HB-6168, As Passed House, September 29, 2004
SUBSTITUTE FOR
HOUSE BILL NO. 6168
(As amended September 29, 2004)
A bill to prohibit certain acts and practices concerning
identity theft; to provide for the powers and duties of certain
state and local governmental officers and entities; to prescribe
penalties and provide remedies; and to repeal acts and parts of
acts.
THE PEOPLE OF THE STATE OF MICHIGAN ENACT:
1 Sec. 1. This act shall be known and may be cited as the
2 "identity theft protection act".
3 Sec. 3. As used in this act:
[(a) "Child or spousal support" means support for a child or spouse, paid or provided pursuant to state or federal law under a court order or judgment. Support includes, but is not limited to, any of the following:
(i) Expenses for day-to-day care.
(ii) Medical, dental, or other health care.
(iii) Child care expenses.
(iv) Educational expenses.
(v) Expenses in connection with pregnancy or confinement under the paternity act, 1956 PA 205, MCL 722.711 to 722.730. PA 205, MCL 722.711 to 722.730.
(vi) Repayment of genetic testing expenses, under the paternity act, 1956 PA 205, MCL 722.711 to 722.730. (vii) A surcharge as provided by section 3a of the support and parenting time enforcement act, 1982 PA 295, MCL 552.603a.
4 (b)] "Credit card" means that term as defined in section 157m
5 of the Michigan penal code, 1931 PA 328, MCL 750.157m.
6 [(c)] "Depository institution" means a state or nationally
7 chartered bank or a state or federally chartered savings and loan
8 association, savings bank, or credit union.
9 [(d)] "Financial institution" means a depository institution,
House Bill No. 6168 (H-3) as amended September 29, 2004
1 an affiliate of a depository institution, a licensee under the
2 consumer financial services act, 1988 PA 161, MCL 487.2051 to
3 487.2072, 1984 PA 379, MCL 493.101 to 493.114, the motor vehicle
4 sales finance act, 1950 (Ex Sess) PA 27, MCL 492.101 to 492.141,
5 the secondary mortgage loan act, 1981 PA 125, MCL 493.51 to
6 493.81, the mortgage brokers, lenders, and servicers licensing
7 act, 1987 PA 173, MCL 445.1651 to 445.1684, or the regulatory
8 loan act of 1963, 1939 PA 21, MCL 493.1 to 493.24, a seller under
9 the home improvement finance act, 1965 PA 332, MCL 445.1101 to
10 445.1431, or the retail installment sales act, 1966 PA 224, MCL
11 445.851 to 445.873, or a person subject to subtitle A of title V
12 of the Gramm-Leach-Bliley act, 15 USC 6801 to 6809.
13 [(e)] "Financial transaction device" means that term as defined
14 in section 157m of the Michigan penal code, 1931 PA 328, MCL
15 750.157m.
16 [(f)] "Identity theft" means engaging in an act or conduct
17 Prohibited in section 5(1).
18 [(g)] "Law enforcement agency" means that term as defined in
19 section 2804 of the public health code, 1978 PA 368, MCL
20 333.2804.
21 [(h)] "Local registrar" means that term as defined in section
22 2804 of the public health code, 1978 PA 368, MCL 333.2804.
23 [(i)] "Medical records or information" includes, but is not
24 limited to, medical and mental health histories, reports,
25 summaries, diagnoses and prognoses, treatment and medication
26 information, notes, entries, and x-rays and other imaging
27 records.
House Bill No. 6168 (H-3) as amended September 29, 2004
1 [(j)] "Person" means an individual, partnership, corporation,
2 limited liability company, association, or other legal entity.
3 [(k)] "Personal identifying information" means a name, number,
4 or other information that is used for the purpose of identifying
5 a specific person or providing access to a person's financial
6 accounts, including, but not limited to, a person's name,
7 address, telephone number, driver license or state personal
8 identification card number, social security number, place of
9 employment, employee identification number, employer or taxpayer
10 identification number, government passport number, health
11 insurance identification number, mother's maiden name, demand
12 deposit account number, savings account number, financial
13 transaction device account number or the person's account
14 password, stock or other security certificate or account number,
15 Credit card number, vital record, or medical records or
16 information.
17 [(l)] "State registrar" means that term as defined in section
18 2805 of the public health code, 1978 PA 368, MCL 333.2805.
19 [(m)] "Trade or commerce" means that term as defined in section
20 2 of the Michigan consumer protection act, 1971 PA 331, MCL
21 445.902.
22 [(n)] "Vital record" means that term as defined in section 2805
23 of the public health code, 1978 PA 368, MCL 333.2805.
