File No. 753

Senate, April 21, 2009

The Committee on Judiciary reported through SEN. MCDONALD of the 27th Dist., Chairperson of the Committee on the part of the Senate, that the substitute bill ought to pass.

AN ACT CONCERNING CONSUMER PRIVACY AND IDENTITY THEFT.

Be it enacted by the Senate and House of Representatives in General Assembly convened:

Section 1. Section 53a-129a of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2009):

(a) A person commits identity theft when such person [intentionally obtains personal identifying information of another person without the authorization of such other person and] knowingly uses [that] personal identifying information of another person to obtain or attempt to obtain, in the name of such other person, money, credit, goods, services, property or medical information [in the name of such other person] without the consent of such other person.

(b) As used in this section, "personal identifying information" means any name, number or other information that may be used, alone or in conjunction with any other information, to identify a specific individual including, but not limited to, such individual's name, date of birth, mother's maiden name, motor vehicle operator's license number, Social Security number, employee identification number, employer or taxpayer identification number, alien registration number, government passport number, health insurance identification number, demand deposit account number, savings account number, credit card number, debit card number or unique biometric data such as fingerprint, voice print, retina or iris image, or other unique physical representation.

Sec. 2. Section 53a-129b of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2009):

(a) A person is guilty of identity theft in the first degree when such person commits identity theft, as defined in section 53a-129a, as amended by this act, of another person and (1) such other person is under sixty years of age, and the value of the money, credit, goods, services or property obtained exceeds ten thousand dollars, or (2) such other person is sixty years of age or older, and the value of the money, credit, goods, services or property obtained exceeds five thousand dollars.

(b) Identity theft in the first degree is a class B felony.

Sec. 3. Section 53a-129c of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2009):

(a) A person is guilty of identity theft in the second degree when such person commits identity theft, as defined in section 53a-129a, as amended by this act, of another person and such other person is under sixty years of age, and the value of the money, credit, goods, services or property obtained exceeds five thousand dollars, or such other person is sixty years of age or older.

(b) Identity theft in the second degree is a class C felony.

Sec. 4. Section 53a-130 of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2009):

(a) A person is guilty of criminal impersonation when [he] such person: (1) Impersonates another and does an act in such assumed character with intent to obtain a benefit or to injure or defraud another; or (2) pretends to be a representative of some person or organization and does an act in such pretended capacity with intent to obtain a benefit or to injure or defraud another; or (3) pretends to be a public servant other than a sworn member of an organized local police department or the Division of State Police within the Department of Public Safety, or wears or displays without authority any uniform, badge or shield by which such public servant is lawfully distinguished, with intent to induce another to submit to such pretended official authority or otherwise to act in reliance upon that pretense.

(b) Criminal impersonation is a class [B] A misdemeanor.

Sec. 5. (NEW) (Effective October 1, 2009) (a) For the purposes of this section, (1) "access device" includes, but is not limited to, any card, plate, code, account number, mobile identification number, personal identification number, telecommunication service access equipment, card-reading device, scanning device, reencoder or other means that could be used to access financial resources or obtain the financial information, personal information or benefits of another person, and (2) "personal identifying information" has the same meaning as provided in section 53a-129a of the general statutes, as amended by this act.

(b) A person is guilty of unlawful possession of a personal identifying information access device when such person possesses an access device, document-making equipment or authentication implement for the purpose of fraudulently altering, obtaining or using the personal identifying information of another person.

(c) Unlawful possession of an access device is a class A misdemeanor.

Sec. 6. (NEW) (Effective October 1, 2009) (a) Any license, registration or certificate issued by the state or any political subdivision of the state that was based upon an application containing any material false statement of personal identifying information, as defined in section 53a-129a of the general statutes, as amended by this act, is void from the date of issuance and shall be surrendered, on demand, to the issuing authority, provided the issuing authority has complied with the notice requirements set forth in subsection (c) of section 4-182 of the general statutes. Any moneys paid for such license, registration or certificate shall be forfeited to the issuing authority.

(b) No person shall obtain, attempt to obtain or assist in the procurement of any license, registration or certificate for another person by misrepresentation or impersonation, and any license, registration or certificate obtained by misrepresentation or impersonation is void from the date of issuance and shall be surrendered, on demand, to the issuing authority, provided the issuing authority has complied with the notice requirements set forth in subsection (c) of section 4-182 of the general statutes. Any moneys paid for such license, registration or certificate shall be forfeited to the issuing authority.

(c) Nothing in this section shall be construed as a limitation upon the power or authority of the state or any political subdivision thereof to seek any administrative, legal or equitable relief permitted by law.

(d) Any person who violates any provision of this section shall be guilty of a class A misdemeanor.

Sec. 7. Section 52-571h of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2009):

(a) Any person aggrieved by an act constituting a violation of section 53a-129a of the general statutes, revision of 1958, revised to January 1, 2003, or section 53a-129b, as amended by this act, 53a-129c, as amended by this act, [or] 53a-129d or 53a-129e may bring a civil action in the Superior Court for damages against the person who committed the violation.

(b) In any civil action brought under this section in which the plaintiff prevails, the court shall award the greater of one thousand dollars or treble damages, together with costs and a reasonable attorney's fee. Damages shall include, but not be limited to, documented lost wages and any financial loss suffered by the plaintiff as a result of identity theft, as defined in section 53a-129a, as amended by this act. The court shall issue an order that the person found guilty of identity theft shall pay restitution to the prevailing party and may award other remedies provided by law, including, but not limited to, the costs of providing not less than two years of commercially available identity theft monitoring and protection for such individual.

