(ii) personally identifying information of the same type as was
provided to the business entity by the unauthorized person; or
(iii) personally identifying information that the business entity
typically requests from new applicants or for new transactions, at
the time of the victim’s request for information, including any
documentation described in clauses (i) and (ii); and
(B) as proof of a claim of identity theft, at the election of the business
entity:
(i) a copy of a police report evidencing the claim of the victim of
identity theft;
(ii) and a properly completed:
(I) copy of a standardized affidavit of identity theft developed
and made available by the Commission; or
(II) an affidavit of fact that is acceptable to the business
entity for that purpose.
(3) PROCEDURES – The request of a victim under paragraph (1) shall:
(A) be in writing;
(B) be mailed to an address specified by the business entity, if any; and
(C) if asked by the business entity, include relevant information about any
transaction alleged to be a result of identity theft to facilitate compliance
with this section including:
(i) if known by the victim (or if readily obtainable by the victim), the
date of the application or transaction; and
(ii) if known by the victim (or if readily obtainable by the victim), any
other identifying information such as an account or transaction
number.
(4) NO CHARGE TO VICTIM – Information required to be provided under paragraph
(1) shall be so provided without charge.
(5) AUTHORITY TO DECLINE TO PROVIDE INFORMATION – A business entity
may decline to provide information under paragraph (1) if, in the exercise of good
faith, the business entity determines that:
(A) this subsection does not require disclosure of the information;
(B) after reviewing the information provided pursuant to paragraph (2), the
business entity does not have a high degree of confidence in knowing the
true identity of the individual requesting the information;
(C) the request for the information is based on a misrepresentation of fact
by the individual requesting the information relevant to the request for
information; or
(D) the information requested is Internet navigational data or similar
information about a person’s visit to a website or online service.
12