A BILL TO BE ENTITLED
AN ACT to further define and deter the crime of financial identity fraud and to provide additional protections to consumers who are the victims of financial identity fraud.
The General Assembly of North Carolina enacts:
SECTION 1.  Section 14‑113.20 of the General Statutes is amended as follows:
"Article 19C.
"Financial Identity Fraud.
"§ 14‑113.20.  Financial identity fraud and attempted financial identity fraud.
(a)	A person who knowingly obtains, possesses, or uses  identifying information of another person, living or dead, without the consent of that other person, or that other person's estate, with the intent to fraudulently represent that the person is the other person for the purposes of making financial or credit transactions in the other person's name or for the purpose of avoiding legal consequences is guilty of a felony punishable as provided in G.S. 14‑113.22(a).
(a1)	 A person who knowingly attempts to obtain, possess, or use identifying information of another person, living or dead, without the consent of that other person or that other person's estate, with the intent to fraudulently represent that the person is the other person for the purposes of making financial or credit transactions in the other person's name or for the purpose of avoiding legal consequences, is guilty of a felony punishable as provided in G.S. 14-113.22(a).
(a2)	The term "business victim" as used in this Article means any individual or entity that provided money, credit, goods, services, or anything of value to someone other than the intended recipient where the intended recipient has not given permission for the actual recipient to receive it and the individual or entity that provided money, credit, goods, services, or anything of value has suffered financial loss as a direct result of the commission or attempted commission of a violation of this Article.
(a3)	The term "consumer victim" as used in this Article means any individual whose identifying information has been obtained, compromised, used, or recorded in any manner without the permission of that individual.
(b)	The term "identifying information" as used in this Article includes the following:
(1)	Social security numbers.
(2)	Drivers license numbers.
(3)	Checking account numbers.
(4)	Savings account numbers.
(5)	Credit card numbers.
(6)	Debit card numbers.
(7)	Personal Identification (PIN) Code as defined in G.S. 14‑113.8(6).
(8)	Electronic identification numbers.
(9)	Digital signatures.
(10)	Any other numbers or information that can be used to access a person's financial resources.
(11)	Biometric data.
(12)	Fingerprints.
(13)	Passwords.
(14)	Parent's legal surname prior to marriage.
(c)	It shall not be a violation under this section for a person to do any of the following:
(1)	Lawfully obtain credit information in the course of a bona fide consumer or commercial transaction.
(2)	Lawfully exercise, in good faith, a security interest or a right of offset by a creditor or financial institution.
(3)	Lawfully comply, in good faith, with any warrant, court order, levy, garnishment, attachment, or other judicial or administrative order, decree, or directive, when any party is required to do so."
SECTION 2.  Article 19C of Chapter 14 of the General Statutes is amended by adding a new section to read:
"§ 14-113.20A.  Trafficking in stolen identities.
(a)	A person commits the crime of trafficking in stolen identities when, without the consent of the consumer victim, he or she sells, transfers, purchases, or possesses with the intent to sell, transfer, or purchase, identifying information with the intent to commit or assist another person in committing financial identity fraud, as defined in G.S. 14-113.20.
(b)	Possession of identifying information pertaining to five or more separate persons, without lawful authorization or the consent of those persons, shall create a rebuttable presumption that the identifying information is possessed with intent to traffic in stolen identities.
(c)	Trafficking in stolen identities is a felony punishable as provided in G.S. 14-113.22(a)."
SECTION 3.  G.S. 14‑113.22 reads as rewritten:
"§ 14‑113.22.  Punishment and liability.
(a)	A violation of G.S. 14-113.20(a) is punishable as a Class F felony, except if the consumer victim is elderly or disabled or suffers arrest, detention, or conviction as a proximate result of the offense, then the violation is punishable as a Class E felony.
(a1)	A violation of G.S. 14-113.20(a1) is punishable as a Class G felony, except if the intended consumer victim is elderly or disabled, then the violation is punishable as a Class F felony.
(a2)	A violation of G.S. 14-113.20.1 is punishable as a Class E felony.
