Title 45 — Trade and Commerce

(a) If a covered person owns or licenses personal information in any form that includes personal information on a state resident, and a breach of the security of the information system that contains personal information occurs, the covered person shall, after discovering or being…

An information collector may delay disclosing the breach under AS 45.48.010 if an appropriate law enforcement agency determines that disclosing the breach will interfere with a criminal investigation. However, the information collector shall disclose the breach to the state resid…

An information collector shall make the disclosure required by AS 45.48.010 (1) by a written document sent to the most recent address the information collector has for the state resident; (2) by electronic means if the information collector's primary method of communication with …

(a) If an information collector is required by AS 45.48.010 to notify more than 1,000 state residents of a breach, the information collector shall also notify without unreasonable delay all consumer credit reporting agencies that compile and maintain files on consumers on a natio…

In AS 45.48.010 — 45.48.090, the good faith acquisition of personal information by an employee or agent of an information collector for a legitimate purpose of the information collector is not a breach of the security of the information system if the employee or agent does not us…

A waiver of AS 45.48.010 — 45.48.090 is void and unenforceable.

(a) If a breach of the security of the information system containing personal information on a state resident that is maintained by an information recipient occurs, the information recipient is not required to comply with AS 45.48.010 — 45.48.030. However, immediately after the i…

(a) If an information collector who is a governmental agency violates AS 45.48.010 — 45.48.090 with regard to the personal information of a state resident, the information collector (1) is liable to the state for a civil penalty of up to $500 for each state resident who was not n…

In AS 45.48.010 — 45.48.090, (1) “breach of the security” means unauthorized acquisition, or reasonable belief of unauthorized acquisition, of personal information that compromises the security, confidentiality, or integrity of the personal information maintained by the informati…

A consumer may prohibit a consumer credit reporting agency from releasing the consumer's credit report or credit score without the express authorization of the consumer by placing a security freeze on the consumer's credit report.

(a) To place a security freeze, a consumer shall make the request to the consumer credit reporting agency (1) by mail to the address designated by the consumer credit reporting agency to receive security freeze requests; or (2) as allowed by (b) of this section. (b) A consumer ma…

(a) Within 10 business days after a consumer makes the request under AS 45.48.110, a consumer credit reporting agency shall send a written confirmation of the placement of the security freeze to the consumer. The confirmation must also inform the consumer that the consumer credit…

(a) While a security freeze is in place, a consumer credit reporting agency shall allow a third party access to a consumer's credit report or credit score if the consumer requests that the consumer credit reporting agency allow the access. (b) To make a request under (a) of this …

(a) Except as provided by AS 45.48.130, a consumer credit reporting agency may not remove a security freeze unless (1) the consumer requests that the consumer credit reporting agency remove the security freeze under (b) of this section; or (2) the consumer made a material misrepr…

When dealing with a third party, a consumer credit reporting agency may not suggest, state, or imply that a consumer's security freeze reflects a negative credit score, history, report, or rating.

(a) Except as provided by (b), (c), or (d) of this section, a consumer credit reporting agency may not charge a consumer to place or remove a security freeze, to provide access under AS 45.48.130, or to take any other action, including the issuance of a personal identification nu…

When a consumer credit reporting agency is required to give a consumer a summary of rights under 15 U.S.C. 1681g (Fair Credit Reporting Act), a consumer credit reporting agency shall also give the consumer the following notice: Consumers Have the Right to Obtain a Security Freeze…

If a consumer credit reporting agency violates a security freeze by releasing a consumer's credit report or credit score, the consumer credit reporting agency shall notify the consumer within five business days after discovering or being notified of the release, and the informati…

A consumer credit reporting agency that acts as a reseller of consumer information shall honor a security freeze placed on a consumer's credit report and credit score by another consumer credit reporting agency.

(a) A consumer who suffers damages as a result of a person's violation of AS 45.48.100 — 45.48.290 may bring an action in court against the person and recover, in the case of a violation where the person acted (1) negligently, actual economic damages, court costs allowed by the r…

(a) The provisions of AS 45.48.100 — 45.48.290 do not apply to the use of a credit report by (1) a person, the person's subsidiary, affiliate, or agent, or the person's assignee with whom a consumer has or, before the assignment, had an account, contract, or debtor-creditor relat…

A parent, legal guardian, or conservator of a minor, incapacitated person, or protected person may make a request under AS 45.48.100 — 45.48.290 on behalf of a consumer who is the minor, incapacitated person, or protected person under the supervision of that parent, legal guardia…

Article 3. Protection of Social Security Number. In AS 45.48.100 — 45.48.290, (1) “account review” means activities related to account maintenance, account monitoring, credit line increases, and account upgrades and enhancements; (2) “consumer” means an individual who is the subj…

(a) A person may not (1) intentionally communicate or otherwise make available to the general public an individual's social security number; (2) print an individual's social security number on a card required for the individual to access products or services provided by the perso…

(a) A person who does business in the state, including the business of government, may not request or collect from an individual the individual's social security number. This subsection does not prohibit a person from asking for another form of identification from the individual.…

