HOUSE BILL NO. 65 An Act relating to breaches of security involving personal information, credit report and credit score security freezes, consumer credit monitoring, credit accuracy, protection of social security numbers, care of records, disposal of records, identity theft, furnishing consumer credit header information, credit cards, and debit cards, and to the jurisdiction of the office of administrative hearings; amending Rule 60, Alaska Rules of Civil Procedure; and providing for an effective date. REPRESENTATIVE JOHN COGHILL, SPONSOR, commented on the amendments to the work draft \L version, previously adopted by the Committee on 2/13/08. He mentioned the need for discussion, whether to keep the Permanent Fund reporting inclusion. He preferred leaving it out of the bill. Representative Coghill referenced Amendment 1, the risk harm component of reporting located on Page 4, Line 3, which creates a new subsection. 3:08:37 PM Co-Chair Meyer MOVED to ADOPT Amendment 1. (Copy on File). Representative Hawker OBJECTED. Page 4, after Line 3, inserting a new subsection (c) "Notwithstanding (a) of this section, notification is not required, if after an appropriate investigation or after consultation with relevant federal, state, or local agencies responsible for law enforcement, the person or government entity determines that no reasonable likelihood of harm to the consumers whose personal information has been acquired has resulted or will result from the breach. Such a determination must be documented in writing and the documentation must be maintained for five years." Page 14, Line 28, after "discovering", inserting "or notification of". Representative Coghill explained the proposed language would address concerns with a breach of information, maintaining a notification requirement. Notification could attempt to balance risk and harm. The amendment clarifies the risk assessment. There has been an attempt to provide reasonable effort when information has been compromised. He voiced support for the amendment. 3:11:43 PM Representative Hawker concurred with the appropriateness associated with the risk of harm provision. He cautioned that the language does not accomplish the intent. One of two things which must occur is an appropriate investigation or a consultation with the agency. He was not sure what "an appropriate investigation" was or who would make that determination; the burden of decision will be vested to the information provider. 3:14:12 PM Representative Gara thought that language stipulates a "good neighbor" aspect. The bill indicates that it is mandatory to tell. The companies came forward saying that they do not want to always tell; if a decision is made, no one gets the information. Representative Gara offered three choices: · If personal privacy is violated, they must be informed. · The companies want a standard indicating that if the person finds out that their information has been breeched and determine that they have been harmed, then the company has to notify them. He commented, the consumer might never find that out. · Middle ground: If the company determines that the information was accidentally released and no one will ever see it, as long as it is documented, they would not have to send out the notices. Representative Gara supported Amendment 1, which he thought would provide reasonable middle ground. Representative Coghill added, it would accompany acquisition of information. He differed from ideas of Representative Gara regarding the companies' responsibility during the assessment process. He realized the risk in information taken, which requires an investigation and consultation with the enforcers. There also would be a need for the reasonable likelihood of harm, which is the standard language. 3:17:10 PM Representative Coghill pointed out that Section B provides a similar standard making exposure of time possible without unreasonable delay. There are ways to determine that the companies did not take reasonable efforts; i.e., soft standards. Representative Hawker WITHDREW his OBJECTION to Amendment 1. There being NO further OBJECTION, Amendment 1 was adopted. 3:19:31 PM Representative Gara MOVED to ADOPT Amendment 2, #25- LS0311\L.3, Bannister, 2/18/08. (Copy on File). Co-Chair Meyer OBJECTED. Page 6, Line 16, following "however" inserting "(1)"; Page 6, Line 19, following "$50,000", inserting "; and (2) damages that may be awarded against the information collector under (A) AS 45.50.5311 are limited to actual economic damages that do not exceed $500; and (B) AS 45.50.537 are limited to actual economic damages". Representative Gara advised that there had been concerns regarding the actual economic damages. Legislative Legal wrote the bill to clarify that the person could not receive non-economic damages, however, left out the limitation needed on Page 6. Co-Chair Meyer WITHDREW his OBJECTION. There being NO further OBJECTION, Amendment 2 was adopted. 