Consumers will have a new way to protect themselves against identity theft, and businesses will have more responsibility to shield personal information from data-security breaches under an Oregon law that took effect Monday.
Gov. Ted Kulongoski unveiled guides for businesses and consumers to help explain the law.
"Identity theft can wreak economic havoc on Oregonians, and it also is extremely costly for the business from where the information was stolen," Kulongoski said.
The 2007 Legislature passed Senate Bill 583, which was negotiated by business and consumer representatives.
Consumers can invoke security freezes on their credit files maintained by the three major credit-reporting agencies. There is no fee if a person is a victim of identity theft and has reported the theft of personal information to the police.
"They gain a powerful new tool to fight identity theft," said Laura Etherton, a consumer advocate for the Oregon State Public Interest Research Group.
Businesses and other agencies will have to notify customers if personal information, such as Social Security or driver's license numbers, are disclosed in a data-security breach. They also cannot publicly display Social Security numbers, or use those numbers on cards or documents. The ban does not apply to internal verification purposes, or to records that state law requires to be made available to the public.
Jimmie Wilkins, director of the Small Business Development Center at Chemeketa Community College, said businesses should not find it difficult to comply with those requirements.
"Are businesses vulnerable? Yes," Wilkins said. "But identity thieves are going to go for easy targets. I think this is a good opportunity for businesses to become aware of the duty they have to protect personal information."
Oregon ranked 13th-highest in the nation per capita in 2006, based on the number of complaints filed with the Federal Trade Commission about identity theft.
One other requirement will take effect Jan. 1. Businesses will have to devise and put into effect reasonable safeguards to protect personal information against unauthorized disclosure.
pwong@StatesmanJournal.com or (503) 399-6745
Freezing a credit report
Below is some information provided by the Oregon State Public Interest Research Group about how consumers can invoke a security freeze on their credit reports.
Web site: www.ospirg.org
Identity Theft Prevention Security Freeze Information for Oregonians
If your personal information has fallen into the hands of identity thieves, it's all too easy for them to open new credit accounts in your name. As of October 2007, Oregonians have the right to a security freeze -- a tool to block identity thieves from opening fraudulent accounts, even if they've accessed your personal information.
What is a security freeze?
A security freeze is the right to control access your own credit report by protecting it with a passcode, like a personal identification number for an automated teller machine. It doesn't interfere with existing accounts. It only blocks unauthorized new accounts.
Why it works:
A potential creditor won't issue new credit (such as a credit card, cell phone account or car loan) without reviewing a consumer's credit report. If only the actual consumer can grant access to the credit report, thieves are blocked from opening new accounts.
Keep in mind that a security freeze will not prevent a thief from misusing your existing credit cards and accounts. A security freeze is a targeted tool to prevent the most expensive and damaging form of identity theft -- the opening of new, fraudulent accounts in your name.
How to place a freeze
Contact each of the three national credit-reporting agencies: Equifax, Experian, or Transunion. You can contact them in writing, or, if they have one, fill out a secure form on their Web site. Within 10 days, the agencies will send you your pass code and instructions for how to temporarily lift, or permanently remove, the freeze.
You can fill out and print a security freeze form at the following state of Oregon Web site:
http://www.cbs.state.or.us/dfcs/identity_theft/security_freeze.html
Contact information for the three credit-reporting agencies regarding a security freeze:
TransUnion
Fraud Victim Assistance Department
P.O. Box 6790
Fullerton, CA 92834-6790
Equifax
Equifax Security Freeze
P.O. Box 105788
Atlanta, GA 30348
Experian
Experian Security Freeze
P.O. Box 9554
Allen, TX 75013
How to lift a freeze
Follow the instructions provided by each of the credit-reporting agencies. You'll need to provide them with your password, identification, and the amount of time you want to temporarily lift your freeze for. Each of the credit reporting agencies must lift your freeze no later than three business days after receiving the request.
How to remove a freeze
Follow the instructions provided by each of the credit reporting agencies, providing them with your passcode and identification. Each of the credit reporting agencies must remove your freeze within three business days of receiving a request.
Cost
The freeze is free for victims of identity theft. Credit reporting agencies can charge Oregonians who aren't yet identity theft victims no more than $10 for each freeze, for each lifting of the freeze, for removal of the freeze, and to replace a pass code.
Links
Web sites:
State of Oregon:
http://www.oregon.gov, click on "Oregon Identity Theft Prevention Act."
State Division of Finance and Corporate Securities:
http://www.dfcs.oregon.gov, click on "identity theft."
Small Business Development Centers:
http://www.bizcenter.org
Oregon State Public Interest Research Group (OSPIRG):
http://www.ospirg.org
Federal Trade Commission:
http://www.ftc.gov/identitytheft
Copyright 2007 Statesman Journal, Salem, Oregon
