79R4880 HLT-F


By:  Giddings, Gonzalez Toureilles                                H.B. No. 1321


A BILL TO BE ENTITLED
AN ACT
relating to the prevention and punishment of identity theft and the rights of certain victims of identity theft; providing penalties. BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS: SECTION 1. (a) Chapter 2, Code of Criminal Procedure, is amended by adding Article 2.29 to read as follows: Art. 2.29. REPORT REQUIRED IN CONNECTION WITH FRAUDULENT USE OR POSSESSION OF IDENTIFYING INFORMATION. (a) A peace officer to whom an alleged violation of Section 32.51, Penal Code, is reported shall make a written report that includes the following information: (1) the name of the victim; (2) the name of the suspect, if known; (3) the type of identifying information obtained, possessed, transferred, or used in violation of Section 32.51, Penal Code; and (4) the results of the investigation. (b) On the victim's request, the peace officer shall provide the report created under Subsection (a) to the victim. In providing the report, the peace officer shall redact any otherwise confidential information that is included in the report, other than the information described by Subsection (a). (b) The change in law made by this section applies only to the investigation of an offense committed on or after September 1, 2005. The investigation of an offense committed before September 1, 2005, is covered by the law in effect when the offense was committed, and the former law is continued in effect for that purpose. For purposes of this subsection, an offense is committed before September 1, 2005, if any element of the offense occurs before that date. SECTION 2. Title 4, Business & Commerce Code, is amended by adding Chapter 48 to read as follows:
CHAPTER 48. UNAUTHORIZED USE OF PERSONAL IDENTIFYING INFORMATION
SUBCHAPTER A. GENERAL PROVISIONS
Sec. 48.001. SHORT TITLE. This chapter may be cited as the Identity Theft Enforcement and Protection Act. Sec. 48.002. DEFINITIONS. In this chapter: (1) "Peace officer" has the meaning assigned by Section 1.07, Penal Code. (2) "Personal identifying information" means information that alone or in conjunction with other information identifies an individual, including an individual's: (A) name, social security number, date of birth, or government-issued identification number; (B) mother's maiden name; (C) unique biometric data, including the individual's fingerprint, voice print, and retina or iris image; (D) unique electronic identification number, address, or routing code; and (E) telecommunication access device. (3) "Telecommunication access device" has the meaning assigned by Section 32.51, Penal Code. (4) "Victim" means a person whose identifying information is used by an unauthorized person.
[Sections 48.003-48.100 reserved for expansion]
SUBCHAPTER B. IDENTITY THEFT
Sec. 48.101. UNAUTHORIZED USE OR POSSESSION OF PERSONAL IDENTIFYING INFORMATION. A person may not obtain, possess, transfer, or use personal identifying information of another person without the other person's consent and with intent to obtain a good, service, insurance, an extension of credit, or any other thing of value in the other person's name. Sec. 48.102. BUSINESS DUTY TO PROTECT AND SAFEGUARD PERSONAL IDENTIFYING INFORMATION. (a) A business shall protect and safeguard any personal identifying information collected or maintained by the business in the regular course of business. (b) A business shall implement and maintain reasonable procedures, including taking any appropriate corrective action, to prevent the unlawful use of any personal identifying information collected or maintained by the business. (c) This section does not apply to a financial institution as defined by 15 U.S.C. Section 6809(3). Sec. 48.103. VICTIM'S RIGHT TO INFORMATION. (a) On request of a victim and presentation of the information specified by Subsection (b), a person that engages in business with another person who allegedly used the victim's personal identifying information without authorization shall provide to the victim or a peace officer without charge: (1) a copy of any application or transaction information related to an alleged violation of Section 32.51, Penal Code; and (2) to the extent available, the personal identifying information that the unauthorized person used to participate in the transaction or complete the application or information related to the use of that information. (b) To be entitled to receive information under Subsection (a), the victim shall provide to the person: (1) a copy of a record created under Section 411.0421, Government Code, or a copy of a police report, investigative report, or complaint, if any, involving the alleged commission of an offense under Section 32.51, Penal Code; and (2) identifying information in the categories of information that the unauthorized person used in the commission of the offense. (c) To enable a victim to comply with Subsection (b)(2), a person, on request of a victim, shall inform the victim of the categories of identifying information used by the unauthorized person. (d) The person shall provide the information as required by this section not later than the 10th business day after the date the person receives the request. Sec. 48.104. ADDITIONAL INFORMATION FOR RELEASE OF INFORMATION TO PEACE OFFICER. Before a person is required to provide information to a peace officer under Section 48.103, the person may require the victim to submit a signed and dated statement: (1) authorizing the disclosure for a stated period; (2) specifying the law enforcement agency to which disclosure is authorized; (3) identifying the types of information authorized to be disclosed; and (4) authorizing the victim to revoke the authorization at any time. [Sections 48.105-48.200 reserved for expansion]
SUBCHAPTER C. REMEDIES AND OFFENSES
