AN ACT CONCERNING CONSUMER PRIVACY AND IDENTITY THEFT.

Substitute Senate Bill No. 838

Public Act No. 09-239

AN ACT CONCERNING CONSUMER PRIVACY AND IDENTITY THEFT.

Be it enacted by the Senate and House of Representatives in General Assembly convened:

Section 1. Section 53a-129a of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2009):

(a) A person commits identity theft when such person [intentionally obtains personal identifying information of another person without the authorization of such other person and] knowingly uses [that] personal identifying information of another person to obtain or attempt to obtain, in the name of such other person, money, credit, goods, services, property or medical information [in the name of such other person] without the consent of such other person.

(b) As used in this section, "personal identifying information" means any name, number or other information that may be used, alone or in conjunction with any other information, to identify a specific individual including, but not limited to, such individual's name, date of birth, mother's maiden name, motor vehicle operator's license number, Social Security number, employee identification number, employer or taxpayer identification number, alien registration number, government passport number, health insurance identification number, demand deposit account number, savings account number, credit card number, debit card number or unique biometric data such as fingerprint, voice print, retina or iris image, or other unique physical representation.

Sec. 2. Section 53a-129b of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2009):

(a) A person is guilty of identity theft in the first degree when such person commits identity theft, as defined in section 53a-129a, as amended by this act, of another person and (1) such other person is under sixty years of age, and the value of the money, credit, goods, services or property obtained exceeds ten thousand dollars, or (2) such other person is sixty years of age or older, and the value of the money, credit, goods, services or property obtained exceeds five thousand dollars.

(b) Identity theft in the first degree is a class B felony.

Sec. 3. Section 53a-129c of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2009):

(a) A person is guilty of identity theft in the second degree when such person commits identity theft, as defined in section 53a-129a, as amended by this act, of another person and such other person is under sixty years of age, and the value of the money, credit, goods, services or property obtained exceeds five thousand dollars, or such other person is sixty years of age or older.

(b) Identity theft in the second degree is a class C felony.

Sec. 4. Section 53a-130 of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2009):

(a) A person is guilty of criminal impersonation when [he] such person: (1) Impersonates another and does an act in such assumed character with intent to obtain a benefit or to injure or defraud another; or (2) pretends to be a representative of some person or organization and does an act in such pretended capacity with intent to obtain a benefit or to injure or defraud another; or (3) pretends to be a public servant other than a sworn member of an organized local police department or the Division of State Police within the Department of Public Safety, or wears or displays without authority any uniform, badge or shield by which such public servant is lawfully distinguished, with intent to induce another to submit to such pretended official authority or otherwise to act in reliance upon that pretense.

(b) Criminal impersonation is a class [B] A misdemeanor.

Sec. 5. (NEW) (Effective October 1, 2009) (a) For the purposes of this section, (1) "access device" includes, but is not limited to, any card, plate, code, account number, mobile identification number, personal identification number, telecommunication service access equipment, card-reading device, scanning device, reencoder or other means that could be used to access financial resources or obtain the financial information, personal information or benefits of another person, and (2) "personal identifying information" has the same meaning as provided in section 53a-129a of the general statutes, as amended by this act.

(b) A person is guilty of unlawful possession of a personal identifying information access device when such person possesses an access device, document-making equipment or authentication implement for the purpose of fraudulently altering, obtaining or using the personal identifying information of another person.

Sec. 6. (NEW) (Effective October 1, 2009) (a) Any license, registration or certificate issued by the state or any political subdivision of the state that was based upon an application containing any material false statement of personal identifying information, as defined in section 53a-129a of the general statutes, as amended by this act, is void from the date of issuance and shall be surrendered, on demand, to the issuing authority, provided the issuing authority has complied with the notice requirements set forth in subsection (c) of section 4-182 of the general statutes. Any moneys paid for such license, registration or certificate shall be forfeited to the issuing authority.

