SENATE MEMORIAL 12

53rd legislature - STATE OF NEW MEXICO - second session, 2018

INTRODUCED BY

Elizabeth “Liz” Stefanics

A MEMORIAL

REQUESTING THE ATTORNEY GENERAL TO ANALYZE THE GENERAL COMPLIANCE WITH THE NOTIFICATION REQUIREMENTS OF THE DATA BREACH NOTIFICATION ACT STEMMING FROM THE 2017 EQUIFAX DATA BREACH AND THE METHODS USED BY SOME STATES TO ELIMINATE CHARGES TO INDIVIDUAL CONSUMERS SEEKING TO PLACE A FREEZE, OR LOCK, ON THEIR CREDIT REPORTS; REQUESTING A REPORT.

     WHEREAS, the Data Breach Notification Act was enacted in 2017 and became effective on June 16, 2017; and

     WHEREAS, Equifax is one of three nationwide credit report service providers that collects the personal information of many New Mexico residents; and

     WHEREAS, on September 7, 2017, Equifax reported to the federal trade commission that it had suffered a breach of consumer data; and

     WHEREAS, the federal trade commission has reported that personal information regarding approximately one hundred forty-three million American consumers was exposed in the Equifax data breach; and

     WHEREAS, the Equifax data breach included the credit card numbers of approximately two hundred nine thousand people and personal identifying information for approximately one hundred eighty-two thousand people; and

     WHEREAS, the Data Breach Notification Act places certain contractual requirements for data security on the owners or licensees of personal identifying information and notification requirements on both the service providers and on the owners and licensees of personal identifying information; and

     WHEREAS, the website Equifax initially provided for consumers to check if they had been affected by the breach was reported to require consumers to sign up for a credit monitoring service, and while the website does not currently have that requirement, many consumers may have been disinclined to check the website because of the perception that they would have to sign up for the service and pay for it; and

     WHEREAS, the federal trade commission encourages consumers to consider putting a lock, also referred to as a freeze, on their credit reports as a safety measure; and

      WHEREAS, consumers who decide to put a lock on their credit reports must contact each credit reporting service separately and pay each service's fee; and

     WHEREAS, after Equifax announced its data breach, it waived its credit report lock fee for a period of time, but the other credit reporting agencies did not; and

     WHEREAS, New Mexico has been listed as one of the five most expensive states for consumers to lock their credit reports, along with Washington, Texas, Pennsylvania and South Dakota; and

     WHEREAS, consumers can lock their credit reports for free in seven states: Colorado, Indiana, Maine, New Jersey, New York, North Carolina and South Carolina;

     NOW, THEREFORE, BE IT RESOLVED BY THE SENATE OF THE STATE OF NEW MEXICO that the attorney general be requested to review and evaluate:

          A. the compliance in New Mexico of the owners and licensees of personal identifying information and the service providers that retain that information under contract with the Data Breach Notification Act;

          B. the effectiveness of the current requirements of the Data Breach Notification Act in protecting personal identifying information and in assisting consumers to protect their credit after a data breach incident; and

          C. the methods that various states have used to ensure that consumers may lock their credit reports for free and the costs and benefits of those methods; and

     BE IT FURTHER RESOLVED that the attorney general be requested to create a report with the conclusions of the review and evaluation and proposals to strengthen consumer data security and breach notification; and

     BE IT FURTHER RESOLVED that the attorney general be requested to present the report to the appropriate legislative interim committee prior to that committee's final meeting in 2018; and

     BE IT FURTHER RESOLVED that a copy of this memorial be transmitted to the office of the attorney general.

- 4 -