National Conference of State Legislatures - The Forum for America's Ideas
Issues & Research » Banking, Insurance & Financial Services » Identity Theft 2008 Introduced Legislation
Go 12534

2008 Introduced Identity Theft Legislation

Last updated: January 20, 2009

NCSL Contact:  Heather Morton, Denver, (303) 364-7700

 State:  Bill Summary:
 Arizona

H.B. 2329
Includes identity theft crimes in the definition of a dangerous crime against an incapacitated adult or vulnerable adult.

 
Substituted by H.F. 2745 4/28/08
Expands the definition of “identity theft” to include knowingly taking, purchasing, manufacturing, recording, possessing or using any personal identifying information or entity identifying information of another real or fictitious person or entity, without consent, with the intent to obtain or continue employment. Establishes that a person commits knowingly accepting the identity of another person or entity if the person, in hiring an employee, knowingly does both of the following: a) accepts any personal identifying information or entity identifying information of another person or entity from an individual and knows that the individual is not the actual person or entity identified by that information. b) uses that identity information to determine whether the individual who presented that identity information has the legal right or authorization under federal law to work in the U.S. as described and determined under IRCA. Classifies knowingly accepting the identity of another person as a class 4 felony and requires a peace officer in any jurisdiction in which an element of an offense is committed or a result of an offense occurs, or the person or entity whose identity is accepted resides or is located, to take a report. Expands the definition of trafficking in the identity of another person to include knowingly selling, transferring or transmitting any personal identifying information or entity identifying information of another real or fictitious person or entity, without consent, to allow another person to obtain or continue employment.
 California

A.B. 378
Died pursuant to Art. IV, Sec. 10(c) of the Constitution 1/31/08
Provides that a caretaker of an older or dependant adult who commits a 2nd or subsequent violation of a law proscribing theft, embezzlement, forgery, fraud, or identity theft with respect to the property of an older and dependent adult, regardless of the value of the money, labor, or real or personal property taken would be subject to punishment by imprisonment, a fine, or both. 

 

A.B. 814
Died pursuant to Art. IV, Sec. 10(c) of the Constitution 1/31/08
This bill, the Consumer Sales Security Act, requires that the Office of Privacy Protection develop an identity theft prevention program for businesses and retailers that will educate them on security methods and procedures to better protect the personal information and financial data of their customers. Makes it a felony for a person to illegally use or tamper with an electronic funds transfer device, and thereby obtain any personal identifying information or financial information. The bill states the intent of the Legislature to increase funding for law enforcement to prevent and investigate identity theft related to electronic funds transfer transactions. 

 

A.B. 1504
Died pursuant to Art. IV, Sec. 10(c) of the Constitution 1/31/08
Provides that a child may come within the jurisdiction of the juvenile court and become a dependent child of the court if the child has been a victim of identity theft, as defined, perpetrated by the parent or guardian or a member of his or her household. 

 
Vetoed by governor 9/30/08
Existing law divides insurance in California into various classes, including, among others, life, fire, marine, title, automobile, and mortgage. Under existing law, a person is prohibited from transacting any class of insurance without first procuring a certificate of authority from the Insurance Commissioner admitting the insurer for that class. This bill adds identity theft to the above list of insurance classes. The bill provides that identity theft insurance includes insurance against costs associated with reestablishing credit, reclaiming financial identity, and communicating with banks, credit agencies, and other financial institutions, as specified. The bill also sets forth related findings regarding identity theft.
 
Existing law proscribes various crimes committed against an elder or dependent adult related to physical and financial abuse when the person has knowledge that the victim is an elder or dependent adult, including causing or permitting an elder or dependent adult to suffer or inflicting thereon unjustifiable physical pain or mental suffering and violating any provision of law proscribing theft, embezzlement, forgery, fraud, or identity theft, with respect to the person or property of an elder or dependent adult. This bill requires the Department of Justice to develop an Internet Web site, to be updated regularly, which would make available to the public certain information concerning persons who have been convicted of violating at least one of specified crimes against elder or dependent adults. The bill requires a facility that release from incarceration any person from a commitment for an offense for which the person is required to be listed pursuant to these provisions to provide specified information to the department regarding the offense.
 

A.C.R. 118
Proclaims March 3 of every year as Identity Theft Awareness Day. 

 

S.B. 471
Returned to secretary of Senate pursuant to Joint Rule 56 2/4/08
Establishes requirements for a person who has been a victim of identity theft to obtain a birth or death record. 

 

S.B. 751
Returned to secretary of Senate pursuant to Joint Rule 56 2/4/08
Amends existing law which provides that the jurisdiction of a criminal action for unauthorized use of another's personal identifying information is the county where the theft occurred or where the information was illegally used. Expands that provision to specify that the jurisdiction of a criminal action also includes the county where the victim resides. 

 
Failed passage in committee 4/15/08
Existing law establishes an additional penalty for a person who violates any provision of law proscribing theft, embezzlement, forgery, fraud, or identity theft, with respect to the person or property of an elder or dependent adult. This bill applies the above penalty to knowingly engaging in exploitation of or exerting criminal undue influence upon an elder or dependent adult in order to acquire possession or control of an interest in funds or property of the elder or dependent adult. This bill would also establish a two-year penalty enhancement for each prior conviction for any person who violates the above provisions governing abuse of an elder or dependent adult in addition to the sentences set forth in those provisions. The bill revises and recasts the definitions of terms used in those provisions and makes technical changes to related provisions.
 

S.B. 1398
Requires any person who requests, in person, a certified copy of a birth or death certificate, to provide the official with valid identification, as prescribed. Requires that any person who has been the victim of identity theft who requests, in person, a certified copy of a birth or death certificate, submit a statement sworn under penalty of perjury that he or she is an authorized person and provide evidence, as prescribed, that he or she has been the victim of identify theft. 

 Colorado
Postponed indefinitely 4/10/08
Includes in the crime of identity theft, using or possessing the personal identifying information of another to deceive a peace officer. Creates the crime of criminal possession of identification documents that prohibits the possession or control of the drivers' licenses, government-issued identification cards, or passports of two or more people without permission or lawful authority. Includes criminal possession of identification documents as a predicate racketeering offense.
 Connecticut
Failed Joint Favorable deadline 4/3/08
Requires that enrollment in the Debix ID Theft Coverage be extended for two more years to the 106,000 taxpayers whose names and Social Security numbers were contained on the stolen Department of Revenue Services' laptop.
 