(b) No person shall obtain, attempt to obtain or assist in the procurement of any license, registration or certificate for another person by misrepresentation or impersonation.

(c) Any license, registration or certificate obtained by misrepresentation or impersonation is void from the date of issuance and shall be surrendered, on demand, to the issuing authority, provided the issuing authority has complied with the notice requirements set forth in subsection (c) of section 4-182 of the general statutes. Any moneys paid for such license, registration or certificate shall be forfeited to the issuing authority.

(d) Nothing in this section shall be construed as a limitation upon the power or authority of the state or any political subdivision thereof to seek any administrative, legal or equitable relief permitted by law.

(e) Any person who violates subsection (b) of this section shall be guilty of a class A misdemeanor.

Sec. 7. Section 52-571h of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2009):

(a) Any person aggrieved by an act constituting a violation of section 53a-129a of the general statutes, revision of 1958, revised to January 1, 2003, or section 53a-129b, as amended by this act, 53a-129c, as amended by this act, [or] 53a-129d or 53a-129e may bring a civil action in the Superior Court for damages against the person who committed the violation.

(b) In any civil action brought under this section in which the plaintiff prevails, the court shall award the greater of one thousand dollars or treble damages, together with costs and a reasonable attorney's fee. Damages shall include, but need not be limited to, documented lost wages and any financial loss suffered by the plaintiff as a result of identity theft, as defined in section 53a-129a, as amended by this act, section 53a-129b, as amended by this act, or section 53a-129c, as amended by this act. The court may award other remedies provided by law, including, but not limited to, the costs of providing not less than two years of commercially available identity theft monitoring and protection for such individual.

(c) No action under this section shall be brought but within [two] three years from the date when the violation is discovered or in the exercise of reasonable care should have been discovered.

Sec. 8. Section 54-93a of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2009):

Whenever a person is convicted of a violation of section 53a-129a of the general statutes, revision of 1958, revised to January 1, 2003, [or] section 53a-129b, as amended by this act, 53a-129c, as amended by this act, [or] 53a-129d or 53a-129e, the court [may] shall issue such orders as are necessary to correct a public record that contains false information as a result of such violation.

Sec. 9. Subsection (e) of section 54-1d of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2009):

(e) Any defendant who is charged with a violation of section 53a-129a of the general statutes, revision of 1958, revised to January 1, 2003, [or] section 53a-129b, as amended by this act, 53a-129c, [or] as amended by this act, 53a-129d or 53a-129e, and any defendant who is charged with any other offense committed as a result of such violation may be presented to the court in the geographical area in which the person whose personal identifying information has been obtained and used by the defendant resides and may be prosecuted in such geographical area or judicial district.

Sec. 10. (NEW) (Effective October 1, 2009) (a) Each employer shall obtain and retain employment applications in a secure manner and shall employ reasonable measures to destroy or make unreadable such employment applications upon disposal. Such measures shall, at a minimum, include the shredding or other means of permanent destruction of such employment applications in a secure setting. For purposes of this section, "employer" shall have the meaning prescribed to such term in section 31-128a of the general statutes.

(b) Any person or entity that violates the provisions of this section shall be subject to a civil penalty of five hundred dollars for each violation, provided such civil penalty shall not exceed five hundred thousand dollars for any single event.

(d) Any civil penalties received pursuant to this section shall be deposited into the privacy protection guaranty and enforcement account established pursuant to section 16 of this act.

Sec. 11. (NEW) (Effective October 1, 2009) (a) Any license, registration or certificate issued by the state or any political subdivision of the state, that is physically altered to conceal or misrepresent a material fact, is void from the date of such alteration and shall be surrendered, on demand, to the issuing authority, provided the issuing authority has complied with notice requirements set forth in subsection (c) of section 4-182 of the general statutes. Any moneys paid for such license, registration or certificate shall be forfeited to the issuing authority.

(b) No person shall alter any license, registration or certificate issued by the state or any political subdivision of the state.

