CSHB 65(JUD): "An Act relating to the disclosure of permanent fund dividend applicant records, breaches of security involving personal information, credit report and credit score security freezes, protection of social security numbers, care of records, disposal of records, identity theft, credit cards, and debit cards, and to the jurisdiction of the office of administrative hearings; amending Rules 60 and 82, Alaska Rules of Civil Procedure; and providing for an effective date."
00 CS FOR HOUSE BILL NO. 65(JUD) 01 "An Act relating to the disclosure of permanent fund dividend applicant records, 02 breaches of security involving personal information, credit report and credit score 03 security freezes, protection of social security numbers, care of records, disposal of 04 records, identity theft, credit cards, and debit cards, and to the jurisdiction of the office 05 of administrative hearings; amending Rules 60 and 82, Alaska Rules of Civil Procedure; 06 and providing for an effective date." 07 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF ALASKA: 08 * Section 1. AS 40.21.110 is amended to read: 09 Sec. 40.21.110. Care of records. Except for public records lawfully in the 10 possession of a person other than the state, public records of existing or defunct 11 agencies of the state, territorial, and Russian governments in Alaska are the property 12 of the state and shall be created, maintained, preserved, stored, transferred, destroyed 13 or disposed of, and otherwise managed in accordance with the provisions of this
01 chapter and AS 45.48.500 - 45.48.530. Records shall be delivered by outgoing 02 officials and employees to their successors, and may not be removed, destroyed or 03 disposed of, except as provided in this chapter and AS 45.48.500 - 45.48.530. 04 * Sec. 2. AS 43.23.017 is amended to read: 05 Sec. 43.23.017. Applicant information confidential. Information on each 06 permanent fund dividend application, except the applicant's name, is confidential. The 07 department may only release information that is confidential under this section 08 (1) to a local, state, or federal government agency; 09 (2) in compliance with a court order; 10 (3) to the individual who or agency that files an application on behalf 11 of another; 12 (4) to a banking institution to verify the direct deposit of a permanent 13 fund dividend or correct an error in that deposit; 14 (5) as directed to do so by the applicant; [AND] 15 (6) to a contractor who has a contract with a person entitled to obtain 16 the information under (1) - (5) of this section to receive, store, or manage the 17 information on that person's behalf; a contractor receiving data under this paragraph 18 may only use the data as directed by and for the purposes of the person entitled to 19 obtain the information; and 20 (7) as provided under (b) of this section. 21 * Sec. 3. AS 43.23.017 is amended by adding new subsections to read: 22 (b) The department shall disclose applicant information to a business under a 23 contract with the department that requests the applicant information if the business has 24 a license under AS 43.70.020, the business, or an agent, an employee, or a contractor 25 of the business, indicates that the business will use the applicant information only in 26 the normal course of business, the person making the request provides proof of the 27 person's identity, and the person making the request states that the business will use 28 the applicant information only 29 (1) to obtain information for law enforcement agencies or for an 30 investigation, if the business is the practice of law or includes the service of process; 31 (2) in connection with a civil, a criminal, an administrative, or an
01 arbitration proceeding, including the service of process, investigation in anticipation of 02 litigation, executing on a judgment, enforcing a judgment, or complying with a court 03 order; 04 (3) for a legal or beneficial interest relating to the applicant, if the 05 business holds the legal or beneficial interest; 06 (4) on behalf of the applicant, if the business is acting in a fiduciary 07 capacity on behalf of the applicant; 08 (5) in connection with insurance claims, insurance investigations, or 09 insurance anti-fraud activities, if the business is an insurer or a person who provides 10 support services to an insurer; 11 (6) to comply with federal, state, or municipal laws, regulations, 12 ordinances, or other legal requirements; or 13 (7) for bulk distribution to political candidates or persons taking polls. 14 (c) In this section, 15 (1) "applicant" means an applicant for a permanent fund dividend; 16 (2) "applicant information" means name, mailing address, and birth 17 year of an applicant; 18 (3) "business" means a person engaging in business. 19 * Sec. 4. AS 44.64.030(a) is amended by adding a new paragraph to read: 20 (35) AS 45.48.080(c) (breach of security involving personal 21 information). 22 * Sec. 5. AS 45 is amended by adding a new chapter to read: 23 Chapter 48. Personal Information Protection Act. 24 Article 1. Breach of Security Involving Personal Information. 25 Sec. 45.48.010. Disclosure of breach of security. (a) If a person owns or uses 26 personal information that includes personal information on a state resident, and a 27 breach of the security of the information system containing the personal information 28 occurs, the person shall, after discovering or being notified of the breach, disclose the 29 breach to each state resident whose personal information was subject to the breach. 30 (b) An information collector shall make the disclosure required by (a) of this 31 section in the most expeditious time possible and without unreasonable delay, except
01 as provided in AS 45.48.020 and as necessary to determine the scope of the breach and 02 restore the reasonable integrity of the information system. 03 Sec. 45.48.020. Allowable delay in notification. An information collector 04 may delay disclosing the breach under AS 45.48.010 if an appropriate law 05 enforcement agency determines that disclosing the breach will interfere with a 06 criminal investigation. However, the information collector shall disclose the breach to 07 the state resident in the most expeditious time possible and without unreasonable delay 08 after the law enforcement agency informs the information collector in writing that 09 disclosure of the breach will no longer interfere with the investigation. 10 Sec. 45.48.030. Methods of notice. An information collector shall make the 11 disclosure required by AS 45.48.010 12 (1) by a written document sent to the most recent address the 13 information collector has for the state resident; 14 (2) by electronic means if making the disclosure by the electronic 15 means is consistent with the provisions regarding electronic records and signatures 16 required for notices legally required to be in writing under 15 U.S.C. 7001 et seq. 17 (Electronic Signatures in Global and National Commerce Act); or 18 (3) if the information collector demonstrates that the cost of providing 19 notice would exceed $150,000, that the affected class of state residents to be notified 20 exceeds 300,000, or that the information collector does not have sufficient contact 21 information to provide notice, by 22 (A) electronic mail if the information collector has an 23 electronic mail address for the state resident; 24 (B) conspicuously posting the disclosure on the Internet 25 website of the information collector if the information collector maintains an 26 Internet site; and 27 (C) providing a notice to major statewide media. 28 Sec. 45.48.040. Notification of certain other agencies. (a) If an information 29 collector is required by AS 45.48.010 to notify more than 1,000 state residents of a 30 breach, the information collector shall also notify without unreasonable delay all 31 consumer credit reporting agencies that compile and maintain files on consumers on a
