Legislature(2007 - 2008)CAPITOL 17
04/20/2007 03:00 PM House LABOR & COMMERCE
| Audio | Topic |
|---|---|
| Start | |
| HB65 | |
| HB163 | |
| Adjourn |
* first hearing in first committee of referral
+ teleconferenced
= bill was previously heard/scheduled
+ teleconferenced
= bill was previously heard/scheduled
| += | HB 163 | TELECONFERENCED | |
| += | HB 195 | TELECONFERENCED | |
| + | HB 197 | TELECONFERENCED | |
| + | TELECONFERENCED | ||
| += | HB 65 | TELECONFERENCED | |
HB 65-PERSONAL INFORMATION & CONSUMER CREDIT 3:13:48 PM CHAIR OLSON announced that the first order of business would be HOUSE BILL NO. 65, "An Act relating to breaches of security involving personal information, credit report and credit score security freezes, consumer credit monitoring, credit accuracy, protection of social security numbers, care of records, disposal of records, identity theft, furnishing consumer credit header information, credit cards, and debit cards, and to the jurisdiction of the office of administrative hearings; amending Rule 60, Alaska Rules of Civil Procedure; and providing for an effective date." 3:14:27 PM REPRESENTATIVE NEUMAN moved to adopt CSHB 65, Version 25- LS0311\C, Bannister, 4/9/07, as the working document. There being no objection, Version C was before the committee. 3:14:49 PM KAREN LIDSTER, Staff to Representative John Coghill, Alaska State Legislature, reviewed the sectional analysis to Version C on behalf of Representative Coghill, joint prime sponsor. She stated that identity theft is becoming more of a problem, and the proposed legislation addresses that issue. She directed attention to [Section 3] of Version C, which would add Chapter 48 to Title 45 - thus creating the Personal Information Protection Act. MS. LIDSTER began with the new sections that would fall under the proposed Chapter 48, Article 1, "Breach of Security Involving Personal Information". She highlighted the proposed AS 45.48.010 - "Disclosure of breach of security", AS 45.48.020 - "Allowable delay in notification", and AS 45.48.030 - "Methods of notice". Regarding the latter, Ms. Lidster relayed that there would be changes to the cost of notification from $250,000 to $150,000, as well as changes to the number of residents affected from 500,000 to 300,000. MS. LIDSTER continued, noting that the proposed AS 45.48.040 - "Notification of certain other agencies" - includes language specifying which agencies must be notified in the case of a breach of security and listing exceptions to that notification. She said AS 45.48.050 - "Exception for employees and agents" - lists exceptions related to the acquisition of personal information, while AS 45.48.060 - "Waivers" - states that there "are no waivers of these sections allowed." The proposed AS 45.48.070 - "Treatment of certain breaches" - would require that breaches of information by an information recipient be reported back to the information distributor in order to comply with notification requirements. She said AS 45.48.080 - "Violations" - sets out the fines for violations related to breeches in information caused by governmental and nongovernmental agencies. AS 45.48.090 - "Definitions" - supplies the definitions for the terms used. MS. LIDSTER turned to the new sections that would fall under the proposed Chapter 48, Article 2, "Credit Report and Credit Score Security Freeze", which include: AS 45.48.100 - "Security freeze authorized"; AS 45.48.110 - "Placement of security freeze"; AS 45.48.120 - "Confirmation of security freeze"; AS 45.48.130 - "Access and actions during security freeze"; and AS 45.48.140 - "Removal of security freeze"; and AS 45.48.150 - "Prohibition". MS. LIDSTER indicated that there had been a requirement to use certified mail, which was deleted because it was burdensome and unnecessary. She mentioned that Legislative Legal and Research Services inserted the words "credit" and "credit score" on page 8 in order to achieve consistency. The committee took an at-ease from 3:20 p.m. to 3:21 p.m. 3:21:36 PM MS. LIDSTER addressed the remaining portions of language pertaining to credit report and credit score security freeze. She said AS 45.48.160 - "Charges" - lists the charges that a consumer must pay in order to have a security freeze lifted. She said, "This is a change from the original bill and states that the reporting agency will allow two lifts for free, and then there will be a charge for the ... lifts after that; but there must also be written notice provided by the consumer reporting agency so the consumer knows that there will be a charge." She explained that the intent behind the charge is to help consumers appreciate the cost to the agency and the amount of work involved. She said the proposed AS 45.48.170 - "Notice of rights" - lists the additional notices the credit agencies will provide to the consumer along with the summary of rights. The notices will let consumers know what their rights are under the Fair Credit Reporting Act. She noted that AS 45.48.180 - "Notification after violation" - lists the notification requirements a consumer credit reporting agency must follow if it violates a security freeze. MS. LIDSTER said the proposed AS 45.48.190 - "Resellers" - would close a small loophole by ensuring that resellers understand that they have to honor a security freeze that has been placed by another consumer reporting agency. She said AS 45.48.200 - "Violations and penalties" - describes the rights of the consumer who suffers damages as a result of a breach. She noted that AS 45.48.210 - "Exemptions" - list the exemptions to the use of credit information when a security freeze is in place. Finally, she noted, AS 45.48.290 - "Definitions" - defines all the terms used. MS. LIDSTER covered the new sections that would fall under the proposed Chapter 48, Article 3, "Consumer Credit Monitoring; Credit Accuracy", which would be: AS 45.48.300 - "Required disclosure"; AS 45.48.310 - "Information to be disclosed"; AS 45.48.320 - "Cost of disclosure"; AS 45.48.330 - "Form of disclosure"; AS 45.48.340 - "Timing of disclosure"; and AS 45.48.350 - "Credit accuracy". Ms. Lidster said the language related to credit accuracy describes procedures for a consumer to follow should he/she find inaccurate information has been reported or distributed in relation to himself/herself. 