By: Hinojosa S.B. No. 122
A BILL TO BE ENTITLED
AN ACT
relating to the prevention and punishment of identity theft and to
assistance to certain victims of identify theft; providing
penalties.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
SECTION 1. (a) Chapter 2, Code of Criminal Procedure, is
amended by adding Article 2.29 to read as follows:
Art. 2.29. REPORT REQUIRED IN CONNECTION WITH FRAUDULENT
USE OR POSSESSION OF IDENTIFYING INFORMATION. (a) A peace officer
to whom an alleged violation of Section 32.51, Penal Code, is
reported shall make a written report that includes the following
information:
(1) the name of the victim;
(2) the name of the suspect, if known;
(3) the type of identifying information obtained,
possessed, transferred, or used in violation of Section 32.51; and
(4) the results of the investigation.
(b) On the victim's request, the peace officer shall provide
the report created under Subsection (a) to the victim. In providing
the report, the peace officer shall redact any otherwise
confidential information that is included in the report, other than
the information described by Subsection (a).
(b) The change in law made by this section applies only to
the investigation of an offense committed on or after September 1,
2005. The investigation of an offense committed before September
1, 2005, is covered by the law in effect when the offense was
committed, and the former law is continued in effect for that
purpose. For purposes of this subsection, an offense is committed
before September 1, 2005, if any element of the offense occurs
before that date.
SECTION 2. Title 4, Business & Commerce Code, is amended by
adding Chapter 48 to read as follows:
CHAPTER 48. IDENTITY THEFT AND PROTECTION
SUBCHAPTER A. GENERAL PROVISIONS
Sec. 48.001. SHORT TITLE. This chapter may be cited as the
Identity Theft Enforcement and Protection Act.
Sec. 48.002. DEFINITIONS. In this chapter:
(1) "Peace officer" has the meaning assigned by
Section 1.07, Penal Code.
(2) "Personal identifying information" means
information that alone or in conjunction with other information
identifies an individual, including an individual's:
(A) name, social security number, date of birth,
or government-issued identification number;
(B) mother's maiden name;
(C) unique biometric data, including the
individual's fingerprint, voice print, and retina or iris image;
(D) unique electronic identification number,
address, or routing code; and
(E) telecommunication access device.
(3) "Required identifying information" means a copy
of:
(A) a police report evidencing the filing of a
criminal complaint alleging commission of an offense under Section
32.51, Penal Code, or a copy of a record created under Section
411.0421, Government Code; and
(B) personal identifying information used by the
alleged perpetrator of an offense under Section 32.51, Penal Code.
(4) "Telecommunication access device" has the meaning
assigned by Section 32.51, Penal Code.
[Sections 48.003-48.100 reserved for expansion]
SUBCHAPTER B. IDENTITY THEFT
Sec. 48.101. UNAUTHORIZED USE OR POSSESSION OF PERSONAL
IDENTIFYING INFORMATION. (a) A person may not obtain, possess,
transfer, or use personal identifying information of another person
without the other person's consent and with intent to obtain a good,
service, insurance, an extension of credit, or any other thing of
value in the other person's name.
Sec. 48.102. BUSINESS DUTY TO PROTECT AND SAFEGUARD
PERSONAL IDENTIFYING INFORMATION. (a) A business shall protect
and safeguard any personal identifying information collected or
maintained by the business in the regular course of business.
(b) A business shall implement and maintain reasonable
procedures, including taking any appropriate corrective action, to
prevent the unlawful use of any personal identifying information
collected or maintained by the business.
(c) This section does not apply to a financial institution
as defined by 15 U.S.C. Section 6809(3).
Sec. 48.103. DUTY TO PROVIDE INFORMATION TO CONSUMER.
(a) On a request and with required identifying information
provided by a consumer, a person that engages in business with
another person who allegedly used the consumer's personal
identifying information shall disclose to the consumer or a peace
officer without charge and not later than the 10th business day
after the date on which the person receives the request:
(1) a copy of any application or transactional
information related to an alleged violation of Section 32.51, Penal
Code; and
(2) to the extent available, the personal identifying
information of the consumer that the person who allegedly
impersonated the consumer used to participate in the transaction or
complete the application or information related to the use of that
information.
(b) Before a person is required to disclose information
under Subsection (a) to a peace officer, the person may require the
consumer to submit a written statement dated and signed by the
consumer. The statement must:
(1) state that the consumer may revoke authorization
of the disclosure at any time before the disclosure is made;
(2) authorize the disclosure for a certain period of
time;
(3) specify the name of the agency or department to
which the disclosure is authorized; and
(4) identify the information that is requested to be
disclosed.
(c) A person may not be held liable under this section if the
person does not make a disclosure to a peace officer because a
consumer fails to provide the authorization requested by the person
as permitted by Subsection (b).