(c) Any license, registration or certificate altered in violation of subsection (b) of this section shall be void from the date of alteration and shall be surrendered, on demand, to the issuing authority, provided the issuing authority has complied with notice requirements set forth in subsection (c) of section 4-182 of the general statutes. Any moneys paid for such license, registration or certificate shall be forfeited to the issuing authority.

(e) Any person who violates subsection (b) of this section shall be guilty of a class A misdemeanor.

Sec. 12. (NEW) (Effective October 1, 2009) (a) All property constituting, or derived from, the proceeds obtained, directly or indirectly, by a person as a result of a violation of section 53a-129a of the general statutes, revision of 1958, revised to January 1, 2003, section 53a-129b of the general statutes, as amended by this act, 53a-129c of the general statutes, as amended by this act, 53a-129d of the general statutes, 53a-129e of the general statutes or 53a-130 of the general statutes, as amended by this act, or section 5, 6 or 11 of this act shall be subject to forfeiture to the state pursuant to subsection (b) of this section.

(b) Not later than ninety days after the seizure of property subject to forfeiture pursuant to subsection (a) of this section, the Chief State's Attorney or a deputy chief state's attorney, state's attorney or assistant or deputy assistant state's attorney may petition the court in the nature of a proceeding in rem to order forfeiture of said moneys or property. Such proceeding shall be deemed a civil suit in equity, in which the state shall have the burden of proving all material facts by clear and convincing evidence. The court shall identify the owner of such property and any other person as appears to have an interest therein, and order the state to give notice to such owner and any interested person by certified or registered mail, and shall promptly, but not less than two weeks after notice, hold a hearing on the petition. No testimony offered or evidence produced by such owner or interested person at such hearing and no evidence discovered as a result of or otherwise derived from such testimony or evidence, may be used against such owner or interested person in any proceeding, except that no such owner or interested person shall be immune from prosecution for perjury or contempt committed while giving such testimony or producing such evidence. At such hearing the court shall hear evidence and make findings of fact and enter conclusions of law and shall issue a final order, from which the parties shall have such right of appeal as from a decree in equity.

(c) No property shall be forfeited under this section to the extent of the interest of an owner or lienholder by reason of any act or omission committed by another person if such owner or lienholder did not know and could not have reasonably known that such property was being used or was intended to be used in, or was derived from, criminal activity.

(d) Notwithstanding the provisions of subsection (a) of this section, no property used or intended to be used by the owner thereof to pay legitimate attorney's fees in connection with his defense in a criminal prosecution shall be subject to forfeiture under this section.

(e) Any property ordered forfeited pursuant to subsection (b) of this section shall be sold at public auction conducted by the Commissioner of Administrative Services.

(f) The proceeds from any sale of property under subsection (e) of this section shall be applied: (1) To payment of the balance due on any lien preserved by the court in the forfeiture proceedings; (2) to payment of any costs incurred for the storage, maintenance, security and forfeiture of such property; and (3) to payment of court costs. The balance, if any, shall be deposited the privacy protection guaranty and enforcement account established under section 16 of this act.

Sec. 13. Section 42-471 of the general statutes, as amended by public act 09-71, is amended by adding subsection (h) as follows (Effective from passage):

(NEW) (h) Any civil penalties received pursuant to this section shall be deposited into the privacy protection guaranty and enforcement account established pursuant to section 16 of this act.

Sec. 14. Section 42-470 of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2009):

(a) For the purposes of this section, "person" means any individual, firm, partnership, association, corporation, limited liability company, organization or other entity, but does not include the state or any political subdivision of the state, or any agency thereof.

(b) Except as provided in subsection (c) of this section, [on and after January 1, 2005,] no person shall:

(1) Publicly post or publicly display in any manner an individual's Social Security number. For the purposes of this subdivision, "publicly post" or "publicly display" means to intentionally communicate or otherwise make available to the general public;

(2) Print an individual's Social Security number on any card required for the individual to access products or services provided by such person;

(3) Require an individual to transmit such individual's Social Security number over the Internet, unless the connection is secure or the Social Security number is encrypted; or

(4) Require an individual to use such individual's Social Security number to access an Internet web site, unless a password or unique personal identification number or other authentication device is also required to access the Internet web site.