01 nationwide basis and provide the agencies with the timing, distribution, and content of 02 the notices. 03 (b) This section may not be construed to require the information collector to 04 provide the consumer reporting agencies identified under (a) of this section with the 05 names or other personal information of the state residents whose personal information 06 was subject to the breach. 07 (c) This section does not apply to an information collector who is subject to 15 08 U.S.C. 6801 - 6827 (Gramm-Leach-Bliley Financial Modernization Act). 09 (d) In this section, "consumer reporting agency that compiles and maintains 10 files on consumers on a nationwide basis" has the meaning given in 15 U.S.C. 11 1681a(p). 12 Sec. 45.48.050. Exception for employees and agents. In AS 45.48.010 - 13 45.48.090, the good faith acquisition of personal information by an employee or agent 14 of an information collector for a legitimate purpose of the information collector is not 15 a breach of the security of the information system if the employee or agent does not 16 use the personal information for a purpose unrelated to a legitimate purpose of the 17 information collector and does not make further unauthorized disclosure of the 18 personal information. 19 Sec. 45.48.060. Waivers. A waiver of AS 45.48.010 - 45.48.090 is void and 20 unenforceable. 21 Sec. 45.48.070. Treatment of certain breaches. (a) If a breach of the security 22 of the information system containing personal information on a state resident that is 23 maintained by an information recipient occurs, the information recipient is not 24 required to comply with AS 45.48.010 - 45.48.030. However, immediately after the 25 information recipient discovers the breach, the information recipient shall notify the 26 information distributor who owns the personal information or who licensed the use of 27 the personal information to the information recipient about the breach and cooperate 28 with the information distributor as necessary to allow the information distributor to 29 comply with (b) of this section. In this subsection, "cooperate" means sharing with the 30 information distributor information relevant to the breach, except for confidential 31 business information or trade secrets.
01 (b) If an information recipient notifies an information distributor of a breach 02 under (a) of this section, the information distributor shall comply with AS 45.48.010 - 03 45.48.030 as if the breach occurred to the information system maintained by the 04 information distributor. 05 Sec. 45.48.080. Violations. (a) If an information collector who is a 06 governmental agency violates AS 45.48.010 - 45.48.090 with regard to the personal 07 information of a state resident, the information collector 08 (1) is liable to the state for a civil penalty of up to $500 for each state 09 resident who was not notified under AS 45.48.010 - 45.48.090, but the total civil 10 penalty may not exceed $50,000; and 11 (2) may be enjoined from further violations. 12 (b) If an information collector who is not a governmental agency violates 13 AS 45.48.010 - 45.48.090 with regard to the personal information of a state resident, 14 the violation is an unfair or deceptive act or practice under AS 45.50.471 - 45.50.561. 15 However, the information collector is not subject to the civil penalties imposed under 16 AS 45.50.551 but is liable to the state for a civil penalty of up to $500 for each state 17 resident who was not notified under AS 45.48.010 - 45.48.090, except that the total 18 civil penalty may not exceed $50,000. 19 (c) The Department of Administration may enforce (a) of this section against a 20 governmental agency. The procedure for review of an order or action of the 21 department under this subsection is the same as the procedure provided by AS 44.62 22 (Administrative Procedure Act), except that the office of administrative hearings 23 (AS 44.64.010) shall conduct the hearings in contested cases and the decision may be 24 appealed under AS 44.64.030(c). 25 (d) In this section, "governmental agency" means a state or local governmental 26 agency, except for an agency of the judicial branch. 27 Sec. 45.48.090. Definitions. In AS 45.48.010 - 45.48.090, 28 (1) "breach of the security" means unauthorized acquisition, or 29 reasonable belief of unauthorized acquisition, of personal information that 30 compromises the security, confidentiality, or integrity of the personal information 31 maintained by the information collector; in this paragraph, "acquisition" includes
01 acquisition by 02 (A) photocopying, facsimile, or other paper-based method; 03 (B) a device, including a computer, that can read, write, or 04 store information that is represented in numerical form; or 05 (C) a method not identified by (A) or (B) of this paragraph; 06 (2) "information collector" means a person who owns or uses personal 07 information in any form if the personal information includes personal information on a 08 state resident; 09 (3) "information distributor" means a person who is an information 10 collector and who owns or licenses personal information to an information recipient; 11 (4) "information recipient" means a person who is an information 12 collector but who does not own or have the right to license to another information 13 collector the personal information received by the person from an information 14 distributor; 15 (5) "personal information" means information in any form on an 16 individual that is not encrypted or redacted, or is encrypted and the encryption key has 17 been accessed or acquired, and that consists of a combination of 18 (A) an individual's name, address, or telephone number; in this 19 subparagraph, "individual's name" means a combination of an individual's 20 (i) first name or first initial; and 21 (ii) last name; and 22 (B) one or more of the following information elements: 23 (i) the individual's social security number; 24 (ii) the individual's driver's license number or state 25 identification card number; 26 (iii) the individual's account number, credit card 27 account number, or debit card account number; 28 (iv) account passwords or personal identification 29 numbers or other access codes. 30 Article 2. Credit Report and Credit Score Security Freeze. 31 Sec. 45.48.100. Security freeze authorized. A consumer may prohibit a