3:25:58 PM MS. LIDSTER reviewed the new sections that would fall under the proposed Chapter 48, Article 4, "Protection of Social Security Number", which would be: AS 45.48.400 - "Use of social security number"; AS 45.48.410 - "Request and collection"; AS 45.48.420 - "Sale, lease, loan, trade, or rental"; AS 45.48.430 - "Disclosure"; AS 45.48.440 - "Interagency disclosure"; AS 45.48.450 - "Exception for employees, agents, and independent contractors"; AS 45.48.460 - "Employment-related exception"; AS 45.48.470 - "Agency regulations"; and AS 45.48.480 - "Penalties". 3:27:44 PM MS. LIDSTER moved on to the new sections that would fall under the proposed Chapter 48, Article 5, "Disposal of Records", which would be: AS 45.48.500 - "Disposal of records"; AS 45.48.510 - "Measures to protect access"; AS 45.48.520 - "Due diligence"; AS 45.48.530 - "Policy and procedures"; AS 45.48.540 - "Exemptions"; AS 45.48.550 - "Civil penalty"; AS 45.48.560 - "Court action"; AS 45.48.590 - "Definitions". 3:29:42 PM MS. LIDSTER then detailed the new sections that would fall under the proposed Chapter 48, Article 6, "Factual Declaration of Innocence after Identity Theft; Right to File Police Report Regarding Identity Theft", which would be: AS 45.48.600 - "Factual declaration of innocence after identity theft"; AS 45.48.610 - "Basis for determination"; AS 45.48.620 - "Criteria for determination; court order"; AS 45.48.630 - "Orders regarding records"; AS 45.48.640 - "Vacation of determination"; AS 45.48.650 - "Court form"; AS 45.48.660 - "Data base"; AS 45.48.670 - "Toll-free telephone number"; AS 45.48.680 - "Right to file police report regarding identity theft"; and AS 45.48.690 - "Definitions". She said the vacation of determination can be ordered by the court if there has been a misrepresentation of material. The court form, she said, would be developed by the court. The data base would house names of victims of identity theft. The language would appoint the responsibility to the law enforcement agency to make the report, even if they do not have the jurisdiction. 3:31:44 PM MS. LIDSTER went on to discuss the two other new sections that would fall under the proposed Chapter 48. One would be Article 7, "Consumer Credit Header information", and the other would be Article 8, "Truncation of Card Information". She explained that within Article 8 is a description of the limits on a business, regarding the printing of credit or debit card numbers and the type of receipt production. Furthermore, she said Article 8 was made to "tighten down the printing of your credit or debit card information." She explained: It's added language that states that a person may not sell a devise that prints more than the last four digits of a credit or debit card on a consumer or merchant copy. It does provide for an effective date, and it also removes the violation of this as a Class A misdemeanor. 3:33:30 PM REPRESENTATIVE GARDNER referred to the factual declaration of innocence after identity theft and cited the language of [subsection (a), including paragraph (1)], on page 25, [beginning on line 24 through line 28], which read as follows: (a) A victim of identity theft may petition the superior court for a determination that the victim is factually innocent of a crime if (1) the perpetrator of the identity theft was arrested for, cited for, or convicted of the crime using the victim's identity; REPRESENTATIVE GARDNER asked Ms. Lidster how the bill would handle a situation in which the victim of the crime never finds out who committed the identity theft. MS. LIDSTER, in response, referred to page 26, [lines 6-9], which read as follows: Sec. 45.48.610. Basis for determination. A determination of factual innocence under AS 45.48.600 may be heard and made on declarations, affidavits, police reports, or other material, relevant, and reliable information submitted by the parties or ordered to be made a part of the record by the court. MS. LIDSTER indicated that the language would cover a situation in which the perpetrator was never identified. 