AN ACT relating to consumer protection.
     Create a new section of KRS Chapter 367 to define “agency,” "business," "consumer," "consumer reporting agency," "consumer report," "disposal," "encrypt," "person," "personal information," "proper identification," "records," "redact," "security breach," and "security freeze"; create a new section of KRS Chapter 367 to prohibit a business from making or requiring certain uses of a consumer's Social Security number; allow certain exceptions for use or disclosure of a consumer’s Social Security number; require a business to make reasonable efforts to implement requirements prior to effective date; delay the effective date of this section to July 1, 2007, and declare that a violation is an unfair, false, misleading or deceptive act or practice in the conduct of trade or commerce in violation of KRS 367.170 subject to same remedies, duties, powers and penalties as a violation of KRS 367.170; create a new section of KRS Chapter 367 to establish a procedure to allow a consumer to place a security freeze on his or her credit report requiring the consumer's authorization for release of his report by a consumer credit reporting agency; require the consumer reporting agency to honor a security freeze placed by another consumer reporting agency; require a consumer reporting agency to provide the consumer with a personal identification number or password to be used by the consumer to access his or her credit file while the security freeze is in effect; provide for a procedure to permit the consumer to temporarily lift or remove the security freeze; require a security freeze to remain in effect until the consumer requests that the freeze be removed, unless the consumer has materially misrepresented facts in placing the freeze; allow an application for credit to be treated as incomplete if the third party cannot get access to a consumer report because of a freeze; prohibit a consumer reporting agency from suggesting that a security freeze reflects negatively on the consumer report; permit a consumer reporting agency to impose a fee of up to five dollars in certain instances; prohibit any fee if the consumer is a victim of identity theft and has a valid police report or has received a notice of security breach and provides a copy of the notice; require a consumer reporting agency to disclose to consumers the process for removing or temporarily lifting a freeze and to provide a notice; prohibit application of a security freeze to consumer reports provided to certain entities; require a consumer reporting agency to notify a consumer after changing certain identifying data in the consumer’s file; require a consumer reporting agency to provide notice to a consumer if it releases a consumer report in violation of the freeze; declare that a violation is an unfair, false, misleading or deceptive act or practice in the conduct of trade or commerce in violation of KRS 367.170 subject to same remedies, duties, powers and penalties as a violation of KRS 367.170; create a new section of KRS Chapter 367 to require an agency or business that conducts business in the Commonwealth to take certain measures to protect against unauthorized access or use of personal information during its disposal; provide certain exceptions; declare that a violation is an unfair, false, misleading or deceptive act or practice in the conduct of trade or commerce in violation of KRS 367.170 subject to same remedies, duties, powers and penalties as a violation of KRS 367.170; create a new section of KRS Chapter 367 to require an agency or business that conducts business in the Commonwealth, and that owns or maintains data that includes personal information, to disclose any security breach to any resident of the Commonwealth whose personal information was acquired or accessed; require an agency or business that does not own the data to notify the owner or licensee of the information in the event of a security breach of the information; provide a procedure for delay of the notice for law enforcement purposes; require certain information to be included in the notice; provide certain exceptions; provide that a waiver is void and unenforceable; require that the notice be given to the Attorney General and consumer reporting agencies if the notice is given to more than 1,000 residents of the Commonwealth; require the notice provider to cooperate with requests to verify the authenticity of the notice; declare that a violation is an unfair, false, misleading or deceptive act or practice in the conduct of trade or commerce in violation of KRS 367.170 subject to same remedies, duties, powers and penalties as a violation of KRS 367.170; create a new section of KRS Chapter 367 to require an agency or business that conducts business in the Commonwealth to take certain measures to safeguard against security breaches; provide certain exceptions; declare that a violation is an unfair, false, misleading or deceptive act or practice in the conduct of trade or commerce in violation of KRS 367.170 subject to same remedies, duties, powers and penalties as a violation of KRS 367.170; create a new section of KRS Chapter 367 to declare that the provisions regarding business use of Social Security numbers, security freezes, disposal of records, security breach notices, and safeguarding against security breaches do not limit agency power to enforce criminal or civil statutes or the right of any person to bring civil actions and are not a waiver of sovereign immunity; declare that no liability accrues to an agency for violations; provide venue for civil actions brought by the Attorney General regarding violations; create a new section of KRS Chapter 17 to require a law enforcement agency where jurisdiction may lie for investigation and prosecution of certain identity-theft-related crimes to take a complaint and provide a copy of the police report to the complainant; create a new section of KRS Chapter 411 to establish an expedited procedure for victim of certain identity-theft-related crimes to petition the District Court for a determination that he or she is a victim of identity theft; require that the court filing fee will be the same as for filing a small claims case; provide that it is a Class D Felony to knowingly provide false information in connection with this proceeding; create a new section of KRS Chapter 431 to establish an expedited procedure allowing a person who has been charged with a crime because another person used his or her identifying information, and who has been found not guilty or the charges have been dismissed, to make a motion to the District or Circuit Court to redact his or her identifying information from certain records; establish a procedure restricting access and inspection of those records; create a new section of KRS Chapter 12 to create definitions; prohibit an agency from making or requiring certain uses of a person’s Social Security number or identifying information; prohibit an agency from collecting a Social Security number unless authorized by law or necessary for the agency’s duties; require an agency to segregate Social Security numbers from the rest of a record and to provide a person with a written statement of the purpose for collecting and using the Social Security number; allow certain exceptions; prohibit the inclusion of a person’s identifying information in documents filed or recorded with an agency subject to certain exceptions; establish a procedure for a person to request redaction of his or her identifying information from official records placed on an agency’s Internet Web site unless the agency is required or authorized by law to include the information on the Web site; allow a petition to Franklin Circuit Court to direct compliance; provide for no liability for agency actions related to this section; provide for no waiver of sovereign immunity; delay the effective date of this section to July 1, 2007; amend KRS 15.334 to require that the law enforcement basic training course provided by the Kentucky Law Enforcement Council also include identity theft and disclosure of information from a financial information repository; amend KRS 411.210 to extend the civil cause of action for victims of identity-theft-related crimes to victims of the provisions regarding business use of Social Security numbers, security freezes, disposal of records, security breach notices, and safeguarding against security breaches; extend the statute of limitations to the later of five years or the date of discovery of the identity of the perpetrator of the violation; amend KRS 514.160 to provide that the crime of theft of identity applies to use of a live or deceased person’s identity; increase the types of identifying information protected; provide that a purpose of the crime also includes avoiding investigation or prosecution for a crime; increase the penalty for subsequent offenses; delete the exclusion of credit or debit card fraud crimes; amend KRS 525.080 to provide that the crime of harassing communications applies whether the perpetrator is using the perpetrator's own or another person’s identity; certain sections effective July 1, 2007.

     Feb 3-introduced in House
     Feb 6-to Judiciary (H)
     Mar 7-posted in committee; posting waived
     Mar 8-reported favorably, 1st reading, to Calendar with Committee Substitute
     Mar 9-2nd reading, to Rules; posted for passage in the Regular Orders of the Day for Friday, March 10, 2006
     Mar 10-floor amendment (1) filed to Committee Substitute
     Mar 13-floor amendment (2) filed to Committee Substitute
     Mar 14-3rd reading, passed 97-0 with Committee Substitute, floor amendment (2)
     Mar 15-received in Senate
     Mar 17-to Judiciary (S)