[Sections 48.104-48.200 reserved for expansion]
SUBCHAPTER C. REMEDIES AND OFFENSES
Sec. 48.201. A CIVIL PENALTY; INJUNCTION. (a) A person
who violates this chapter is liable to the state for a civil penalty
of at least $2,000 but not more than $50,000 for each violation.
The attorney general may bring suit to recover the civil penalty
imposed by this subsection.
(b) If it appears to the attorney general that a person is
engaging in, has engaged in, or is about to engage in conduct that
violates this chapter, the attorney general may bring an action in
the name of this state against the person to restrain the violation
by a temporary restraining order or a permanent or temporary
injunction.
(c) An action brought under Subsection (b) shall be filed in
a district court in Travis County or:
(1) in any county in which the violation occurred; or
(2) in the county in which the victim resides,
regardless of whether the alleged violator has resided, worked, or
done business in the county in which the victim resides.
(d) The plaintiff in an action under this section is not
required to give a bond. The court may also grant any other
equitable relief that the court considers appropriate to prevent
any additional harm to a victim of identify theft or a further
violation of this chapter or to satisfy any judgment entered
against the defendant, including the issuance of an order to
appoint a receiver, sequester assets, correct a public or private
record, or prevent the dissipation of a victim's assets.
(e) The attorney general is entitled to recover reasonable
expenses incurred in obtaining injunctive relief, civil penalties,
or both, under this section, including reasonable attorney's fees,
court costs, and investigatory costs. Penalties collected by the
attorney general under this section shall be deposited in the
general revenue fund and may be appropriated only for the
investigation and prosecution of other cases under this chapter.
Sec. 48.202. COURT ORDER TO DECLARE INDIVIDUAL A VICTIM OF
IDENTIFY THEFT. (a) A person who is injured by a violation of
Section 48.101 or who has filed a criminal complaint alleging an
offense under Section 32.51, Penal Code, may file an application
with a district court for the issuance of a court order declaring
that the person is a victim of identity theft. A person may file an
application under this section regardless of whether the person is
able to identify each person who allegedly transferred or used the
person's identifying information in an unlawful manner.
(b) A person is presumed to be a victim of identify theft
under this section if the person charged with an offense under
Section 32.51, Penal Code, is convicted of the offense.
(c) After notice and hearing, if the court is satisfied by a
preponderance of the evidence that the applicant has been injured
by a violation of Section 48.101 or is the victim of an offense
under Section 32.51, Penal Code, the court shall enter an order
containing:
(1) a declaration that the person filing the
application is a victim of identity theft resulting from a
violation of Section 48.101 or an offense under Section 32.51,
Penal Code, as appropriate;
(2) any known information identifying the violator or
person charged with the offense;
(3) the specific personal identifying information and
any related document used to commit the alleged violation or
offense; and
(4) information identifying any financial account or
transaction affected by the alleged violation or offense,
including:
(A) the name of the financial institution in
which the account is established or of the merchant involved in the
transaction, as appropriate;
(B) any relevant account numbers;
(C) the dollar amount of the account or
transaction affected by the alleged violation or offense; and
(D) the date of the alleged violation or offense.
(d) An order entered under this section must be sealed
because of the confidential nature of the information required to
be included in the order. The order may be opened and the order or a
copy of the order may be released only:
(1) to the proper officials in a civil proceeding
brought by or against the victim arising or resulting from a
violation of this chapter, including a proceeding to set aside a
judgment obtained against the victim;
(2) to the victim for the purpose of submitting the
copy of the order to a governmental entity or private business to:
(A) prove that a financial transaction or account
of the victim was directly affected by a violation of this chapter
or the commission of an offense under Section 32.51, Penal Code; or
(B) correct any record of the entity or business
that contains inaccurate or false information as a result of the
violation or offense;
(3) on order of the judge; or
(4) as otherwise required or provided by law.
(e) A court at any time may vacate an order issued under this
section if the court finds that the application or any information
submitted to the court by the applicant contains a fraudulent
misrepresentation or a material misrepresentation of fact.
(f) A copy of an order provided to a person under Subsection
(d)(1) must remain sealed throughout and after the civil
proceeding. Information contained in a copy of an order provided to
a governmental entity or business under Subsection (d)(2) is
confidential and may not be released to another person except as
otherwise required or provided by law.
Sec. 48.203. DECEPTIVE TRADE PRACTICE. A violation of this
chapter, other than Section 48.103, is a deceptive trade practice
actionable under Subchapter E, Chapter 17.
Sec. 48.204. AFFIRMATIVE DEFENSE. Good faith reliance on a
consumer report as defined by Section 20.01 by a financial
institution as defined by 31 U.S.C. Section 5312 is an affirmative
defense to an action brought against the financial institution
under this chapter.
SECTION 3. This Act takes effect September 1, 2005.