House Amendment 8188 PAG LIN 1 1 Amend House File 2610 as follows: 1 2 #1. Page 5, by inserting after line 12 the 1 3 following: 1 4 <Sec. . NEW SECTION. 422.72A SUSPECTED MISUSE 1 5 OF PERSONAL INFORMATION == NOTICE REQUIRED. 1 6 1. For the purposes of this section, the following 1 7 definitions apply: 1 8 a. "Affected individual" means an individual who 1 9 is identified by or connected with personal 1 10 information contained in the department's records. 1 11 b. "Personal information" means all of the 1 12 following: 1 13 (1) Social security number. 1 14 (2) Tax identification number. 1 15 (3) Driver's license number or other unique 1 16 identification number created or collected by a 1 17 government body. 1 18 (4) Financial account number, credit card number, 1 19 or debit card number in combination with any required 1 20 security code, access code, or password that would 1 21 permit access to an individual's financial account. 1 22 (5) Unique electronic identifier or routing code, 1 23 in combination with any required security code, access 1 24 code, or password. 1 25 c. "Suspected misuse of personal information" 1 26 means circumstances exist which would cause a 1 27 reasonable person to believe that an individual's 1 28 personal information is being used by an unauthorized 1 29 individual. Such circumstances include but are not 1 30 limited to either of the following: 1 31 (1) A tax identification number under which wages 1 32 are being reported by two or more individuals. 1 33 (2) A tax identification number of an individual 1 34 under the age of sixteen with reported wages exceeding 1 35 one thousand dollars for a single quarterly period. 1 36 2. a. Unless otherwise prohibited by state or 1 37 federal law, the department shall provide notice to 1 38 each affected individual if department records 1 39 indicate a suspected misuse of personal information. 1 40 Notice shall be made without unreasonable delay. If 1 41 the affected individual is a minor, notice shall be 1 42 provided to the minor's parent or guardian. 1 43 b. Notice of the suspected misuse of personal 1 44 information shall also be provided to an appropriate 1 45 law enforcement agency. 1 46 3. Notice provided to an affected individual shall 1 47 be clear and conspicuous and be provided by at least 1 48 one of the following: 1 49 a. Written notice to the affected individual's 1 50 last address of record. 2 1 b. Electronic mail notice, if the affected 2 2 individual has agreed to receive communications 2 3 electronically. 2 4 c. Telephonic notice, if the communication is made 2 5 directly with the affected individual.> 2 6 #2. Title page, line 1, by inserting after the 2 7 word <to> the following: <identity determination and 2 8 protection and>. 2 9 #3. Title page, line 3, by inserting after the 2 10 word <individuals,> the following: <and requiring the 2 11 department of revenue to provide notice of suspected 2 12 misuse of personal information,>. 2 13 #4. By renumbering as necessary. 2 14 2 15 2 16 2 17 SANDS of Louisa 2 18 HF 2610.703 82 2 19 ak/rj/11215 -1-