39-14-150 - Identity theft victims' rights.
39-14-150. Identity theft victims' rights.
(a) This section shall be known and may be cited as the Identity Theft Victims' Rights Act of 2004.
(b) A person commits the offense of identity theft who knowingly obtains, possesses, buys, or uses, the personal identifying information of another:
(1) With the intent to commit any unlawful act including, but not limited to, obtaining or attempting to obtain credit, goods, services or medical information in the name of such other person; and
(2) (A) Without the consent of such other person; or
(B) Without the lawful authority to obtain, possess, buy or use that identifying information.
(3) For purposes of the offense of identity theft, an activity involving a possession, use or transfer that is permitted by the Tennessee Financial Records Privacy Act, codified in title 45, chapter 10; Title V of the Gramm-Leach-Bliley Act, Pub. L. No. 106-102; or the Fair Credit Reporting Act, as amended by the Fair and Accurate Credit Transactional Act, (15 U.S.C. § 1681 et seq.) shall not be considered an unlawful act.
(c) (1) A person commits the offense of identity theft trafficking who knowingly sells, transfers, gives, trades, loans or delivers, or possesses with the intent to sell, transfer, give, trade, loan or deliver, the personal identifying information of another:
(A) With the intent that the information be used by someone else to commit any unlawful act including, but not limited to, obtaining or attempting to obtain credit, goods, services or medical information in the name of the other person; or
(B) Under circumstances such that the person should have known that the identifying information would be used by someone else to commit any unlawful act including, but not limited to, obtaining or attempting to obtain credit, goods, services or medical information in the name of the other person; and
(C) The person does not have the consent of the person who is identified by the information to sell, transfer, give, trade, loan or deliver, or possess with the intent to sell, transfer, give, trade, loan or deliver, that information; and
(D) The person does not have lawful authority to sell, transfer, give, trade, loan or deliver, or possess with the intent to sell, transfer, give, loan or deliver, the personal identifying information.
(2) For purposes of the offense of identity theft trafficking, an activity involving a possession, use or transfer that is permitted by the Tennessee Financial Records Privacy Act, codified in title 45, chapter 10; Title V of the Gramm-Leach-Bliley Act, Pub. L. No. 106-102; or the Fair Credit Reporting Act, as amended by the Fair and Accurate Credit Transactional Act, (15 U.S.C. § 1681 et seq.) shall not be considered an unlawful act.
(d) In a prosecution under subsection (c), the trier of fact may infer from the defendant's simultaneous possession of the personal identifying information of five (5) or more different individuals that the defendant possessed the personal identifying information with the intent to sell, transfer, give, trade, loan or deliver the information. However, if the defendant had the consent of one (1) or more of the individuals to possess the personal identifying information of that individual, the consenting individual shall not be counted in determining whether an inference of possession for sale may be drawn by the trier of fact.
(e) As used in this section, personal identifying information means any name or number that may be used, alone or in conjunction with any other information, to identify a specific individual, including:
(1) Name, social security number, date of birth, official state or government issued driver license or identification number, alien registration number, passport number, employer or taxpayer identification number;
(2) Unique biometric data, such as fingerprint, voice print, retina or iris image, or other unique physical representation;
(3) Unique electronic identification number, address, routing code or other personal identifying data which enables an individual to obtain merchandise or service or to otherwise financially encumber the legitimate possessor of the identifying data; or
(4) Telecommunication identifying information or access device.
(f) (1) The general assembly recognizes that an offense under this section may result in more than one (1) victim. While a company or business that loses money, merchandise, or other things of value as a result of the offense is a victim, it is equally true that the person whose identity is stolen is also a victim. The person whose identity is stolen suffers definite and measurable losses including expenses necessary to cancel, stop payment on, or replace stolen items such as credit cards, checks, driver licenses, and other documents, costs incurred in discovering the extent of the identity theft, in repairing damage from the theft such as credit ratings and reports and preventing further damages from the theft, long distance telephone charges to law enforcement officials, government offices, and businesses in regard to the theft, and lost wages from the time away from work required to obtain new personal identifying information and complete all of the tasks set out in this subdivision (f)(1). In addition to measurable losses, the person whose identity is stolen also suffers immeasurable damages such as stress and anxiety as well as possible health problems resulting from or aggravated by the offense.
(2) For the reasons set out in subdivision (f)(1), the general assembly declares that any person whose identity is unlawfully obtained in violation of subsection (b) or (c) is a victim of crime within the meaning of Tenn. Const., art. I, § 35 and title 40, chapter 38.
(g) (1) Notwithstanding any other provision of law to the contrary, if a private entity or business maintains a record that contains any of the personal identifying information set out in subdivision (g)(2) concerning one of its customers, and the entity, by law, practice or policy discards such records after a specified period of time, any record containing the personal identifying information shall not be discarded unless the business:
(A) Shreds or burns the customer's record before discarding the record;
(B) Erases the personal identifying information contained in the customer's record before discarding the record;
(C) Modifies the customer's record to make the personal identifying information unreadable before discarding the record; or
(D) Takes action to destroy the customer's personal identifying information in a manner that it reasonably believes will ensure that no unauthorized persons have access to the personal identifying information contained in the customer's record for the period of time between the record's disposal and the record's destruction.
