A new Chapter VIII is added to Title 19; Parts 4600 and 4601 of Title 21 are repealed; Parts 4602 – 4605 and 4607 - 4608 of Title 21 are renumbered as Parts 220 – 225 of Title 19, respectively; and a new Part 226 is added to Title 19 to read as follows:
Division of Consumer Protection
220 General Provisions.
223 Design, Installation, Inspection and Maintenance of Playground Equipment.
224 Children’s Product Safety and Recall Effectiveness.
225 Anchoring, Securing and Counter-Weighting a Moveable Soccer Goal.
226 Identity Theft and Mitigation Program
Identity Theft Prevention and Mitigation Program
(Statutory authority: Executive Law, §§91 and 94-a)
226.3 Consumer Assistance.
226.4 Consumer Educational Materials.
226.5 Request for Information.
226.6 Consumer Credit Reporting Agency Filing.
226.7 Consumer Information.
The Division of Consumer Protection was created within the Department of State to protect the people of New York State from economic harm resulting from unscrupulous and questionable business practices. The Division is authorized to promulgate rules and regulations to achieve this objective, including the authority to establish and administer the Identity Theft Prevention and Mitigation Program. The Program is intended to:
1) inform consumers about how to protect their personal identifying information; (2) help consumers prevent identity theft, including taking steps to protect their identities once their personal identifying information has been compromised, and (3) help consumers mitigate issues related to the theft of their identities. These regulations establish requisites and procedures to provide consumers with the means to protect themselves against identity theft and to assure that appropriate assistance and complaint resolution mechanisms are in place for the protection and repair of their financial and credit history in the event their personal identifying information has been compromised.
(a) Victim of identity theft. The term “victim of identity theft” shall mean any natural person whose personal information has been wrongfully obtained by another or is used in some way that involves fraud or deception, typically for economic gain.
(b) Personal information. The term “personal information” shall mean any information concerning a natural person which, because of name, number, personal mark, or other identifier, can be used to identify such natural person.
(c) Consumer Reporting Agency. The term “consumer reporting agency” means any person who, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports or investigative consumer reports to third parties.
(d) Consumer credit reporting agency. The term “consumer credit reporting agency” means a consumer reporting agency that regularly engages in the practice of assembling or evaluating and maintaining, for the purpose of furnishing consumer credit reports to third parties bearing on a consumer's credit worthiness, credit standing, or credit capacity, public record information and credit account information from persons who furnish that information regularly and in the ordinary course of business.
(e) Division. The term “Division” shall mean the Division of Consumer Protection.
(f) Department. The term “Department” shall mean the Department of State.
(g) Program. The term “Program” shall mean the Identity Theft Prevention and Mitigation Program.
§226.3 Consumer Assistance.
Persons requesting assistance from the Division to respond to an identity theft concern shall complete a consumer complaint assistance form as prescribed by the Division. The Division, where appropriate, may undertake any activities necessary to help a victim of identity theft obtain any such information and assistance from any entity identified in Executive Law §94-a3(9)(ii), including, but not limited to, consumer credit reporting agencies, as is necessary to prevent the utilization of such consumer’s personal identifying information in a way that inures to such consumer’s economic detriment, or to mitigate the impacts when such consumer’s personal identifying information has been used to such consumer’s economic detriment.
§226.4 Consumer Educational Materials.
The Division shall make available upon request to any person identifying themselves as a victim of identity theft information that provides such victims with guidance in understanding and addressing concerns surrounding an identity theft crime.
§226.5 Request for Information.
When the Division of Consumer Protection acts on behalf of a consumer to investigate, mediate and/or mitigate an identity theft complaint, the Division may require substantiating and/or supporting documentation and/or records from any State agency, including the Division of State Police, State public authority, municipal department or agency, county or municipal police department, and any non-governmental entity, including, but not limited to, consumer credit reporting agencies. A consumer credit reporting agency shall comply with the written request of the Division for such documentation and/or records within 10 business days of service of such request, consistent with applicable laws and this Part.
§226.6 Consumer Credit Reporting Agency Filing.
Each consumer credit reporting agency operating within the State shall file with the Department such information as the Division finds necessary to effectively administer the Program. Such information shall be disclosed by filing a form provided by the Department and entitled “Consumer Reporting Agency Notice and Contact Information.” Such form shall include, but not be limited to, the following information, which shall be maintained and updated by the filer in the manner prescribed by the Department:
(a) The name of the consumer credit reporting agency.
(b) The principles and officers of the consumer credit reporting agency.
(c) The direct contact information for an individual(s) within the consumer credit reporting agency available to the Division during regular business hours.
(d) The direct contact information for an individual(s) within the consumer credit reporting agency available to the Division within 24 hours of a notification of a security breach pursuant to GBL §399-aa(8)(a).
(e) Contact information available to consumers, including, the consumer credit reporting agency’s web address, telephone number and email address.
(f) A listing of all proprietary products offered by the consumer credit reporting agency to consumers for the prevention or mitigation of identity theft, any and all fees associated with the purchase of or subscription to such products, and the contractual provisions and disclosures in relation to such purchase or subscription, including, but not limited to: scope of services; liability for negligent or erroneous provision of services, and cancellation requisites.
(g) A listing and description of all business affiliations and contractual relationships with any other entities, where such business affiliations or contractual relationships relate to the provision of any products or services advertised to consumers as products or services available for the prevention or mitigation of identity theft.
(h) The consumer credit reporting agency’s DUNNS number.
§226.7 Consumer Information.
Any advertisements or other material promoting proprietary products offered to consumers by a consumer credit reporting agency for the prevention of identity theft must prominently disclose any and all fees associated with the purchase or use of such product, including, if offered on a trial basis, any and all fees charged for its purchase or use after the trial period and the requisites of cancellation of such continued use.
A violation of any of the rules set forth in this Part shall be referred to the Attorney General, Department of Financial Services and/or any other appropriate law enforcement or regulatory entity for action.