NO. 155. AN ACT RELATING TO IDENTITY THEFT.
It is hereby enacted by the General Assembly of the State of Vermont:
Sec. 1. 9 V.S.A. § 2480a is amended to read:
§ 2480a. DEFINITIONS
For purposes of this subchapter:
* * *
(4) “Identity theft” means the unauthorized use of another person’s personal identifying information to obtain credit, goods, services, money, or property.
“Investigative credit report” means a report in which information on a
consumer’s character, general reputation, personal characteristics, or mode of
living is obtained through personal interviews with neighbors, friends, or
associates of the consumer reported on or with others with whom the consumer is
acquainted or who may have knowledge concerning any such items of information.
The term does not include reports of specific factual information on a
consumer’s credit record obtained directly from a creditor of the consumer or
from a credit reporting agency when such information was obtained directly from
a creditor of the consumer or from the consumer.
(6) “Proper identification,” as used in this subchapter, means that information generally deemed sufficient to identify a person.
(7) “Security freeze” means a notice placed in a credit report, at the request of the consumer who is a victim of identity theft, pursuant to section 2480h of this title.
Sec. 2. 9 V.S.A. § 2480b is amended to read:
§ 2480b. DISCLOSURES TO CONSUMERS
* * *
(c) Any time a credit reporting agency is required to make a written disclosure to consumers pursuant to 15 U.S.C. § 1681g, it shall disclose, in at least 12 point type, and in bold type as indicated, the following notice:
NOTICE TO VERMONT CONSUMERS
* * *
(3) If you believe a law regulating consumer credit reporting has been violated, you may file a complaint with the Vermont Attorney General’s Consumer Assistance Program, 104 Morrill Hall, University of Vermont,
Burlington, Vermont 05405.
Telephone number (800)
649-2424 or, in Chittenden County , 649-2424.”
Vermont Consumers Who Are Victims of Identity Theft
Have the Right to Obtain a Security Freeze
You may obtain a security freeze on your credit report at no charge if you are a victim of identity theft and you submit a copy of a police report, investigative report or complaint you have filed with a law enforcement agency about unlawful use of your personal information by another person. You have a right to place a “security freeze” on your credit report pursuant to 9 V.S.A.
§ 2480h. The security freeze will prohibit a credit reporting agency from releasing any information in your credit report without your express authorization. A security freeze must be requested in writing by certified mail.
The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gains access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding new loans, credit, mortgage, insurance, government services or payments, rental housing, employment, investment, license, cellular phone, utilities, digital signature, internet credit card transaction, or other services, including an extension of credit at point of sale.
When you place a security freeze on your credit report, within ten business days you will be provided a personal identification number or password to use if you choose to remove the freeze on your credit report or authorize the release of your credit report for a specific party, parties or period of time after the freeze is in place. To provide that authorization, you must contact the credit reporting agency and provide all of the following:
(1) The unique personal identification number or password provided by the credit reporting agency.
(2) Proper identification to verify your identity.
(3) The proper information regarding the third party or parties who are to receive the credit report or the period of time for which the report shall be available to users of the credit report.
A credit reporting agency that receives a request from a consumer to lift temporarily a freeze on a credit report shall comply with the request no later than three business days after receiving the request.
A security freeze does not apply to a person or entity, or its affiliates, or collection agencies acting on behalf of the person or entity with which you have an existing account that requests information in your credit report for the purposes of reviewing or collecting the account, provided you have previously given your consent to this use of your credit reports. Reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.
You have a right to bring a civil action against someone who violates your rights under the credit reporting laws. The action can be brought against a credit reporting agency or a user of your credit report.”
* * *
(e) The attorney general may revise this required notice by rule as appropriate from time to time so long as no new substantive rights are created therein.
