(a) This section shall be known and may be cited as the "Identity Theft Victims' Rights Act of 2004." (b) (1) A person commits the offense of identity theft who knowingly obtains, possesses, buys, or uses, the personal identifying information of another: (A) With the intent to commit any unlawful act including, but not limited to, obtaining or attempting to obtain credit, goods, services or medical information in the name of such other person; and (B) (i) Without the consent of such other person; (ii) Without the lawful authority to obtain, possess, buy or use that identifying information; or (iii) To commit a violation of § 53-11-402 or § 53-11-416 by using a prescription for a controlled substance represented as having been issued by a physician, nurse practitioner, or other health care provider. (2) For purposes of the offense of identity theft, an activity involving a possession, use or transfer that is permitted by the Tennessee Financial Records Privacy Act, compiled in title 45, chapter 10; Title V of the Gramm-Leach-Bliley Act, Pub. L. No. 106-102; or the Fair Credit Reporting Act, as amended by the Fair and Accurate Credit Transactional Act, ( 15 U.S.C. § 1681 et seq.) shall not be considered an "unlawful act". (c) (1) A person commits the offense of identity theft trafficking who knowingly sells, transfers, gives, trades, loans or delivers, or possesses with the intent to sell, transfer, give, trade, loan or deliver, the personal identifying information of another: (A) With the intent that the information be used by someone else to commit any unlawful act including, but not limited to, obtaining or attempting to obtain credit, goods, services or medical information in the name of the other person; or (B) Under circumstances such that the person should have known that the identifying information would be used by someone else to commit any unlawful act including, but not limited to, obtaining or attempting to obtain credit, goods, services or medical information in the name of the other person; and (C) The person does not have the consent of the person who is identified by the information to sell, transfer, give, trade, loan or deliver, or possess with the intent to sell, transfer, give, trade, loan or deliver, that information; and (D) The person does not have lawful authority to sell, transfer, give, trade, loan or deliver, or possess with the intent to sell, transfer, give, loan or deliver, the personal identifying information. (2) For purposes of the offense of identity theft trafficking, an activity involving a possession, use or transfer that is permitted by the Tennessee Financial Records Privacy Act; Title V of the Gramm-Leach-Bliley Act; or the Fair Credit Reporting Act, as amended by the Fair and Accurate Credit Transactional Act, shall not be considered an "unlawful act". (d) In a prosecution under subsection (c), the trier of fact may infer from the defendant's simultaneous possession of the personal identifying information of five (5) or more different individuals that the defendant possessed the personal identifying information with the intent to sell, transfer, give, trade, loan or deliver the information. However, if the defendant had the consent of one (1) or more of the individuals to possess the personal identifying information of that individual, the consenting individual shall not be counted in determining whether an inference of possession for sale may be drawn by the trier of fact. (e) As used in this section, "personal identifying information" means any name or number that may be used, alone or in conjunction with any other information, to identify a specific individual, including: (1) Name, social security number, date of birth, official state or government issued driver license or identification number, alien registration number, passport number, employer or taxpayer identification number; (2) Unique biometric data, such as fingerprint, voice print, retina or iris image, or other unique physical representation; (3) Unique electronic identification number, address, routing code or other personal identifying data which enables an individual to obtain merchandise or service or to otherwise financially encumber the legitimate possessor of the identifying data; (4) Telecommunication identifying information or access device; or (5) Any name, number, information, medical prescribing pad, electronic message, or form used by a physician, nurse practitioner, or other health care provider for prescribing a controlled substance. (f) (1) The general assembly recognizes that an offense under this section may result in more than one (1) victim. While a company or business that loses money, merchandise, or other things of value as a result of the offense is a victim, it is equally true that the person whose identity is stolen is also a victim. The person whose identity is stolen suffers definite and measurable losses including expenses necessary to cancel, stop payment on, or replace stolen items such as credit cards, checks, driver licenses, and other documents, costs incurred in discovering the extent of the identity theft, in repairing damage from the theft such as credit ratings and reports and preventing further damages from the theft, long distance telephone charges to law enforcement officials, government offices, and businesses in regard to the theft, and lost wages from the time away from work