Identity Theft; Personal Records
Exempts disclosure of social security numbers from government payroll records that are public information; restricts retail merchant card issuers from requesting personal information except for credit purposes and from sharing cardholder information. (HB2674 CD1)
HOUSE OF REPRESENTATIVES
TWENTY-SECOND LEGISLATURE, 2004
STATE OF HAWAII
A BILL FOR AN ACT
RELATING TO IDENTITY THEFT.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:
SECTION 1. The 2004 Annual Report of the Federal Trade Commission (FTC) reports that identity theft is the number one consumer complaint, accounting for forty-two per cent of all complaints filed with the FTC in 2003. In 2003, Hawaii ranked twenty-fifth among the states in the number of identity theft victims, with almost fifty-two victims per one hundred thousand population. As many as six hundred forty-nine Hawaii consumers reported complaints about identity theft to the FTC. However, the true number of Hawaii victims may be far more than reported because many victims do not report claims to the FTC.
Hawaii consumers primarily complained about credit or charge card fraud, bank fraud, and phone or utilities fraud. Examples of credit or charge card and bank fraud included establishing new accounts or accessing existing accounts with the victim’s identity. Bank fraud also included theft through electronic fund transfers. Utilities fraud typically involved establishing new accounts, such as wireless telephone accounts, with the victim’s identity. Hawaii consumers also complained about forged government documents, such as driver’s licenses, social security cards, tax returns, and loans obtained with the victim’s identity.
Nearly one third of the victims lived in Honolulu. Most of the remaining victims lived in Kaneohe, Kailua, Mililani, Wahiawa, and Waipahu. About seventy-five per cent of the Hawaii victims are between eighteen to forty-nine years of age.
The legislature finds that identity theft is a serious problem for consumers. The legislature finds that one important step toward protecting consumers from identity theft is by protecting against the use and disclosure of social security numbers. The social security number is a unique identifier that is used in conjunction with other personal information for many purposes, including obtaining credit or loans, opening financial accounts, and even enrolling in school.
The purpose of this Act is to:
(1) Ensure that social security numbers are exempt from disclosure in documents that are otherwise public records; and
(2) Prohibit retail merchant club card issuers from requesting personal identifiers, such as social security numbers, driver's license numbers, and birth dates except in limited circumstances and restricting their use of consumer information.
SECTION 2. The Hawaii Revised Statutes is amended by adding a new chapter to be appropriately designated and to read as follows:
RETAIL MERCHANT CLUB CARDS
§ -1 Definitions. For purposes of this chapter:
"Cardholder" means any consumer to whom a retail merchant club card is issued, and may include all persons holding the club card under the same account.
"Cardholder information" means the cardholder's name, mailing address, electronic mail address, and any unique membership identifiers assigned by the club card issuer to the cardholder for purposes of targeting marketing activities.
"Club card" means any card or device used for the purpose of obtaining access to purchase retail products through membership, for price discounts, or to receive other no-cost benefits provided by the retail merchant. A "club card" is not a credit card, charge card, or check cashing card.
"Club card issuer" means a retail merchant that provides club cards to consumers, and includes a contract information services provider of the retail merchant.
"Marketing purposes" means the categorization of cardholders based on the cardholder’s shopping patterns, spending history, or behavioral characteristics derived from account activity that is provided to an unaffiliated third party for consideration.
"Personal information" means information associated with an actual person that is a name, an address, a telephone number, an electronic mail address, a driver's license number, a social security number, an employer, a place of employment, information related to employment, an employee identification number, a mother's maiden name, an identifying number of a depository account, a bank account number, a password used for accessing information, a taxpayer identification number, health insurance identification number, date of birth, a personal identification number (PIN), a government passport number, credit card number, or any other name, number, or code that is used to access personal financial information about the actual person.
"Retail merchant" means any retailer that sells food, products, or merchandise.
"Unaffiliated third party" means a business that is not under the corporate control or common ownership of the club card issuer or is not a contract information services provider of the retail merchant.
§ -2 Retail merchant club cards; requirements. (a) No club card issuer shall request in a club card application, or require as a condition of obtaining a club card, that the applicant provide any personal information except name, address, and telephone number. If the club card issuer requires a unique identifier to confirm the identity of the applicant, the club card issuer may ask for the last four digits of the applicant's social security number.
(b) No club card issuer may sell or share a cardholder’s name, address, telephone number, or any personal information to any unaffiliated third party except as permitted in this subsection. A club card issuer may share cardholder information for marketing purposes if the club card issuer complies with all the following:
(1) The club card issuer charges an annual fee for the club card and requires the cardholder to renew the club card annually;
(2) The club card issuer allows only cardholders to make purchases and not members of the general public;
(3) The club card issuer provides a written statement to the cardholder upon payment of the annual fee that notifies the cardholder that:
(A) The cardholder information may be shared with other businesses for purposes of marketing information;
(B) Payment of the annual fee means the cardholder has agreed to allow the club card issuer to share cardholder information; and
(C) The cardholder may choose to opt-out from the sharing of cardholder information; and
(4) The club card issuer obtains a written confidentiality agreement from the unaffiliated third party that the shared information will not be transferred to any other entity.
