22-40-8. Identity theft--Felony.

If any person, without the authorization or permission of another person and with the intent to deceive or defraud:

(1)    Obtains, possesses, transfers, uses, attempts to obtain, or records identifying information not lawfully issued for that person's use; or

(2)    Accesses or attempts to access the financial resources of that person through the use of identifying information;

such person commits the crime of identity theft. Identity theft committed pursuant to this section is a Class 6 felony.

Source: SL 2000, ch 107, § 1; SDCL, § 22-30A-3.1; SL 2005, ch 120, §§ 80, 83.

22-40-9. Identifying information defined.

For the purposes of §§ 22-40-8 to 22-40-10, inclusive, identifying information includes:

(1)    Birth certificate or passport information;

(2)    Driver's license numbers or tribal identification card information;

(3)    Social security or other taxpayer identification numbers;

(4)    Checking account numbers;

(5)    Savings account numbers;

(6)    Credit card numbers;

(7)    Debit card numbers;

(8)    Personal identification numbers, passwords, or challenge questions;

(9)    User names or identifications;

(10)    Biometric data; or

(11)    Any other numbers, documents, or information which can be used to access another person's financial resources.

Source: SL 2000, ch 107, § 2; SDCL § 22-30A-3.2; SL 2005, ch 120, §§ 81, 83; SL 2011, ch 13, § 3.

22-40-10. Physical presence in county not necessary to commission of identity theft.

In any criminal proceeding brought pursuant to § 22-40-8, the crime may be considered to have been committed in any county in which any part of the identity theft took place, regardless of whether the defendant was ever actually in such county.

Source: SL 2000, ch 107, § 3; SDCL, § 22-30A-3.3; SL 2005, ch 120, §§ 82, 83.

22-40-11. Reencoder and scanning device defined.

Terms used in §§ 22-40-11 to 22-40-14, inclusive, mean:

(1)    "Reencoder," any electronic device that places encoded information from the magnetic strip or stripe of a payment card or a computer chip embedded in a payment card onto the magnetic strip or stripe or computer chip of a different payment card;

(2)    "Scanning device," any scanner, reader, or any other electronic device that is used to access, read, scan, obtain, memorize, or store, temporarily or permanently, information encoded on the magnetic strip or stripe or on a computer chip of a payment card.

Source: SL 2003, ch 131, § 1; SDCL § 22-30A-8.2; SL 2005, ch 120, §§ 84, 85; SL 2019, ch 110, § 4.

22-40-12. Unauthorized use of scanning device on payment card--Felony.

A person is guilty of a Class 6 felony if the person directly or indirectly uses a scanning device to access, read, obtain, memorize, or store, temporarily or permanently, information encoded on the magnetic strip or stripe of a payment card or encoded on a chip embedded on a payment card without the permission of the authorized user of the payment card, the issuer of the authorized user's payment card, or a merchant.

Source: SL 2003, ch 131, § 2; SDCL § 22-30A-8.3; SL 2005, ch 120, § 85; SL 2019, ch 110, § 1.

22-40-13. Unauthorized use of reencoder on payment card--Felony.

A person is guilty of a Class 6 felony if the person directly or indirectly uses a reencoder to place information encoded on the magnetic strip or stripe of a payment card or encoded on a computer chip embedded on a payment card onto the magnetic strip or stripe or computer chip of a different payment card without the permission of the authorized user of the payment card from which the information is being reencoded, the issuer of the authorized user's payment card, or a merchant.

Source: SL 2003, ch 131, § 3; SDCL § 22-30A-8.4; SL 2005, ch 120, § 85; SL 2019, ch 110, § 2.

22-40-14. Ownership or possession of scanning device or reencoder with intent to obtain or alter payment card information without permission--Felony.

A person is guilty of a Class 6 felony if the person owns or possesses a scanning device or a reencoder with the intent to use the scanning device or reencoder to obtain or alter information encoded or embedded on a payment card without the permission of the authorized user of the payment card, the issuer of the authorized user's payment card, or a merchant.

A person is guilty of a Class 6 felony if the person owns or possesses a scanning device or reencoder with knowledge that a person other than an authorized user, the issuer of the authorized user's payment card, or a merchant intends to use the scanning device or reencoder to obtain information encoded or embedded on a payment card without the permission of the authorized user, the issuer of the authorized user's payment card, or any merchant.

Source: SL 2003, ch 131, § 4; SDCL § 22-30A-8.5; SL 2005, ch 120, § 85; SL 2019, ch 110, § 3.

