Title 19 Part 226

The Division of Consumer Protection was created within the Department of State to protect the people of New York State from economic harm resulting from unscrupulous and questionable business practices. The division is authorized to promulgate rules and regulations to achieve this objective, including the authority to establish and administer the Identity Theft Prevention and Mitigation Program. The program is intended to:

The term victim of identity theft shall mean any natural person whose personal information has been wrongfully obtained by another or is used in some way that involves fraud or deception, typically for economic gain.

The term personal information shall mean any information concerning a natural person which, because of name, number, personal mark, or other identifier, can be used to identify such natural person.

The term consumer reporting agency means any person who, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports or investigative consumer reports to third parties.

The term consumer credit reporting agency means a consumer reporting agency that regularly engages in the practice of assembling or evaluating and maintaining, for the purpose of furnishing consumer credit reports to third parties bearing on a consumer's credit worthiness, credit standing, or credit capacity, public record information and credit account information from persons who furnish that information regularly and in the ordinary course of business.

The term division shall mean the Division of Consumer Protection.

The term department shall mean the Department of State.

The term program shall mean the Identity Theft Prevention and Mitigation Program.

Persons requesting assistance from the division to respond to an identity theft concern shall complete a consumer complaint assistance form as prescribed by the division. The division, where appropriate, may undertake any activities necessary to help a victim of identity theft obtain any such information and assistance from any entity identified in Executive Law section 94-a3(9)(ii), including, but not limited to, consumer credit reporting agencies, as is necessary to prevent the utilization of such consumer’s personal identifying information in a way that inures to such consumer’s economic detriment, or to mitigate the impacts when such consumer’s personal identifying information has been used to such consumer’s economic detriment.

The division shall make available upon request to any person identifying themselves as a victim of identity theft information that provides such victims with guidance in understanding and addressing concerns surrounding an identity theft crime.

When the Division of Consumer Protection acts on behalf of a consumer to investigate, mediate and/or mitigate an identity theft complaint, the division may require substantiating and/or supporting documentation and/or records from any State agency, including the Division of State Police, State public authority, municipal department or agency, county or municipal police department, and any non-governmental entity, including, but not limited to, consumer credit reporting agencies. A consumer credit reporting agency shall comply with the written request of the division for such documentation and/or records within 10 business days of service of such request, consistent with applicable laws and this Part.

Each consumer credit reporting agency operating within the State shall file with the department such information as the division finds necessary to effectively administer the program. Such information shall be disclosed by filing a form provided by the department and entitled Consumer Reporting Agency Notice and Contact Information. Such form shall include, but not be limited to, the following information, which shall be maintained and updated by the filer annually or immediately upon a material or substantive change to the information provided pursuant to this section:

Any advertisements or other material promoting proprietary products offered to consumers by a consumer credit reporting agency for the prevention of identity theft must, in addition to other applicable laws, prominently disclose any and all fees associated with the purchase or use of such product, including, if offered on a trial basis, any and all fees charged for its purchase or use after the trial period and the requisites of cancellation of such continued use.

A violation of any of the rules set forth in this Part shall be referred to the Attorney General, Department of Financial Services and/or any other appropriate law enforcement or regulatory entity for action.