(a3)	In addition to any other punishment, a person found guilty of a violation of G.S. 14-113.20 or G.S. 14-113.20.1 shall be ordered by the court to make restitution for financial loss caused by the violation to any consumer victim. Financial loss may include, but is not limited to, lost wages, attorney fees, and other costs incurred by the consumer victim in correcting his or her credit history or credit rating, in connection with any criminal proceeding brought against the consumer victim, or in connection with any civil or administrative proceeding resulting from the misappropriation of the consumer victim's  identifying information. The court also may order restitution for financial loss caused by the violation to any business victim.
(b)	Notwithstanding subsections (a1), (a2), or (a3) of this section, any consumer victim who suffers injury or damages as a result of a violation of G.S. 14-113.20 or G.S. 14-113.20.1, irrespective of whether any criminal prosecution for the violation has occurred, shall have a cause of action against the person engaged in the violation for civil damages of up to five thousand dollars ($5,000) for each incident, or three times the amount of actual damages, if any, sustained by the consumer victim, whichever amount is greater. A business victim who suffers injury or damages as a result of any violation of G.S. 14-113.20 or G.S. 14-113.20.1, irrespective of whether any criminal prosecution for the violation has occurred, shall have a cause of action for the actual damages sustained and, where appropriate, punitive damages. A consumer or business victim damaged as set forth in this subsection may also institute a civil action to enjoin and restrain future acts which would constitute a violation of this G.S. 14-113.20 or G.S. 14-113.20.1. The court, in an action brought under this subsection, may award reasonable attorneys' fees to the prevailing party.
The plaintiff's burden of proof in any civil action brought under this subsection shall be by the preponderance of the evidence.  The venue for any civil action brought under this subsection shall be the county in which the plaintiff resides or any county in which any part of the alleged violation of G.S.14-113.20 or G.S. 14-113.20.1 took place, regardless of whether the defendant was ever actually present in that county. Civil actions under this subsection must be brought within three years from the date on which the identity of the wrongdoer was discovered or reasonably should have been discovered.
(c)	In any case in which a person obtains identifying information of another person in violation of G.S. 14‑113.20, uses that information to commit a crime in addition to a violation of G.S. 14‑113.20, and is convicted of that additional crime, the court records shall reflect that the person whose identity was falsely used to commit the crime did not commit the crime."
SECTION 4.   G.S. 14‑113.23 reads as rewritten:
"§ 14‑113.23.  Application of Chapter 75, Article 1, and authority of the Attorney General.
A violation of G.S. 14-113.20 or G.S. 14-113.20.1 is an unfair or deceptive act or practice in or affecting commerce for the purpose of applying G.S. 75-1.1. The Attorney General may investigate any complaint regarding financial identity fraud or trafficking in stolen identities under this Article. In conducting these investigations, the Attorney General has all the civil investigative and enforcement powers available to the Attorney General under Article 1 of Chapter 75 of the General Statutes. The Attorney General shall refer  cases of criminal financial identity fraud or trafficking in stolen identities  to the district attorney in the county where the crime was deemed committed in accordance with G.S. 14‑113.21."
SECTION 5.  Chapter 75 of the General Statutes is amended by adding a new Article to read:
"Article 4.
"Financial Identity Fraud Prevention and Assistance to Victims.
"§ 75-100.  Definitions.
The following definitions apply in this Article:
(1)	"Bureau" means the Bureau of Privacy Protection within the Office of the Attorney General.
(2)	"Business" means a sole proprietorship, partnership, corporation, association, or other group, however organized and whether or not organized to operate at a profit. The term includes a financial institution organized, chartered, or holding a license or authorization certificate under the laws of this State, any other state, the United States, or any other country, or the parent or the subsidiary of any such financial institution.
(3)	"Cardholder" means the person to whom or for whose benefit a credit card is issued by an issuer, including any employee or other authorized agent of the cardholder.
(4)	"Consumer credit report" means any consumer report as defined in section 603 of the Fair Credit Reporting Act, 15 U.S.C. Section 1681a, as amended.
