Criminal use of personal identification information.

(1) As used in this section, the term:

(a) “Access device” means any card, plate, code, account number, electronic serial number, mobile identification number, personal identification number, or other telecommunications service, equipment, or instrument identifier, or other means of account access that can be used, alone or in conjunction with another access device, to obtain money, goods, services, or any other thing of value, or that can be used to initiate a transfer of funds, other than a transfer originated solely by paper instrument.

(b) “Authorization” means empowerment, permission, or competence to act.

(c) “Harass” means to engage in conduct directed at a specific person that is intended to cause substantial emotional distress to such person and serves no legitimate purpose. “Harass” does not mean to use personal identification information for accepted commercial purposes. The term does not include constitutionally protected conduct such as organized protests or the use of personal identification information for accepted commercial purposes.

(d) “Individual” means a single human being and does not mean a firm, association of individuals, corporation, partnership, joint venture, sole proprietorship, or any other entity.

(e) “Person” means a “person” as defined in s. 1.01(3).

(f) “Personal identification information” means any name or number that may be used, alone or in conjunction with any other information, to identify a specific person, including any:

1. Name, postal or electronic mail address, telephone number, social security number, date of birth, mother’s maiden name, official state-issued or United States-issued driver license or identification number, alien registration number, government passport number, employer or taxpayer identification number, Medicaid or food assistance account number, bank account number, credit or debit card number, or personal identification number or code assigned to the holder of a debit card by the issuer to permit authorized electronic use of such card;

2. Unique biometric data, such as fingerprint, voice print, retina or iris image, or other unique physical representation;

3. Unique electronic identification number, address, or routing code;

4. Medical records;

5. Telecommunication identifying information or access device; or

6. Other number or information that can be used to access a person’s financial resources.

(g) “Counterfeit or fictitious personal identification information” means any counterfeit, fictitious, or fabricated information in the similitude of the data outlined in paragraph (f) that, although not truthful or accurate, would in context lead a reasonably prudent person to credit its truthfulness and accuracy.

(2)(a) Any person who willfully and without authorization fraudulently uses, or possesses with intent to fraudulently use, personal identification information concerning another person without first obtaining that person’s consent, commits the offense of fraudulent use of personal identification information, which is a felony of the third degree, punishable as provided in s. 775.082, s. 775.083, or s. 775.084.

(b) Any person who willfully and without authorization fraudulently uses personal identification information concerning a person without first obtaining that person’s consent commits a felony of the second degree, punishable as provided in s. 775.082, s. 775.083, or s. 775.084, if the pecuniary benefit, the value of the services received, the payment sought to be avoided, or the amount of the injury or fraud perpetrated is $5,000 or more or if the person fraudulently uses the personal identification information of 10 or more persons, but fewer than 20 persons, without their consent. Notwithstanding any other provision of law, the court shall sentence any person convicted of committing the offense described in this paragraph to a mandatory minimum sentence of 3 years’ imprisonment.

(c) Any person who willfully and without authorization fraudulently uses personal identification information concerning a person without first obtaining that person’s consent commits a felony of the first degree, punishable as provided in s. 775.082, s. 775.083, or s. 775.084, if the pecuniary benefit, the value of the services received, the payment sought to be avoided, or the amount of the injury or fraud perpetrated is $50,000 or more or if the person fraudulently uses the personal identification information of 20 or more persons, but fewer than 30 persons, without their consent. Notwithstanding any other provision of law, the court shall sentence any person convicted of committing the offense described in this paragraph to a mandatory minimum sentence of 5 years’ imprisonment. If the pecuniary benefit, the value of the services received, the payment sought to be avoided, or the amount of the injury or fraud perpetrated is $100,000 or more, or if the person fraudulently uses the personal identification information of 30 or more persons without their consent, notwithstanding any other provision of law, the court shall sentence any person convicted of committing the offense described in this paragraph to a mandatory minimum sentence of 10 years’ imprisonment.

(3) Neither paragraph (2)(b) nor paragraph (2)(c) prevents a court from imposing a greater sentence of incarceration as authorized by law. If the minimum mandatory terms of imprisonment imposed under paragraph (2)(b) or paragraph (2)(c) exceed the maximum sentences authorized under s. 775.082, s. 775.084, or the Criminal Punishment Code under chapter 921, the mandatory minimum sentence must be imposed. If the mandatory minimum terms of imprisonment under paragraph (2)(b) or paragraph (2)(c) are less than the sentence that could be imposed under s. 775.082, s. 775.084, or the Criminal Punishment Code under chapter 921, the sentence imposed by the court must include the mandatory minimum term of imprisonment as required by paragraph (2)(b) or paragraph (2)(c).