3:38:30 PM CLYDE "ED" SNIFFEN, JR., Senior Assistant Attorney General, Civil Division (Anchorage), Department of Law (DOL), in response to a question from Representative LeDoux, confirmed that the language regarding basis for determination focuses on having someone declared factually innocent after identity theft even if the perpetrator is not convicted but there is evidence to show that the victim of the identity theft had nothing to do with "that criminal proceeding." REPRESENTATIVE LeDOUX asked why a perpetrator has to be found if the identity theft victim has already proven his/her legal innocence. MR. SNIFFEN said that is an excellent question. He said the current language of the bill focuses only on a situation in which there is a perpetrator that the victim has been able to identify, which results in either an arrest of the perpetrator or a complaint being filed against him/her. He continued: And I think what you're suggesting is that, "Well, what if you can't even find the guy?" Let's say you're identity's been stolen and you're having all these problems - you don't where the guy is. Why can't we go get some relief from the court to show that, "Hey, this isn't me; I need to get on with my life; declare me factually innocent so I can help clear this mess up"? And I don't know that the language in this CS, as currently drafted, addresses that situation head on. REPRESENTATIVE LeDOUX confirmed that Version C does not address that issue. She asked Mr. Sniffen if he had any suggestions regarding how to solve this problem. MR. SNIFFEN offered to speak with Anne Carpeneti, [Assistant Attorney General, Legal Services Section - Juneau, Criminal Division, Department of Law], who has been focusing on this particular section of the bill, in order to come up with a solution. He explained that his area of expertise is in civil law; therefore "the criminal implications of this particular section are lost on me." REPRESENTATIVE LeDOUX asked what manner of problems a person might encounter if he/she has been judged as innocent but is unable to show his/her factual innocence. MR. SNIFFEN said some people have trouble getting creditors to believe that they are not the identity thief, but are instead the innocent victim of the identity theft. He stated: ... I think this process would allow those victims to go to the creditor and say, "See, I have a court order that tells you that I did not do this thing. You need to discharge me of the obligation for this debt, and you need to write a letter to my credit reporting agency telling them that I'm not responsible for this." And I think the ... force of a court order directing that the victim actually had nothing to do with it is something ... [identity] theft victims would like to see. REPRESENTATIVE LeDOUX asked Mr. Sniffen if he envisions that a person would have to be tried and use identity theft as an affirmative defense. She described another situation in which "nobody's going to actually get tried, so legal innocence isn't going to be adjudicated, but they're really having a problem and they would like to show this." She said she is not certain whether or not Article 6 "covers that." She said she imagines there are many cases in which a person's identity has been stolen, yet he/she has not been charged with a bill. She explained that generally, not paying bills is not a crime, but is a civil action. MR. SNIFFEN agreed that most identity theft victims don't get charged with crimes, at least initially; however, he noted that sometimes an identity thief uses a person's name to "rack up bad credit" for so long, that that person ends up getting a visit from a trooper with a warrant for his/her arrest. He remarked, "Before that happens, you would think there would be something that the victims could do to get assistance to help clear their name. And there may be room in this Article 6 for that to happen prior to criminal charges being brought." He said he would speak with Ms. Carpeneti on that point. 3:45:02 PM REPRESENTATIVE NEUMAN asked if the language on page 3 - regarding the cost of providing notice exceeding $150,000 and the affected class of state residents to be notified exceeding 300,000 - would strengthen the intent of the bill. MS. LIDSTER replied that the 300,000 amount "just shows that there would be other methods used to communicate the breach to them other than ... just the written notice." She added: At that level of $150,000 - if it was going to exceed that, or exceed 300,000 residents, it would have to be notified. We did not feel that it weakened the bill, it was just a reasonable number. 3:47:02 PM MS. LIDSTER, in response to Representative Neuman, reiterated that notice still has to be given by electronic mail or through the Internet. She mentioned notice through statewide media, as well. REPRESENTATIVE NEUMAN directed attention to page 15, [beginning on page 29], to the language regarding credit monitoring. He asked how a person would go about getting a copy of his/her personal [credit] information. MS. LIDSTER said the individual would make a request to the consumer reporting agency. She shared her understanding that there are web sites available for this. In response to a follow-up question from Representative Neuman, she offered her understanding that there are three national agencies: Equifax, TransUnion LLC, and Experian. She offered further information related to using the agencies and placing a freeze. 3:52:13 PM REPRESENTATIVE NEUMAN asked for details regarding a security freeze. MS. LIDSTER responded that those details can be found on page 11, [beginning on line 6, through page 12, line 29 of Version C]. 3:53:51 PM REPRESENTATIVE BUCH directed attention to the language in the proposed AS 45.48.120 [on page 7, lines 1-11, and noted that the consumer credit reporting agency would be given a 10-day period by which to respond to a consumer's request for a security freeze. He asked if it would be correct to interpret that language to mean that the consumer would be vulnerable for those 10 days. MS. LIDSTER confirmed that there would be ten days between the time a consumer made the request to the time he/she received confirmation from the agency that the freeze was put in place. 3:54:52 PM REPRESENTATIVE GARDNER suggested that that could mean the security freeze is implemented immediately, but it could take ten days to receive confirmation of it in writing. MS. LIDSTER confirmed that's correct. CHAIR OLSON noted that a tremendous amount of research has gone into HB 65 and into a similar bill the previous year. He asked, "How many breaches have we had in Alaska in the last five years?" MS. LIDSTER said she does not know. REPRESENTATIVE NEUMAN asked if, in the absence of the bill becoming law, a person could request a security freeze. MS. LIDSTER shared her understanding that this is the case because of the Fair Credit Reporting Act. She noted that a representative of the Consumers Union is available to offer further details. 3:57:05 PM GAIL HILLEBRAND, Senior Attorney, Consumers Union, in response to Representative Neuman's question, said: There are 31 states that have passed security freeze laws. We've got a policeman in Texas who called up and tried to get one and he was not able to because his state provides it only for victims. ... Our best understanding is they're not providing it voluntarily to people who live outside those 31 states. 3:58:02 PM REPRESENTATIVE NEUMAN said insurance companies have been known to use a credit reporting system to determine how much they charge for insurance. He asked, "Is this where credit scores could be used in that, and, if so, how would insurance companies work around that?" [Due to technical difficulties, there is no sound recording from 3:58:14 to 4:00:07; that segment was reconstructed from Gavel to Gavel's recording.] CHAIR OLSON offered his belief that that is not addressed by the bill. MS. LIDSTER stated that the exceptions to the credit freeze are listed, beginning on the bottom of page 13. She stated that she does not believe an insurance agency would necessarily "fall into these exceptions." 4:01:07 PM REPRESENTATIVE LES GARA, Alaska State Legislature, joint prime sponsor, in response to Chair Olson's previous question as to how many security breaches there have been in Alaska, said there was one major breach. He called it the "Choice Point situation," which occurred in 2005. He relayed that Choice Point is a division of Equifax. He mentioned an article pertaining to this occurrence, which appeared in the [Anchorage Daily News]. He explained that Choice Point accidentally released the social security and credit information of 140,000 Americans; approximately 250 of those were Alaskans. He said that is the only national breach he knows of that has been broken down to show how many Alaskans have been affected. Soon after the breach, Choice Point contacted the California victims to notify them that their security had been breached, because unlike Alaska, California has a law requiring companies to do that. Alaska victims were contacted some months later. He stated, "Choice Point's explanation has been: they thought that maybe the information that was stolen from the Californians ... might somehow more readily lead to theft of their information than the information that was taken from Alaskans. ... I suppose many people are skeptical of that explanation." REPRESENTATIVE BUCH revealed that he is a Department of Veterans Affairs (VA) [Hospital] patient. He asked Representative Gara if he is aware of a nationwide breach of security that occurred approximately eight months ago, when someone accessed all the VA information. REPRESENTATIVE GARA said he was not aware of that breach. REPRESENTATIVE GARDNER noted that that information was personal, not "credit," which would explain why Representative Gara had not heard of it before. REPRESENTATIVE GARA, in response to Representative Neuman, reviewed the main provisions of the bill. In response to a follow-up question, he said requesting a freeze from the previously mentioned three main credit agencies would be sufficient to stop credit agencies from giving clearance to any sale on big ticket items wherein the sales person calls for that clearance before completing the sale. He indicated that it would not stop smaller purchases from occurring. He offered his understanding that a person's credit card information is not public information; the first two provisions in the bill address stolen credit cards. 4:06:53 PM REPRESENTATIVE GARDNER asked if a person would have to have a card stolen before he/she would be able to put a freeze on his/her account. REPRESENTATIVE GARA answered no. He said it is at the discretion of the card holder whether or not to request that a freeze be placed on his/her card. He added, "You don't have to prove anything to place the freeze." REPRESENTATIVE GARDNER said it seems as though the three major companies make their money by sharing information with qualified organizations. She questioned why people worried about identity theft would not simply put a freeze on all their assets to avoid taking a risk. REPRESENTATIVE GARA shared his understanding that it may be possible to do that, but such action might affect a person's credit report. 