(2) As used in this subsection (g), personal identifying information means a customer's:
(A) Social security number;
(B) Driver license identification number;
(C) Savings account number;
(D) Checking account number;
(E) PIN (personal identification number) or password;
(F) Complete credit or debit card number;
(G) Demand deposit account number;
(H) Health insurance identification number; or
(I) Unique biometric data.
(3) (A) A violation of this subsection (g) shall be considered a violation of the Tennessee Consumer Protection Act of 1977, codified in title 47, chapter 18, and may be punishable by a civil penalty in the amount of five hundred dollars ($500) for each record containing a customer's personal identifying information that is wrongfully disposed of or discarded; provided, however, that no total penalty may exceed ten thousand dollars ($10,000) for any one (1) customer.
(B) It is an affirmative defense to any civil penalty imposed pursuant to this subsection (g) that the business used due diligence in its attempt to properly dispose of or discard the records.
(4) The methods of destroying the personal identifying information of a customer set out in this subsection (g) shall be considered the minimum standards. If a private entity or business by law, practice or policy currently is required to have or otherwise has in place more stringent methods and procedures for destroying the personal identifying information in a customer's record than are required by this subsection (g), the private entity or business may continue to destroy the identifying information in the more stringent manner.
(5) To the extent that the provisions of this subsection (g) conflict with applicable federal law, this subsection (g) shall not apply to an entity that is subject to the enforcement authority of the federal banking agencies, the national credit union administration, the federal trade commission or the securities and exchange commission. For any such entity, the provisions of applicable federal law shall govern the proper disposition of records containing consumer information, or any compilation of consumer information, derived from consumer reports for a business purpose.
(6) Notwithstanding subdivision (g)(5), the provisions of this subsection (g) shall not apply to any financial institution that is subject to the privacy and security provisions of the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801, et. seq., as amended, and as it existed on January 31, 2002.
(h) (1) The following property shall be subject to seizure and judicial forfeiture to the state in the manner provided:
(A) Any property, real or personal, directly or indirectly acquired by or received in violation of this section;
(B) Any property, real or personal, received as an inducement to violate this section;
(C) Any property, real or personal, traceable to the proceeds from the violation;
(D) Any property, real or personal, used in connection with or to facilitate a violation of this section; and
(E) All conveyances, including aircraft, vehicles or vessels, which are used, or are intended for use, in the commission of or escape from a violation of this section and any money, merchandise or other property contained in those conveyances.
(2) Property seized pursuant to this subsection (h) shall be seized and forfeited pursuant to the procedure set out in title 39, chapter 11, part 7.
(3) Notwithstanding the provisions of § 39-11-713, property seized pursuant to this subsection (h) shall be disposed of as follows:
(A) All property ordered forfeited shall be sold at public auction. The proceeds from all property forfeited and sold at public auction shall be disposed of by the court as directed by this section. The attorney general shall first be compensated for all expenses incident to the litigation, as approved by the court. Any costs for appeals shall be provided for by the trial court upon conclusion of the litigation. The attorney general shall then direct that any public agency be reimbursed for out-of-pocket expenses resulting from the investigation, seizure and storage of the forfeited property.
(B) Out of the proceeds remaining, the court shall order restitution be made to the person or persons whose identity was stolen for any identifiable losses resulting from the offense.
(C) The court shall then award the remainder of the funds as follows:
(i) In the event that the investigating and seizing agency was a state agency, then ten percent (10%) of the funds shall be distributed to the state treasurer who shall deposit the funds in a designated account for the agency to be used in its identity theft operations;
(ii) In the event that the investigating and seizing agency is the Tennessee bureau of investigation, then ten (10%) of the funds shall be distributed to the state treasurer who shall deposit the funds in a designated account for the agency to be used in its identity theft operations;
(iii) In the event that the investigating and seizing agency is a local public agency, then twenty-five percent (25%) of the funds shall be distributed to its local government for distribution to the law enforcement agency for use in the enforcement of this section. When more than one (1) local public agency participated in the investigation and seizure of forfeited property as certified by the attorney general, then the court shall order a distribution of ten percent (10%) of the funds according to the participation of each local public agency. Accounting procedures for the financial administration of the funds shall be in keeping with those prescribed by the comptroller of the treasury; and
(iv) The remainder of the funds shall be distributed to the state treasurer who shall deposit the funds in the general fund to defray the incarceration costs associated with the offense of identity theft trafficking defined in subsection (c).
(4) For purposes of this subsection (h), a local public agency includes any county or municipal law enforcement agency or commission, the district attorney general, or any department or agency of local government authorized by the attorney general to participate in the investigation.
(5) Funds awarded under this section may not be used to supplement salaries of any public employee or law enforcement officer. Funds awarded under this section may not supplant other local or state funds.
(i) (1) Identity theft as prohibited by subsection (b) is a Class D felony.
(2) Identity theft trafficking as prohibited by subsection (c) is a Class C felony.
[Acts 1999, ch. 57, § 1; 2004, ch. 911, § 1.]