Illinois second state in the nation to require companies to notify consumers of security breaches         

New laws protect Illinois consumers from identity theft

[JUNE 20, 2005]  SPRINGFIELD -- After several high-profile financial information security breaches across the nation, Gov. Rod Blagojevich signed several pieces of legislation Thursday designed to safeguard consumers against identity theft. The bills the governor signed not only place more stringent regulations on businesses, requiring them to quickly notify consumers of possible security breaches, but also increase the penalties against identity thieves and provide victims with the resources necessary to protect themselves from future violation. The cornerstone of the package, House Bill 1633, makes Illinois the second state in the nation to require companies to quickly notify consumers in the state if their personal information is compromised due to a breach in company security.

"These new laws will provide consumers some peace of mind and protection from the fastest growing crime in the country -- identity theft," the governor said. "Last year alone, identity thieves cost consumers $550 million. One of the best ways we can protect consumers is to require companies to notify customers quickly when their records have been compromised. These laws can help individuals take steps to protect their assets and identities before thieves wreak havoc on their credit."

The governor and Attorney General Lisa Madigan worked closely with the Illinois Public Interest Research Group and state legislators to create the Personal Information Protection Act. Sponsored by Rep. John Fritchey, D-Chicago, in the House and Sen. Ira Silverstein, D-Chicago, in the Senate, the new law requires any entity that collects personal data to notify those consumers affected by a breach in security without delay.

"ID theft is a crime that plagues consumers and their credit records," Madigan said. "With all of the recent security breaches, it is critical that consumers are informed when their personal information may be compromised. With the knowledge that sensitive personal information has been breached, consumers can act quickly to stop or minimize damage to their credit history. This legislation gives consumers the power to protect themselves from a crime that can cost a great deal of time, money and peace of mind."

House Bill 1633 came in response to an October 2004 incident in which Georgia-based ChoicePoint sold the personal information of more than 145,000 people, including 5,000 Illinoisans, to identity thieves who pretended to be legitimate businesses. Even though officials at ChoicePoint were aware of the breach, consumers weren't notified of the situation until months later, when officials -- prompted by an existing California law requiring the disclosure of any security breach which puts Californians' personal information at risk -- revealed the information. Other massive security breaches have earned attention recently: Financial information for roughly 1.5 million DSW Shoe Warehouse customers was compromised in April; tapes containing information about 3.9 million CitiFinancial customers were reported missing earlier this month; and Motorola disclosed that computers were stolen that contained the Social Security numbers of potentially thousands of employees.

"Over 9 million people had their information stolen or misplaced this year," said John Gaudette, consumer advocate with the Illinois Public Interest Research Group. "The Breach Notification Act will force companies to take more responsibility in protecting our personal information."

"It can take years for a person to undo the damage caused by identity theft," said Fritchey, the House sponsor. "This new law will help ensure that consumers get the information they need to prevent them from becoming victims in the first place."

"The actions of identity thieves against consumers is deplorable, and that is why the state legislature had to take matters into its own hands -- to protect the hardworking people of Illinois from being taken advantage of," said Silverstein, the Senate sponsor. "I applaud Governor Blagojevich for taking this critical step to further protect our citizens."

House Bill 1633 becomes effective immediately.

Gov. Blagojevich will also sign House Bill 1058 when it reaches his desk. Sponsored by Rep. Marlow Colvin, D-Chicago, and Sen. Mattie Hunter, D-Chicago, the law allows people who have been victims of identity theft to place a security freeze on their credit report, preventing the release of the report to any party without their consent. This legislation also acts to prevent a thief from opening additional credit card accounts with the person's information and from changing crucial information in the credit report -- such as a person's name, date of birth, Social Security number or address -- without the consumer being notified in writing by the credit reporting agency within 30 days of the change.

"When something like this happens -- whether someone steals your wallet, breaks into your home or fraudulently obtains your information for their personal use -- you feel violated," said Colvin, the House sponsor. "This legislation attempts to restore power to the consumer, so that they can regain financial solvency."

"This legislation further protects consumers from becoming victims of identity theft," said Hunter, the Senate sponsor. "As a consumer myself, I understand how critical this legislation is to preventing unauthorized persons from obtaining the personal information of unsuspecting consumers."

The governor also signed a number of other consumer protection bills into law on Thursday:

Senate Bill 1799, sponsored by Sen. Peter J. Roskam, R-Wheaton, and Rep. Sidney H. Mathias, R-Arlington Heights, requires the Department of Revenue to notify a taxpayer directly if the department suspects another person has used the taxpayer's Social Security number to register a business or pay taxes and fees. The bill becomes effective Jan. 1, 2006.

The Department of Revenue continues to be an integral part of the governor's identity theft initiative. Recently, the agency adopted a number of new measures to protect citizens' personal information, including changing the configuration of its mailings to better conceal Social Security numbers. Data security is a top concern as new e-filing applications are developed, and the department uses the latest encryption and security technology to maintain strict confidentiality standards for taxpayer financial information.

Senate Bill 123, sponsored by Sen. Todd Sieben, R-Geneseo, and Rep. Bill Black, R-Danville, requires the Illinois Department of Natural Resources to phase in new Conservation ID numbers to replace Social Security numbers on hunting and fishing licenses as applicants renew. This change will be a part of the department's new automated licensing system as it is phased in over the next year. The law requires the department to keep a record of the Social Security number on file, although that number will not appear on the license.

House Bill 2696, sponsored by Rep. Ruth Munson, R-Elgin, and Sen. Pamela J. Althoff, R-Crystal Lake, prohibits businesses from denying a person credit or utility services or increasing a person's credit limits based solely on their status as an identity theft victim. The law is effective immediately.

House Bill 2697, sponsored by Rep. Sandra M. Pihos, R-Glen Ellyn, and Sen. Carole Pankau, R-Bloomingdale, categorizes as a Class A misdemeanor the unauthorized copying and transmitting of any financial transaction devices, including credit and debit cards or other devices used to make a payment, get cash or make a deposit. This law is effective immediately.

House Bill 2699, sponsored by Rep. Ruth Munson, R-Elgin, and Sen. Edward D. Maloney, D-Chicago, increases the penalties by one felony class for identity theft and aggravated identity theft crimes. This legislation also increases the penalties against people who steal the identities of more than three victims. This law is effective immediately.

Identity theft has become the fastest growing crime in the country. According to the Federal Trade Commission, last year alone identity theft and consumer fraud cost Americans nearly $550 million, a $12 million increase from 2003. On average, victims will spend an average of 600 hours and $1,500 repairing their credit.

The Illinois Public Interest Research Group recently identified several ways consumers can protect their personal information, and therefore, better protect themselves against identity theft:

• Obtain a free credit report and look for and report any inconsistent information.
• Properly dispose of bills, monthly statements, credit offers and convenience checks.
• Never give out account numbers or Social Security numbers to strangers.
• Never write your Social Security number on checks or use the number as a password.
• Make sure your full credit card number or expiration date does not appear on receipts.
• Do not respond to e-mails asking for personal information (example: bank info update).

"Now that the General Assembly has passed these important tools for fighting identity theft, Illinois consumers must play an active role in the protection of their credit," said Gaudette, from the Illinois Public Interest Research Group. "Every Illinois consumer should know where to get your free credit report, how to review your credit report and what to do when you become a victim of identity theft."

In accordance with federal legislation, Illinois residents are able to obtain a free annual credit report from each of the three major credit reporting agencies. For more information on obtaining a free credit report, visit www.annualcreditreport.com or call 1 [phone].

[News release from the governor's office]