H.B. 5760
Requires that if a state governmental agency, person or business intentionally or negligently loses or discloses an individual's personal identifying information and such loss or disclosure results in such individual's identity being stolen, such governmental agency, person or business shall be responsible for the cost of providing not less than two years of commercially available identity theft monitoring and protection for such individual, plus all costs and fees incurred by such individual to restore such individual's identity. 

 
Passed Senate 5/6/08
Makes numerous changes in laws relating to identity theft, Social Security numbers, and restricting the dissemination of personal identifying information. Changes the criminal law by making the definition of “identity theft” broader, increases the penalty for criminal impersonation, and creates the crime of unlawful possession of personal access devices. Makes void any state- or municipal-issued credential (1) obtained by making a material false statement or (2) physically altered to misrepresent a material fact. Allows a victim of identity theft to sue for damages if the perpetrator was found guilty of trafficking in personal identifying information. Victims can already sue for damages if the perpetrator was found guilty of identity theft. The bill extends the statute of limitations for these suits from two to three years. The bill requires, rather than allows, courts to issue orders to correct public records whenever a person is convicted of identity theft. Allows perpetrators to be prosecuted in the area where the victim lives. Prohibits employers from disclosing an employee's Social Security number without the employee's written consent, with certain exceptions. Makes property gained from committing identity theft subject to forfeiture and requires proceeds from its disposition to be deposited in the Department of Consumer Protection's (DCP) Consumer Protection Enforcement Account to pay for enforcing the laws relating to the professions and trades it regulates. Requires banks and credit unions to take adequate measures to protect against identity theft when disposing of documents containing personal identifying information. Creates another definition of “personal identifying information” (an individual's Social Security number, age, or birth date) and restricts how it may be disseminated. Restricts how state agencies and political subdivisions may use an individual's personal identifying information. Creates a Privacy Protection Enforcement Account to reimburse individuals hurt by violations of the bill's provisions on the dissemination of personal identifying information. It is funded with fines imposed on those who violate them.
 
Passed Senate 4/15/08
Requires the State Insurance and Risk Management Board to insure the state against losses people incur due to identity theft resulting from the state's loss of personal identifying information. Requires the claims commissioner to hear and determine claims for these losses.
 Delaware

H.B. 117
Allows law enforcement to arrest individuals who have committed the act of identity theft while fraudulently purchasing narcotics. 

 Florida

S.B. 122
Withdrawn from consideration 3/12/08
Provides an enhanced penalty for certain fraudulent uses of personal identification information concerning an individual 65 years of age or older without first obtaining the consent of the individual. Deletes fraudulent intent as an element of certain offenses involving use, possession, or creation of personal identification information.

 Illinois
Provides that whenever a person has been arrested for or convicted of any offense, in the name of a person whose identity he has stolen or otherwise come into possession of, the aggrieved person from whom the identity was stolen or otherwise obtained without authorization, upon learning of the person having been arrested using his identity, may, upon verified petition to the chief judge of the circuit wherein the arrest was made, have a court order entered nunc pro tunc by the chief judge to correct the arrest record, conviction record, if any, and all official records of the arresting authority, the Department, other criminal justice agencies, the prosecutor, and the trial court concerning such arrest, if any, by removing his name from all such records in connection with the arrest and conviction, if any, and by inserting in the records the name of the offender, if known or ascertainable, in lieu of the aggrieved's name.
 
To concurrence 5/23/08
Amends the Illinois Insurance Code. Requires the Department of Financial and Professional Regulation to develop an appropriate consumer fact sheet to be provided to consumers, either via the Department's website or by hard copy if requested, regarding identity theft insurance. Provides that the fact sheet shall include at a minimum, information on what is generally covered under identity theft insurance and on how to protect himself or herself from identity theft.
 Iowa

H.F. 2610
H.S.B. 717
Became H.F. 2610 3/13/08
Amends Code §715A.8(2), which creates the crime of identity theft, to include the elements of attempting to fraudulently use the identification information of a fictitious person to contract for various benefits, including to obtain employment. Amends Code §715A.8(3) to include employment and other benefits as value derived from committing identity theft and to provide that if identity theft is committed but no value can be determined, the person commits an aggravated misdemeanor, which is punishable by confinement for no more than two years and a fine of at least $625 but not more than $6,250. Amends Code §715A.9 to include employment and other benefits for determining the value derived from committing identity theft. 

 

S.F. 2287
Provides that if a person violates a provision of Code chapter 144 relating to the issuance of vital records, and that violation constitutes identity theft pursuant to Code §715A.8, the person shall, in addition to any penalties otherwise imposed, be subject to the penalty provisions for identity theft violations. Specifically, an identity theft violation where the value of credit, property, or services involved exceeds $1,000 is a class "D" felony; a violation where the value of credit, property, or services involved does not exceed $1,000 is an aggravated misdemeanor; and in both instances violations are considered an unlawful practice under Code §714.16. That Code section contains provisions including a civil penalty of up to $40,000 per violation. 

 Kansas

H.B. 2836
Creates the crime of employment identity fraud, if false or misleading identification documents are presented to an employer in order to obtain employment. The crime would be a severity level 8, non-person felony. 

 

H.B. 2921
Provides that if the identification documents obtained or supplied are used for the purpose of obtaining employment, or if the possessor of such documents is an illegal alien, then identity fraud is a severity level 5, nonperson felony. 

 

S.B. 458
Passed Senate 3/27/08
Creates the crime of employment identity fraud which is willfully presenting to an employer false or misleading identification documents for the purpose of obtaining employment. The penalty is a severity level 8, nonperson felony. 

 

S.B. 644
Allows a consumer who has been the victim of identity theft, or the suspected victim of identity theft, to contact the local law enforcement agency with jurisdiction over the complainant. Requires the local law enforcement to take a police report of the incident and provide a copy of such report to the complainant. If the law enforcement agency lacks jurisdiction over the complainant, it shall make the appropriate procedural steps to record the complaint and refer it to the proper jurisdiction. 

 Kentucky

H.B. 95
Amend KRS 514.160 to include with the offense of identity theft the theft of identity by an unauthorized alien for the purpose of obtaining employment.

 

H.B. 304
Repeals, reenacts, and amends KRS 514.160 relating to identity theft to increase the number of pieces of identifying information, include use of false identification to deprive a person of money, obtain employment, hide one's true identity, cause another person to suffer economic loss, defraud another person, or attempt, solicit, or conspire to commit identity theft.

