BILL NUMBER: AB 1068 CHAPTERED
BILL TEXT
CHAPTER 1030
FILED WITH SECRETARY OF STATE SEPTEMBER 28, 2002
APPROVED BY GOVERNOR SEPTEMBER 28, 2002
PASSED THE ASSEMBLY AUGUST 22, 2002
PASSED THE SENATE AUGUST 19, 2002
AMENDED IN SENATE AUGUST 14, 2002
AMENDED IN SENATE JUNE 26, 2002
AMENDED IN SENATE JUNE 13, 2002
AMENDED IN SENATE MAY 14, 2002
AMENDED IN SENATE APRIL 22, 2002
AMENDED IN SENATE AUGUST 20, 2001
INTRODUCED BY Assembly Member Wright
(Coauthor: Assembly Member Nation)
FEBRUARY 23, 2001
An act to amend Sections 1785.16.2, 1785.20.3, 1786.16, 1786.24,
1786.29, and 1786.53 of, and to add Sections 1786.40, 1786.55, and
1786.60 to, the Civil Code, relating to personal information, and
declaring the urgency thereof, to take effect immediately.
LEGISLATIVE COUNSEL'S DIGEST
AB 1068, Wright. Personal information.
(1) The Consumer Credit Reporting Agencies Act regulates consumer
credit reporting agencies and the manner in which these agencies
assemble and evaluate consumer credit information, as specified.
Existing law prohibits the sale of a consumer debt if the file of the
consumer is blocked, as specified, or if the consumer provides in
writing that the debt is not his or her obligation due to identity
theft. Existing law exempts from those prohibitions the sale of a
debt to a subsidiary or affiliate of the creditor.
This bill would revise and recast those provisions, and define the
term "debt collector." The bill would additionally require, for
continual exemption from those prohibitions, that a subsidiary or
affiliate not take any action to collect on the debt.
(2) Existing law establishes a process by which any person who
uses a consumer credit report in connection with a credit transaction
is required to verify the address of the consumer, confirm that the
transaction is not the result of identity theft, and verify the
identity of the consumer, under specified circumstances.
This bill would delete those provisions and establish a different
process by which any person who uses a consumer credit report in
connection with the approval of credit based on an application for an
extension of credit is required to make verifications and
confirmations, under specified circumstances. The bill would require
a creditor to provide written notice to a victim of identity theft
of his or her rights, pursuant to specified provisions. The bill
would exempt certain entities, as specified, from certain notice
requirements. The bill would also exclude from these provisions a
United States Army or Air Force post office address or a United
States Fleet post office address.
(3) Existing law requires that a person that procures or causes to
be prepared an investigative consumer report in connection with the
underwriting of insurance or for employment purposes other than
suspicion of wrongdoing meet specified conditions, including, but not
limited to, the name and address of the agency conducting the
investigation, the nature and scope of the investigation, and
information on consumer inspection.
This bill would impose further requirements on the recipient of an
investigative consumer report, as specified, unless the report is
procured or caused to be prepared by an employer for employment
purposes due to suspicion of wrongdoing or misconduct.
(4) Existing law establishes a process by which a consumer may
dispute the accuracy of information in a consumer credit report.
Existing law requires an investigative consumer reporting agency to
make reinvestigations, as specified, and, if information is deleted
or modified, to notify the appropriate source from which the disputed
information was obtained and the consumer.
This bill would provide that notification to the consumer need not
provide the identity of the source of the disputed information.
(5) Existing law requires an investigative consumer reporting
agency to attach notices as cover sheets to any report, in at least
16-point type, setting forth disclosures and warnings, as specified,
and to send a copy to the subject of the report.
This bill would require those notices to be placed on the first
page of an investigative consumer report in 12-point boldface type,
including a notice providing that information generated as a result
of identity theft, including evidence of criminal activity, may be
inaccurately associated with the subject of the report. The bill
would also delete the copy requirement.
(6) Existing law permits an investigative consumer reporting
agency to prepare an investigative consumer report for various
purposes and entities.
This bill would provide that if an investigative consumer report
results in the denial of a specified insurance policy or the increase
of the hiring of a dwelling unit, the user of the report is to
notify the consumer of that adverse action and the name and address
of the agency that made the report.