01 consumer credit reporting agency from releasing all or a part of the consumer's credit 02 report or credit score without the express authorization of the consumer by placing a 03 security freeze on the consumer's credit report. 04 Sec. 45.48.110. Placement of security freeze. (a) To place a security freeze, a 05 consumer shall make the request to the consumer credit reporting agency 06 (1) by certified mail to the address designated by the consumer credit 07 reporting agency to receive security freeze requests; or 08 (2) as allowed by (b) of this section. 09 (b) A consumer may make a request under (a) of this section by telephone or 10 by fax, the Internet, or other electronic media if the consumer credit reporting agency 11 has developed procedures for using the telephone or an electronic medium to receive 12 and process the request in an expedited manner. 13 (c) A consumer credit reporting agency shall place a security freeze within 14 five business days after receiving a request under (a) or (b) of this section and proper 15 identification from the consumer. 16 Sec. 45.48.120. Confirmation of security freeze. (a) Within 10 business days 17 after a consumer makes the request under AS 45.48.110, a consumer credit reporting 18 agency shall send a written confirmation of the placement of the security freeze to the 19 consumer. The confirmation must also inform the consumer that the consumer credit 20 reporting agency may charge, as allowed by AS 45.48.160(c), a fee for third-party 21 access during the security freeze. 22 (b) At the same time that the consumer credit reporting agency sends a 23 confirmation under (a) of this section, the consumer credit reporting agency shall 24 provide the consumer with a unique personal identification number, password, or 25 similar device to be used by the consumer when the consumer authorizes the release of 26 the consumer's credit report or credit score under AS 45.48.130. 27 Sec. 45.48.130. Access and actions during security freeze. (a) While a 28 security freeze is in place, a consumer credit reporting agency shall allow a third party 29 access to a consumer's credit report or credit score if the consumer requests that the 30 consumer credit reporting agency allow the access. 31 (b) To make a request under (a) of this section, the consumer shall contact the
01 consumer credit reporting agency by mail at the address designated by the consumer 02 credit reporting agency to receive security freeze requests or as allowed by (c) of this 03 section, authorize the consumer credit reporting agency to allow the access, and 04 provide the consumer credit reporting agency with 05 (1) proper identification to verify the consumer's identity; 06 (2) the unique personal identification number, password, or similar 07 device provided under AS 45.48.120(b); and 08 (3) the proper information necessary to identify the third party to 09 whom the consumer credit reporting agency may allow the access or the time period 10 during which the consumer credit reporting agency may allow the access to third 11 parties who request the access. 12 (c) In addition to making the request by mail, a consumer may make a request 13 under (a) of this section by telephone or by fax, the Internet, or other electronic media 14 if the consumer credit reporting agency has developed procedures for using the 15 telephone or an electronic medium to receive and process the request in an expedited 16 manner. 17 (d) A consumer credit reporting agency that receives a request from a 18 consumer under (b) or (c) of this section shall comply with the request immediately 19 after receiving the request by telephone or by an electronic medium or within three 20 business days after receiving the request by mail. 21 (e) If a security freeze is in place, a consumer credit reporting agency may not 22 release the credit report or credit score to a third party without the prior express 23 authorization of the consumer. 24 (f) If a security freeze is in place on a consumer's credit report and credit score 25 and if a third party applies to a consumer credit reporting agency to provide the third 26 party with access to the consumer's credit report or credit score, the consumer credit 27 reporting agency and, except as provided for insurers under (g) of this section, the 28 third party may treat the third party's application as incomplete unless the consumer 29 authorizes the access under (a) of this section. 30 (g) If an insurer requests access to a consumer's credit report and credit score 31 on which a security freeze is in place, unless the consumer authorizes access under (a)
01 of this section, the insurer may, notwithstanding AS 21.36.460, 02 (1) treat the consumer's application as incomplete; 03 (2) decline the consumer's application if the consumer does not lift the 04 security freeze for the insurer after a request by the insurer or the insurer's agent; 05 (3) treat the consumer as if the consumer has a neutral credit rating; 06 (4) exclude the use of credit information as a factor and use only 07 underwriting criteria; or 08 (5) treat the consumer in a manner that is otherwise approved by the 09 division of insurance. 10 (h) If a security freeze is in place, a consumer credit reporting agency may not 11 change the consumer's official information in the consumer's credit report and credit 12 score without sending a written statement of the change to the consumer within 30 13 days after the change is made. A consumer credit reporting agency is not required to 14 send a written statement if the consumer credit reporting agency makes a technical 15 change in the consumer's official information. If a consumer credit reporting agency 16 makes a change, other than a technical change, in a consumer's address, the consumer 17 credit reporting agency shall send the written statement to the consumer at both the 18 new address and the former address. In this subsection, 19 (1) "official information" means name, birth date, social security 20 number, and address; 21 (2) "technical change" means changing spelling, transposing numbers 22 or letters, abbreviating a word, or spelling out an abbreviation. 23 (i) This section is not intended to prevent a consumer credit reporting agency 24 from advising a third party that requests access to a consumer's credit report or credit 25 score that a security freeze is in effect. 26 (j) The procedures used by a consumer credit reporting agency for 27 implementing the provisions of this section may include the use of telephone, 28 facsimile, or electronic means if making the disclosure by the electronic means is 29 consistent with the provisions regarding electronic records and signatures required for 30 notices legally required to be in writing under 15 U.S.C. 7001 et seq. (Electronic 31 Signatures in Global and National Commerce Act).