4:09:50 PM REPRESENTATIVE GARDNER opined: It seems to me, if I'm in the business of selling credit data, I would want to make some kind of clarification as to whether the freeze is triggered by a consumer directly or by something else; because at some point ... that consumer will take the freeze off ... for whatever reason, and in the interest of having the data useful and valuable, I need to make a distinction so that other people will buy my data. REPRESENTATIVE GARA said he doesn't know that any other entity can place a freeze on someone's credit card; therefore, if a freeze has been placed, then it was done by the owner of the card. 4:12:15 PM MS. HILLEBRAND clarified that a security freeze is designed to give the individual consumer the choice whether or not to freeze the file. During the freeze, information in the file remains in an up-to-date state; therefore, when the consumer lifts the freeze, the bureau can still sell information to creditors once the freeze is lifted. Furthermore, during a freeze, existing creditors can still access the consumer's file to ensure that he/she is still a good risk. She explained that the bureau cannot sell information in a frozen file, which means the owner of the frozen file is protected from someone trying to impersonate them in order to access information. REPRESENTATIVE GARDNER asked Ms. Hildebrand, "Have the credit reporting agencies fought this kind of legislation in other places?" MS. HILLEBRAND answered that the bureau's response is "evolving"; it did oppose such legislation in "some of the early states," while in other states it seemed to be trying to make it harder to use, by imposing requirements such as certified mail or high fees. She related, "Interestingly, one of the arguments they're making in some states is not that many consumers are using it. We think that's a 'yet' - that when word gets around about this tool, more consumers will want to use it." 4:13:58 PM MS. HILLEBRAND, in response to a question from Representative Neuman, said although a person could acquire his/her own credit information from a frozen file, it would not be useful for the purpose of giving it to a car dealer, for example. That car dealer would want to get the information directly from the bureau to ensure that the consumer has not doctored the file in some way. Therefore, if the consumer would have to take an extra step in requesting a temporary lift and identifying how long the life should be or specifically for whom it is being lifted. MS. HILLEBRAND, in response to a follow-up question from Representative Neuman, offered the following hypothetical example: Here's how it works: I'm a thief. I want to open an account in your name. I go to a creditor of my choice, but that creditor, in processing my ... false application, will go the credit borough to check your credit. And that's why the credit bureau is kind of a choke hold on the ... theft system. ... The creditor I choose to impersonate you at would not go to your other creditors, they'd just go to the credit bureau. 4:15:53 PM REPRESENTATIVE GARDNER asked Ms. Hildebrand to speak generally about legitimate uses of a person's file that that person has not directly requested. MS. HILLEBRAND responded: Your existing creditors do have a need or may have perceived a need to review your file on a periodic basis. They want to make sure that you're as good a credit risk today as the day they gave you your mortgage or your car loan or your credit card. And that is account review, which is specifically exempted on page 15 from the operation of the freeze. That's the main one. There also is an exemption for a special kind of agency that deals with people who have their checking accounts closed because they didn't pay their bad checks. ... If your existing creditor is going to sell your loan to another entity, ... the people who are buying that whole portfolio of loans needs to check up and make sure those are sound loans, and that's exempted, as well. And then there is an exemption here for what's called, "pre-screening," and that's because states cannot address that under state law - you'd be preempted if you do. MS HILLEBRAND offered further details. 4:18:02 PM REPRESENTATIVE NEUMAN asked Representative Gara what other highlights he sees in HB 65. REPRESENTATIVE GARA mentioned "the trade of social security numbers provision," which he said has been a strong issue for many of the other co-sponsors of the bill. He explained that currently it is legal to sell a social security number, and he opined that it should not be. 4:19:24 PM REPRESENTATIVE GARDNER asked Representative Gara to describe the distinction between how government agencies and private businesses are treated in the bill. REPRESENTATIVE GARA replied: The first provision, let's say. If the state were to release your personal information accidentally - if somebody were to steal it - they, too, would have to notify you under this bill. They wouldn't be subject to the freeze provisions, because the freeze provisions only apply to those three agencies that have the information. They would be subject to the limitation of transferring out your social security numbers. They have to keep your social security numbers secure; we would require them to do that. There is a provision on the safe-keeping of financial and social security records and the proper disposal of them when you're in the business of using those things. The state and private entities would be required to not just take your social security information and leave it on a trash bin for somebody to pick up; they would have to have a disposal policy and protect the privacy of that information. ... I guess there's a case that could be made that we should exempt the state from many of these things, ... but the state is largely included in the bill, to the same extent as private business. There might be an exception here or there. REPRESENTATIVE NEUMAN asked if it would be advisable for a person to place a freeze on his/her credit information. He opined that such an action would increase personal security, but he asked if it would be "over the top." REPRESENTATIVE GARA said, "I think you're going to find a number of detriments to yourself if you have a permanent security freeze on your own credit." He deferred to Ms. Hildebrand for further comment. 