Identity Theft Laws: State Penalties and Remedies and Pending Federal Bills1

Order Code RS22484 January 11, 2007 Identity Theft Laws: State Penalties and Remedies and Pending Federal Bills1 Tara Rainson Law Librarian Knowledge Services Group Summary This report provides an overview of state laws on identity theft.2 State laws to penalize identity theft are discussed, as well as state laws to assist identity theft victims, including those that permit the consumers to block unauthorized persons from obtaining their credit information or “security freezes.” The report concludes with a survey of state credit freeze statutes. This report will be updated as relevant legislation is introduced in the 110th Congress. State Criminal Penalties Aimed at Identity Theft. Forty-eight states have criminal identity theft statutes.3 Many of these include both monetary penalties and imprisonment. For example, in California imposters are subject to a fine and confinement in jail for up to one year.4 In Louisiana, imposters are subject to a fine of up to $10,000 and confinement in jail for up to ten years.5 Several state statutes include restitution provisions. In Texas, Virginia, and Maryland, the court may order the imposter to 1 This report was originally prepared by Kristin Thornblad, a law clerk in the American Law Division. 2 For further information, see Gail Hillebrand, After the FACTA: State Power to Prevent Identity Theft, 17 Loy. Consumer L. Rev 53 (2004); New Data Security Laws Take Effect in Several States, 75 U.S.L.W. 25 (2007); Catherine Pastrikos, Identity Theft Statutes: Which Will Protect Americans the Most?, 67 Alb. L. Rev. 1137 (2004); Holly K. Towle, Identity Theft: Myths, Methods and New Law, 30 Rutgers Computer & Tech. L.J. 237 (2004); Gary M. Victor, Identity Theft, Its Environment and Proposals for Change, 18 Loy. Consumer L. Rev. 273 (2006). 3 To date, Colorado and Vermont have not enacted criminal identity theft statutes. For a complete list of state criminal identity theft statutes, see [http://www.consumer.gov/idtheft /law_laws_state_criminal.htm] (accessed Jan. 11, 2007). 4 Cal. Penal Code §§ 530.5-530.7. 5 La. Rev. Stat. Ann. § 14:67.16. CRS-2 reimburse the victim for expenses incurred because of the theft, such as lost income.6 Other states impose civil penalties for identity theft activities and provide victims with judicial recourse for damages incurred as a result of the theft. In Washington, imposters are liable for civil damages of $1,000 or actual damages, whichever is greater.7 The definition of identity theft varies across state codes. Idaho, for example, simply criminalizes the use of “identifying information.”8 In Oregon and Maine, the criminal identity theft includes fraudulent use of credit cards.9 Massachusetts and Illinois criminalize fraudulent credit card use, but also specifically address the fraudulent use of a credit card number or other identifying number.10 State Credit Freeze Laws.11 Twenty-six states currently have “security freeze” laws (also “credit freeze” laws) as a form of identity theft victim assistance.12 A survey of these laws is provided at the conclusion of this report. A security freeze law allows a customer to block unauthorized third parties from obtaining his or her credit report or score. A consumer who places a security freeze on his or her credit report or score receives a personal identification number to gain access to credit information or to authorize the dissemination of credit information. Benefits of security freeze laws include increased consumer control over access to personal information and corresponding decreased opportunities for imposters to obtain access to credit. Critics of security freeze laws argue that security freezes may cause consumers unwanted delays when they must provide third party institutions access to credit histories for such purposes as qualifying for loans, applying for rental property 6 Tex. Penal Code § 32.51; Va. Code Ann. § 18.2-186.3, et seq; Md. Crim. Law Code Ann. § 8301. 7 Rev. Code Wash. 9.35.020(3). 8 Idaho Code Ann. § 18-3126. 