(1) If the prospective user is a retail seller, and intends to issue credit to a consumer who appears in person on the basis of an application for credit submitted in person, the credit bureau shall, with a reasonable degree of certainty, match at least three (3) categories of identifying information within the file maintained by the credit bureau on the consumer with the information provided to the credit bureau by the retail seller. The categories of identifying information may include, but are not limited to, first and last name, month and date of birth, driver's license number, place of employment, current residence address, previous residence address, or social security number. The categories of information shall not include mother's maiden name.

(2) If the prospective user is a retail seller, and intends to issue credit to a consumer who appears in person on the basis of an application for credit submitted in person, the retail seller shall certify in writing, to the credit bureau that it instructs its employees and agents to inspect a photo identification of the consumer at the time the application was submitted in person. This paragraph shall not apply to an application for credit submitted by mail.

(3) If the prospective user intends to extend credit by mail pursuant to a solicitation by mail, the extension of credit shall be mailed to the same address as on the solicitation unless the prospective user verifies any address change by, among other methods, contacting the person to whom the extension of credit will be mailed.

(b) Whenever a credit bureau prepares a consumer credit report, it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates. These reasonable procedures shall include, but not be limited to, permanent retention by the credit bureau in the consumer's file, or a separately individualized file, of that portion of the data in the file that is used by the credit bureau to identify the individual consumer pursuant to paragraph (1) of subdivision (a). This permanently retained data shall be available for use in either a credit reinvestigation, an investigation where the consumer has filed a police report, or a restoration of a file involving the consumer. If the permanently retained identifying information is retained in a consumer's file, it shall be clearly identified in the file in order for an individual who reviews the file to easily distinguish between the permanently stored identifying information and any other identifying information that may be a part of the file. This retention requirement shall not apply to data that is reported in error, that is obsolete, or that is found to be inaccurate through the results of a reinvestigation initiated by a consumer.

(c) No credit bureau may prohibit any user of any consumer credit report furnished by the credit bureau from disclosing the contents of the consumer credit report to the consumer who is the subject of the report if adverse action may be taken by the user based in whole or in part on the consumer credit report. The act of disclosure to the consumer by the user of the contents of a consumer credit report shall not be a basis for liability of the consumer credit reporting agency or the user.

6-13.1-29. Civil penalty for identity theft. - (a) Any person who suffers damages as a result of a violation of section 6-13.1-28 by any person may bring an action in a court of appropriate jurisdiction against that person to recover the following:

(1) In the case of a negligent violation, actual damages, including court costs, loss of wages, attorneys' fees and, when applicable, pain and suffering;

(2) In the case of a willful violation:

(A) Actual damages as set forth in paragraph (1) above;

(B) Punitive damages of not less than one hundred dollars ($100) nor more than five thousand dollars ($5,000) for each violation as the court deems proper;

(C) Any other relief which the court deems proper.

(3) In the case of liability of a natural person for obtaining a consumer credit report under false pretenses or knowingly without a permissible purpose, an award of actual damages pursuant to paragraph (1) or subparagraph (A) of paragraph (2) shall be in an amount of not less than two thousand five hundred dollars ($2,500).

(b) Injunctive relief shall be available to any person aggrieved by a violation or a threatened violation of this chapter whether or not the person seeks any other remedy under this section.

(c) Notwithstanding any other provision of this section, any person who willfully violates any requirement imposed under this chapter may be liable for punitive damages in the case of a class action, in an amount that the court may allow. In determining the amount of award in any class action, the court shall consider among relevant factors the amount of any actual damages awarded, the frequency of the violations, the resources of the violator and the number of persons adversely affected.

(d) The prevailing parties in any action commenced under this section shall be entitled to recover court costs and reasonable attorneys' fees, unless the plaintiff only seeks and obtains injunctive relief to compel compliance with this title. If the plaintiff only seeks and obtains injunctive relief to compel compliance with this chapter, court costs and reasonable attorneys' fees may be awarded. The provisions of this section shall be in addition to and not in lieu of any other remedy available to the person.

CHAPTER 41.3
THEFT OF PERSONAL IDENTIFYING INFORMATION

(b) "Personal identifying information" as used in this section, means the name, address, telephone number, driver's license number, social security number, place of employment, employee identification number, mother's maiden name, demand deposit account number, savings account number, or credit card number of an individual person.