SB-0792, As Passed Senate, December 10, 2003
SUBSTITUTE FOR
SENATE BILL NO. 792
A bill to prohibit certain acts and practices concerning
identity theft; to provide for the powers and duties of certain
state and local governmental officers and entities; to prescribe
penalties and provide remedies; and to repeal acts and parts of
acts.
THE PEOPLE OF THE STATE OF MICHIGAN ENACT:
1 Sec. 1. This act shall be known and may be cited as the
2 "identity theft protection act".
3 Sec. 3. (1) As used in this act:
4 (a) "Credit card" means that term as defined in section 157m
5 of the Michigan penal code, 1931 PA 328, MCL 750.157m.
6 (b) "Depository institution" means a state or nationally
7 chartered bank or a state or federally chartered savings and loan
8 association, savings bank, or credit union.
9 (c) "Financial institution" means a depository institution,
1 an affiliate of a depository institution, a licensee under the
2 consumer financial services act, 1988 PA 161, MCL 487.2051 to
3 487.2072, 1984 PA 379, MCL 493.101 to 493.114, the motor vehicle
4 sales finance act, 1950 (Ex Sess) PA 27, MCL 492.101 to 492.141,
5 the secondary mortgage loan act, 1981 PA 125, MCL 493.51 to
6 493.81, the mortgage brokers, lenders, and servicers licensing
7 act, 1987 PA 173, MCL 445.1651 to 445.1684, or the regulatory
8 loan act of 1963, 1939 PA 21, MCL 493.1 to 493.24, or a seller
9 under the home improvement finance act, 1965 PA 332, MCL 445.1101
10 to 445.1431, or the retail installment sales act, 1966 PA 224,
11 MCL 445.851 to 445.873.
12 (d) "Financial transaction device" means that term as defined
13 in section 157m of the Michigan penal code, 1931 PA 328, MCL
14 750.157m.
15 (e) "Identity theft" means any unauthorized use of another
16 person's personal identifying information to do any of the
17 following:
18 (i) Obtain credit, goods, services, money, property, medical
19 records or information, or employment, except as provided in
20 subsection (2).
21 (ii) Commit any other unlawful act.
22 (f) "Law enforcement agency" means that term as defined in
23 section 2804 of the public health code, 1978 PA 368, MCL
24 333.2804.
25 (g) "Local registrar" means that term as defined in section
26 2804 of the public health code, 1978 PA 368, MCL 333.2804.
27 (h) "Medical records or information" includes, but is not
Senate Bill No. 792 as amended December 10, 2003
1 limited to, medical and mental health histories, reports,
2 summaries, diagnoses and prognoses, treatment and medication
3 information, notes, entries, and x-rays and other imaging
4 records.
5 (i) "Person" means an individual, partnership, corporation,
6 limited liability partnership or company, association, or other
7 legal entity.
8 (j) "Personal identifying information" means a name, number,
9 or other information that may be used to identify a specific
10 person or provide access to a person's financial accounts,
11 including, but not limited to, a person's name, address,
12 telephone number, driver license or state personal identification
13 card number, social security number, place of employment,
14 employee identification number, employer or taxpayer
15 identification number, government passport number, health
16 insurance identification number, mother's maiden name, demand
17 deposit account number, savings account number, financial
18 transaction device account number or the person's account
19 password, stock or other security certificate or account number,
20 credit card number, or medical records or information.
21 (k) "Trade or commerce" means that term as defined in section
22 2 of the Michigan consumer protection act, 1971 PA 331, MCL
23 445.902.
<<(l) "Unauthorized" means without the consent of the person whose personal identifying information is being used, except if the consent is knowingly given to commit an unlawful act.>>
24 (m) "Vital record" means that term as defined in section 2805
25 of the public health code, 1978 PA 368, MCL 333.2805.
