Identity theft protection.

WORKING DRAFT
2007
STATE OF
WYOMING
07LSO-0053

SENATE FILE
NO.
SF0065

Identity theft protection.

Sponsored by:
Senator(s) Johnson and Case

A BILL

for

AN ACT relating to consumer protection; providing for notice to consumers affected by breaches of consumer information databases, as specified; authorizing consumers to prohibit release of information maintained by credit rating agencies, as specified; providing definitions; providing exceptions; and providing for an effective date.

Be It Enacted by the Legislature of the State of
Wyoming
:

Section 1.

W.S. 40
‑
12
‑
501 through 40
‑
12
‑
50
4
are created to read:

ARTICLE 5
CONSUMER DATABASES

40
‑
12
‑
501.

Definitions.

(a)

For purposes of this article:

(i)

"Breach of the security of the data system" means unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of personal identifying information maintained by the person or business and causes or is reasonably believed to cause loss or injury to a resident of this state. Good faith acquisition of personal identifying information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the data system, provided that the personal identifying information is not used or subject to further unauthorized disclosure;

(ii)

"Consumer" means any person who is utilizing or seeking credit for personal, family or household purposes;

(iii)

"Credit rating agency" means
any person whose business is the assembling and evaluating of information as to the credit standing and credit worthiness of a consumer, for the purposes of furnishing credit reports, for monetary fees and dues to third parties;

(iv)

"Credit report" means
any written or oral report, recommendation or representation of a credit rating agency as to the credit worthiness, credit standing or credit capacity of any consumer, and includes any information which is sought or given for the purpose of serving as the basis for determining eligibility for credit to be used primarily for personal, family or household purposes;

(v)

"Creditor" means as defined in W.S. 26
‑
21
‑
102(a)(iii);

(vi)

"Personal identifying information" means as defined in W.S. 6
‑
3
‑
901(b);

(vii)

"Security freeze" means a notice placed in a consumer's credit report, at the request of the consumer, that prohibits the credit rating agency from releasing the consumer's credit report or any information from it without the express authorization of the consumer;

(viii)

"Substitute notice" means:

(A)

An electronic mail notice when the person or business has an electronic mail address for the subject persons;

(B)

Conspicuous posting of the notice on the website page of the person or business if the person or business maintains one; or

(C)

Publication in applicable local or statewide media.

40
‑
12
‑
502.

Computer security breech; notice to affected persons.

(a)

Any person or business that conducts business in this state and that owns or licenses a computerized database that stores personal identifying information shall disclose any breach of the security of the data system following discovery or notification of the breach to any person whose unencrypted personal identifying information was or is reasonably believed to have been acquired by an unauthorized person. The disclosure shall be made without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subsection (c) of this section, or consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

(b)

Any person or business that maintains computerized data that includes personal identifying information that the person or business does not own shall notify the owner or licensee of the information of any breach of the security of the data system immediately following discovery if the personal identifying information was or is reasonably believed to have been acquired by an unauthorized person.

(c)

The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation and requests a delay in notification. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.

(d)

Notice required by this section may be provided by one (1) of the following methods:

(i)

Written notice;

(ii)

Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures pursuant to 15 U.S.C. § 7001;

(iii)

Telephone notice;

(iv)

If the person or business maintains a written policy for the treatment of personal identifying information in the event of a security breach and notice to affected persons is given as provided in the policy and not unreasonably delayed; or

(v)

Substitute notice, if the person or business demonstrates that:

(A)

The cost of providing notice to all affected persons would exceed two hundred fifty thousand dollars ($250,000.00);

(B)

The number of persons affected by the breach of the security of the data system exceeds five hundred thousand (500,000); or

(C)

The person or business does not have sufficient contact information.

40
‑
12
‑
503.

Security freeze.

(a)

Any consumer may submit a written request, by certified mail or another secure method as authorized by a credit rating agency, to a credit rating agency to place a security freeze on the consumer's credit report. The credit rating agency shall place a security freeze on a consumer's credit report not later than five (5) business days after receipt of the request from the consumer. Not later than ten (10) business days after placing a security freeze on a consumer's credit report, a credit rating agency shall send a written confirmation of the security freeze to the consumer that provides the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of the consumer's report to a third party or for a period of time.

(b)

In the event a consumer, while a security freeze as provided in subsection (a) of this section is in effect, wishes to authorize the disclosure of the consumer's credit report to a third party, or for a period of time, the consumer shall contact the credit rating agency and provide proper identification, the unique personal identification number or password described in subsection (a) of this section and proper information regarding the third party who is to receive the credit report or the time period for which the credit report shall be available. Any credit rating agency that receives a request from a consumer pursuant to this section shall lift the security freeze not later than three (3) business days after receipt of the request.

