SB475.html

Title 16 of the Official Code of Georgia Annotated, relating to crimes and offenses, is amended by striking Code Section 16-9-4, relating to definitions of identification documents and prohibitions regarding false documents, in its entirety and inserting in lieu thereof the following:
"16-9-4.
(a) As used in this Code section, the term:
(1) 'Access device' means a unique electronic identification number, address, description, or routing code or a device containing a unique electronic identification number, address, description, or routing code issued to an individual which permits or facilitates entry into a facility or computer or provides access to the financial resources, including, but not limited, to the credit resources of the individual to whom the device or card is issued.
(2) 'Description' means any identifying information about a person, including, but not limited to, date of birth, place of birth, address, social security number, height, weight, hair or eye color, or unique biometric data such as fingerprint, voice print, retina or iris image, DNA profile, or other unique physical representation.
(3) 'Government agency' means any agency of the executive, legislative, or judicial branch of government or political subdivision or authority thereof of this state, any other state, the United States, or any foreign government or international governmental or quasi-governmental agency recognized by the United States or by any of the several states.
(4) 'Identification document' means:
(A) Any document or card issued to an individual by a government agency or by the authority of a government agency containing the name of a person and a description of the person or such person´s photograph, or both, and includes, without being limited to, a passport, visa, military identification card, driver´s license, or an identification card;
(B) Any document issued to an individual for the purpose of identification by or with the authority of the holder of a trademark or trade name of another, as these terms are defined in Code Section 10-1-371, that contains the trademark or trade name and the name of the person to whom the document is issued and a description of the person or the person´s photograph, or both; or
(C) Any access device.
(b)(1) It shall be unlawful for any person to knowingly possess, display, or use any false, fictitious, fraudulent, or altered identification document.
(2) It shall be unlawful for any person to knowingly manufacture, alter, sell, distribute, deliver, possess with intent to sell, deliver, or distribute, or offer for sale, delivery, or distribution a false, fraudulent, or fictitious identification document or any identification document which contains any false, fictitious, or fraudulent statement or entry.
(3) It shall be unlawful for any person to knowingly manufacture, alter, sell, distribute, deliver, possess with the intent to sell, deliver, or distribute, or offer for sale, delivery, or distribution any identification document containing the trademark or trade name of another without the written consent of the owner of the trademark or trade name.
(4) It shall be unlawful for any person to knowingly possess, display, or use any false, fictitious, fraudulent, or altered identification document containing the logo or legal or official seal of a government agency or any colorable imitation thereof in furtherance of a conspiracy or attempt to commit a violation of the criminal laws of this state or of the United States or any of the several states which is punishable by imprisonment for one year or more.
(5) It shall be unlawful for any person to knowingly manufacture, alter, sell, distribute, deliver, possess with the intent to sell, deliver, or distribute, or offer for sale or distribution any other identification document containing the logo or legal or official seal of a government agency or any colorable imitation thereof without the written consent of the government agency.
(6) It shall be unlawful for any person to knowingly possess, display, or use an identification document issued to or on behalf of another person without the permission or consent of the other person for a lawful purpose, unless the identification document is possessed, displayed, or used with the intent to restore it to the other person or government agency or other entity that issued the identification document to the person.
(c)(1) Except as provided in paragraph (2) or (3) of this subsection, any person who violates paragraph (1), (2), (3), or (6) of subsection (b) of this Code section shall be guilty of a misdemeanor.
(2) Any person who violates paragraph (2), (3), or (6) of subsection (b) of this Code section for the second or any subsequent offense shall be guilty of a felony and shall be punished by a fine of not more than $25,000.00 or by imprisonment for not more than three years, or both.
(3) Any person who manufactures, alters, sells, distributes, delivers, receives, possesses, or offers for sale or distribution three or more identification documents in violation of subsection (b) of this Code section shall be punished by imprisonment for not less than three nor more than ten years, a fine not to exceed the amount specified by Code Section 17-10-8, or both.
(4) Any person who violates paragraph (4) or (5) of subsection (b) of this Code section shall be punished by imprisonment for not less than one nor more than five years, a fine not to exceed the amount specified by Code Section 17-10-8, or both.
(5) Any person convicted of an attempt or conspiracy to violate subsection (b) of this Code section shall be punished by imprisonment, by a fine, or by both such punishments not to exceed the maximum punishment prescribed for the offense the commission of which was the object of the attempt or conspiracy.
(d) Each violation of this Code section shall constitute a separate offense.
(e) Any violation of this Code section shall be considered to have been committed in any county of this state in which the evidence shows that the identification document was manufactured, altered, sold, displayed, distributed, delivered, received, offered for sale or distribution, or possessed.
(f) The provisions of this Code section shall not apply to any lawfully authorized investigative, protective, or intelligence activity of an agency of the United States, this state, or any of the several states or their political subdivisions or any activity authorized under Chapter 224 of Title 18 of the United States Code or any similar such law relating to witness protection.
(g) It shall not be a defense to a violation of this Code section that a document contained words indicating that it is not an identification document unless there appears on the front and back of such document the word 'novelty' which is in a color which is not transparent on the design of the document, is in block letters not less than 40 point type in size, and is indelible ink.
(h)(1) Any property which is used, intended for use, or used in any manner to facilitate a violation of this Code section is contraband and forfeited to the state and no person shall have a property interest in it. Such property may be seized or detained in the same manner as provided in Code Section 16-13-49 and shall not be subject to replevin, conveyance, sequestration, or attachment.
(2) Within 60 days of the date of the seizure of contraband pursuant to this Code section, the district attorney shall initiate forfeiture or other proceedings as provided in Code Section 16-13-49. An owner or interest holder, as defined by subsection (a) of Code Section 16-13-49, may establish as a defense to the forfeiture of property which is subject to forfeiture under this Code section the applicable provisions of subsection (e) or (f) of Code Section 16-13-49. Property which is forfeited pursuant to this Code section shall be disposed of and distributed as provided in Code Section 16-13-49.
(3) If property subject to forfeiture cannot be located; has been transferred or conveyed to, sold to, or deposited with a third party; is beyond the jurisdiction of the court; has been substantially diminished in value while not in the actual physical custody of a receiver or governmental agency directed to maintain custody of the property; or has been commingled with other property that cannot be divided without difficulty, the court shall order the forfeiture of any property of a claimant or defendant up to the value of property found by the court to be subject to forfeiture under this subsection in accordance with the procedures set forth in subsection (x) of Code Section 16-13-49.
(4) The provisions of paragraphs (3), (4), and (5) of subsection (x) and subsection (z) of Code Section 16-13-49 shall be applicable to any proceedings brought pursuant to this subsection.
(i) It shall be an affirmative defense to the manufacturing, selling, or distributing of identification documents that contain false, fictitious, or altered information that the person manufacturing, selling, or distributing the documents used due diligence to ascertain the truth of the information contained in the identification document."

