Washington State House of Representatives Office of Program Research	BILL ANALYSIS
Financial Institutions & Insurance Committee

ESSB 5449

Brief Description:  Prohibiting identity theft.

Sponsors:  By Senators Prentice, Long, Winsley, Gardner, Franklin, Costa, Rasmussen and Kohl‑Welles; by request of Attorney General.

Brief Summary of Engrossed Substitute Bill

$Expands the definition of the crime of identity theft, increases the potential penalties, requires businesses to assist victims by providing access to information, and allows the court to enter orders requiring the correction of the victim=s financial records.

$Makes the crime of identity theft actionable under the Criminal Profiteering Act.

$Restricts contact by collection agencies with identity theft victims regarding debts that may  be the result of an alleged identity theft.  The victim is required to provide the agency with specified information substantiating the victim=s claim that the debt is the result of an identity theft.

$Requires credit reporting agencies to omit certain information from a credit report upon a showing by the victim of an alleged identity theft that the credit information may be the result of such a theft.

Hearing Date: 

Staff:  Thamas Osborn (786‑7129).

Background: 

In 1999, the legislature enacted a set of laws designed to address the problem of so-called "identity theft" and related crimes involving the improper use or acquisition of personal financial information.  In so doing, the legislature found that unlawfully obtained financial information can be a source of significant harm to a person=s privacy, financial security, and other interests.  That legislation is codified as Chapter 9.35 RCW, Identity Crimes.

The crime of identity theft is currently a class C felony, which allows for a maximum sentence of  five years in prison, or a  fine of $10,000, or both.  In addition to the criminal penalty, a person convicted of identity theft must pay the victim $500, or actual damages, including costs to repair the victim=s credit report, whichever is greater, as well as reasonable attorneys= fees.  If a business repeatedly commits identity theft, it also violates the Consumer Protection Act.

This bill has been requested by the Attorney General, and stems from the findings of a consumer privacy task force initiated by the Attorney General in 1999.

Summary of Engrossed Substitute Bill: 

Sharing of Information Relevant to Identity Theft.  Persons or business entities that have information relating to violations of the identity theft act and who may have done business with the perpetrator must provide, upon the request of the victim, copies of all information relevant to the identity theft.  Before providing the requested information to the victim, the business may require the victim to verify his or her identity.  When so requested, the victim must provide the business with the following verification: 1) a government issued photo identification card; and 2) a copy of a filed police report evidencing the victim=s claim; and 3) a written statement from the state patrol documenting that the victim=s identity has been verified.  A business may require compensation for the reasonable costs of providing the information.

A business that shares information with others for the purpose of aiding identity theft victims or assisting law enforcement will not be subject to civil or criminal liability, provided such action was taken in good faith.

A business may decline to provide the information when, in the exercise of good faith and reasonable judgment, it determines that the law does not require the disclosure of the information.

A business that fails to abide by the foregoing provisions requiring the disclosure of information may be in violation of the Consumer Protection Act.  An affected consumer may be awarded actual damages, or, in the case of willful violations, may additionally be awarded punitive damages in the amount of one thousand dollars, the costs of the action and reasonable attorney=s fees.  

Victim Identification Procedure.  A victim may provide fingerprints to the State Patrol to be filed for the purpose of identification in cases of identity theft.  Once the fingerprints have been filed, the State Patrol is required to provide the victim with a written statement verifying the alleged identity theft and informing businesses of their legal obligation to share relevant information with the victim.

Limitations Imposed On Collection Agencies.  A collection agency may not initiate oral contact with a debtor more than one time in 180 days in order to collect on debts allegedly created because of an identity theft,  provided the debtor/victim forwards specified information to the collection agency regarding the alleged theft.  The information that must be provided by the victim is as follows: 1) a written statement describing the nature of the fraud or theft and identifying the documents and/or accounts involved; 2) a certified copy of the relevant police report; 3) detailed information specifically identifying the relevant financial institutions, account identifiers, check numbers, etc.; 4) a legible copy of a government issued photo identification card that was issued prior to the date of the alleged identity theft; and 5) a statement advising the collection agency that the subject debt is being disputed as the result of an alleged identity theft involving the fraudulent use of the written instrument or account.  This prohibition goes into effect only if the specific written instruments and/or accounts identified by the victim are identical to those in the agency=s records pertaining to the debt. 

This section of the bill, Section 4, expires on April 1, 2004, and is replaced by Section 5, which goes into effect on the same day.  Section 5 is largely identical to Section 4, except it omits the requirement that the specific written instruments and/or accounts identified by the victim be identical to those on record in the files of the collection agency.

Under certain circumstances a collection agency may be exempted from liability despite  repeated oral contacts with a debtor that would otherwise violate the statute.  A collection agency does not violate the statute if it is acting in good faith and the contacts with the debtor fall under any one of several specified exceptions.

Limitations Imposed On Consumer Reporting Agencies.  Within thirty days of receiving proof of a consumer=s identification and a copy of a filed police report verifying the consumers claim that he or she is the victim of identity theft, a consumer reporting agency must permanently block information from a credit report that may be in the report as the result of the theft.  The credit reporting company must tell the entities providing information that the information has been blocked.  Under certain circumstances, such as errors or misrepresentation by the consumer, the credit reporting company or the entity providing the information may rescind the block..

Improperly Obtaining Financial Information.  The statute prohibiting the actual or attempted acquisition or disclosure of financial information obtained via fraud is amended so as to apply with respect to information received from a "financial information repository, financial services provider, merchant, corporation, trust, partnership, or unincorporated association." The law presently includes only a "financial information repository.@

Identity Theft.  The definition of the crime of identity theft is expanded to include the act of obtaining and/or possessing either a means of identification or financial information, when accompanied by the requisite criminal intent.  The law currently criminalizes only the "use" or "transfer" of certain information, and does not specifically include financial information.

Identity theft may be prosecuted as either a class B or a class C felony, depending on the aggregate value of the credit, property, or services obtained via the theft.  If the aggregate value is more than $1,500, the offense is a class B felony.  If the aggregate value is $1,500 or less, the offense is a class C felony.

Following a defendant=s conviction for identity theft, the sentencing court is empowered to issue an order to correct any public record that contains false information resulting from the theft.

The Consumer Protection Act is made applicable with respect to the provisions set forth Chapter 9.35 RCW, Identity Crimes.

Criminal Profiteering.  Identity theft crimes are added to the list of crimes falling under the category of  "criminal profiteering" and are thus made subject to the provisions of the Criminal Profiteering Act.  This act allows for the forfeiture of illegally obtained property and provides victims with civil remedies.

Appropriation:  None.

Fiscal Note:  Available.

Effective Date:  Ninety days after adjournment of session in which bill is passed.