[Title]

Committee: Judiciary

First Analysis (8-3-09)

BRIEF SUMMARY: The bills amend various acts to:

· Require restitution be made by offenders to victims.

· Require the Department of State Police to develop a model form for the reporting of identity theft incidents.

· Specify in statute that identity theft victims are entitled to file a police report.

· Allow victims to file a civil action to recover damages and certain costs related to correct their financial records.

· Make it a crime to mislead police regarding a suspect’s or defendant’s identity or to use another person’s identity to commit a crime.

· Require certain businesses to establish a written identity theft prevention program and establish a civil fine for a business that knowingly violated the requirement.

· Revise the definition of "destroy" in relation to data purged from databases and revise circumstances under which personal information contained in the data would have to be destroyed.

FISCAL IMPACT: The bills would have an indeterminate fiscal impact on the judiciary and no impact on the Michigan State Police. A more detailed discussion follows later in the analysis.

THE APPARENT PROBLEM:

In 2004, legislation was enacted that, among other things, created the Identity Theft Protection Act; made it a felony to use personal identifying information without consent to obtain credit, goods, or services; established the right of victims to obtain a police report; clarified the jurisdiction where ID thefts could be prosecuted; and extended the statute of limitations for ID thefts to six years after the crime was committed or the identity of the thief was established. Despite this legislation, and other federal, state, and local initiatives to combat identity theft, it remains as the fastest growing crime in America.

Simply put, identity theft occurs when a person uses the personal identifying information of another – without consent – to open new credit accounts, use existing bank and credit accounts, obtain goods or services (including medical care in another person’s name), obtain employment, or even commit a criminal act.

Identity theft ranks as the number one fraud complaint filed with the Federal Trade Commission (FTC). It costs consumers, businesses, and government billions of dollars each year. To repair his or her credit standing and financial records, a victim of identity theft can spend anywhere from 26 hours of direct work for a simple case to 200 hours or more for a complicated one, and, on average, almost $700. The process can take two or more years to complete. Last year, Michigan ranked 19^th in the number of cases reported to the FTC per 100,000 population, but was 9^th overall in reported cases after California, Texas, Florida, New York, Illinois, Georgia, Pennsylvania, and Arizona (8,363 out of 313,982 cases nationally). Experts suspect that many more cases go unreported.

To further strengthen the state’s identity theft laws and provide some relief for victims of identity theft, legislation has been offered to amend the Identity Theft Protection Act and other statutes.

THE CONTENT OF THE BILLS:

Public Act 452 of 2004 created the Identity Theft Protection Act, which among other things made it a felony to use personal identifying information to obtain goods and services without consent. House Bills 4731-4735 each amends the Identity Theft Protection Act (ITPA). The other bills amend different acts to address matters directly related to identity theft.

House Bills 4730-4734 are tie-barred to each other and to House Bill 4729, and House Bill 4735 is tie-barred to House Bills 4729-4734. (House Bill 4729, which was not reported from committee with the rest of the package, would amend the ITPA to establish the Identity Theft Protection Commission in the Department of Technology.)

Restitution

House Bills 4736-4738 each amends a different act to require courts to order restitution in cases where the victims are victims of identity theft. Restitution would be in an amount that compensates the victim in full for the work done by the victim or the victim's attorney, or both, to correct financial records and vital records and to ameliorate the effects of the identity theft on the victim's financial affairs, including credit history, credit rating, or credit score.

House Bill 4736 would amend the Code of Criminal Procedure (MCL 869.1a). House Bill 4737 would amend the William Van Regenmorter Crime Victim Rights Act (MCL 780.754a et al.) and incorporates changes to that act made by Public Act 146 of 2009, enrolled Senate Bill 146. House Bill 4738 would amend Chapter XIIA of the Probate Code, which deals with juvenile offenses (MCL 712A.30 et al.). The three bills are tie-barred to one another.

Model Police Report

House Bill 4736 would also specify in the Code of Criminal Procedure that a bona fide victim of identity theft is entitled to file a police report with a law enforcement agency in a jurisdiction where the alleged violation may be prosecuted and would require the Department of State Police to develop a model form of police report of identity theft and make it available to law enforcement agencies and victims of identity theft.

The bill also incorporates changes to the act made by Public Act 27 of 2009, enrolled Senate Bill 145.

House Bill 4730 would amend the William Van Regenmorter Crime Victim Rights Act (MCL 780.754 et al.). The bill would include a reference to Sections 11 and 13 of the Identity Theft Protection Act in a provision pertaining to the right of victims of ID theft to file a police report and obtain a copy of that report.

Civil Action for Damages

House Bill 4735 would add Section 11a to the Identity Theft Protection Act to allow a victim of identity theft to file a civil action for damages against a person who violated prohibitions contained in Sections 5 and 6 of the act (i.e., intentionally using the personal information of another to obtain credit, goods, services, or money) and recover all of the following: actual damages, reasonable attorney fees, and court costs; reimbursement for notifying third parties of the identity theft, reporting identity theft to law enforcement, and correcting personal identifying information or providing other information to third parties required because of the identity theft; and restitution, in an amount that compensates the victim in full for the work done by the victim or the victim's attorney, or both, to correct financial records and vital records and to ameliorate the effects of the identity theft on the victim's financial affairs, including credit history, credit rating, or credit score.

