HB 65-PERSONAL INFORMATION & CONSUMER CREDIT 4:17:48 PM CHAIR OLSON announced that the final order of business would be HOUSE BILL NO. 65, "An Act relating to breaches of security involving personal information, credit report and credit score security freezes, consumer credit monitoring, credit accuracy, protection of social security numbers, care of records, disposal of records, identity theft, furnishing consumer credit header information, credit cards, and debit cards, and to the jurisdiction of the office of administrative hearings; amending Rule 60, Alaska Rules of Civil Procedure; and providing for an effective date." 4:18:02 PM REPRESENTATIVE JOHN COGHILL, Alaska State Legislature, joint prime sponsor, began by explaining that a similar bill was introduced during the previous legislative session. He stated that when personal information is used, whether for-profit or for credit scoring purposes, it should be kept secure. He opined that the rules in Alaska "need to change with the times," adding that the various agencies involved would explain any concerns. He stated that HB 65 addresses when personal information is used, as well as identity theft and the consumer's right to freeze credit. He said that if social security numbers are going to be used, this should be properly protected. He requested that the committee not consider amendments at this time. REPRESENTATIVE NEUMAN questioned how HB 65 will correspond with the ethics issues that the legislature is currently working on. REPRESENTATIVE COGHILL replied that both of these deal with the issue of public trust. With regard to legislators, he stated that Title 24 deals with legislative reporting requirements, which he opined are "justifiable." He explained that HB 65 applies to personal information that is used for credit purposes. He said "I think you're talking about two ... different realms. One of them is going to be about your personal credit history, and one of them is going to be about your disclosure of personal income." He stated that HB 65 creates safeguards for the transfer of personal information. REPRESENTATIVE NEUMAN shared his belief that these two issues overlap. He pointed out that legislators are required to provide the names and addresses of individuals that they work with, and questioned how this information is going to be protected. REPRESENTATIVE COGHILL replied that these two issues may overlap, and requested that any areas be pointed out to him as the bill is discussed. He stated that he is open to discussion; however, at this point he does not know which areas overlap. 4:28:14 PM REPRESENTATIVE LEDOUX questioned whether HB 65 has any impact on other public records that include personal information, such as workers' compensation records or voters registration lists. REPRESENTATIVE COGHILL offered his understanding that there are certain public records within the various departments that would become more secure. However, public lists, such as the voters' registration list, would most likely not be affected. He pointed out that a person's name and address are public record, and most phone numbers are published. He opined that when it comes to information such as social security numbers and credit card numbers, which are sensitive to personal economic well- being, this information should be protected. In regard to workers' compensation information, he noted that this issue is being addressed by a different piece of legislation. He stated that HB 65 addresses process protection issues with regard to social security and credit information. REPRESENTATIVE GARDNER asked whether this would affect how businesses are required to dispose of an applicant's personal information. REPRESENTATIVE COGHILL shared his understanding that credit card information must be disposed of in a certain way, although he does not know how specific the disposal section is. He stated that he would be interested to hear more from the Department of Law (DOL) regarding this issue. REPRESENTATIVE GARDNER questioned whether HB 65 applies to all businesses, or only those that deal with data collection services. REPRESENTATIVE COGHILL replied that certain areas of the bill do apply to all businesses, while other areas apply to those that specifically deal in data collection and distribution. He stated that these businesses are needed, and the intention is to ensure that the "firewalls are very secure." He commented that the electronic transfer of information is common, and stated that barriers need to be in place. He said that insurance companies and banks require this type of information, and pointed out that most of these businesses are regulated under the Gramm-Leach-Bliley Act and the Fair Credit Reporting Act. He said that states are responsible for implementing the rules set forth by these acts, and HB 65 does this. 4:33:30 PM REPRESENTATIVE GARDNER inquired as to the differences between HB 65, and the bill that was introduced during the previous legislative session. REPRESENTATIVE COGHILL explained that HB 65 contains the language that passed the House of Representatives. He stated that any proposed amendments would first be denied, until the various industries have proven that the amendments are necessary. REPRESENTATIVE GARDNER, referring to the fiscal note, pointed out that HB 65, "if enacted in its current form, could result in the imposition of extremely large financial penalties for the state of Alaska," in the event of a security breach. REPRESENTATIVE COGHILL agreed that this is correct, and explained that this is considering the worst case scenario. He stated that the standard should be determined, in order to determine what the consequences of a security breach should be. He commented that it may be costly for the responsible party to notify individuals of a security breach. He said that if a company has good security measures that are "demonstrably secure," he is unsure that the company would be held responsible, adding that if there is a security breach due to a lack of security, the company should be held responsible for this. He stated that while he is open to hearing how the state intends to follow through on this, he is "very unsympathetic." REPRESENTATIVE GATTO asked whether the state would be held liable for an incorrect media representation that referenced statements made by a legislator on the public record. REPRESENTATIVE COGHILL replied that this is outside the scope of HB 65, and clarified that this bill only applies to personal information such as credit and social security information. He stated that the legislature is exempt from slander laws, adding that legislators are "public targets." In response to an additional question, he reiterated that a person's name would not be protected. 