BILL NUMBER: SB 1254 CHAPTERED 08/26/02 CHAPTER 254 FILED WITH SECRETARY OF STATE AUGUST 26, 2002 APPROVED BY GOVERNOR AUGUST 24, 2002 PASSED THE SENATE AUGUST 8, 2002 PASSED THE ASSEMBLY JULY 3, 2002 AMENDED IN ASSEMBLY JUNE 28, 2002 AMENDED IN ASSEMBLY JUNE 4, 2002 AMENDED IN SENATE APRIL 23, 2002 AMENDED IN SENATE APRIL 9, 2002 AMENDED IN SENATE MARCH 11, 2002 AMENDED IN SENATE FEBRUARY 12, 2002 INTRODUCED BY Senator Alpert JANUARY 9, 2002 An act to amend Sections 530.5 and 530.8 of the Penal Code, relating to identity theft. LEGISLATIVE COUNSEL'S DIGEST SB 1254, Alpert. Identity theft. Existing law provides that every person who willfully obtains personal identifying information about another person, as defined, and uses that information for any unlawful purpose is guilty of a crime punishable by imprisonment in a county jail not to exceed one year, or a fine not to exceed $1,000, or both, or by imprisonment in the state prison, or a fine not to exceed $10,000, or both. This bill would expand the definition of "personal identifying information" to include other identification numbers and other specified information. By expanding the scope of an existing crime, this bill imposes a state-mandated local program. This bill would also provide that every person who, with the intent to defraud, acquires, transfers, or retains possession of the personal identifying information, as defined, of another person, is guilty of a crime punishable by imprisonment in the county jail not exceeding a year, a fine not exceeding $1,000, or by both that imprisonment and fine. By creating a new crime, this bill would impose a state-mandated local program. Existing law provides that if a person discovers that an unauthorized person has applied for certain services or opened certain accounts, the person is entitled to receive the identifying information that was used by the unauthorized person to apply for or open the account or service upon presentation of a copy of a police report and identifying information. This bill would add applications and accounts regarding commercial mobile radio services, as defined, to the applications and accounts covered by these provisions. It would require that a request for identifying information be made in writing when made to a telephone or telegraph corporation, as specified. The bill would require the person or entity with which the application was filed or the account opened to provide the information and copies of all forms, without charge, within 10 business days. The bill would also require the person or entity with which the application was filed or the account opened to provide the information and copies to a law enforcement officer specified by the person in whose name the application was filed or the account opened. It would allow the person or entity to require a signed and dated statement, as specified, from the requesting person. This bill would also make clarifying changes to these provisions. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason. THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS: SECTION 1. Section 530.5 of the Penal Code is amended to read: 530.5. (a) Every person who willfully obtains personal identifying information, as defined in subdivision (b), of another person, and uses that information for any unlawful purpose, including to obtain, or attempt to obtain, credit, goods, services, or medical information in the name of the other person without the consent of that person, is guilty of a public offense, and upon conviction therefor, shall be punished either by imprisonment in a county jail not to exceed one year, a fine not to exceed one thousand dollars ($1,000), or both that imprisonment and fine, or by imprisonment in the state prison, a fine not to exceed ten thousand dollars ($10,000), or both that imprisonment and fine. (b) "Personal identifying information," as used in this section, means the name, address, telephone number, health insurance identification number, taxpayer identification number, school identification number, state or federal driver's license number, or identification number, social security number, place of employment, employee identification number, mother's maiden name, demand deposit account number, savings account number, checking account number, PIN (personal identification number) or password, alien registration number, government passport number, date of birth, unique biometric data including fingerprint, facial scan identifiers, voice print, retina or iris image, or other unique physical representation, unique electronic data including identification number, address, or routing code, telecommunication identifying information or access device, information contained in a birth or death certificate, or credit card number of an individual person. (c) In any case in which a person willfully obtains personal identifying information of another person, uses that information to commit a crime in addition to a violation of subdivision (a), and is convicted of that crime, the court records shall reflect that the person whose identity was falsely used to commit the crime did not commit the crime. (d) Every person who, with the intent to defraud, acquires, transfers, or retains possession of the personal identifying information, as defined in subdivision (b), of another person is guilty of a public offense, and upon conviction therefor, shall be punished by imprisonment in a county jail not to exceed one year, or a fine not to exceed one thousand dollars ($1,000), or by both that imprisonment and fine. SEC. 2. Section 530.8 of the Penal Code is amended to read: 530.8. (a) If a person discovers that an application in his or her name for a loan, credit line or account, credit card, charge card, public utility service, or commercial mobile radio service has been filed with any person or entity by an unauthorized person, or that an account in his or her name has been opened with a bank, trust company, savings association, credit union, public utility, or commercial mobile radio service provider by an unauthorized person, then, upon presenting to the person or entity with which the application was filed or the account was opened a copy of a police report prepared pursuant to Section 530.6 and identifying information in the categories of information that the unauthorized person used to complete the application or to open the account, the person, or a law enforcement officer specified by the person, shall be entitled to receive information related to the application or account, including a copy of the unauthorized person's application or application information and a record of transactions or charges associated with the application or account. Upon request by the person in whose name the application was filed or in whose name the account was opened, the person or entity with which the application was filed shall inform him or her of the categories of identifying information that the unauthorized person used to complete the application or to open the account. The person or entity with which the application was filed or the account was opened shall provide copies of all forms and information required by this section, without charge, within 10 business days of receipt of the person's request and submission of the required copy of the police report and identifying information. (b) Any request made pursuant to subdivision (a) to a person or entity subject to the provisions of Section 2891 of the Public Utilities Code shall be in writing and the requesting person shall be deemed to be the subscriber for purposes of that section. (c) (1) Before a person or entity provides copies to a law enforcement officer pursuant to subdivision (a), the person or entity may require the requesting person to submit a signed and dated statement by which the requesting person does all of the following: (A) Authorizes disclosure for a stated period. (B) Specifies the name of the agency or department to which the disclosure is authorized. (C) Identifies the types of records that the requesting person authorizes to be disclosed. (2) The person or entity shall include in the statement to be signed by the requesting person a notice that the requesting person has the right at any time to revoke the authorization. (d) As used in this section, "law enforcement officer" means a peace officer as defined by Section 830.1 of the Penal Code. (e) As used in this section, "commercial mobile radio service" means "commercial mobile radio service" as defined in section 20.3 of Title 47 of the Code of Federal Regulations. SEC. 3. No reimbursement is required by this act pursuant to Section 6 of Article XIII B of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIII B of the California Constitution.