The Identity Theft Trends and Issues: CRS Report for Congress provides a good review of relevant trends, statutes and authorities relating to identity theft as well as an overview of the legislative landscape. The Summary from the report is included below. For the complete report, see: http://www.fas.org/sgp/crs/misc/R40599.pdf

[report summary starts here]

In the wake of the economic downturn, policymakers are increasingly concerned with securing the economic health of the United States--including combating those crimes that threaten to further undermine the nation's financial stability. Identity theft is one such crime. It is the fastest growing type of fraud in the United States; in 2008 about 9.9 million Americans were reportedly victims of identity theft, an increase of 22% from the number of cases in 2007. In addition, the Federal Trade Commission (FTC) estimates that it costs consumers about $50 billion annually. Identity theft is often committed to facilitate other crimes such as credit card fraud, document fraud, or employment fraud, which in turn can affect not only the nation's economy but its security. Consequently, in securing the nation and it's economic health, policymakers are also tasked with reducing identity theft and its impact.

Congress continues to debate the federal government's role in (1) preventing identity theft and its related crimes, (2) mitigating the potential effects of identity theft after it occurs, and (3) providing the most effective tools to investigate and prosecute identity thieves. With respect to preventing identity theft, one issue concerning policymakers is the prevalence of personally identifiable information--and in particular, the prevalence of social security numbers (SSNs)--in both the private and public sectors. One policy option to reduce their prevalence may involve restricting the use of SSNs on government-issued documents such as Medicare identification cards. Another option could entail providing federal agencies with increased regulatory authority to curb the prevalence of SSN use in the private sector. In debating policies to mitigate the effects of identity theft, one option Congress may consider is whether to strengthen data breach notification requirements. Such requirements could affect the notification of relevant law enforcement authorities as well as any individuals whose personally identifiable information may be at risk from the breach.

There have already been several legislative and administrative actions aimed at curtailing identity theft. Congress enacted legislation naming identity theft as a federal crime in 1998 (P.L. 105-318) and later provided for enhanced penalties for aggravated identity theft (P.L. 108-275). In April 2007, the President's Identity Theft Task Force issued recommendations to combat identity theft, including specific legislative recommendations to close identity theft-related gaps in the federal criminal statutes. In a further attempt to curb identity theft, Congress directed the FTC to issue an Identity Theft Red Flags Rule (effective November 1, 2009), requiring that creditors and financial institutions with specified account types develop and institute written identity theft prevention programs.

Multiple federal agencies, including the Federal Bureau of Investigation; U.S. Secret Service; U.S. Postal Inspection Service; U.S. Immigration and Customs Enforcement; and Social Security Administration, Office of the Inspector General, are involved in investigating identity theft. Further, prosecutions and convictions of identity theft and aggravated identity theft cases have continued to increase since becoming federal crimes. In line with this trend, there has been a general increase in the number of identity theft complaints to the FTC as well in the number of reported data breaches placing personally identifiable information at risk.

This report will be updated as needed.