Int 0139-2004

Be it enacted by the Council as follows: Section One. Legislative declaration. The Council finds that acts of identity theft are plaguing New Yorkers. Federal Trade Commission statistics for 2002 and 2003 indicate that identity theft is the single most common consumer fraud complaint in the nation. New York City residents are as likely to be victimized by identity theft as the citizens of many cities within the United States. The Council further finds that identity thieves are constantly developing new ways to harm consumers. Some hack into computer systems storing sensitive information and misuse the contents to defraud innocent victims. Others obtain personal information by stealing paper records or manipulating consumers to unknowingly surrender such data. Most recently, the practice of “skimming,” or swiping an Automated Teller Machine card or credit card in a device programmed to steal the personal identification encoded in the card, has facilitated identity theft in small businesses throughout the City. Skimming can be done with a hand-held device or through an instrument installed in a seemingly innocuous Automated Teller Machine. The Council finds that such acts harm individual consumers and tarnish the good name of hard-working, upstanding New York City business people. Those few bad actors who use their professional resources to engage in identity theft should not be permitted to profit from City residents or act as authorized licensees of the City. The Council thus finds it necessary and appropriate to prevent chronic identity thieves from receiving or maintaining licenses from the Department of Consumer Affairs. §2. Section 20-104 of the administrative code of the city of New York is amended by adding a new subdivision g, to read as follows: g. The commissioner may refuse to issue or renew any license issued in accordance with the provisions of chapter two of this title and may suspend or revoke any such license, after due notice and opportunity to be heard, upon the occurrence of any one or more of the following conditions: 1. Two or more judgments within a two-year period against the applicant or licensee for theft of identity as defined in section three hundred eighty-s of the general business law; or 2. One criminal conviction against the applicant or licensee for acts of identity theft or unlawful possession of personal identification information as defined in article one hundred ninety of the penal law; or 3. Two or more criminal convictions within a two-year period of any employees or associates of the applicant or licensee for acts of identity theft or unlawful possession of personal identification information as defined in article one hundred ninety of the penal law that are committed with the use of the applicant’s or licensee’s equipment, data, technology, or other similar resource. It shall be an affirmative defense that a applicant or licensee did not have reasonable grounds to believe the proscribed acts were taking place with the use of the licensee’s equipment, data, technology, or other similar resource or that the proscribed acts were not taking place with the use of the applicant’s or licensee’s equipment, data, technology, or other similar resource. §3. Chapter 1 of title 20 of the administrative code of the city of New York is amended by adding a new section 20-118, to read as follows: § 20-118 Notifications regarding identity theft. Any person, firm, partnership, corporation or association required to be licensed under chapter two, or pursuant to provisions of state law enforced by the department, shall immediately notify the department upon the occurrence of a judgment against such person, firm, partnership, corporation or association for theft of identity; a conviction of such person, firm, partnership, corporation or association of an offense specified in subdivision g of section 20-104 of this chapter; or a conviction of the person’s, firm’s, partnership’s, corporation’s or association’s employees or associates for acts of identity theft or unlawful possession of personal identification information as defined in article one hundred ninety of the penal law that are committed with the use of the person’s, firm’s, partnership’s, corporation’s or association’s equipment, data, technology, or other similar resource. §4. This local law shall take effect 120 days after it shall have been enacted into law; provided that the commissioner may take any actions necessary prior to such effective date for the implementation of this local law including, but not limited to, establishing guidelines and promulgating rules.