01 Sec. 45.48.140. Removal of security freeze. (a) Except as provided by 02 AS 45.48.130, a consumer credit reporting agency may not remove a security freeze 03 unless 04 (1) the consumer requests that the consumer credit reporting agency 05 remove the security freeze under (b) of this section; or 06 (2) the consumer made a material misrepresentation of fact to the 07 consumer credit reporting agency when the consumer requested the security freeze 08 under AS 45.48.110; if a consumer credit reporting agency intends to remove a 09 security freeze on a consumer's credit report under this paragraph, the consumer credit 10 reporting agency shall notify the consumer in writing before removing the security 11 freeze. 12 (b) A consumer credit reporting agency shall remove a security freeze 13 immediately after receiving a request for removal from the consumer who requested 14 the security freeze. 15 (c) To make a request under (b) of this section, the consumer shall contact the 16 consumer credit reporting agency by mail or as allowed by (d) of this section, 17 authorize the consumer credit reporting agency to remove the security freeze, and 18 provide the consumer credit reporting agency with 19 (1) proper identification to verify the consumer's identity; and 20 (2) the unique personal identification number, password, or similar 21 device provided under AS 45.48.120(b). 22 (d) In addition to mail, a consumer may make a request under (b) of this 23 section by telephone or by fax, the Internet, or other electronic media if the consumer 24 credit reporting agency has developed procedures for using the telephone or an 25 electronic medium to receive and process the request in an expedited manner. 26 Sec. 45.48.150. Prohibition. When dealing with a third party, a consumer 27 credit reporting agency may not suggest, state, or imply that a consumer's security 28 freeze reflects a negative credit score, history, report, or rating. 29 Sec. 45.48.160. Charges. (a) Except as provided by (b), (c), or (d) of this 30 section, a consumer credit reporting agency may not charge a consumer to place or 31 remove a security freeze, to provide access under AS 45.48.130, or to take any other
01 action, including the issuance of a personal identification number, password, or similar 02 device under AS 45.48.120, that is related to the placement of, removal of, or allowing 03 access to a credit report or credit score on which a security freeze has been placed. 04 (b) A consumer credit reporting agency may charge a consumer $10 for 05 placing a security freeze. 06 (c) If a consumer makes more than two access requests during a calendar year, 07 a consumer credit reporting agency may charge the consumer $2 for each additional 08 access request made by the consumer during that calendar year. In this subsection, 09 "access request" means a request made by the consumer under AS 45.48.130 to allow 10 third-party access to the consumer's credit report or credit score on which a security 11 freeze has been placed. 12 (d) If a consumer fails to retain a personal identification number, password, or 13 similar device issued under AS 45.48.120, a consumer credit reporting agency may 14 charge the consumer up to $5 for each time after the first time that the consumer credit 15 reporting agency issues the consumer another personal identification number, 16 password, or similar device because the consumer failed to retain the personal 17 identification number, password, or similar device. 18 Sec. 45.48.170. Notice of rights. When a consumer credit reporting agency is 19 required to give a consumer a summary of rights under 15 U.S.C. 1681g (Fair Credit 20 Reporting Act), a consumer credit reporting agency shall also give the consumer the 21 following notice: 22 Consumers Have the Right to Obtain a Security Freeze 23 You may obtain a security freeze on your credit report and 24 credit score for $10 to protect your privacy and ensure that credit is not 25 granted in your name without your knowledge. You have a right to 26 place a "security freeze" on your credit report and credit score under 27 state law (AS 45.48.100 - 45.48.290). 28 The security freeze will prohibit a consumer credit reporting 29 agency from releasing your credit score and any information in your 30 credit report without your express authorization or approval. 31 The security freeze is designed to prevent credit, loans, and
01 other services from being approved in your name without your consent. 02 However, you should be aware that using a security freeze to take 03 control over who gets access to the personal and financial information 04 in your credit report and credit score may delay, interfere with, or 05 prohibit the timely approval of any subsequent request or application 06 you make regarding a new loan, credit, a mortgage, a governmental 07 service, a governmental payment, rental housing, employment, an 08 investment, a license, a cellular telephone, a utility, a digital signature, 09 an Internet credit card transaction, an extension of credit at point of 10 sale, and other items and services. 11 When you place a security freeze on your credit report and 12 credit score, within 10 business days you will be provided a personal 13 identification number, password, or similar device to use if you choose 14 to remove the freeze on your credit report and credit score or to 15 temporarily authorize the release of your credit report and credit score 16 to a specific third party or specific third parties or for a specific period 17 of time after the freeze is in place. To provide that authorization, you 18 must contact the consumer credit reporting agency and provide all of 19 the following: 20 (1) proper identification to verify your identity; 21 (2) the personal identification number, password, or 22 similar device provided by the consumer credit reporting agency; 23 (3) proper information necessary to identify the third 24 party or third parties who are authorized to receive the credit report and 25 credit score or the specific period of time for which the credit report 26 and credit score are to be available to third parties. 27 A consumer credit reporting agency that receives your request 28 to temporarily lift a freeze on a credit report and credit score is required 29 to comply with the request immediately after receiving your request if 30 you make the request by telephone, or an electronic method if the 31 agency provides an electronic method, or within three business days
01 after receiving your request if you make the request by mail. Under 02 some circumstances, the consumer credit reporting agency may charge 03 you $2 to temporarily lift the freeze. 04 A security freeze does not apply to circumstances where you 05 have an existing account relationship and a copy of your credit report 06 and credit score are requested by your existing creditor or its agents or 07 affiliates for certain types of account review, collection, fraud control, 08 or similar activities. 09 If you are actively seeking credit, you should understand that 10 the procedures involved in lifting a security freeze may slow your own 11 applications for credit. You should plan ahead and lift a freeze, either 12 completely if you are shopping around, or specifically for a certain 13 creditor, days before applying for new credit. 14 You have a right to bring a civil action against someone who 15 violates your rights under these laws on security freezes. The action can 16 be brought against a consumer credit reporting agency. 17 Sec. 45.48.180. Notification after violation. If a consumer credit reporting 18 agency violates a security freeze by releasing a consumer's credit report or credit 19 score, the consumer credit reporting agency shall notify the consumer within five 20 business days after the release, and the information in the notice must include an 21 identification of the information released and of the third party who received the 22 information. 23 Sec. 45.48.190. Resellers. A consumer credit reporting agency that acts as a 24 reseller of consumer information shall honor a security freeze placed on a consumer's 25 credit report and credit score by another consumer credit reporting agency. 26 Sec. 45.48.200. Violations and penalties. (a) A consumer who suffers 27 damages as a result of a person's violation of AS 45.48.100 - 45.48.290 may bring an 28 action in court against the person and recover, in the case of a violation where the 29 person acted 30 (1) negligently, actual damages, including loss of wages, and, when 31 applicable, damages for pain and suffering;