(5)	"Consumer credit reporting agency" means any consumer reporting agency as defined in section 603 of the Fair Credit Reporting Act, 15 U.S.C. Section 1681a, as amended.
(6)	"Credit card" means any instrument or device, whether known as a credit card, credit plate, bank service card, bank card, check guarantee card, debit card, or by any other name, including an account number, issued with or without fee by an issuer for the use of a cardholder in obtaining money, goods, services, or anything else of value or for use in an automated banking device to obtain any of the services offered through the device.
(7)	"Customer" means an individual who provides personal information to another person for the purpose of purchasing or leasing a product or obtaining a service or credit from that person.
(8)	"Discard" means to throw away, get rid of, or eliminate.
(9)	"Financial identity fraud" means the unauthorized use of another person's identifying information as defined in G.S. 14-113.20(a).
(10)	"Identifying information" means information as defined in G.S. 
14-113.20(b).
(11)	"Issuer" means the financial institution or other organization that issues a credit card, including the issuer's duly authorized agents.
(12)	"Person" means an individual, corporation, partnership, trust association, joint venture pool, syndicate, sole proprietorship, unincorporated organization, or any other legal entity.
(13)	"Personal information" means:
a.	Personally identifiable data about a customer's medical condition, if the data are not considered to be public knowledge;
b.	Personally identifiable data which contain a customer's identifying information, account balance, balance owing, credit balance, or credit limit, if the data relate to a customer's account or transaction with another person;
c.	Personally identifiable data provided by a customer to another person upon opening an account or applying for a loan or credit; or
d.	Personally identifiable data about a customer's federal, state, or local income tax return.
(14)	"Personally identifiable" means capable of being associated with a particular customer through one or more identifiers, including, but not limited to, the customer's identifying information. A customer's name, address, and telephone number shall not be considered personally identifiable data unless used in conjunction with the customer's identifying information.
(15)	"Provider" means a person who furnishes money, goods, services, or anything else of value upon presentation, whether physically, in writing, verbally, electronically, or otherwise, of a credit card by a cardholder or by any agent or employee of a cardholder.
(16)	"Record" means any material on which written, drawn, printed, spoken, visual, or electromagnetic information is recorded or preserved, regardless of physical form or characteristics.
"§ 75-101.  Credit cards; printing of account information on sales receipts; liability.
(a)	Except as otherwise provided in this section, no provider shall print or otherwise produce or reproduce, or permit the printing or other production or reproduction, of either of the following on any receipt provided or made available to a cardholder:
(1)	More than the last five digits or other characters of the credit card account number.
(2)	The credit card expiration date.
(b)	This section shall not apply to any of the following:
(1)	A credit card transaction in which the sole means available to the provider for recording the credit card account number is by handwriting or by imprint of the card.
(2)	Receipts issued for transactions on the electronic benefits transfer card system in accordance with 7 C.F.R. 274.12(g)(3).
(c)	Any provider who violates the provisions of this section shall be liable to the cardholder and the issuer for any damages or expenses, or both, including attorney fees, incurred by the cardholder or issuer as a proximate result of the violation.
(d)	The provisions of this section shall become operative:
(1)	On January 1, 2005, with respect to any cash register or other machine or device that prints receipts for credit card transactions that is in use prior to July 1, 2003.
(2)	On July 1, 2003, with respect to any cash register or other machine or device that prints receipts for credit card transactions that is first put into use on or after July 1, 2003.
"§ 75-102.  Disposal of identifying information.
(a)	Except as otherwise expressly permitted by law, no business shall discard a record containing personal information unless it:
(1)	Shreds or otherwise destroys the customer's record before discarding the record;
(2)	Erases the personal information contained in the customer's record before discarding the record;
(3)	Modifies the customer's record to make the personal information unreadable before discarding the record; or
(4)	Takes actions that it reasonably believes will ensure that no unauthorized person will have access to the personal information contained in the customer's record for the period between the discarding of the record and the record's destruction.
