Source: https://llrx.com/2006/02/features-identity-theft-outline-of-federal-statutes-and-bibliography-of-select-resources/?share=google-plus-1
Timestamp: 2019-04-20 01:48:10+00:00

Document:
Identity theft is an increasingly common crime in which a criminal obtains a victim’s Personal Identifying Information (PII) to commit fraud or other crimes. The daily news is full of these stories, ranging from anecdotal tales of an individuals’ stolen identity to lapses in security surrounding sensitive consumer data.
Researching the topic can be a daunting task. Indeed, the recent proliferation of materials, along with the fact that case law is growing exponentially, means that there is a rather large body of literature. In addition, the actual act of identity theft is dynamic and constantly evolving, thus any technical materials are being continually revised.
The following bibliography outlines the pertinent federal statutes and resources for researching Identity Theft. Included is a list of newsletters and blogs that can be used to keep abreast of new developments, such as a bill introduction or a major security breach.
A wide range of federal laws relate to identity theft. Laws can be grouped into four main categories: Identity theft specific laws, false identification laws, privacy and personal data laws, and credit law. Identity theft specific laws are those that were designed and enacted to criminalize the act of identity theft. False Identification laws deal specifically with fraud in connection with personal identifying documents. Privacy and personal data laws can help prevent identity theft by regulating how personal identifying information (PII) is collected and disseminated. Laws regarding credit directly impact victims of identity theft, as those individuals must restore their credit ratings and limit their liability for unauthorized debts. In particular, the following statutes are frequently cited in the literature regarding identity theft.
The Identity Theft Penalty Enhancement Act, passed in July 2004, established penalties for aggravated identity theft. This includes instances when identity theft has been used as one step in a process of more serious crimes, such as terrorist acts, immigration violations, and firearms offenses. The Act directs the U.S. Sentencing Commission to amend the Federal sentencing guidelines so that individuals who gain access to the information used to commit identity theft at their place of employment face increased penalties. The amendments set fourth by the United States Sentencing Commission, implementing sections 2 and 5 of the Identity Theft Penalty Enhancement Act were published in the May 11, 2005 Federal Register. The Fair and Accurate Credit Transactions Act of 2003.
117 Stat. 1952, U.S.C. § 1681 et seq.
Section 5 of the Fair and Accurate Credit Transactions Act (FACTA), an amendment to the Fair Credit Reporting Act, specifically addresses identity theft and related consumer issues. Victims of identity theft are granted the ability to work with creditors and credit bureaus to remove negative information in their credit report resulting from identity theft. FACTA also created requirements to prevent identity theft, such as requiring merchants to truncate credit card numbers on receipts, and enabling consumers to request that a credit bureau truncate their Social Security number when disclosing their credit report (15 U.S.C. § 1681g(a)(1)(A)). Individuals can also order a copy of their credit report free of charge once every year (15 U.S.C. § 1681j). In an effort to give credit bureaus time to comply with these new regulations, the FTC created a rolling effective date, based on the state of the consumer’s residence (Effective Dates for the Fair and Accurate Credit Transactions Act of 2003, 16 CFR Part 602). FACTA also enabled consumers to place three different types of fraud alerts intended to stop credit grantors from opening any new accounts. An individual who suspects they are, or are about to become, the victim of ID theft, can place an “initial alert” in their file. If an individual has been a victim of ID theft, and has filed report with a law enforcement agency, they can then request an “extended alert.” After an extended alert is activated, it will stay in place for seven years, and the victim may order two free credit reports within 12 months. For the next five years, credit agencies must exclude the consumer’s name from lists used to make pre-screened credit or insurance offers. Finally, military officials are enabled to place an “active duty alert” when they are on active duty or assigned to service away from the usual duty station (15 U.S.C. § 1681c-1).
The False Identification Crime Control Act of 1982 was passed to prohibit fraud in connection with identification documents. The act added two new statutes, “Fraud and related activity in connection with identification documents” (18 U.S.C. § 1028) and “Mailing private identification documents without a disclaimer” (18 U.S.C. § 1738, since repealed by P.L. 106-578). Violators face fines and/or imprisonment for producing or transferring an identification document known it to be false or stolen. The Act also prohibited producing, transferring, or possessing a document-making device with the intent to produce false identification documents. However, the usage of the word “document” indicated that a defendant would have to actually possess the physical identification.
The Internet False Identification Act of 2000 amended the False Identification Crime Control Act of 1982 to encompass computer-aided false identity crimes. Essentially, the Act expanded the scope of the fraudulent identification document crime to include document transfer by electronic means. Indeed, one of the main goals of the act was to end the distribution of counterfeit identification documents over the web. According to the FDIC, the Act closed “a loophole left by the ID Theft Act, [enabling] law enforcement agencies to pursue those who formerly could sell counterfeit social security cards legally by maintaining the fiction that such cards were “novelties” rather than counterfeit documents” (Putting an End to Account-Hijacking Identity Theft, FDIC). As a result, the statute now accounts for computer-facilitated crimes of false identity and prohibits the possession, production, or transfer of false identification documents or identification documents that were not legally issued to the possessor (18 U.S.C. §§1028 (a)(1), (2)). It also prohibits the production, transfer, or possession of any “document making implement” that is intended for use manufacturing false identification documents (18 U.S.C. §§1028 (a)(5)).
