Relates to identity theft, protection of sensitive personal information, employee personal identifying information; creates the crimes of unlawful possession of skimmer device in the first and second degree.
NEW YORK STATE ASSEMBLY MEMORANDUM IN SUPPORT OF LEGISLATION submitted in accordance with Assembly Rule III, Sec 1(f)
BILL NUMBER: A11752
SPONSOR: Rules (Pheffer) TITLE OF BILL: An act to amend the executive law, the general busi-
ness law, the public officers law, the labor law, the penal law, and the
criminal procedure law, in relation to identity theft; and to amend the
penal law, in relation to establishing the crime of unlawful possession
of a skimmer device
PURPOSE:
This bill strengthens New York State's identity theft laws and helps
protect the State's residents from the fraudulent use of their personal
information.
SUMMARY OF PROVISIONS:
Section 1 of the bill amends Executive Law § 553(2) to establish a proc-
ess for identity theft victims to receive information and assistance
from the Consumer Protection Board (CPB).
Section 2 of the bill amends General Business Law (GBL) § 380-t to allow
consumers to request a freeze on their credit reports via telephone or
secure electronic means.
Section 3 of the bill adds a new § 96-a to the Public Officers Law to
extend to public entities prohibitions already applicable to private
businesses, including bans on intentional communication of a social
security number to the public.
Sections 4 and 5 of the bill amend GBL § 399-dd to preclude encoding or
embedding of social security numbers in place of removing a social secu-
rity number and prohibit the filing of documents available for public
inspection that contain social security numbers.
Section 6 of the bill adds a new § 203-d to the Labor Law to restrict
employers' use of employee personal identifying information, including
prohibiting employers from posting or displaying an employee's social
security number, or placing social security numbers in files with open
access.
Section 7 of the bill amends Penal Law § 60.27(1) by enabling victims of
identity theft to obtain restitution for the time they spend fixing
their credit and financial history.
Sections 8 through 13 amend the Penal Law to add new provisions for
unlawful possession of a skimmer device, which can obtain personal iden-
tifying information such as numbers from credit cards.
Section 14 of the bill amends Criminal Procedure Law § 190.30 to allow
certain business records to be received at grand jury proceedings when
the necessary foundation for their introduction is established by sworn
written statements rather than live testimony.
Section 15 sets out the severability clause.
Section 16 sets forth an effective date of 180 days after enactment;
provided that section 3 shall take effect January 1, 2010; sections 8
through 13 shall take effect November 1 following enactment; and that
section 14 shall take effect 30 days following enactment.
EXISTING LAW:
Identity theft has prompted frequent legislative action in recent years,
but significant gaps remain in New York law.
STATEMENT IN SUPPORT:
In 2006, the Identity Theft Data Clearinghouse of the Federal Trade
Commission (FTC) ranked New York eighth in the country for per capita
identity theft complaints. Data security is making headlines nearly
every day, as highlighted by this past winter's breach involving the
Hannaford Brothers supermarket chain. The heightened level of vulner-
ability and exposure created by the compilation of large electronic
databases necessitates a greater level of risk sensitivity.
Despite the magnitude of the problem, victims of identity theft and
financial fraud in New York State face barriers in receiving important
assistance, information, and resources. Victims of identity theft have
an arduous task in repairing their financial record, credit rating, and
well being. They require assistance and intervention to address their
particular needs and navigate various public and private systems.
This bill will help to address this problem in numerous ways.
First, the bill allows New York State residents who become victims of
identity theft to seek assistance from the Consumer Protection Board's
(CPB) Identity Theft Prevention and Mitigation Program. The program will
serve to assist victims in undoing the damage that the identity thief
has done to their financial and credit history.
Second, since November 2006, consumers been able to help prevent and
mitigate identity theft by placing a "security freeze" on their credit
report, which blocks most entities from gaining access to credit infor-
mation. The freeze also prevents unauthorized persons from opening new
accounts or borrowing money using another's personal information.
The amendments contained in this bill provide consumers more accessible
methods for placing and lifting a freeze, by: (1) as of January 1, 2010,
requiring credit reporting agencies to place a security freeze on an
identity theft victim's credit report within 24 hours of receiving
notice and proper identification; and (2) requiring credit bureaus to
"thaw" a consumer's credit file within 15 minutes of receipt of the
request. North Dakota passed legislation that will require credit
reporting agencies to place a security freeze on an identity theft
victim's credit report within 24 hours of receiving notice and proper
identification. In addition, Delaware, New Mexico, Minnesota, New
Jersey, Utah and West Virginia have laws that require credit bureaus to
"thaw" a consumer's credit file within 15 minutes of receipt of request.
Third, this bill extends important confidentiality protections to public
entities to prevent the intentional communication of social security
numbers to the public. The State and political subdivisions will not be
able to require individuals to transmit their social security numbers
over the Internet or print social security numbers on any materials that
are mailed to individuals.
Fourth, the bill restricts the ability of employers to use employee
personal identifying information, including prohibiting employers from
posting or displaying more than the last four digits of an employee's
social security number, or placing social security numbers in files with
open access. This will provide important confidentiality safeguards for
employees.
Fifth, the bill outlaws the possession of "skimmer" devices which can
obtain personal identifying information from credit cards. The bill also
will facilitate the prosecution of identity theft cases by permitting
certain business records to be received at grand jury proceedings based
upon sworn written statements.
The bill authorizes the Attorney General to bring enforcement actions
for violations of these restrictions, including injunctions and civil
penalties of not more than $5,000 per violation. In addition, any indi-
vidual whose confidential personal information is disclosed illegally
will be able to bring an action and recover actual damages or $1,000,
whichever is greater.
Finally, the bill enables victims of identity theft to obtain restitu-
tion for the value of the time they spend fixing the damage that the
criminal has inflicted. According to one study, identity theft victims
spent 330 hours in addressing the damage caused by the identity thief.
For the first time, these victims will be able to be compensated for
their lost time.
BUDGET IMPLICATIONS:
The 2008-09 Enacted Budget includes funding sufficient to cover the
costs of this legislation.
EFFECTIVE DATE:
This act shall take effect 180 days following enactment, provided that
section 3 shall take effect January 1, 2010; sections 8 through 13 shall
take effect November 1 following enactment; and that section 14 shall
take effect 30 days following enactment.