(c) No action under this section shall be brought but within [two] three years from the date when the violation is discovered or in the exercise of reasonable care should have been discovered.

Sec. 8. Section 54-93a of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2009):

Whenever a person is convicted of a violation of section 53a-129a of the general statutes, revision of 1958, revised to January 1, 2003, [or] section 53a-129b, as amended by this act, section 53a-129c, as amended by this act, [or] section 53a-129d or section 53a-129e, the court [may] shall issue such orders as are necessary to correct a public record that contains false information as a result of such violation.

Sec. 9. Subsection (e) of section 54-1d of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2009):

(e) Any defendant who is charged with a violation of section 53a-129a of the general statutes, revision of 1958, revised to January 1, 2003, [or] section 53a-129b, as amended by this act, section 53a-129c, [or] as amended by this act, section 53a-129d or section 53a-129e, and any defendant who is charged with any other offense committed as a result of such violation may be presented to the court in the geographical area in which the person whose personal identifying information has been obtained and used by the defendant resides and may be prosecuted in such geographical area or judicial district.

Sec. 10. (NEW) (Effective October 1, 2009) (a) Each employer shall obtain and retain employment applications in a secure manner and shall employ reasonable measures to destroy or make unreadable such employment applications upon disposal. Such measures shall, at a minimum, include the shredding or other means of permanent destruction of such employment applications in a secure setting. For purposes of this section, "employer" shall have the meaning prescribed to such term in section 31-128a of the general statutes.

(b) Any person or entity that violates the provisions of this section shall be subject to a civil penalty of five hundred dollars for each violation, provided such civil penalty shall not exceed five hundred thousand dollars for any single event.

(c) The provisions of this section shall not apply to any agency or political subdivision of the state.

(d) Any civil penalties received pursuant to this section shall be deposited into the privacy protection guaranty and enforcement account established pursuant to section 16 of this act.

Sec. 11. (NEW) (Effective October 1, 2009) (a) Any license, registration or certificate issued by the state, or any political subdivision of the state, that is physically altered to conceal or misrepresent a material fact is void from the date of such alteration and shall be surrendered, on demand, to the issuing authority, provided the issuing authority has complied with notice requirements set forth in subsection (c) of section 4-182 of the general statutes. Any moneys paid for such license, registration or certificate shall be forfeited to the issuing authority.

(b) No person shall alter any license, registration or certificate issued by the state, or any political subdivision of the state, and any license, registration or certificate so altered shall be void from the date of alteration and shall be surrendered, on demand, to the issuing authority, provided the issuing authority has complied with notice requirements set forth in subsection (c) of section 4-182 of the general statutes. Any moneys paid for such license, registration or certificate shall be forfeited to the issuing authority.

(c) Nothing in this section shall be construed as a limitation upon the power or authority of the state or any political subdivision thereof to seek any administrative, legal or equitable relief permitted by law.

(d) Any person who violates any provision of this section shall be guilty of a class A misdemeanor.

Sec. 12. Section 54-36h of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2009):

(a) The following property shall be subject to forfeiture to the state pursuant to subsection (b) of this section:

(1) All moneys used, or intended for use, in the procurement, manufacture, compounding, processing, delivery or distribution of any controlled substance, as defined in subdivision (9) of section 21a-240;

(2) All property constituting the proceeds obtained, directly or indirectly, from any sale or exchange of any such controlled substance in violation of section 21a-277 or 21a-278;

(3) All property derived from the proceeds obtained, directly or indirectly, from any sale or exchange for pecuniary gain of any such controlled substance in violation of section 21a-277 or 21a-278;

(4) All property used or intended for use, in any manner or part, to commit or facilitate the commission of a violation for pecuniary gain of section 21a-277 or 21a-278;

(5) All property constituting, or derived from, the proceeds obtained, directly or indirectly, [by a corporation] as a result of a violation of section 53a-276, 53a-277 or 53a-278;

(6) All property constituting, or derived from, the proceeds obtained, directly or indirectly, by a person as a result of a violation of section 53a-129a of the general statutes, revision of 1958, revised to January 1, 2003, 53a-129b, as amended by this act, 53a-129c, as amended by this act, 53a-129d, 53a-129e or 53a-130, as amended by this act or section 5, 6 or 11 of this act.

(b) Not later than ninety days after the seizure of moneys or property subject to forfeiture pursuant to subsection (a) of this section, in connection with a lawful criminal arrest or a lawful search, the Chief State's Attorney or a deputy chief state's attorney, state's attorney or assistant or deputy assistant state's attorney may petition the court in the nature of a proceeding in rem to order forfeiture of said moneys or property. Such proceeding shall be deemed a civil suit in equity, in which the state shall have the burden of proving all material facts by clear and convincing evidence. The court shall identify the owner of said moneys or property and any other person as appears to have an interest therein, and order the state to give notice to such owner and any interested person by certified or registered mail, and shall promptly, but not less than two weeks after notice, hold a hearing on the petition. No testimony offered or evidence produced by such owner or interested person at such hearing and no evidence discovered as a result of or otherwise derived from such testimony or evidence, may be used against such owner or interested person in any proceeding, except that no such owner or interested person shall be immune from prosecution for perjury or contempt committed while giving such testimony or producing such evidence. At such hearing the court shall hear evidence and make findings of fact and enter conclusions of law and shall issue a final order, from which the parties shall have such right of appeal as from a decree in equity.

