HB 7/LM/CI (BR 966) - R. Webb, J. Richards, R. Adams, R. Adkins, J. Arnold Jr, E. Ballard, L. Belcher, L. Clark, H. Collins, R. Damron, M. Denham, T. Edmonds, J. Glenn, J. Gooch Jr, D. Graham, K. Hall, R. Henderson, C. Hoffman, D. Keene, T. McKee, R. Meeks, H. Moberly Jr, R. Nelson, F. Nesler, D. Owens, R. Palumbo, D. Pasley, R. Rand, T. Riner, A. Smith, J. Stacy, T. Thompson, J. Tilley, J. Vincent, J. Wayne, S. Westrom, R. Wilkey, B. Yonts

     AN ACT relating to consumer protection.
     Create new sections of KRS Chapter 367 to create definitions related to identity theft; restrict certain uses by businesses of a consumer's Social Security number subject to certain exceptions, to delay the effective date to July 1, 2008, and to make a violation subject to the same remedies, duties, powers and penalties as violations of the Consumer Protection Act; require an agency or business to give notice to a person whose personal information was acquired in a security breach subject to certain exceptions, to make a waiver void and unenforceable, and to declare that a violation is subject to the same remedies, duties, powers and penalties as violations of the Consumer Protection Act; require an agency or business to take certain measures to safeguard against security breaches subject to certain exceptions, and to declare that a violation is subject to the same remedies, duties, powers and penalties as violations of the Consumer Protection Act; declare that the provisions regarding business use of Social Security numbers, security breach notices, and safeguarding against security breaches do not limit the power to enforce criminal or civil statutes or the right to bring civil actions, and to provide venue for civil actions brought by the Attorney General regarding violations; create a new section of KRS Chapter 17 to require a law enforcement agency to take a complaint and provide a copy of the police report to a complainant who has learned or reasonably suspects that his or her identity or personal information has been used without consent in the commission of a criminal offense; create a new section of KRS Chapter 411 to establish an expedited Circuit Court procedure for a person whose identity or personal information has been used without consent in the commission of a criminal offense to get a determination that he or she is a victim of identity theft, and to require that the court filing fee be the same as for filing a small claims case; create a new section of KRS Chapter 431 to establish an expedited procedure allowing a person who has been charged with a crime because another person used his or her identifying information, and who has been found not guilty or the charges have been dismissed, to make a motion to the Court to redact his or her identifying information from certain records and to establish a procedure restricting access and inspection of those records; create a new section of KRS Chapter 12 to restrict certain uses by agencies of a person’s Social Security number, and to prohibit the inclusion of a person’s Social Security number in documents filed or recorded with an agency, subject to certain exceptions, to establish a procedure to request redaction of a Social Security number shown in official records on an agency’s Internet Web site subject to certain exceptions, and to delay the effective date to July 1, 2008; create a new section of KRS Chapter 434 to create definitions and establish a Class D felony offense for "phishing," which is using the Internet to induce a person to provide identifying information by representing without authorization that the requester is another person; create a new section of KRS Chapter 411 to provide a civil cause of action against a person who "phishes," to allow injunctive relief, damages up to the greater of actual damages or $25,000 for each violation, treble damages in certain circumstances, and reasonable attorney's fees and court costs to a prevailing plaintiff to subject violations to the remedies, powers, and duties of the Consumer Protection Act, and to establish a statute of limitations; amend KRS 365.720 relating to disposal of records to create a definition for "agency" and delete the definition for "customer"; amend KRS 365.725 to extend the application of the records disposal provisions to agencies and to make the provisions applicable to all records; amend KRS 15.334 to require law enforcement basic training regarding identity theft; amend KRS 411.210 to extend the civil cause of action for victims of certain identity-theft-related crimes to persons whose identity or personal information has been used without consent in the commission of a criminal offense, and to extend the statute of limitations to the later of five years or the date of discovery of the violation or the identity of the perpetrator of the violation; amend KRS 514.160 to provide that the crime of theft of identity applies to use of a live or deceased person’s identity, to increase the types of identifying information protected, and to delete the exclusion of credit or debit card fraud crimes; amend KRS 525.080 to provide that the crime of harassing communications applies whether the perpetrator is using the perpetrator's own or another person’s identity.

HB 7 - AMENDMENTS

     HCS/LM/CI - Amend definition of "security breach" to include additional circumstances where data might be disclosed.

     Feb 7-introduced in House
     Feb 8-to Judiciary (H)
     Feb 12-posted in committee
     Feb 14-reported favorably, 1st reading, to Calendar with Committee Substitute
     Feb 15-2nd reading, to Rules; posted for passage in the Regular Orders of the Day for Friday, February 16, 2007
     Feb 22-3rd reading, passed 99-0 with Committee Substitute
     Feb 23-received in Senate
     Mar 1-to Judiciary (S)

Vote History