26 (2) If committed to obtain credit, goods, services, money,
27 property, medical records or information, or employment,
Senate Bill No. 792 as amended December 10, 2003
1 "identity theft" does not include any of the following acts:
<<(a) An act that is a bona fide gift for or for the primary benefit of and use, consumption, or control by the person whose personal identifying information was used, except if the act is committed with the intent to defraud or commit another unlawful act.>>
2 (b) An act in lawful pursuit or enforcement of a person's
3 legal rights, including an audit, collection, investigation, or
4 transfer of a debt, claim, <<crime,>> receivable, or account or an interest
5 in a receivable or account.
6 (c) An act committed by a health care provider <<or employer>> in connection
7 with providing of health care or employment benefits to an
8 individual.
9 (d) An act authorized or required by state or federal law,
10 rule, regulation, or court order or rule.
11 (e) An act committed by a person who is subject to and
12 regulated by a statute administered by a regulatory board or
13 officer acting under authority of this state or the United States
14 that confers exclusive jurisdiction on that regulatory board or
15 officer to authorize, prohibit, or regulate the transactions and
16 conduct of that person, if the act does not violate state or
17 federal law. The statutes described in this subdivision include,
18 but are not limited to, any state or federal statute governing a
19 financial institution and the insurance code of 1956, 1956 PA
20 218, MCL 500.100 to 500.8302.
21 (f) An act committed by a person who has contracted with a
22 person described in subdivision <<(b), (c), (d), or (e)>> to use any
23 personal identifying information, if the person has privacy
24 protections in place similar to those of the person described in
25 that subdivision that makes the personal identifying information
26 confidential.
27 Sec. 5. (1) A person shall not do any of the following:
1 (a) Commit or attempt to commit identity theft.
2 (b) Except as provided in section 3(2), obtain or possess, or
3 attempt to obtain or possess, personal identifying information of
4 another person with the intent to use that information to commit
5 identity theft or another unlawful act.
6 (c) Except as provided in section 3(2), sell or transfer, or
7 attempt to sell or transfer, personal identifying information of
8 another person if the person knows or has reason to know that the
9 specific intended recipient will use, attempt to use, or further
10 transfer the information to another person for the purpose of
11 committing identity theft or another unlawful act.
12 (d) Falsify a victim certificate, or knowingly create,
13 possess, or use a false victim certificate, described in section
14 23 of chapter XVI of the code of criminal procedure, 1927 PA 175,
15 MCL 776.23.
16 (2) A person who violates this section is guilty of a felony
17 punishable by imprisonment for not more than 5 years or a fine of
18 not more than $10,000.00, or both.
19 (3) This section does not prohibit a person from being
20 charged with, convicted of, or sentenced for any other violation
21 of law committed by that person using information obtained in
22 violation of this section.
23 (4) This section does not prohibit a person from lawfully
24 obtaining or attempting to obtain personal identifying
25 information of another person pursuant to the discovery process
26 in a civil or criminal action, an administrative proceeding, or
27 an arbitration proceeding.
Senate Bill No. 792 as amended December 10, 2003
1 (5) This section does not prohibit a person from lawfully
2 obtaining or attempting to obtain personal identifying
3 information of another person for the purpose of detecting,
4 preventing, or deterring a financial <<or other>> crime, identity theft, or
5 the funding of a criminal activity.
6 (6) This section applies whether an individual who is a
7 victim or intended victim of a violation of this section is alive
8 or deceased at the time of the violation.
9 (7) This section does not apply to a violation of a statute
10 or rule administered by a regulatory board or officer acting
11 under authority of this state or the United States that confers
12 exclusive jurisdiction on that regulatory board or officer to
13 authorize, prohibit, or regulate the transactions and conduct of
14 that person, including, but not limited to, a state or federal
15 statute or rule governing a financial institution and the
16 insurance code of 1956, 1956 PA 218, MCL 500.100 to 500.8302, if
17 the act is committed by a person subject to and regulated by that
18 statute or rule, or by another person who has contracted with
19 that person to use personal identifying information and who has
20 similar privacy protection policies in place similar to that
21 person that makes the personal identifying information
22 confidential.
