Connecticut Seal

Substitute Senate Bill No. 688

Public Act No. 03-156

AN ACT CONCERNING IDENTITY THEFT.

Be it enacted by the Senate and House of Representatives in General Assembly convened:

Section 1. Section 53a-129a of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2003):

(a) A person [is guilty of] commits identity theft when such person intentionally obtains personal identifying information of another person without the authorization of such other person and uses that information [for any unlawful purpose including, but not limited to, obtaining, or attempting] to obtain or attempt to obtain, money, credit, goods, services, property or medical information in the name of such other person without the consent of such other person.

(b) As used in this section, "personal identifying information" means [a] any name, number or other information that may be used, alone or in conjunction with any other information, to identify a specific individual including, but not limited to, such individual's name, date of birth, mother's maiden name, motor vehicle operator's license number, Social Security number, employee identification number, [mother's maiden name,] employer or taxpayer identification number, alien registration number, government passport number, health insurance identification number, demand deposit account number, savings account number, [or] credit card number, debit card number or unique biometric data such as fingerprint, voice print, retina or iris image, or other unique physical representation.

[(b) Identity theft is a class D felony. ]

Sec. 2. (NEW) (Effective October 1, 2003) (a) A person is guilty of identity theft in the first degree when such person commits identity theft, as defined in section 53a-129a of the general statutes, as amended by this act, and the value of the money, credit, goods, services or property obtained exceeds ten thousand dollars.

(b) Identity theft in the first degree is a class B felony.

Sec. 3. (NEW) (Effective October 1, 2003) (a) A person is guilty of identity theft in the second degree when such person commits identity theft, as defined in section 53a-129a of the general statutes, as amended by this act, and the value of the money, credit, goods, services or property obtained exceeds five thousand dollars.

(b) Identity theft in the second degree is a class C felony.

Sec. 4. (NEW) (Effective October 1, 2003) (a) A person is guilty of identity theft in the third degree when such person commits identity theft, as defined in section 53a-129a of the general statutes, as amended by this act.

(b) Identity theft in the third degree is a class D felony.

Sec. 5. (NEW) (Effective October 1, 2003) (a) A person is guilty of trafficking in personal identifying information when such person sells, gives or otherwise transfers personal identifying information, as defined in section 53a-129a of the general statutes, as amended by this act, of another person to a third person knowing that such information has been obtained without the authorization of such other person and that such third person intends to use such information for an unlawful purpose.

(b) Trafficking in personal identifying information is a class D felony.

Sec. 6. (NEW) (Effective October 1, 2003) Whenever a person is convicted of a violation of section 53a-129a of the general statutes, revision of 1958, revised to January 1, 2003, or section 2, 3 or 4 of this act, the court may issue such orders as are necessary to correct a public record that contains false information as a result of such violation.

Sec. 7. (NEW) (Effective October 1, 2003) Any person who believes that such person's personal identifying information has been obtained and used by another person in violation of section 53a-129a of the general statutes, revision of 1958, revised to January 1, 2003, or section 2, 3 or 4 of this act may file a complaint reporting such alleged violation with the law enforcement agency for the town in which such person resides. Such law enforcement agency shall accept such complaint, prepare a police report on the matter, provide the complainant with a copy of such report and investigate such alleged violation and any other offenses allegedly committed as a result of such violation and shall, if necessary, coordinate such investigation with any other law enforcement agencies.

Sec. 8. Section 54-1d of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2003):

(a) Except as provided in [subsection (b)] subsections (b) and (c) of this section, defendants in criminal actions shall be brought either to the court in the geographical area established pursuant to section 51-348, in which the crime was alleged to have been committed, or, if the arrest was by warrant, to the court in the geographical area in which the arrest was made, for arraignment. If the defendant was brought to the court in the geographical area in which the arrest was made for arraignment and was not released from custody after such arraignment, the defendant shall be presented to the court in the geographical area in which the crime was alleged to have been committed not later than the second court day following such arraignment. A criminal cause shall not fail on the ground that it has been submitted to a session of improper venue.