(4) Any person who willfully and without authorization possesses, uses, or attempts to use personal identification information concerning a person without first obtaining that person’s consent, and who does so for the purpose of harassing that person, commits the offense of harassment by use of personal identification information, which is a misdemeanor of the first degree, punishable as provided in s. 775.082 or s. 775.083.

(5) If an offense prohibited under this section was facilitated or furthered by the use of a public record, as defined in s. 119.011, the offense is reclassified to the next higher degree as follows:

(a) A misdemeanor of the first degree is reclassified as a felony of the third degree.

(b) A felony of the third degree is reclassified as a felony of the second degree.

(c) A felony of the second degree is reclassified as a felony of the first degree.

For purposes of sentencing under chapter 921 and incentive gain-time eligibility under chapter 944, a felony offense that is reclassified under this subsection is ranked one level above the ranking under s. 921.0022 of the felony offense committed, and a misdemeanor offense that is reclassified under this subsection is ranked in level 2 of the offense severity ranking chart in s. 921.0022.

(6) Any person who willfully and without authorization fraudulently uses personal identification information concerning an individual who is younger than 18 years of age or 60 years of age or older without first obtaining the consent of that individual or of his or her legal guardian commits a felony of the second degree, punishable as provided in s. 775.082, s. 775.083, or s. 775.084.

(7) Any person who is in the relationship of parent or legal guardian, or who otherwise exercises custodial authority over an individual who is younger than 18 years of age or 60 years of age or older, who willfully and fraudulently uses personal identification information of that individual commits a felony of the second degree, punishable as provided in s. 775.082, s. 775.083, or s. 775.084.

(8)(a) Any person who willfully and fraudulently uses, or possesses with intent to fraudulently use, personal identification information concerning a deceased individual or dissolved business entity commits the offense of fraudulent use or possession with intent to use personal identification information of a deceased individual or dissolved business entity, a felony of the third degree, punishable as provided in s. 775.082, s. 775.083, or s. 775.084.

(b) Any person who willfully and fraudulently uses personal identification information concerning a deceased individual or dissolved business entity commits a felony of the second degree, punishable as provided in s. 775.082, s. 775.083, or s. 775.084, if the pecuniary benefit, the value of the services received, the payment sought to be avoided, or the amount of injury or fraud perpetrated is $5,000 or more, or if the person fraudulently uses the personal identification information of 10 or more but fewer than 20 deceased individuals or dissolved business entities. Notwithstanding any other provision of law, the court shall sentence any person convicted of committing the offense described in this paragraph to a mandatory minimum sentence of 3 years’ imprisonment.

(c) Any person who willfully and fraudulently uses personal identification information concerning a deceased individual or dissolved business entity commits the offense of aggravated fraudulent use of the personal identification information of multiple deceased individuals or dissolved business entities, a felony of the first degree, punishable as provided in s. 775.082, s. 775.083, or s. 775.084, if the pecuniary benefit, the value of the services received, the payment sought to be avoided, or the amount of injury or fraud perpetrated is $50,000 or more, or if the person fraudulently uses the personal identification information of 20 or more but fewer than 30 deceased individuals or dissolved business entities. Notwithstanding any other provision of law, the court shall sentence any person convicted of the offense described in this paragraph to a minimum mandatory sentence of 5 years’ imprisonment. If the pecuniary benefit, the value of the services received, the payment sought to be avoided, or the amount of the injury or fraud perpetrated is $100,000 or more, or if the person fraudulently uses the personal identification information of 30 or more deceased individuals or dissolved business entities, notwithstanding any other provision of law, the court shall sentence any person convicted of an offense described in this paragraph to a mandatory minimum sentence of 10 years’ imprisonment.

(9) Any person who willfully and fraudulently creates or uses, or possesses with intent to fraudulently use, counterfeit or fictitious personal identification information concerning a fictitious person, or concerning a real person without first obtaining that real person’s consent, with intent to use such counterfeit or fictitious personal identification information for the purpose of committing or facilitating the commission of a fraud on another person, commits the offense of fraudulent creation or use, or possession with intent to fraudulently use, counterfeit or fictitious personal identification information, a felony of the third degree, punishable as provided in s. 775.082, s. 775.083, or s. 775.084.