(c) The provisions of subsection (b) of this section shall apply with respect to group and individual health insurance policies providing coverage of the type specified in subdivisions (1), (2), (4), (6), (10) and (12) of section 38a-469 that are delivered, issued for delivery, amended, renewed or continued on and after July 1, 2005.

(d) This section does not prevent the collection, use or release of a Social Security number as required by state or federal law or the use of a Social Security number for internal verification or administrative purposes.

(e) Any person who wilfully violates the provisions of subsection (b) of this section shall be fined not more than one hundred dollars for a first offense and not more than five hundred dollars for a second offense, and shall be fined not more than one thousand dollars or be imprisoned not more than six months, or both, for each subsequent offense.

(f) Any person who wilfully violates the provisions of subsection (b) of this section shall be subject to a civil penalty of five hundred dollars for each such violation, provided such civil penalty shall not exceed five hundred thousand dollars for any single event.

(g) All civil penalties received pursuant to subsection (f) of this section shall be deposited into the privacy protection guaranty and enforcement account established under section 16 of this act.

Sec. 15. (NEW) (Effective from passage) (a) Except as otherwise provided in section 42-471 of the general statutes, as amended by this act, the Commissioner of Consumer Protection may conduct investigations and hold hearings on any matter under the provisions of section 42-470 of the general statutes, as amended by this act, or 42-471 of the general statutes, as amended by this act, section 10, 14 or 17 of this act or any regulation adopted pursuant to section 19 of this act. The commissioner may issue subpoenas, administer oaths, compel testimony and order the production of books, records, papers and documents. If any person refuses to appear, testify or produce any book, record, paper or document when so ordered, upon application of the commissioner, the Superior Court may make such order as may be appropriate to aid in the enforcement of this section.

(b) (1) The Attorney General, at the request of the Commissioner of Consumer Protection, may apply to the Superior Court for an order temporarily or permanently restraining and enjoining any person from violating any provision of section 42-470 of the general statutes, as amended by this act, or 42-471 of the general statutes, as amended by this act, section 10, 14 or 17 of this act or any regulation adopted pursuant to section 19 of this act.

(2) The Attorney General, at the request of any other state agency charged with enforcement of section 42-471 of the general statutes, as amended by this act, pursuant to subsection (d) of said section, may apply to the Superior Court for an order temporarily or permanently restraining and enjoining any person from violating any provision of section 42-471 of the general statutes, as amended by this act.

Sec. 16. (NEW) (Effective from passage) (a) There is established a "privacy protection guaranty and enforcement account" which shall be a nonlapsing account within the General Fund. The account may contain any moneys required by law to be deposited in the account. The account shall be used by the Commissioner of Consumer Protection: (1) For the reimbursement of losses sustained by individuals injured by a violation of the provisions of section 42-470 of the general statutes, as amended by this act, or 42-471 of the general statutes, as amended by this act, section 10, 14 or 17 of this act or any regulation adopted pursuant to section 19 of this act, and (2) for the enforcement of provisions of section 42-470 of the general statutes, as amended by this act, or 42-471 of the general statutes, as amended by this act, section 10, 14 or 17 of this act or any regulation adopted pursuant to section 19 of this act.

(b) Payments received pursuant to section 42-470 of the general statutes, as amended by this act, or 42-471 of the general statutes, as amended by this act, section 10, 14 or 17 of this act or any regulation adopted pursuant to section 19 of this act, shall be credited to the privacy protection guaranty and enforcement account. Any money in the privacy protection guaranty and enforcement account may be invested or reinvested and any interest arising from such investments shall be credited to said account.

