
Colorado, Colo. Rev.
Yes
No fees for first
July 1, 2006
Stat. § 12-14.3-102,
request. No fees
et seq.
for identity theft
victims.
Connecticut, Conn.
Yes
Yes
Jan. 1, 2006
Gen. Stat. § 36a-701a
Delaware, Del. Code
Yes
Yes
Sept. 29, 2006
Ann. tit. 6, § 2201, et
seq.
Florida, Fla. Stat. §
Yes
Yes. No fees for
July 1, 2006
501.005
identity theft
victims.
23 For further information, see CRS Report RL30318, The Social Security Number: Legal
Developments Affecting Its Collection, Disclosure, and Confidentiality, by Kathleen S.
Swendiman.
24 Mich. Comp. Laws. § 445.84.
25 Cal. Civ. Code §§ 1798.85-1798.96.
26 R.I. Gen. Laws § 6-13-17.

---

CRS-5
Credit reporting
State Security
Applies to all
agency fees for
Effective date
Freeze Statute
consumers?
freeze requests?
Hawaii, 2006 Haw.
No. Applies only to
No
Jan. 1, 2007
Rev. Stat. Ann. Adv.
identity theft victims.
Legis. Service 138
(LexisNexis)
Illinois, 815 Ill.
Yes
Yes. No fees for
Jan. 1, 2007
Comp. Stat.
identity theft
505/2MM
victims or seniors
65+ years old.
Kansas, 2006 Kan.
No. Applies only to
No
Jan. 1, 2007
Sess. Laws 149
identity theft victims.
Kentucky, Ky. Rev.
Yes
Yes. No fees for
July 11, 2006
Stat. § 367, et seq.
identity theft
victims.
Louisiana, La. Rev.
Yes
Yes. No fees for
July 1, 2005
Ann. § 9.3571(H) to
identity theft
(Y)
victims or for
seniors 62+ years
old.
Maine, Me. Rev.
Yes
Yes. No fees for
Feb. 1, 2006
Stat. Ann. tit. 10 §
identity theft
1313-C
victims.
Minnesota, Minn.
Yes
Yes. No fees for
Aug. 1, 2006
Stat. § 13C.016
identity theft
victims.
Nevada, Nev. Rev.
Yes
Yes. No fees for
Oct. 1, 2005
Stat. § 598C.010, et
identity theft
seq.
victims.
New Hampshire, §
Yes
Yes. No fees for
Jan. 1, 2007
359-B:22 et seq.
identity theft
victims.
New Jersey, N.J.
Yes
Yes. No fees for
Jan. 1, 2006
Rev. Stat. §§ 56:11-
first request.
44 - 56:11-50
New York, N.Y.
Yes
Yes. No fees for
Nov. 1, 2006
Gen. Bus. Law 380-
identity theft
a, et seq.
victims.
North Carolina, N.C.
Yes
Yes. No fees for
Dec. 1, 2005
Gen. Stat. § 75-60, et
identity theft
seq.
victims.
Oklahoma, Okla.
Yes
Yes. No fees for
Jan. 1, 2007
Stat. tit. 24, § 149, et
identity theft
seq.
victims or seniors
65+ years old.

---

CRS-6
Credit reporting
State Security
Applies to all
agency fees for
Effective date
Freeze Statute
consumers?
freeze requests?
Pennsylvania, 2006
Yes
Yes. No fees for
Jan. 1, 2007
Pa. Legis. Serv. 163
identity theft
(West)
victims or seniors
65+ years old.
Rhode Island, R.I.
Yes
Yes. No fees for
Jan. 1, 2007
Gen. Laws § 6-48-1
identity theft
et seq.
victims or seniors
65+ years old.
South Dakota, S.D.
No. Applies to
No
July 1, 2006
Codified Laws § 54-
identity theft victims
15-1, et seq.
only.
Texas, Tex. Bus. &
No. Applies to
Yes
Sept. 1, 2003
Com. Code § 20.031-
identity theft victims
20.039
only.
Utah, Utah Code
Yes
Yes. Allows for
Sept. 1, 2008
Ann. § 13-42-102
“reasonable fees.”
and 13-42-201
Vermont, Vt. Stat.
Yes
No
July 1, 2005
Ann. tit. 9, §§ 2480a-
2480j
Washington, Wash.
No. Applies to
No
July 24, 2005
Rev. Code § 19.182
identity theft victims.
Wisconsin, Wis. Stat.
Yes
Yes. No fees for
Jan. 1, 2007
§ 138.25
identity theft
victims.

---