Lindstrom Testifies For Increased ID Theft Protections
Consumers, Business and Government Urged to Step-Up Prevention and Response
Lindstrom pointed to the recent breach of Rhode Island's state website, which allowed hackers in Russia to potentially access up to 53,000 credit card numbers as an example where greater accountability and response is needed. She urged legislative approval of House Bill 4061, Governor Romney's proposal that provides for enhanced penalties and consumer protections against identity theft.
"Consumers are learning that their credit card numbers could have been vulnerable a whole month after the incident in Rhode Island. People need to be able to react quickly if their information is out there. We've proposed notification to customers by businesses and organizations within ten days of detecting a breach," said Director Lindstrom.
Referencing the mistaken release of subscriber account information with The Boston Globe's newspaper distribution and the headline story today in which patient information may have repeatedly been sent to the wrong business fax despite several warnings, Lindstrom said, "This should be a lesson to all businesses and government, that the time to set-up internal controls is before customers' financial information is lost, stolen or mistakenly made public."
Director Lindstrom testified to the need for the consumer protection provisions in the Governor's bill, which in addition to the ten-day notification requirement include:
- Allowing consumers to place a security alert on their credit reports for 90 days, which would require credit bureaus to notify credit history requesters that a consumer's identity may have been used without authorization. The credit history requester would then be required to verify the identity of a credit applicant before issuing a line of credit;
- Allowing consumers to freeze access to their credit reports within 3 days and deny access to those reports until a consumer rescinds the request. While credit reports are frozen, credit history requesters would need authorization from consumers to view their credit reports. Any changes made to a frozen credit report must be reported to the consumer within 30 days;
- Requiring credit reporting agencies to provide consumers with notice of their rights under this new law.
Members of the Massachusetts State Police testified to the proposed enhancement of criminal penalties for identity theft crimes and closing of loopholes within existing identity theft laws. The provisions proposed would:
- Add seven felony crimes to the identify theft laws;
- Mandate imprisonment of 10-20 years and a fine of up to $30,000 or both for identity theft convictions found to further any major crime, such as a terrorist act;
- Close loopholes in existing law that prevents police and prosecutors from punishing offenders who use false identification to obtain a driver's licenses;
- Include ATM cards in the definition of something of "value" under the existing law.
Director Lindstrom also testified that consumers must continue to be "the first line of defense" and urged that they take advantage of their right to review their credit reports for free annually, but reiterated that government and business have an obligation to its citizens and customers.
"My office and our regulatory agencies are developing best practices for the use and security of our licensees' personal identifying information. Government has an obligation to take the lead in this area and our expectation is that the best practices should also be implemented by all businesses that house consumers' financial information," said Lindstrom.