(c) Whenever an individual obtains a court judgment against any person or entity for a violation of section 42-470 of the general statutes, as amended by this act, or 42-471 of the general statutes, as amended by this act, section 10, 14 or 17 of this act or any regulation adopted pursuant to section 19 of this act, such individual may, upon the final determination of, or expiration of time for appeal in connection with any such judgment, apply to the Commissioner of Consumer Protection for an order directing payment out of said account of the amount unpaid upon the judgment for actual damages and costs taxed by the court against the person or entity, exclusive of punitive damages. The application shall be made on forms provided by the commissioner and shall be accompanied by a certified copy of the court judgment obtained against the person or entity, together with a notarized affidavit, signed and sworn to by the individual, affirming that the individual: (1) Has complied with all the requirements of this subsection; (2) has obtained a judgment stating the amount thereof and the amount owing thereon at the date of application; and (3) except for a judgment obtained by the individual in small claims court, has caused to be issued a writ of execution upon such judgment, and the officer executing the same has made a return showing that no bank accounts or real property of the person or entity liable to be levied upon in satisfaction of the judgment could be found, or that the amount realized on the sale of them or of such of them as were found, under the execution, was insufficient to satisfy the actual damage portion of the judgment, or stating the amount realized and the balance remaining due on the judgment after application thereon of the amount realized. A true and attested copy of such executing officer's return, when required, shall be attached to such application and affidavit.

(d) Upon receipt of such application together with such certified copy of the court judgment, notarized affidavit and true and attested copy of the executing officer's return, when required, the commissioner or the commissioner's designee shall inspect such documents for their veracity and upon a determination that such documents are complete and authentic, and a determination that the individual has not been paid, the commissioner shall order payment out of said account of the amount unpaid upon the judgment for actual damages and costs taxed by the court against the person or entity, exclusive of punitive damages.

(e) Whenever an individual is awarded an order of restitution against any person or entity for loss or damages sustained by reason of a violation of section 10, 14 or 17 of this act or any regulation adopted pursuant to section 19 of this act in a proceeding brought by the Attorney General at the request of the commissioner pursuant to section 42-470 of the general statutes, as amended by this act, or 42-471 of the general statutes, as amended by this act, or in a proceeding brought by the Attorney General, such individual may, upon the final determination of, or expiration of time for appeal in connection with any such order of restitution, apply to the commissioner for an order directing payment out of said account of the amount unpaid upon the order of restitution. The commissioner may issue such order upon a determination that the individual has not been paid.

(f) Before the commissioner shall issue any order directing payment out of the account to an individual pursuant to this section, the commissioner shall first notify the person or entity of the individual's application for an order directing payment out of the account and of the person or entity's right to a hearing to contest the disbursement in the event that the person or entity has already paid the individual. Such notice shall be given to the person or entity not later than fifteen days after the receipt by the commissioner of the individual's application for an order directing payment out of said account. If the person or entity requests a hearing in writing by certified mail not later than fifteen days after receipt of the notice from the commissioner, the commissioner shall grant such request and shall conduct a hearing in accordance with the provisions of chapter 54 of the general statutes. If the commissioner receives no written request by certified mail from the person or entity for a hearing not later than fifteen days after the person's or entity's receipt of such notice, the commissioner shall determine that the individual has not been paid, and the commissioner shall issue an order directing payment out of said account for the amount unpaid upon the judgment for actual damages and costs taxed by the court against the person or entity, exclusive of punitive damages, or for the amount unpaid upon the order of restitution.

(g) The commissioner or the commissioner's designee may proceed against any person or entity for an order of restitution arising from loss or damages sustained by any individual by reason of such person's or entity's violation of any of the provisions of section 42-470 of the general statutes, as amended by this act, or 42-471 of the general statutes, as amended by this act, section 10, 14 or 17 of this act or any regulation adopted pursuant to section 19 of this act. Any such proceeding shall be held in accordance with the provisions of chapter 54 of the general statutes. In the course of such proceeding, the commissioner or the commissioner's designee shall decide whether to order restitution arising from such loss or damages, and whether to order payment out of said account. The commissioner or the commissioner's designee may hear complaints of all individuals submitting claims against a single person or entity in one proceeding.