22-40-15. Making or possessing forgery or counterfeiting devices--Felony.

Any person who:

(1)    Makes or possesses, with knowledge of its character, any plate, die, or other device, apparatus, equipment, or article specifically designated for use in counterfeiting, unlawfully simulating, or otherwise forging, written instruments;

(2)    Makes or possesses any device, apparatus, equipment, or article capable of or adaptable to a use specified in subdivision (1) of this section, with intent to use it or to aid or permit another to use it, for the purpose of forgery; or

(3)    Possesses a genuine plate, die, or other device used in the production of written instruments, with intent to defraud;

is guilty of a Class 6 felony.

Source: SDC 1939, §§ 13.4101 (2), 13.4123; SDCL, §§ 22-39-9, 22-39-11; SL 1976, ch 158, § 39-3; SDCL, § 22-39-37; SL 2005, ch 120, § 105, 106.

22-40-16. Impersonation of officer, employee, firefighter, or person causing injury or fraud--Misdemeanor.

Any person who intentionally impersonates any public officer or employee, civil or military, or any firefighter or any person having special authority by law to perform any act affecting the rights or interests of another, or assumes, without authority, any uniform or badge by which such officer, employee, firefighter, or person is usually distinguished, and in such assumed character does any act whereby another person is injured or defrauded, is guilty of a Class 1 misdemeanor.

Source: SL 1976, ch 158, § 11-24; SDCL, § 22-11-8; SL 2005, ch 120, §§ 199, 200.

22-40-17. Impersonating a judicial official--Misdemeanor.

Any person who, without authority under the U.S. Constitution, federal law, or the constitution or laws of this state, acts as a supreme court justice, a circuit court judge, a magistrate judge, a lay magistrate, a clerk of court or deputy, a juror, or other official holding authority to determine a controversy or adjudicate the rights or interests of any other person, or signs a document in such capacity, is guilty of a Class 1 misdemeanor. It is no defense to a prosecution under this section that the judicial office that the person pretended to hold did not exist.

Source: SL 1997, ch 45, § 13; SDCL, § 22-11-34; SL 2005, ch 120, §§ 230, 231.

22-40-18. Misuse of tribal identification card.

No person may:

(1)    Possess any cancelled, fictitious, fraudulently altered, or fraudulently obtained tribal identification card;

(2)    Lend the person's tribal identification card to any other person or knowingly permit its use by another;

(3)    Display or represent a tribal identification card not issued to the person as being the person's card;

(4)    Photograph, duplicate, or in any way reproduce a tribal identification card or facsimile thereof in such a manner that it could be mistaken for a valid identification card;

(5)    Use a tribal identification card that was obtained by false swearing, fraud, or false statement of any kind or in any form.

A violation of this section is a Class 1 misdemeanor.

Source: SL 2011, ch 13, § 2.

22-40-19. Definition of terms in §§ 22-40-19 to 22-40-26.

Terms in §§ 22-40-19 to 22-40-26, inclusive, mean:

(1)    "Breach of system security," the unauthorized acquisition of unencrypted computerized data or encrypted computerized data and the encryption key by any person that materially compromises the security, confidentiality, or integrity of personal or protected information maintained by the information holder. The term does not include the good faith acquisition of personal or protected information by an employee or agent of the information holder for the purposes of the information holder if the personal or protected information is not used or subject to further unauthorized disclosure;

(2)    "Encrypted," computerized data that is rendered unusable, unreadable, or indecipherable without the use of a decryption process or key or in accordance with the Federal Information Processing Standard 140-2 in effect on January 1, 2018;

(3)    "Information holder," any person or business that conducts business in this state, and that owns or licenses computerized personal or protected information of residents of this state;

(4)    "Personal information," a person's first name or first initial and last name, in combination with any one or more of the following data elements:

(a)    Social security number;

(b)    Driver license number or other unique identification number created or collected by a government body;

(c)    Account, credit card, or debit card number, in combination with any required security code, access code, password, routing number, PIN, or any additional information that would permit access to a person's financial account;

(d)    Health information as defined in 45 CFR 160.103; or

(e)    An identification number assigned to a person by the person's employer in combination with any required security code, access code, password, or biometric data generated from measurements or analysis of human body characteristics for authentication purposes.

