1. Statutory authority:

New York Executive Law § 91 authorizes the Secretary of State to: “adopt and promulgate such rules which shall regulate and control the exercise of the powers of the department of state.” Additional authority is set forth in Executive Law § 94(6), which authorizes the Secretary of State to “implement other powers and duties by regulation,” and Executive Law § 94(9)(i) which authorizes the Secretary of State to “promulgate rules and regulations to administer the identity theft prevention and mitigation program.”

2. Legislative objectives:

Chapter 62 of the Laws of 2011 consolidated the Consumer Protection Board within the Department of State as a division under the supervision of the Secretary of State. Section 94-a of the Executive Law provides the Division of Consumer Protection with general authority to act in the interests of consumers “in order to protect the people of New York state from economic harm.” The Division has long been concerned with the psychologically destructive and economically catastrophic effects of identity theft. It has engaged in public education and outreach, represented the interests of identity theft victims and acted as liaison between them and other entities, both governmental and private. These rules would augment such efforts by establishing an “identity theft prevention and mitigation program (Program).” Among other things, the Program sets forth complaint procedures for consumers and provides for the timely flow of information and assistance critical to consumers exposed to identity theft.

In order to steal an individual’s identity, the criminal must acquire the victim’s personal information. Of great value is the victim’s financial information and credit history, which provides the criminal with a roadmap for the looting of the victim’s wealth. Such information is aggregated, maintained and analyzed by Consumer Credit Reporting Agencies (CCRAs), which provide “consumer credit reports” to entities doing business with consumers. Consumers seeking to obtain such things as mortgages, apartment rentals, and loans must consent to such “credit check” or go without. It is critical to the economic health of all that such information be maintained in the strictest confidence and used only for its intended purpose. Unfortunately, recent events have shown that such is not the case. The massive data breach experienced by Equifax, a large CCRA, has exposed millions of New Yorkers to fraud and economic ruin. The “theft” of these individual’s identities begins with such breach. Equifax (and other such entities experiencing data breaches) is under an obligation to consumers to provide timely information concerning the status of their credit histories, what is being done to protect them and how they can protect themselves. These rules include mechanisms to facilitate the provision of such information and assistance by: 1) clarifying the status of a “victim of identity theft” as inclusive of an individual who has been victimized by a security breach; 2) requiring, among other things, the filing of a form with the Division that CCRAs establish and notify the Division of a point of contact for Division inquiry and fact finding, and for such point of contact to be available for such dialogue for general matters during regular business hours and within 24 hours in event of a notification of a security breach, and 3) the disclosure to the Division and consumers of proprietary and other products offered by the CCRA to consumers for the prevention of identity theft, with information as to the fees and contractual provisions associated therewith. Such information will better enable consumers to make informed choices as to what credit monitoring or protection product is suitable for them.

The Secretary of State, empowered to issue these regulations to safeguard the interests of consumers and the public, generally, finds that the ready availability of information and assistance to victims of identity theft and security breaches is critical to their efforts to avoid the potentially devastating consequences of identity theft.

3. Needs and benefits:

The rulemaking, establishing the Identity Theft Prevention and Mitigation Program, facilitates the timely provision of information and assistance by Consumer Credit Reporting Agencies to victims of identity theft and security breaches and the Division of Consumer Protection. The timely provision of such information and assistance will better enable individuals to protect themselves from fraud and financial devastation.

4. Costs:

a. Costs to regulated parties:

The cost to CCRAs to comply with this rule will be nominal.

b. Costs to the Department of State, the State, and Local Governments:

The Department does not anticipate any additional costs to implement the rule.

5. Local government mandates:

The rule does not impose any program, service, duty or responsibility upon any county, city, town, village, school district or other special district.

6. Paperwork:

The rule requires CCRAs to file a form with the Division. It is anticipated that such form will be short and will not require significant resources to complete.

7. Duplication:

The Department currently educates and assists the public with regard to identity theft and mediates on behalf of victims of identity theft. However, the Division has found that the timely provision of necessary information and assistance to such victims is of critical importance to their efforts to protect themselves from, or mitigate the impacts of, the theft. These rules facilitate such timely provision.

8. Alternatives:

The Department considered not proposing the instant rulemaking. However, this rule is needed to provide a clear path for consumers to acquire information and assistance necessary in the wake of a security breach and to better enable the Division to provide support to victims of identity theft.

9. Federal standards:

The proposed amendments do not exceed any minimum standards of the federal government for the same or similar subject areas.

10. Compliance schedule:

Immediate upon adoption.

The rule imposes neither an adverse economic impact on small businesses or local governments; nor reporting, recordkeeping or other compliance requirement on small businesses or local governments.

The massive data breach experienced by Equifax, a large Consumer Credit Reporting Agency, has exposed millions of New Yorkers to fraud and economic ruin. The “theft” of these individual’s identities begins with such breach. Equifax (and other such entities experiencing data breaches) is under an obligation to consumers to provide timely information concerning the status of their credit histories, what is being done to protect them and how they can protect themselves. This rules includes mechanisms to facilitate the provision of such information and assistance.

Comments will be received and entertained during the public comment period associated with the Proposed Rulemaking.

This rule imposes neither an adverse impact on rural areas; nor reporting, recordkeeping or other compliance requirements on public or private entities in rural areas.

The rule will apply to Consumer Credit Reporting Agencies (CCRAs) which provide services across the state, but are not primarily located in rural areas. This rule requires among other things, that: CCRAs establish and notify the Division of a point of contact for Division inquiry and fact finding, such point of contact be available for such dialogue for general matters during regular business hours and within 24 hours in event of a notification of a security breach, and disclosure be provided to the Division and consumers of proprietary products offered by the CCRA to consumers for the prevention of identity theft, with information as to the fees and contractual provisions associated therewith. It is anticipated that the costs associated with such requirements will be insubstantial.

Comments will be received and entertained during the public comment period associated with the Proposed Rulemaking.

It is apparent from the nature and purposes of this rule that it will not have a substantial adverse impact on jobs or employment opportunities.

This rule will primarily apply to three large Consumer Credit Reporting Agencies (CCRAs).

The rule will require, among other things, that (CCRAs): establish and notify the Division of a point of contact for Division inquiry and fact finding, ensure such point of contact be available for such dialogue for general matters during regular business hours and within 24 hours in event of a notification of a security breach, and provide disclosure to the Division and consumers of proprietary products offered by the CCRA to consumers for the prevention of identity theft, with information as to the fees and contractual provisions associated therewith. It is anticipated that such requirements would have little to no impact on jobs.

Comments will be received and entertained during the public comment period associated with the Proposed Rulemaking.