24 Sec. 5. (1) A person shall not do any of the following:
25 (a) With intent to defraud or violate the law, use or attempt
26 to use the personal identifying information of another person to
27 do either of the following:
House Bill No. 6168 (H-3) as amended September 29, 2004
1 (i) Obtain credit, goods, services, money, property, a vital
2 record, medical records or information, or employment.
3 (ii) Commit another unlawful act.
4 (b) By concealing, withholding, or misrepresenting the
5 person's identity, use or attempt to use the personal identifying
6 information of another person to do either of the following:
7 (i) Obtain credit, goods, services, money, property, a vital
8 record, medical records or information, or employment.
9 (ii) Commit another unlawful act.
10 (2) A person who violates subsection (1)(b)(i) may assert 1
11 or more of the following as a defense in a civil action or as an
12 affirmative defense in a criminal prosecution, and has the burden
13 of proof on that defense by a preponderance of the evidence:
14 (a) That the person gave a bona fide gift for or for the
15 benefit or control of, or use or consumption by, the person whose
16 personal identifying information was used.
17 (b) That the person acted in otherwise lawful pursuit or
18 enforcement of a person's legal rights, including an
19 investigation of a crime or an audit, collection, investigation,
20 or transfer of a debt, [child or spousal support obligation, tax liability,] claim, receivable, account, or interest in
21 a receivable or account.
22 (c) That the action taken was authorized or required by state
23 or federal law, rule, regulation, or court order or rule.
24 (d) That the person acted with the consent of the person
25 whose personal identifying information was used, unless the
26 person giving consent knows that the information will be used to
27 commit an unlawful act.
1 Sec. 7. A person shall not do any of the following:
2 (a) Obtain or possess, or attempt to obtain or possess,
3 personal identifying information of another person with the
4 intent to use that information to commit identity theft or
5 another crime.
6 (b) Sell or transfer, or attempt to sell or transfer,
7 personal identifying information of another person if the person
8 knows or has reason to know that the specific intended recipient
9 will use, attempt to use, or further transfer the information to
10 another person for the purpose of committing identity theft or
11 another crime.
12 (c) Falsify a police report of identity theft, or knowingly
13 create, possess, or use a false police report of identity theft.
14 Sec. 9. (1) Subject to subsection (5), a person who
15 violates section 5 or 7 is guilty of a felony punishable by
16 imprisonment for not more than 5 years or a fine of not more than
17 $25,000.00, or both.
18 (2) Sections 5 and 7 apply whether an individual who is a
19 victim or intended victim of a violation of 1 of those sections
20 is alive or deceased at the time of the violation.
21 (3) This section does not prohibit a person from being
22 charged with, convicted of, or sentenced for any other violation
23 of law committed by that person using information obtained in
24 violation of this section.
25 (4) A person may assert as a defense in a civil action or as
26 an affirmative defense in a criminal prosecution for a violation
27 of section 5 or 7, and has the burden of proof on that defense by
1 a preponderance of the evidence, that the person lawfully
2 transferred, obtained, or attempted to obtain personal
3 identifying information of another person for the purpose of
4 detecting, preventing, or deterring identity theft or another
5 crime or the funding of a criminal activity.
6 (5) Subsection (1) does not apply to a violation of a statute
7 or rule administered by a regulatory board, commission, or
8 officer acting under authority of this state or the United States
9 that confers primary jurisdiction on that regulatory board,
10 commission, or officer to authorize, prohibit, or regulate the
11 transactions and conduct of that person, including, but not
12 limited to, a state or federal statute or rule governing a
13 financial institution and the insurance code of 1956, 1956 PA
14 218, MCL 500.100 to 500.8302, if the act is committed by a person
15 subject to and regulated by that statute or rule, or by another
16 person who has contracted with that person to use personal
17 identifying information.
18 Sec. 11. (1) A person shall not do any of the following in
19 the conduct of trade or commerce:
20 (a) Deny credit or public utility service to or reduce the
21 credit limit of a consumer solely because the consumer was a
22 victim of identity theft, if the person had prior knowledge that
23 the consumer was a victim of identity theft. A consumer is
24 presumed to be a victim of identity theft for the purposes of
25 this subdivision if he or she provides both of the following to
26 the person:
27 (i) A copy of a police report evidencing the claim of the
1 victim of identity theft.
2 (ii) Either a properly completed copy of a standardized
3 affidavit of identity theft developed and made available by the
4 federal trade commission pursuant to 15 USC 1681g or an affidavit
5 of fact that is acceptable to the person for that purpose.
