RE: The Identity Theft Prevention Act, N.J.S.A. 56:11-44 et seq.

State of New Jersey  DEPARTMENT OF BANKING AND INSURANCE PO BOX 325 TRENTON, NJ 08625-0325 JON S. CORZINE STEVEN M. GOLDMAN Governor TEL (609) 292-5360 Commissioner Visit us on the Web at www.njdobi.org New Jersey is an Equal Opportunity Employer • Printed on Recycled Paper and Recyclable BULLETIN 07-10 TO: ALL REGULATED ENTITIES FROM: STEVEN M. GOLDMAN, COMMISSIONER RE: THE IDENTITY THEFT PREVENTION ACT, N.J.S.A. 56:11-44 et seq. On September 22, 2005, the Identity Theft Prevention Act, P.L. 2005, c. 226, N.J.S.A. 56:11-44 et seq. (the Act), was signed by Acting Governor Codey. The legislation, which became effective on January 1, 2006, mandates the safeguarding of electronically stored consumer information, including social security numbers, and establishes procedures for disclosing security breaches and for implementing security freezes on consumer reports. The Act affects most of the entities regulated by the Department and provided for the Department of Law and Public Safety, Division of Consumer Affairs (DCA) to promulgate regulations to effectuate its provisions. The DCA has published a Notice of Proposed New Rules in the April 16, 2007 edition of the New Jersey Register and will be accepting comments on the proposal until June 15, 2007. A downloadable version of that proposal is available on the DCA's website at www.njconsumeraffairs.gov/proposal/proposal.htm. The proposed rules would impose a number of specific requirements, including data encryption, for the security of the computer systems of every business. "Business" is defined in the proposed rules as a sole proprietorship, corporation, association, or other entity whether or not organized to operate at a profit, that does business in New Jersey and compiles or maintains computerized records that include personal information on New Jersey residents irements, including data encryption, for the security of the computer systems of every business. "Business" is defined in the proposed rules as a sole proprietorship, corporation, association, or other entity whether or not organized to operate at a profit, that does business in New Jersey and compiles or maintains computerized records that include personal information on New Jersey residents. The definition includes financial institutions organized, chartered or holding a license or authorization certificate under the laws of this State, any state, the United States or any other country, or the parent or subsidiary of a financial institution. "Personal information" is defined in the proposed rules as an individual's first name or first initial and last name linked with any one or more of the following: a Social Security number; a driver's license number or state identification card number; or an account number or credit or debit card number in combination with any required security code, access code, password security question or authentication device that would permit access to an individual's bank account, investment account or financial account. The breach of security provisions, including the computer security system requirements are proposed in Subchapter 3 of the proposed rules. Subchapter 4 addresses Social Security numbers. 2 The DCA has requested that recipients of this Bulletin who wish to express concerns in a comment on the computer security aspects of the proposal specifically identify any requirements of particular concern. Pursuant to the Notice of Proposal all comments should be sent directly to DCA. The Department is interested in the views of its regulated entities on the proposed rules and would therefore invite any party submitting a comment to the DCA to provide a copy of it to the Department. Such copies may be sent to: Robert J osal specifically identify any requirements of particular concern. Pursuant to the Notice of Proposal all comments should be sent directly to DCA. The Department is interested in the views of its regulated entities on the proposed rules and would therefore invite any party submitting a comment to the DCA to provide a copy of it to the Department. Such copies may be sent to: Robert J. Melillo, Chief Legislative and Regulatory Affairs New Jersey Department of Banking and Insurance 20 West State Street P.O. Box 325 Trenton, NJ 08625-0325 or faxed to: (609) 292-0896 or emailed to Legislative and Regulatory Affairs at legsregs@dobi.state.nj.us 5/17/07 /s/Steven M. Goldman Date Steven M. Goldman Commissioner INOORD\itpa3.doc