File No. 168

Senate, March 26, 2008

The Committee on Insurance and Real Estate reported through SEN. CRISCO of the 17th Dist., Chairperson of the Committee on the part of the Senate, that the substitute bill ought to pass.

AN ACT CONCERNING IDENTITY THEFT.

Be it enacted by the Senate and House of Representatives in General Assembly convened:

Section 1. Section 4a-20 of the general statutes is repealed and the following is substituted in lieu thereof (Effective July 1, 2008):

The State Insurance and Risk Management Board shall determine the method by which the state shall insure itself against losses by the purchase of insurance governed by the provisions of title 38a to obtain the broadest coverage at the most reasonable cost. Such coverage shall include insurance against losses incurred by individuals due to identity theft, as defined in section 53a-129a, resulting from the loss of personal identifying information by the state. It shall direct the negotiations for purchase of such insurance and determine whether deductible or other risk retention provisions should be included in the insurance contract. Wherever appropriate it shall determine that the state shall act as a self-insurer and may request funds from the contingency fund to establish reserves and carry out such practices as are necessary to safeguard the self-insurance activity. Said board may develop and implement risk management and loss prevention programs related to insurance plans established pursuant to the provisions of sections 4a-19 to 4a-21, inclusive, and may recommend to the Governor and the General Assembly the enactment of policies designed to reduce risks and hazards that may result in state liability for tortious conduct. It shall designate the agent or agents of record and shall select the companies from whom insurance coverage and surety bonds shall be purchased. Notwithstanding any other provision of the general statutes, including without limitation sections 38a-707 and 38a-825, it shall have full authority to negotiate either a commission or fee structure to compensate the agent or agents of record for services performed. It shall also have full authority to retain consulting firms and to negotiate their fee compensation for services performed. Any refund, dividend or other payment from any insurance company in connection with insurance for the state shall be returned to the Comptroller for deposit in the General Fund. The board shall establish specifications for each contract of insurance and shall request bids for each such contract through the agent of record. Each such contract shall be for a specified period of time.

Sec. 2. Section 4-142 of the general statutes is repealed and the following is substituted in lieu thereof (Effective July 1, 2008):

There shall be a Claims Commissioner who shall hear and determine all claims against the state except: (1) Claims for the periodic payment of disability, pension, retirement or other employment benefits; (2) claims upon which suit otherwise is authorized by law including suits to recover similar relief arising from the same set of facts; (3) claims for which an administrative hearing procedure otherwise is established by law; (4) requests by political subdivisions of the state for the payment of grants in lieu of taxes; and (5) claims for the refund of taxes. Notwithstanding subdivisions (1) to (5), inclusive, of this section, the Claims Commissioner shall hear and determine claims, pursuant to the provisions of sections 4-147 to 4-165b, inclusive, for losses incurred by an individual due to identity theft, as defined in section 53a-129a, resulting from the loss of personal identifying information by the state.

Statement of Legislative Commissioners:

"Data" was changed to "identifying information" for accuracy.

The following fiscal impact statement and bill analysis are prepared for the benefit of members of the General Assembly, solely for the purpose of information, summarization, and explanation, and do not represent the intent of the General Assembly or either chamber thereof for any purpose:

OFA Fiscal Note

State Impact:

Note: GF=General Fund

Municipal Impact: None

Explanation

The bill could result in a potentially significant cost to the State Insurance and Risk Management Board (IRM). The bill requires that IRM insure the state against losses incurred because of the state's loss of personal identifying information. The bill requires the claims commissioner to hear and determine claims for these losses, which can be accomplished within existing agency resources.

IRM requires insurance premium reimbursement of all state agencies that do not receive General Fund money for their property, auto, surety bond, and other insurance premiums paid by IRM. The insurance premiums for state agencies that do receive General Fund money do not get reimbursed. The premiums for these agencies are funded out of IRM's General Fund operating budget.  As insurance premiums are increased due to the additional insurance coverage required by the bill, costs will increase for IRM. Additional cost information will be available after IRM submits an underwriting application for insurance coverage against losses incurred due to identity theft.

The Out Years

The cost of the increased insurance coverage premiums would continue into the future.



