New, Stronger Identity Theft Law Gives Greater Protection

Assemblymember Audrey Pheffer announced that a new law now on the books strengthens existing identity theft laws that were enacted in 2002.

Pheffer (D- Rockaway) says the new statute "addresses issues that have arisen with the ever-growing world of technology".

The new measure, Pheffer said,

•Extends provisions that cut off intentional communication of Social Security numbers to the public by government agencies;

•Restricts employers from using personal identifying numbers of employees, and

•Outlaws the possession and use of "skimmer" devices to obtain personal information from credit cards.

In addition, the law also facilitates the prosecution of identity theft cases by permitting certain business records to be received at grand jury proceedings based upon sworn written statements," Pheffer said.

Pheffer said the new law authorizes the state attorney general to bring enforcement actions for violations of these restrictions, including injunctions and civil penalties of not more than $5,000 per violation.

In addition, she said, any individual whose confidential personal information is disclosed illegally will be able to bring an action and recover actual damages or $1,000, whichever is greater.

Finally, said Pheffer, who chairs the Assembly Consumer Affairs Committee, the new law enables ID theft victims to obtain restitution for the value of the time they spend fixing the damage that the criminal has inflicted. She said that according to one study, ID theft victims have spent 330 hours in addressing the damage caused by identity thieves. This would be the first time a victim could be compensated for lost time.

A major component of the new law allows victims to seek assistance from the state Consumer Protection Board (CPB) Identity Theft Prevention and Mitigation Program, which will assist victims in undoing the damage that the identity theft has done to their financial and credit history.

Another major provision provides consumers more accessible methods for placing a security freeze on their credit reports. As of Jan. 1, 2010, credit reporting agencies will be required to place a security freeze request on a consumer's credit report within 24 hours of receiving notice and proper identification. Credit bureaus will also be required to "thaw" a consumer's credit file within 15 minutes of receiving such a request. The latter provision takes effect Sept. 1, 2009.

Pheffer said that a provision also prevents the intentional giving out of Social Security numbers. "State and political subdivisions will not be able to require individuals to transmit their Social Security numbers over the Internet or to print Social Security numbers on any materials that are mailed to individuals," she said.

Also, employers may not divulge employees' personal identifying information, including posting or displaying no more than the last four digits of an employee's Social Security number, or placing Social Security numbers in files with open access. This action will take effect Jan. 1, 2010, Pheffer said.

Pheffer closed by saying, "The heightened level of vulnerability and exposure created by the compilation of large electronic databases necessitates a greater level of risk sensitivity. Despite the magnitude of the problem, victims of identity theft and financial fraud in New York state face barriers in receiving important assistance, information and resources.

Victims have an arduous task in repairing their financial records, credit rating and well being. They require assistance and intervention to address their particular needs and navigate various public and private systems. This new statute "addresses these issues and ensures that the identities of New Yorkers are protected".