01 (2) knowingly, 02 (A) damages as described in (1) of this subsection; 03 (B) punitive damages that are not less than $100 nor more than 04 $5,000 for each violation as the court determines to be appropriate; and 05 (C) other relief that the court determines to be appropriate. 06 (b) A consumer may bring an action in court against a person for a violation or 07 threatened violation of AS 45.48.100 - 45.48.290 for injunctive relief, whether or 08 not the consumer seeks another remedy under this section. 09 (c) Notwithstanding (a)(2) of this section, a person who knowingly violates 10 AS 45.48.100 - 45.48.290 is liable in a class action for an amount that the court 11 allows. When determining the amount of an award in a class action under this 12 subsection, the court shall consider, among the relevant factors, the amount of any 13 actual damages awarded, the frequency of the violations, the resources of the violator, 14 and the number of consumers adversely affected. 15 (d) In this section, "knowingly" has the meaning given in AS 11.81.900. 16 Sec. 45.48.210. Exemptions. (a) The provisions of AS 45.48.100 - 45.48.290 17 do not apply to the use of a credit report by 18 (1) a person, the person's subsidiary, affiliate, or agent, or the person's 19 assignee with whom a consumer has or, before the assignment, had an account, 20 contract, or debtor-creditor relationship if the purpose of the use is to review the 21 consumer's account or to collect a financial obligation owing on the account, contract, 22 or debt; 23 (2) a subsidiary, an affiliate, an agent, an assignee, or a prospective 24 assignee of a person to whom access has been granted under AS 45.48.130 if the 25 purpose of the use is to facilitate the extension of credit or another permissible use; 26 (3) a person acting under a court order, warrant, or subpoena; 27 (4) an agency of a state or municipality that administers a program for 28 establishing and enforcing child support obligations; 29 (5) the Department of Health and Social Services, its agents, or its 30 assigns when investigating fraud; 31 (6) the Department of Revenue, its agents, or its assigns when
01 investigating or collecting delinquent taxes or unpaid court orders or when 02 implementing its other statutory responsibilities; 03 (7) a person if the purpose of the use is prescreening allowed under 15 04 U.S.C. 1681b(c) (Fair Credit Reporting Act); 05 (8) a person administering a credit file monitoring subscription service 06 to which the consumer has subscribed; or 07 (9) a person providing a consumer with a copy of the consumer's credit 08 report or credit score at the consumer's request; or 09 (10) a consumer credit reporting agency if the data base or file of the 10 consumer credit reporting agency consists entirely of information concerning and used 11 solely for one or more of the following purposes: 12 (A) criminal record information; 13 (B) personal loss history information; 14 (C) fraud prevention or detection; 15 (D) tenant screening; or 16 (E) employment screening. 17 (b) Except as provided by AS 45.48.190, the provisions of AS 45.48.100 - 18 45.48.290 do not apply to a person who acts only as a reseller of consumer 19 information. 20 Sec. 45.48.290. Definitions. In AS 45.48.100 - 45.48.290, 21 (1) "account review" means activities related to account maintenance, 22 account monitoring, credit line increases, and account upgrades and enhancements; 23 (2) "consumer" means an individual who is the subject of a credit 24 report or credit score; 25 (3) "consumer credit reporting agency" has the meaning given in 26 AS 45.48.990, but does not include a person who issues reports 27 (A) on incidents of fraud or authorizations for the purpose of 28 approving or processing negotiable instruments, electronic funds transfers, or 29 similar methods of payments; or 30 (B) regarding account closures because of fraud, substantial 31 overdrafts, automated teller machine abuse, or similar negative information
01 regarding a consumer to inquiring banks or other financial institutions for use 02 only in reviewing consumer requests for deposit accounts at the inquiring 03 banks or financial institutions; 04 (4) "reseller of consumer information" means a person who assembles 05 and merges information contained in the data bases of consumer credit reporting 06 agencies and does not maintain a permanent data base of consumer information from 07 which new consumer credit reports are produced; 08 (5) "security freeze" means a prohibition against a consumer credit 09 reporting agency from releasing all or a part of a consumer's credit report or credit 10 score without the express authorization of the consumer; 11 (6) "third party" means a person who is not 12 (A) the consumer who is the subject of the consumer's credit 13 report or credit score; or 14 (B) the consumer credit reporting agency that is holding the 15 consumer's credit report or credit score. 16 Article 3. Protection of Social Security Number. 17 Sec. 45.48.400. Use of social security number. A person may not 18 (1) intentionally communicate or otherwise make available to the 19 general public an individual's social security number; 20 (2) print an individual's social security number on a card required for 21 the individual to access products or services provided by the person; 22 (3) require an individual to transmit the individual's social security 23 number over the Internet unless the Internet connection is secure or the social security 24 number is encrypted; 25 (4) require an individual to use the individual's social security number 26 to access an Internet site unless a password, a unique personal identification number, 27 or another authentication device is also required to access the site; or 28 (5) print an individual's social security number on material that is 29 mailed to the individual unless 30 (A) local, state, or federal law, including a regulation adopted 31 under AS 45.48.470, expressly authorizes placement of the social security