(c) No property shall be forfeited under this section to the extent of the interest of an owner or lienholder by reason of any act or omission committed by another person if such owner or lienholder did not know and could not have reasonably known that such property was being used or was intended to be used in, or was derived from, criminal activity.

(d) Notwithstanding the provisions of subsection (a) of this section, no moneys or property used or intended to be used by the owner thereof to pay legitimate attorney's fees in connection with his defense in a criminal prosecution shall be subject to forfeiture under this section.

(e) Any property ordered forfeited pursuant to subsection (b) of this section shall be sold at public auction conducted by the Commissioner of Administrative Services or his designee.

(f) The proceeds from any sale of property under subsection (e) of this section and any moneys forfeited under this section shall be applied: (1) To payment of the balance due on any lien preserved by the court in the forfeiture proceedings; (2) to payment of any costs incurred for the storage, maintenance, security and forfeiture of such property; and (3) to payment of court costs. The balance, if any, shall be deposited in the drug assets forfeiture revolving account established under section 54-36i, except that any balance attributable to a sale of property in connection with a prosecution for a violation of section 53a-129a of the general statutes, revision of 1958, revised to January 1, 2003, sections 53a-129b to 53a-130, inclusive, as amended by this act, or section 5, 6 or 11 of this act, shall be deposited in the privacy protection guaranty and enforcement account established under section 16 of this act.

Sec. 13. Subsection (g) of section 42-471 of the general statutes is repealed and the following is substituted in lieu thereof (Effective from passage):

(g) Any civil penalties received pursuant to this section shall be deposited into the privacy protection guaranty and enforcement account established pursuant to section [19 of substitute senate bill 30 of the February 2008, regular session] 16 of this act.

Sec. 14. (NEW) (Effective October 1, 2009) (a) Any person who intentionally violates any provision of section 42-470 of the general statutes, or any provision of any regulation adopted pursuant to section 19 of this act shall be subject to a civil penalty of five hundred dollars for each violation, provided such penalty shall not exceed five hundred thousand dollars for any single event.

(b) All civil penalties received pursuant to this section shall be deposited in the privacy protection guaranty and enforcement account, pursuant to section 16 of this act.

Sec. 15. (NEW) (Effective from passage) (a) The Commissioner of Consumer Protection may conduct investigations and hold hearings on any matter under the provisions of section 42-470 or 42-471 of the general statutes, or of section 10, 14, 17 or 19 of this act. The commissioner may issue subpoenas, administer oaths, compel testimony and order the production of books, records, papers and documents. If any person refuses to appear, to testify or to produce any book, record, paper or document when so ordered, upon application of the commissioner, the Superior Court may make such order as may be appropriate to aid in the enforcement of this section.

(b) The Attorney General, at the request of the Commissioner of Consumer Protection, may apply to the Superior Court for an order temporarily or permanently restraining and enjoining any person from violating any provision of section 42-470 or 42-471 of the general statutes, or of section 10, 14, 17 or 19 of this act.

Sec. 16. (NEW) (Effective from passage) (a) There is established a "privacy protection guaranty and enforcement account" which shall be a nonlapsing account within the General Fund. The account may contain any moneys required by law to be deposited in the account. The account shall be used by the Commissioner of Consumer Protection: (1) For the reimbursement of losses sustained by individuals injured by a violation of the provisions of section 42-470 or 42-471 of the general statutes, or of section 10, 14, 17 or 19 of this act, and (2) for the enforcement of provisions of section 42-470 or 42-471 of the general statutes, or of section 10, 14, 17 or 19 of this act.

(b) Payments received pursuant to section 42-470 or 42-471 of the general statutes, or of section 10, 14, 17 or 19 of this act, shall be credited to the privacy protection guaranty and enforcement account. Any money in the privacy protection guaranty and enforcement account may be invested or reinvested and any interest arising from such investments shall be credited to said account.

(c) Whenever an individual obtains a court judgment against any person or entity for a violation of section 42-470 or 42-471 of the general statutes, or of section 10, 14, 17 or 19 of this act, such individual may, upon the final determination of, or expiration of time for appeal in connection with any such judgment, apply to the Commissioner of Consumer Protection for an order directing payment out of said account of the amount unpaid upon the judgment for actual damages and costs taxed by the court against the person or entity, exclusive of punitive damages. The application shall be made on forms provided by the commissioner and shall be accompanied by a certified copy of the court judgment obtained against the person or entity, together with a notarized affidavit, signed and sworn to by the individual, affirming that the individual: (1) Has complied with all the requirements of this subsection; (2) has obtained a judgment stating the amount thereof and the amount owing thereon at the date of application; and (3) except for a judgment obtained by the individual in small claims court, has caused to be issued a writ of execution upon such judgment, and the officer executing the same has made a return showing that no bank accounts or real property of the person or entity liable to be levied upon in satisfaction of the judgment could be found, or that the amount realized on the sale of them or of such of them as were found, under the execution, was insufficient to satisfy the actual damage portion of the judgment, or stating the amount realized and the balance remaining due on the judgment after application thereon of the amount realized. A true and attested copy of such executing officer's return, when required, shall be attached to such application and affidavit.

(d) Upon receipt of such application together with such certified copy of the court judgment, notarized affidavit and true and attested copy of the executing officer's return, when required, the commissioner or the commissioner's designee shall inspect such documents for their veracity and upon a determination that such documents are complete and authentic, and a determination that the individual has not been paid, the commissioner shall order payment out of said account of the amount unpaid upon the judgment for actual damages and costs taxed by the court against the person or entity, exclusive of punitive damages.

