IDENTITY THEFT PROTECTION COMMISSION

House Bill 4729 (Substitute H-2)

Sponsor:  Rep. Kathy Angerer

Committee:  Judiciary

Complete to 9-8-09

A SUMMARY OF HOUSE BILL 4729 AS REPORTED FROM COMMITTEE 8-19-09

House Bill 4729 would add Section 14 to the Identity Theft and Protection Act to establish a nine-member Identity Theft Protection Commission in the Department of Information Technology (DIT). 

The bill is tie-barred to House Bills 4730-4734, which were previously reported from committee and are awaiting floor action.  [Those bills would amend the same act to provide a victim of identity theft with the right to file, and obtain a copy of, a police report; criminalize the use of another’s personal identifying information to commit a crime; require certain businesses to develop a written ID theft prevention program; impose a civil fine for committing ID theft; and revise statutory criteria for destruction of data containing personal identifying information.]   

Except as provided in the bill, the Identity Theft Protection Commission would be one of the advisor workgroups of the Information Privacy Protection Council as authorized under Section VI-E of Executive Reorganization Order N. 2009-18.  If the Council was not fully operational within 30 days of the bill’s effective date, the ID Theft Protection Commission would exist as a separate commission within the DIT (and not as one of the advisory workgroups of the Council).  To be fully operational, all of the Council’s members would have to have been appointed, and at least one meeting of the Council held.  If the ID Theft Protection Commission did become one of the advisory workgroups of the Council, but the Council was subsequently abolished (by law or executive order), the Commission would continue its existence as a separate commission within DIT.

Commission membership.  The director of DIT, or a designee, would serve as chair.  Other members would be the director of the Department of State Police (or a designee), the Commissioner of the Office of Financial and Insurance Regulation (or a designee), the State Treasurer (or a designee), three members of the general public, and two representatives of the business committee who were appointed by the Governor.  The three public members would be appointed by the Governor, but one would be appointed from a list of three or more nominees submitted by the Speaker of the House of Representatives and one would be appointed from a list submitted by the Majority Leader of the Senate.

Commission and DIT duties.  Among other functions, the new commission would, by September 30, 2011: review and provide recommendations to the Governor and to the Information Privacy Protection Council (hereinafter, Council) about state rules, guidelines, and procedures related to identity theft protection and prevention; review and provide recommendations about legislation to the Legislature and Council; provide recommendations to the public and to the Council about business practices; provide recommendations to state agencies and departments and to the Council on reducing the use of Social Security numbers; make recommendations to DIT and the Council concerning the design and content of the Identity Theft Information Website; and establish a process for recognizing those with exemplary business practices in identity theft protection and prevention.

DIT would have to provide staff assistance to the Commission as necessary to carry out the Commission's duties.

Further, DIT would have to establish and maintain an identity theft information website.  The department would have to consider the Commission's recommendations in selecting the design and content of the website.

Commission meetings.  Meetings of the Commission would have to be held in compliance with the Open Meetings Act and writings prepared, owned, used, in the possession of, or retained by the Commission in the performance of an official function would have to be available to the public in compliance with the Freedom of Information Act. 

Repealer.  The new Section 14 would be repealed effective December 31, 2011.

BACKGROUND INFORMATION:

Among other things, Executive Order No. 2009 – 18 created the position of Chief Privacy Officer within the executive branch of government; called for the designation of an information privacy protection officer for each principal department of state government to coordinate departmental compliance with state and federal privacy laws; created the Information Privacy Protection Council within the Department of Information Technology; charged the council with acting in an advisory capacity to the Governor and required the council to fill certain specified duties such as reviewing, developing, and recommending policies and procedures to be implemented by state departments and agencies to assure compliance with state and federal privacy laws and the promotion of effective information security and privacy protection; and detail operations of the Council. 

According to the EO, creation of the office of Chief Privacy Officer, designation of agency Information Privacy Protection Officers, and creation of the Information Privacy Protection Council is intended to address the need for residents of the state to "understand the manner in which their personal identifying information is collected, displayed, retained, destroyed, and disposed of by state government and their rights when that information is used or accessed without authorization."  The entities created by the EO are to "assist the state in its efforts to comply with state and federal privacy laws and to educate the residents of this state on their rights related to these laws."

Section VI-E of the EO authorizes the Council to "establish advisory workgroups composed of representatives of entities participating in Council activities or other members of the public as deemed necessary by the Council to assist the Council in performing its duties and responsibilities."  The Council also is given the authority to adopt, reject, or modify any recommendations proposed by an advisory workgroup.

If the Council is fully implemented and operational, the commission created by the bill would operate as an advisory workgroup.  If for any reason the Council was not fully operational, the commission created by the bill would be created and would be required to fulfill all of the bill’s requirements by September 30, 2011.  The enabling statute for the Commission would be repealed by December 31, 2011 and would cease to exist as of that date.  Supporters feel that the Commission is necessary to ensure that state agencies are in full compliance with state and federal privacy laws and that the public is adequately educated as to how their personal identifying information is used by state agencies, how it is protected, how it is destroyed when no longer needed, and what their rights are in regards to those state and federal laws.

House Bill 4729 is part of a larger package of bills previously reported from the House Judiciary Committee – House Bills 4730-4738.  For more information on those bills, see the analysis prepared by the House Fiscal Agency dated 8-3-09.

FISCAL IMPACT:

House Bill 4729 would establish a new commission, the Identity Theft Protection Commission, within the Department of Information Technology.  The bill requires the department to reimburse Commission members for their actual and necessary expenses, provide the Commission with staff assistance, and develop and maintain an identity theft information website as well.  These requirements would result in additional costs to the department.  The amount of the increase would depend upon a variety of factors, including the scope and magnitude of the Commission’s activity, the expenses they incur, and the amount of staffing the Commission will need to carry out their duties.

POSITIONS:

Patrick Clawson, with experience as both an investigative reporter and private investigator, testified in support of the bill.  (8-19-09)

                                                                                           Legislative Analyst:   Susan Stutzky

                                                                                                  Fiscal Analyst:   Viola Bay Wild

■ This analysis was prepared by nonpartisan House staff for use by House members in their deliberations, and does not constitute an official statement of legislative intent.