Sec. 48.201. A CIVIL PENALTY; INJUNCTION. (a) A person who violates this chapter is liable to the state for a civil penalty of at least $2,000 but not more than $50,000 for each violation. The attorney general may bring suit to recover the civil penalty imposed by this subsection. (b) If it appears to the attorney general that a person is engaging in, has engaged in, or is about to engage in conduct that violates this chapter, the attorney general may bring an action in the name of this state against the person to restrain the violation by a temporary restraining order or a permanent or temporary injunction. (c) An action brought under Subsection (b) shall be filed in a district court in Travis County or: (1) in any county in which the violation occurred; or (2) in the county in which the victim resides, regardless of whether the alleged violator has resided, worked, or done business in the county in which the victim resides. (d) The plaintiff in an action under this section is not required to give a bond. The court may also grant any other equitable relief that the court considers appropriate to prevent any additional harm to a victim of identity theft or a further violation of this chapter or to satisfy any judgment entered against the defendant, including the issuance of an order to appoint a receiver, sequester assets, correct a public or private record, or prevent the dissipation of a victim's assets. (e) The attorney general is entitled to recover reasonable expenses incurred in obtaining injunctive relief, civil penalties, or both, under this section, including reasonable attorney's fees, court costs, and investigatory costs. Amounts collected by the attorney general under this section shall be deposited in the general revenue fund and may be appropriated only for the investigation and prosecution of other cases under this chapter. Sec. 48.202. COURT ORDER TO DECLARE INDIVIDUAL A VICTIM OF IDENTITY THEFT. (a) A person who is injured by a violation of Section 48.101 or who has filed a criminal complaint alleging commission of an offense under Section 32.51, Penal Code, may file an application with a district court for the issuance of a court order declaring that the person is a victim of identity theft. A person may file an application under this section regardless of whether the person is able to identify each person who allegedly transferred or used the person's identifying information in an unlawful manner. (b) A person is presumed to be a victim of identity theft under this section if the person charged with an offense under Section 32.51, Penal Code, is convicted of the offense. (c) After notice and hearing, if the court is satisfied by a preponderance of the evidence that the applicant has been injured by a violation of Section 48.101 or is the victim of an offense under Section 32.51, Penal Code, the court shall enter an order containing: (1) a declaration that the person filing the application is a victim of identity theft resulting from a violation of Section 48.101 or an offense under Section 32.51, Penal Code, as appropriate; (2) any known information identifying the violator or person charged with the offense; (3) the specific personal identifying information and any related document used to commit the alleged violation or offense; and (4) information identifying any financial account or transaction affected by the alleged violation or offense, including: (A) the name of the financial institution in which the account is established or of the merchant involved in the transaction, as appropriate; (B) any relevant account numbers; (C) the dollar amount of the account or transaction affected by the alleged violation or offense; and (D) the date of the alleged violation or offense. (d) An order rendered under this section must be sealed because of the confidential nature of the information required to be included in the order. The order may be opened and the order or a copy of the order may be released only: (1) to the proper officials in a civil proceeding brought by or against the victim arising or resulting from a violation of this chapter, including a proceeding to set aside a judgment obtained against the victim; (2) to the victim for the purpose of submitting the copy of the order to a governmental entity or private business to: (A) prove that a financial transaction or account of the victim was directly affected by a violation of this chapter or the commission of an offense under Section 32.51, Penal Code; or (B) correct any record of the entity or business that contains inaccurate or false information as a result of the violation or offense; (3) on order of the judge; or (4) as otherwise required or provided by law. (e) A court at any time may vacate an order issued under this section if the court finds that the application or any information submitted to the court by the applicant contains a fraudulent misrepresentation or a material misrepresentation of fact. (f) A copy of an order provided to a person under Subsection (d)(1) must remain sealed throughout and after the civil proceeding. Information contained in a copy of an order provided to a governmental entity or business under Subsection (d)(2) is confidential and may not be released to another person except as otherwise required or provided by law. Sec. 48.203. DECEPTIVE TRADE PRACTICE. A violation of this chapter, other than Section 48.103, is a deceptive trade practice actionable under Subchapter E, Chapter 17. Sec. 48.204. AFFIRMATIVE DEFENSE. Good faith reliance on a consumer report as defined by Section 20.01 by a financial institution as defined by 31 U.S.C. Section 5312 is an affirmative defense to an action brought against the financial institution under this chapter. SECTION 3. This Act takes effect September 1, 2005.
COMMITTEE AMENDMENT NO. 1
Amend H.B. No. 1321 as follows: (1) On page 3, between lines 19 and 20, insert the following: (c) A business shall destroy or arrange for the destruction of customer records containing personal identifying information within the business's custody or control that are not to be retained by the business by: (1) shredding; (2) erasing; or (3) otherwise modifying the personal identifying information in the records to make the information unreadable or undecipherable through any means. (2) On page 3, line 20, strike "(c)" and substitute "(d)". 79R9872 HLT-F Keel