HB 686-FN – AS AMENDED BY THE HOUSE

18Mar2008… 0687h

18Mar2008… 1021h

2007 SESSION

07-0302

05/10

HOUSE BILL 686-FN

AN ACT relative to the regulation of remotely readable devices and the illegal use of payment card scanning devices or reencoders.

SPONSORS: Rep. Kurk, Hills 7; Rep. M. Smith, Straf 7

COMMITTEE: Commerce

AMENDED ANALYSIS

This bill:

I. Requires consumer products or identification documents with remotely readable devices to include a consumer notice to that effect.

II. Prohibits the human implantation of a remotely readable device without the individual’s informed, written consent.

III. Prohibits electronic tracking of another individual with certain limited exceptions.

IV. Amends the definition of payment card and reencoding for purposes of the crime of using a scanning device or reencoder for fraudulent purposes.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Explanation: Matter added to current law appears in bold italics.

Matter removed from current law appears [in brackets and struckthrough.]

Matter which is either (a) all new or (b) repealed and reenacted appears in regular type.

18Mar2008… 0687h

18Mar2008… 1021h

07-0302

05/10

STATE OF NEW HAMPSHIRE

In the Year of Our Lord Two Thousand Seven

AN ACT relative to the regulation of remotely readable devices and the illegal use of payment card scanning devices or reencoders.

Be it Enacted by the Senate and House of Representatives in General Court convened:

1 New Chapter; Regulation of Remotely Readable Devices. Amend RSA by inserting after chapter 358-S the following new chapter:

CHAPTER 358-T

REGULATION OF REMOTELY READABLE DEVICES

358-T:1 Definitions.

I. “Consumer” means an individual in the state of New Hampshire who consumes or uses a retail product for personal, non-commercial reasons.

II. “Consumer product” means a physical object that is, or is intended to be, used or consumed by a consumer and includes, but is not limited to food, alcoholic and nonalcoholic beverages, and prescription and nonprescription drugs, clothing, merchandise, motor vehicles, advertising and sales documents and literature, books, magazines, greeting and business cards, and any packaging intended to be removed by a consumer. A “consumer product” does not include an identification document or any product to the extent that unique identification via radio waves is an essential part of the consumer’s use, including, but not limited to, commercial mobile radio service as described in 47 U.S.C. section 332, electronic toll collection systems as defined in RSA 236:31, I(c), keys, and garage door openers.

III. “Consumer notice” means either:

(a) A graphical system designed to provide a standard way to show the presence of a remotely readable device; or

(b) Notice given with the following text: “This product contains a remotely readable device that can be read without your knowledge if it is brought within range of a reader device.”

IV. “Identification document” means any document or object containing personal information that an individual uses alone or in conjunction with any other information to establish his or her identity, to obtain health or medical care, to engage in government-regulated activities, or to engage in financial transactions. Identification documents shall include but shall not be limited to:

(a) Drivers’ licenses, identification cards, and license plates issued by the director of the division of motor vehicles, department of safety.

(b) Electronic toll collection systems as defined in RSA 236:31, I(c).

(c) Identification cards or badges issued to employees or contractors.

(d) Insurance benefit cards.

(e) Identification cards issued by schools and educational institutions.

(f) Benefit cards issued in conjunction with any government-supported aid program.

(g) Credit, debit, and financial account cards.

(h) Licenses, certificates, registrations, or other means to engage in a business or profession regulated by the state or its political subdivisions.

(i) Library cards issued by any public library.

V. “Person” means an individual, corporation, business trust, estate, trust, partnership, limited liability corporation, association, foundation, joint venture, government, government subdivision, agency or instrumentality, public corporation, or any other legal or commercial entity.

VI. “Personal information” means information that can be used to identify an individual. Such information includes an individual’s name, address, telephone and cellular telephone number, social security number, credit card and financial account numbers, driver’s license number, e-mail address, date of birth, race, religion, ethnicity, nationality, political affiliation, photograph and digital image, fingerprint or other biometric identification, and any other unique personal identifier or number.

VII. “Remotely readable device” means any item, application or mark that is passively or actively capable of transmitting an individual’s identity, characteristics, status, group membership, travel history, or location, or capable of storing or transmitting a number, symbol, signal, pattern, or other identifier that could be linked with any such identification or location information. A remotely readable device includes, but is not limited to, technologies that use radio waves to identify individual objects, such as radio frequency identification.

VIII. “Track” means to locate, follow, or plot the path of an individual by means of a remotely readable device, but shall not include locating technology used by the enhanced 911 system or commercial mobile radio service pursuant to 47 U.S.C. Section 332.

358-T:2 Notice Required; Consumer Products.

I. No person shall manufacture a consumer product or identification document to which a remotely readable device has been affixed or implanted, which is intended to be offered for sale or provided to a consumer, without a consumer notice affixed to the consumer product, identification document, or its packaging.

II. Consumer products to which a remotely readable device has been affixed or implanted, which are offered for loan or rental without an original, manufacturer’s consumer notice, shall include either:

(a) A consumer notice; or

(b) The following notice: “This (specify product type) may contain a remotely readable device which can be read without your knowledge if it is brought within range of a reader device.”