23 Sec. 7. (1) A person shall not do any of the following in
24 the conduct of trade or commerce:
25 (a) Deny credit or public utility service to or reduce the
26 credit limit of a consumer solely because the consumer was a
27 victim of identity theft, if the person had prior knowledge that
1 the consumer was a victim of identity theft. A consumer is
2 presumed to be a victim of identity theft for the purposes of
3 this subdivision if he or she possesses a valid certification
4 under section 23 of chapter XVI of the code of criminal
5 procedure, 1927 PA 175, MCL 776.23.
6 (b) Solicit to extend credit to a consumer who does not have
7 an existing line of credit, or has not had or applied for a line
8 of credit within the preceding year, through the use of an
9 unsolicited check that includes personal identifying information
10 other than the recipient's name, address, and a partial, encoded,
11 or truncated personal identifying number. In addition to any
12 other penalty or remedy under this act or the Michigan consumer
13 protection act, 1976 PA 331, MCL 445.901 to 445.922, a credit
14 card issuer, financial institution, or other lender that violates
15 this subdivision, and not the consumer, is liable for the amount
16 of the instrument if the instrument is used by an unauthorized
17 user and for any fees assessed to the consumer if the instrument
18 is dishonored.
19 (c) Solicit to extend credit to a consumer who does not have
20 a current credit card, or has not had or applied for a credit
21 card within the preceding year, through the use of an unsolicited
22 credit card sent to the consumer. In addition to any other
23 penalty or remedy under this act or the Michigan consumer
24 protection act, 1976 PA 331, MCL 445.901 to 445.922, a credit
25 card issuer, financial institution, or other lender that violates
26 this subdivision, and not the consumer, is liable for any charges
27 if the credit card is used by an unauthorized user and for any
1 interest or finance charges assessed to the consumer.
2 (d) Extend credit to a consumer without exercising procedures
3 to verify the identity of that consumer. Compliance with
4 regulations issued by the United States department of treasury
5 under section 326 of the USA patriot act of 2001, Public Law
6 107-56, 31 USC 5318, is considered compliance with this
7 subdivision.
8 (2) A person who knowingly or intentionally violates
9 subsection (1) is guilty of a misdemeanor punishable by
10 imprisonment for not more than 30 days or a fine of not more than
11 $100.00, or both. This subsection does not affect the
12 availability of any civil remedy for a violation of this act, the
13 Michigan consumer protection act, 1976 PA 331, MCL 445.901 to
14 445.922, or any other state or federal law.
15 Sec. 9. A law enforcement agency, financial institution, or
16 victim of identity theft may obtain copies of a vital record from
17 a local registrar under part 28 of the public health code, 1978
18 PA 368, MCL 333.2801 to 333.2899, if necessary to enforce this
19 act or investigate or prevent identity theft. The registrar may
20 charge for the actual costs of copying the vital records obtained
21 by a financial institution or victim of identity theft.
22 Sec. 13. (1) There is created an identity theft advisory
23 board. The 5 members of the identity theft advisory board are
24 the governor or his or her designee, the attorney general or his
25 or her designee, who shall serve as the chairperson of the
26 identity theft advisory board, the secretary of state or his or
27 her designee, the majority leader of the senate or his or her
1 designee, and the speaker of the house of representatives or his
2 or her designee. The board shall annually report to the standing
3 committees of the senate and the house of representatives with
4 jurisdiction over issues relating to identity theft with any
5 recommendations for statutory changes.
6 (2) The identity theft advisory board shall study data from
7 identity theft cases in this state.
8 Enacting section 1. This act takes effect March 31, 2004.
9 Enacting section 2. Section 285 of the Michigan penal code,
10 1931 PA 328, MCL 750.285, is repealed.
11 Enacting section 3. This act does not take effect unless
12 all of the following bills of the 92nd Legislature are enacted
13 into law:
14 (a) Senate Bill No. 657.
15 (b) Senate Bill No. 793.
16 (c) Senate Bill No. 794.