Senator Unveils New Steps To Protect Consumers And Private Financial Data

SCHUMER REVEALS NUMBER OF IDENTITY THEFT VICTIMS IN EACH UPSTATE NY COUNTY, COSTING MILLIONS - SENATOR UNVEILS NEW STEPS TO PROTECT CONSUMERS AND PRIVATE FINANCIAL DATA

Senator: 21,000 Consumers in Capital Region Have Had Their Identity Stolen; Central NY 16,000; Rochester/Finger Lakes 29,000; Hudson Valley 72,000; North Country 8,000; Southern Tier 8,960; Western NY 32,000

In Light of Recent Data Security Breaches, Schumer Calls on Companies To Undergo Internal Voluntary Reviews of Data Security Procedures

At Senate Commerce Committee Hearing, Schumer To Urge FTC To Immediately Implement Measures Until Schumer-Nelson Legislation Becomes Law

On the heels of new identity theft breaches, U.S. Senator Charles E. Schumer today unveil a new report showing approximately 187,000 New Yorkers have been victims of identity theft last year, costing consumers a total of $93 million to repair. Schumer, who recently introduced a comprehensive ID Theft Prevention Bill, will be testifying at Thursday's Senate Commerce Committee hearing on identify theft urged the Federal Trade Commission (FTC) to immediately implement several stop gap provisions until Schumer's bill becomes law.

"What bank robbery was to the Depression Age, identity theft is to the Information Age," Schumer said. "Identity theft has become so pervasive and so out-of-hand, that we must make a real effort to prevent it before it happens."

Today, Schumer today announced new momentum for his ID Theft Prevention bill. He called on the FTC to immediately implement provisions from his ID Theft Prevention Bill, including measures that would crate an office of identity theft, coordinate international action against identity theft, and study government usage of social security numbers. Until the bill becomes law, Schumer asked the FTC to act aggressively to ensure as many consumers as possible are protected and private financial data is secure.

Schumer will be testifying at Thursday's Senate Commerce Committee hearing on identity theft, and will publicly urge companies to undergo voluntary reviews of data security procedures to prevent any future breaches. Schumer will be joined by the Chair of the Federal Trade Commission, Honorable Deborah Majoras; President of National Association of Attorney Generals, Honorable William Sorrell; and several FTC Commissioners.

In light of recent security breaches, Schumer will add a new provision to his ID theft bill, which would specifically allow the FTC to require standards of transport for both first-party and third-party transportation of sensitive personal information. Under the bill, fines could be levied on those who violate the security standards of sensitive personal information, including courier businesses and organizations.

Schumer released a new study today showing that 187,000 upstate New Yorkers suffered identify theft over the past year. Specifically, Schumer's report found that:

• Over the past year, approximately 20,720 consumers in the Capital Region have experienced identity theft;
• Over the past year, approximately 16,160 consumers in Central New York have experienced identity theft;
• Over the past year, approximately 29,400 consumers in the Rochester/Finger Lakes area have experienced identity theft;
• Over the past year, approximately 71,640 consumers in the Hudson Valley have experienced identity theft;
• Over the past year, approximately 8,200 consumers in the North Country have experienced identity theft;
• Over the past year, approximately 8,960 consumers in Southern Tier have experienced identity theft;
• Over the past year, approximately 32,000 consumers in Western New York have experienced identity theft;

Schumer's ID Theft Prevention bill, introduced with Senator Bill Nelson (D-FL) is the most comprehensive effort to really prevent ID theft, not just punish those who commit ID theft. The Schumer-Nelson bill would:

• Create FTC Office of Identity Theft to help the millions of victims of ID theft each year to get their identity back through an easily accessible website, toll free phone number and consumer-service teams, and authorizes $60 million a year, for five years for this office.

• Regulate data merchants (akin to regulation of credit bureaus) by:
- Make them register with the FTC;
- Institute safeguards to prevent fraudulent access by unauthorized parties;
- Develop authentication process for their customers with individualized passwords;
- Users allowed these passwords are people who have passed a reasonably effective background check;
- Data Merchant should track who accessed what records and for what lawful purpose they were accessed;
- Allow consumers, like with their credit reports, to obtain reports showing which data-merchants have their information and mandates a correction process to fix errors;
- Demands accuracy standards for their information;
- Regulates Credit Bureaus only if, and as far as, they sell credit header information currently unregulated by the Fair Credit Reporting Act and its amendments.

• Disclosure Box: Any company that is collecting your sensitive personal information and plans to sell or transfer your information to an unaffiliated third party, must put a "Disclosure Box" on it, which lets the consumer know in PLAIN ENGLISH that "this information may be sold or given to an unaffiliated third party without your additional consent."

• Notification provisions in the case of an information breach are very similar to current California law (the law that forced ChoicePoint to notify consumers). But there is a new provision, allowing any consumer who is notified of a breach of their information to request, in writing, that their information be completely expunged from the company's database.

• Every company required to take "Reasonable Steps" to protect sensitive personal information they are storing.

• Social Security Number Specific Provisions:
- Prohibits any company from asking for a Social Security number unless they actually need it in
the normal course of business;
- Prohibits SSN's displayed on employee IDs and prohibits inmates in prison from having any access to them as part of their prison jobs;
- Bans SSN purchase and sale, except for law enforcement, national security and fraud purposes;
- Grants U.S. Attorney General the ability to further define the exemptions as situations arise and exempt more if needed.

• Would also require the FTC to:
- Study national, state and local governments' public postings of Social Security numbers, come up with recommendations and forward them on to the relevant national, state and local governments;
- Require a thorough annual report each year on ID theft;
- For each section there's a maximum penalty, usually $1,000 per individual record per violation, which can be administered by the FTC or Attorneys General.
- Study international identity theft and determine ways to combat it;
- Create a blue-ribbon working group representing both industry and consumer groups to find the
best ways for private entities to protect consumer data;

• Stop public postings of private financial account numbers (i.e. mutual fund companies posting shareholder information on Internet).

• Preempts state law to the extent that it is inconsistent with the provisions of this bill and then only to the extent of the inconsistency. If the statute offers greater consumer protections than this bill, it shall not be preempted by this bill.

• Create an Assistant Secretary for Cyber Security in the Department of Homeland Security, which is what an earlier Schumer amendment to the 9-11 bill and a bi-partisan house bill in the 108th would have done.

http://schumer.senate.gov/SchumerWebsite/pressroom/pr-latest_news.html