Title: An act relating to identity theft.

Brief Description: Addressing identity theft.

Brief History:

Financial Institutions & Insurance: 2/1/06, 2/2/06 [DPS].

HOUSE COMMITTEE ON FINANCIAL INSTITUTIONS & INSURANCE

Majority Report: The substitute bill be substituted therefor and the substitute bill do pass. Signed by 10 members: Representatives Kirby, Chair; Ericks, Vice Chair; Roach, Ranking Minority Member; Tom, Assistant Ranking Minority Member; Newhouse, O'Brien, Serben, Simpson, Strow and Williams.

Minority Report: Do not pass. Signed by 1 member: Representative Santos.

Staff: Jon Hedegard (786-7127).

Background:

Privacy and Financial Fraud:
Gramm-Leach-Blilely Act. Passed in 1999, the Gramm-Leach-Blilely Act (GLBA) is a federal act that eliminates the long-standing legal barriers to the integration of banking, securities, and insurance firms, and generally overhauls the regulation of the financial services industry. The GLBA explicitly states that all financial institutions have a continuing obligation to consumers to protect the privacy and security of nonpublic personal information. Beginning on July 1, 2001, financial institutions are required to notify customers about their privacy practices and allow consumers to "opt out" of having their nonpublic personal information disclosed to nonaffiliated third parties. However, the GLBA carves out an exception to the prohibition against disclosing nonpublic personal information in the event such disclosure is necessary to protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability.

Fair Credit Reporting Act (Act). Washington's Act restricts the disclosure of consumer credit information by consumer reporting agencies. In general, the Act prohibits consumer reporting agencies from disclosing such information except in relation to customer initiated credit transactions or other legitimate business needs in connection with a commercial transaction involving the consumer.

Financial Literacy:
"Financial literacy" has been defined as the understanding of basic concepts of money and the skills needed to manage personal finances during the course of an individual's lifetime. It includes an understanding of how compound interest works, the meaning of net worth, the effects of annual percentage rates on credit cards, discernment of appropriate investments, price and term comparisons, and planning ahead for major transactions and life events, such as buying a home or car, or funding college or retirement.

In 2004, the Legislature created the Washington Financial Literacy Public-Private Partnership (Partnership) consisting of 12 to14 members, including legislators, financial services representatives, educators, and representatives from the Office of the Superintendent of Public Instruction (OSPI) and the Department of Financial Institutions. The Partnership is charged with developing a working definition of "financial literacy," identifying strategies to promote the use of financial literacy curricula in schools, serving as a resource, and seeking outcome measures to determine the effectiveness of educational efforts. The Partnership is directed to submit its final report to the Legislature and educational stakeholders by June 30, 2007.

The Washington Financial Literacy Education Partnership Account also was created to support the Partnership and its efforts to provide learning opportunities for students and professional development for educators. Public funds and donations may be included in the account. Money may be withdrawn from the account by the OSPI when equal matching amounts from private sources are received in the account.

Summary of Substitute Bill:

Privacy and Financial fraud:
Fraud alert network. The bill grants limited legal immunity to specified financial institutions and merchants with respect to the sharing of consumer information pursuant to participation in a statewide "fraud alert network." The phrase "fraud alert network" refers to a voluntary program of information sharing established by financial institutions and merchants for the purpose of preventing, detecting, and deterring financial crimes. The network may include a website where fraud-related consumer information may be posted and shared by authorized participants.

Financial crimes. "Financial crimes" are defined very broadly to include forgery, identity theft, robbery, embezzlement, tax evasion, money laundering, various fraud-related crimes, and many other offenses. The definition requires that the offense be committed for financial gain and that it be "chargeable or indictable" as a violation of state or federal law, though it does not require that a charge or indictment actually be issued.

Network standards. The fraud alert network must meet specified standards and requirements, including:

• participants must either be merchants or entities/persons meeting a very broad definition of "financial institutions;"
• access to the network must be limited to designated financial institutions or merchants;
• the sole purpose of the network must be for the sharing of information for the prevention, detection, and deterrence of financial crimes;
• information posted on the network must be accessible only to designated employees whose job-related duties are relevant to the use of such information for the prevention of financial crimes;
• network users must be informed that information cannot be used for routine business purposes related to credit evaluation or acquisition;
• information furnished to the network is limited to statements of fact that the provider reasonably believes to be true (subject to an exception for circumstances constituting an emergency); and
• the type of information provided to the network must fall under one of the specified categories of information allowed to be shared within the network.

Information furnished to the network. Information provided to the network must relate to suspected financial crimes and must be limited to statements of fact that the provider reasonably believes to be true. The bill also contains a detailed description of the broad categories of information that can be furnished to the network. Participants in the network are prohibited from furnishing information consisting of delinquent payment information or other information regarding credit history, except where such information forms an integral part of a body of information reasonably believed to be related to financial crime.

Immunity from legal liability. Financial institutions and merchants are granted broad legal immunity from civil liability stemming from their participation in the network, provided their participation is consistent with the requirements of the Act. This immunity does not apply with respect to violations of Washington statutes.

Exceptions to immunity provisions. A participant will not be immune from legal liability if he or she:

• knowingly provides false information to the network;
• fails to maintain procedures to ensure that information provided to the network is reliable and current;
• fails to maintain procedures to ensure that only properly designated individuals have access to the information from the network;
• improperly uses the information for the purpose of evaluating a person's credit worthiness or other commercial purpose;
• uses information derived from the network for any purpose other than that related to the prevention, deterrence, or prosecution of financial crimes; and
• improperly shares or sells access to the network.

