[Title]

Committee: Judiciary

Complete to6-24-08

A SUMMARY OF HOUSE BILLS 6096-6105 AS REPORTED FROM COMMITTEE

6-20-08

Public Act 452 of 2004 created the Identity Theft Protection Act, which among other things made it a felony to use personal identifying information to obtain goods and services without consent. House Bills 6099 and 6101-6105 each amends the Identity Theft Protection Act. The other bills amend different acts to address matters directly related to identity theft.

House Bills 6099-6105 are tie-barred to each other and have an effective date ofNovember 1, 2008.

Restitution

House Bills 6096-6098 each amends a different act to require courts to order restitution in cases where the victims are victims of identity theft. Restitution would be in an amount that compensates the victim in full for the work done by the victim or the victim's attorney, or both, to correct financial records and vital records and to ameliorate the effects of the identity theft on the victim's financial affairs, including credit history, credit rating, or credit score.

House Bill 6096 would amend the Code of Criminal Procedure (MCL 869.1a). House Bill 6097 would amend the William Van Regenmorter Crime Victim Rights Act (MCL 780.754a et al.). House Bill 6098 would amend Chapter XIIA of the Probate Code, which deals with juvenile offenses (MCL 712A.30 et al.). The three bills are tie-barred to one another.

Model Police Report

House Bill 6096 would also specify in the Code of Criminal Procedure that a bona fide victim of identity theft is entitled to file a police report with a law enforcement agency in a jurisdiction where the alleged violation may be prosecuted and would require the Department of State Police to develop a model form of police report of identity theft and make it available to law enforcement agencies and victims of identity theft.

House Bill 6100 would amend the William Van Regenmorter Crime Victim Rights Act (MCL 780.754 et al.). The bill would include a reference to Sections 11 and 13 of the Identity Theft Protection Act in a provision pertaining to the right of victims of ID theft to file a police report and obtain a copy of that report.

Civil Action for Damages

House Bill 6099 would add Section 11a to the Identity Theft Protection Act to allow a victim of identity theft to file a civil action for damages and recover all of the following: actual damages, reasonable attorney fees, and court costs; reimbursement for notifying third parties of the identity theft, reporting identity theft to law enforcement, and correcting personal identifying information or providing other information to third parties required because of the identity theft; and restitution, in an amount that compensates the victim in full for the work done by the victim or the victim's attorney, or both, to correct financial records and vital records and to ameliorate the effects of the identity theft on the victim's financial affairs, including credit history, credit rating, or credit score.

For purposes of the above provision, a person who failed to comply with the prohibitions listed in Sections 5 or 7 of the act while acting in good faith would not be in violation of that section if the compliance failure had not been intentional and resulted from a bona fide error despite the maintenance of procedures reasonably adapted to avoid those errors, and appropriate restitution was made to the victim. A "bona fide error" would include, but not be limited to, a computer malfunction or a clerical, calculation, computer programming, or printing error. An error of legal judgment with respect to a person's obligations under this section would not be a bona fide error.

Misleading Law Enforcement/Courts

House Bill 6101 would amend Section 5 of the Identity Theft and Protection Act (MCL 445.65) to make it an offense to use or attempt to use the personal identifying information of another person to engage in criminal activity or other violations of law or to mislead a law enforcement agency or court concerning the identity of an individual under criminal investigation or a criminal defendant.

Written Identity Theft Prevention Program

House Bill 6102 would add Section 12c to the Identity Theft and Protection Act to require, within 30 days after the bill's effective date, each "qualified person" (certain financial institutions, as described later) to establish a written identity theft prevention program that met all of the following:

· Included reasonable policies and procedures for detecting, preventing, and mitigating identity theft.

· Identified, and detected, specific activities that indicated the possible existence of identity theft and addressed those activities in the program.

· Responded to the activities described above in order to mitigate the adverse effects of identity theft.

· Trained staff to effectively implement the program.

· Ensured that the program was periodically reviewed to identify, detect, and respond to new and emerging practices that increased the risk of identity theft.

A "qualified person" would mean a person that has more than 50 employees and who was engaged in extending credit in the form of covered accounts to state residents. A "covered account" would mean that term as defined in federal rules for financial institutions and creditors found at 16 CFR 681.2. Generally speaking, these are consumer accounts at financial institutions for personal, family, or household purposes. Further, a qualified person that is subject to and complies with the joint final rules and guidelines concerning identity theft red flags and address discrepancies under the federal Fair and Accurate Credit Transactions Act would not be required to establish a written identity theft prevention program as described above.

House Bill 6103 would add Section 12d to the Identity Theft and Protection Act to specify that a person who knowingly violated Section 12c regarding the written identity theft prevention program could be ordered to pay a civil fine of not more than $250 for each violation. The attorney general or a prosecuting attorney could bring an action to recover a civil fine under this provision. The provision would not affect the availability of any civil remedy for a violation of state or federal law.

