BILL NUMBER: AB 424 CHAPTERED 02/25/06 CHAPTER 10 FILED WITH SECRETARY OF STATE FEBRUARY 25, 2006 APPROVED BY GOVERNOR FEBRUARY 24, 2006 PASSED THE ASSEMBLY FEBRUARY 14, 2006 PASSED THE SENATE FEBRUARY 6, 2006 AMENDED IN SENATE JANUARY 17, 2006 AMENDED IN SENATE JANUARY 9, 2006 AMENDED IN SENATE SEPTEMBER 2, 2005 AMENDED IN SENATE JUNE 21, 2005 AMENDED IN ASSEMBLY APRIL 6, 2005 AMENDED IN ASSEMBLY MARCH 29, 2005 INTRODUCED BY Assembly Member Calderon (Principal coauthor: Senator Alquist) FEBRUARY 15, 2005 An act to amend Sections 530.5, 530.6, and 530.8 of the Penal Code, relating to crime, and declaring the urgency thereof, to take effect immediately. LEGISLATIVE COUNSEL'S DIGEST AB 424, Calderon Identity theft. Existing law provides that every person who willfully obtains personal identifying information about another person, as defined, and uses that information for any unlawful purpose is guilty of a crime. Existing law provides a procedure for a person to initiate an investigation of potential identity theft. Existing law also provides that any person, upon discovering that in the person's name an unauthorized individual has made an application for certain services or has opened certain accounts, is entitled to receive the identifying information that was used by the unauthorized individual to apply for any service or open any account, upon the presentation of a copy of a police report and identifying information. This bill would expand the definition of "personal identifying information" to include an equivalent form of identification. This bill would provide that "person" as used in these provisions includes a firm, association, organization, partnership, business trust, company, corporation, limited liability company, or public entity. By expanding the scope of an existing crime, this bill imposes a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason. This bill would declare that it is to take effect immediately as an urgency statute. THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS: SECTION 1. Section 530.5 of the Penal Code is amended to read: 530.5. (a) Every person who willfully obtains personal identifying information, as defined in subdivision (b), of another person, and uses that information for any unlawful purpose, including to obtain, or attempt to obtain, credit, goods, services, or medical information in the name of the other person without the consent of that person, is guilty of a public offense, and upon conviction therefor, shall be punished either by imprisonment in a county jail not to exceed one year, a fine not to exceed one thousand dollars ($1,000), or both that imprisonment and fine, or by imprisonment in the state prison, a fine not to exceed ten thousand dollars ($10,000), or both that imprisonment and fine. (b) "Personal identifying information," as used in this section, means the name, address, telephone number, health insurance identification number, taxpayer identification number, school identification number, state or federal driver's license number, or identification number, social security number, place of employment, employee identification number, mother's maiden name, demand deposit account number, savings account number, checking account number, PIN (personal identification number) or password, alien registration number, government passport number, date of birth, unique biometric data including fingerprint, facial scan identifiers, voiceprint, retina or iris image, or other unique physical representation, unique electronic data including identification number, address, or routing code, telecommunication identifying information or access device, information contained in a birth or death certificate, or credit card number of a person, or an equivalent form of identification. (c) In any case in which a person willfully obtains personal identifying information of another person, uses that information to commit a crime in addition to a violation of subdivision (a), and is convicted of that crime, the court records shall reflect that the person whose identity was falsely used to commit the crime did not commit the crime. (d) Every person who, with the intent to defraud, acquires, transfers, or retains possession of the personal identifying information, as defined in subdivision (b), of another person is guilty of a public offense, and upon conviction therefor, shall be punished by imprisonment in a county jail not to exceed one year, or a fine not to exceed one thousand dollars ($1,000), or by both that imprisonment and fine. (e) Every person who, with the intent to defraud, acquires, transfers, or retains possession of the personal identifying information, as defined in subdivision (b), of another person who is deployed to a location outside of the state is guilty of a public offense, and upon conviction therefor, shall be punished by imprisonment in a county jail not to exceed one year, or a fine not to exceed one thousand five hundred dollars ($1,500), or by both that imprisonment and fine. (f) For purposes of this section, "deployed" means that the person has been ordered to serve temporary military duty during a period when a presidential executive order specifies that the United States is engaged in combat or homeland defense and he or she is either a member of the armed forces, or is a member of the armed forces reserve or the National Guard, who has been called to active duty or active service. It does not include temporary duty for the sole purpose of training or processing or a permanent change of station. (g) For purposes of this section, "person" means a natural person, firm, association, organization, partnership, business trust, company, corporation, limited liability company, or public entity. SEC. 2. Section 530.6 of the Penal Code is amended to read: 530.6. (a) A person who has learned or reasonably suspects that his or her personal identifying information has been unlawfully used by another, as described in subdivision (a) of Section 530.5, may initiate a law enforcement investigation by contacting the local law enforcement agency that has jurisdiction over his or her actual residence or place of business, which shall take a police report of the matter, provide the complainant with a copy of that report, and begin an investigation of the facts. If the suspected crime was committed in a different jurisdiction, the local law enforcement agency may refer the matter to the law enforcement agency where the suspected crime was committed for further investigation of the facts. (b) A person who reasonably believes that he or she is the victim of identity theft may petition a court, or the court, on its own motion or upon application of the prosecuting attorney, may move, for an expedited judicial determination of his or her factual innocence, where the perpetrator of the identity theft was arrested for, cited for, or convicted of a crime under the victim's identity, or where a criminal complaint has been filed against the perpetrator in the victim's name, or where the victim's identity has been mistakenly associated with a record of criminal conviction. Any judicial determination of factual innocence made pursuant to this section may be heard and determined upon declarations, affidavits, police reports, or other material, relevant, and reliable information submitted by the parties or ordered to be part of the record by the court. Where