(7) Existing law provides that any person that collects consumer
information, without the services of an investigative consumer
reporting agency, provide that information to the consumer, as
specified.
This bill would instead require that any person that collects or
receives consumer information for employment purposes that constitute
matters of public record, as defined, to provide that information on
no more than one occasion to the consumer in a specified form. The
bill would require that any person prior to taking adverse action in
response to that information give the consumer a copy of the public
record. The bill would also require that person to provide specified
information on any job application form, or any other written form,
to permit a consumer to waive his or her right to receive that
information, except as specified.
(8) Existing law requires an employer to make employee personnel
records available for review, with specified exceptions, and permits
an employer or employment agency to obtain employee information
without the use of an investigative consumer reporting agency.
Existing law generally provides that attorney-client communications
and attorney work product are privileged, with exceptions.
This bill would declare that these provisions are unaffected by
the bill.
(9) Existing law prohibits any person or entity, not including a
state or local agency, as of July 1, 2002, from using an individual's
social security number in certain ways, including posting it
publicly or requiring it for access to products or services.
This bill would exempt any financial institution from that
prohibition until July 1, 2003, for specified purposes.
(10) This bill would provide that the requirement that a creditor
is to provide written notice to a consumer identified as a victim of
identity theft of his or her rights is to become operative 90 days
after the effective date of this measure.
(11) This bill would declare that it is to take effect immediately
as an urgency statute.
THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:
SECTION 1. Section 1785.16.2 of the Civil Code is amended to read:
1785.16.2. (a) No creditor may sell a consumer debt to a debt
collector, as defined in 15 U.S.C. Sec. 1692a, if the consumer is a
victim of identity theft, as defined in Section 1798.2, and with
respect to that debt, the creditor has received notice pursuant to
subdivision (k) of Section 1785.16.
(b) Subdivision (a) does not apply to a creditor's sale of a debt
to a subsidiary or affiliate of the creditor, if, with respect to
that debt, the subsidiary or affiliate does not take any action to
collect the debt.
(c) For the purposes of this section, the requirement in 15 U.S.C.
Sec. 1692a, that a person must use an instrumentality of interstate
commerce or the mails in the collection of any debt to be considered
a debt collector, does not apply.
SEC. 2. Section 1785.20.3 of the Civil Code is amended to read:
1785.20.3. (a) Any person who uses a consumer credit report in
connection with the approval of credit based on an application for an
extension of credit, and who discovers that the address on the
credit application does not match, within a reasonable degree of
certainty, the address or addresses listed, if any, on the consumer
credit report, shall take reasonable steps to verify the accuracy of
the address provided on the application to confirm that the extension
of credit is not the result of identity theft, as defined in Section
1798.92.
(b) Any person who uses a consumer credit report in connection
with the approval of credit based on an application for an extension
of credit, and who has received notification pursuant to subdivision
(k) of Section 1785.16 that the applicant has been a victim of
identity theft, as defined in Section 1798.92, may not lend money or
extend credit without taking reasonable steps to verify the consumer'
s identity and confirm that the application for an extension of
credit is not the result of identity theft.
(c) Any consumer who suffers damages as a result of a violation of
this section by any person may bring an action in a court of
appropriate jurisdiction against that person to recover actual
damages, court costs, attorney's fees, and punitive damages of not
more than thirty thousand dollars ($30,000) for each violation, as
the court deems proper.
(d) As used in this section, "identity theft" has the meaning
given in subdivision (b) of Section 1798.92.
(e) For the purposes of this section, "extension of credit" does
not include an increase in an existing open-end credit plan, as
defined in Regulation Z of the Federal Reserve System (12 C.F.R.
226.2), or any change to or review of an existing credit account.
(f) If a consumer provides initial written notice to a creditor
that he or she is a victim of identity theft, as defined in
subdivision (d) of Section 1798.92, the creditor shall provide
written notice to the consumer of his or her rights under subdivision
(k) of Section 1785.16.
(g) The provisions of subdivisions (k) and (l) of Section 1785.16
do not apply to a consumer credit reporting agency that acts only as
a reseller of credit information by assembling and merging
information contained in the database of another consumer credit
reporting agency or the databases of multiple consumer credit
reporting agencies, and does not maintain a permanent database of
credit information from which new credit reports are produced.