(e) Whenever an individual is awarded an order of restitution against any person or entity for loss or damages sustained by reason of a violation of section 10, 14, 17 or 19 of this act in a proceeding brought by the Attorney General at the request of the commissioner pursuant to section 42-470 or 42-471 of the general statutes or in a proceeding brought by the Attorney General, such individual may, upon the final determination of, or expiration of time for appeal in connection with any such order of restitution, apply to the commissioner for an order directing payment out of said account of the amount unpaid upon the order of restitution. The commissioner may issue such order upon a determination that the individual has not been paid.

(f) Before the commissioner shall issue any order directing payment out of the account to an individual pursuant to this section, the commissioner shall first notify the person or entity of the individual's application for an order directing payment out of the account and of the person or entity's right to a hearing to contest the disbursement in the event that the person or entity has already paid the individual. Such notice shall be given to the person or entity not later than fifteen days after the receipt by the commissioner of the individual's application for an order directing payment out of said account. If the person or entity requests a hearing in writing by certified mail not later than fifteen days after receipt of the notice from the commissioner, the commissioner shall grant such request and shall conduct a hearing in accordance with the provisions of chapter 54 of the general statutes. If the commissioner receives no written request by certified mail from the person or entity for a hearing not later than fifteen days after the person's or entity's receipt of such notice, the commissioner shall determine that the individual has not been paid, and the commissioner shall issue an order directing payment out of said account for the amount unpaid upon the judgment for actual damages and costs taxed by the court against the person or entity, exclusive of punitive damages, or for the amount unpaid upon the order of restitution.

(g) The commissioner or the commissioner's designee may proceed against any person or entity for an order of restitution arising from loss or damages sustained by any individual by reason of such person's or entity's violation of any of the provisions of section 42-470 or 42-471 of the general statutes, or section 10, 14, 17 or 19 of this act. Any such proceeding shall be held in accordance with the provisions of chapter 54 of the general statutes. In the course of such proceeding, the commissioner or the commissioner's designee shall decide whether to order restitution arising from such loss or damages, and whether to order payment out of said account. The commissioner or the commissioner's designee may hear complaints of all individuals submitting claims against a single person or entity in one proceeding.

(h) No application for an order directing payment out of said account shall be made later than three years from the final determination of or expiration of time for appeal in connection with any judgment or order of restitution.

(i) Whenever an individual satisfies the commissioner or the commissioner's designee that it is not practicable to comply with the requirements of subdivision (3) of subsection (c) of this section and that the individual has taken all reasonable steps to collect the amount of the judgment or the unsatisfied part thereof and has been unable to collect the same, said commissioner or said designee may, in his or her discretion, dispense with the necessity for complying with such requirement.

(j) In order to preserve the integrity of said account, the commissioner, in his or her sole discretion, may order payment out of said account of an amount less than the actual loss or damages incurred by the individual or less than the order of restitution awarded by the commissioner or the Superior Court.

(k) If the money deposited in said account is insufficient to satisfy any duly authorized claim or portion thereof, the commissioner shall, when sufficient money has been deposited in the account, satisfy such unpaid claims or portions thereof, in the order that such claims or portions thereof were originally determined.

(l) When the commissioner has caused any sum to be paid from said account to an individual, the commissioner shall be subrogated to all of the rights of the individual up to the amount paid plus reasonable interest, and prior to receipt of any payment from said account, the individual shall assign all of this right, title and interest in the claim up to such amount to the commissioner, and any amount and interest recovered by the commissioner on the claim shall be deposited in said account.

(m) If the commissioner orders the payment of any amount as a result of a claim against any party, said commissioner shall determine if the person or entity is possessed of assets liable to be sold or applied in satisfaction of the claim on said account. If the commissioner discovers any such assets, the Attorney General shall take any action necessary for the reimbursement of said account.

(n) If the commissioner orders the payment of an amount as a result of a claim against any party, said commissioner may enter into an agreement with the party whereby the party agrees to repay said account in full in the form of periodic payments over a set period of time.

Sec. 17. (NEW) (Effective October 1, 2009) Any person filing with the Commissioner of Consumer Protection any notice, statement or other document required under the provisions of section 42-470 or 42-471 of the general statutes, or of section 10 or sections 14 to 19, inclusive, of this act, which is false or untrue or contains any material misstatement of fact shall be fined not less than five hundred dollars nor more than five thousand dollars for each violation. All fines received pursuant to this section shall be deposited in the privacy protection guaranty and enforcement account.

Sec. 18. (NEW) (Effective from passage) Any person aggrieved by any decision, order or regulation of the Commissioner of Consumer Protection pursuant to section 42-470 or 42-471 of the general statutes, or of section 10 or sections 14 to 18, inclusive, of this act, may appeal in accordance with the provisions of chapter 54 of the general statutes.

Sec. 19. (NEW) (Effective from passage) The Commissioner of Consumer Protection may adopt regulations, in accordance with the provisions of chapter 54 of the general statutes, to carry out the provisions of section 42-470 or 42-471 of the general statutes, and of section 10 or sections 14 to 18, inclusive, of this act.

The following Fiscal Impact Statement and Bill Analysis are prepared for the benefit of the members of the General Assembly, solely for purposes of information, summarization and explanation and do not represent the intent of the General Assembly or either chamber thereof for any purpose. In general, fiscal impacts are based upon a variety of informational sources, including the analyst's professional knowledge. Whenever applicable, agency data is consulted as part of the analysis, however final products do not necessarily reflect an assessment from any specific department.