(c) The restrictions of subsection (a) shall not apply when the club card application form is used for the dual purpose of club card membership and establishing privileges for check cashing, check verification, or as a credit application; provided that no club card issuer shall require as a condition of obtaining a club card that the cardholder obtain the club card as an identification card for purposes of check cashing or credit.
(d) Nothing in this section prohibits a club card issuer from including on its club card application form a credit application to a designated credit card company and transmitting the credit application to the credit card company, provided that:
(1) The credit application form is separately identified as an option on the club card application form; and
(2) The credit application clearly discloses that the cardholder is applying for credit with the designated credit card company."
SECTION 3. Section 92F-12, Hawaii Revised Statutes, is amended by amending subsection (a) to read as follows:
"(a) Any other law to the contrary notwithstanding, each agency shall make available for public inspection and duplication during regular business hours:
(1) Rules of procedure, substantive rules of general applicability, statements of general policy, and interpretations of general applicability adopted by the agency;
(2) Final opinions, including concurring and dissenting opinions, as well as orders made in the adjudication of cases;
(3) Government purchasing information, including all bid results, except to the extent prohibited by section 92F-13;
(4) Pardons and commutations, as well as directory information concerning an individual's presence at any correctional facility;
(5) Land ownership, transfer, and lien records, including real property tax information and leases of state land;
(6) Results of environmental tests;
(7) Minutes of all agency meetings required by law to be public;
(8) Name, address, and occupation of any person borrowing funds from a state or county loan program, and the amount, purpose, and current status of the loan;
(9) Certified payroll records on public works contracts[
;] except that social security numbers of individuals shall not be disclosed;
(10) Regarding contract hires and consultants employed by agencies:
the] The contract itself, the amount of compensation[ ,];
the] The duration of the contract[ ,]; and
the] The objectives of the contract;
(11) Building permit information within the control of the agency;
(12) Water service consumption data maintained by the boards of water supply;
(13) Rosters of persons holding licenses or permits granted by an agency that may include name, business address, type of license held, and status of the license;
(14) The name, compensation (but only the salary range for employees covered by or included in chapter 76, and sections 302A-602 to 302A-640, and 302A-701, or bargaining unit (8)), job title, business address, business telephone number, job description, education and training background, previous work experience, dates of first and last employment, position number, type of appointment, service computation date, occupational group or class code, bargaining unit code, employing agency name and code, department, division, branch, office, section, unit, and island of employment, of present or former officers or employees of the agency; provided that this paragraph shall not require the creation of a roster of employees; and provided further that this paragraph shall not apply to information regarding present or former employees involved in an undercover capacity in a law enforcement agency;
(15) Information collected and maintained for the purpose of making information available to the general public; and
(16) Information contained in or compiled from a transcript, minutes, report, or summary of a proceeding open to the public."
SECTION 4. Section 92F-14, Hawaii Revised Statutes, is amended by amending subsection (b) to read as follows:
"(b) The following are examples of information in which the individual has a significant privacy interest:
(1) Information relating to medical, psychiatric, or psychological history, diagnosis, condition, treatment, or evaluation, other than directory information while an individual is present at such facility;
(2) Information identifiable as part of an investigation into a possible violation of criminal law, except to the extent that disclosure is necessary to prosecute the violation or to continue the investigation;
(3) Information relating to eligibility for social services or welfare benefits or to the determination of benefit levels;
(4) Information in an agency's personnel file, or applications, nominations, recommendations, or proposals for public employment or appointment to a governmental position, except:
(A) Information disclosed under section 92F-12(a)(14); and
(B) The following information related to employment misconduct that results in an employee's suspension or discharge:
(i) The name of the employee;
(ii) The nature of the employment related misconduct;
(iii) The agency's summary of the allegations of misconduct;
(iv) Findings of fact and conclusions of law; and
(v) The disciplinary action taken by the agency;
when the following has occurred: the highest non-judicial grievance adjustment procedure timely invoked by the employee or the employee's representative has concluded; a written decision sustaining the suspension or discharge has been issued after this procedure; and thirty calendar days have elapsed following the issuance of the decision; provided that this subparagraph shall not apply to a county police department officer except in a case which results in the discharge of the officer;
(5) Information relating to an individual's nongovernmental employment history except as necessary to demonstrate compliance with requirements for a particular government position;
(6) Information describing an individual's finances, income, assets, liabilities, net worth, bank balances, financial history or activities, or creditworthiness;
(7) Information compiled as part of an inquiry into an individual's fitness to be granted or to retain a license, except:
(A) The record of any proceeding resulting in the discipline of a licensee and the grounds for discipline;
(B) Information on the current place of employment and required insurance coverages of licensees; and
(C) The record of complaints including all dispositions; [
(8) Information comprising a personal recommendation or evaluation[
(9) Social security numbers."
SECTION 5. Statutory material to be repealed is bracketed and stricken. New statutory material is underscored.
SECTION 6. This Act shall take effect upon its approval; except that section 2 shall take effect on July 1, 2005.