SB581: Bill Text

LRB-3433/2

CMH/CTS/ARG/MDK/GMM:kjf&lmk:ch

2005 - 2006 LEGISLATURE

2005 Senate BILL 581

February 7, 2006 - Introduced by Senators Decker, Robson, Risser, Taylor, Breske, Hansen and Carpenter, cosponsored by Representatives Musser, Seidel, Black, Sinicki, Vruwink and Molepske. Referred to Committee on Judiciary, Corrections and Privacy.

SB581,1,8 An Act to amend 165.25 (4) (ar) and 343.17 (3) (a) 4.; to repeal and recreate 942.05; and to create 100.54, 103.135, 138.25, 939.646 and 971.19 (12) of the statutes; relating to: mail theft, penalty enhancers for identity theft crimes against certain persons, protection of social security numbers of employees, prohibiting discrimination against an individual who refuses to disclose the individual's social security number, prohibiting social security numbers as identifying numbers on driver's licenses and identification cards, allowing individuals to restrict release of credit reports, and providing penalties.

Analysis by the Legislative Reference Bureau

This bill does the following: 1) makes changes regarding mail theft and identity theft; 2) makes changes regarding the use of social security numbers by businesses and employers; and 3) allows individuals to restrict access to their credit reports.

mail theft

Current law prohibits a person from opening any sealed letter or package if the person knows that he or she does not have the consent of the sender or the addressee and prohibits a person from publishing the contents of any letter or package that was opened without the consent of the sender or the addressee. Whoever violates one of these prohibitions is guilty of a misdemeanor and may be fined up to $10,000 or sentenced to a term of imprisonment for up to nine months or both.

This bill prohibits a person without a claim of right, as defined in the bill, from removing mail from any mail box or post office box, taking mail from a mail carrier, deceiving another person to obtain custody of mail, removing the contents of mail, taking mail left for collection, or possessing, publishing, buying, or concealing mail that was acquired through one of the new prohibitions the bill creates. Whoever violates one of the prohibitions is guilty of a felony and may be fined up to $10,000 or sentenced to a term of imprisonment for up to three years and six months or both. Although current law generally requires criminal cases to be tried in the county where the crime was committed, this bill specifies that such mail theft cases may be tried also in the county in which the victim resided at the time of the offense, or, if the victim was a business or other entity, in the county where its place of business was located.

Identity theft

Under current law, a person is prohibited from using another person's personal identifying information or personal identification document without authorization from the other person in order to obtain something of value, to avoid civil or criminal process or penalties, or to harm the other person. A person who violates the prohibition is guilty of a felony and may be fined up to $10,000 or sentenced to a term of imprisonment of up to six years or both. This bill creates an additional penalty for cases in which the offender sought to obtain something of value or to avoid civil or criminal process or penalties and in which the victim was selected because he or she was a vulnerable adult or was disabled, elderly, or under the age of 18. The additional penalty increases the maximum fine by $5,000 and increases the maximum term of imprisonment by five years.

Social security numbers

This bill prohibits a person that conducts business in this state from discriminating with respect to the sale or purchase of goods or services against an individual who refuses to disclose the individual's social security number, unless state or federal law requires or specifically authorizes the person to obtain the individual's social security number. Under the bill, the Department of Agriculture, Trade and Consumer Protection (DATCP) investigates violations of this prohibition and may bring an enforcement action against a violator for injunctive relief or for a penalty specified in current law. In an enforcement action, DATCP is represented by the attorney general.

This bill prohibits an employer from soliciting from any applicant for employment the social security number of the applicant until the employer makes an offer of employment to the applicant. In addition, the bill prohibits an employer from using the social security number or any derivative of a social security number of an employee as an identifier unless that use is required or specifically authorized by state or federal law. The bill also prohibits an employer from displaying the social security number or any derivative of a social security number of an employee on any identification card that is issued by the employer.

Under current law, each driver's license and identification card issued to a person by the Department of Transportation (DOT) must bear a unique identifying number assigned by DOT. This bill prohibits DOT from using a person's social security number as the unique identifying number on the person's driver's license or identification card.

credit reports

The bill allows an individual to prohibit, with certain exceptions, a credit reporting agency from releasing the individual's credit report to third parties without the individual's authorization. Under the bill, if an individual provides the notice by certified mail or telephone to a credit reporting agency, then, no later than five business days after receipt of the notice, the credit reporting agency may not, with certain exceptions, release the individual's credit report to third parties without first obtaining the individual's authorization. The bill also allows, but does not require, a credit reporting agency to accept notices by electronic mail. If such notice is allowed, the credit reporting agency's deadline for not releasing credit reports is three business days after receipt of the notice. The bill also requires a credit reporting agency, within five business days after receipt of a notice, to provide an individual a unique personal identification number or password for authorizing the release of credit reports as described below.

As an alternative to giving prior authorization, the bill allows an individual who provides the notice described above to request the credit reporting agency to release a credit report to a third party identified by the individual. In addition, the bill allows an individual to request a credit reporting agency to release credit reports, for a period of time specified by the individual, to persons eligible to obtain them under federal law. An individual must provide the identification number or password described above to request release of a credit report under such circumstances. The bill requires a credit reporting agency to establish procedures for making such requests. The procedures must allow the requests to be made by certified mail or telephone and may allow the requests to be made by electronic mail. The bill requires a credit reporting agency to comply with a request within three business days after receipt of the request.

The bill contains exceptions to the prohibition on releasing credit reports without an individual's prior authorization. If an individual makes a material misrepresentation of fact in the notice describe above, the credit reporting agency may release a credit report, but only if the credit reporting agency first notifies the individual in writing about the misrepresentation at least five business days before releasing the credit report.

Also, the bill allows a credit reporting agency to release an individual's credit report to a person, or subsidiary, affiliate, agent, or assignee of a person, with whom the individual has an account, contract, or debtor-creditor relationship, provided that the release is for certain account review activities. In addition, the bill allows a credit reporting agency to release a credit report to any of the following: 1) a court, state or local governmental agency, or law enforcement agency; 2) a person acting pursuant to a court order, warrant, or subpoena; 3) the Department of Workforce Development (DWD) or a county child support agency for the purpose of enforcing support or maintenance obligations; 4) DWD or the Department of Health and Family Services for the purpose of investigating suspected fraudulent activity regarding specified benefits programs; 5) the Department of Revenue for the purpose of collecting delinquent taxes; 6) a person administering a credit file monitoring service to which the individual has subscribed; or 7) a person who provides the individual with a copy of a credit report at the individual's request. In addition, a credit reporting agency may release reports for the purpose of prescreening that is allowed under the federal Fair Credit Reporting Act. (Prescreening is a process in which credit reporting agencies compile lists of consumers who meet specific criteria and provide the lists to third parties for credit or insurance solicitation purposes.)

The bill also does all of the following:

1. Allows an individual to rescind a notice described above.

2. Allows a credit reporting agency to advise a third party that the credit reporting agency must obtain an individual's authorization before releasing a credit report to the third party.

3. Allows a third party to treat an individual's application for credit or any other purpose as incomplete if the bill prohibits a credit reporting agency from releasing the individual's credit report to the third party.

4. If a credit reporting agency releases an individual's credit report in violation of the bill's requirements, requires a credit reporting agency to notify the individual within 5 business days after releasing the credit report.

5. Prohibits a credit reporting agency from charging fees for taking actions required under the bill, except for reissuing personal identification numbers and passwords under certain circumstances.

6. Allows an individual to bring an action against a credit reporting agency that violates the bill's requirements regarding credit reports and recover damages or $10,000 per violation, whichever is greater.

7. Requires credit reporting agencies to provide individuals with a notice describing their rights under the bill whenever the credit reporting agency is required to provide a notice under federal law regarding consumer rights with respect to credit reports.

Finally, the bill requires the Division of Banking in the Department of Financial Institutions to enforce the foregoing requirements.

Because this bill creates a new crime or revises a penalty for an existing crime, the Joint Review Committee on Criminal Penalties may be requested to prepare a report concerning the proposed penalty and the costs or savings that are likely to result if the bill is enacted.

For further information see the state and local fiscal estimate, which will be printed as an appendix to this bill.

The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:

SB581, s. 1 Section 1. 100.54 of the statutes is created to read:

SB581,5,6 100.54 Refusals to disclose social security number; discrimination prohibited. (1) No person that conducts business in this state may discriminate with respect to the terms or conditions of the sale or purchase of goods or services against an individual who refuses to disclose the individual's social security number, unless the person is required or specifically authorized by state or federal law to obtain the individual's social security number.

SB581,5,8 (2) The department may exercise its authority under ss. 93.14 and 93.15 to investigate violations of this section.

SB581,5,12 (3) The department may commence an action in the name of the state to restrain by temporary or permanent injunction a violation of this section. Before entry of final judgment, the court may make any necessary orders to restore to any person any pecuniary loss suffered by the person because of the violation.

SB581, s. 2 Section 2. 103.135 of the statutes is created to read:

SB581,5,19 103.135 Employee social security number protection. (1) Definition. In this section, "employer" means any person engaging in any activity, enterprise, or business in this state employing at least one individual. "Employer" includes the state and any office, department, independent agency, authority, institution, association, society, or other body in state government created or authorized to be created by the constitution or any law, including the legislature and the courts.