16-9-120.
As used in this article, the term:
(1) 'Administrator' means the administrator appointed under Part 2 of Article 15 of Chapter 1 of Title 10, the 'Fair Business Practices Act of 1975.'
(2) 'Business victim' means any individual or entity that provided money, credit, goods, services, or anything of value to someone other than the intended recipient where the intended recipient has not given permission for the actual recipient to receive it and the individual or entity that provided money, credit, goods, services, or anything of value has suffered financial loss as a direct result of the commission or attempted commission of a violation of this article.
(3) 'Consumer victim' means any individual whose personal identifying information has been obtained, compromised, used, or recorded in any manner without the permission of that individual.
(4) 'Identifying information' shall include, but not be limited to:
(A) Current or former names;
(B) Social security numbers;
(C) Driver´s license numbers;
(D) Checking account numbers;
(E) Savings account numbers;
(F) Credit and other financial transaction card numbers;
(G) Debit card numbers;
(H) Personal identification numbers;
(I) Electronic identification numbers;
(J) Digital or electronic signatures;
(K) Medical identification numbers;
(L) Birth dates;
(M) Mother´s maiden name;
(N) Selected personal identification numbers;
(O) Tax identification numbers;
(P) State identification card numbers issued by state departments; or
(Q) Any other numbers or information which can be used to access a person´s or entity´s resources.
(5) 'Resources' includes, but is not limited to:
(A) A person´s or entity´s credit, credit history, credit profile, and credit rating;
(B) United States currency, securities, real property, and personal property of any kind;
(C) Credit, charge, and debit accounts;
(D) Loans and lines of credit;
(E) Documents of title and other forms of commercial paper recognized under Title 11;
(F) Any account, including a safety deposit box, with a financial institution as defined by Code Section 7-1-4, including a national bank, federal savings and loan association, or federal credit union or a securities dealer licensed by the Secretary of State or the federal Securities and Exchange Commission; and
(G) A person´s personal history, including but not limited to records of such person´s driving records; criminal, medical, or insurance history; education; or employment.

16-9-121.
A person commits the offense of identity fraud when without the authorization or permission of a person with the intent unlawfully to appropriate resources of or cause physical harm to that person, or of any other person, to his or her own use or to the use of a third party he or she:
(1) Obtains or records identifying information of a person which would assist in accessing the resources of that person or any other person; or
(2) Accesses or attempts to access the resources of a person through the use of identifying information.

16-9-122.
It shall be unlawful for any person to attempt or conspire to commit any offense prohibited by this article. Any person convicted of a violation of this Code section shall be punished by imprisonment or community service, by a fine, or by both such punishments not to exceed the maximum punishment prescribed for the offense the commission of which was the object of the attempt or conspiracy.