The 1974 Privacy Act was implemented to give individuals more control over the government’s collection and use of personal identifying information. Under the act a government agency can collect only information that is relevant and necessary to accomplish the particular agency functions (5 U.S.C. § 552a(e)(1)). Federal agencies are also limited in the extent to which they can disclose records. An individual must consent in writing, a court order must be placed, or the disclosure must fall within one of the exceptions provided in the statute. Regarding the usage of social security numbers as an identifier, the Privacy Act requires any federal, state or local government agency to tell you if the number is required, what will be done with it, and what will happen if you refuse to provide it (U.S.C. § 552a). The Privacy Act failed to address personal information collected by private parties, such as data brokers, collection agencies or consumer credit groups.
Congress passed the Driver’s Privacy Protection Act (DPPA) as an amendment to the Omnibus Crime Act of 1994. Prior to passage of the DPPA, anyone could pay a couple dollars, and obtain a driver’s full name, address, birth date and license number. The DPPA limited the use of a driver’s motor vehicle record to certain purposes (18 U.S.C. § 2721). Essentially the act was passed to make it more difficult to obtain an individual’s PII. After being challenged by a South Carolina court alleging that the Act violated principles of federalism, the Supreme Court upheld the constitutionality of the Drivers Privacy Protection Act under Congress’s authority to regulate interstate commerce within the Commerce Clause (Reno v. Condon, 528 U.S. 141 (2000)).
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires healthcare providers and insurers to create and maintain electronic patient records, in order to improve confidentiality and efficiency. The confidentially provisions limit the way doctors, health plans, pharmacies, hospitals and medical providers use patients’ medical information. HIPAA protects “individually identifiable health information,” meaning any data “created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse” relating to a patients physical or mental condition or care (42 U.S.C. § 1320d(4)). HIPAA requires health providers to send a privacy notice that states their policies for sharing individually identifiable health information without consent. Only when a patient gives consent, may a provider disclose individually identifiable health information. In effect, HIPAA implies a duty to disclose security breaches to affected individuals.
113 Stat. 1338, 15 U.S.C. § 6801, et seq.
The Gramm-Leach-Bliley Act (GLBA), also known as the Financial Services Modernization Act of 1999, provides limited privacy protections against the sale of consumer financial information. The financial privacy provisions of GLBA are located in subchapter 1, “Disclosure of Nonpublic Personal Information” (15 U.S.C. § 6801-6809), and subchapter 2, “Fraudulent Access to Financial Information” (15 U.S.C. § 6821-6827). Both contain specific prohibitions against gathering or disclosing consumer’s financial information under false pretenses. GLBA specifically makes it a crime to obtain customer information by means of false or fraudulent statements to an officer, employee, agent or customer of a financial institution (15 U.S.C.6821, 6823). Gramm-Leach- Bliley instructs eight federal regulatory agencies and the states to administer and enforce the Financial Privacy Rule and the Safeguards Rule, to ensure that financial institutions prevent unauthorized disclosure of consumer financial information, including fraudulent access, by implementing appropriate policies, procedures and controls.
The Social Security Confidentially Act of 2000 prohibits displaying social security numbers on unopened checks or other Treasury issued drafts.
The Fair Credit Reporting Act (FCRA) regulates consumer reports and consumer reporting agencies (15 U.S.C. § 1681 et seq.). Since the original FCRA’s passage in 1970, various amendments have altered the standards used for the collection and dissemination of credit information. The Consumer Credit Reporting Reform Act of 1996, amended the FCRA to expand the ability of companies to share consumer reports among affiliates if it is clearly disclosed to the consumer, and the consumer has had a chance to opt-out, prior to the actual disclosure. The next major overhaul was the Fair and Accurate Credit Transactions Act of 2003 (see above).
The Truth in Lending Act limits liability for fraudulent credit card charges to $50.00, in most situations. It also requires “meaningful disclosure” of key information in any consumer credit transaction (15 U.S.C. § 1601).
92 Stat. 3728, 15 U.S.C. § 1693 et seq.
The Electronic Fund Transfer Act provides a basic framework of the rights, liabilities, and responsibilities of parties involved in making electronic fund transfers. It grants consumers protections when using a credit or debit card for financial transactions (15 U.S.C. §1693).
88 Stat. 1511, 15 U.S.C § 1666 et seq.
Best, R. A. (2004). Identity Theft: A Legal Research Guide. Buffalo, NY: William S. Hein & Co.
Manz, W. H. (2005). Federal Identity Theft Law: Major Enactments of the 108th Congress. Buffalo, NY: William S. Hein & Co.
Menninger, K. (2005). Identity Theft and Other Misuses of Credit and Debit Cards. American Jurisprudence Proof of Facts 3d, 81:113.
Newton, M. (2004). The Encyclopedia of High-Tech Crime and Crime-Fighting. New York, NY: Checkmark Books.
Fischer, L.R. The Law of Financial Privacy. Austin, TX :A.S. Pratt & Sons.