4:22:17 PM MS. HILLEBRAND proffered: The freeze is designed precisely for what the representative described, which is: you don't think you're going to be seeking new credit; you want the extra protection. It's kind of like bolting your front door and now you have to carry two keys. There is an inconvenience factor when you decide you're the one that wants to get new credit in your own name; you have to go and lift the freeze - but you do have a method to do that. We think it's particularly appropriate for people who are mature in the credit market: they're either not in the housing market or they already have a house; they maybe are not going to be buying a car for the next few years; like most of us, they have enough or too many credit cards. It's probably less likely that ... a recent college graduate is going to want to place the freeze if they are kind of in that acquisition stage of their life, in terms of credit. For seniors it can be particularly valuable if there's an issue of competency, and if you're caring for an aging senior, you might very well want to put that freeze on just so you don't have to worry about whether they are going to respond properly to the danger signals if someone has opened an account in their name. So, it's a highly personal choice. MS. HILLEBRAND concluded that [a freeze] offers the most protection, but requires an extra step in order to access the credit again. 4:23:38 PM REPRESENTATIVE LeDOUX asked what would happen if a person waits a couple years to lift a freeze and by then has forgotten his/her password. MS. HILLEBRAND replied that the person would have to contact the bureau, and that process would take longer, because the bureau would have to confirm the identity of that person. REPRESENTATIVE GARA, in response to a question from Representative Gardner, said he has spoken with Mr. Sniffen of the Department of Law, regarding liability issues for the state. He said there is a fine provision in the bill, and he surmised that the state could be fined for its own misconduct and "in some sense it would be paying itself." He said Mr. Sniffen recommended that the bill sponsors address that portion of the bill. Regarding damages that the state may cause someone else, Representative Gara said he thinks that is something for which the state should be liable. 4:25:50 PM REPRESENTATIVE GARA, in response to a request from Representative Gardner, noted that the definition of "personal information" is on pages 5-6 of Version C, and includes name, address, or telephone number, plus one or more of the following: social security number, driver's license, financial information, or financial access codes. 4:29:34 PM MR. SNIFFEN said he is involved in educating Alaskans regarding identity theft, and he appreciates these issues being brought to the forefront through proposed legislation. He continued: The issues that we have with the bill ... deal with the state's exposure to liability for inadvertent breaches. And the one provision in particular that we have concern about is in [the proposed AS] 45.48.480, and that's in the social security number section. There's a provision there that essentially says the state could be liable to a consumer who suffers no damages - which is different than the scenario Representative Gara described - ... but still can get $5,000 from the state, because the provision says an action may be brought against the state to recover actual damages or $5,000, whichever is greater. So, imagine an inadvertent breach by a clerk who makes $8/hour in some agency in the State of Alaska, and numbers get out to 300,000 people. The exposure to the state for that kind of liability is just enormous, and it's just not necessary, because I don't know how that would help further the goals of the bill. State agencies are going to continue their efforts to protect this information [and] do what they can to keep it confidential. The provisions in the bill under Section 1, dealing with security breaches, we have no issues with. There's a reasonable cap on potential damages to the state there - that's fine. And I'm not necessarily opposed to letting consumers who suffer actual damages bring claims against the state like they could any other tort. But providing for this $5,000 sort of automatic damage is just a lure for a class action plaintiff to find some breach and really create some significant liability against the state. So, we would encourage the committee to take a look at those liability provisions and decide if it's good state policy to have the state exposed to that kind of liability. 