OFA Fiscal Note

State Impact:

Note: GF=General Fund

Municipal Impact: None

Explanation

Criminal Penalties for Identity Theft

The bill enhances various criminal penalties related to identity theft: (1) expanding the definition of the “identity theft” crime, which is a felony, to include obtaining information with the victim's permission; (2) increasing penalties if the victim of “identity theft” is sixty years of age or older; (3) increasing the penalty for criminal impersonation (allowing for imprisonment of up to 1 year instead of up to 6 months as current law provides); and (4) establishing new crimes related to the unlawful possession of an access device, misrepresentation to obtain any governmental-issued license, registration or certificate and alteration of any such license, registration or certificate.

To the extent that these changes increase the likelihood that offenders would be prosecuted or receive harsher penalties, a potential revenue gain from criminal fines and potential cost for incarceration and/or probation supervision in the community exist. It is anticipated that relatively few fines would be imposed on an annual basis, and, consequently, any revenue gain under the bill is expected to be minimal. On average, it costs the state $3,736 to supervise an offender on probation in the community as compared to $44,165 to incarcerate the offender.



Forfeiture of Money / Property Obtained by Identity Theft

The bill also establishes a procedure by which any money or property obtained through identity theft may be seized by the state and placed into an account to provide victims with restitution. The Division of Criminal Justice would incur minimal (i.e., less than $50,000) annual costs (overtime, expenses) to bring civil actions needed to seize this property from offenders. The Department of Administrative Services could process property forfeited under this bill through the normal course of its duties and at no additional cost. It is estimated that the Attorney General could generate as much as $250,000 in forfeiture revenue.

The Out Years

The annualized ongoing costs for incarceration and probation identified above, in addition to the potential value of seized assets, would continue into the future subject to inflation; the revenue gain from criminal fines would remain constant into the future since fine amounts are set by statute.

OLR Bill Analysis

sSB 838

AN ACT CONCERNING CONSUMER PRIVACY AND IDENTITY THEFT.

SUMMARY:

This bill makes numerous changes in laws relating to identity theft, Social Security numbers (SSNs), and the dissemination of personal identifying information.

It broadens the definition of “identity theft,” increases the penalty for criminal impersonation, and creates the crime of unlawful possession of personal access devices. The law already makes it a crime to possess skimmers and reencoders under certain circumstances. The bill also increases the penalties for identity theft when the victim is age 60 or older.

It allows a victim of identity theft to sue for damages if the perpetrator was found guilty of trafficking in personal identifying information. Victims can already sue for damages if the perpetrator was found guilty of identity theft. The bill expands the statute of limitations from two to three years. The bill specifies that damages include documented lost wages and any financial loss suffered by the plaintiff as a result of the identity theft. It requires the court to order restitution and other remedies that may be provided by law. The bill requires, rather than allows, courts to issue orders to correct public records whenever a person is convicted of identity theft.

It voids a credential issued by the state or political subdivision of the state (1) obtained by making a material false statement or (2) physically altered to misrepresent a material fact, requiring the credential to be returned to the issuing authority provided the authority complies with notice provisions.

It allows perpetrators to be prosecuted in the area where the victim lives rather than where the alleged crime was committed.

It penalizes employers for failing to obtain and retain employment applications securely and to take reasonable measures to destroy or make them unreadable when disposing.

It makes property gained from committing identity theft subject to forfeiture and requires proceeds from its disposition to be deposited in the Department of Consumer Protection's (DCP) consumer protection enforcement account to pay for enforcing the laws relating to the professions and trades DCP regulates.

It authorizes the DCP commissioner to investigate violations. It also allows the attorney general, upon request of the commissioner, to apply to the court to restrain or enjoin a violator.

The bill creates a privacy protection enforcement account to enforce the law and reimburse individuals hurt by violations of the bill's provisions on the dissemination of personal identifying information. It is funded with fines imposed on violators.

It establishes a fine, of between $500 and $5,000, to be deposited into the privacy protection account for (1) filing a notice, statement, or document required by the bill that includes false or untrue information or (2) intentionally violating the provisions of this bill or identity theft laws. It also establishes an appeals process for anyone aggrieved by a decision, order, or regulation made by the commissioner under the bill.

EFFECTIVE DATE: October 1, 2009, except the provisions relating to investigations, the privacy protection account, appeals, and regulations, which are effective upon passage.

§ 1 — IDENTITY THEFT

The bill expands “identity theft” by eliminating the requirement that personal identifying information be obtained without permission. Under the bill, a person commits identity theft when he or she knowingly uses another's personal identifying information to obtain or attempt to obtain money, credit, goods, services, property, or medical information. Under current law, a person commits identity theft when he intentionally obtains, without permission, another person's personal identifying information and uses it to illegally obtain or attempt to obtain money, credit, goods, services, property, or medical information. A violator commits a class D, C, or B felony, depending on the amount involved (see BACKGROUND for penalties).

By law, “personal identifying information” for this purpose includes any name, number, or other information that may be used, alone or with any other information, to identify a specific individual. It specifies that the information includes a person's name; birth date; mother's maiden name; motor vehicle operator, Social Security, employee identification, employer identification, taxpayer identification, alien registration, government passport, health insurance identification, demand deposit account, savings account, credit or debit card number; or unique biometric data, such as a fingerprint, voice print, retina or iris image, or other unique physical representation.