Sec. 3. 9 V.S.A. § 2480h-2480n are added to read:
§ 2480h. SECURITY FREEZE BY CREDIT REPORTING AGENCY; TIME
(a) A consumer who has been the victim of identity theft may place a security freeze on his or her credit report by making a request in writing by certified mail to a credit reporting agency with a valid copy of a police report, investigative report, or complaint the consumer has filed with a law enforcement agency about unlawful use of his or her personal information by another person. A credit reporting agency shall not charge a fee for placing, removing, or removing for a specific party or parties a security freeze on a credit report. A security freeze shall prohibit, subject to the exceptions in subsection (l) of this section, the credit reporting agency from releasing the consumer’s credit report or any information from it without the express authorization of the consumer. When a security freeze is in place, information from a consumer’s credit report shall not be released to a third party without prior express authorization from the consumer. This subsection does not prevent a credit reporting agency from advising a third party that a security freeze is in effect with respect to the consumer’s credit report.
(b) A credit reporting agency shall place a security freeze on a consumer’s credit report no later than five business days after receiving a written request from the consumer.
(c) The credit reporting agency shall send a written confirmation of the security freeze to the consumer within 10 business days and shall provide the consumer with a unique personal identification number or password, other than the customer’s Social Security number, to be used by the consumer when providing authorization for the release of his or her credit for a specific party, parties, or period of time.
(d) If the consumer wishes to allow his or her credit report to be accessed for a specific party, parties, or period of time while a freeze is in place, he or she shall contact the credit reporting agency, request that the freeze be temporarily lifted, and provide the following:
(1) Proper identification.
(2) The unique personal identification number or password provided by the credit reporting agency pursuant to subsection (c) of this section.
(3) The proper information regarding the third party, parties, or time period for which the report shall be available to users of the credit report.
(e) A credit reporting agency may develop procedures involving the use of telephone, fax, the internet, or other electronic media to receive and process a request from a consumer to temporarily lift a freeze on a credit report pursuant to subsection (d) of this section in an expedited manner.
(f) A credit reporting agency that receives a request from a consumer to lift temporarily a freeze on a credit report pursuant to subsection (d) of this section shall comply with the request no later than three business days after receiving the request.
(g) A credit reporting agency shall remove or temporarily lift a freeze placed on a consumer’s credit report only in the following cases:
(1) Upon consumer request, pursuant to subsection (d) or (j) of this section.
(2) If the consumer’s credit report was frozen due to a material misrepresentation of fact by the consumer. If a credit reporting agency intends to remove a freeze upon a consumer’s credit report pursuant to this subdivision, the credit reporting agency shall notify the consumer in writing prior to removing the freeze on the consumer’s credit report.
(h) If a third party requests access to a credit report on which a security freeze is in effect and this request is in connection with an application for credit or any other use and the consumer does not allow his or her credit report to be accessed for that specific party or period of time, the third party may treat the application as incomplete.
(i) If a consumer requests a security freeze pursuant to section 2480h of this title, the credit reporting agency shall disclose to the consumer the process of placing and temporarily lifting a security freeze and the process for allowing access to information from the consumer’s credit report for a specific party, parties, or period of time while the security freeze is in place.
(j) A security freeze shall remain in place until the consumer requests that the security freeze be removed. A credit reporting agency shall remove a security freeze within three business days of receiving a request for removal from the consumer who provides both of the following:
(1) Proper identification.
(2) The unique personal identification number or password provided by the credit reporting agency pursuant to subsection (c) of this section.
(k) A credit reporting agency shall require proper identification of the person making a request to place or remove a security freeze.
(l) The provisions of this section, including the security freeze, do not apply to the use of a consumer report by the following:
(1) A person, or the person’s subsidiary, affiliate, agent, or assignee with which the consumer has or, prior to assignment, had an account, contract, or debtor-creditor relationship for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or debt, or extending credit to a consumer with a prior or existing account, contract, or debtor-creditor relationship, subject to the requirements of section 2480e of this title. For purposes of this subdivision, “reviewing the account” includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.
(2) A subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted under subsection (d) of this section for purposes of facilitating the extension of credit or other permissible use.
(3) Any person acting pursuant to a court order, warrant, or subpoena.
