Section 37E. (a) For purposes of this section, the following words shall have the following meanings:—

''Harass'', willfully and maliciously engage in an act directed at a specific person or persons, which act seriously alarms or annoys such person or persons and would cause a reasonable person to suffer substantial emotional distress.

''Personal identifying information'', any name or number that may be used, alone or in conjunction with any other information, to assume the identity of an individual, including any name, address, telephone number, driver's license number, social security number, place of employment, employee identification number, mother's maiden name, demand deposit account number, savings account number, credit card number or computer password identification.

''Pose'', to falsely represent oneself, directly or indirectly, as another person or persons.

''Victim'', any person who has suffered financial loss or any entity that provided money, credit, goods, services or anything of value and has suffered financial loss as a direct result of the commission or attempted commission of a violation of this section.

(b) Whoever, with intent to defraud, poses as another person without the express authorization of that person and uses such person's personal identifying information to obtain or to attempt to obtain money, credit, goods, services, anything of value, any identification card or other evidence of such person's identity, or to harass another shall be guilty of identity fraud and shall be punished by a fine of not more than $5,000 or imprisonment in a house of correction for not more than two and one-half years, or by both such fine and imprisonment.

(c) Whoever, with intent to defraud, obtains personal identifying information about another person without the express authorization of such person, with the intent to pose as such person or who obtains personal identifying information about a person without the express authorization of such person in order to assist another to pose as such person in order to obtain money, credit, goods, services, anything of value, any identification card or other evidence of such person's identity, or to harass another shall be guilty of the crime of identity fraud and shall be punished by a fine of not more than $5,000 or imprisonment in a house of correction for not more than two and one-half years, or by both such fine and imprisonment.

(c1/2) Whoever possesses a tool, instrument or other article adapted, designed or commonly used for accessing a person's financial services account number or code, savings account number or code, checking account number or code, brokerage account number or code, credit card account number or code, debit card number or code, automated teller machine number or code, personal identification number, mother's maiden name, computer system password, electronic signature or unique biometric data that is a fingerprint, voice print, retinal image or iris image of another person under circumstances evincing an intent to use or knowledge that some person intends to use the same in the commission of larceny shall be guilty of identity fraud and shall be punished by a fine of not more than $5,000, or imprisonment in a house of correction for not more than 21/2 years, or by both such fine and imprisonment.

(d) A person found guilty of violating any provisions of this section shall, in addition to any other punishment, be ordered to make restitution for financial loss sustained by a victim as a result of such violation. Financial loss may include any costs incurred by such victim in correcting the credit history of such victim or any costs incurred in connection with any civil or administrative proceeding to satisfy any debt or other obligation of such victim, including lost wages and attorney's fees.

(e) A law enforcement officer may arrest without warrant any person he has probable cause to believe has committed the offense of identity fraud as defined in this section.

(f) A law enforcement officer shall accept a police incident report from a victim and shall provide a copy to such victim, if requested, within 24 hours. Such police incident reports may be filed in any county where a victim resides, or in any county where the owner or license holder of personal information stores or maintains said personal information, the owner's or license holder's principal place of business or any county in which the breach of security occurred, in whole or in part.