However, immunity from civil liability applies only if the provider of the information "reasonably believes" the information to be true, unless an emergency exists and the provider notes that the information may not be reliable.

Fair Credit Reporting Act (Act). The bill states the intent that the provisions of the Act will not apply to the fraud alert network, provided the participants are in compliance with the other provisions of the bill.

Financial Literacy.
The bill appropriates $25,000 in 2007, and $25,000 in 2008, from the General Fund to the Partnership Account. To the extent funds are appropriated or available, the OSPI and the Partnership must make available to school districts a list of financial literacy skills and knowledge, instructional materials, assessments, and other relevant information. School districts are encouraged to provide students with opportunities to master financial literacy skills and knowledge.

Identity Theft Grant Program:
The Attorney General must develop a grant program to provide funding for persons and organizations that provide:

• education to aid seniors in preventing identity theft;
• assistance to aid seniors in recovering from identity theft;
• education to aid persons with a developmental disability and their legal representatives in preventing the theft of the identity of persons with a developmental disability;
• assistance to aid persons with a developmental disability and their legal representatives in recovering from the identity theft of the identity of persons with a developmental disability; or
• any combination of the above.

There is an appropriation of $1.5 million from the General Fund for the grant program to the Attorney General for the fiscal year ending June 30, 2007. The costs for developing and administering the grant program incurred by the Attorney General must be paid out of the appropriation.

The Attorney General must make an annual report to the Legislature regarding the development and the implementation of the grant program. The first report is due December 1, 2007.

Substitute Bill Compared to Original Bill:

The definition of "merchant" is modified by the elimination of the need for a physical presence in the state. Language is added stating how the Legislature intends the fraud network to be viewed in light of federal financial privacy laws. The database provisions relating to the fraud network are removed. The reporting requirement is removed. The credit freeze section is removed. Language is added requiring the costs for developing and administering the grant program incurred by the Attorney General to be paid out of the appropriation.

Appropriation: The sum of $1.5 million is appropriated from the State General Fund to the Attorney General for the Identity Theft Grant Program for the fiscal year ending June 30, 2007.

The sum of $50,000 is appropriated from the State General Fund to the Washington Financial Literacy Public-Private Partnership; $25,000 for the fiscal year ending June 30, 2007, and $25,000 for the fiscal year ending June 30, 2008.

Fiscal Note: Available.

Effective Date of Substitute Bill: The bill takes effect 90 days after adjournment of session in which bill is passed.

Testimony For: This bill is the product of work over the last several months with other legislators, the Attorney General, law enforcement, members of the private sector, and citizens. We have worked to deal with the problems of identity theft. There are many options. This bill includes several of the possible approaches. Identity theft is a major problem for seniors. My next door neighbor was 85 years old when she had a box of checks stolen from her mailbox. It was very confusing and very difficult for her. The stress debilitated her. She had to go into a nursing home and died months later. I was a victim of identity theft. It took four years to resolve. Not everyone has the ability to fight this. The bill focuses on vulnerable citizens. My organization assists senior citizens. An increasing amount of our time is spent on identity theft. Older people may lose their nest egg, the money set aside for their retirement or long-term care. Those assets cannot be replaced. The Attorney General held an identity theft summit in November. We asked for ideas and have issued a report. Some of the provisions of this bill came up at the summit. A fraud alert network was a concept that was discussed. In regards to the grant program, we asked to make sure that our administrative costs would be covered. We appreciate that the issue was addressed in the proposed substitute. The bill and the grant program are good ideas. Bankers are concerned about identity theft and have taken steps to fight it. A task force said that identity theft and financial fraud costs financial institutions $100 million in this state. Merchants face similar losses. The Washington Bankers Association created an internet-based system to fight fraud. Law enforcement is allowed to participate at no cost. The limited, targeted immunity in the bill will encourage more financial institutions to share information. Today, the system does not include retailers. We are studying federal privacy laws and trying to make sure that the federal laws will allow for banks and retailers to share this information and we support the financial literacy provisions. Community banks have a parallel fraud network. It includes $170 million of bad checks, 9,000 suspects, and has 400 participating law enforcement agencies.

(With concerns) I am a guardian of a 94 year old woman who had well over $1 million stolen from her due to various fraudulent activities and financial crimes. This bill would help in many areas. There are some holes in the bill though. The bill would reduce the impact and amount of money involved in fraud. In her case, people at banks knew of the fraud and told her about it but she referred them to the advisers who were defrauding her. The banks felt they could not go to the police because it would violate her privacy. This bill would have helped. Banks have an incentive to protect deposited money. Credit card companies and mortgage lenders are different. They have something to gain. Additional fees can be recovered. The bill states that information can't be used in considering loans. That is wrong. Lenders can benefit from fraud. I oppose the bill if that provision is not changed. The language regarding the types of information should be permissive. I am unclear if that is the case. The provision regarding the Federal Credit Reporting Act is not clear to me. The appropriation regarding financial literacy should be changed. Financial literacy is important but that money should be spent fighting fraud.

Testimony Against: None.

Persons Testifying: Meg Battson, Sally Nixon and Jane Waldron, Aging and Long Term Care Pierce County; Joan Hildebrant; Denny Eliason, Washington Bankers Associations; Brad Tower, Washington Independent Community Bankers; and Steve Larson, Washington Attorney General.

(With Concerns) Robert Forgrave.

Persons Signed In To Testify But Not Testifying: None.