HB5311ham001 95TH GENERAL ASSEMBLY

Consumer Protection Committee

Filed: 3/11/2008

09500HB5311ham001 LRB095 18444 LCT 47516 a

AMENDMENT TO HOUSE BILL 5311

AMENDMENT NO. ______. Amend House Bill 5311 by replacing the title with the following:

"An ACT concerning financial regulation."; and

by replacing everything after the enacting clause with the following:

"Section 5. The Electronic Fund Transfer Act is amended by changing Section 10 and by adding Section 10.1 as follows:

(205 ILCS 616/10)

Sec. 10. Definitions. For purposes of this Act, the words and phrases defined in this Section shall have the meanings ascribed to them unless the context requires otherwise. Whenever the terms "network" and "switch" are used, they shall be deemed interchangeable unless, from the context and facts, the intention is plain to apply only to one type of entity.

"Access device" means a card, code, or other means of access to an account, or any combination thereof, that may be used by a customer to initiate an electronic fund transfer at a terminal. An "access device" contains a magnetic stripe, microprocessor chip, or other means for storage information that includes, but is not limited to, a credit card, debit card, or stored value card.

"Account" means a demand deposit, savings deposit, share, member, or other customer asset account held by a financial institution.

An "affiliate" of, or a person "affiliated" with, a specified person, means a person that directly, or indirectly through one or more intermediaries, controls, is controlled by, or is under common control with, the person specified.

"Breach of the security of the system" has the meaning given in Section 5 of the Personal Information Protection Act.

"Card security code" means the 3-digit or 4-digit value printed on an access device or contained in the microprocessor chip or magnetic stripe of an access device that is used to validate access device information during the authorization process.

"Commissioner" means the Commissioner of Banks and Real Estate or a person authorized by the Commissioner, the Office of Banks and Real Estate Act, or this Act to act in the Commissioner's stead.

"Magnetic stripe data" means data contained in the magnetic strip of an access device.

"Microprocessor chip data" means the data contained in the microprocessor chip of an access device.

"Electronic fund transfer" means a transfer of funds, other than a transaction originated by check, draft, or similar paper instrument, that is initiated through a terminal for the purpose of ordering, instructing, or authorizing a financial institution to debit or credit an account.

"Financial institution" means a bank established under the laws of this or any other state or established under the laws of the United States, a savings and loan association or savings bank established under the laws of this or any other state or established under the laws of the United States, a credit union established under the laws of this or any other state or established under the laws of the United States, or a licensee under the Consumer Installment Loan Act or the Sales Finance Agency Act.

"Interchange transaction" means an electronic fund transfer that results in exchange of data and settlement of funds between 2 or more unaffiliated financial institutions.

"Network" means an electronic information communication and processing system that processes interchange transactions.

"Person" means a natural person, corporation, unit of government or governmental subdivision or agency, trust, estate, partnership, cooperative, or association.

"PIN" means a personal identification code that identifies the cardholder.

"PIN verification code number" means the data used to verify cardholder identity when a PIN is used in a transaction.

"Seller of goods and services" means a business entity other than a financial institution.

"Service provider" means a person or entity that stores, processes, or transmits access device data on behalf of another person or entity.

"Switch" means an electronic information and communication processing facility that processes interchange transactions on behalf of a network. This term does not include an electronic information and communication processing company (1) that is owned by a bank holding company or an affiliate of a bank holding company and used solely for transmissions among affiliates of the bank holding company or (2) to the extent that the facility, by virtue of a contractual relationship, is used solely for transmissions among affiliates of a bank holding company, regardless of whether the facility is an affiliate of the bank holding company or operates as a switch with respect to one or more networks under an independent contractual relationship.

"Terminal" means an electronic device through which a consumer may initiate an interchange transaction. This term does not include (1) a telephone, (2) an electronic device located in a personal residence, (3) a personal computer or other electronic device used primarily for personal, family, or household purposes, (4) an electronic device owned or operated by a seller of goods and services unless the device is connected either directly or indirectly to a financial institution and is operated in a manner that provides access to an account by means of a personal and confidential code or other security mechanism (other than signature), (5) an electronic device that is not accessible to persons other than employees of a financial institution or affiliate of a financial institution, or (6) an electronic device that is established by a financial institution on a proprietary basis that is identified as such and that cannot be accessed by customers of other financial institutions. The Commissioner may issue a written rule that excludes additional electronic devices from the definition of the term "terminal".

(Source: P.A. 89-310, eff. 1-1-96; 89-508, eff. 7-3-96.)

(205 ILCS 616/10.1 new)

Sec. 10.1. Security or identification information, data capture, and storage restrictions and liability.

(a) No person or entity conducting business in Illinois that accepts an access device in connection with an electronic fund transfer transaction (whether PIN or signature based) shall: (1) retain the card security code data; (2) retain the PIN verification code number; (3) retain the full contents of any track of magnetic stripe data, subsequent to the authorization of the transaction of in the case of a PIN debit transaction, subsequent to 48 hours after authorization of the transaction on days the issuing bank is open for settlement; or (4) store any payment-related data that is not needed for business purposes. A person or entity is in violation of this Section if its service provider retains such data subsequent to the authorization of the transaction or in the case of a PIN debit transaction, subsequent to 48 hours after authorization of the transaction.

(b) Whenever there is a breach of the security of the system of a person or entity that has violated this Section, or that person's or entity's service provider, that person or entity shall reimburse the financial institution that issued any access devices affected by the breach for consequential damages and costs for reasonable actions undertaken by the financial institution as a result of the breach.

Section 99. Effective date. This Act takes effect upon becoming law.".