BILL NUMBER: AB 2886 CHAPTERED 09/28/06 CHAPTER 522 FILED WITH SECRETARY OF STATE SEPTEMBER 28, 2006 APPROVED BY GOVERNOR SEPTEMBER 28, 2006 PASSED THE ASSEMBLY AUGUST 31, 2006 PASSED THE SENATE AUGUST 30, 2006 AMENDED IN SENATE AUGUST 28, 2006 AMENDED IN SENATE AUGUST 7, 2006 AMENDED IN ASSEMBLY MAY 26, 2006 AMENDED IN ASSEMBLY MAY 1, 2006 INTRODUCED BY Assembly Members Frommer, Lieu, and Parra (Coauthor: Senator Poochigian) FEBRUARY 24, 2006 An act to amend Section 530.5 of, and to add Section 530.55 to the Penal Code, relating to crime. LEGISLATIVE COUNSEL'S DIGEST AB 2886, Frommer Crime. Existing law provides that every person who, with the intent to defraud, acquires, transfers, or retains possession of the personal identifying information of another person is guilty of a crime punishable by a fine, by imprisonment in a county jail not to exceed one year, or by both a fine and imprisonment. This bill would instead provide that every person who, with the intent to defraud, acquires or retains possession of the personal identifying information of another person, and who has previously been convicted of a violation of provisions proscribing identity theft, or who, with the intent to defraud, acquires or retains possession of the personal identifying information of 10 or more other persons, shall be punished by a fine, by imprisonment in a county jail not to exceed one year, or by both a fine and imprisonment, or by imprisonment in the state prison. This bill would also provide that any person who, with intent to defraud, sells, transfers, or conveys the personal identifying information of another person shall be punished by a fine, by imprisonment in a county jail not to exceed one year, or by both a fine and imprisonment, or by imprisonment in the state prison. This bill would also provide that any person who, with actual knowledge that the personal identifying information of a specific person will be used in violation of identity theft provisions who sells, transfers, or conveys that personal identifying information shall be punished by a fine or by both a fine and imprisonment, or by imprisonment in the state prison. This bill would specify that, for purposes of these provisions, "person" includes natural persons living and deceased, and organizations, associations, business relationships and other legal entities, expand the definition of "personal identifying information" to include any form of identification equivalent to those already listed, and make other conforming changes. Because this bill would expand the definition of existing crimes and create new crimes, it would impose a state-mandated local program. Existing federal law provides that mail theft is punishable by a fine, imprisonment for a period not exceeding 5 years, or by both. This bill would provide that mail theft, as defined, is punishable by a fine, imprisonment in a county jail for a period not exceeding one year, or by both a fine and imprisonment. Because this bill would create new crimes, this bill would impose a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason. THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS: SECTION 1. This act shall be known and may be cited as the "Personal Information Trafficking and Mail Theft Prevention Act." SEC. 2. Section 530.5 of the Penal Code is amended to read: 530.5. (a) Every person who willfully obtains personal identifying information, as defined in subdivision (b) of Section 530.55, of another person, and uses that information for any unlawful purpose, including to obtain, or attempt to obtain, credit, goods, services, real property, or medical information without the consent of that person, is guilty of a public offense, and upon conviction therefor, shall be punished by a fine, by imprisonment in a county jail not to exceed one year, or by both a fine and imprisonment, or by imprisonment in the state prison. (b) In any case in which a person willfully obtains personal identifying information of another person, uses that information to commit a crime in addition to a violation of subdivision (a), and is convicted of that crime, the court records shall reflect that the person whose identity was falsely used to commit the crime did not commit the crime. (c) (1) Every person who, with the intent to defraud, acquires, or retains possession of the personal identifying information, as defined in subdivision (b) of Section 530.55, of another person is guilty of a public offense, and upon conviction therefor, shall be punished by a fine, by imprisonment in a county jail not to exceed one year, or both a fine and imprisonment. (2) Every person who, with the intent to defraud, acquires or retains possession of the personal identifying information, as defined in subdivision (b) of Section 530.55, of another person, and who has previously been convicted of a violation of this section upon conviction therefor shall be punished by a fine, by imprisonment in a county jail not to exceed one year, or by both a fine and imprisonment, or by imprisonment in the state prison. (3) Every person who, with the intent to defraud, acquires or retains possession of the personal identifying information, as defined in subdivision (b) of Section 530.55, of 10 or more other persons is guilty of a public offense, and upon conviction therefor, shall be punished by a fine, by imprisonment in a county jail not to exceed one year, or by both a fine and imprisonment, or by imprisonment in the state prison. (d) (1) Every person who, with the intent to defraud, sells, transfers, or conveys the personal identifying information, as defined in subdivision (b) of Section 530.55, of another person is guilty of a public offense, and upon conviction therefor, shall be punished by a fine, by imprisonment in a county jail not to exceed one year, or by both a fine and imprisonment, or by imprisonment in the state prison. (2) Every person who, with actual knowledge that the personal identifying information, as defined in subdivision (b) of Section 530.55, of a specific person will be used to commit a violation of subdivision (a), sells, transfers, or conveys that same personal identifying information is guilty of a public offense, and upon conviction therefor, shall be punished by a fine, by imprisonment in the state prison, or by both fine and imprisonment. (e) Every person who commits mail theft, as defined in Section 1705 of Title 18 of the United States Code, is guilty of a public offense, and upon conviction therefor shall be punished by a fine, by imprisonment in a county jail not to exceed one year, or by both a fine and imprisonment. Prosecution under this subdivision shall not limit or preclude prosecution under any other provision of law, including, but not limited to subdivisions (a) to (c), inclusive, of this section. (f) An interactive computer service or access software provider, as defined in subsection (f) of Section 230 of Title 47 of the United States Code, shall not be liable under this section unless the service or provider acquires, transfers, sells, conveys, or retains possession of personal information with the intent to defraud. SEC. 3. Section 530.55 is added to the Penal Code, to read: 530.55. (a) For purposes of this chapter, "person" means a natural person, living or deceased, firm, association, organization, partnership, business trust, company, corporation, limited liability company, or public entity, or any other legal entity. (b) For purposes of this chapter, "personal identifying information" means any name, address, telephone number, health insurance number, taxpayer identification number, school identification number, state or federal driver's license, or identification number, social security number, place of employment, employee identification number, professional or occupational number, mother's maiden name, demand deposit account number, savings account number, checking account number, PIN (personal identification number) or password, alien registration number, government passport number, date of birth, unique biometric data including fingerprint, facial scan identifiers, voiceprint, retina or iris image, or other unique physical representation, unique electronic data including information identification number assigned to the person, address or routing code, telecommunication identifying information or access device, information contained in a birth or death certificate, or credit card number of an individual person, or an equivalent form of identification. SEC. 4. No reimbursement is required by this act pursuant to Section 6 of Article XIII B of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIII B of the California Constitution.