§§ 2 & 3 — INCREASED PENALTIES FOR CRIMES AGAINST SENIORS

Under current law, identity theft in the 1^st degree is committed when the value of the goods or services is greater than $10,000. The bill lowers the threshold to $5,000 if the crime is perpetrated against someone age 60 or older. First-degree identity theft is a class B felony.

Identity theft in the 2^nd degree is committed when the value of the goods or services is greater than $5,000. The bill lowers the threshold to any amount if the crime is perpetrated against someone age 60 or older. Second-degree identity theft is a class C felony.

The effect is to raise the penalty for committing identity theft against a senior from a class D to a class C felony when the amount involved is less that $ 5,000 and from a class C to class B felony when it is more (see BACKGROUND for penalties). These provisions are apparently in addition to penalties for larceny, which is the act of wrongfully taking, obtaining or withholding such property from an owner, intending to deprive another of property or to appropriate the property to oneself or a third person (CGS § 53a-119).

§ 4 — CRIMINAL IMPERSONATION

The bill increases the penalty for committing criminal impersonation from a class B misdemeanor to a class A misdemeanor (see BACKGROUND for penalties). By law, a person commits criminal impersonation when he or she:

1. impersonates another and acts in the assumed character with intent to obtain a benefit or to injure or defraud another;

2. pretends to represent a person or organization and acts in the pretended capacity with intent to obtain a benefit or to injure or defraud another; or

3. pretends to be a public servant, other than a police officer (which is another crime), with intent to induce another to submit to, or act in reliance on, the pretended authority.

§ 5 — UNLAWFUL POSSESSION OF PERSONAL INFORMATION ACCESS DEVICES

The bill creates the crime of unlawful possession of “personal identifying information access devices.” A person is guilty of committing this crime when he or she possesses access devices, document-making equipment, and authentication implements to alter, obtain, or use another's personal identifying information. The law already prohibits possession of a scanning device or reencoder under circumstances manifesting an intent to use it to commit identity theft (see BACKGROUND for Scanning Devices and Reencoders).

For this purpose, “access devices” include a card, plate, code, account number, mobile identification number, personal identification number, telecommunication service access equipment, card-reading device, scanning device, reencoder or other means that could be used to access financial resources or obtain financial information, personal identifying information, or another person's benefits.

A violator commits a class A misdemeanor (see BACKGROUND for penalty).

It is already a crime to (1) fraudulently use an automated teller machine with intent to deprive someone of property or to appropriate property to oneself or a third person and (2) knowingly use in a fraudulent manner an automated teller machine for the purpose of obtaining property (CGS § 53a-127b).

§ 6 — CREDENTIALS OBTAINED WITH FALSE INFORMATION

The bill prohibits obtaining or attempting to obtain another person's license, registration, or certificate by misrepresentation or impersonation. It makes void from the date of issue any credential (1) obtained under these circumstances or (2) issued by the state or a political subdivision thereof based upon an application containing a material false statement. It requires the credential, and any money paid for it, to be surrendered, on demand, to the issuing authority, provided the authority has complied with the notice requirements (see BACKGROUND for notice requirements). These provisions do not limit the power or authority of the state or any political subdivision thereof to seek administrative, legal, or equitable relief.

A violator commits a class A misdemeanor (see BACKGROUND for penalty).

§ 7 — CIVIL ACTION FOR DAMAGES, TRAFFICKING IN PERSONAL IDENTIFYING INFORMATION, AND STATUTE OF LIMITATIONS

By law, victims of identity theft can bring a civil action for damages against the offender in Superior Court. The bill also allows civil actions for damages if the offender was guilty of trafficking in personal identifying information. The law requires courts to award prevailing plaintiffs the greater of $ 1,000 or triple damages, costs, and reasonable attorney's fees. The bill specifies that damages include documented lost wages and any financial loss the plaintiff suffered as a result of identity theft. Further, it requires the court to order that the violator pay restitution and any other remedies provided by law, including the costs of providing at least two years of commercially available identity theft monitoring and protection.

The bill extends the two-year statute of limitations to three years. By law, the limitation period starts from the date the violation is discovered or reasonably should have been discovered.

§ 8 — CORRECTING PUBLIC RECORDS

The bill requires, rather than allows, a court to issue orders necessary to correct a public record that contains false information due to identity theft whenever a person is convicted of identity theft. It also applies the requirement to convictions of trafficking in personal identifying information.

§ 9 — VENUE FOR PROSECUTING IDENTITY THEFT CASES

Current law allows alleged identity theft offenders to be presented in the Superior Court for the geographical area where the victim lives rather than the area where the crime was allegedly committed. The bill specifies that the alleged violator may also be prosecuted in that judicial district or geographical area. It also applies the provision to prosecutions for trafficking in personal identifying information.

§ 10 — SAFEGUARDING EMPLOYEE DATA

The bill requires employers to obtain and retain applications in a secure manner and employ reasonable measures when disposing of the applications to destroy or make them unreadable at least by shredding them. An “employer” is an individual, corporation, partnership, or unincorporated association. This does not apply to state agencies or political subdivisions.

A violation is subject to a civil penalty of $500 per violation, not to exceed $500,000 per event. Civil penalties received must be deposited in the privacy protection guaranty and enforcement account.