 

H.B. 553
Passed House 3/18/08
Creates new sections of KRS Chapter 367 to create definitions related to identity theft; restricts certain uses by businesses of a consumer's Social Security number subject to certain exceptions, to delay the effective date to July 1, 2009, and to make a violation subject to the same remedies, duties, powers, and penalties as violations of the Consumer Protection Act; requires a business to give specified notice to a person whose personal information was acquired in a security breach subject to certain exceptions, to make a waiver void and unenforceable, and to declare that a violation is subject to the same remedies, duties, powers, and penalties as violations of the Consumer Protection Act; requires a business to take certain measures to safeguard against security breaches subject to certain exceptions and to declare that a violation is subject to the same remedies, duties, powers, and penalties as violations of the Consumer Protection Act; declares that the provisions regarding business use of Social Security numbers, security breach notices, and safeguarding against security breaches do not limit the power to enforce criminal or civil statutes or the right to bring civil actions, and to provide venue for civil actions brought by the attorney general regarding violations; creates a new section of KRS Chapter 411 to establish an expedited Circuit Court procedure for a person whose identity or personal information has been used without consent in the commission of a criminal offense to get a determination that he or she is a victim of identity theft, and to require that the court filing fee be the same as for filing a small claims case; creates a new section of KRS Chapter 431 to establish an expedited procedure allowing a person who has been charged with a crime because another person used his or her identifying information, and who has been found not guilty or the charges have been dismissed, to make a motion to the Court to redact his or her identifying information from certain records and to establish a procedure restricting access and inspection of those records; creates a new section of KRS Chapter 17 to require a law enforcement agency to take a complaint and provide a copy of the police report to a complainant who has learned or reasonably suspects that his or her identity or personal information has been used without consent in the commission of a criminal offense; creates a new section of KRS Chapter 434 to create definitions and establish a Class D felony offense for "phishing"; create a new section of KRS Chapter 411 to provide a civil cause of action against a person who "phishes," to allow injunctive relief, damages up to the greater of actual damages or $25,000 for each violation, treble damages in certain circumstances, and reasonable attorney's fees and court costs to a prevailing plaintiff, to subject violations to the remedies, powers, and duties of the Consumer Protection Act, and to establish a statute of limitations; amends KRS 365.720 and 365.725 to conform; amends KRS 15.334 to require law enforcement basic training regarding identity theft; amends KRS 411.210 to extend the civil cause of action for victims of certain identity-theft-related crimes to persons whose identity or personal information has been used without consent in the commission of a criminal offense, and to extend the statute of limitations to the later of five years or the date of discovery of the violation or the identity of the perpetrator of the violation; amends KRS 514.160 to provide that the crime of theft of identity applies to use of a live or deceased person’s identity, to increase the types of identifying information protected, to avoid criminal prosecution to the prohibited uses of another's identity, and to delete the exclusion of credit or debit card fraud crimes; amends KRS 525.080 to provide that the crime of harassing communications applies whether the perpetrator is using the perpetrator's own or another person's identity and to expand the offense to include harassment through electronic communication.

 

S.B. 102
Amends KRS 514.160, relating to theft of identity, to add avoiding criminal prosecution as an element of the offense.

 Louisiana
Requires adults and juveniles who are convicted of identity theft to: (1) Register with local law enforcement within 21 days of residing in the state or after conviction or release from confinement and pay a fee of $60. (2) Reregister if absent from their last address for more than 30 days. (3) If adults, notify the management of emergency shelters of their offender status within 24 hours. (4) If adults, give notice to certain residences and businesses within a certain area, publish notice in the official journal of the parish with a photograph, and give any other notice deemed appropriate by the courts including signs, handbills, bumper stickers, or clothing labeling. (5) Give notice to the Louisiana Bureau of Criminal Identification and Information of the postsecondary institution where the person is a student or a worker within five days. (6) If adult, give notice to within 10 days to local law enforcement of a change of address, temporary displacement, or temporary residence following the issuance of an evacuation order or declaration of emergency. Requires an annual update of registration for 10 years after conviction for a first offense and life for subsequent convictions. Imposes a penalty for first conviction for "failure to register" of a fine of not more than $1,500 and imprisonment with hard labor for not less than one year nor more than five years without benefit of parole, probation, or suspension of sentence; upon second or subsequent convictions a fine of $2,500 and imprisonment with hard labor for not less than three years nor more than 15 years without benefit of parole, probation, or suspension of sentence.
 
To conference committee 6/18/08
Requires adults and juveniles who are convicted of identity theft to: 1) Register with local law enforcement within 21 days of residing in the state or after conviction or release from confinement and pay a fee of $60. 2) Re-register if absent from their last address for more than 30 days. 3) If adults, notify the management of emergency shelters of their offender status within 24 hours. 4) If adults, give notice to certain residences and businesses within a certain area, publish notice in the official journal of the parish with a photograph, and give any other notice deemed appropriate by the courts including signs, handbills, bumper stickers, or clothing labeling. 5) Give notice to the Louisiana Bureau of Criminal Identification and Information of the post-secondary institution where the person is a student or a worker within five days. 6) If adult, give notice to within 10 days to local law enforcement of a change of address, temporary displacement, or temporary residence following the issuance of an evacuation order or declaration of emergency. Requires an annual update of registration for 10 years after conviction for a first offense, for life for subsequent convictions. Imposes a penalty for first conviction for "failure to register" of a fine of not more than $1,000 and imprisonment with hard labor for not less than two years nor more than 10 years without benefit of parole, probation, or suspension of sentence; a fine of $3,000 and imprisonment with hard labor for not less than five years nor more than 20 years without benefit of parole, probation, or suspension of sentence.
 Maryland
Prohibits a person from committing specified offenses, including identity fraud, against a person who is at least a specified age or a person with a specified disability; establishes a penalty; provides that a conviction under the Act does not merge with a conviction for an underlying offense; and provides that a sentence imposed for a violation of the Act is to be consecutive to and not concurrent with any other sentence imposed for other crimes.
 

H.B. 1096
S.B. 972
Withdrawn 3/24/08
Establishes that specified property that is used or intended for use in connection with a violation of the Identity Fraud law is subject to seizure and forfeiture; establishes conditions that would exclude specified property from forfeiture; establishes how specified property subject to forfeiture may be seized, with specified exceptions; establishes a deadline for filing a complaint seeking forfeiture; provides for the contents and distribution of a complaint.