(b) Any defendant who is charged with multiple offenses under any provision of section 53a-127b or sections 53a-128a to 53a-128i, inclusive, where such offenses were alleged to have been committed in more than one geographical area established pursuant to section 51-348, may be presented to the court in any one of such geographical areas. The court may consolidate all such offenses into a single criminal action and shall have jurisdiction over such action.

(c) Any defendant who is charged with a violation of section 53a-129a of the general statutes, revision of 1958, revised to January 1, 2003, or section 2, 3 or 4 of this act and any defendant who is charged with any other offense committed as a result of such violation may be presented to the court in the geographical area in which the person whose personal identifying information has been obtained and used by the defendant resides.

Sec. 9. (NEW) (Effective October 1, 2003) (a) A consumer, as defined in section 36a-695 of the general statutes, who believes he or she is a victim of a violation of section 53a-129a of the general statutes, revision of 1958, revised to January 1, 2003, or section 2, 3 or 4 of this act may request a credit rating agency, as defined in section 36a-695 of the general statutes, to block and not report information appearing on his or her credit report, as defined in section 36a-695 of the general statutes, as a result of such violation. Such consumer shall submit such request, in writing, to the credit rating agency, together with proof of such consumer's identity and a copy of a police report prepared pursuant to section 7 of this act. Not later than thirty days after receipt of such request, the credit rating agency shall block reporting any information that the consumer alleges appears on his or her credit report as a result of such violation so that the information cannot be reported. The credit rating agency shall promptly notify the furnisher of the information that a police report has been filed, that a block has been requested and the effective date of the block.

(b) A credit rating agency may decline to block or may rescind any block of consumer information if the credit rating agency believes in good faith that: (1) The information was blocked due to a misrepresentation of fact by the consumer relevant to the request to block under this section, (2) the consumer agrees that the blocked information or portions of the blocked information were blocked in error, (3) the consumer knowingly obtained possession of goods, services or moneys as a result of the blocked transaction or transactions or the consumer should have known that he or she obtained possession of goods, services or moneys as a result of the blocked transaction or transactions, (4) the information was blocked due to fraud in which the consumer participated or of which the consumer had knowledge, and which may for purposes of this section be demonstrated by circumstantial evidence, or (5) the credit rating agency, in the exercise of good faith and reasonable judgment, has substantial reason based on specific, verifiable facts to doubt the authenticity of the consumer's report of a violation of section 53a-129a of the general statutes, revision of 1958, revised to January 1, 2003, or section 2, 3 or 4 of this act.

(c) If the credit rating agency declines to block information or rescinds the block of information pursuant to subsection (b) of this section, the credit rating agency shall promptly notify the consumer in the same manner as consumers are notified of the reinsertion of information pursuant to subsection (b) of section 36a-699b of the general statutes. The prior presence of the blocked information in the credit rating agency's file on the consumer is not evidence of whether the consumer knew or should have known that he or she obtained possession of any goods, services or moneys.

(d) A credit rating agency shall accept the consumer's version of the disputed information and correct the disputed item when the consumer submits to the credit rating agency documentation obtained from the source of the item in dispute or from public records confirming that the report was inaccurate or incomplete, unless the credit rating agency, in the exercise of good faith and reasonable judgment, has substantial reason based on specific, verifiable facts to doubt the authenticity of the documentation submitted and notifies the consumer in writing of that decision, explaining its reasons for unblocking the information and setting forth specific, verifiable facts on which the decision is based.

(e) A credit rating agency shall delete from a credit report inquiries for credit reports based upon credit requests that the credit rating agency verifies were initiated as a result of a violation of section 53a-129a of the general statutes, revision of 1958, revised to January 1, 2003, or section 2, 3 or 4 of this act.