SB581,5,25 (2) Unnecessary solicitation or use prohibited. No employer may solicit from any applicant for employment the social security number of the applicant until the employer makes an offer of employment to the applicant. No employer may use the social security number of any derivative of the social security number of an employee as an identifier unless that use is required or specifically authorized by state or federal law.

SB581,6,3 (3) Display prohibited. No employer may display the social security number or any derivative of a social security number of an employee on any identification card that is issued by the employer.

SB581, s. 3 Section 3. 138.25 of the statutes is created to read:

SB581,6,5 138.25 Access to credit reports. (1) Definitions. In this section:

SB581,6,7 (a) "Account review" includes review activities related to account maintenance or monitoring, credit line increases, or account upgrades or enhancements.

SB581,6,9 (b) "Business day" means a business day, as defined in s. 421.301 (6), that is not a legal holiday under s. 895.20 or a federal legal holiday.

SB581,6,14 (c) "Credit report" means any written, oral, or other communication of any information by a credit reporting agency bearing on a individual's credit worthiness, credit standing, or credit capacity, which is used or is expected to be used, or collected in whole or in part, for a purpose specified in 15 USC 1681b or for the purpose of serving as a factor in establishing the individual's eligibility for any of the following:

SB581,6,15 1. Credit to be used primarily for personal, family, or household purposes.

SB581,6,16 2. Employment, promotion, reassignment, or retention as an employee.

SB581,6,17 3. Rental of a residential dwelling unit.

SB581,6,23 (d) "Credit reporting agency" means any person who, for fees, dues, or other compensation, or on a cooperative nonprofit basis, regularly engages in whole or in part in the business of assembling or evaluating credit or other information on individuals for the purpose of furnishing credit reports to 3rd parties, but does not include any governmental agency whose records are maintained primarily for traffic safety, law enforcement, or licensing purposes.

SB581,6,25 (e) "Eligible user" means a person who is allowed under federal law to obtain an individual's credit report.

SB581,7,6 (2) Restriction of access. (a) Notice. 1. If an individual provides notice, as specified in subd. 2., to a credit reporting agency to restrict access to the individual's credit report, then, no later than the deadline specified in subd. 2., the credit reporting agency may not, except as provided in sub. (3), release the credit report, or any information included in the credit report, to a 3rd party without the individual's prior authorization.

SB581,7,14 2. An individual may provide the notice required under subd. 1. to a credit reporting agency by certified mail, telephone, or, if allowed by the credit reporting agency, electronic mail. The notice shall include information that allows the credit reporting agency to verify the identity of the individual providing the notice. If a notice includes such information, a credit reporting agency shall comply with subd. 1. no later than 5 business days after an individual provides notice by certified mail or telephone and no later than 3 business days after an individual provides notice by electronic mail.

SB581,7,18 3. No later than 5 business days after the deadline specified in subd. 2., the credit reporting agency shall provide the individual with a unique personal identification number or password for the individual to authorize release of the individual's credit report as described in par. (b).

SB581,7,25 (b) Access authorization. 1. An individual who has provided notice under par. (a) 1. to a credit reporting agency may request the credit reporting agency to release the individual's credit report to a 3rd party upon the 3rd party's request or to any eligible user who requests the credit report during a specified period of time. In making a request, an individual shall provide the credit reporting agency with the unique personal identification number or password described in par. (a) 3. and identify the 3rd party or specify the period of time.

SB581,8,5 2. A credit reporting agency shall establish procedures for individuals to make requests under subd. 1. The procedures shall allow an individual to make a request by certified mail or telephone. The procedures may allow an individual to make a request by electronic mail. A credit reporting agency shall disclose the procedures to individuals who provide notice under par. (a) 1.

SB581,8,8 3. A credit reporting agency shall comply with a request made under subd. 1. no later than 3 business days after the credit reporting agency's receipt of the request.

SB581,8,11 (3) Release of reports. (a) A credit reporting agency may release to 3rd parties and eligible users the credit report of an individual who provides notice under sub. (2) (a) 1. if any of the following apply:

SB581,8,13 1. The individual requests the credit reporting agency to release the credit report to the 3rd party or eligible user under sub. (2) (b).

SB581,8,19 2. The individual provides the credit reporting agency a subsequent written notice by certified mail that rescinds the notice provided under sub. (2) (a) 1. and includes with the notice the unique personal identification number or password described in sub. (2) (a) 3. No later than 3 business days after receipt of the notice, the credit reporting agency shall eliminate the restrictions on access to the individual's credit report that are otherwise required under sub. (2) (a) 1.

SB581,8,23 3. The individual makes a material misrepresentation of fact in a notice under sub. (2) (a) 1., provided that the credit reporting agency notifies the individual in writing about the misrepresentation at least 5 business days before the credit reporting agency releases the credit report to 3rd parties.