4:32:21 PM REPRESENTATIVE GARDNER spoke of a document that is sent to the Department of Labor by employers when they hire employees, which enables the Department of Labor to garnish child support payments from the appropriate employees. She noted that currently, the Municipality of Anchorage is embroiled in a dispute with the Department of Labor, because it wants access to that data in order to collect other types of judgments - for example, unpaid [traffic citations]. She asked Mr. Sniffen if he is familiar with the situation. MR. SNIFFEN answered no. 4:34:02 PM LORI DAVEY, President, Motznik Information Services, Inc, testified as follows: I'm testifying today in favor of HB 65, along with the request to amend the bill to reauthorize access to the PFD [permanent fund dividend] file for legitimate business purposes. House Bill 65 finally defines what constitutes personal information and the legal recourse for those who are negligently careless or criminally intent on misusing a person's information. A person's name, address, date of birth, and phone number alone is not considered personal information. From the PFD file we've only ever had the address and the name of individuals. We find ourselves today in juxtaposition between making sure people's personal information is protected and ensuring citizens can go about their normal business of employment, buying a home, and banking, as well as offering remedy to those who have had their identity fraudulently or mistakenly crossed with another's. Victims of identity theft or mistaken identity have little resources to differentiate themselves from criminals or other individuals. When I purchased Motznik Information Services four years ago, my bank documents had a lien against the other Lori J. Davey's coffee shop in Glennallen, and I was born in Glennallen. I was able to prove by our public voter records and our PFD records and hunting and fishing records that we were not the same person. It would be harder to do that today. It's fortunate for my family and my employees that the other Lori Davey doesn't have a criminal record or a bankruptcy record. During my February visit to Juneau, I believe it was in Representative Olson's office that a staff person told me about a Kenai resident who erroneously had his PFD check garnished to pay a debt for another resident with a similar name. It's normal practice for employers and creditors to run background checks on individuals. The Alaska criminal file has the identifier's name and date of birth in it. We use a series of public files to cross-reference and differentiate individuals with common names to compare to the records in the civil, criminal, bankruptcy, and Recorder's Office files. The best match [is] when you can corroborate a name and a date of birth. As you may recall, we lost access to the PFD file in 2005. I was told by then Senator Guess that this would be corrected for us in the next session, but it was not. When we lost this file, we lost the best source for a comprehensive list of all Alaskans. It's now very difficult to differentiate criminals from non-criminals with common names. Criminals do not necessarily vote, register their vehicles, purchase hunting and fishing licenses, or own property - but they do get a PFD check. This is about accountability and ensuring the average Alaska citizen maintains their personal rights in society. Reauthorizing access to the PFD file in a limited format will ensure records are properly matched to the individual, and you'll have the balance necessary for the innocent John Doe to prove he is not the same person as the criminal. I've been working with Representative Ramras to create an amendment to reauthorize limited access to the PFD file for legitimate business purposes by modeling the DMV [Division of Motor Vehicles] exemptions and the "do-not-call" exemptions as a guide. ... As an industry, we already maintain a separate classification of access for the confidential DMV file, and [the] limited access PFD file would have to be handled in much the same way. MS. DAVEY concluded by referring to an amendment to HB 65 that would "correct the past mistakes by reauthorizing access to [the] PFD file for legitimate purposes," thus allowing those with similar names to be identified accurately. 4:37:45 PM MS. DAVEY, in response to a question from Representative Gardner, confirmed that the information she would like access to through the PFD files is: name, address, and date of birth. In response to Representative Neuman, she clarified that the aforementioned amendment has not been introduced, "but it's one that we've been working on." 4:38:31 PM MS. HILLEBRAND augmented her original remarks by noting that the Consumers Union is the nonprofit publisher of Consumer Reports. She stated, "Our mission's to test, inform, and protect, and I'm with the protect portion of our organization." She said [the Consumers Union] supports HB 65 as a "solid, well-balanced bill." 4:38:50 PM JACK KREINHEDER, Chief Analyst, Office of Management & Budget (OMB), Office of the Governor, noted that he had prepared the fiscal note for HB 65. In response to Chair Olson, he stated that based on his review of Version C, there would be no change in the fiscal note. The reason, he explained, is that Version C would not change the aforementioned penalty provision. 