Status of identity and privacy related AZ Legislative bills April 20, 2006 Mike Keeling ATIC, Chair

Three Bills of Interest SB 1338 Personal information, security breach, notification SB 1347 Freezing consumer reports; identify theft HB 2351 Identity theft omnibus HB2024 Government anti-identification theft assessment

SB1338; Personal information, Security breach, Notification Business Owners/operators Unencrypted computerized data w/ personal information Notification in most expedient manner Nature and scope of breach Written, electronic, phone call May be delayed by law enforcement Exempts HIPAA and Gramm-Leach-Bliley Only enforced by AZ Attorney General Actual damages + civil penalty <$10,000 Preempts similar city and county rules

SB1347; Freezing consumer reports; Identify theft Consumer may place freeze on personal ‘consumer report’ as issued by consumer reporting agency (CRA) CRA prohibited from releasing info Effective within 10 days of notice Must be lifted within 3 days of notice 3 rd parties may treat application for credit during ‘freeze period’ as ‘incomplete’ $15 fee to freeze/un-freeze, CPI adjusted

HB2351; Identify theft omnibus Min. jail penalties for identify theft Take identify = 60 days Aggravated identity theft = 270 days Trafficking in identity of others = 1 yr Extraterritorial search warrants Execute search warrant outside of AZ Service by electronic means Limited to electronic/paper records

HB2351; Identify theft omnibus – Con’t Disclosure Any breach, following discovery of breach Every resident affected must be notified Notify law enforcement & CRA < 48 hrs Defines disclosure (see SB 1338) NO waiver allowed (Contractually) County Attorney or AZ AG can enforce $500 Civil penalty/individual NOT notified If NOT notified, Reimburse - actual costs Exception if data encrypted/good faith Exception for Fed Law compliance

HB2351; Identify theft omnibus – Con’t Record disposal (Businesses) Prohibits discarding PI records not Shredded Erased Modified to make unreadable Violation - reimburse each customer Actual and secondary costs Civil penalty, greater of $10,000 or actual loss Costs of County Attorney or AZ AG Affirmative defenses Compliance with federal law Use due diligence

HB2024; Gov’t Anti-identification and theft assessment Government establish procedures Ensure collected info cannot be accessed by unauthorized persons Entity identifying information Personal identifying information Excepts public records Defines Identifying information, Personal identifying information Governmental agency (State and Local)

Identity Theft Resource Center Federal Trade Commission idtheft ( )

ID Theft ID Theft: When Bad Things Happen To Your Good Name [TEXT] [PDF] idtheft ( )

Privacy Rights Clearinghouse (619)