Division of Privacy and Identity Protection

The Division of Privacy and Identity Protection oversees issues related to consumer privacy, credit reporting, identity theft, and information security. The Division enforces the statutes and rules within its jurisdiction, engages in outreach and policy development, and educates consumers and businesses about emerging privacy, credit reporting, and information security issues, as well as identity theft prevention and assistance.

Specifically the Division enforces laws including:

• Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices, including deceptive statements and unfair practices involving the use or protection of consumers' personal information;
• The Fair Credit Reporting Act, which ensures the accuracy and privacy of information kept by credit bureaus and other consumer reporting agencies, and gives consumers the right to know what information these entities are distributing about them to creditors, insurance companies and employers;
• The Gramm-Leach-Bliley Act, which requires financial institutions to ensure the security and confidentiality of customer information, provide notice to consumers about their information practices, and give consumers an opportunity to direct that their personal information not be shared with certain non-affiliated third parties;
• The Children’s Online Privacy Protection Act, which is meant to give parents control over information online companies can collect about their children and how such information can be used; and
• The Health Breach Notification Rule, which requires certain businesses not covered by HIPAA to notify customers, and others, if there’s a breach of unsecured, individually identifiable electronic health information.