Identity Theft Protection Commission

House Bill 6104 would add Section 14 to the Identity Theft and Protection Act to establish a nine-member Identity Theft Protection Commission in the Department of Information Technology (DIT). The director of DIT, or a designee, would serve as chair. Other members would be the attorney general (or a designee), director of the Department of State Police (or a designee), the commissioner of the Office of Financial and Insurance Regulation (or a designee), the state treasurer (or a designee), three members of the general public, and a representative of the business committee who was appointed by the governor for a two-year term. The three public members would be appointed to two-year terms, one each by the governor, the Speaker of the House of Representatives, and the Majority Leader of the Senate.

Among other functions, the new commission would, by September 30, 2010: review and provide recommendations to the governor about state rules, guidelines, and procedures related to identity theft protection and prevention; review and provide recommendations about legislation to the legislature; provide recommendations to the public about business practices; provide recommendations to state agencies and departments on reducing the use of Social Security numbers; make recommendations to DIT concerning the design and content of the Identity Theft Information Website; and establish a process for recognizing those with exemplary business practices in identity theft protection and prevention.

Meetings of the commission would be held in accordance with the Open Meetings Act and writings prepared, owned, used, in the possession of, or retained by the commission in the performance of an official function would have to be available to the public in compliance with the Freedom of Information Act. DIT would have to provide staff assistance to the commission as necessary to carry out the commission's duties.

Further, DIT would have to establish and maintain an identity theft information website. The department would have to consider the commission's recommendations in selecting the design and content of the website.

Section 14 would be repealed effectiveDecember 31, 2010.

Destruction of Data

House Bill 6105 would amend provisions of the Identity Theft Protection Act (MCL 445.72a) regarding the destruction of data in a database that includes personal information on multiple individuals. Currently, data containing personal identifying information on an individual is to be destroyed when that data is removed from the database and the person or agency is not retaining the data elsewhere for another purpose. The bill would revise the provision to instead specify that a person or agency that disposed of any data from a database that included any unencrypted, unredacted personal information concerning an individual who was a resident of the state would have to destroy that data when it was removed from the database, unless the person or agency was retaining the data elsewhere for another lawful purpose.

Further, the definition of "destroy" would be revised to mean to destroy or arrange for the destruction of data by shredding, erasing, incinerating, mutilating, or otherwise changing the data so that they cannot be read, deciphered, or reconstructed through generally available means. (Underlining denotes new language.)

BACKGROUND INFORMATION:

In 2004, a package of legislation was enacted on the issue of identity theft. Taken together, the legislation:

o Created the Identity Theft Protection Act to make it a felony to use personal identifying information to obtain goods and services without consent.

o Prohibited businesses from denying credit or public utility service to victims of identity theft and establish penalties for violations.

o Clarified the jurisdiction where ID thefts could be prosecuted.

o Extended the statute of limitations for ID thefts to six years after the crime was committed or the identity of the thief was established.

o Created the Social Security Number Privacy Act to prohibit certain uses of SSNs, established penalties for violations, and provided remedies.

o Established the right of a victim of ID theft to obtain a police report.

o Listed ID theft as an unlawful practice of trade or commerce.

o Prohibited—as an unlawful practice of trade or commerce—issuing receipts containing more than the last four digits of a credit card account.

o Prohibited requiring a consumer to provide an SSN as a condition for doing business.

o Prohibited and created penalties for photographing, recording, or electronically transmitting personal identifying information taken, without consent, from credit, debit, and ATM cards and other devices.

FISCAL IMPACT:

There would be an indeterminate and likely negligible impact on the judiciary; any fiscal impact would come from increased complexity in the caseload brought under the bills. However, House Bill 6103 would have an indeterminate, but likely negligible, fiscal impact on the judiciary due to the possible increase in the caseloads. In addition, it is unclear what fiscal impact the civil fine revenue would have. "Civil fines" are treated differently than "civil infractions," which go to fund public libraries and county law libraries under the Michigan State Constitution of 1963 (Article 8, Section 9). Unless a civil violation is labeled a "civil infraction," it cannot be presumed to be subject to the provisions of the Revised Judicature Act. One could presume that MCL 18.1443 would apply, which states that "[e]xcept as provided by law, all money received by the various state agencies for whom appropriations are made by a budget act shall be forwarded to the state treasurer and credited to the state general fund." However, it is unclear whether civil fines collected amount to "money received." In conclusion, where civil fines are not dedicated to a specific fund, as is the case with HB 6103, the allocation of fine revenue remains unclear.

The bills would have no impact on the Department of State Police since they have already produced a model identity theft police report form.

House Bill 6104 would establish a new commission, the Identity Theft Protection Commission, within the Department of Information Technology. The bill requires the department to reimburse commission members for their actual and necessary expenses and provide the commission with staff assistance as well. These requirements would result in additional costs to the department. The amount of the increase would depend upon a variety of factors, including the scope and magnitude of the commission's activity, the expenses they incur, and the amount of staffing the commission will need to carry out their duties.

Legislative Analyst: Susan Stutzky

Chris Couch

Fiscal Analyst: Ben Gielczyk

Bethany Wicksall

Viola Bay Wild

■ This analysis was prepared by nonpartisan House staff for use by House members in their deliberations, and does not constitute an official statement of legislative intent.