(c)

Except for the temporary lifting of a security freeze as provided in subsection (b) of this section, any security freeze authorized pursuant to the provisions of this section shall remain in effect until the consumer requests the security freeze to be removed. A credit rating agency shall remove a security freeze not later than three (3) business days after receipt of the request provided the consumer provides proper identification to the credit rating agency and the unique personal identification number or password described in subsection (a) of this section at the time of the request for removal of the security freeze.

(d)

Any credit rating agency may develop procedures to receive and process a request from a consumer to temporarily lift or remove a security freeze on a credit report pursuant to subsection (b) of this section. The procedures shall include, but not be limited to, the ability of a consumer to send a temporary lift or removal request by electronic mail, letter or facsimile.

(e)

In the event that a third party requests access to a consumer's credit report in connection with an application for credit or any other use and the consumer has not authorized the disclosure of the consumer's credit report to that third party, the third party may deem the credit application incomplete.

(f)

A credit rating agency may refuse to implement or may remove a security freeze if the agency believes in good faith that the request for a security freeze was made as part of a fraud that the consumer participated in, had knowledge of, or that can be demonstrated by circumstantial evidence, or that the consumer credit report was frozen due to a material misrepresentation of fact by the consumer. In the event a rating agency refuses to implement or removes a security freeze pursuant to this subsection, the credit rating agency shall promptly notify the consumer in writing of the refusal not later than five (5) business days after the refusal or, in the case of a removal of a security freeze, prior to removing the freeze on the consumer's credit report.

(g)

Nothing in this section shall be construed to prohibit disclosure of a consumer's credit report to:

(i)

A person, or the person's subsidiary, affiliate, agent or assignee with which the consumer has or, prior to assignment, had an account, contract or debtor-creditor relationship for the purpose of reviewing the account for account maintenance, monitoring, credit line increases and account upgrades and enhancements or collecting the financial obligation owing for the account, contract or debt;

(ii)

A subsidiary, affiliate, agent, assignee or prospective assignee of a person to whom access has been granted under subsection (b) of this section for the purpose of facilitating the extension of credit or other permissible use;

(iii)

Any person acting pursuant to a court order, warrant or subpoena;

(iv)

Any person for the purpose of using the credit information to prescreen as provided by the federal Fair Credit Reporting Act;

(v)

Any person for the sole purpose of providing a credit file monitoring subscription service to which the consumer has subscribed;

(vi)

A credit rating agency for the sole purpose of providing a consumer with a copy of his credit report upon the consumer's request; or

(vii)

A federal, state or local governmental entity, including a law enforcement agency, or court, or their agents or assignees pursuant to their statutory or regulatory duties.

(h)

The following persons shall not be required to place a security freeze on a consumer's credit report, provided those persons shall be subject to any security freeze placed on a credit report by another credit rating agency:

(i)

A check services or fraud prevention services company that reports on incidents of fraud or issues authorizations for the purpose of approving or processing negotiable instruments, electronic fund transfers or similar methods of payment;

(ii)

A deposit account information service company that issues reports regarding account closures due to fraud, substantial overdrafts, automated teller machine abuse, or similar information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution; or

(iii)

A credit rating agency that acts only to resell credit information by assembling and merging information contained in a database of one (1) or more credit reporting agencies and does not maintain a permanent database of credit information from which new credit reports are produced.

(j)

A credit rating agency may charge a fee of not more than ten dollars ($10.00) to a consumer for each placement, removal or temporary lift of a security freeze for a period of time, and a fee of not more than twelve dollars ($12.00) for a temporary lift of a freeze for a specific party.

(k)

An insurer, as defined in W.S. 26
‑
1
‑
102(a)(xvi), may deny an application for insurance if an applicant has placed a security freeze on the applicant's credit report and fails to authorize the disclosure of the applicant's credit report to the insurer as provided in subsection (b) of this section.

40
‑
12
‑
504.

Violations; penalties.

(a)

A person required to provide notification under W.S. 40
‑
12
‑
502 who fails to provide notification or a credit rating agency required to place a security freeze under W.S. 40
‑
12
‑
503 who fails to properly place a security freeze under that section may be liable in a civil action for:

(i)

A civil penalty in an amount not to exceed ten thousand dollars ($10,000.00) for each violation plus any damages available under other civil laws; and

(ii)

Reasonable expenses, court costs, investigative costs and attorney's fees.

Section 2.

This act is effective July 1, 2007.

(END)

1
SF0065