(h) This section does not apply if one of the addresses at issue
is a United States Army or Air Force post office address or a United
States Fleet post office address.
SEC. 3. Section 1786.16 of the Civil Code is amended to read:
1786.16. (a) Any person described in subdivision (d) of Section
1786.12 shall not procure or cause to be prepared an investigative
consumer report unless the following applicable conditions are met:
(1) If an investigative consumer report is sought in connection
with the underwriting of insurance, it shall be clearly and
accurately disclosed in writing at the time the application form,
medical form, binder, or similar document is signed by the consumer
that an investigative consumer report regarding the consumer's
character, general reputation, personal characteristics, and mode of
living may be made. If no signed application form, medical form,
binder, or similar document is involved in the underwriting
transaction, the disclosure shall be made to the consumer in writing
and mailed or otherwise delivered to the consumer not later than
three days after the report was first requested. The disclosure
shall include the name and address of any investigative consumer
reporting agency conducting an investigation, plus the nature and
scope of the investigation requested, and a summary of the provisions
of Section 1786.22.
(2) If, at any time, an investigative consumer report is sought
for employment purposes other than suspicion of wrongdoing or
misconduct by the subject of the investigation, the person seeking
the investigative consumer report may procure the report, or cause
the report to be made, only if all of the following apply:
(A) The person procuring or causing the report to be made has a
permissible purpose, as defined in Section 1786.12.
(B) The person procuring or causing the report to be made provides
a clear and conspicuous disclosure in writing to the consumer at any
time before the report is procured or caused to be made in a
document that consists solely of the disclosure, that:
(i) An investigative consumer report may be obtained.
(ii) The permissible purpose of the report is identified.
(iii) The disclosure may include information on the consumer's
character, general reputation, personal characteristics, and mode of
living.
(iv) Identifies the name, address, and telephone number of the
investigative consumer reporting agency conducting the investigation.
(v) Notifies the consumer in writing of the nature and scope of
the investigation requested, including a summary of the provisions of
Section 1786.22.
(C) The consumer has authorized in writing the procurement of the
report.
(3) If an investigative consumer report is sought in connection
with the hiring of a dwelling unit, as defined in subdivision (c) of
Section 1940, the person procuring or causing the request to be made
shall, not later than three days after the date on which the report
was first requested, notify the consumer in writing that an
investigative consumer report will be made regarding the consumer's
character, general reputation, personal characteristics, and mode of
living. The notification shall also include the name and address of
the investigative consumer reporting agency that will prepare the
report and a summary of the provisions of Section 1786.22.
(4) The person procuring or causing the request to be made shall
certify to the investigative consumer reporting agency that the
person has made the applicable disclosures to the consumer required
by this subdivision and that the person will comply with subdivision
(b).
(5) The person procuring the report or causing it to be prepared
agrees to provide a copy of the report to the subject of the
investigation, as provided in subdivision (b).
(b) Any person described in subdivision (d) of Section 1786.12 who
requests an investigative consumer report, in accordance with
subdivision (a) regarding that consumer, shall do the following:
(1) Provide the consumer a means by which the consumer may
indicate on a written form, by means of a box to check, that the
consumer wishes to receive a copy of any report that is prepared. If
the consumer wishes to receive a copy of the report, the recipient
of the report shall send a copy of the report to the consumer within
three business days of the date that the report is provided to the
recipient, who may contract with any other entity to send a copy to
the consumer. The notice to request the report may be contained on
either the disclosure form, as required by subdivision (a), or a
separate consent form. The copy of the report shall contain the
name, address, and telephone number of the person who issued the
report and how to contact them.
(2) Comply with Section 1786.40, if the taking of adverse action
is a consideration.
(c) Subdivisions (a) and (b) do not apply to an investigative
consumer report procured or caused to be prepared by an employer, if
the report is sought for employment purposes due to suspicion held by
an employer of wrongdoing or misconduct by the subject of the
investigation.
(d) Those persons described in subdivision (d) of Section 1786.12
constitute the sole and exclusive class of persons who may cause an
investigative consumer report to be prepared.