  

H.B. 1107
S.B. 327
Passed Senate 3/14/08
Provides that specified personal and business documents are admissible as evidence and presumed to be authentic if the account holder testifies as to their authenticity in any judicial or administrative proceeding; and authorizes, in a criminal case or juvenile proceeding involving identity fraud, the introduction of the affidavit of a lawful credit cardholder as substantive evidence that the credit card or credit card number of the credit cardholder was taken, used, or possessed without authorization.

  
Prohibits a person from knowingly and willfully removing, taking, possessing, obtaining, or receiving mail under specified circumstances without the permission of the United States Postal Service or the intended recipient; provides penalties for a violation of the Act; repeals a provision that prohibits opening a letter without permission, that is rendered inconsistent with the Act.
  

S.B. 846
Passed Senate 3/27/08
Establishes seizure and forfeiture procedures for property obtained through or used in connection with identity fraud; establishes conditions that would exclude specified property from forfeiture; establishes how specified property subject to forfeiture may be seized, with specified exceptions; establishes circumstances that must be considered when determining whether to seize specified property; establishes a specified deadline for filing a complaint seeking forfeiture.

 Massachusetts

H.B. 211
Relates to identity fraud. 

 

H.B. 265
Authorizes identity theft victims to report identity theft to local law enforcement. 

 

H.B. 328
Substituted by H.B. 4930 7/1/08

Relates to identity theft protection; amends penalties relating to identity fraud. 

 

H.B. 333
Relates to identity theft in the commonwealth; authorizes identity theft victims to report identity theft to local law enforcement; creates a division of privacy protection; regulates the use of Social Security numbers. 

 

H.B. 1392
Relates to identity theft. 

 

H.B. 1521
Relates to identity theft; includes pretexting in the crime of identity fraud. 

 

H.B. 1571
Relates to the crime of identity fraud. 

 
H.B. 4930
Relates to identity theft protection; amends provisions regarding encrypted information, the likelihood of fraud, personal information, inconvenience to any resident and terms related to unauthorized acquisition or use of personal information.
 

S.B. 161
Regards public safety and identity theft; creates a commission to study and publish findings and information concerning the incidence of identity theft. 

 

S.B. 163
Regards public safety and policing practices to prevent identity theft; creates a commission to study and publish findings and information concerning the incidence of identity theft. 

 

S.B. 180
Relates to the crime of identity fraud. 

 

S.B. 233
Protects victims of identity theft. 

 

S.B. 243
Relates to identity theft jurisdiction. 

 Michigan
Passed House 9/10/08
Under the Michigan Penal Code, "racketeering" means committing, attempting to commit, conspiring to commit, or aiding or abetting, soliciting, coercing, or intimidating a person to commit, for financial gain, an offense listed in the definition. The bill amends the code (MCL 750.159g) to include a felony violation of the Identity Theft Protection Act and a violation of Section 145d of the penal code as a predicate offense in the code's definition of racketeering.
 
Passed House 9/10/08
Adds several new sections to the Identity Theft Protection Act (MCL 445.74 et al.) to identify property subject to forfeiture, establish forfeiture procedures, authorize the seizing agency to retain or sell seized property, and require a seizing agency to submit a summary report annually to the attorney general for forwarding to the legislature regarding forfeiture of property. The provisions are similar to those in the Public Health Code regarding the seizure and forfeiture of property related to crimes involving controlled substances.
 
Passed House 11/13/08
Specifies in the Code of Criminal Procedure that a bona fide victim of identity theft is entitled to file a police report with a law enforcement agency in a jurisdiction where the alleged violation may be prosecuted and requires the Department of State Police to develop a model form of police report of identity theft and make it available to law enforcement agencies and victims of identity theft.
 
Passed House 6/24/08
Provides that if the victim is the victim of identity theft as that term is defined, then the court shall order restitution to compensate the victim in full for the work done by the victim or the victim's attorney, or both, to rectify the victim's financial records and vital records and to ameliorate the effects of the identity theft on the victim's financial affairs, including, but not limited to, credit history, credit rating, or credit score.
 
Passed House 6/24/08
Provides for enhanced restitution for victims of identity theft.
 
Passed House 6/24/08
Adds Section 11a to the Identity Theft Protection Act to allow a victim of identity theft to file a civil action for damages and recover all of the following: actual damages, reasonable attorney fees, and court costs; reimbursement for notifying third parties of the identity theft, reporting identity theft to law enforcement, and correcting personal identifying information or providing other information to third parties required because of the identity theft; and restitution, in an amount that compensates the victim in full for the work done by the victim or the victim's attorney, or both, to correct financial records and vital records and to ameliorate the effects of the identity theft on the victim's financial affairs, including credit history, credit rating, or credit score. For purposes of the above provision, a person who failed to comply with the prohibitions listed in Sections 5 or 7 of the act while acting in good faith would not be in violation of that section if the compliance failure had not been intentional and resulted from a bona fide error despite the maintenance of procedures reasonably adapted to avoid those errors, and appropriate restitution was made to the victim. A "bona fide error" would include, but not be limited to, a computer malfunction or a clerical, calculation, computer programming, or printing error. An error of legal judgment with respect to a person's obligations under this section would not be a bona fide error.
 
Passed House 6/24/08
Amends the William Van Regenmorter Crime Victim Rights Act (MCL 780.754 et al.). The bill includes a reference to Sections 11 and 13 of the Identity Theft Protection Act in a provision pertaining to the right of victims of ID theft to file a police report and obtain a copy of that report.
 
Passed House 6/24/08
Amends Section 5 of the Identity Theft and Protection Act (MCL 445.65) to make it an offense to use or attempt to use the personal identifying information of another person to engage in criminal activity or other violations of law or to mislead a law enforcement agency or court concerning the identity of an individual under criminal investigation or a criminal defendant.
 