01 number on the material; or 02 (B) the social security number is included on an application or 03 other form, including a document sent as a part of an application process or an 04 enrollment process, sent by mail to establish, amend, or terminate an account, a 05 contract, or a policy, or to confirm the accuracy of the social security number; 06 however, a social security number allowed to be mailed under this 07 subparagraph may not be printed, in whole or in part, on a postcard or other 08 mailer that does not require an envelope, or in a manner that makes the social 09 security number visible on the envelope or without the envelope's being 10 opened. 11 Sec. 45.48.410. Request and collection. (a) A person who does business in the 12 state, including the business of government, may not request or collect an individual's 13 social security number. This subsection does not prohibit a person from asking for 14 another form of identification from the individual. 15 (b) The prohibition in (a) of this section does not apply 16 (1) if the person is expressly authorized by local, state, or federal law, 17 including a regulation adopted under AS 45.48.470, to demand proof of the 18 individual's social security number, to collect the individual's social security number, 19 or to submit the individual's social security number to the local, state, or federal 20 government; 21 (2) if the person is engaging in the business of government and 22 (A) is authorized by law to request or collect the individual's 23 social security number; or 24 (B) the request or collection of the individual's social security 25 number is required for the performance of the person's duties or 26 responsibilities as provided by law; 27 (3) to a financial institution that is regulated by 15 U.S.C. 6801 - 6827 28 (Gramm-Leach-Bliley Financial Modernization Act) if the financial institution 29 requests or collects the individual's social security number to facilitate a transaction of 30 the individual; 31 (4) to a communication to or from a consumer reporting agency; in this
01 paragraph, "consumer reporting agency" has the meaning given in 15 U.S.C. 1681a 02 (Fair Credit Reporting Act); 03 (5) if the request or collection is for a background check on the 04 individual, law enforcement purposes, or the individual's employment, including 05 employment benefits; or 06 (6) if the disclosure does not have independent economic value, is 07 incidental to a larger transaction, and is necessary to verify the identity of the 08 individual. 09 Sec. 45.48.420. Sale, lease, loan, trade, or rental. (a) A person may not sell, 10 lease, loan, trade, or rent an individual's social security number to a third party. 11 (b) The prohibition in (a) of this section does not apply if the sale, lease, loan, 12 trade, or rental is 13 (1) expressly authorized by local, state, or federal law, including a 14 regulation adopted under AS 45.48.470; 15 (2) part of a report prepared by a consumer credit reporting agency in 16 response to a request by a person and the person submits the social security number as 17 part of the request to the consumer credit reporting agency for the preparation of the 18 report. 19 (c) A person who knowingly violates (a) of this section is guilty of a class A 20 misdemeanor. In this subsection, "knowingly" has the meaning given in AS 11.81.900. 21 Sec. 45.48.430. Disclosure. (a) A person doing business, including the 22 business of government, may not disclose an individual's social security number to a 23 third party. 24 (b) The prohibition in (a) of this section does not apply if 25 (1) the disclosure is expressly authorized by local, state, or federal law, 26 including a regulation adopted under AS 45.48.470; 27 (2) the person is engaging in the business of government and 28 (A) is authorized by law to disclose the individual's social 29 security number; or 30 (B) the disclosure of the individual's social security number is 31 required for the performance of the person's duties or responsibilities as
01 provided by law; 02 (3) the third party is a financial institution that is regulated by 15 03 U.S.C. 6801 - 6827 (Gramm-Leach-Bliley Financial Modernization Act), and the 04 disclosure is to facilitate a transaction of the individual; 05 (4) the disclosure is part of a report prepared by a consumer credit 06 reporting agency in response to a request by a person and the person submits the social 07 security number as part of the request to the consumer credit reporting agency for the 08 preparation of the report; or 09 (5) the disclosure is for a background check on the individual, law 10 enforcement purposes, or the individual's employment, including employment 11 benefits. 12 Sec. 45.48.440. Interagency disclosure. Notwithstanding the other provisions 13 of AS 45.48.400 - 45.48.480, a state or local governmental agency may disclose an 14 individual's social security number to another state or local governmental agency or to 15 an agency of the federal government if the disclosure is required in order for the 16 agency to carry out the agency's duties and responsibilities. 17 Sec. 45.48.450. Exception for employees, agents, and independent 18 contractors. (a) Notwithstanding the other provisions of AS 45.48.400 - 45.48.480, a 19 person may disclose an individual's social security number to an employee or agent of 20 the person for a legitimate purpose established by and as directed by the person, but 21 the employee or agent may not use the social security number for another purpose or 22 make an unauthorized disclosure of the individual's personal information. 23 (b) Notwithstanding the other provisions of AS 45.48.400 - 45.48.480, and 24 except as provided for an agent under (a) of this section, a person may disclose an 25 individual's social security number to an independent contractor of the person to 26 facilitate the purpose or transaction for which the individual initially provided the 27 social security number to the person, but the independent contractor may not use the 28 social security number for another purpose or make an unauthorized disclosure of the 29 individual's personal information. 30 Sec. 45.48.460. Employment-related exception. The provisions of 31 AS 45.48.400 - 45.48.480 may not be construed to restrict a person's use or exchange
01 of an individual's social security number 02 (1) in the course of the administration of a claim, benefit, or procedure 03 related to the individual's employment by the person, including the individual's 04 termination from employment, retirement from employment, and injury suffered 05 during the course of employment; or 06 (2) to check on an unemployment insurance claim of the individual. 07 Sec. 45.48.470. Agency regulations. If regulations are necessary in order for a 08 state agency to carry out the state agency's duties and responsibilities, a state agency 09 may adopt regulations under AS 44.62 (Administrative Procedure Act) to establish 10 when the state agency or a person regulated by the state agency may 11 (1) print an individual's social security number on material that is 12 mailed to the individual; 13 (2) demand proof from an individual of the individual's social security 14 number, collect from an individual the individual's social security number, or submit 15 an individual's social security number to a local, state, or federal agency; 16 (3) ask an individual to provide the state agency with the individual's 17 social security number; 18 (4) disclose an individual's social security number to a third party; 19 (5) sell, lease, loan, trade, or rent an individual's social security number 20 to a third party. 21 Sec. 45.48.480. Penalties. (a) A person who knowingly violates AS 45.48.400 22 - 45.48.430 is liable to the state for a civil penalty not to exceed $3,000. 23 (b) An individual may bring a civil action in court against a person who 24 knowingly violates AS 45.48.400 - 45.48.430 and may recover actual damages, court 25 costs allowed by the rules of court, and full reasonable attorney fees. 26 (c) In this section, "knowingly" has the meaning given in AS 11.81.900. 27 Article 4. Disposal of Records. 28 Sec. 45.48.500. Disposal of records. (a) When disposing of records that 29 contain personal information, a business and a governmental agency shall take all 30 reasonable measures necessary to protect against unauthorized access to or use of the 31 records.