(h) No application for an order directing payment out of said account shall be made later than three years from the final determination of or expiration of time for appeal in connection with any judgment or order of restitution.

(i) Whenever an individual satisfies the commissioner or the commissioner's designee that it is not practicable to comply with the requirements of subdivision (3) of subsection (c) of this section and that the individual has taken all reasonable steps to collect the amount of the judgment or the unsatisfied part thereof and has been unable to collect the same, said commissioner or said designee may, in his or her discretion, dispense with the necessity for complying with such requirement.

(j) In order to preserve the integrity of said account, the commissioner, in his or her sole discretion, may order payment out of said account of an amount less than the actual loss or damages incurred by the individual or less than the order of restitution awarded by the commissioner or the Superior Court.

(k) If the money deposited in said account is insufficient to satisfy any duly authorized claim or portion thereof, the commissioner shall, when sufficient money has been deposited in the account, satisfy such unpaid claims or portions thereof, in the order that such claims or portions thereof were originally determined.

(l) When the commissioner has caused any sum to be paid from said account to an individual, the commissioner shall be subrogated to all of the rights of the individual up to the amount paid plus reasonable interest, and prior to receipt of any payment from said account, the individual shall assign all of this right, title and interest in the claim up to such amount to the commissioner, and any amount and interest recovered by the commissioner on the claim shall be deposited in said account.

(m) If the commissioner orders the payment of any amount as a result of a claim against any party, said commissioner shall determine if the person or entity is possessed of assets liable to be sold or applied in satisfaction of the claim on said account. If the commissioner discovers any such assets, the Attorney General shall take any action necessary for the reimbursement of said account.

(n) If the commissioner orders the payment of an amount as a result of a claim against any party, said commissioner may enter into an agreement with the party whereby the party agrees to repay said account in full in the form of periodic payments over a set period of time.

Sec. 17. (NEW) (Effective October 1, 2009) Any person filing with the Commissioner of Consumer Protection any notice, statement or other document required under the provisions of section 42-470 of the general statutes, as amended by this act, or 42-471 of the general statutes, as amended by this act, section 10 of this act, sections 14 to 18, inclusive, of this act or of any regulation adopted pursuant to section 19 of this act, which is false or untrue or contains any material misstatement of fact shall be fined not less than five hundred dollars nor more than five thousand dollars for each violation. All fines received pursuant to this section shall be deposited in the privacy protection guaranty and enforcement account established pursuant to section 16 of this act.

Sec. 18. (NEW) (Effective from passage) Any person aggrieved by any decision or order of the Commissioner of Consumer Protection pursuant to section 42-470 of the general statutes, as amended by this act, or 42-471 of the general statutes, as amended by this act, as applicable, section 10 of this act, sections 14 to 18, inclusive, of this act or any regulation adopted pursuant to section 19 of this act, may appeal in accordance with the provisions of chapter 54 of the general statutes.

Sec. 19. (NEW) (Effective from passage) (a) The Commissioner of Consumer Protection may adopt regulations, in accordance with the provisions of chapter 54 of the general statutes, to carry out the provisions of section 42-470 of the general statutes, as amended by this act, or 42-471 of the general statutes, as amended by this act, as applicable, section 10 or sections 14 to 18, inclusive, of this act.

(b) Any person who wilfully violates the provisions of any regulation adopted by the commissioner pursuant to subsection (a) of this section shall be subject to a civil penalty of five hundred dollars for each violation, provided such penalty shall not exceed five hundred thousand dollars for any single event.

(c) All civil penalties received pursuant to subsection (b) of this section shall be deposited into the privacy protection guaranty and enforcement account established under section 16 of this act.

Approved July 9, 2009