S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   5242
 
                        2017-2018 Regular Sessions
 
                           I N  A S S E M B L Y
 
                             February 7, 2017
                                ___________
 
 Introduced by M. of A. DINOWITZ -- read once and referred to the Commit-
   tee on Consumer Affairs and Protection
 
 AN  ACT  to  amend the general business law, in relation to the identity
   theft protection services
 
   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:

   Section  1.  Section  393-b  of  the general business law, as added by
 chapter 433 of the laws of 2005, is amended to read as follows:
   § 393-b. [Written solicitation] CREDIT CARD  PROTECTION  SERVICES.  1.
 [Any written] FOR THE PURPOSES OF THIS SECTION:
   (A)  "CLEARLY  AND  PROMINENTLY" MEANS: (I) IN WRITTEN COMMUNICATIONS,
 INCLUDING PRINT AND THOSE MADE THROUGH AN  ELECTRONIC  MEDIUM  (SUCH  AS
 VIDEO AND INTERACTIVE MEDIA INCLUDING, BUT NOT LIMITED TO, THE INTERNET,
 ONLINE  SERVICES,  AND  ELECTRONIC  MAIL) THE MESSAGE SHALL BE IN A TYPE
 SIZE SUFFICIENTLY NOTICEABLE  FOR  AN  ORDINARY  CONSUMER  TO  READ  AND
 COMPREHEND  IT, IN TYPE THAT CONTRASTS WITH THE BACKGROUND AGAINST WHICH
 IT APPEARS; AND (II) IN ORAL COMMUNICATIONS, THE MESSAGE SHALL BE DELIV-
 ERED IN A VOLUME AND CADENCE SUFFICIENT FOR AN ORDINARY CONSUMER TO HEAR
 IT AND COMPREHEND IT. IF ANY COMMUNICATION IS PRESENTED  SOLELY  THROUGH
 ORAL,  WRITTEN,  OR  VISUAL MEANS, THE MESSAGE SHALL BE MADE THROUGH THE
 SAME MEANS. REGARDLESS OF THE MEDIUM USED TO DISSEMINATE IT, THE MESSAGE
 SHALL BE IN UNDERSTANDABLE LANGUAGE AND SYNTAX.   NOTHING  CONTRARY  TO,
 INCONSISTENT  WITH, OR IN MITIGATION OF THE MESSAGE SHALL BE USED IN ANY
 COMMUNICATION.
   (B) "CREDIT CARD PROTECTION  SERVICE"  MEANS  A  SERVICE  TO  PROTECT,
 INDEMNIFY,  OR  REIMBURSE  THE  CREDIT  CARD  HOLDER AGAINST THE LOSS OR
 MISUSE OF THE CREDIT CARD. SUCH TERM SHALL INCLUDE, BUT NOT  BE  LIMITED
 TO,  SERVICES  THAT OFFER TO OBTAIN ACCESS TO CREDIT REPORTS, PROVIDE AN
 EXPLANATION OF CREDIT ENTRIES ON THE  REPORT,  IDENTIFY  THOSE  ENTITIES
 THAT  HAVE ACCESSED THE REPORT, AND PROVIDE CREDIT CARD PROTECTION SECU-
 RITY SERVICES.
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
              