9 Ore. Rev. Stat. § 165.055; Me. Rev. Stat. Ann. tit. 17-A, § 905-A. 10 720 Ill. Comp. Stat. 5/16G-10; Mass. Gen. Laws ch. 266, § 37E. 11 Pursuant to recent Fair and Accurate Credit Transactions Act (FACT) amendments to the Fair Credit Reporting Act (FCRA), federal law may preempt some state provisions relating to identity theft. P.L. 108-159, 117 Stat. 1952. For effective dates, see 68 Fed. Reg. 74,467 and 68 Fed. Reg. 74,529 (December 24, 2003). The preemption of these provisions in state law does not apply to any state law in effect on the date of enactment of the Consumer Credit Reporting Reform Act of 1996. 15 U.S.C. 1681t(b)(1)(E). The FCRA, as amended, includes several provisions aimed at preventing identity theft or assisting victims. These new provisions preempt similar state laws relating to the blocking of information in a consumer’s credit report resulting from identity theft, with some exceptions. For more information see CRS Report RS21449, Fair Credit Reporting Act: Preemption of State Law. 12 The states with enacted security freeze laws are: California, Colorado, Connecticut, Delaware, Florida, Hawaii, Illinois, Kansas, Kentucky, Louisiana, Maine, Minnesota, Nevada, New Hampshire, New Jersey, New York, Oklahoma, North Carolina, Rhode Island, South Dakota, Texas, Utah, Vermont, Washington, and Wisconsin. See State Security Freeze Laws [http://www.consumersunion.org/campaigns/learn_more/003484indiv.html] (accessed Jan. 11, 2007). CRS-3 leases, and obtaining mortgage rate approval.13 In an effort to balance these interests of security and accessibility, five states permit consumers to initiate security freezes only if they have been victims of identity theft or attempted identity theft.14 State laws also differ regarding what fees, if any, a credit reporting agency may charge consumers for requesting a security freeze. Fifteen states prohibit credit reporting agencies (CRAs) from charging fees to an identity theft victim who requests a freeze. The Wisconsin identity theft statute provides, for example, that there shall be no fee imposed on an individual who submits “evidence satisfactory to the CRAs” that he or she has filed an identity theft report with a law enforcement agency.15 In Vermont, CRAs may impose fees when the requester believes he or she is an identity theft victim.16 Under the recentlyenacted Kansas identity theft statute, CRAs may not charge a security freeze fee to seniors 65 years of age or older.17 Most state laws specify the maximum fee a CRA may charge per security freeze request. In California and Connecticut, CRAs may charge up to ten dollars per security freeze request.18 The relevant Utah statute states only that security freeze fees must be “reasonable.”19 In addition to security freeze statutes, five states have enacted “credit information blocking” laws.20 Alabama, Colorado, Idaho, and Washington require consumer credit reporting agencies to block false information resulting from identity theft from victims’ credit reports.21 California requires a debt collector to stop collection when the alleged debtor provides evidence of his status as an identity theft victim.22 13 The Financial Services Industry’s Responsibilities and Role in Preventing Identity Theft and Protecting the Sensitive Financial Information of their Customers: Hearing Before the Senate Comm. on Banking, Housing, and Urban Affairs, 109th Cong., 1st Sess. (2005) (statement by Stuart K. Pratt, President and Chief Executive Officer, Consumer Data Industry Association). 14 Haw. Rev. Stat. Ch. 489P; Kan. Sess. Laws 2006, Ch. 149; S.D. Codified Laws § 54-15-1, et seq.; Tex. Bus. & Com. Code Ann. § 20.031-20.039; Rev. Code Wash. §§ 19.182.170 19.182.200. 15 Wis. Stat. § 138.25. 16 Vt. Stat. Ann. tit. 9, §§ 2480a-2480j. 17 Kan. Sess. Laws 2006, Ch. 149. 18 Conn. Gen. Stat. § 36a-701a; Cal. Civ. Code §§ 1785.11.2-1785.11.6. 19 Utah Code Ann. §§ 13-42-101 and 13-42-102; §§ 13-42-201 et seq. 20 For further information, see [http://www.consumer.gov/idtheft/law_laws_credit_info.htm] (accessed Jan. 11, 2006). 21 Ala. Code § 13A-8-200; Colo. Rev. Stat. §§ 12-4.3-106.5 to 12-4.3-108 and 16-8.5-103; Idaho Code § 28-51-102; Rev. Code Wash. § 19.182.160. 