Law of Internet Security and Privacy. New York, NY: Aspen Law & Business.
Cronin, K.P. & Weikers, R.N. Data Security and Privacy Law: Combating Cyberthreats. St. Paul, Minn: Thomson/West.
Consumer Credit Guide. Chicago, Ill: CCH.
Non-profit organizations produce a large quantity of work on identity theft. Consumer advocates and privacy groups have a special interest in the protection of an individual’s good credit and financial information.
There are 5 main federal non-judicial agencies that have a role in deterring or prosecuting identity theft. Since all five agencies have significant statutory mandate in this area, they maintain websites that contain information for citizens, statistical reports and other materials.
Theft: Prevalence, Clearance Rates, and Victim/Offender Characteristics. Journal of Criminal Justice, 33(1), 19.
and Organisations Related Responsibilities. Journal of Financial Crime 12(1) 33.
Hayward, C. L. (Ed.). (2004). Identity Theft. Hauppauge, N.Y.: Novinka Books.
Katel, P. (2005). Identity Theft. The CQ Researcher Online, 15(22), 517-540 .
Dynamic. The Journal of Consumer Affairs, 38(2), 244.
Identity Theft Law. Federal Lawyer 50(1): 11.
and Technology Law Journal 30: 237.
Davis, K. (2005). Can You Smell the Phish? Kiplinger’s Personal Finance 59(2): 76-80.
Finch, E. (2003). What a Tangled Web We Weave: Identity Theft and the Internet.
Gomes, L. (2005, Jun 20). Phisher Tales: How Webs of Scammers Pull Off Internet Fraud. The Wall Street Journal B:1.
Lynch, J. (2005). Identity Theft in Cyberspace: Crime Control Methods and their Effectiveness in Combating Phishing Attacks. Berkeley Technology Law Journal 20 (1):259.
Rusch, J.J. (2005, Jan). The Compleat Cyber-Angler: A Guide to Phishing.
Computer Fraud and Security 1:4-6.
Consumers Union. (2004) How Do I Order My Free Annual Consumer Credit Reports?
Application of the FCRA to Identity Theft. Alabama Law Review 53: 583.
Identity Theft. Business Horizons 47(5): 3.
Accurate Credit Transactions Act of 2003 and the Road Not Taken. The Journal of Consumer Affairs 38(2): 204.
Claburn, T. (2005, Feb 17). Law Requires ChoicePoint To Disclose Fraud.
Gordon-Murnane, L. (2005). Data Security Breaches and Consumer Notification.
Important Role of Data Security in Privacy Compliance Programs. Intellectual Property & Technology Law Journal, 17(5), 20.
Pike, G. H. (2005, May 1). Privacy and the Database Industry. Information Today 22:5.
Their Customers’ Personal Data Secure? Fortune, 151(10): 66.
Information Gathered through the Internet. Business Law Today 14:13.
Smith, R.E. (2005, Mar). ChoicePoint: An Ignoble Corporate History. Privacy Journal.
Swartz, N. (2005). Database Debacles. Information Management Journal, 39(3): 20.
Criminal Justice Professionals : Police Officers, Attorneys, and Judges.
Flushing, N.Y.: Looseleaf Law Publications.
Dadisho, E. (2005, Mar). Identity Theft and the Police Response: The Investigation.
Dadisho, E. (2005, Apr). Identity Theft and the Police Response: Resources for Police.
to Victimization. Journal of Police and Criminal Psychology, 17(1), 19-35.
Newman, G.R. (2004). Problem Oriented Guides for Police: Identity Theft. U.S.
Somatic Impact of Identity Theft. Journal of Forensic Sciences, 49(1), 131-136.
Schwartz, E. (2005, Mar 7). Cybercrime Crackdown. InfoWorld 27(10): 8.
Baldas, T. (2005, May 12). Identity Thefts Leading to “Fear Factor” Lawsuits.
The Recorder (American Lawyer Media) 129:92.
Brace for Increased Liability. Corporate Legal Times, 15: 164.
Annual Institute on Privacy Law: New Developments & Compliance Issues in a Security-Conscious World. New York, NY: Practising Law Institute.
Privacy and Security Class Action Lawsuits. Electronic Commerce & Law Report 10 (26): 659-661.
Lepofsky, R. (2004). Preventing Identity Theft. Risk Management, 51(10): 34.
Personal Information Secure from the Threat of Identity Theft. U.C. David Law Review 34:1077.
Murphy, M. (2003). Privacy Protection for Customer Financial Information.
of Financial Service Professionals 58(1): 20.
O’Rourke, M. (2005). Data Security in Crisis. Risk Management 52(5):9.
Tomes, J. P. (2005). Prescription for Data Protection. Security Management 49(4):75.
Wade, J. (2004). Personal Data Liability. Risk Management 51(5): 9.

References: § 1681
 § 1681
 § 1681
 § 1681
 § 1028
 § 1738
 § 552
 § 552
 § 2721
 v. 
 § 1320
 § 6801
 § 6801
 § 6821
 § 1681
 § 1601
 § 1693
 §1693
 § 1666