Passed House 6/24/08
Adds Section 12c to the Identity Theft and Protection Act to require, within 30 days after the bill's effective date, each "qualified person" (certain financial institutions, as described later) to establish a written identity theft prevention program that met all of the following: A) Included reasonable policies and procedures for detecting, preventing, and mitigating identity theft. B) Identified, and detected, specific activities that indicated the possible existence of identity theft and addressed those activities in the program. C) Responded to the activities described above in order to mitigate the adverse effects of identity theft. D) Trained staff to effectively implement the program. E) Ensured that the program was periodically reviewed to identify, detect, and respond to new and emerging practices that increased the risk of identity theft. A "qualified person" means a person that has more than 50 employees and who was engaged in extending credit in the form of covered accounts to state residents. A "covered account" means that term as defined in federal rules for financial institutions and creditors found at 16 CFR 681.2. Generally speaking, these are consumer accounts at financial institutions for personal, family, or household purposes. Further, a qualified person that is subject to and complies with the joint final rules and guidelines concerning identity theft red flags and address discrepancies under the federal Fair and Accurate Credit Transactions Act would not be required to establish a written identity theft prevention program as described above.
 
Passed House 6/24/08
Adds Section 12d to the Identity Theft and Protection Act to specify that a person who knowingly violated Section 12c regarding the written identity theft prevention program could be ordered to pay a civil fine of not more than $250 for each violation. The attorney general or a prosecuting attorney could bring an action to recover a civil fine under this provision. The provision would not affect the availability of any civil remedy for a violation of state or federal law.
 
Passed House 11/13/08
Adds Section 14 to the Identity Theft and Protection Act to establish a nine-member Identity Theft Protection Commission in the Department of Information Technology (DIT). The director of DIT, or a designee, would serve as chair. Other members would be the attorney general (or a designee), director of the Department of State Police (or a designee), the commissioner of the Office of Financial and Insurance Regulation (or a designee), the state treasurer (or a designee), three members of the general public, and a representative of the business committee who was appointed by the governor for a two-year term. The three public members would be appointed to two-year terms, one each by the governor, the Speaker of the House of Representatives, and the Majority Leader of the Senate. Among other functions, the new commission would, by September 30, 2010: review and provide recommendations to the governor about state rules, guidelines, and procedures related to identity theft protection and prevention; review and provide recommendations about legislation to the legislature; provide recommendations to the public about business practices; provide recommendations to state agencies and departments on reducing the use of Social Security numbers; make recommendations to DIT concerning the design and content of the Identity Theft Information Website; and establish a process for recognizing those with exemplary business practices in identity theft protection and prevention. DIT would have to establish and maintain an identity theft information Web site. The department would have to consider the commission's recommendations in selecting the design and content of the Web site.
 

S.B. 945
Passed Senate 3/19/08
Prohibits communicating under false pretenses to request personal identifying information, creating or operating an unauthorized webpage to solicit personal identifying information, or altering a computer or software setting to solicit personal identifying information, with the intent to commit identity theft or another crime; and prohibit the same activities without the element of intent. Prescribes a penalty of up to 10 years' imprisonment and/or a fine of not less than $5,000 or more than $500,000, rather than up to five years and/or a maximum fine of $25,000, for violations of current identity theft prohibitions; and extend the penalty to violations of the bill committed with intent to commit identify theft or another crime. Allows the attorney general, or an interactive computer service provider, to bring a civil action against a person who violated the proposed prohibition that would not include the element of intent. Exempt a law enforcement officer engaged in his or her official duties, or any other investigator engaged in a lawful investigation, from the proposed prohibition that would not include intent to commit identity theft or another crime. Exempts an interactive computer service provider from liability under the Act for certain actions. Expands the definition of "personal identifying information" to include any account password in combination with sufficient information to identify and gain access to a person's financial account, and a person's automated or electronic signature or biometrics.

 

S.B. 1191
Passed Senate 3/19/08
Amends the Code of Criminal Procedure to revise the sentencing guidelines classification of certain identity theft violations. Currently, a violation of Section 7 of the Identity Theft Protection Act (which provides for the criminal offense described in Senate Bill 945 (S-1)) is a Class E felony against the public order, with a statutory maximum sentence of five years' imprisonment. Under the bill, the offense would be a Class D felony against the public order, with a statutory maximum sentence of 10 years' imprisonment.

 Minnesota

H.F. 3294
S.F. 2931
Expands identity theft crime to include using another's identity to obtain employment; provides a criminal penalty.

 Mississippi

H.B. 252
Died in Senate committee 3/18/08
Establishes a procedure for a victim of identity theft to have the debt forgiven and credit reports purged.

 
Died in Senate committee 3/18/08
Revises the subject matter jurisdiction of state grand jury to include identity theft.
 

S.B. 3017
Died on calendar 2/28/08
Establishes a procedure for a victim of identity theft to have the debt forgiven and credit reports purged.

 
Died in committee 2/19/08
Proposes an amendment to §26, Mississippi Constitution of 1890, to expand the jurisdiction of state grand juries to include identity theft.
 Missouri 

H.B. 1746
This bill defines "breach of security of the system," "personal information," "proper identification," "security alert," and "security freeze." Any person or company that conducts business in Missouri and owns or licenses computerized data which includes personal information is required to disclose a breach of security to any resident whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Notification must be made within 30 days of the discovery of the breach and may be given by written or electronic notice. Substitute notice may be given if the cost of providing notice would exceed $250,000. Violation of this requirement will be a class A misdemeanor. A consumer is allowed to place a security alert or freeze on his or her credit report. Once a security alert has been placed on a report, a consumer credit reporting agency will notify each person requesting consumer credit information of the alert. If a security freeze is in place, information from a consumer's credit report may not be released to a third party without prior express authorization from the consumer, and a consumer credit reporting agency will not change any of the identification information in a report without sending a written confirmation of the change to the consumer. A consumer credit reporting agency must disclose in writing to the consumer a summary of his or her rights under Missouri law. Any person violating the requirements of the bill may be liable for any actual damages sustained by the consumer as a result of his or her negligence and the costs and attorney fees associated with any lawsuit. Any person convicted of the crime of identity theft which resulted in the theft of credit, money, goods, services, or other property of less than $500 from a disabled or elderly person will be guilty of a class D felony. If the theft of credit, money, goods, services, or other property was more than $500 but not exceeding $5,000 and the victim is a disabled or elderly person, it will be a class B felony.

 

H.B. 2157
Passed House 4/2/08
Allows any person who has learned or reasonably suspects that he or she has been the victim of identity theft to file and receive a copy of a police report with the local law enforcement agency that has jurisdiction over his or her residence. If the jurisdiction for the investigation and prosecution of the crime lies elsewhere, the local law enforcement agency may refer the complaint to an enforcement agency in that jurisdiction.