3:20:14 PM Representative Nelson MOVED to ADOPT Amendment 3, #25- LS0311\K.2, Bannister, 2/07/08. (Copy on File). Representative Hawker OBJECTED. Page 1, Line 1, deleting "the disclosure of permanent fund dividend applicant records,"; Page 2, Line 4 through Page 3, Line 18, deleting all material and then renumber the following bill sections accordingly: Page 29, Line 17, deleting "sec. 5", inserting "sec. 3"; Page 29, Line 21, deleting "sec. 5", inserting "sec. 3"; Page 29, Line 24, deleting "sec. 5", inserting "sec. 3"; Page 29, Line 26, deleting "sec. 6", inserting "sec. 4". Representative Nelson commented that the Permanent Fund Dividend (PFD) application being distributed to business owners was counter-intuitive to the bill. She maintained that Alaska should not need be in the business of distributing personal information. Vice-Chair Stoltze added that the amendment seeks to return the State to the policy of privacy for dividend application information; he did not think the request should be stuck inside a privacy bill and recommended other avenues for delivery by considered. He mentioned concerns expressed by victims of domestic violence. He thought that would be a worthy discussion. Representative Hawker indicated his opposition to Amendment 3, which seeks to remove language added in the House Judiciary Committee following extensive discussion. He reiterated that it would be inappropriate to treat the two databases of the registered voters in a different manner than the Permanent Fund database. There was language added placing an appropriate sidebar around access and utilization of that data. He encouraged that the Committee consider the protection of individuals as well as presumptive evidence. He wanted to see the language of the bill preserved. 3:25:15 PM Vice-Chair Stoltze stated that the information on the Permanent Fund Dividend (PFD) is the most current by necessity. It is not as common to update information on one's driver's license or voter registration card because the nature of the dividend is that applicants want to receive their checks. He maintained the need for extra effort to protect individuals. 3:26:38 PM A roll call vote was taken on the MOTION to ADOPT Amendment 3. IN FAVOR: Nelson, Stoltze, Thomas, Gara OPPOSED: Hawker, Kelly, Meyer Representatives Joule, Crawford, Harris and Chenault were not present for the vote. The MOTION FAILED (4-3). Representative Nelson requested the amendment be HELD for RESCIND at the next meeting, when enough members are present. Representative Thomas asked if the social security numbers listed in the PFD information, would be distributed. Co- Chair Meyer remembered that was optional information. Representative Nelson pointed out that Representative Coghill has sponsored numerous pieces of legislation attempting to protect individual's social security numbers. Representative Hawker requested clarifying testimony from authorities. 3:29:07 PM Representative Hawker MOVED to ADOPT Amendment 4, #25- LS0311\K.1, Bannister, 1/20/08. (Copy on File). Representative Nelson OBJECTED. Page 2, Line 22, following "information" inserting "except applicant information about individuals who are under 18 years of age". Representative Hawker explained that the amendment provides language determined by the Department of Revenue and another interested party's to resolve concerns of access of children's information. He understood that the Department of Revenue fully supports the amendment. Representative Kelly asked if the sponsor was in supported the amendment. Representative Coghill affirmed. Representative Nelson WITHDREW her OBJECTION. There being NO further OBJECTION, it was adopted. 3:30:22 PM Representative Gara recommended that Amendment 3 be addressed on the House Floor. Representative Nelson did not agree, maintaining her request. Representative Kelly anticipated an answer to the social security question relative to Amendment 3. Representative Coghill recommended that the Permanent Fund Dividend representative address that issue. 3:31:57 PM JERRY BURNETT, DIRECTOR, DIVISION OF ADMINISTRATIVE SERVICES, DEPARTMENT OF REVENUE, responded to the query regarding whether or not social security numbers could be released with PFD information under the bill as written. The answer is that the bill limits information to only names and addresses not social security numbers. There is a limitation in the bill regarding what applicant information can be distributed. HB 65 was HELD in Committee for further consideration.