§ 11 — ALTERED CREDENTIALS

The bill prohibits anyone from physically altering any license, registration, or certificate issued by the state or political subdivision to conceal or misrepresent a material fact. It makes any credential so altered void from the date of alteration. The bill requires the credential to be surrendered on demand to the issuing authority provided the authority has complied with the notice requirements (see BACKGROUND for notice requirements). The bill makes any money paid for the credential forfeited to the issuing authority.

These provisions do not limit the power or authority of the state or any political subdivision thereof to seek administrative, legal, or equitable relief.

A violator commits a class A misdemeanor (see BACKGROUND for penalty).

§ 12 — FORFEITURE OF PROCEEDS OF IDENTITY THEFT

The bill subjects to forfeiture all proceeds, or property derived from the proceeds, obtained, directly or indirectly, from identity theft, trafficking in personal identifying information, and unlawful possession of personal information access devices.

The law establishes procedures for hearings to handle the proceeds from the sale of forfeited property. The proceeds must be used to pay, in order: (1) preserved liens; (2) storage, maintenance, security, and forfeiture costs; and (3) court costs. The bill requires balances from the following to be deposited in the consumer protection enforcement account: sale of property made in connection with a prosecution for identity theft, criminal impersonation, unlawful possession of personal information access devices, making a material misstatement to obtain a credential, and altering a credential (see BACKGROUND).

§ 15 — INVESTIGATIONS

The bill authorizes the DCP commissioner to conduct investigations and hold hearings on violations of laws against misuse or failure to safeguard social security numbers, as well as the provisions of the bill related to (1) safeguarding employee data, (2) filing documents with DCP containing false, untrue, or material misstatement of fact, or (3) the regulations set forth by DCP in accordance with this bill.

The commissioner may (1) issue subpoenas; (2) administer oaths; (3) compel testimony; and (4) order the production of books, records, papers, and documents. If an individual refuses to comply, the Superior Court may make an appropriate order to aid enforcement. The attorney general, at the request of the commissioner, may apply to the Superior Court for an order temporarily or permanently restraining and enjoining a person from violating the relevant laws.

§16 — PRIVACY PROTECTION GUARANTY AND ENFORCEMENT ACCOUNT

§ 16(a) — Establishment of Account

The bill establishes the “Privacy Protection Guaranty and Enforcement Account” as a nonlapsing General Fund account. It may contain any money the law requires to be deposited in it.

The bill requires the DCP commissioner to use it to (1) reimburse individuals hurt by violations of laws against misuse of or failure to safeguard SSNs, as well as (a) the provisions of the bill related to safeguarding employee data, (b) the filing of documents with DCP containing false, untrue, or material misstatements of fact, or (c) the regulations set forth by DCP in accordance with this bill; and (2) enforce the above laws and provisions.

§ 16(b) — Payments to Account

The bill requires payments of penalties for violations of laws against misuse of or failure to safeguard SSNs, as well as (1) failure to safeguard employee data, (2) filing documents with DCP containing false, untrue, or material misstatements of fact, or (3) violating DCP regulations set forth in accordance with this bill to be credited to the account. The money in the account may be invested or reinvested and any interest earned by the investments must be credited to the account.

§ 16(c) — Applying for Payment

After someone hurt by a violation of the bill's restriction on disseminating personal identifying information has obtained a court judgment, the individual may apply to the commissioner for a payment from the account for the unpaid amount of the judgment for actual damages and costs, but not for punitive damages. The application must be made on DCP forms and be accompanied by a certified copy of the court judgment and a notarized, signed, and sworn affidavit. The affidavit must affirm that the applicant has:

1. complied with all the application requirements;

2. obtained a judgment;

3. stated the judgement amount and the amount still owed as of the application date; and

4. caused a writ of execution to be issued on the judgment, and the officer executing it has made a return showing (a) that it could not be satisfied, (b) that the amount recovered was not enough to satisfy the actual damage portion of the judgment, or (c) the amount realized and the balance remaining.

The bill also requires a true and attested copy of the executing officer's return, when required, to be attached to the application and affidavit. It does not require an applicant who obtained a judgment in small claims to fulfill these requirements.

Applications may be made after the final determination of, or expiration of time for, appeal in connection with a judgment.

§ 16(d) — Commissioner's Determination

The bill requires the DCP commissioner or his designee to inspect the application and accompanying documents for veracity. Once he determines that they are complete and authentic and that the applicant has not been paid, he must pay the unpaid amount, other than punitive damages, from the account.

§ 16(e) — Orders of Restitution

The bill allows an individual awarded restitution for loss or damages sustained from a violation of the bill in a proceeding brought by the commissioner or the attorney general, to apply for payment of the unpaid amount from the account. The commissioner may make the payment after determining that the individual has not been paid and the time for appeal has passed.

§ 16(f) — Violator's Right to a Hearing

The bill requires the commissioner, before making a payment from the account, to first notify the person or entity responsible for the damage caused by disseminating personal information of (1) the application for payment and (2) the person or entity's right to a hearing to contest the disbursement if the person or entity has already paid the applicant.

The bill requires the notice to be given within 15 days after the commissioner receives an application for payment. If the person or entity requests a hearing in writing by certified mail within 15 days after receiving the commissioner's notice, the commissioner must conduct a hearing in accordance with the Uniform Administrative Procedure Act (UAPA). If the commissioner does not receive such a request by certified mail, he must determine that the individual has not been paid and make a payment from the account.