required to obtain new personal identifying information and complete all of the tasks set out in this subdivision (f)(1). In addition to measurable losses, the person whose identity is stolen also suffers immeasurable damages such as stress and anxiety as well as possible health problems resulting from or aggravated by the offense. (2) For the reasons set out in subdivision (f)(1), the general assembly declares that any person whose identity is unlawfully obtained in violation of subsection (b) or (c) is a victim of crime within the meaning of Article 1, § 35 of the Constitution of Tennessee and title 40, chapter 38. (g) (1) Notwithstanding any law to the contrary, if a private entity or business maintains a record that contains any of the personal identifying information set out in subdivision (g)(2) concerning one of its customers, and the entity, by law, practice or policy discards such records after a specified period of time, any record containing the personal identifying information shall not be discarded unless the business: (A) Shreds or burns the customer's record before discarding the record; (B) Erases the personal identifying information contained in the customer's record before discarding the record; (C) Modifies the customer's record to make the personal identifying information unreadable before discarding the record; or (D) Takes action to destroy the customer's personal identifying information in a manner that it reasonably believes will ensure that no unauthorized persons have access to the personal identifying information contained in the customer's record for the period of time between the record's disposal and the record's destruction. (2) As used in this subsection (g), "personal identifying information" means a customer's: (A) Social security number; (B) Driver license identification number; (C) Savings account number; (D) Checking account number; (E) PIN (personal identification number) or password; (F) Complete credit or debit card number; (G) Demand deposit account number; (H) Health insurance identification number; or (I) Unique biometric data. (3) (A) A violation of this subsection (g) shall be considered a violation of the Tennessee Consumer Protection Act of 1977, compiled in title 47, chapter 18, and may be punishable by a civil penalty in the amount of five hundred dollars ($500) for each record containing a customer's personal identifying information that is wrongfully disposed of or discarded; provided, however, that no total penalty may exceed ten thousand dollars ($10,000) for any one (1) customer. (B) It is an affirmative defense to any civil penalty imposed pursuant to this subsection (g) that the business used due diligence in its attempt to properly dispose of or discard the records. (4) The methods of destroying the personal identifying information of a customer set out in this subsection (g) shall be considered the minimum standards. If a private entity or business by law, practice or policy currently is required to have or otherwise has in place more stringent methods and procedures for destroying the personal identifying information in a customer's record than are required by this subsection (g), the private entity or business may continue to destroy the identifying information in the more stringent manner. (5) To the extent that this subsection (g) conflicts with applicable federal law, this subsection (g) shall not apply to an entity that is subject to the enforcement authority of the federal banking agencies, the national credit union administration, the federal trade commission or the securities and exchange commission. For any such entity, the applicable federal law shall govern the proper disposition of records containing consumer information, or any compilation of consumer information, derived from consumer reports for a business purpose. (6) Notwithstanding subdivision (g)(5), this subsection (g) shall not apply to any financial institution that is subject to the privacy and security provisions of the Gramm-Leach-Bliley Act, as amended, and as it existed on January 31, 2002. (h) (1) The following property shall be subject to seizure and judicial forfeiture to the state in the manner provided: (A) Any property, real or personal, directly or indirectly acquired by or received in violation of this section; (B) Any property, real or personal, received as an inducement to violate this section; (C) Any property, real or personal, traceable to the proceeds from the violation; (D) Any property, real or personal, used in connection with or to facilitate a violation of this section; and (E) All conveyances, including aircraft, vehicles or vessels, which are used, or are intended for use, in the commission of or escape from a violation of this section and any money, merchandise or other property contained in those conveyances. (2) Property seized pursuant to this subsection (h) shall be seized and forfeited pursuant to the procedure set out in chapter 11, part 7 of this title. (3) Notwithstanding § 39-11-713 , property seized pursuant to this subsection (h) shall be disposed of as follows: (A) All property ordered forfeited shall be sold at public auction. The proceeds from all property forfeited and sold at public auction shall be disposed of by the court as directed by this section. The attorney general and reporter shall first be compensated for all expenses incident to the