(4) The office of child support when investigating a child support case pursuant to Title IV-D of the Social Security Act (42 U.S.C. et seq.) and section 4102 of Title 33.
(5) The department of prevention, assistance, transition, and health access or its agents or assignee acting to investigate Medicaid fraud.
(6) The department of taxes, municipal taxing authorities, or the department of motor vehicles or any of their agents or assignees, acting to investigate or collect delinquent taxes or assessments, including interest and penalties, unpaid court orders, or to fulfill any of their other statutory or charter responsibilities.
(7) A person’s use of credit information for the purposes of prescreening as provided by the federal Fair Credit Reporting Act.
(8) Any person for the sole purpose of providing a credit file monitoring subscription service to which the consumer has subscribed.
(9) A credit reporting agency for the sole purpose of providing a consumer with a copy of his or her credit report upon the consumer’s request.
§ 2480i. CREDIT REPORTING AGENCY DUTIES IF SECURITY FREEZE
If a security freeze is in place, a credit reporting agency shall not change any of the following official information in a credit report without sending a written confirmation of the change to the consumer within 30 days of the change being posted to the consumer’s file: name, date of birth, Social Security number, and address. Written confirmation is not required for technical modifications of a consumer’s official information, including name and street abbreviations, complete spellings, or transposition of numbers or letters. In the case of an address change, the written confirmation shall be sent to both the new address and the former address.
§ 2480j. PERSONS NOT REQUIRED TO PLACE SECURITY FREEZE
The following persons are not required to place in a credit report a security freeze, pursuant to section 2480h of this title; provided, however, that any person that is not required to place a security freeze on a credit report under the provisions of subdivision (3) of this section shall be subject to any security freeze placed on a credit report by another credit reporting agency from which it obtains information:
(1) A check services or fraud prevention services company, which reports on incidents of fraud or issues authorizations for the purpose of approving or processing negotiable instruments, electronic fund transfers, or similar methods of payment.
(2) A deposit account information service company, which issues reports regarding account closures due to fraud, substantial overdrafts, ATM abuse, or similar negative information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution.
(3) A credit reporting agency that:
(A) acts only to resell credit information by assembling and merging information contained in a database of one or more credit reporting agencies; and
(B) does not maintain a permanent database of credit information from which new credit reports are produced.
§ 2480k. COMPLAINTS TO LAW ENFORCEMENT AGENCIES
A person who has learned or reasonably suspects that his or her personal identifying information has been unlawfully used by another, as described in subsection 2029(a) of Title 13, may make a complaint about the unlawful use of personal identifying information to the state police or to the person’s local law enforcement agency. The law enforcement agency shall take the complaint and provide the complainant with a copy of the complaint, the name of the law enforcement officer taking the complaint, and an incident number or case number assigned to the complaint by the law enforcement agency. If the suspected crime was committed in a different jurisdiction, the law enforcement agency shall take the complaint and provide the complainant with a copy of the complaint, the name of the law enforcement officer taking the complaint, and an incident number or case number assigned to the complaint by the law enforcement agency and refer the complaint to a law enforcement agency in that different jurisdiction.
§ 2480l. VERIFICATION OF CHANGE OF CONSUMER’S ADDRESS
FOR PREAPPROVED OFFERS OF CREDIT
A credit card issuer that mails an offer or solicitation to receive a credit card and, in response, receives a completed application for a credit card that lists an address that is substantively different from the address on the offer or solicitation shall make a commercially reasonable attempt to verify the change of address, which may include checking addresses on other open accounts.
§ 2480m. LIMITATIONS ON USE OF SOCIAL SECURITY NUMBERS
Prior to posting or requiring the posting of a document in a place of general public circulation, an agency, board, department, commission, committee, branch, instrumentality, or authority of the state or an agency, board, committee, department, branch, instrumentality, commission or authority of any political subdivision of the state shall take all reasonable steps to redact any Social Security numbers from the document. Files and records made available to the public in accordance with and pursuant to 24 V.S.A. § 1165 are not considered posted in a place of general public circulation for the purposes of this section.