SEC. 4. Section 1786.24 of the Civil Code is amended to read:
1786.24. (a) If the completeness or accuracy of any item of
information contained in his or her file is disputed by a consumer,
and the dispute is conveyed directly to the investigative consumer
reporting agency by the consumer, the investigative consumer
reporting agency shall, without charge, reinvestigate and record the
current status of the disputed information or delete the item from
the file in accordance with subdivision (c), before the end of the
30-day period beginning on the date on which the agency receives the
notice of the dispute from the consumer.
(b) The agency shall notify any person who provided information in
dispute at the address and in the manner specified by that person.
The notice shall include all relevant information regarding the
dispute that the investigative consumer reporting agency has received
from the consumer. The agency shall also promptly provide to the
person who provided the information in dispute all relevant
information regarding the dispute that is received by the agency from
the consumer during the reinvestigation.
(c) In conducting a reinvestigation, the investigative consumer
reporting agency shall review and consider all relevant information
submitted by the consumer with respect to the disputed item of
information.
(d) Notwithstanding subdivision (a), an investigative consumer
reporting agency may terminate a reinvestigation of information
disputed by a consumer if the investigative consumer reporting agency
reasonably determines that the dispute is frivolous or irrelevant,
including by reason of a failure by a consumer to provide sufficient
information to investigate the disputed information. Upon making a
determination that a dispute is frivolous or irrelevant, the
investigative consumer reporting agency shall notify the consumer, by
mail or, if authorized by the consumer for that purpose, by any
other means available to the agency. In this notification, the
investigative consumer reporting agency shall state the specific
reasons why it has determined that the consumer's dispute is
frivolous or irrelevant and provide a description of any information
required to investigate the disputed information, that may consist of
a standardized form describing the general nature of the required
information.
(e) If a reinvestigation is made and, after reinvestigation, the
disputed item of information is found to be inaccurate, incomplete,
or cannot be verified by the evidence submitted, the investigative
consumer reporting agency shall promptly delete that information from
the consumer's file or modify the information, as appropriate, based
on the results of the reinvestigation, and shall notify the consumer
that the information has been deleted or modified. The consumer
reporting agency shall also notify any and all sources from which the
disputed information was obtained and inform them in writing of the
reasons and results of the reinvestigation, and send a copy of this
notification to the consumer. In accordance with subdivision (b) of
Section 1786.10, the copy of the notification sent to the consumer
need not reveal the identity of the source of information, unless
otherwise required by law.
(f) No information may be reinserted in the file of a consumer
after having been deleted pursuant to this section, unless the person
who furnished the information verifies that the information is
complete and accurate. If any information deleted from the file of a
consumer is reinserted in the file, the investigative consumer
reporting agency shall promptly notify the consumer of the
reinsertion in writing or, if authorized by the consumer for that
purpose, by any other means available to the agency. As part of, or
in addition to, this notice, the investigative consumer reporting
agency shall provide to the consumer in writing (1) a statement that
the disputed information has been reinserted, (2) the name, address,
and telephone number of any furnisher of information contacted or
that contacted the investigative consumer reporting agency in
connection with the reinsertion, and the telephone number of the
furnisher, if reasonably available, and (3) a notice that the
consumer has the right to a reinvestigation of the information
reinserted by the investigative consumer reporting agency and to add
a statement to his or her file disputing the accuracy or completeness
of the information.
(g) An investigative consumer reporting agency shall provide
notice to the consumer of the results of any reinvestigation under
this section by mail or, if authorized by the consumer for that
purpose, by other means available to the agency. The notice shall
include (1) a statement that the reinvestigation is completed, (2) an
investigative consumer report that is based on the consumer's file
as that file is revised as a result of the reinvestigation, (3) a
description or indication of any changes made in the investigative
consumer report as a result of those revisions to the consumer's
file, (4) a notice that, if requested by the consumer, a description
of the procedure used to determine the accuracy and completeness of
the information shall be provided to the consumer by the
investigative consumer reporting agency, including the name, business
address, and telephone number of any furnisher of information
contacted in connection with that information, (5) a notice that the
consumer has the right to add a statement to the consumer's file
disputing the accuracy or completeness of the information, and (6) a
notice that the consumer has the right to request that the
investigative consumer reporting agency furnish notifications under
subdivision (k).
(h) The presence of information in the consumer's file that
contradicts the contention of the consumer shall not, in and of
itself, constitute reasonable grounds for believing the dispute is
frivolous or irrelevant.