 New Hampshire

H.B. 269
Inexpedient to legislate 1/2/08

Makes "pretexting," the act of using a ruse to obtain personally identifiable information about another individual, a violation, subject to a fine, and establishes a private cause of action for those injured by pretexting. 

 

H.B. 1531
Establishes a cause of action for identity theft.

 New Jersey
Establishes a procedure whereby a victim of identity theft can obtain a factual determination of innocence. Under the provisions of the bill, if a person reasonably believes that he is a victim of identity theft that person, or the court on its motion or upon application by the prosecuting attorney, may move for an expedited judicial determination of factual innocence if a defendant has been arrested for, charged with or convicted of a crime under the victims identity or where a criminal complaint has been filed against a defendant in the victim's name or if the victim's identity has been mistakenly associated with a record of criminal conviction. If the court determines that the petition or motion is meritorious and that the victim has not committed the offense, the court is to issue a judicial determination of factual innocence. After an order has been issued, the court may order that the name and personal identifying information of the victim contained in court records, files and indexes be deleted, sealed or labeled to show that the data is impersonated and does not reflect the victim’s identity. The bill also requires the Administrative Office of the Courts (AOC) to establish and maintain a database of persons who have been victims of identity theft and who have received determinations of factual innocence. Access to the database is to be limited to criminal justice agencies, victims of identity theft and any other persons and agencies authorized by a victim. The AOC also is directed to establish a toll free number to provide access information to victims of identity theft.
 

A.B. 1896
Withdrawn from further consideration 9/22/08

Amends and supplements the recently enacted "Identity theft Prevention Act," P.L.2005, c.226 to specifically provide for victims of identity theft with an "identity theft verification passport." The identity theft verification passport provides victims with an additional method of demonstrating to law enforcement, creditors and other entities that they have been victims of identity theft. It also provides these entities with another tool which they may use in determining whether fraudulent charges have been made. This bill provides that once the report is filed, the victim may apply for an identity theft verification passport with the local law enforcement agency. Under the provisions of the bill, the local law enforcement agency is required to send a copy of the police report with the victim’s application to the attorney general for issuance of an identity theft verification passport. The attorney general processes the application and the supporting police report and issues the victim an identity theft verification passport in the form of a card or certificate. The victim may present the identity theft verification passport to any law enforcement agency to assist them in their investigation into whether false charges were made against the victim for an offense committed by a person other than the victim, who is using the victim’s identity. The victim may also present the passport to any creditor to assist the creditor in its investigation into whether fraudulent charges were made against accounts in the victim’s name or whether accounts were opened using the victim’s identity. In addition, the victim may present the passport to any other entity in order to assist in that entity’s investigation of whether the victim’s identity was fraudulently obtained or used without the victim’s consent. Acceptance of the identity theft verification passport presented by the victim to a law enforcement agency, creditor or other entity is at the discretion of the law enforcement agency, creditor or entity. A law enforcement agency, creditor or entity may consider the identity theft verification passport and surrounding circumstances and available information concerning the offense pertaining to the victim in determining whether to accept the identity theft verification passport. In addition, this bill requires the attorney general to maintain statistics concerning the number of applications submitted and the number of identity theft verification passports issued. The attorney general would be required to submit is report to the governor and the Legislature.

 

A.B. 1997
Provides for expungement of records in cases where a victim of an identity theft was mistakenly accused of an offense. Under the provisions of the bill, a victim of an identity theft can make an application to the court for expungement of any records relating to the victim's charge or conviction, provided that the victim was charged or convicted of an offense or a motor vehicle violation as a result of another person using the victim's personal identifying information to commit an offense or violation and that the charge or conviction was dismissed or set aside. The bill provides that the application should include documents and information to support the victim's application. After an expungement is granted, the court would forward a copy of the expungement order to the appropriate agency. Upon receipt of the order, the agency would be required to expunge the pertinent records. The bill provides that the victim would not be charged a fee for the expungement. The bill amends N.J.S.A.2C:52-28, which provides that the expungement provisions in the statute do not apply to arrests or convictions for motor vehicle violations, to make a limited exception for victims of identity theft. In addition, the bill requires an insurance company to refund those additional premiums charged to a policyholder who was a victim of identity theft upon notification of the expungement. The bill also requires the director of the Division of Motor Vehicles to provide the person whose motor vehicle record was expunged with a certified corrected driver history. The director would also be required to reinstate any drivers license suspended or revoked as a result of the charge or conviction which was later expunged.

 
Creates the separate crime of fiscal victimization of a senior citizen or a person with a disability. Under the provisions of the bill a person would be guilty of fiscal victimization if he commits, attempts to commit, conspires with another to commit or threatens to commit a theft offense specified in chapter 20 of Title 2C of the New Jersey Statutes or a violation of N.J.S.2C:21-17, identity theft, against a senior citizen or a person with a disability. Fiscal victimization is a crime of the fourth degree if the underlying offense is a disorderly persons offense or petty disorderly persons offense. Otherwise, fiscal victimization is a crime one degree higher than the most serious underlying crime, except if the underlying crime is a crime of the first degree. Under those circumstances, fiscal victimization would be a first degree crime and upon conviction the defendant could be sentenced to an ordinary term of imprisonment between 10 years and 30 years, with a presumptive term of 20 years, notwithstanding the provisions of N.J.S.A.2C:43-6. The bill also provides a conviction of fiscal victimization would not merge with a conviction of any of the underlying offenses, nor would any conviction for the underlying offense merge with a conviction for fiscal victimization. Therefore, the court would be authorized to impose separate sentences upon a conviction for fiscal victimization and a conviction of any underlying offense. In addition, the bill provides that if the victim of the underlying offense is a senior citizen or a person with a disability, the actor would be strictly liable for the victimization offense. It would not be a defense that the actor did not know that the victim was a senior citizen or a person with a disability, nor would it be defense that the actor believed that the victim was not a senior citizen or a person with a disability, even if the mistaken belief was reasonable. The bill defines a "senior citizen" as a person 60 years of age or older. "Person with a disability" is defined as a person who by reason of a pre-existing medically determinable physical or mental impairment is substantially incapable of exercising normal physical or mental power of resistance, and includes, but is not limited to, a person determined disabled pursuant to the federal Social Security Act or any other governmental retirement or benefits program that uses substantially the same criteria for determining eligibility.
 
