Assigned to CED                                                                                                         AS PASSED BY THE SENATE

ARIZONA STATE SENATE

Forty-eighth Legislature, First Regular Session

FACT SHEET FOR H.B. 2726

unlawfully obtaining communication records

(NOW: communication service records; unauthorized use)

Purpose

            Prohibits the procurement and sale of public utility records and communication service records through unauthorized, fraudulent or deceptive means, with certain exceptions.  Prohibits the unauthorized use of personal information from a telephone record, public utility record or communication service record in a judicial, administrative, legislative or other proceeding, with certain exceptions.

Background

            The Federal Trade Commission defines pretexting as the practice of getting personal information under false pretenses.  Pretexters use a variety of tactics to obtain information, which they then sell to people who may use it to secure credit in a false name, steal assets or investigate or sue the owner of the personal information.

            Federal law permits a telecommunications carrier (carrier) to use, disclose or permit access to individually identifiable Customary Proprietary Network Information (CPNI) only as required by law, with the customer’s approval and in providing the service from which the customer’s information is derived (47 U.S.C. § 222).  CPNI is information that relates to the quantity, technical, configuration, type, destination and amount of use of a telecommunications service and that is made available to the carrier by the customer solely by virtue of the customer-carrier relations, and information contained in the bills pertaining to telephone exchange service or telephone toll service.

            The federal Telephone Records and Privacy Protection Act of 2006 (Act) prohibits a person, in interstate and foreign commerce, from knowingly and intentionally obtaining confidential phone records information by: a) making false or fraudulent statements or representations to an employee or customer of a carrier; b) knowingly providing false or fraudulent documents to a carrier; and c) accessing customer accounts via the Internet or by other unauthorized means without the customer’s prior authorization.  The Act also prohibits a person from knowingly and intentionally selling, transferring, purchasing or receiving confidential phone records without the customer’s prior authorization or knowing or having reason to know the information was obtained fraudulently.  A person who commits a violation is subject to a fine and/or imprisonment of up to ten years (18 U.S.C. § 1039). 

With some exceptions, Arizona prohibits a person from: a) knowingly procuring, attempting to procure, soliciting or conspiring with another to procure any Arizona resident’s telephone record without the customer’s authorization or by fraudulent, deceptive or false means; b) knowingly selling or attempting to sell the telephone record of any Arizona resident without the customer’s authorization; and c) receiving a telephone record of any Arizona resident knowing that the record has been obtained without the customer’s authorization or by fraudulent, deceptive or false means.  A violation is a class 1 misdemeanor and the aggrieved person may recover appropriate relief, damages and reasonable attorney fees and costs (A.R.S. Title 44, Chapter 9, Article 20).  H.B. 2726 expands this to include public utility records and communication service records.

            The anticipated fiscal impact associated with this legislation is undeterminable.  However, there may be a fiscal impact related to increased caseloads for prosecution by the Attorney General, and incarceration in county jail, of persons who procure and sell public utility records and communication service records through unauthorized, fraudulent or deceptive means.

Provisions

1. Prohibits a person from doing any of the following:

a) knowingly procuring, attempting to procure, soliciting or conspiring with another to procure a public utility record or a communication service record of any Arizona resident without the authorization of the customer to whom the record pertains, or by fraudulent, deceptive or false means.

b) knowingly selling or attempting to sell a public utility record or communication service record of any Arizona resident without the authorization of the customer to whom the record pertains.

c) receiving a public utility record or communication service record of any Arizona resident knowing that the record has been obtained without the authorization of the customer to whom the record pertains or by fraudulent, deceptive or false means.

2. Permits the Arizona Corporation Commission (ACC), in the performance of its official duties, to receive a public utility record, telephone record or communication service record of any Arizona resident.

3. Requires entities that maintain communication service records or public utility records of an Arizona resident to establish reasonable procedures to protect against unauthorized or fraudulent disclosure of the records.

4. Prohibits the use of any personal information that is contained in a telephone record, public utility record or communication service record that is obtained without authorization or by fraudulent, deceptive or false means in any judicial, administrative, legislative or other proceeding, unless the information is offered as proof in an action or prosecution for the unauthorized procurement or sale of the records, or is otherwise authorized by law.

5. Allows a law enforcement agency to obtain public utility records or communication service records in connection with the agency’s official duties.

6. Permits a public utility or an entity that maintains communication service records to obtain, use, disclose or permit access to any public utility record or communication service record either directly or indirectly through its agents when:

a) it is authorized by law.

b) lawful consent of the customer or subscriber is obtained.

c) it is necessary to the rendition of the service or protection of the rights or property of the service provider or to protect users and carriers from fraudulent, abusive or unlawful use of or subscription to these services.

d) the public utility or entity reasonably believes that an emergency involving the immediate danger or death or serious injury to any person justifies disclosure of the information to a governmental entity.

e) the record is released to the National Center for Missing and Exploited Children in connection with a missing or exploited child report.

7. Permits a public utility, telephone company or entity that maintains communication service records to disclose or permit access to any public utility record, telephone record or other communication service record either directly or indirectly through its agents to the ACC for use in the performance of its duties.

8. States that the record requirements do not apply to or expand the obligations and duties of any public utility or entity that maintains communication service records to protect the records beyond those otherwise established by federal and state law.

9. States that the record requirements and related penalties do not apply to a public utility or entity, or its agents or representatives, who act reasonably and in good faith. 

10. Allows a customer whose communication service records or public utility records are procured, sold or received in violation of the record requirements to recover from the person who committed the violation, in a civil action, the following:

a) preliminary and other appropriate relief.

b) damages equal to the sum of the actual damages suffered by the person and any profits made by the person who committed violation.  Damages must be at least $1,000.

c) reasonable attorney fees and other litigation costs that are reasonably incurred.

11. Prohibits a civil action from being commenced more than two years after the date on which the claimant first discovered or had a reasonable opportunity to discover the violation.

12. Makes any violation of the record prohibitions a violation of the Consumer Fraud Act subject to investigation and action by the Attorney General, and a class 1 misdemeanor subject to forfeiture of any personal property used or intended to be used to commit the offense.

13. Defines:

a) communication service record.

b) public utility.

c) public utility record.

14. Expands the definition of telephone record to include information made available to a telephone company by virtue of the relationship between the telephone company and the customer.

15. Makes conforming changes.

16. Becomes effective on the general effective date.

Amendments Adopted by Committee of the Whole

· Modifies the definition of public utility to exclude multi-county water conservation districts.

House Action Senate Action

Approp            2/21/07     DPA/SE     13-4-0-0          CED                3/14/07     DP     5-0-3

3^rd Read           3/5/07                           54-1-5-0         3^rd Read           4/19/07               27-0-3

Prepared by Senate Research

April 20, 2007

LB/ac