MASSACHUSETTS NEW IDENTITY THEFT PROTECTION WINS APPROVAL FROM LAWMAKERS SouthCoastToday.com: Identity theft protection bill clears hurdle:

Identity theft protection bill clears hurdle

By KEN MAGUIRE

Associated Press writer

May 05, 2007 6:00 AM

BOSTON — Identity theft legislation that won approval of key lawmakers Friday would allow Massachusetts residents to place a "security freeze" on their consumer credit reports — at a cost of up to $10 per request.

The measure from the Consumer Protection Committee establishes rules for private companies and government agencies to notify people about security breaches, and for disposal of old records that contain personal information such as Social Security numbers.

"It's not the cure-all but I think it does offer a lot of protection to consumers," said Sen. Michael Morrissey, D-Quincy.

Morrissey and fellow committee co-chairman Rep. Michael Rodrigues, D-Fall River, agreed Friday to send the bill out of committee and to the House for full debate. Both said they expect the measure to be amended before final passage.

Morrissey said he opposes the provision that would require businesses and government agencies to shred or otherwise destroy documents.

"It causes a lot of problems for the retail community," he said.

But Rodrigues said thieves regularly search through trash bins for information that would allow them to assume someone's identity and obtain credit cards.

"Those documents must be shredded," he said.

Massachusetts is among just six states without a comprehensive identity theft law, consumer protection advocates said.

Under this measure, Massachusetts residents would have to request in writing a security freeze, which would prohibit a credit reporting agency from releasing the consumer's report without authorization.

Identity theft thieves use personal information to apply for credit, and often get instant approval at retail stores after the stores run a quick credit check.

There are three credit reporting agencies, so a true freeze would cost a total of $30. The bill also would allow the credit reporting agencies to charge $10 to "unfreeze" each request.

Eric Bourassa, a consumer advocate at the Massachusetts Public Interest Research Group, said states that are passing laws now are limiting the fees to $5.

"That's the new standard," he said, citing Maryland, Minnesota and Montana as states that limit fees to $5.

Morrissey defended the $10 fee as "consistent with a number of other states."

Identity theft victims would be exempt from the fee, under the bill.

Sen. Jarrett Barrios, D-Cambridge, has advocated for lower fees but was generally supportive of the bill

"With more protection built in, it would be a major victory for consumers," he said.

Identity theft hit home when Framingham-based TJX Cos., the owner of nearly 2,500 discount stores including T.J. Maxx and Marshalls, disclosed on Jan. 17 that a breach of itscomputer systems exposed at least 45 million credit and debit cards to potential fraud.

Independent organizations that track data thefts say the TJX case is believed to be the largest in the U.S. based on the number of customer records compromised.

The bill would require companies and government agencies to notify consumers and the state attorney general's office of security breaches. Consumers could be notified by mail, e-mail, or if the number of people affected is more than 500,000, via announcement on the company's Web site.

Notice may be delayed if a law enforcement agency indicates that notice would impede an investigation.

TJX officials initially said that they discovered their security breach in mid-December, but it was kept confidential upon the request of law enforcement officials.