Passed Assembly 3/13/08
Requires the attorney general to promulgate guidelines setting forth mandatory procedures to be followed by local police departments to enhance their ability to positively identify suspects before they are released. The purpose of the guidelines is to address the growing problem of "criminal identity theft." Criminal identity theft occurs when a criminal suspect provides a law enforcement officer during an investigation or arrest with another person’s name and personal information, such as a driver’s license, whether valid or counterfeit, birth date, or Social Security number. The suspect is released, but the law enforcement agency has the victim's information, not the suspect's. As a result, unsuspecting victims whose information has been stolen may be arrested, have their driver's license suspended, or be denied a professional license or employment based on a criminal history records they didn’t know they had.
 

A.B. 2450
Addresses the security of personal information, such as Social Security numbers, driver’s license numbers, or financial account numbers, by businesses and public entities. It enhances the duty of a business or public entity to secure such information and respond to a breach of security, and broadens liability for violating this duty. First, the bill requires any business or public entity, when compiling or maintaining computerized records that include personal information, to secure the information by encryption or by any other method or technology rendering it unreadable, undecipherable, or otherwise unusable by an unauthorized person through generally available means. This requirement applies to any computer, including a desktop computer or laptop computer, computer equipment, computer network, or computer system, as defined by the bill. Compliance with this requirement shall require more than the use of a password protection computer program, if that program only prevents general unauthorized access to personal information, but does not render the information itself unreadable, undecipherable, or otherwise unusable by an unauthorized person operating, altering, deleting, or bypassing the password protection program. Second, the bill expands the definition of "breach of security" to include unauthorized access to any computerized records containing personal information, or unauthorized physical custody of such computerized records, whether or not accessed. The current law addresses a security breach more narrowly as only being an unauthorized access of personal information. By expanding this definition, the bill broadens the scope of situations in which a business or public entity shall take affirmative steps to notify and protect individuals concerning a breach, such as the physical theft of a computer or other computer device. Third, in the event that a business or public entity discovers circumstances of a breach of security, requiring notice to more than 1,000 individuals, the business or public entity shall also contract with one or more consumer reporting agencies, as defined by federal law, to provide each individual with at least five years of consumer credit monitoring and reporting. The business or public entity shall contract for the services at no cost to any individual, and shall not pass through the contracting cost to any individual as a charge, tax, or in any other manner. Fourth, the bill broadens the liability standard for establishing violations by a business or public entity. Since the existing law protecting personal information adopts the remedies available for violations of the consumer fraud act, P.L.1960, s.39 (C.56:8-1 et seq.), violators are already subject to the wide range of enforcement provisions available under that act, including: civil penalties of not more than $10,000 for a first offense or not more than $20,000 for any subsequent offense; treble damage awards; and attorneys fees and costs of suit. However, these do not apply unless the violation occurred willfully, knowingly, or recklessly. The bill broadens the range of legal liability to which these penalty provisions apply by encompassing violations based upon the negligence of the business or public entity. Finally, the bill establishes a nonlapsing, special fund within the General Fund, known as the Identity Theft Education Fund. The State Treasurer shall credit to the fund all civil penalties collected from violators pursuant to section 1 of P.L.1966, c.39 (C.56:8-13) of the consumer fraud act. The director of the Division of Consumer Affairs, in the Department of Law and Public Safety, may draw upon this fund to produce materials and provide educational seminars for the public, addressing issues regarding identity theft.

 
Establishes the “New Jersey Fair Debt Collection Practices Act.” Generally, the bill eliminates abusive practices in the collection of consumer debts, promotes fair debt collection and provides consumers with an avenue for disputing and obtaining validation of debt information in order to ensure that information's accuracy. The bill creates guidelines under which debt collectors may conduct business, defines rights of consumers involved with debt collectors, and prescribes penalties and remedies for violations of the bill. Requires a debt collector to stop all collection activities upon receipt from a debtor of the debtor's written statement that the debtor claims to be the victim of identity theft with respect to the specific debt being collected by the debt collector, consisting of either: the Federal Trade Commission's standardized ID Theft Affidavit, or a written statement that certifies that the representations are true, correct, and contain no material omissions of fact to the best knowledge and belief of the debtor.
 

S.B. 2173

Establishes a procedure whereby a victim of identity theft could obtain a factual determination of innocence. Under the provisions of the bill, if a person reasonably believes that he is a victim of identity theft that person, or the court on its motion or upon application by the prosecuting attorney, may move for an expedited judicial determination of his factual innocence if a defendant has been arrested for, charged with or convicted of a crime under the victims identity or where a criminal complaint has been filed against a defendant in the victim's name or if the victim's identity has been mistakenly associated with a record of criminal conviction. If the court determines that the petition or motion is meritorious and that the victim has not committed the offense, the court shall issue a judicial determination of factual innocence. After an order has been issued, the court may order that the name and personal identifying information of the victim contained in court records, files and indexes be deleted, sealed or labeled to show that the data is impersonated and does not reflect the defendant's identity. This bill also requires the Administrative Office of the Courts (AOC) to establish and maintain a database of persons who have been victims of identity theft and who have received determinations of factual innocence. Access to the database would be limited to criminal justice agencies, victims of identity theft and any other persons and agencies authorized by the victims. The AOC would also be required to establish a toll free number to provide access information to victims of identity theft.
 
Requires restitution by offenders in identity theft cases. Under current law, courts have discretion in whether or not to order restitution in cases of identity theft. This bill would require courts to order identity theft offenders to pay restitution of costs, including reasonable attorney’s fees and other litigation costs incurred by victims in clearing their credit or in connection with certain proceedings arising as a result of the thefts. The bill also includes debit card numbers in the definition of “personal identifying information” for the purposes of the statutes dealing with theft.
 New York

A.B. 2884
S.B. 2397
Passed Senate 2/5/08
Provides that insurers may underwrite and sell group identity theft insurance policies. 

 
A.B. 8348
S.B. 5795
Passed Senate 5/19/08
Creates the crime of unlawful possession of a skimmer device for gathering the personal identification information of another person; upgrades the degree of crimes of identity theft.
 

A.B. 9926
S.B. 2090
Increases the penalties for identity theft crimes. 

 
A.B. 11151
S.B. 7893
Passed Senate 6/23/08
Establishes the identity theft prevention and mitigation unit under the jurisdiction of the consumer protection board; outlines powers and duties of such unit; further establishes the New York state task force on identity security.
 