22 Cal. Civ. Code § 1788.18. CRS-4 Social Security Numbers. Several state laws are intended to protect consumers by preventing identity theft.23 Michigan’s Social Security Number Privacy Act, the first state law of its kind, requires employers to adopt a policy to insure the confidentiality of employee social security numbers (SSNs).24 The employer policy must include document destruction protocols and impose penalties on persons who violate the policy. The statute requires employers to publish the policy in an employee handbook or through other means. California also has enacted a statute intended to protect the integrity of employees’ SSNs.25 The statute prohibits employers from publicly displaying SSNs or printing the numbers on employee identification cards or badges. Other states have restricted the collection of SSNs for use in consumer transactions. In Rhode Island, it is a misdemeanor to require a consumer to disclose his or her SSN, “incident to the sale of consumer goods or services.”26 The law includes exceptions for insurance and healthcare services and applications for consumer credit. Survey of State Security Freeze Laws State Security Freeze Statute Applies to all consumers? Credit reporting agency fees for freeze requests? Effective date California, Cal. Civ. Code §§ 1785.11.21785.11.6 Yes Yes. No fees for identity theft victims. Jan. 1, 2003 (subsequently amended) Colorado, Colo. Rev. Stat. § 12-14.3-102, et seq. Yes No fees for first request. No fees for identity theft victims. July 1, 2006 Connecticut, Conn. Gen. Stat. § 36a-701a Yes Yes Jan. 1, 2006 Delaware, Del. Code Ann. tit. 6, § 2201, et seq. Yes Yes Sept. 29, 2006 Florida, Fla. Stat. § 501.005 Yes Yes. No fees for identity theft victims. July 1, 2006 23 For further information, see CRS Report RL30318, The Social Security Number: Legal Developments Affecting Its Collection, Disclosure, and Confidentiality, by Kathleen S. Swendiman. 24 Mich. Comp. Laws. § 445.84. 25 Cal. Civ. Code §§ 1798.85-1798.96. 26 R.I. Gen. Laws § 6-13-17. CRS-5 Credit reporting agency fees for freeze requests? State Security Freeze Statute Applies to all consumers? Hawaii, 2006 Haw. Rev. Stat. Ann. Adv. Legis. Service 138 (LexisNexis) No. Applies only to identity theft victims. No Jan. 1, 2007 Illinois, 815 Ill. Comp. Stat. 505/2MM Yes Yes. No fees for identity theft victims or seniors 65+ years old. Jan. 1, 2007 Kansas, 2006 Kan. Sess. Laws 149 No. Applies only to identity theft victims. No Jan. 1, 2007 Kentucky, Ky. Rev. Stat. § 367, et seq. Yes Yes. No fees for identity theft victims. July 11, 2006 Louisiana, La. Rev. Ann. § 9.3571(H) to (Y) Yes Yes. No fees for identity theft victims or for seniors 62+ years old. July 1, 2005 Maine, Me. Rev. Stat. Ann. tit. 10 § 1313-C Yes Yes. No fees for identity theft victims. Feb. 1, 2006 Minnesota, Minn. Stat. § 13C.016 Yes Yes. No fees for identity theft victims. Aug. 1, 2006 Nevada, Nev. Rev. Stat. § 598C.010, et seq. Yes Yes. No fees for identity theft victims. Oct. 1, 2005 New Hampshire, § 359-B:22 et seq. Yes Yes. No fees for identity theft victims. Jan. 1, 2007 New Jersey, N.J. Rev. Stat. §§ 56:1144 - 56:11-50 Yes Yes. No fees for first request. Jan. 1, 2006 New York, N.Y. Gen. Bus. Law 380a, et seq. Yes Yes. No fees for identity theft victims. Nov. 1, 2006 North Carolina, N.C. Gen. Stat. § 75-60, et seq. Yes Yes. No fees for identity theft victims. Dec. 1, 2005 Oklahoma, Okla. Stat. tit. 24, § 149, et seq. Yes Yes. No fees for identity theft victims or seniors 65+ years old. Jan. 1, 2007 Effective date CRS-6 State Security Freeze Statute Applies to all consumers? Credit reporting agency fees for freeze requests? Effective date Pennsylvania, 2006 Pa. Legis. Serv. 163 (West) Yes Yes. No fees for identity theft victims or seniors 65+ years old. Jan. 1, 2007 Rhode Island, R.I. Gen. Laws § 6-48-1 et seq. Yes Yes. No fees for identity theft victims or seniors 65+ years old. Jan. 1, 2007 South Dakota, S.D. Codified Laws § 5415-1, et seq. No. Applies to identity theft victims only. No July 1, 2006 Texas, Tex. Bus. & Com. Code § 20.03120.039 No. Applies to identity theft victims only. Yes Sept. 1, 2003 Utah, Utah Code Ann. § 13-42-102 and 13-42-201 Yes Yes. Allows for “reasonable fees.” Sept. 1, 2008 Vermont, Vt. Stat. Ann. tit. 9, §§ 2480a2480j Yes No July 1, 2005 Washington, Wash. Rev. Code § 19.182 No. Applies to identity theft victims. No July 24, 2005 Wisconsin, Wis. Stat. § 138.25 Yes Yes. No fees for identity theft victims. Jan. 1, 2007