(a) A person may not sell, lease, loan, trade, or rent an individual's social security number to a third party. (b) The prohibition in (a) of this section does not apply if the sale, lease, loan, trade, or rental is (1) authorized by local, state, or federal law, including a regu…

(a) A person doing business, including the business of government, may not disclose an individual's social security number to a third party. (b) The prohibition in (a) of this section does not apply if (1) the disclosure is authorized by local, state, or federal law, including a …

Notwithstanding the other provisions of AS 45.48.400 — 45.48.480, a state or local governmental agency may disclose an individual's social security number to another state or local governmental agency or to an agency of the federal government if the disclosure is required in orde…

(a) Notwithstanding the other provisions of AS 45.48.400 — 45.48.480, a person may disclose an individual's social security number to an employee or agent of the person for a legitimate purpose established by and as directed by the person, but the employee or agent may not use th…

The provisions of AS 45.48.400 — 45.48.480 may not be construed to restrict a person's use or exchange of an individual's social security number (1) in the course of the administration of a claim, benefit, or procedure related to the individual's employment by the person, includi…

If regulations are necessary in order for a state agency to carry out the state agency's duties and responsibilities, a state agency may adopt regulations under AS 44.62 (Administrative Procedure Act) to establish when the state agency or a person regulated by the state agency ma…

Article 4. Disposal of Records. (a) A person who knowingly violates AS 45.48.400 — 45.48.430 is liable to the state for a civil penalty not to exceed $3,000. (b) An individual may bring a civil action in court against a person who knowingly violates AS 45.48.400 — 45.48.430 and m…

(a) When disposing of records that contain personal information, a business and a governmental agency shall take all reasonable measures necessary to protect against unauthorized access to or use of the records. (b) Notwithstanding (a) of this section, if a business or government…

The measures that may be taken to comply with AS 45.48.500 include (1) implementing and monitoring compliance with policies and procedures that require the burning, pulverizing, or shredding of paper documents containing personal information so that the personal information canno…

In AS 45.48.510(3), due diligence ordinarily includes performing one or more of the following: (1) reviewing an independent audit of the third party's operations and its compliance with AS 45.48.500 — 45.48.590; (2) obtaining information about the third party from several referen…

A business or governmental agency shall adopt written policies and procedures that relate to the adequate destruction and proper disposal of records containing personal information and that are consistent with AS 45.48.500 — 45.48.590.

(a) A business or a governmental agency is not required to comply with AS 45.48.500 — 45.48.530 if federal law requires that the business or governmental agency act in a way that does not comply with AS 45.48.500 — 45.48.530. (b) A business is not required to comply with AS 45.48…

(a) An individual, a business, or a governmental agency that knowingly violates AS 45.48.500 — 45.48.590 is liable to the state for a civil penalty not to exceed $3,000. (b) In this section, “knowingly” has the meaning given in AS 11.81.900.

An individual who is damaged by a violation of AS 45.48.500 — 45.48.590 may bring a civil action in court to enjoin further violations and to recover for the violation actual economic damages, court costs allowed by the rules of court, and full reasonable attorney fees.

Article 5. Factual Declaration of Innocence after Identity Theft; Right to File Police Report Regarding Identity Theft. In AS 45.48.500 — 45.48.590, (1) “business” means a person who conducts business in the state or a person who conducts business and maintains or otherwise posse…

(a) A victim of identity theft may petition the superior court for a determination that the victim is factually innocent of a crime if (1) the perpetrator of the identity theft was arrested for, cited for, or convicted of the crime using the victim's identity; (2) a criminal comp…

A determination of factual innocence under AS 45.48.600 may be heard and made on declarations, affidavits, police reports, or other material, relevant, and reliable information submitted by the parties or ordered to be made a part of the record by the court.

(a) A court may determine that a petitioner under AS 45.48.600 is factually innocent of a crime if the court finds beyond a reasonable doubt that (1) the petitioner is a victim of identity theft; (2) the petitioner did not commit the offense for which the perpetrator of the ident…

After a court issues an order under AS 45.48.620, the court may order the name and associated personal information of the victim of identity theft that is contained in the files, indexes, and other records of the court that are accessible by the public labeled to show that the na…

A court that has issued an order under AS 45.48.620 may, at any time, vacate the order if the petition, or any information submitted in support of the petition, is found to contain a material misrepresentation, an omission, or false information.

The supreme court of the state may develop a form to be used for the order under AS 45.48.620.

The department may establish and maintain a database of individuals who have been victims of identity theft and who have received an order under AS 45.48.620. The department shall provide a victim or the victim's authorized representative access to a database established under th…

The department may establish and maintain a toll-free telephone number to provide access to information in a database established under AS 45.48.660.

(a) Even if the local law enforcement agency does not have jurisdiction over the theft of an individual's identity, if an individual who has learned or reasonably suspects the individual has been the victim of identity theft contacts, for the purpose of filing a complaint, a loca…

Article 6. Truncation of Card Information. In AS 45.48.600 — 45.48.690, (1) “crime” has the meaning given in AS 11.81.900; (2) “department” means the Department of Law; (3) “perpetrator” means the person who perpetrated the theft of an individual's identity; (4) “victim” means an…