§ 16(g) — Restitution Hearing

The bill allows the commissioner or his designee to proceed for restitution from any person or entity for (1) dissemination of SSNs, (2) failure to safeguard SSNs and employee data, (3) filing false information in documents required by this bill, or (4) violating DCP regulations set forth in accordance with this bill. Proceedings must be held according to the UAPA. The bill requires the commissioner or designee to decide in the course of the hearing whether to order restitution and whether to order payment from the account.

The bill allows the commissioner or designee to hear complaints of all individuals submitting claims against a single person or entity in one proceeding.

§ 16(h) — Deadline for Applying

The bill requires applications for payments to be made before three years have elapsed from the final determination of, or expiration of time for, appeal of the court judgment.

§ 16(i) — Exemption from Applicant's Duty to Satisfy Judgment

The bill allows the commissioner or his designee to dispense with the requirement that an applicant attempt to execute a judgment if the applicant satisfies the commissioner or designee that (1) it is not practicable, (2) has taken all reasonable steps to collect, and (3) has been unable to collect.

§ 16(j) — Payment Cap and Preserving the Account's Integrity

It allows the commissioner, in his sole discretion, to pay less than the actual loss or damages or the amount of a court or DCP restitution order to preserve the integrity of the account. It requires the commissioner, when sufficient money has been deposited in the account, to satisfy such unpaid claims.

§ 16(k) — Account Shortfall

If the money in the account is insufficient to satisfy a claim, the bill requires the commissioner to pay unsatisfied claims when enough money has been deposited, in the order that such claims were determined.

§ 16(l) — Subrogation

The bill requires individuals to assign to the commissioner the right to recover the amount they have been paid from the fund, plus reasonable interest. Any amount and interest the commissioner recovers on the claim must be deposited in the guaranty account.

§16(m) — Commissioner's Duty to Seek Recovery

If the commissioner pays from the account, the bill requires him to determine if the person or entity that caused the injury has assets that could be sold or applied to satisfy the claim. If he discovers any such assets, the bill requires the attorney general to take necessary action to reimburse the account.

§ 16(n) — Commissioner's Authority to Make Repayment Agreements

The bill authorizes the commissioner to make repayment agreements whereby the party agrees to repay the account in full through periodic payments over a set period of time.

§17 — FALSE STATEMENTS

The bill subjects to a fine of $500 to $5,000 anyone who files a notice, statement, or other document required by the bill's provisions on dissemination of personal identifying information if it is false or untrue or includes a material misstatement of fact.

§18 — APPEALS

The bill authorizes anyone aggrieved by any decision, order, or regulation the commissioner makes under the bill's provisions restricting the dissemination of personal identifying information to appeal in accordance with the UAPA.

§19 — REGULATIONS

The bill authorizes the DCP commissioner to adopt regulations implementing the bill's provisions on restricting the dissemination of personal identifying information.

BACKGROUND

Criminal Penalties

Scanning Devices and Reencoders

The law prohibits using a scanning device to access, read, obtain, memorize, or temporarily or permanently store information encoded on a computer chip or a payment card's magnetic strip without the authorized user's permission and with the intent to defraud the authorized user, issuer, or a merchant. It also prohibits using a reencoder to take information encoded on a computer chip or a magnetic strip and putting it onto a computer chip or the strip of a different card without the authorized user's permission and with the intent to defraud the authorized user, the card issuer, or a merchant.

By law, a “scanning device” is a scanner, reader, or any other electronic device used to access, read, scan, obtain, memorize, or store information on a computer chip or a magnetic strip of a payment card. A “reencoder” is an electronic device that places encoded information from a computer chip or magnetic strip of a payment card onto a computer chip or magnetic strip of another card or any electronic medium that allows an authorized transaction to occur. A “payment card” is a credit, charge, debit, or any other card issued to an authorized user allowing him to obtain goods, services, money, or anything else of value from a merchant. A “merchant” is a person who receives a payment card from its authorized user or someone he believes to be its authorized user in return for goods or services from the merchant.

The law authorizes the attorney general to sue to enforce its scanner and reencoder provisions. A violator is subject to one to 10 years imprisonment, a fine of up to $10,000, or both.

Restrictions on Disclosing Social Security Numbers

With certain exceptions, the law prohibits individuals and businesses from publicly disclosing Social Security numbers. The prohibition does not prevent the numbers from being (1) collected, used, or released as required by state or federal law or (2) used for internal verification or administrative purposes.

Specifically, the law prohibits any person, firm, corporation, or other entity, other than the state or its political subdivisions, from:

1. intentionally communicating or otherwise making available to the general public an individual's Social Security number;

2. printing anyone's Social Security number on any card that the person must use to access the person's or entity's products or services;

3. requiring anyone to transmit his Social Security number over the Internet, unless the connection is secure or the number is encrypted; or

4. requiring anyone to use his Social Security number to access an Internet web site, unless a password or unique personal identification number or other authentication is also required to access it.

The penalty for willful violations is a fine of up to $100 for the first offense, up to $500 for a second offense, and up to $1,000 or six months in prison for each subsequent offense.

Consumer Protection Enforcement Account

This statutorily established account is funded with revenue generated from imposing fines for licensing law violations and with up to $400,000 per year from the Home Improvement Guaranty Fund. DCP must use the account “to fund positions and other related expenses” to enforce the licensing and registration laws it administers (CGS § 21a-8a).

Related Bills

The Judiciary Committee favorably reported sSB 1090, which restricts dissemination of personal identifying information by requiring businesses to inform consumers of how the personal information will be used.

COMMITTEE ACTION

General Law Committee

Joint Favorable Substitute Change of Reference

Judiciary Committee

Joint Favorable