(10) Any person who commits an offense described in this section and for the purpose of obtaining or using personal identification information misrepresents himself or herself to be a law enforcement officer; an employee or representative of a bank, credit card company, credit counseling company, or credit reporting agency; or any person who wrongfully represents that he or she is seeking to assist the victim with a problem with the victim’s credit history shall have the offense reclassified as follows:

(a) In the case of a misdemeanor, the offense is reclassified as a felony of the third degree.

(b) In the case of a felony of the third degree, the offense is reclassified as a felony of the second degree.

(c) In the case of a felony of the second degree, the offense is reclassified as a felony of the first degree.

(d) In the case of a felony of the first degree or a felony of the first degree punishable by a term of imprisonment not exceeding life, the offense is reclassified as a life felony.

For purposes of sentencing under chapter 921, a felony offense that is reclassified under this subsection is ranked one level above the ranking under s. 921.0022 or s. 921.0023 of the felony offense committed, and a misdemeanor offense that is reclassified under this subsection is ranked in level 2 of the offense severity ranking chart.

(11) A person who willfully and without authorization fraudulently uses personal identification information concerning an individual who is 60 years of age or older; a disabled adult as defined in s. 825.101; a public servant as defined in s. 838.014; a veteran as defined in s. 1.01; a first responder as defined in s. 125.01045; an individual who is employed by the State of Florida; or an individual who is employed by the Federal Government without first obtaining the consent of that individual commits a felony of the second degree, punishable as provided in s. 775.082, s. 775.083, or s. 775.084.

(12) In addition to any sanction imposed when a person pleads guilty or nolo contendere to, or is found guilty of, regardless of adjudication, a violation of this section, the court shall impose a surcharge of $1,001.

(a) The sum of $500 of the surcharge shall be deposited into the Department of Law Enforcement Operating Trust Fund for the department to provide grants to local law enforcement agencies to investigate offenses related to the criminal use of personal identification information as provided in s. 943.0412.

(b) The sum of $250 of the surcharge shall be deposited into the State Attorneys Revenue Trust Fund for the purpose of funding prosecutions of offenses relating to the criminal use of personal identification information. The sum of $250 of the surcharge shall be deposited into the Indigent Criminal Defense Trust Fund for the purposes of indigent criminal defense related to the criminal use of personal identification information.

(c) The clerk of the court shall retain $1 of each $1,001 surcharge that he or she collects as a service charge of the clerk’s office.

(d) The surcharge may not be waived by the court. In the event that the person has been ordered to pay restitution in accordance with s. 775.089, the surcharge shall be included in a judgment.

(13) The prosecutor may move the sentencing court to reduce or suspend the sentence of any person who is convicted of a violation of this section and who provides substantial assistance in the identification, arrest, or conviction of any of that person’s accomplices, accessories, coconspirators, or principals or of any other person engaged in fraudulent possession or use of personal identification information. The arresting agency shall be given an opportunity to be heard in aggravation or mitigation in reference to any such motion. Upon good cause shown, the motion may be filed and heard in camera. The judge hearing the motion may reduce or suspend the sentence if the judge finds that the defendant rendered such substantial assistance.

(14) This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of this state or any of its political subdivisions, of any other state or its political subdivisions, or of the Federal Government or its political subdivisions.

(15)(a) In sentencing a defendant convicted of an offense under this section, the court may order that the defendant make restitution under s. 775.089 to any victim of the offense. In addition to the victim’s out-of-pocket costs, restitution may include payment of any other costs, including attorney’s fees incurred by the victim in clearing the victim’s credit history or credit rating, or any costs incurred in connection with any civil or administrative proceeding to satisfy any debt, lien, or other obligation of the victim arising as the result of the actions of the defendant.

(b) The sentencing court may issue such orders as are necessary to correct any public record that contains false information given in violation of this section.

(16) Prosecutions for violations of this section may be brought on behalf of the state by any state attorney or by the statewide prosecutor.

(17) The Legislature finds that, in the absence of evidence to the contrary, the location where a victim gives or fails to give consent to the use of personal identification information is the county where the victim generally resides.

(18) Notwithstanding any other provision of law, venue for the prosecution and trial of violations of this section may be commenced and maintained in any county in which an element of the offense occurred, including the county where the victim generally resides.

(19) A prosecution of an offense prohibited under subsection (2), subsection (6), or subsection (7) must be commenced within 3 years after the offense occurred. However, a prosecution may be commenced within 1 year after discovery of the offense by an aggrieved party, or by a person who has a legal duty to represent the aggrieved party and who is not a party to the offense, if such prosecution is commenced within 5 years after the violation occurred.