Identity Theft 2007

On Tuesday, May 7, 2007 the Joint Consumer Protection and Professional Licensure Committee passed a comprehensive identity theft protection bill. We applaud the leadership of House Chairman Michael Rodrigues and the members of the committee for moving forward a bill with numerous strong consumer protections. We also appreciate the great work of Representatives William Straus and Michael Costello on this legislation.

This bill will reduce identity theft by establishing the following provisions:

Breach Notification—requires commercial entities and government agencies to notify affected consumers if enough of their personal information to commit identity theft has been acquired by an unauthorized person or for an unauthorized purpose.
Credit Report Security Freeze—enables consumers to “lock” their credit report, preventing would be ID thieves from taking out credit in their name.
Disposal of Personal Information—sets minimum standard for disposing data that contains enough personal information about a consumer that it could be used to commit identity theft.
Police Reports—allows victims of ID theft to get a copy of their police report from any law enforcement office, even if crime did not occur in that jurisdiction (in a different city or state). Victims need a copy of their police report to clean up the financial mess resulting from identity theft and to qualify for a free security freeze.

While the bill includes strong language in some of these sections, is should be improved in the following ways to better protect consumers in Massachusetts from identity theft.

Eliminate the $10 fees per credit bureau to place and lift the security freeze.  Indiana recently passed a law making the freeze free, New Jersey has it free to place and only $5 to lift, and numerous states only charge $5 to both lift and place.

2 Make the lifting of the security freeze occur fast—within 15 minutes—so consumers with a security freeze can take advantage of credit offers. Several states including New Jersey, New York, Utah, Wyoming, North Dakota, West Virginia, New Mexico, Montana, Maryland, Indiana, Minnesota and Delaware already require this.

3 Tighten up the definition of the “security freeze” to include a consumer’s credit score, which can often be used to issue credit.

We urge you to support these improvements, which Rep. Straus and Rep. Costello will introduce. Please feel free to contact me with any questions or comments about the bill.

Sincerely,

Eric Bourassa
Consumer Advocate

Comments

[rebecca rabinowitz]

Jarrett,

Will you keep this blog after you change jobs? Would you be able to blog about health care from your new position? Or would that be unkosher?

A fan (and current constituent),
Rebecca Rabinowitz

[Flynn]

This is great, but the credit bureaus are still making freezes as hard to get as they can. For someone who doesn't use credit, and who is reluctant to share personal information with organizations who have no business having it, the large amount of information the bureaus demand is a strong disincentive to get a freeze. For example, here are part of the instructions Experian gives for getting a freeze:

"Requests [for security freezes] must include all of the following: full name, with middle initial and generation, such as JR, SR, II, III, etc.; Social Security number; date of birth (month/date/year); current address; and previous addresses for the past two years. In addition, enclose one copy of a government issued identification card, such as a driver’s license, state ID card, military ID card, etc., and one copy of a utility bill, bank or insurance statement, etc., and make sure that each copy is legible (enlarge if necessary), displays your name and current mailing address, and the date of issue. . ."

It would be nice if legislation also limited the amount of data a bureau may request for enacting a freeze. Since the credit bureaus don't have a good understanding of data security, I would never want to give any of them all this data.

I think it's very unlikely that people getting freezes for _other_ people would be a big problem; I think the bureaus just want to collect as much information about people as they can, even if that data is irrelevant, because data and more data is where they see their revenue coming from.

In particular, they are in effect demanding a photo, which is something they didn't necessarily have before.

I understand the number of people who have gotten credit freezes in California for example, is rather small; I would say it's because of the high data bar imposed by the credit bureaus.