01 (b) Notwithstanding (a) of this section, if a business or governmental agency 02 has otherwise complied with the provisions of AS 45.48.500 - 45.48.590 in the 03 selection of a third party engaged in the business of record destruction, the business or 04 governmental agency is not liable for the disposal of records under AS 45.48.500 - 05 45.48.590 after the business or governmental agency has relinquished control of the 06 records to the third party for the destruction of the records. 07 (c) A business or governmental agency is not liable for the disposal of records 08 under AS 45.48.500 - 45.48.590 after the business or governmental agency has 09 relinquished control of the records to the individual to whom the records pertain. 10 Sec. 45.48.510. Measures to protect access. The measures that may be taken 11 to comply with AS 45.48.500 include 12 (1) implementing and monitoring compliance with policies and 13 procedures that require the burning, pulverizing, or shredding of paper documents 14 containing personal information so that the personal information cannot practicably be 15 read or reconstructed; 16 (2) implementing and monitoring compliance with policies and 17 procedures that require the destruction or erasure of electronic media and other 18 nonpaper media containing personal information so that the personal information 19 cannot practicably be read or reconstructed; 20 (3) after due diligence, entering into a written contract with a third 21 party engaged in the business of record destruction to dispose of records containing 22 personal information in a manner consistent with AS 45.48.500 - 45.48.590. 23 Sec. 45.48.520. Due diligence. In AS 45.48.510(3), due diligence ordinarily 24 includes performing one or more of the following: 25 (1) reviewing an independent audit of the third party's operations and 26 its compliance with AS 45.48.500 - 45.48.590; 27 (2) obtaining information about the third party from several references 28 or other reliable sources and requiring that the third party be certified by a recognized 29 trade association or similar organization with a reputation for high standards of quality 30 review; or 31 (3) reviewing and evaluating the third party's information security
01 policies and procedures, or taking other appropriate measures to determine the 02 competency and integrity of the third party. 03 Sec. 45.48.530. Policy and procedures. A business or governmental agency 04 shall adopt written policies and procedures that relate to the adequate destruction and 05 proper disposal of records containing personal information and that are consistent with 06 AS 45.48.500 - 45.48.590. 07 Sec. 45.48.540. Exemptions. (a) A business or a governmental agency is not 08 required to comply with AS 45.48.500 - 45.48.530 if federal law requires that the 09 business or governmental agency act in a way that does not comply with AS 45.48.500 10 - 45.48.530. 11 (b) A business is not required to comply with AS 45.48.500 - 45.48.530 if 12 (1) the business is subject to and in compliance with 15 U.S.C. 6801 - 13 6827 (Gramm-Leach-Bliley Financial Modernization Act); or 14 (2) the manner of the disposal of the records of the business is subject 15 to 15 U.S.C. 1681w (Fair Credit Reporting Act) and the business is complying with 15 16 U.S.C. 1861w. 17 Sec. 45.48.550. Civil penalty. (a) An individual, a business, or a governmental 18 agency that knowingly violates AS 45.48.500 - 45.48.590 is liable to the state for a 19 civil penalty not to exceed $3,000. 20 (b) In this section, "knowingly" has the meaning given in AS 11.81.900. 21 Sec. 45.48.560. Court action. An individual who is damaged by a violation of 22 AS 45.48.500 - 45.48.590 may bring a civil action in court to enjoin further violations 23 and to recover damages for the violation and court costs and attorney fees allowed by 24 the rules of court. 25 Sec. 45.48.590. Definitions. In AS 45.48.500 - 45.48.590, 26 (1) "business" means a person who conducts business in the state or a 27 person who conducts business and maintains or otherwise possesses personal 28 information on state residents; in this paragraph, 29 (A) "conducts business" includes engaging in activities as a 30 financial institution organized, chartered, or holding a license or authorization 31 certificate under the laws of this state, another state, the United States, or
01 another country; 02 (B) "possesses" includes possession for the purpose of 03 destruction; 04 (2) "dispose" means 05 (A) the discarding or abandonment of records containing 06 personal information; 07 (B) the sale, donation, discarding, or transfer of 08 (i) any medium, including computer equipment or 09 computer media, that contains records of personal information; 10 (ii) nonpaper media, other than that identified under (i) 11 of this subparagraph, on which records of personal information are 12 stored; and 13 (iii) equipment for nonpaper storage of information; 14 (3) "governmental agency" means a state or local governmental 15 agency, except for an agency of the judicial branch; 16 (4) "personal information" means 17 (A) an individual's passport number, driver's license number, 18 state identification number, bank account number, credit card number, debit 19 card number, other payment card number, financial account information, or 20 information from a financial application; or 21 (B) a combination of an individual's 22 (i) name, address, or telephone number; and 23 (ii) medical information, insurance policy number, 24 employment information, or employment history; 25 (5) "records" means material on which information that is written, 26 drawn, spoken, visual, or electromagnetic is recorded or preserved, regardless of 27 physical form or characteristics, but does not include publicly available information 28 containing names, addresses, telephone numbers, or other information an individual 29 has voluntarily consented to have publicly disseminated or listed. 30 Article 5. Factual Declaration of Innocence after Identity Theft; Right to File Police 31 Report Regarding Identity Theft.
01 Sec. 45.48.600. Factual declaration of innocence after identity theft. (a) A 02 victim of identity theft may petition the superior court for a determination that the 03 victim is factually innocent of a crime if 04 (1) the perpetrator of the identity theft was arrested for, cited for, or 05 convicted of the crime using the victim's identity; 06 (2) a criminal complaint was filed against the perpetrator of the 07 identity theft; and 08 (3) the victim's identity was mistakenly associated with a record of a 09 conviction for a crime. 10 (b) In addition to a petition by a victim under (a) of this section, the 11 department may petition the superior court for a determination under (a) of this 12 section, or the superior court may, on its own motion, make a determination under (a) 13 of this section. 14 Sec. 45.48.610. Basis for determination. A determination of factual 15 innocence under AS 45.48.600 may be heard and made on declarations, affidavits, 16 police reports, or other material, relevant, and reliable information submitted by the 17 parties or ordered to be made a part of the record by the court. 18 Sec. 45.48.620. Criteria for determination; court order. (a) A court may 19 determine that a petitioner under AS 45.48.600 is factually innocent of a crime if the 20 court finds beyond a reasonable doubt that 21 (1) the petitioner is a victim of identity theft; 22 (2) the petitioner did not commit the offense for which the perpetrator 23 of the identity theft was arrested, cited, or convicted; 24 (3) the petitioner filed a criminal complaint against the perpetrator of 25 the identity theft; and 26 (4) the petitioner's identity was mistakenly associated with a record of 27 conviction for the crime. 28 (b) If a court finds under this section that the victim is factually innocent of a 29 crime, the court shall issue an order indicating this determination of factual innocence 30 and shall provide the victim with a copy of the order. 31 Sec. 45.48.630. Orders regarding records. After a court issues an order under