OLR Bill Analysis

sSB 315

AN ACT CONCERNING IDENTITY THEFT.

SUMMARY:

This bill requires the State Insurance and Risk Management Board to insure the state against losses people incur due to identity theft resulting from the state's loss of personal identifying information. It requires the claims commissioner to hear and determine claims for these losses.

EFFECTIVE DATE: July 1, 2008

IDENTITY THEFT

Crimes

Under existing law, a person commits identity theft when he or she intentionally obtains, without permission, another person's personal identifying information and uses it to obtain or attempt to obtain money, credit, goods, services, property, or medical information.

By law, it is:

1. first-degree identity theft, a class B felony (up to $15,000 fine, one to 20 years in prison, or both), when the theft involves money, credit, goods, services, or property valued at over $10,000;

2. second-degree identity theft, a class C felony (up to $10,000 fine, one to 10 years in prison, or both), when the value is between $5,000 and $10,000; and

3. third-degree identity theft, a class D felony (up to $5,000 fine, one to five years in prison, or both), when the value is $5,000 or less.

A person commits trafficking in personal identifying information, a class D felony, when he or she sells, gives, or otherwise transfers another person's personal identifying information to a third person knowing that (1) it was obtained without permission and (2) the third person intends to use it for an unlawful purpose.

Definition

The law defines "personal identifying information" as any name, number, or other information that may be used, alone or with other information, to identify a specific individual. It includes a person's:

1. name;

2. birth date;

3. mother's maiden name;

4. driver's license, Social Security, employee identification, employer or taxpayer identification, alien registration, government passport, health insurance identification, demand deposit or savings account, or credit or debit card number; or

5. unique biometric data (e.g., fingerprint, voice print, retina, or iris image) or other physical representation.

BACKGROUND

State Insurance and Risk Management Board

The law requires the State Insurance and Risk Management Board to purchase insurance with the broadest coverage and at the most reasonable cost to insure the state against losses. The board must direct the purchasing negotiations and determine whether the insurance contract should include deductibles or other risk retention provisions. Where appropriate, it must determine that the state self-insure and may request funds to establish reserves and carry out practices necessary to safeguard the self-insurance activity. It may develop and implement risk management and loss prevention programs related to insurance plans.

Claims Commissioner

The law requires those who wish to sue the state to go to the claims commissioner unless their case falls within a statutory exception. They must file their claim within one year after it accrues. A claim accrues on the date the damage or injury is sustained or discovered or, in the exercise of reasonable care, should have been discovered. But no claim may be presented more than three years after the date of event at issue.

The law excludes (1) claims for which an administrative hearing procedure is established by law; (2) claims for tax refunds and the periodic payment of disability, pensions, retirement, or other employment benefits; and (3) political subdivisions' requests for payments of grants in lieu of taxes.

Civil Action

By law, identity theft victims can bring a civil action for damages against their offender in Superior Court. The law requires courts to award prevailing plaintiffs the greater of $1,000 or treble damages, costs, and reasonable attorney fees. There is a two-year statute of limitations for bringing the action that starts on the date the violation is discovered or reasonably should have been discovered.

Related Bills

sSB 30, which the General Law Committee reported, changes the criteria for determining when a person commits identity theft from intentionally obtaining to knowingly using another person's personal identifying information without permission for the reasons specified by law. Among other things, it also requires courts to (1) award prevailing plaintiffs in civil actions involving identity theft restitution and (2) include in damages the plaintiff's documented lost wages and financial loss.

sHB 5760, which the General Law Committee reported, requires a state agency, person, or business that loses or discloses a person's personal identifying information in error to pay for at least two years of commercially available identity theft monitoring and protection for that person if identity theft results, plus the costs and fees to restore his or her identity.

sSB 671, which the Judiciary Committee reported, requires the state, if it loses or discloses in error a person's Social Security number, to inform the person within seven days of discovering it and offer him or her at least two years of commercially available identity theft monitoring and protection. It permits the aggrieved person to bring a civil action against the state in Superior Court.

COMMITTEE ACTION

Insurance and Real Estate Committee

Joint Favorable