4:43:03 PM SENATOR GENE THERRIAULT, Alaska State Legislature, explained that he began working on consumer protection legislation in 2005. Senator Gretchen Guess and Senator Johnny Ellis had introduced similar legislation, and during the interim, the three collaborated on a new piece of legislation, which was introduced in 2006. He explained that due to the debate on gas pipeline issues during the 2006 legislative session, Senator Guess did most of the technical work, and worked with the stakeholders involved. While she was not able to incorporate all concerns and suggestions for alternative language, he opined that the parties affected by the bill were "fairly comfortable" that they had been treated fairly. He agreed that amendments would be denied until adequate explanation is given, and said "I have told representatives of different industry segments ... that ... I want to understand what their concerns with the printed words on the page are. I want to understand what their suggested change is, and I want to understand the reasoning." If the concern is legitimate, a "fix" will be crafted. He expressed hope that the changes would not create loopholes or remove an entire section from the bill, and shared his understanding that industry representatives are willing to engage in this discussion. SENATOR THERRIAULT, in response to an earlier question from Representative Gardner regarding personal employment paperwork, stated that this paperwork is most likely going to contain the individual's social security number and date of birth. He explained that the bill requires that this information be thoroughly disposed of, so that this information cannot be accessed by others. Referring to Page 5, lines 15-16, he stated that this would include a business owner who takes job applications or retains personal information for payroll taxes. It is suggested that this information be kept in a locked file drawer, and if purged, this information should be shredded or burned completely. He then referred to a Dateline NBC program titled "To Catch an ID Thief," and stated that it was startling to see how quickly large bills can be run up, once the personal information is obtained. He commented that Alaska needs to have protection for this information. 4:49:36 PM SENATOR THERRIAULT went on to say that HB 65 is patterned after numerous other states. There are also sections that are "cutting edge," and he opined that these sections may be more objectionable to companies in the data brokerage business. [Chair Olson turned the gavel over to Vice-Chair Neuman] 4:50:46 PM KENTON BRINE, Property Casualty Insurers Association of America (PCI), stated that while PCI is not opposed to HB 65, it does have concerns regarding the sections relating to the credit score security freeze. He said that amendatory language has been submitted to Representative Coghill and Senator Therriault, and expressed hope that the committee would consider amending the bill to allow insurers and other non-lending related businesses to view credit reports that have been frozen. He explained that credit freeze laws began to be enacted in 2003, and the first 6 states did not include specific exemptions. However, in the past year, 20 more states have enacted legislation that allows insurers and businesses that are looking at credit reports for other purposes to have access to frozen credit reports. The PCI believes this makes it easier for employers to complete the job application process, as well as obtaining accurate insurance rate quotes. He stated that PCI is open to working with the House Labor and Commerce Standing Committee to possibly include this language. [Vice-Chair Neuman returned the gavel to Chair Olson] 4:53:27 PM MICHELLE JUN, Staff Attorney, Consumers Union, stated that Consumers Union has worked with Representative Coghill and Senator Therriault, and is in support of HB 65. She said that Consumers Union is "delighted" that the sponsors will remain firm with any amendments that are proposed. In regard to insurance exemptions, she expressed hope that any exemptions are limited to underwriting purposes. 4:54:38 PM STEVE CLEARY, Executive Director, Alaska Public Interest Research Group (AkPIRG), stated that AkPIRG is in support of HB 65, and expressed appreciation for the work done by the sponsors. He went on to say that it is time for Alaska to pass identity theft protection. Referring to a security breach in February of 2005, he pointed out that according to the Privacy Rights Clearinghouse, over 100 million data records of US residents have been exposed due to security breaches since this occurred. The Federal Trade Commission (FTC) has data on identity theft and fraud. In 2005, he said, Alaskans were number one for fraud complaints with the FTC, adding that it cost the average complainant over $1,000. In 2006, Alaskans were number 5, although the price paid per complainant went up to almost $4,000. He stated that identity theft costs consumers and businesses "an incredible amount of money each year." He pointed out the increasing complexity and speed of the technological society, and said that as this increases, so will the complexity of identity thieves. He shared a story regarding a state employee who had her identity stolen while on maternity leave. This resulted in difficulty reestablishing personal identity, in addition to establishing her child's identity. He stated that consumers spend an average of 175 hours trying to reestablish identity. He pointed out that 25 states currently have laws that allow consumers to restrict access to their credit report, which AkPIRG feels is one of the most important aspects of HB 65. Additionally, 34 states require notification of a security breach, which he opined is essential to ensure that consumers' identity is not stolen. He said that while AkPIRG teaches consumers how to protect against identity theft, the state needs to put common sense protections in place to ensure that identity thieves do not have the upper hand. In regard to the certified mail requirement in order to lift the security freeze, he said that generally, states do not have this requirement, although some states do require certified mail to place the freeze. He shared his understanding that Alaska would be unique in this requirement, and expressed concern that this might deter some consumers from taking this step. He reiterated that AkPIRG is in support of HB 65, and would like to see consumers better protected from identity theft in Alaska. 4:59:30 PM PAT LUBY, Advocacy Director, AARP Alaska, stated that AARP is in strong support of HB 65. He said that suggestions based on other states would be sent to Representative Coghill and Senator Therriault; however, AARP Alaska will stay in support of the bill regardless of whether these suggestions are adopted. In regard to the seriousness of identity theft, he stated that individuals who are victims of identity theft have a higher mortality rate than those that are not. In response to Representative Gatto, he stated that he is unsure of the mortality rate of identity thieves. 5:01:02 PM CHAIR OLSON indicated that HB 65 would be held over.