The term does not include information that is lawfully made available to the general public from federal, state, or local government records or information that has been redacted, or otherwise made unusable; and

(5)    "Protected information," includes:

(a)    A user name or email address, in combination with a password, security question answer, or other information that permits access to an online account; and

(b)    Account number or credit or debit card number, in combination with any required security code, access code, or password that permits access to a person's financial account;

(6)    "Unauthorized person," any person not authorized to acquire or disclose personal information, or any person authorized by the information holder to access personal information who has acquired or disclosed the personal information outside the guidelines for access of disclosure established by the information holder.

Source: SL 2018, ch 135, § 1.

22-40-20. Notice of breach of system security--Exception.

Following the discovery by or notification to an information holder of a breach of system security an information holder shall disclose in accordance with § 22-40-22 the breach of system security to any resident of this state whose personal or protected information was, or is reasonably believed to have been, acquired by an unauthorized person. A disclosure under this section shall be made not later than sixty days from the discovery or notification of the breach of system security, unless a longer period of time is required due to the legitimate needs of law enforcement as provided under § 22-40-21. An information holder is not required to make a disclosure under this section if, following an appropriate investigation and notice to the attorney general, the information holder reasonably determines that the breach will not likely result in harm to the affected person. The information holder shall document the determination under this section in writing and maintain the documentation for not less than three years.

Any information holder that experiences a breach of system security under this section shall disclose to the attorney general by mail or electronic mail any breach of system security that exceeds two hundred fifty residents of this state.

Source: SL 2018, ch 135, § 2.

22-40-21. Delay of notice that would impede criminal investigation.

A notification required under § 22-40-20 may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. If the notification is delayed, the notification shall be made not later than thirty days after the law enforcement agency determines that notification will not compromise the criminal investigation.

Source: SL 2018, ch 135, § 3.

22-40-22. Types of notice of breach of system security.

A disclosure under § 22-40-20 may be provided by:

(1)    Written notice;

(2)    Electronic notice, if the electronic notice is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. § 7001 in effect as of January 1, 2018, or if the information holder's primary method of communication with the resident of this state has been by electronic means; or

(3)    Substitute notice, if the information holder demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars, that the affected class of persons to be notified exceeds five hundred thousand persons, or that the information holder does not have sufficient contact information and the notice consists of each of the following:

(a)    Email notice, if the information holder has an email address for the subject persons;

(b)    Conspicuous posting of the notice on the information holder's website, if the information holder maintains a website page; and

(c)    Notification to statewide media.

Source: SL 2018, ch 135, § 4.

22-40-23. Notice of breach of system security in accordance with information holder's policies.

Notwithstanding § 22-40-22, if an information holder maintains its own notification procedure as part of an information security policy for the treatment of personal or protected information and the policy is otherwise consistent with the timing requirements of this section, the information holder is in compliance with the notification requirements of § 22-40-22 if the information holder notifies each person in accordance with the information holder's policies in the event of a breach of system security.

Source: SL 2018, ch 135, § 5.

22-40-24. Notice to consumer reporting agencies.

If an information holder discovers circumstances that require notification pursuant to § 22-40-20 the information holder shall also notify, without unreasonable delay, all consumer reporting agencies, as defined under 15 U.S.C. § 1681a in effect as of January 1, 2018, and any other credit bureau or agency that compiles and maintains files on consumers on a nationwide basis, of the timing, distribution, and content of the notice.

Source: SL 2018, ch 135, § 6.

22-40-25. Prosecution for violations.

The attorney general may prosecute each failure to disclose under the provisions of §§ 22-40-19 to 22-40-26, inclusive, as a deceptive act or practice under § 37-24-6. In addition to any remedy provided under chapter 37-24, the attorney general may bring an action to recover on behalf of the state a civil penalty of not more than ten thousand dollars per day per violation. The attorney general may recover attorney's fees and any costs associated with any action brought under this section.

Source: SL 2018, ch 135, § 7.

22-40-26. Notice of breach of system security in accordance with federal law.

Notwithstanding any other provisions in §§ 22-40-19 to 22-40-26, inclusive, any information holder that is regulated by federal law or regulation, including the Health Insurance Portability and Accountability Act of 1996 (P.L. 104-191, as amended) or the Gramm Leach Bliley Act (15 U.S.C. § 6801 et seq., as amended) and that maintains procedures for a breach of system security pursuant to the laws, rules, regulations, guidance, or guidelines established by its primary or functional federal regulator is deemed to be in compliance with this chapter if the information holder notifies affected South Dakota residents in accordance with the provisions of the applicable federal law or regulation.

Source: SL 2018, ch 135, § 8.