                                                            LBD03183-01-7

 A. 5242                             2
 
   2. IN ANY solicitation to enter into an agreement for  various  credit
 card protection services THE ENTITY OFFERING SUCH SERVICES shall CLEARLY
 AND PROMINENTLY:
   (A)  disclose  that the purchase of credit card protection services or
 the renewal thereof is not required for a consumer to secure  or  retain
 his or her credit card; and
   (B) BY MEANS OF a concise statement [regarding] INFORM THE CONSUMER OF
 his  or  her  rights  that  already exist free of charge under the "Fair
 Credit Billing Act" and the regulations thereunder,  as  such  acts  and
 regulations  may from time to time be amended. [A credit card protection
 service means a service to protect, indemnify, or reimburse  the  credit
 card  holder  against  the  loss or misuse of the credit card. Such term
 shall include  services  provided  along  with  credit  card  protection
 services for the same price, including, but not be limited to, access to
 credit  reports,  an  explanation  of  credit entries on the report, the
 identification of those who have accessed the report, and insurance  and
 security  services.]  No  agreement  for CREDIT CARD PROTECTION services
 shall provide that services will be automatically renewed on  an  annual
 basis  and  the  consumer  billed,  unless  the consumer in the expiring
 agreement is notified not more than sixty days and not less than fifteen
 days prior to the termination of the existing agreement by mail  of  the
 credit  protection  service  provider's intention to automatically renew
 the agreement.
   [2.] 3. Whenever there shall be a violation of this section,  applica-
 tion  may  be  made by the attorney general in the name of the people of
 the state of New York to a court or justice  having  jurisdiction  by  a
 special  proceeding  to  issue  an  injunction,  and  upon notice to the
 defendant of not less than five days, to enjoin and restrain the contin-
 uance of such violations; and if it shall appear to the satisfaction  of
 the  court  or  justice  that  the defendant has, in fact, violated this
 section, an injunction may be issued by such court or justice, enjoining
 and restraining any further violation, without requiring proof that  any
 person  has,  in  fact,  been  injured  or  damaged thereby. In any such
 proceeding, the court may make allowances to  the  attorney  general  as
 provided  in  paragraph  six  of subdivision (a) of section eighty-three
 hundred three of the civil practice law and rules, and  direct  restitu-
 tion.  Whenever  the  court  shall  determine  that  a violation of this
 section has occurred, the court may impose a civil penalty of  not  more
 than  one  thousand  dollars  for each violation. In connection with any
 such proposed application, the attorney general is  authorized  to  take
 proof  and  make  a  determination  of  the  relevant facts and to issue
 subpoenas in accordance with the civil practice law and rules.
   § 2. The general business law is amended by adding a new section  393-
 bb to read as follows:
   §  393-BB.  IDENTITY THEFT PROTECTION SERVICES. 1. FOR THE PURPOSES OF
 THIS SECTION:
   (A) "CLEARLY AND PROMINENTLY" MEANS: (I)  IN  WRITTEN  COMMUNICATIONS,
 INCLUDING  PRINT  AND  THOSE  MADE THROUGH AN ELECTRONIC MEDIUM (SUCH AS
 VIDEO AND INTERACTIVE MEDIA INCLUDING, BUT NOT LIMITED TO, THE INTERNET,
 ONLINE SERVICES, AND ELECTRONIC MAIL) THE MESSAGE SHALL  BE  IN  A  TYPE
 SIZE  SUFFICIENTLY  NOTICEABLE  FOR  AN  ORDINARY  CONSUMER  TO READ AND
 COMPREHEND IT, IN TYPE THAT CONTRASTS WITH THE BACKGROUND AGAINST  WHICH
 IT APPEARS; AND (II) IN ORAL COMMUNICATIONS, THE MESSAGE SHALL BE DELIV-
 ERED IN A VOLUME AND CADENCE SUFFICIENT FOR AN ORDINARY CONSUMER TO HEAR
 IT  AND  COMPREHEND IT. IF ANY COMMUNICATION IS PRESENTED SOLELY THROUGH
 ORAL, WRITTEN, OR VISUAL MEANS, THE MESSAGE SHALL BE  MADE  THROUGH  THE