A.B. 11344
Establishes the crime of attempted identity theft, a class A misdemeanor and attempted identity theft of a senior citizen, a class E felony.
 
A.B. 11349
Relates to identity theft; creates certain new offenses related to identity theft and unlawful possession of personal identification information.
 
A.B. 11843
Establishes the small business crime prevention services to provide small businesses with information on strategies, best practices and programs offering training and assistance in prevention of crimes in and around the premises of small businesses or otherwise affecting small businesses, including but not limited to: assault, arson and other violent felony offenses; robbery, burglary, theft, identity theft and fraud; and vandalism, graffiti and other property damage; further provides that information on eligibility and applications for financial assistance be made available to small businesses; authorizes the New York State Urban Development Corporation to provide loans, loan guarantees, interest subsidies and grants to small businesses, municipalities, not-for-profit corporations or other organizations for the purpose of preventing crimes against small businesses or on the premises or in the vicinity of small businesses; makes related provisions.
 
S.B. 1651
Passed Senate 6/5/08
Relates to the crimes identify theft and unlawful possession of personal identification information; changes identity theft in the first degree to a class C felony; broadens the definition of unlawful possession of personal identification information in the first degree.
 
S.B. 4721
Passed Senate 5/28/08
Relates to identity theft and unlawful possession of personal identification information.
 
S.B. 7253
Adds medical and health insurance information within the definitions of identity theft.
 
S.B. 7613
Relates to creating identity theft in the fourth degree.
 
S.B. 8677
Requires credit reporting agencies to furnish proof of identity theft to creditors upon debtor's request.
 North Carolina
Creates the North Carolina Citizen Protection Act. Expands the definition of identity theft to include obtaining, possessing, or using identifying information about another person with the intent to fraudulently obtain employment.
 Oklahoma

H.B. 2541
Relates to identity theft; modifies penalties; providing for revocation or acceleration of sentence for willful nonpayment of restitution. 

 

H.B. 3088
Creates the Oklahoma Identity Theft Protection Act of 2008. 

 Rhode Island

H.B. 7257
Mandates the specific penalties imposed for conviction of impersonation and identity fraud. A first conviction is imprisonment for not more than three years and a fine of not more than $5,000. A second conviction would require the person would be imprisoned for not more than three years nor more than five years and would be fined not more than $10,000.

 
Passed Senate 6/17/08
Mandates judges to impose specific sentences for a second conviction for impersonation or identity fraud.
 Utah

H.B. 95
Enacting clause struck 3/5/08
Creates a Document Fraud-Identity Theft Unit within the Office of the Attorney General to investigate, apprehend, and prosecute individuals and entities involved with identity theft or identity fraud.

 Virginia
Increases from $200 to $500 the threshold amount of money or the value of the goods or chattel that the defendant must take before the crime rises from petit larceny to grand larceny. Includes identity theft.
 Washington

H.B. 1272
Changes identity theft provisions; enacts this act to expressly reject the interpretation of State v. Leyda, 157 Wn.2d 335, 138P.3d 610 (2006), which holds that the unit of prosecution in identity theft is any one act of either knowingly obtaining, possessing, using, or transferring a single piece of another's identification or financial information, including all subsequent proscribed conduct with that single piece of identification. 

 

H.B. 2636
Passed House 2/7/08
S.B. 6670
Allows a person who has learned or reasonably suspects that his or her financial information or means of identification has been unlawfully obtained, used by, or disclosed to another, as described in chapter 9.35 RCW, to file an incident report with a law enforcement agency, by contacting the local law enforcement agency that has jurisdiction over his or her actual residence, place of business, or place where the crime occurred. Requires the law enforcement agency to create a police incident report of the matter and provide the complainant with a copy of that report, and may refer the incident report to another law enforcement agency.

 

H.B. 2638
S.B. 6672
Provides that a person is guilty of identity theft in the second degree when he or she violates RCW 9.35.020(1) under circumstances not amounting to identity theft in the first degree. Provides that each crime prosecuted under this act shall be punished separately under chapter 9.94A RCW, unless it is the same criminal conduct as any other crime, under RCW 9.94A.589. Provides that whenever any series of transactions involving a single person's means of identification or financial information which constitute identity theft would, when considered separately, constitute identity theft in the second degree because of value, and the series of transactions are a part of a common scheme or plan, then the transactions may be aggregated in one count and the sum of the value of all of the transactions shall be the value considered in determining the degree of identity theft involved. Provides that every person who, in the commission of identity theft, shall commit any other crime may be punished therefor as well as for the identity theft, and may be prosecuted for each crime separately.

 

H.B. 3045
Creates an identity theft unit within the Washington state patrol. Makes an appropriation.

 

H.B. 3233
S.B. 6523
Orders the Washington association of sheriffs and police chiefs to establish the Washington identity theft analysis center, to be colocated with the Washington joint analytical center. Directs the center to create and maintain a Web site accessible to law enforcement and prosecutors.

 

S.B. 6850
Creates the financial fraud and identity theft crimes investigation and prosecution program.

 West Virginia

H.B. 2026
Amends the crime of identity theft to provide that it is a felony if a person commits the crime with the intent to commit any other crime.

 

H.B. 2179
Includes persons who participate in or who contribute to taking a person's identity with fraudulent intent under the provisions of the criminal offense of taking the identity of another person.

 
Relates generally to consumer credit and identity theft protection; defines certain terms; provides a procedure for consumers to implement a security freeze; provides for notice of consumer rights; provides for protection for consumer credit header information; provides for the right to file a police report in the event of security theft; requires a notice to consumers of information systems breach; provides for factual declaration of innocence after identity theft; protects Social Security numbers; provides for civil penalties for violations; provides for making a violation an unfair or deceptive act or practice.
 

H.B. 4572
Relates to the crime victims compensation program; allows awards under the crime victims compensation program to be made to victims of identity theft; and definitions.

 

 NCSLFeedback Maximize


  

Denver Office
Tel: 303-364-7700 | Fax: 303-364-7800 | 7700 East First Place | Denver, CO 80230

 

Washington Office
Tel: 202-624-5400 | Fax: 202-737-1069 | 444 North Capitol Street, N.W., Suite 515 | Washington, D.C. 20001

©2009 National Conference of State Legislatures.  All Rights Reserved.