(b)	A violation of this section is an unfair or deceptive act or practice in or affecting commerce for the purpose of applying G.S. 75-1.1; provided, however, that it shall be an affirmative defense to the wrongful discarding of a customer's record containing personal information if the business can show that it used due diligence in its attempt to properly discard such records.
(c)	This section does not apply to any bank or financial institution that is subject to the privacy and security provisions of the Gramm-Leach-Bliley Act, 15 U.S.C. Section 6801 et seq., as amended.
"§ 75-103.  Transfer of customer's identifying information.
(a)	Except as otherwise expressly permitted by law, no provider that obtains a customer's identifying information shall sell, trade, or otherwise transfer that identifying information to any other person without the customer's written permission except for the purpose of completing either:
(1)	A transaction for which or during which the customer provided the personal information, or
(2)	Another transaction expressly authorized in writing by the customer.
(b)	A violation of this section is an unfair or deceptive act or practice in or affecting commerce for the purpose of applying G.S. 75-1.1.
(c)	This section does not apply to any bank or financial institution that is subject to the privacy and security provisions of the Gramm-Leach-Bliley Act, 15 U.S.C. Section 6801 et seq., as amended.
"§ 75-104.  Verification of change of offeree's address.
(a)	A credit card issuer who mails an offer or solicitation to receive a credit card and, in response, receives a completed application for a credit card that lists an address different from the address on the offer or solicitation shall verify the change of address by contacting the person to whom the offer or solicitation was mailed.
(b)	Notwithstanding any other provision of law, a person to whom an offer or solicitation to receive a credit card is made shall not be liable for the use of a credit card issued as a result of that offer or solicitation if the issuer does not comply with the provisions of subsection (a) of this section before issuing the credit card, unless the issuer proves that the person to whom the offer or solicitation was addressed actually incurred or authorized the charge on the credit card.
(c)	When a credit card issuer receives a written or oral request for a change of the cardholder's billing address and then receives a written or oral request for an additional credit card within 10 days after the requested address change, the issuer shall not mail the requested additional credit card to the new address or, alternatively, shall not activate the requested additional card, unless the issuer has verified the change of address.
"§ 75-105.  Verification of consumer address; reasonable steps to prevent financial identity fraud; recoverable damages for violation.
 (a)	If a person uses a consumer credit report in connection with a credit transaction, and the address on the consumer credit report does not match the address of the consumer requesting or being offered credit, the person offering or extending credit shall take reasonable steps to verify the identity of the consumer requesting or being offered credit and to confirm that the credit transaction is not an attempted financial identity fraud.
(b)	Any person who uses a consumer credit report in connection with a credit transaction, and who receives notice from a consumer credit reporting agency that the information in the report has been blocked pursuant to G.S. 75-106 as a result of financial identity fraud, shall not lend money or extend credit without taking reasonable steps to verify the identity of the consumer requesting or being offered credit and to confirm that the credit transaction is not an attempted financial identity fraud.
(c)	Any consumer who suffers damage as a result of a violation of this section by any person may bring an action in a court of appropriate jurisdiction against that person to recover actual damages, court costs, attorney fees, and punitive damages.
"§ 75-106.  Block of information appearing as a result of financial identity fraud.
(a)	If a consumer submits to a consumer credit reporting agency a copy of a filed police report evidencing the consumer's claim to be a victim of a violation of G.S. 
14-113.20, the consumer credit reporting agency shall, within 30 days of its receipt of the police report, permanently block the reporting of any information appearing on the consumer's credit report that the consumer claims is a result of a violation of G.S. 
14-113.20, so that the information cannot be reported except as provided in subsection (b) of this section. The consumer credit reporting agency shall promptly notify the furnisher of the information that a police report has been filed, that a block has been requested, and the effective date of the block.
(b)	A consumer credit reporting agency may decline to block or may rescind any block of consumer information if, in the exercise of good faith and reasonable judgment, the consumer reporting agency believes:
(1)	The information was blocked due to a misrepresentation of fact by the consumer;
(2)	The consumer agrees that the blocked information or portions of the blocked information were blocked in error; or
(3)	The consumer knowingly obtained possession of goods, services, or moneys as a result of the blocked transaction or transactions or the consumer should have known that he or she obtained possession of goods, services, or moneys as a result of the blocked transaction or transactions.