 A. 5242                             3
 
 SAME MEANS. REGARDLESS OF THE MEDIUM USED TO DISSEMINATE IT, THE MESSAGE
 SHALL  BE  IN  UNDERSTANDABLE LANGUAGE AND SYNTAX.  NOTHING CONTRARY TO,
 INCONSISTENT WITH, OR IN MITIGATION OF THE MESSAGE SHALL BE USED IN  ANY
 COMMUNICATION.
   (B)  "IDENTITY  THEFT  PROTECTION  SERVICE"  MEANS A SERVICE MARKETED,
 DESCRIBED AND SOLD AS A SERVICE TO  PROTECT  A  CONSUMER  FROM  IDENTITY
 THEFT. SUCH TERM SHALL INCLUDE, BUT NOT BE LIMITED TO, SERVICES THAT:
   (I) NOTIFY CONSUMERS WHEN NEW CREDIT IS OPENED IN HIS OR HER NAME;
   (II)  MONITOR  THE  CONSUMER'S  CREDIT REPORT FOR ANY CHANGES THAT MAY
 INDICATE FRAUDULENT ACTIVITY AND NOTIFY THE CONSUMER OF SUCH ACTIVITY;
   (III) PROVIDE THE IDENTIFICATION OF THOSE WHO HAVE OBTAINED ACCESS  TO
 THE CONSUMER'S CREDIT REPORT;
   (IV) PLACE, RENEW, OR UPDATE FRAUD ALERTS OR SECURITY FREEZES; OR
   (V) ASSIST CONSUMERS BY OBTAINING A LIMITED POWER OF ATTORNEY FROM THE
 CONSUMER.  SUCH  TERM  SHALL  NOT INCLUDE IDENTITY THEFT GROUP INSURANCE
 POLICIES ISSUED PURSUANT TO SECTION THREE THOUSAND FOUR  HUNDRED  FIFTY-
 ONE OF THE INSURANCE LAW.
   2.  (A)  IN  ANY  SOLICITATION TO ENTER INTO AN AGREEMENT FOR IDENTITY
 THEFT PROTECTION SERVICES THE ENTITY OFFERING SUCH SERVICES SHALL CLEAR-
 LY AND PROMINENTLY, BY MEANS OF A CONCISE STATEMENT, INFORM THE CONSUMER
 OF HIS OR HER RIGHTS THAT ALREADY EXIST FREE OF CHARGE UNDER THE FEDERAL
 FAIR CREDIT REPORTING ACT AND THE  REGULATIONS  THEREUNDER  AND  ARTICLE
 TWENTY-FIVE  OF THIS CHAPTER, AS SUCH ACTS AND REGULATIONS MAY FROM TIME
 TO TIME BE AMENDED.
   (B) NO AGREEMENT FOR IDENTITY THEFT PROTECTION SERVICES SHALL  PROVIDE
 THAT  SERVICES  WILL BE AUTOMATICALLY RENEWED ON AN ANNUAL BASIS AND THE
 CONSUMER BILLED, UNLESS THE CONSUMER IN THE EXPIRING AGREEMENT IS  NOTI-
 FIED  NOT  MORE  THAN SIXTY DAYS AND NOT LESS THAN FIFTEEN DAYS PRIOR TO
 THE TERMINATION OF THE EXISTING AGREEMENT BY MAIL OF THE IDENTITY  THEFT
 PROTECTION  SERVICE  PROVIDER'S  INTENTION  TO  AUTOMATICALLY  RENEW THE
 AGREEMENT.
   3. WHENEVER THERE SHALL BE A VIOLATION OF  THIS  SECTION,  APPLICATION
 MAY  BE  MADE  BY  THE ATTORNEY GENERAL IN THE NAME OF THE PEOPLE OF THE
 STATE OF NEW YORK TO A COURT OR JUSTICE HAVING JURISDICTION BY A SPECIAL
 PROCEEDING TO ISSUE AN INJUNCTION, AND UPON NOTICE TO THE  DEFENDANT  OF
 NOT  LESS THAN FIVE DAYS, TO ENJOIN AND RESTRAIN THE CONTINUANCE OF SUCH
 VIOLATIONS; AND IF IT SHALL APPEAR TO THE SATISFACTION OF THE  COURT  OR
 JUSTICE  THAT  THE  DEFENDANT  HAS,  IN  FACT, VIOLATED THIS SECTION, AN
 INJUNCTION MAY BE  ISSUED  BY  SUCH  COURT  OR  JUSTICE,  ENJOINING  AND
 RESTRAINING  ANY  FURTHER  VIOLATION,  WITHOUT  REQUIRING PROOF THAT ANY
 PERSON HAS, IN FACT, BEEN  INJURED  OR  DAMAGED  THEREBY.  IN  ANY  SUCH
 PROCEEDING,  THE  COURT  MAY  MAKE ALLOWANCES TO THE ATTORNEY GENERAL AS
 PROVIDED IN PARAGRAPH SIX OF SUBDIVISION  (A)  OF  SECTION  EIGHTY-THREE
 HUNDRED  THREE  OF THE CIVIL PRACTICE LAW AND RULES, AND DIRECT RESTITU-
 TION. WHENEVER THE COURT  SHALL  DETERMINE  THAT  A  VIOLATION  OF  THIS
 SECTION  HAS  OCCURRED, THE COURT MAY IMPOSE A CIVIL PENALTY OF NOT MORE
 THAN ONE THOUSAND DOLLARS FOR EACH VIOLATION.  IN  CONNECTION  WITH  ANY
 SUCH  PROPOSED  APPLICATION,  THE ATTORNEY GENERAL IS AUTHORIZED TO TAKE
 PROOF AND MAKE A DETERMINATION  OF  THE  RELEVANT  FACTS  AND  TO  ISSUE
 SUBPOENAS IN ACCORDANCE WITH THE CIVIL PRACTICE LAW AND RULES.
   §  3.  This  act shall take effect on the ninetieth day after it shall
 have become a law; provided, however  that  effective  immediately,  the
 addition,  amendment  and/or  repeal of any rule or regulation necessary
 for the implementation of this act on its effective date are  authorized
 and directed to be made and completed on or before such effective date.