4:40:37 PM ANNE CARPENETI, Assistant Attorney General, Legal Services Section - Juneau, Criminal Division, Department of Law (DOL), in response to Representative Gardner's previous question regarding the dispute of the Municipality of Anchorage, said she cannot answer whether or not the proposed legislation would prohibit that kind of exchange of information from state to municipality. She explained that her focus on the bill has been on Article 6. REPRESENTATIVE LeDOUX, referring to Article 6 and the declaration of factual innocence, asked what would happen if the perpetrator is never found. She questioned why someone who is innocent would not have any recourse. [CHAIR OLSON turned the gavel over to Vice Chair Neuman.] MS. CARPENETI interpreted the proposed AS 45.48.600 as not addressing that particular situation. She asked Representative LeDoux if she could use a particular incident as an example. REPRESENTATIVE LeDOUX clarified that she is talking about someone who has had his/her identity stolen, whose credit rating is "all screwed up." MS. CARPENETI said she is unclear as to how Article 6 would function. She said: The way it's drafted now, I think it requires that the ... thief who took the identity would have to have some connection with the criminal justice system. MS. CARPENETI referred to language in the original bill version, [which is found in Version C, on page 25, lines 24-31, through page 26, line 1, and which read as follows]: Sec. 45.48.600. Factual declaration of innocence after identity theft. (a) A victim of identity theft may petition the superior court for a determination that the victim is factually innocent of a crime if (1) the perpetrator of the identity theft was arrested for, cited for, or convicted of the crime using the victim's identity; (2) a criminal complaint was filed against the perpetrator of the identity theft; (3) the victim's identity was mistakenly associated with a record of a conviction for a crime. MS. CARPENETI noted that there is no use of the word "or" or "and" between [paragraphs (1), (2), and (3)]. She said she thinks the word "or" should be there [between paragraphs (2) and (3)]. REPRESENTATIVE GARA confirmed that is correct. He added, "And therefore you could get a factual declaration of innocence, even if they didn't find the perpetrator, as long as the court determined that the victim's identity was mistaken and that they were not the thief." He clarified that the word "or" should appear after "theft;" on page 25, line 30, of Version C. REPRESENTATIVE LeDOUX proffered: Suppose it's just some poor guy, as it usually is. He's got his credit report screwed up, because somebody has stolen his identity. Why does somebody have had to have been convicted of a crime or [had a] criminal complaint filed against him, or anything like that? Why don't we just let these people prove that they are factually innocent? 4:47:28 PM MS. CARPENETI responded as follows: That may be a procedure that you would want to consider, but this particular procedure deals with how a person would approach ... a situation where the identity theft has been convicted and there's a record of the conviction. I think you might be talking about another procedure to ... get your credit report cleared, even if there's no conviction or any criminal activity that you can prove. REPRESENTATIVE LeDOUX asked, "Why wouldn't we have it all in one fell swoop ...?" REPRESENTATIVE GARA said this provision is in other states' bills, which is why he cannot explain the policy call. However, he suggested asking Ms. Hildebrand for an explanation. He continued: The one thing I do know is ... these are the kinds of mistakes that you can go to a court in a summary fashion, with affidavits [and] paperwork and get a very quick order on. ... These are issues of ... mistaken conviction [and] mistaken identity, and you want to clear your name up very quickly. You can do that on a form from the court or you can do it with affidavits, and this is a procedure to come up with that very quick declaration. You're talking about a much more complex situation which might also occur, where somehow your name has been associated with a criminal act - maybe somehow the credit reporting agency has found out about it, [and] they haven't found the perpetrator - and I don't know what the procedure would be for something like that. REPRESENTATIVE LeDOUX said she thought the initial discussion of the bill indicated that its intent was to make it possible for someone to clear his/her name when his/her credit report is sullied by someone else. 4:50:16 PM REPRESENTATIVE GARA asked Ms. Hildebrand if she would confirm whether there is already a procedure that exists for a person to clear up his/her credit report and how that is distinct from the proposed provision. MS. HILLEBRAND stated: This was copied from a number of other state laws; it deals with a very specific type of identity theft called, "criminal identity theft." This is where it's not just that the person may or may not have opened accounts in your name; the person's arrested for a crime and gives your name instead of their own. Your name goes into an arrest database, a warrant database, perhaps, and the next time you have a traffic violation you spend the night in jail. MS. HILLEBRAND indicated that [Article 6] was designed not to deal with all kinds of identity theft or all the problems relating to civil identity theft, but to address the situation outlined in [paragraph (1), text provided previously]. She continued: There are two individuals; there's a real crime; there's a real criminal; but that criminal has given an innocent person's name. And the idea here is for the innocent person, in that situation, to go to court and show quickly, "This is me; I'm not the crook; give me a piece of paper so I don't have to spend the night in jail every time I get pulled over." And that's what this is designed for, and that's why it's so narrowly tied to the criminal system. MS. HILLEBRAND, in response to Representative Gara, confirmed that the word missing after "theft;", on page 25, line 30, is "or". [VICE CHAIR NEUMAN returned the gavel to Chair Olson.] 4:52:15 PM CHAIR OLSON closed public testimony. CHAIR OLSON announced that HB 65 was heard and held.
| Document Name | Date/Time | Subjects |
|---|