(i) If the investigative consumer reporting agency determines that
the dispute is frivolous or irrelevant, or if the reinvestigation
does not resolve the dispute, or if the information is reinserted
into the file of a consumer pursuant to subdivision (f), the consumer
may file a brief statement setting forth the nature of the dispute.
The investigative consumer reporting agency may limit these
statements to not more than 500 words if it provides the consumer
with assistance in writing a clear summary of the dispute.
(j) If a statement of dispute is filed, the investigative consumer
reporting agency shall, in any subsequent investigative consumer
report containing the information in question, clearly note that the
information is disputed by the consumer and shall include in the
report either the statement of the consumer or a clear and accurate
summary thereof.
(k) Following the deletion of information from the file of a
consumer pursuant to this section, or following the filing of a
dispute pursuant to subdivision (i), the investigative consumer
reporting agency shall, at the request of the consumer, furnish
notification that the item of information has been deleted or that
the item of information is disputed. In the case of disputed
information, the notification shall include the statement or summary
of the dispute filed pursuant to subdivision (i). This notification
shall be furnished to any person who has, within two years prior to
the deletion or the filing of the dispute, received an investigative
consumer report concerning the consumer for employment purposes, or
who has, within one year of the deletion or the filing of the
dispute, received an investigative consumer report concerning the
consumer for any other purpose, if these investigative consumer
reports contained the deleted or disputed information, unless the
consumer specifically requests in writing, that this notification not
be given to all persons or to any specified persons. The
investigative consumer reporting agency shall clearly and
conspicuously disclose to the consumer his or her rights to make a
request that this notification not be made.
(l) An investigative consumer reporting agency shall maintain
reasonable procedures designed to prevent the reappearance in the
file of a consumer and in investigative consumer reports information
that has been deleted pursuant to this section and not reinserted
pursuant to subdivision (f).
(m) If the the dispute of a consumer is resolved by deletion of
the disputed information within three business days, beginning with
the day the investigative consumer reporting agency receives notice
of the dispute in accordance with subdivision (a), the investigative
consumer reporting agency is exempt from requirements for further
action under subdivisions (g), (i), and (j), if the agency: (1)
provides prompt notice of the deletion to the consumer by telephone,
(2) provides written confirmation of the deletion and a copy of an
investigative consumer report of the consumer that is based on the
file of a consumer after the deletion, and (3) includes, in the
telephone notice or in a written notice that accompanies the
confirmation and report, a statement of the consumer's right to
request under subdivision (k) that the agency not furnish
notifications under that subdivision.
(n) Any investigative consumer reporting agency that compiles and
maintains files on consumers on a nationwide basis, as defined in the
federal Fair Credit Reporting Act, as amended (15 U.S.C. Sec. 1681
et seq.), shall implement an automated system through which
furnishers of information to that agency may report the results of a
reinvestigation that finds incomplete or inaccurate information in
the file of a consumer to other investigative consumer reporting
agencies.
(o) All actions to be taken by an investigative consumer reporting
agency under this section are governed by the applicable time
periods specified in Section 611 of the federal Fair Credit Reporting
Act, as amended (15 U.S.C. Sec. 1681i).
SEC. 5. Section 1786.29 of the Civil Code is amended to read:
1786.29. An investigative consumer reporting agency shall provide
the following notices on the first page of an investigative consumer
report:
(a) A notice in at least 12-point boldface type setting forth that
the report does not guarantee the accuracy or truthfulness of the
information as to the subject of the investigation, but only that it
is accurately copied from public records, and information generated
as a result of identity theft, including evidence of criminal
activity, may be inaccurately associated with the consumer who is the
subject of the report.
(b) An investigative consumer reporting agency shall provide a
consumer seeking to obtain a copy of a report or making a request to
review a file, a written notice in simple, plain English and Spanish
setting forth the terms and conditions of his or her right to receive
all disclosures, as provided in Section 1786.26.
SEC. 6. Section 1786.40 is added to the Civil Code, to read:
1786.40. (a) Whenever insurance for personal, family, or
household purposes, employment, or the hiring of a dwelling unit
involving a consumer is denied, or the charge for that insurance or
the hiring of a dwelling unit is increased, under circumstances in
which a report regarding the consumer was obtained from an
investigative consumer reporting agency, the user of the
investigative consumer report shall so advise the consumer against
whom the adverse action has been taken and supply the name and
address of the investigative consumer reporting agency making the
report.