(f) The provisions of this section do not apply to: (1) A credit rating agency that acts as a reseller of credit information by assembling and merging information contained in the databases of other credit rating agencies, and that does not maintain a permanent database of credit information from which new credit reports are produced, (2) a check services or fraud prevention services company that issues reports on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers or similar payment methods, or (3) a demand deposit account information service company that issues reports regarding account closures due to fraud, substantial overdrafts, automatic teller machine abuse or similar negative information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a demand deposit account at the inquiring bank or financial institution.

Sec. 10. Section 36a-699 of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2003):

Any person who wilfully violates any provision of sections 36a-695 to 36a-699, inclusive, or section 9 of this act shall be fined not more than one hundred dollars for a first offense and not more than five hundred dollars for a second offense, and shall be fined not more than one thousand dollars or be imprisoned for not more than six months, or both, for each subsequent offense.

Sec. 11. Section 52-571h of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2003):

(a) Any person aggrieved by an act constituting a violation of section 53a-129a of the general statutes, revision of 1958, revised to January 1, 2003, or section 2, 3 or 4 of this act may bring a civil action in the Superior Court for damages against the person who committed the violation.

(b) In any civil action brought under this section in which the plaintiff prevails, the court shall award the greater of one thousand dollars or treble damages, together with costs and a reasonable attorney's fee.

(c) No action under this section shall be brought but within two years from the date when the violation is discovered or in the exercise of reasonable care should have been discovered.

Sec. 12. (NEW) (Effective October 1, 2003) (a) For the purposes of this section, "person" means any individual, firm, partnership, association, corporation, limited liability company, organization or other entity, but does not include the state or any political subdivision of the state, or any agency thereof.

(b) On and after January 1, 2005, no person who accepts credit cards or debit cards for the transaction of business may print on a receipt provided to the cardholder (1) more than the last five digits of the credit card or debit card account number, or (2) the expiration date of the credit card or debit card.

(c) The provisions of subsection (b) of this section apply only to receipts that are electronically printed and do not apply to transactions in which the sole means of recording the cardholder's credit card or debit card account number is by handwriting or by an imprint or copy of the credit card or debit card.

(d) Any person who wilfully violates the provisions of subsection (b) of this section shall be fined not more than one hundred dollars for a first offense and not more than five hundred dollars for a second offense, and shall be fined not more than one thousand dollars or be imprisoned not more than six months, or both, for each subsequent offense.

Sec. 13. (NEW) (Effective October 1, 2003) (a) For the purposes of this section, "person" means any individual, firm, partnership, association, corporation, limited liability company, organization or other entity, but does not include the state or any political subdivision of the state, or any agency thereof.

(b) Except as provided in subsection (c) of this section, on and after January 1, 2005, no person shall:

(1) Publicly post or publicly display in any manner an individual's Social Security number. For the purposes of this subdivision, "publicly post" or "publicly display" means to intentionally communicate or otherwise make available to the general public;

(2) Print an individual's Social Security number on any card required for the individual to access products or services provided by such person;

(3) Require an individual to transmit such individual's Social Security number over the Internet, unless the connection is secure or the Social Security number is encrypted; or

(4) Require an individual to use such individual's Social Security number to access an Internet web site, unless a password or unique personal identification number or other authentication device is also required to access the Internet web site.

(c) The provisions of subsection (b) of this section shall apply with respect to group and individual health insurance policies providing coverage of the type specified in subdivisions (1), (2), (4), (6), (10) and (12) of section 38a-469 of the general statutes that are delivered, issued for delivery, amended, renewed or continued on and after July 1, 2005.

(d) This section does not prevent the collection, use or release of a Social Security number as required by state or federal law or the use of a Social Security number for internal verification or administrative purposes.

(e) Any person who wilfully violates the provisions of subsection (b) of this section shall be fined not more than one hundred dollars for a first offense and not more than five hundred dollars for a second offense, and shall be fined not more than one thousand dollars or be imprisoned not more than six months, or both, for each subsequent offense.

Approved June 26, 2003