16-9-123.
The administrator appointed under Code Section 10-1-395 shall have the authority to investigate any complaints of consumer victims regarding identity fraud. In conducting such investigations the administrator shall have all investigative powers which are available to the administrator under Part 2 of Article 15 of Chapter 1 of Title 10, the 'Fair Business Practices Act of 1975.' If, after such investigation, the administrator determines that a person has been a consumer victim of identity fraud in this state, the administrator shall, at the request of the consumer victim, provide the consumer victim with certification of the findings of such investigation. Copies of any and all complaints received by any law enforcement agency of this state regarding potential violations of this article shall be transmitted to the Governor´s Office of Consumer Affairs. The Governor´s Office of Consumer Affairs shall maintain a repository for all complaints in the State of Georgia regarding identity fraud. Information contained in such repository shall not be subject to public disclosure. The information in the repository may be transmitted to any other appropriate investigatory agency or entity. Consumer victims of identity fraud may file complaints directly with the Governor´s Office of Consumer Affairs. Employees of the Governor´s Office of Consumer Affairs may communicate with consumer victims. Any and all transmissions authorized under this Code section may be transmitted electronically, provided that such transmissions are made through a secure channel for the transmission of such electronic communications or information, the sufficiency of which is acceptable to the Governor´s Office of Consumer Affairs. Nothing in this Code section shall be construed to preclude any otherwise authorized law enforcement or prosecutorial agencies from conducting investigations and prosecuting offenses of identity fraud.

16-9-124.
The Attorney General and prosecuting attorneys shall have the authority to conduct the criminal prosecution of all cases of identity fraud.

16-9-125.
The General Assembly finds that identity fraud involves the use of identifying information which is uniquely personal to the consumer or business victim of that identity fraud and which information is considered to be in the lawful possession of the consumer or business victim wherever the consumer or business victim currently resides or is found. Accordingly, the fraudulent use of that information involves the fraudulent use of information that is, for the purposes of this article, found within the county where the consumer or business victim of the identity fraud resides or is found. Accordingly, in a proceeding under this article, the crime will be considered to have been committed in any county where the person whose means of identification or financial information was appropriated resides or is found, or in any county in which any other part of the offense took place, regardless of whether the defendant was ever actually in such county.

16-9-126.
(a) A violation of this article, other than a violation of Code Section 16-9-122, shall be punishable by imprisonment for not less than one nor more than ten years or a fine not to exceed $100,000.00, or both. Any person who commits such a violation for the second or any subsequent offense shall be punished by imprisonment for not less than three nor more than 15 years, a fine not to exceed $250,000.00, or both.
(b) Any person found guilty of a violation of this article may be ordered by the court to make restitution to any consumer victim or any business victim of such fraud.
(c) Each violation of this article shall constitute a separate offense.
(d) Upon a conviction of a violation of this article, the court may issue any order necessary to correct a public record that contains false information resulting from the actions which resulted in the conviction.

16-9-127.
The administrator shall have authority to initiate any proceedings and to exercise any power or authority in the same manner as if he or she were acting under Part 2 of Article 15 of Chapter 1 of Title 10, as regards violations or potential violations of this article.

16-9-128.
(a) The prohibitions set forth in Code Sections 16-9-121 and 16-9-122 shall not apply to nor shall any cause of action arise under Code Sections 16-9-129 and 16-9-131 for:
(1) The lawful obtaining of credit information in the course of a bona fide consumer or commercial transaction;
(2) The lawful, good faith exercise of a security interest or a right to offset by a creditor or a financial institution;
(3) The lawful, good faith compliance by any party when required by any warrant, levy, garnishment, attachment, court order, or other judicial or administrative order, decree, or directive; or
(4) The good faith use of identifying information with the permission of the affected individual.
(b) The exemptions provided in subsection (a) of this Code section will not apply to a person intending to further a scheme to violate Code Section 16-9-121 or 16-9-122.
(c) It is not necessary for the state to negate any exemption or exception in this article in any complaint, accusation, indictment, or other pleading or in any trial, hearing, or other proceeding under this article involving a business victim. In such cases the burden of proof of any exemption or exception is upon the business victim claiming it.

16-9-129.
Any business victim who is injured by reason of any violation of this article shall have a cause of action for the actual damages sustained and, where appropriate, punitive damages. Such business victim may also recover attorney´s fees in the trial and appellate courts and the costs of investigation and litigation reasonably incurred.