litigation, as approved by the court. Any costs for appeals shall be provided for by the trial court upon conclusion of the litigation. The attorney general and reporter shall then direct that any public agency be reimbursed for out-of-pocket expenses resulting from the investigation, seizure and storage of the forfeited property; (B) Out of the proceeds remaining, the court shall order restitution be made to the person or persons whose identity was stolen for any identifiable losses resulting from the offense; and (C) The court shall then award the remainder of the funds as follows: (i) In the event that the investigating and seizing agency was a state agency, then ten percent (10%) of the funds shall be distributed to the state treasurer who shall deposit the funds in a designated account for the agency to be used in its identity theft operations; (ii) In the event that the investigating and seizing agency is the Tennessee bureau of investigation, then ten (10%) of the funds shall be distributed to the state treasurer who shall deposit the funds in a designated account for the agency to be used in its identity theft operations; (iii) In the event that the investigating and seizing agency is a local public agency, then twenty-five percent (25%) of the funds shall be distributed to its local government for distribution to the law enforcement agency for use in the enforcement of this section. When more than one (1) local public agency participated in the investigation and seizure of forfeited property as certified by the attorney general and reporter, then the court shall order a distribution of ten percent (10%) of the funds according to the participation of each local public agency. Accounting procedures for the financial administration of the funds shall be in keeping with those prescribed by the comptroller of the treasury; and (iv) The remainder of the funds shall be distributed to the state treasurer who shall deposit the funds in the general fund to defray the incarceration costs associated with the offense of identity theft trafficking defined in subsection (c). (4) For purposes of this subsection (h), a "local public agency" includes any county or municipal law enforcement agency or commission, the district attorney general, or any department or agency of local government authorized by the attorney general and reporter to participate in the investigation. (5) Funds awarded under this section may not be used to supplement salaries of any public employee or law enforcement officer. Funds awarded under this section may not supplant other local or state funds. (i) (1) Identity theft as prohibited by subsection (b) is a Class D felony. (2) Identity theft trafficking as prohibited by subsection (c) is a Class C felony. (j) (1) For purposes of this subsection (j), "victim" means the person whose personal identifying information was obtained, possessed, bought or used in violation of subsection (b), or sold, transferred, given, traded, loaned, delivered or possessed in violation of subsection (c). (2) Identity theft is a continuing offense because the offense involves an unlawful taking and use of personal identifying information that remains in the lawful possession of a victim wherever the victim currently resides or is found. As provided in this section, such unlawful taking and use are elements of the offense of identity theft and occur wherever the victim resides or is found. (3) Pursuant to § 39-11-103 and subdivision (j)(2), if a victim of identity theft resides or is found in this state, an essential element of the offense is committed in this state and a defendant is subject to prosecution in this state, regardless of whether the defendant was ever actually in this state. (4) Venue for the offense of identity theft shall be in any county where an essential element of the offense was committed, including but not limited to, in any county where the victim resides or is found, regardless of whether the defendant was ever actually in such county. (k) (1) For purposes of this subsection (k): (A) "Reencoder" means an electronic device that places encoded information from the computer chip or magnetic strip or stripe of a payment card, driver license or state or local government-issued identification card, onto the computer chip or magnetic strip or stripe of a different payment card, driver license, or state or local government-issued identification card, or any other electronic medium that allows an authorized transaction to occur; and (B) "Scanning device" means a scanner, reader or any other electronic device that is used to access, read, scan, obtain, memorize, or store, temporarily or permanently, information encoded on a computer chip or magnetic strip or stripe of a payment card, driver license, or state or local government-issued identification card. (2) (A) It is an offense for a person to use a scanning device or reencoder without the permission of the holder of the card or license from which information is being scanned or reencoded with the intent to commit, aid, or abet any criminal offense. (B) It is an offense for a person who possesses any device, apparatus, equipment, software, material, good, property, or supply that is designed or adapted for use as a scanning device or reencoder with the intent to commit, aid, or abet any criminal offense. (C) A violation of this subsection (k) is a class A misdemeanor.