For purposes of the above provision, a person who failed to comply with the prohibitions listed in Sections 5 or 7 of the act while acting in good faith would not be in violation of that section if the compliance failure had not been intentional and resulted from a bona fide error despite the maintenance of procedures reasonably adapted to avoid those errors, and appropriate restitution was made to the victim. A "bona fide error" would include, but not be limited to, a computer malfunction or a clerical, calculation, computer programming, or printing error. An error of legal judgment with respect to a person's obligations under this section would not be a bona fide error.

Misleading Law Enforcement/Courts

House Bill 4731 would amend Section 5 of the Identity Theft and Protection Act (MCL 445.65) to make it an offense to use or attempt to use the personal identifying information of another person to engage in criminal activity or other violations of law or to mislead a law enforcement agency or court concerning the identity of an individual under criminal investigation or a criminal defendant.

Written Identity Theft Prevention Program

House Bill 4732 would add Section 12c to the Identity Theft and Protection Act to require, within 30 days after the bill's effective date, each "qualified person" (certain financial institutions, as described later) to establish a written identity theft prevention program that met all of the following:

· Included reasonable policies and procedures for detecting, preventing, and mitigating identity theft.

· Identified, and detected, specific activities that indicated the possible existence of identity theft and addressed those activities in the program.

· Responded to the activities described above in order to mitigate the adverse effects of identity theft.

· Trained staff to effectively implement the program.

· Ensured that the program was periodically reviewed to identify, detect, and respond to new and emerging practices that increased the risk of identity theft.

A "qualified person" would mean an entity with more than 50 employees and engaged in extending credit in the form of covered accounts to state residents. A "covered account" would mean that term as defined in federal rules for financial institutions and creditors found at 16 CFR 681.2. Generally speaking, these are consumer accounts at financial institutions for personal, family, or household purposes.

The following entities would be exempted from the requirement to establish a written identity theft prevention program as described above:

** Entities that are subject to and comply with the joint final rules and guidelines concerning identity theft red flags and address discrepancies under the federal Fair and Accurate Credit Transactions Act.

** A state or federal court, a political subdivision of this state, or a state or federal department or agency.

House Bill 4733 would add Section 12d to the Identity Theft and Protection Act to specify that a person who knowingly violated Section 12c regarding the written identity theft prevention program could be ordered to pay a civil fine of not more than $10,000 for each violation. The attorney general or a prosecuting attorney could bring an action to recover a civil fine under this provision. The provision would not affect the availability of any civil remedy for a violation of state or federal law.

Destruction of Data

House Bill 4734 would amend provisions of the Identity Theft Protection Act (MCL 445.72a) regarding the destruction of data in a database that includes personal information on multiple individuals. Currently, data containing personal identifying information on an individual is to be destroyed when that data is removed from the database and the person or agency is not retaining the data elsewhere for another purpose. The bill would revise the provision to instead specify that a person or agency that disposed of any data from a database that included any unencrypted, unredacted personal information concerning an individual who was a resident of the state would have to destroy that data when it was removed from the database, unless the person or agency was retaining the data elsewhere for another lawful purpose.

Further, the definition of "destroy" would be revised to mean to destroy or arrange for the destruction of data by shredding, erasing, incinerating, mutilating, or otherwise changing the data so that they cannot be read, deciphered, or reconstructed through generally available means. (Underlining denotes new language.)

BACKGROUND INFORMATION:

The bills are virtually identical to a package passed by the House last session (House Bills 6096-6103 and 6105). House Bill 4729, to which some of the bills are tie-barred, would create an Identity Theft Protection Commission; the bill was not reported with the other bills.

Consumers can find information on identity theft, how to protect against identity theft, and resources for victims of identity theft from many sites on the Web, including the following:

Department of State Police: www.michigan.gov/msp. Under "Features", click on Identity Theft Resources.

Federal Trade Commission: www.ftc.gov. Under "Quick Finder", click on Identity Theft.

Identity Theft Resource Center: www.idtheftcenter.org

Privacy Rights Clearinghouse: www.privacyrights.org. Click on "Identity Theft.”

U.S. Department of Justice: www.usdoj.gov. Under "What We Do", click on "Investigate Fraud" and scroll down to "Identity Theft and Fraud.”

Center for Identity Management and Information Protection, housed at Utica College: www.utica.edu/academic/institutes/cimip.