the court determines that the petition or motion is meritorious and that there is no reasonable cause to believe that the victim committed the offense for which the perpetrator of the identity theft was arrested, cited, convicted, or subject to a criminal complaint in the victim's name, or that the victim's identity has been mistakenly associated with a record of criminal conviction, the court shall find the victim factually innocent of that offense. If the victim is found factually innocent, the court shall issue an order certifying this determination. (c) After a court has issued a determination of factual innocence pursuant to this section, the court may order the name and associated personal identifying information contained in court records, files, and indexes accessible by the public deleted, sealed, or labeled to show that the data is impersonated and does not reflect the defendant' s identity. (d) A court that has issued a determination of factual innocence pursuant to this section may at any time vacate that determination if the petition, or any information submitted in support of the petition, is found to contain any material misrepresentation or fraud. (e) The Judicial Council of California shall develop a form for use in issuing an order pursuant to this section. (f) For purposes of this section,"person" means a natural person, firm, association, organization, partnership, business trust, company, corporation, limited liability company, or public entity. SEC. 3. Section 530.8 of the Penal Code is amended to read: 530.8. (a) If a person discovers that an application in his or her name for a loan, credit line or account, credit card, charge card, public utility service, mail receiving or forwarding service, office or desk space rental service, or commercial mobile radio service has been filed with any person or entity by an unauthorized person, or that an account in his or her name has been opened with a bank, trust company, savings association, credit union, public utility, mail receiving or forwarding service, office or desk space rental service, or commercial mobile radio service provider by an unauthorized person, then, upon presenting to the person or entity with which the application was filed or the account was opened a copy of a police report prepared pursuant to Section 530.6 and identifying information in the categories of information that the unauthorized person used to complete the application or to open the account, the person, or a law enforcement officer specified by the person, shall be entitled to receive information related to the application or account, including a copy of the unauthorized person's application or application information and a record of transactions or charges associated with the application or account. Upon request by the person in whose name the application was filed or in whose name the account was opened, the person or entity with which the application was filed shall inform him or her of the categories of identifying information that the unauthorized person used to complete the application or to open the account. The person or entity with which the application was filed or the account was opened shall provide copies of all paper records, records of telephone applications or authorizations, or records of electronic applications or authorizations required by this section, without charge, within 10 business days of receipt of the person's request and submission of the required copy of the police report and identifying information. (b) Any request made pursuant to subdivision (a) to a person or entity subject to the provisions of Section 2891 of the Public Utilities Code shall be in writing and the requesting person shall be deemed to be the subscriber for purposes of that section. (c) (1) Before a person or entity provides copies to a law enforcement officer pursuant to subdivision (a), the person or entity may require the requesting person to submit a signed and dated statement by which the requesting person does all of the following: (A) Authorizes disclosure for a stated period. (B) Specifies the name of the agency or department to which the disclosure is authorized. (C) Identifies the types of records that the requesting person authorizes to be disclosed. (2) The person or entity shall include in the statement to be signed by the requesting person a notice that the requesting person has the right at any time to revoke the authorization. (d) (1) A failure to produce records pursuant to subdivision (a) shall be addressed by the court in the jurisdiction in which the victim resides or in which the request for information was issued. At the victim's request, the Attorney General, the district attorney, or the prosecuting city attorney may file a petition to compel the attendance of the person or entity in possession of the records, as described in subdivision (a), and order the production of the requested records to the court. The petition shall contain a declaration from the victim stating when the request for information was made, that the information requested was not provided, and what response, if any, was made by the person or entity. The petition shall also contain copies of the police report prepared pursuant to Section 530.6 and the request for information made pursuant to this section upon the person or entity in possession of the records, as described in subdivision (a), and these two documents shall be kept confidential by the court. The petition and copies of the police report and the application shall be served upon the person or entity in possession of the records, as described in subdivision (a). The court shall hold a hearing on the petition no later than 10 court days after the petition is served and filed. The court shall order the release of records to the victim as required pursuant to this section. (2) In addition to any other civil remedy available, the victim may bring a civil action against the entity for damages, injunctive relief or other equitable relief, and a penalty of one hundred dollars ($100) per day of noncompliance, plus reasonable attorneys' fees. (e) For the purposes of this section, the following terms have the following meanings: (1) "Application" means a new application for credit or service, the addition of authorized users to an existing account, the renewal of an existing account, or any other changes made to an existing account. (2) "Commercial mobile radio service" means "commercial mobile radio service" as defined in Section 20.3 of Title 47 of the Code of Federal Regulations. (3) "Law enforcement officer" means a peace officer as defined by Section 830.1. (4) "Person" means a natural person, firm, association, organization, partnership, business trust, company, corporation, limited liability company, or public entity. SEC. 4. No reimbursement is required by this act pursuant to Section 6 of Article XIII B of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIII B of the California Constitution. SEC. 5. This act is an urgency statute necessary for the immediate preservation of the public peace, health, or safety within the meaning of Article IV of the Constitution and shall go into immediate effect. The facts constituting the necessity are: In order to provide business in California with timely protection from the growing problem of identity theft, it is necessary that this bill take effect immediately.