(c)	If the block of information is declined or rescinded under subsection (b) of this section, the consumer shall be notified promptly in the same manner as consumers are notified of the reinsertion of information pursuant to section 611 of the Fair Credit Reporting Act, 15 U.S.C. Section 1681i, as amended.
(d)	A consumer harmed by a violation of this section may bring an action in a court of appropriate jurisdiction to recover actual damages, court costs, attorney fees, and punitive damages against the consumer credit reporting agency or the furnisher of the information or both.
"§ 75-107.  Information available to victims of financial identity fraud.
(a)	Any person who possesses information relating to an actual or potential violation of G.S 14-113.20 and who has entered into a transaction with a person who has or may have used a consumer's identifying information in violation of G.S. 
14-113.20 shall, upon written request of the consumer victim, provide copies to the victim of all documents and other information related to the transaction being alleged as a potential or actual violation of G.S. 14-113.20. Nothing in this section requires the information provider to disclose information that it is otherwise prohibited from disclosing by law, except that a law that prohibits disclosing a person's information to third parties shall not be used to deny disclosure of such information to the victim under this section.
(b)	Any person requesting copies of documents or information pursuant to subsection (a) of this section shall provide the following as proof of his or her identity and claim to be a victim of financial identity fraud:
(1)	A government-issued photo identification card or, if providing proof by mail, a copy of a government-issued photo identification card; and
(2)	A certified copy of a filed police report evidencing the victim's claim.
(c)	Any person who provides documents or other information pursuant to subsection (a) of this section may require compensation for the actual cost of providing the information requested.
(d)	No person may be held liable for actions taken in good faith to provide information pursuant to subsection (a) of this section to alleged victims who have complied with the identification requirements of subsection (b) of this section.
(e)	A person may decline to provide documents or other information pursuant to this section when, in the exercise of good faith and reasonable judgment, the person believes that this section does not require disclosure of the information or that the request is being made for improper purposes.
(f)	Nothing in this section obligates a person to retain or maintain information or records that would not otherwise be retained or maintained in the ordinary course of business.
"§ 75-108.  Bureau of Privacy Protection.
(a)	There is established in the Office of the Attorney General a bureau to be known as the Bureau of Privacy Protection. The bureau shall be under the direction of the Attorney General or the Attorney General's designee. The bureau shall protect the privacy of individuals' identifying information in a manner consistent with the laws of this State by identifying and responding to consumer problems and complaints in the privacy area and facilitating development of fair information practices consistent with the goals set forth in this section.
(b)	The Attorney General or the Attorney General's designees shall:
(1)	Inform the public of potential options for protecting the privacy of and avoiding the misuse of identifying information.
(2)	Receive complaints from individuals concerning any persons'obtaining, compiling, maintaining, using, disclosing, or disposing of identifying information in a manner that may be potentially unlawful or violate a stated privacy policy relating to that individual and shall provide advice, information, and referral where available.
(3)	Provide information to consumers on effective ways of handling complaints that involve violations of privacy-related laws, including identity theft and identity fraud. Where appropriate federal, State or local agencies are available to assist consumers with those complaints, the Attorney General shall refer those complaints to those agencies.
(4)	Investigate and assist in the prosecution of identity fraud and other privacy-related crimes and, as necessary, coordinate with federal, State, and local law enforcement agencies in the investigation of similar crimes.
(5)	Assist in the training of federal, State, and local law enforcement agencies regarding identify fraud and other privacy-related crimes, as appropriate.
SECTION 6.  There is appropriated from the General Fund to the Department of Justice the sum of fifty thousand dollars ($50,000) for the 2002‑2003 fiscal year to carry out the purposes of this act.
SECTION 7.  This act becomes effective December 1, 2002, and applies to offenses committed on or after that date.