§ 2480n. CREDIT REPORT FILES OF DECEASED PERSONS
(a) An executor, administrator, or other person authorized to act on behalf of an estate of a deceased person may request that a credit reporting agency indicate on the deceased person's credit reporting file that the person is deceased. The credit reporting agency shall indicate on the deceased person's credit reporting file that the person is deceased within five business days of receipt of the following documentation from the executor, administrator or other person authorized to act on behalf of the estate of the deceased person:
(1) a certificate of death, or a certificate of appointment, letters testamentary, or other order from the probate court authorizing the executor, administrator, or other person to act on behalf of the estate of the deceased person; and
(2) a request to indicate on the deceased person's credit reporting file that the person is deceased.
(b) The credit reporting agency may remove the indication placed on the person's file pursuant to subsection (a) of this section if the credit reporting agency finds that the indication was placed on the person's file through material misrepresentation of fact. If the credit reporting agency intends to remove the indication pursuant to this subsection, the credit reporting agency shall notify the executor, administrator, or other person authorized to act on behalf of the estate in writing prior to removing the indication.
Sec. 4. 13 V.S.A. § 2030 is added to read:
§ 2030. IDENTITY THEFT
(a) No person shall obtain, produce, possess, use, sell, give, or transfer personal identifying information belonging or pertaining to another person with intent to use the information to commit a misdemeanor or a felony.
(b) No person shall knowingly or recklessly obtain, produce, possess, use, sell, give, or transfer personal identifying information belonging or pertaining to another person without the consent of the other person and knowingly or recklessly facilitating the use of the information by a third person to commit a misdemeanor or a felony.
(c) For the purposes of this section, “personal identifying information” includes name, address, birth date, Social Security number, motor vehicle personal identification number, telephone number, financial services account number, savings account number, checking account number, credit card number, debit card number, picture, identification document or false identification document, electronic identification number, educational record, health care record, financial record, credit record, employment record, e-mail address, computer system password, or mother’s maiden name, or similar personal number, record, or information.
(d) This section shall not apply when a person obtains the personal identifying information belonging or pertaining to another person to misrepresent the person’s age for the sole purpose of obtaining alcoholic beverages, tobacco, or another privilege denied based on age.
(e) It shall be an affirmative defense to an action brought pursuant to this section, to be proven by a preponderance of the evidence, that the person had the consent of the person to whom the personal identifying information relates or pertains.
(f) A person who violates this section shall be imprisoned for not more than three years or fined not more $5,000.00, or both. A person who is convicted of a second or subsequent violation of this section involving a separate scheme shall be imprisoned for not more than ten years or fined not more than $10,000.00, or both.
Sec. 5. STUDY; REPORT
(a) The agency of administration with the cooperation of the attorney general’s office, the department of health, the agency of human services, and the agency of commerce and community development and with solicited participation from the Vermont League of Cities and Towns and any other interested affected parties shall study the use of Social Security numbers by both public and private entities and develop proposals for reducing such use wherever possible and protecting privacy and security when the numbers must be used. Prohibiting the following and assessment of the appropriate implementation periods shall be considered along with an investigation of any potential secondary effects:
(1) printing of an individual’s Social Security number on any card required for the individual to access products or services provided by the entity;
(2) requiring that an individual transmit his or her Social Security number over the internet, unless the connection is secure or the Social Security number is encrypted and requiring an individual to use his or her Social Security number to access an internet website, unless a password or unique personal identification number or other authentication device is also required to access the internet website; or
(3) printing of an individual’s Social Security number on any materials that are mailed to the individual, unless state or federal law requires the Social Security number to be on the materials.
(b) The agency shall prepare recommendations and report to the general assembly and the senate committees on judiciary and finance and the house committees on commerce and judiciary on or before January 15, 2005.
Sec. 6. EFFECTIVE DATES
This act shall take effect upon passage, except for Secs. 1, 2, and 3 which shall take effect on July 1, 2005.
Approved: June 8, 2004
The Vermont General Assembly
115 State Street