16-9-130.
(a) Any consumer victim who suffers injury or damages as a result of a violation of this article may bring an action individually or as a representative of a class against the person or persons engaged in such violations under the rules of civil procedure to seek equitable injunctive relief and to recover general and punitive damages sustained as a consequence thereof in any court having jurisdiction over the defendant; provided, however, punitive damages shall be awarded only in cases of intentional violation. A claim under this article may also be asserted as a defense, setoff, cross-claim, or counterclaim or third-party claim against such person.
(b) A court shall award three times actual damages for an intentional violation.
(c) If the court finds in any action that there has been a violation of this article, the consumer victim injured by such violation shall, in addition to other relief provided for in this Code section and irrespective of the amount in controversy, be awarded reasonable attorney´s fees and expenses of litigation incurred in connection with said action.
(d) It shall not be a defense in any action under this article that others were, are, or will be engaged in like practices.
(e) In any action brought under this article the administrator shall be served by certified or registered mail or statutory overnight delivery with a copy of the initial complaint and any amended complaint within 20 days of the filing of such complaint. The administrator shall be entitled to be heard in any such action, and the court where such action is filed may enter an order requiring any of the parties to serve a copy of any other pleadings in an action upon the administrator.

16-9-131.
Whenever an investigation has been conducted by the Governor´s Office of Consumer Affairs under this article and such investigation reveals conduct which constitutes a criminal offense, the administrator shall forward the results of such investigation to the Attorney General or other prosecuting attorney of this state who shall commence any criminal prosecution that he or she deems appropriate.

16-9-132.
This article is cumulative with other laws and is not exclusive. The rights or remedies provided for in this article shall be in addition to any other procedures, rights, remedies, or duties provided for in any other law or in decisions of the courts of this state dealing with the same subject matter."

10-15-1.
As used in this chapter, the term:
(1) 'Business' means a sole proprietorship, partnership, corporation, association, or other group, however organized and whether or not organized to operate at a profit. The term includes a financial institution organized, chartered, or holding a license or authorization certificate under the laws of this state, any other state, the United States, or any other country, or the parent or the subsidiary of any such financial institution. The term also includes an entity that destroys records. However, for purposes of this chapter, the term shall not include any bank or financial institution that is subject to the privacy and security provisions of the Gramm-Leach-Bliley Act, 15 U.S.C. 6801, et seq., as amended, and as it existed on January 31, 2002, nor shall it include any hospital or health care institution licensed under Title 31 which is subject to the privacy and security provisions of the federal Health Insurance Portability and Accountability Act of 1996, P.L. 104-191, nor any other entity which is governed by federal law, provided that the federal law governing the business requires the business to discard a record containing personal information in the same manner as Code Section 10-15-2.
(2) 'Customer' means an individual who provides personal information to a business for the purpose of purchasing or leasing a product or obtaining a service from the business.
(3) 'Discard' means to throw away, get rid of, or eliminate.
(4) 'Dispose' means the sale or transfer of a record for value to a company or business engaged in the business of record destruction.
(5) 'Personal information' means:
(A) Personally identifiable data about a customer´s medical condition, if the data are not generally considered to be public knowledge;
(B) Personally identifiable data which contain a customer´s account or identification number, account balance, balance owing, credit balance, or credit limit, if the data relate to a customer´s account or transaction with a business;
(C) Personally identifiable data provided by a customer to a business upon opening an account or applying for a loan or credit; or
(D) Personally identifiable data about a customer´s federal, state, or local income tax return.
(6)(A) 'Personally identifiable' means capable of being associated with a particular customer through one or more identifiers, including, but not limited to, a customer´s fingerprint, photograph, or computerized image, social security number, passport number, driver identification number, personal identification card number, date of birth, medical information, or disability information.
(B) A customer´s name, address, and telephone number shall not be considered personally identifiable data unless one or more of them are used in conjunction with one or more of the identifiers listed in subparagraph (A) of this paragraph.
(7) 'Record' means any material on which written, drawn, printed, spoken, visual, or electromagnetic information is recorded or preserved, regardless of physical form or characteristics.

10-15-2.
A business may not discard a record containing personal information unless it:
(1) Shreds the customer´s record before discarding the record;
(2) Erases the personal information contained in the customer´s record before discarding the record;
(3) Modifies the customer´s record to make the personal information unreadable before discarding the record; or
(4) Takes actions that it reasonably believes will ensure that no unauthorized person will have access to the personal information contained in the customer´s record for the period between the record´s disposal and the record´s destruction.

10-15-3. Reserved.

10-15-4.
A business that violates Code Section 10-15-2 may be fined by the administrator appointed pursuant to Code Section 10-1-395 not more than $500.00 for each customer´s record that contains personal information that is wrongfully disposed of or discarded; provided, however, in no event shall the total fine levied by the administrator exceed $10,000.00. Notwithstanding anything to the contrary contained in this Code section, it shall be an affirmative defense to the wrongful disposing of or discarding of a customer´s record that contains personal information if the business can show that it used due diligence in its attempt to properly dispose of or discard such records.