FISCAL INFORMATION:

House Bills 4730-4738. There would be an indeterminate, but likely negligible impact on the judiciary. Any fiscal impact would come from increased complexity in the caseload brought under the bills. In addition, it is unclear what fiscal impact House Bill 4733 would have. "Civil fines" are treated differently from "civil infractions," which are directed towards public libraries and county law libraries under the Michigan State Constitution of 1963 (Article 8, Section 9). Unless a civil violation is labeled a "civil infraction," it cannot be presumed to be subject to the provisions of the Revised Judicature Act. One could presume that MCL 18.1443 would apply, which states that "[e]xcept as provided by law, all money received by the various state agencies for whom appropriations are made by a budget act shall be forwarded to the state treasurer and credited to the state general fund." However, it is unclear whether civil fines collected amount to "money received." In conclusion, where civil fines are not dedicated to a specific fund, as is the case with HB 4733, the allocation of fine revenue remains unclear.

House Bills 4730 and 4736 would have no impact on the Department of State Police since they have already produced a model identity theft police report form.

ARGUMENTS:

For:

Though many state and federal laws have been enacted in recent years to combat identity theft, criminals have found new ways to evade detection, necessitating laws to be updated. The bill is modeled in large part upon recommendations made by a federal task force charged with combating identity theft, and the bill package would do just that.

House Bills 4736-4738 would, in part, address some of the financial costs to victims of identity theft in repairing their damaged credit by requiring judges to order ID thieves to compensate their victims through restitution. Under House Bill 4735, victims would be able to sue any individual, business, or legal entity who engaged in conduct prohibited by the Identity Theft Protection Act. There is some overlap with the damages that could be recovered from court-ordered restitution under House Bills 4736-4738, but the bill would also allow a victim to recover for the full amount lost through the ID theft as well as for attorney fees and court costs. The bill would protect businesses and individuals from being sued for unintentional mistakes or breaches as long as appropriate restitution was made to the victim.

Though current law already gives identity theft victims the right to file a police report in an appropriate jurisdiction, House Bills 4736 and 4730 would strengthen and streamline current provisions by requiring a model form, created and distributed by the Department of State Police, to be available to all law enforcement agencies and victims.

House Bill 4731 would make it a criminal offense to either use a stolen ID to commit a crime or to mislead a court or law enforcement agency as to the offender’s real identity. This is important because, over the past few years, there have been documented cases of innocent people being arrested under warrants issued for persons who stole their identities and then committed crimes or other violations of law. Others, when undergoing employment-related criminal history fingerprint checks, have discovered that someone not only committed a crime under their stolen identity, but also were convicted and incarcerated under the stolen ID.

House Bill 4732, modeled after the federal "red flags rules," would require mid-size and large financial institutions and creditors to develop and implement a written identity theft prevention program." Any entity subject to those requirements who knowingly (which implies intent) failed to comply could face harsh civil penalties under House Bill 4733.

House Bill 4734 would allow individuals or businesses that maintain databases with personal identifying information to destroy that information by incinerating, mutilating, or changing the data so that it could not be read, deciphered, or reconstructed. This will give businesses more options when faced with purging databases. The bill would also make it clearer what types of information must be destroyed in the stated manner (basically, any personal information that was not encrypted or redacted).

Against:

House Bill 4733 would subject a business that was not in compliance with the requirement to have a written identity theft prevention program to a civil fine as high as $10,000. Last session, a similar bill put the maximum fine amount at $250 and capped the civil liability at $750,000 total for multiple violations. The increased amount in the current version is too harsh, since the bill does not specify how the fine would be imposed; for instance, would the fine cover a single incident, even if more than one requirement was violated, or would each violation subject the business owner to a separate $10,000 fine?

In addition, House Bills 4732 and 4733 are duplicative and therefore not needed. Federal law, as part of the "red flags program," already requires this of financial institutions.

Response:

The higher civil fine for those who would violate the program requirements is necessary to appropriately punish the bad actors. The bill protects businesses being fined for accidental and unintentional incidents. And, though, like provisions in some of the other bills, the bill is duplicative of federal regulations, many state laws mirror or mimic federal law. In that way, state regulators and law enforcement agencies can prosecute violators without having to wait upon federal law enforcement to act.

Against:

The State Bar of Michigan has requested that House Bills 4736-4738, which would require judges to order restitution to compensate victims of identity theft, instead be amended to be permissive so as to provide for judicial discretion. In addition, the Bar has requested that the bills also provide a reasonableness standard as to the amount of the restitution.

POSITIONS:

The Department of State Police supports the bills. (7-15-09)

The Insurance Institute of Michigan supports the bills. (7-15-09)

The Michigan Council of Private Investigators indicated support for the bills. (7-15-09)

The Michigan Credit Union League indicated a neutral position on House Bill 4732. (7-15-09)

The Michigan Bankers Association indicated a position of neutral on House Bill 4732. (7-15-09)

The National Federation of Independent Business (NFIB) indicated opposition to House Bills 4732, 4732, 4733, and 4734. (7-15-09)

Legislative Analyst: Susan Stutzky

Fiscal Analyst: Ben Gielczyk

Jan Wisniewski

■ This analysis was prepared by nonpartisan House staff for use by House members in their deliberations, and does not constitute an official statement of legislative intent.