Protect Identity Theft Victims

Section 1. Section 393-b of the general business law, as added by chapter 433 of the laws of 2005, is amended to read as follows:

§ 393-b. [Written solicitation] Credit card protection services. 1. [Any written] For the purposes of this section:

(a) "Clearly and prominently" means: (i) in written communications, including print and those made through an electronic medium (such as video and interactive media including, but not limited to, the Internet, online services, and electronic mail) the message shall be in a type size sufficiently noticeable for an ordinary consumer to read and comprehend it, in type that contrasts with the background against which it appears; and (ii) in oral communications, the message shall be delivered in a volume and cadence sufficient for an ordinary consumer to hear it and comprehend it. If any communication is presented solely through oral, written, or visual means, the message shall be made through the same means. Regardless of the medium used to disseminate it, the message shall be in understandable language and syntax. Nothing contrary to, inconsistent with, or in mitigation of the message shall be used in any communication.

(b) "Credit card protection service" means a service to protect, indemnify, or reimburse the credit card holder against the loss or misuse of the credit card. Such term shall include, but not be limited to, services that offer to obtain access to credit reports, provide an explanation of credit entries on the report, identify those entities that have accessed the report, and provide credit card protection security services.

EXPLANATION--Matter in italics (underscored) is new; matter in brackets

[ ] is old law to be omitted.

LBD03183-01-7

A. 5242 2

2. In any solicitation to enter into an agreement for various credit card protection services the entity offering such services shall clearly and prominently:

(a) disclose that the purchase of credit card protection services or the renewal thereof is not required for a consumer to secure or retain his or her credit card; and

(b) by means of a concise statement [regarding] inform the consumer of his or her rights that already exist free of charge under the "Fair Credit Billing Act" and the regulations thereunder, as such acts and regulations may from time to time be amended. [A credit card protection service means a service to protect, indemnify, or reimburse the credit card holder against the loss or misuse of the credit card. Such term shall include services provided along with credit card protection services for the same price, including, but not be limited to, access to credit reports, an explanation of credit entries on the report, the identification of those who have accessed the report, and insurance and security services.] No agreement for credit card protection services shall provide that services will be automatically renewed on an annual basis and the consumer billed, unless the consumer in the expiring agreement is notified not more than sixty days and not less than fifteen days prior to the termination of the existing agreement by mail of the credit protection service provider's intention to automatically renew the agreement.

[2.] 3. Whenever there shall be a violation of this section, application may be made by the attorney general in the name of the people of the state of New York to a court or justice having jurisdiction by a special proceeding to issue an injunction, and upon notice to the defendant of not less than five days, to enjoin and restrain the continuance of such violations; and if it shall appear to the satisfaction of the court or justice that the defendant has, in fact, violated this section, an injunction may be issued by such court or justice, enjoining and restraining any further violation, without requiring proof that any person has, in fact, been injured or damaged thereby. In any such proceeding, the court may make allowances to the attorney general as provided in paragraph six of subdivision (a) of section eighty-three hundred three of the civil practice law and rules, and direct restitution. Whenever the court shall determine that a violation of this section has occurred, the court may impose a civil penalty of not more than one thousand dollars for each violation. In connection with any such proposed application, the attorney general is authorized to take proof and make a determination of the relevant facts and to issue subpoenas in accordance with the civil practice law and rules.

§ 2. The general business law is amended by adding a new section 393- bb to read as follows:

§ 393-bb. Identity theft protection services. 1. For the purposes of this section:

(a) "Clearly and prominently" means: (i) in written communications, including print and those made through an electronic medium (such as video and interactive media including, but not limited to, the Internet, online services, and electronic mail) the message shall be in a type size sufficiently noticeable for an ordinary consumer to read and comprehend it, in type that contrasts with the background against which it appears; and (ii) in oral communications, the message shall be delivered in a volume and cadence sufficient for an ordinary consumer to hear it and comprehend it. If any communication is presented solely through oral, written, or visual means, the message shall be made through the

A. 5242 3

same means. Regardless of the medium used to disseminate it, the message shall be in understandable language and syntax. Nothing contrary to, inconsistent with, or in mitigation of the message shall be used in any communication.

(b) "Identity theft protection service" means a service marketed, described and sold as a service to protect a consumer from identity theft. Such term shall include, but not be limited to, services that:

(i) notify consumers when new credit is opened in his or her name;

(ii) monitor the consumer's credit report for any changes that may indicate fraudulent activity and notify the consumer of such activity;

(iii) provide the identification of those who have obtained access to the consumer's credit report;

(iv) place, renew, or update fraud alerts or security freezes; or

(v) assist consumers by obtaining a limited power of attorney from the consumer. Such term shall not include identity theft group insurance policies issued pursuant to section three thousand four hundred fiftyone of the insurance law.

2. (a) In any solicitation to enter into an agreement for identity theft protection services the entity offering such services shall clearly and prominently, by means of a concise statement, inform the consumer of his or her rights that already exist free of charge under the federal fair credit reporting act and the regulations thereunder and article twenty-five of this chapter, as such acts and regulations may from time to time be amended.

(b) No agreement for identity theft protection services shall provide that services will be automatically renewed on an annual basis and the consumer billed, unless the consumer in the expiring agreement is notified not more than sixty days and not less than fifteen days prior to the termination of the existing agreement by mail of the identity theft protection service provider's intention to automatically renew the agreement.

3. Whenever there shall be a violation of this section, application may be made by the attorney general in the name of the people of the state of New York to a court or justice having jurisdiction by a special proceeding to issue an injunction, and upon notice to the defendant of not less than five days, to enjoin and restrain the continuance of such violations; and if it shall appear to the satisfaction of the court or justice that the defendant has, in fact, violated this section, an injunction may be issued by such court or justice, enjoining and restraining any further violation, without requiring proof that any person has, in fact, been injured or damaged thereby. In any such proceeding, the court may make allowances to the attorney general as provided in paragraph six of subdivision (a) of section eighty-three hundred three of the civil practice law and rules, and direct restitution. Whenever the court shall determine that a violation of this section has occurred, the court may impose a civil penalty of not more than one thousand dollars for each violation. In connection with any such proposed application, the attorney general is authorized to take proof and make a determination of the relevant facts and to issue subpoenas in accordance with the civil practice law and rules.

§ 3. This act shall take effect on the ninetieth day after it shall have become a law; provided, however that effective immediately, the addition, amendment and/or repeal of any rule or regulation necessary for the implementation of this act on its effective date are authorized and directed to be made and completed on or before such effective date.