01 AS 45.48.620, the court may order the name and associated personal information of 02 the victim of identity theft that is contained in the files, indexes, and other records of 03 the court that are accessible by the public labeled to show that the name and personal 04 information of the victim of identity theft is incorrect. 05 Sec. 45.48.640. Vacation of determination. A court that has issued an order 06 under AS 45.48.620 may, at any time, vacate the order if the petition, or any 07 information submitted in support of the petition, is found to contain a material 08 misrepresentation, omission, or false information. 09 Sec. 45.48.650. Court form. The supreme court of the state may develop a 10 form to be used for the order under AS 45.48.620. 11 Sec. 45.48.660. Data base. The department may establish and maintain a data 12 base of individuals who have been victims of identity theft and who have received an 13 order under AS 45.48.620. The department shall provide a victim or the victim's 14 authorized representative access to a data base established under this section to 15 establish that the individual has been a victim of identity theft. Access to the a data 16 base established under this section is limited to criminal justice agencies, victims of 17 identity theft, and individuals and agencies authorized by the victims. 18 Sec. 45.48.670. Toll-free telephone number. The department may establish 19 and maintain a toll-free telephone number to provide access to information in a data 20 base established under AS 45.48.660. 21 Sec. 45.48.680. Right to file police report regarding identity theft. (a) Even 22 if the local law enforcement agency does not have jurisdiction over the theft of an 23 individual's identity, if an individual who has learned or reasonably suspects the 24 individual has been the victim of identity theft contacts, for the purpose of filing a 25 complaint, a local law enforcement agency that has jurisdiction over the individual's 26 actual place of residence, the local law enforcement agency shall make a report of the 27 matter and provide the individual with a copy of the report. The local law enforcement 28 agency may refer the matter to a law enforcement agency in a different jurisdiction. 29 (b) This section is not intended to interfere with the discretion of a local law 30 enforcement agency to allocate its resources to the investigation of crime. A local law 31 enforcement agency is not required to count a complaint filed under (a) of this section
01 as an open case for purposes that include compiling statistics on its open cases. 02 Sec. 45.48.690. Definitions. In AS 45.48.600 - 45.48.690, 03 (1) "crime" has the meaning given in AS 11.81.900; 04 (2) "department" means the Department of Law; 05 (3) "identity theft" means the theft of the identity of an individual; 06 (4) "perpetrator" means the person who perpetrated the theft of an 07 individual's identity; 08 (5) "victim" means an individual who is the victim of identity theft. 09 Article 6. Truncation of Card Information. 10 Sec. 45.48.750. Truncation of card information. (a) A person who accepts 11 credit cards or debit cards for the transaction of business may not print more than the 12 last four digits of the card number or the expiration date on any receipt or other 13 physical record of the transaction provided at the point of the sale or transaction. 14 (b) This section applies only to receipts that are electronically printed and does 15 not apply to transactions in which the sole means of recording a credit card or debit 16 card account number is by handwriting or by an imprint or copy of the card. 17 (c) An individual may bring a civil action in court against a person who 18 knowingly violates this section and may recover actual damages or $5,000, whichever 19 is greater, and court costs and attorney fees allowed by the rules of court. 20 (d) A person who knowingly violates this section is liable to the state for a 21 civil penalty not to exceed $3,000. 22 (e) In this section, 23 (1) "credit" means the right granted by a creditor to a debtor to defer 24 payment of debt, to incur debts and defer payment of the debt, or to purchase property 25 or services and defer payment of the purchase;in this paragraph, "creditor" means a 26 person who regularly extends, renews, or continues credit, a person who regularly 27 arranges for the extension, renewal, or continuation of credit, or an assignee of an 28 original creditor who participates in the decision to extend, renew, or continue credit; 29 (2) "credit card" means a card, plate, coupon book, or other credit 30 device existing for the purpose of obtaining money, property, labor, or services on 31 credit;
01 (3) "debit card" means a card issued by a financial institution to a 02 consumer for use in initiating an electronic fund transfer from the account of the 03 consumer at the financial institution for the purpose of transferring money between 04 accounts or obtaining money, property, labor, or services; 05 (4) "knowingly" has the meaning given in AS 11.81.900. 06 Article 7. General Provisions. 07 Sec. 45.48.990. Definitions. In this chapter, unless the context indicates 08 otherwise, 09 (1) "consumer" means an individual; 10 (2) "consumer credit reporting agency" means a person who, for 11 monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or 12 in part in the practice of assembling or evaluating consumer credit information or 13 other information on consumers for the purpose of furnishing credit reports to third 14 parties; 15 (3) "credit report" means a written, oral, or other communication of 16 information by a consumer credit reporting agency bearing on a consumer's credit 17 worthiness, credit standing, credit capacity, character, general reputation, personal 18 characteristics, or mode of living if the communication is used or expected to be used 19 or collected in whole or in part to serve as a factor in establishing the consumer's 20 eligibility for 21 (A) credit or insurance to be used primarily for personal, 22 family, or household purposes; 23 (B) employment purposes; or 24 (C) any other permissible purpose authorized under section 15 25 U.S.C. 1681b; 26 (4) "information system" means any information system, including a 27 system consisting of digital data bases and a system consisting of pieces of paper; 28 (5) "person" has the meaning given in AS 01.10.060 and includes a 29 state or local governmental agency, except for an agency of the judicial branch; 30 (6) "state resident" means an individual who satisfies the residency 31 requirements under AS 01.10.055.
01 Sec. 45.48.995. Short title. This chapter may be cited as the Alaska Personal 02 Information Protection Act. 03 * Sec. 6. AS 45.48.750 is amended by adding a new subsection to read: 04 (f) A person may not sell a device that electronically prints more than the last 05 four digits of a credit card or debit card on a consumer receipt for a business 06 transaction or on a copy retained by a business person for a business transaction. 07 * Sec. 7. AS 45.50.471(b) is amended by adding a new paragraph to read: 08 (52) an information collector, other than a governmental agency, 09 violating AS 45.48.010 - 45.48.090 (breach of security involving personal 10 information); in this paragraph, 11 (A) "governmental agency" has the meaning given in 12 AS 45.48.080; 13 (B) "information collector" has the meaning given in 14 AS 45.48.090. 15 * Sec. 8. The uncodified law of the State of Alaska is amended by adding a new section to 16 read: 17 INDIRECT COURT RULE AMENDMENTS. (a) AS 45.48.640, enacted by sec. 5 of 18 this Act, has the effect of changing Rule 60(b), Alaska Rules of Civil Procedure, by allowing 19 a court to vacate an order on its own motion and at any time and by establishing a specific 20 criterion for vacating the order under AS 45.48.640. 21 (b) AS 45.48.480(b), enacted by sec. 5 of this Act, has the effect of changing Rule 82, 22 Alaska Rules of Civil Procedure, by changing the criteria for determining the amount of 23 attorney fees to be awarded to a party in an action under AS 45.48.480(b). 24 * Sec. 9. AS 45.48.470, enacted by sec. 5 of this Act, takes effect immediately under 25 AS 01.10.070(c). 26 * Sec. 10. AS 45.48.750(f), enacted by sec. 6 of this Act, takes effect January 1, 2009.