6 (b) Solicit to extend credit to a consumer who does not have
7 an existing line of credit, or has not had or applied for a line
8 of credit within the preceding year, through the use of an
9 unsolicited check that includes personal identifying information
10 other than the recipient's name, address, and a partial, encoded,
11 or truncated personal identifying number. In addition to any
12 other penalty or remedy under this act or the Michigan consumer
13 protection act, 1976 PA 331, MCL 445.901 to 445.922, a credit
14 card issuer, financial institution, or other lender that violates
15 this subdivision, and not the consumer, is liable for the amount
16 of the instrument if the instrument is used by an unauthorized
17 user and for any fees assessed to the consumer if the instrument
18 is dishonored.
19 (c) Solicit to extend credit to a consumer who does not have
20 a current credit card, or has not had or applied for a credit
21 card within the preceding year, through the use of an unsolicited
22 credit card sent to the consumer. In addition to any other
23 penalty or remedy under this act or the Michigan consumer
24 protection act, 1976 PA 331, MCL 445.901 to 445.922, a credit
25 card issuer, financial institution, or other lender that violates
26 this subdivision, and not the consumer, is liable for any charges
27 if the credit card is used by an unauthorized user and for any
House Bill No. 6168 (H-3) as amended September 29, 2004
1 interest or finance charges assessed to the consumer.
2 (d) Extend credit to a consumer without exercising [reasonable] procedures
3 to verify the identity of that consumer. Compliance with
4 regulations issued [for depository institutions, and to be issued for other financial institutions,] by the United States department of treasury
5 under section 326 of the USA patriot act of 2001, 31 USC 5318, is
6 considered compliance with this subdivision. [This subdivision does not apply to a change to or review of an existing account.]
7 (2) A person who knowingly or intentionally violates
8 subsection (1) is guilty of a misdemeanor punishable by
9 imprisonment for not more than 30 days or a fine of not more than
10 $1,000.00, or both. This subsection does not affect the
11 availability of any civil remedy for a violation of this act, the
12 Michigan consumer protection act, 1976 PA 331, MCL 445.901 to
13 445.922, or any other state or federal law.
14 Sec. 13. (1) A law enforcement agency or victim of identity
15 theft may verify information from a vital record from a local
16 registrar or the state registrar in the manner described in
17 section 2881(2) of the public health code, 1978 PA 368, MCL
18 333.2881.
19 (2) A state registrar or local registrar that verifies
20 information from a vital record under section 2881(2) of the
21 public health code, 1978 PA 368, MCL 333.2881, for a law
22 enforcement agency investigating identity theft may provide that
23 law enforcement agency with all of the following information
24 about any previous requests concerning that public record that is
25 available to the registrar:
26 (a) Whether or not a certified copy or copies of the record
27 were requested.
1 (b) The date or dates a copy or copies of the record were
2 issued.
3 (c) The name of each applicant who requested the record.
4 (d) The address, e-mail address, telephone number, and other
5 identifying information of each applicant who requested the
6 record.
7 (e) Payment information regarding each request.
8 (3) A state registrar or local registrar that verifies
9 information from a vital record under section 2881(2) of the
10 public health code, 1978 PA 368, MCL 333.2881, for an individual
11 who provides proof that he or she is a victim of identity theft
12 may provide that individual with all of the following information
13 about any previous requests concerning that public record that is
14 available to the registrar:
15 (a) Whether or not a certified copy or copies of the record
16 were requested.
17 (b) The date or dates a copy or copies of the record were
18 issued.
19 (4) For purposes of subsection (3), it is sufficient proof
20 that an individual is a victim of identity theft for a state
21 registrar or local registrar to provide the information described
22 in that subsection if he or she provides the registrar with a
23 copy of a police report evidencing the claim that he or she is a
24 victim of identity theft; and, if available, an affidavit of
25 identity theft, in a form developed by the state registrar in
26 cooperation with the attorney general for purposes of this
27 subsection.
1 (5) A law enforcement agency may request an administrative
2 use copy of a vital record from the state registrar in the manner
3 described in section 2891 of the public health code, 1978 PA 368,
4 MCL 333.2891.
5 (6) A law enforcement agency may request an administrative
6 use copy of a vital record from a local registrar in the manner
7 described in section 2891 of the public health code, 1978 PA 368,
8 MCL 333.2891, if the request for the administrative use copy is
9 in writing and contains both of the following:
10 (a) A statement that the law enforcement agency requires
11 information from a vital record beyond the information the local
12 registrar may verify under subsections (1) and (2).
13 (b) The agreement of the law enforcement agency that it will
14 maintain the administrative use copy of the vital record in a
15 secure location and will destroy the copy by confidential means
16 when it no longer needs the copy.
17 Sec. 15. Section 285 of the Michigan penal code, 1931 PA
18 328, MCL 750.285, is repealed.
19 Sec. 17. This act takes effect March 1, 2005.