Commentary: Marylanders need more protection from identity theft, fraud

According to the Maryland Office of the Attorney General, 656 large data breaches affected state residents in 2023 and exposed their personal information online, creating the opportunity for countless instances of identity theft and fraud. As a lawyer who represents victims of identity theft, I see what happens when hackers open fraudulent accounts.

Often, those accounts hurt the victim’s credit scores, and some people even get sued over debts run up by an imposter. The fraudulent accounts could be everything from student loans and medical debt to credit cards and apartment rentals. The consequences can be devastating.

Fixing the problem is even more cumbersome and expensive when a collector refuses to disclose all the information on which they are relying. This is perfectly legal, because (unless there is a lawsuit) a consumer doesn’t currently have an enforceable right to obtain this information.

For example, when someone’s address or Social Security number gets exposed in a data breach, debt collectors might end up pursuing the person for credit card debt on an account they never opened. This person calls the collector and requests basic information such as the email address and phone number associated with this credit account, but the collector refuses to release that information.

The collector says the account “matches your personal identifiers” and won’t accept that the victim didn’t open the account. Without knowing the information the collector relies on, the victim can’t prove they didn’t open the credit card account.

As another example, a woman in the middle of a difficult divorce with an abusive spouse starts getting collection calls on an account she doesn’t recognize. She suspects her spouse of stealing her identity. But she doesn’t know how far he has gone or if he is the one responsible. She wants to know more about these fraudulent accounts to try to work out what action she should take, but no one will tell her what she needs to know. Situations such as these are common.

Too often for victims such as these, the only viable option to get their file is litigation, which is time-consuming and expensive. And going to court to challenge a lawsuit seeking to collect on a fraudulent credit card may end up costing more than the amount of the alleged debt.

Currently, other than a lawsuit, Marylanders such as these do not have the right to know what information the collector has about them. Although federal law is supposed to provide a right to disclosure for victims of identity theft, individual consumers cannot enforce that right, and must effectively prove they are victims before getting the information. The only way to obtain the complete documentation to help clients know and correct the full extent of damage caused by identity theft and prove their innocence is through the discovery phase of the litigation process. This process is expensive, lengthy, and causes delays in settling any accounts or rectifying any damage caused. This broken system needs fixing.

Fixing the problem requires disclosure of what information the collectors have. Citizens of the European Union have had this “right to know” for years. Marylanders deserve a similar right to know, and that is why I strongly support the Maryland Online Data Privacy Act (SB 541), which would add this much-needed protection, and more.

Under this legislation, Marylanders would have the right to know what address a business has for you, what changes of address they have, what email addresses and phone numbers they have, and whether they have spoken to anyone about the account in question.

It is time for Maryland to adopt a strong data privacy law, and SB 541, currently working its way through the Maryland General Assembly, would do just that. It would establish new consumer rights to view, correct and delete data and to opt out of data collection. For victims of identity theft, the most important new right will be the consumer’s right to obtain and correct their data.

Under the legislation, big tech and other large corporations would be required to disclose the data they have on Maryland consumers, upon request. Let’s pass it now.

Peter Holland is the former director of the University of Maryland Law School Consumer Protection Clinic, and the founder of the Holland Law Firm for Consumer Rights in Annapolis, which helps victims of identity theft, wrongful debt collection and other financial scams.

More From The Banner

Suspect in Pikesville AI case set off red flags before racist recording spread

Errors in Nick Mosby’s latest fundraising report raise even more questions

Map, dive, cut, lift: An inside look at the Key Bridge salvage strategy

A Bethesda-based peace activist is charged with being a would-be revolutionary in Africa