Brief Description: Regulating electronic mail fraud.

Sponsors: Representatives Nixon, Morris, Hunter, B. Sullivan, Simpson, Ormsby, Morrell, Haler, Clibborn, Ericks, Williams, Darneille, Dunn, Dickerson, P. Sullivan, Green and Hudgins.

Hearing Date: 2/15/05

Staff: Kara Durbin (786-7133).

Background:

Unsolicited E-mail:

In 1998, legislation was enacted regulating commercial electronic mail (e-mail) messages, collectively referred to as "spam." A commercial electronic mail message is an e-mail message sent for the purpose of promoting real property, goods, or services for sale or lease. In particular, the laws prohibit the sending of commercial e-mail from a computer located in Washington to an e-mail address of a Washington resident if the commercial e-mail uses:

• a false or misleading return address;
• a false or misleading subject line; or
• a third party's e-mail address (domain name) without permission.

The law not only prohibits the sender from sending a false or misleading commercial e-mail message, but also prohibits anyone who conspires with the sender or who assists in the transmission of the commercial e-mail message. A sender is responsible for knowing that a recipient is a Washington resident, if that information is available, upon request, from the registrant of the Internet domain name contained in the recipient's electronic mail address, typically the internet service provider. The Attorney General and the Washington Association of Internet Service Providers have established a voluntary on-line registry where a Washington resident can register their e-mail address.

An interactive computer service (which includes internet service providers) may block the transmission of commercial e-mail that it reasonably believes is being sent in violation of the law and may not be held liable for this voluntary action taken in good faith.

A recipient or an internet service provider may bring a civil action against a sender who violates the laws relating to commercial electronic mail messages. In the case of a suit brought by a recipient, the penalty is the greater of $500 or actual damages incurred. In the case of a lawsuit brought by an internet service provider, the penalty is the greater of $1,000 or actual damages. A violation of laws relating to commercial electronic mail messages is also a violation of the Consumer Protection Act and may be enforced by the Attorney General. A violation of the Consumer Protection Act may result in a civil fine, treble damages, court costs, and attorneys' fees.

Phishing:

The term "phishing" generally refers to a type of internet activity that uses fraudulent e-mails and websites to solicit personal financial information from an e-mail recipient. Typically, a user receives an e-mail that appears to be from a familiar business or organization, such as an internet service provider, bank, or online retailer. The message usually requests that the recipient update or validate his or her account information by clicking on a link embedded in the e-mail. Once the recipient clicks on the link, the user is taken to a fraudulent website where the user is asked to input personal and confidential information.

Summary of Bill:

This law prohibits a person from soliciting, requesting, or taking any action to induce another person to provide personally identifying information by means of a web page, electronic mail message, or otherwise using the internet by representing oneself, either directly or by implication, to be a business or individual without the authority or approval of such business or individual.
"Personally identifiable information" is defined as any of the following types of information:

• Social Security Number;
• Driver's license number;
• Bank account number;
• Credit or debit card number;
• Personal Identification Number;
• Automated or electronic signature;
• Unique biometric data;
• Account passwords; or
• Any other piece of information that can be used to access an individual's financial accounts or to obtain goods or services.

A consumer can seek damages of up to $500 per violation, or actual damages, whichever is greater.

An internet service provider, an owner of a web page, or a trademark owner can seek to enjoin further violations, and may recover $5,000 per violation, or actual damages, whichever is greater. In addition, the court may increase the damage award up to three times (up to $15,000) if the defendant has engaged in a pattern and practice of engaging in the prohibited activities. The court may also award costs and reasonable attorneys' fees to the prevailing party.

A violation of these provisions is defined as an unfair or deceptive act for purposes of applying the Consumer Protection Act.

There is a severability clause.

Appropriation: None.

Fiscal Note: Not requested.

Effective Date: The bill takes effect 90 days after adjournment of session in which bill is passed.