(b) Whenever insurance for personal, family, or household purposes
involving a consumer is denied or the charge for that insurance is
increased, either wholly or in part because of information bearing
upon the consumer's general reputation, personal characteristics, or
mode of living, that was obtained from a person other than an
investigative consumer reporting agency, the consumer, or another
person related to the consumer and acting on the consumer's behalf,
the user of the information shall, within a reasonable period of
time, and upon the consumer's written request for the reasons for the
adverse action received within 60 days after learning of the adverse
action, disclose the nature and substance of the information to the
consumer. The user of the information shall clearly and accurately
disclose to the consumer his or her right to make this written
request at the time the adverse action is communicated to the
consumer.
SEC. 7. Section 1786.53 of the Civil Code is amended to read:
1786.53. (a) Any person who collects, assembles, evaluates,
compiles, reports, transmits, transfers, or communicates information
on a consumer's character, general reputation, personnel
characteristics, or mode of living, for employment purposes, which
are matters of public record, and does not use the services of an
investigative consumer reporting agency, shall provide that
information to the consumer pursuant to subdivision (b). For
purposes of this section:
(1) "Adverse action," as relating to employment, means a denial of
employment or any decision made for an employment purpose that
adversely affects any current or prospective employee.
(2) The term "person" does not include an agency subject to the
Information Practices Act of 1977 (Chapter 1 (commencing with Section
1798) of Title 1.8).
(3) "Public records" means records documenting an arrest,
indictment, conviction, civil judicial action, tax lien, or
outstanding judgment.
(b) (1) Any person described in subdivision (a), or any person who
receives information pursuant to subdivision (a), shall provide a
copy of the related public record to the consumer within seven days
after receipt of the information, regardless of whether the
information is received in a written or oral form.
(2) Any person shall provide on any job application form, or any
other written form, a box that, if checked by the consumer, permits
the consumer to waive his or her right to receive a copy of any
public record obtained pursuant to this section.
(3) If any person obtains a public record pursuant to this section
for the purpose of conducting an investigation for suspicion of
wrongdoing or misconduct by the subject of the investigation, the
person may withhold the information until the completion of the
investigation. Upon completion, the person shall provide a copy of
the public record pursuant to paragraph (1), unless the consumer
waived his or her rights pursuant to paragraph (2).
(4) If any person takes any adverse action as a result of
receiving information pursuant to subdivision (a), the person shall
provide to the consumer a copy of the public record, regardless of
whether the consumer waived his or her rights pursuant to paragraph
(2).
(c) Nothing in subdivision (a) or (b) requires any person to
provide the same information to any consumer on more than one
occasion.
SEC. 8. Section 1786.55 is added to the Civil Code, to read:
1786.55. Nothing in this chapter is intended to modify Section
1198.5 of the Labor Code or existing law concerning information
obtained by an employer or employment agency without the use of the
services of an investigative consumer reporting agency for employment
reference checks, background investigations, credential
verifications, or employee investigations, except as provided in
Section 1786.53. Nothing in this chapter is intended to change or
supersede existing law related to privileged attorney-client
communications or attorney work product, or require the production or
disclosure of that information.
SEC. 9. Section 1786.60 is added to the Civil Code, to read:
1786.60. Notwithstanding subdivision (a) of Section 1798.85,
prior to July 1, 2003, any financial institution may print the social
security number of an individual on any account statement or similar
document mailed to that individual, if the social security number is
provided in connection with a transaction governed by the rules of
the National Automated Clearing House Association, or a transaction
initiated by a federal governmental entity through an automated
clearing house network.
SEC. 10. The changes made by this act to subdivision (f) of
Section 1785.20.3 of the Civil Code shall become operative 90 days
after the effective date of this act.
SEC. 11. This act is an urgency statute necessary for the
immediate preservation of the public peace, health, or safety within
the meaning of Article IV of the Constitution and shall go into
immediate effect. The facts constituting the necessity are:
In order to clarify confusion over the operational provisions of
Chapter 354 of the Statutes of 2001, and further protect consumer
interests in relation to credit information and identity theft, it is
necessary that this act take immediate effect.