III. Any notice provided pursuant to this subparagraph shall be given in a clear and conspicuous manner.

IV. No consumer notice required under paragraph I may be removed until it has been sold or provided to a consumer.

358-T:3 Human Implantation of Remotely Readable Device Prohibited.

I. No person shall implant or attempt to implant or physically incorporate a remotely readable device into or on the body, skin, teeth, hair or nails of another individual without the prior, informed written consent of the individual. Consent of a guardian, guardian ad litem, attorney-in-fact, or parent of a minor child shall be considered adequate consent, unless a written instrument executed by the individual precludes implantation or physical incorporation. Use of a bracelet or other readily removable device is not considered implantation or physical incorporation under this section.

II. No individual shall be offered an incentive, denied an opportunity, or in any way treated by a person differently from any other individual as a consequence of providing or withholding such consent.

III. No person shall use the presence or absence of an implanted remotely readable device as a basis for discriminating against an individual for any purpose whatsoever, including, but not limited to, employment, housing, insurance, medical care, voting, education, travel, and commerce.

358-T:4 Restrictions on State Use of Remotely Readable Devices.

I. The state or a political subdivision, department, or agency shall not issue, or permit others to issue on its behalf, any identification document that contains a remotely readable device or uses remotely readable devices to locate an individual, either directly or indirectly through other persons, except in the following circumstances:

(a) To locate a person who is incarcerated in the state prison or county jail, is housed in a mental health facility pursuant to a court order after having been charged with a crime, is subject to court-ordered electronic monitoring, or is a resident of a state or county hospital, nursing facility or assisted living facility.

(b) When the remotely readable device is implanted in an identification document that is to be used on a toll road or bridge owned or operated by the state or a political subdivision, department, or agency thereof, but only for the specific purpose of collecting funds for the use of that road or bridge.

(c) An identification document that is issued to a person for the limited purpose of facilitating secure access by the identification document holder to a secured public building or parking area.

(d) The identification document is part of a contactless identification document system used by the state or a political subdivision, department, or agency of the state that is operational and in use prior to January 1, 2007.

(e) Credit, debit, or financial account cards issued to a person for use on behalf of the state or a political subdivision, department, or agency of the state, provided that such card complies with RSA 358-T:2.

II. No identification document permitted under this section shall contain, transmit, or enable the remote reading of any personal information other than a unique personal identifier number which is not a social security number.

III. This section shall not apply to the court authorized use of remotely readable devices by law enforcement officials.

358-T:5 Electronic Tracking Prohibited. Except as otherwise provided in this chapter, no person may track an individual without a valid court order or the consent of the person being tracked. Notwithstanding the foregoing, a person may track property owned or otherwise legally possessed where the person has reason to believe the property is being used in violation of the person’s property interests.

358-T:6 Penalties.

I. Any person convicted of violating RSA 358-T:2 or RSA 358-T:5 shall be guilty of a misdemeanor if a natural person and a felony if any other person. Each such act shall constitute a separate offense.

II. Any person convicted of violating RSA 358-T:3 shall be guilty of a class B felony.

III. An aggrieved individual or the state may bring suit for civil penalties for up to $1,000 or actual damages, whichever is greater, plus court costs and reasonable attorney’s fees, for each violation of this chapter.

2 Illegal Use of Payment Card Scanning Device or Reencoder. Amend RSA 638:28, I-III to read as follows:

I. “Scanning device” means a scanner, reader, or any other electronic device that is used to access, read, scan, obtain, memorize, or store, temporarily or permanently, information encoded on [the magnetic strip or stripe of] or in a payment card.

II. “Reencoder” means an electronic device that places encoded information from [the magnetic strip or stripe of] a payment card onto [the magnetic strip or stripe of] or into a different payment card.

III. “Payment card” means a credit card, charge card, debit card, or any other card or device that is issued to an authorized [card] user and that allows the user to obtain, purchase, or receive goods, services, money, or anything else of value from a merchant.

3 Illegal Use of Payment Card Scanning Device or Reencoder. Amend RSA 638:29, I to read as follows:

I. A person is guilty of the crime of using a scanning device or reencoder to defraud when the person knowingly:

(a) Uses a scanning device to access, read, obtain, memorize, or store, temporarily or permanently, information encoded on [the magnetic strip or stripe of a] or in a payment card without the permission of the authorized user of the payment card and with the intent to defraud the authorized user, the issuer of the authorized user’s payment card, or a merchant; or

(b) Uses a reencoder to place information encoded on [the magnetic strip or stripe of a] or into a different payment card onto [the magnetic strip or stripe of] or into a different card without the permission of the authorized user of the card from which the information is being reencoded and with the intent to defraud the authorized user, the issuer of the authorized user’s payment card, or a merchant.

4 Consumer Notice. Amend RSA 358-T:1, III(a) to read as follows:

(a) A graphical system designed to provide a standard way to show the presence of a remotely readable device, and if an RFID transponder, its frequency and data structure; or

5 Effective Date.

I. Section 4 of this act shall take effect January 1, 2013.

II. The remainder of this act shall take effect January 1, 2009.

LBAO

07-0302

Amended 04/28/08

HB 686 FISCAL NOTE

AN ACT relative to the regulation of remotely readable devices and the illegal use of payment card scanning devices or reencoders.

FISCAL IMPACT:

METHODOLOGY: