BILL ANALYSIS
SENATE JUDICIARY COMMITTEE
Senator Ellen M. Corbett, Chair
2009-2010 Regular Session
AB 953 (Eng)
As Amended June 7, 2010
Hearing Date: June 15, 2010
Fiscal: Yes
Urgency: No
SK:jd
SUBJECT
Department of Motor Vehicles: Records: Confidentiality
DESCRIPTION
Existing law protects residence address information contained in
records of the Department of Motor Vehicles (DMV). In certain
instances, that information may be disclosed. For example, an
insurance company may obtain from DMV address information about
motorists and vehicle owners involved in accidents with
individuals insured with the company. This bill, sponsored by
the California Association of Collectors, would extend this
provision to also include authorized contractors of the
insurance company, such as debt collectors, thus permitting the
disclosure of the address information from DMV directly to the
authorized contractor in these instances.
BACKGROUND
Under existing law, residence address information in DMV records
is confidential and may not be disclosed to any person except to
a court, law enforcement or other government agency, or if the
disclosure is subject to certain exemptions. Disclosures to
insurance companies are currently exempted from this prohibition
when the company, under penalty of perjury, requests the
information for any of the following purposes: (1) to obtain the
address of another motorist or vehicle owner involved in an
accident with the company's insured; (2) to obtain address
information about an individual who has signed a written waiver
of the disclosure prohibition; or (3) to obtain address
information about other individuals insured under that policy
where the named insured has signed the written waiver.
(more)
AB 953 (Eng)
Page 2 of ?
This bill would permit the disclosure of residence address
information to an authorized contractor of the insurance
company. Information could only be disclosed for the purpose of
obtaining the address of another motorist or vehicle owner
involved in an accident with the company's insured.
CHANGES TO EXISTING LAW
Existing law provides that any residence address in DMV records
is confidential and shall not be disclosed to any person except
a court, law enforcement or other government agency, or as
specified in Vehicle Code Sections 1808.22 and 1808.23. (Veh.
Code Sec. 1808.21.)
Existing law provides that residence address information may be
released to an insurance company when the company, under penalty
of perjury, requests the information for the purpose of
obtaining the address of another motorist or vehicle owner
involved in an accident with the company's insured. Residence
information may also be released to an insurance company when
the company requests the information about an individual who has
signed a written waiver of Section 1808.21 or when the requested
information relates to individuals insured under the policy if a
named insured has signed the written waiver. (Veh. Code Sec.
1808.22(b).)
Existing law provides that any residential addresses released by
DMV may not be used for direct marketing or solicitation for the
purchase of any consumer product or service. (Veh. Code Sec.
1808.23(d).)
Existing law also requires any person who has access to
confidential or restricted DMV information to establish
procedures to protect the confidentiality of those records.
Existing law specifies that if any confidential or restricted
information is released to any agent of a person authorized to
obtain information, the person shall require the agent to take
all steps necessary to ensure confidentiality and prevent the
release of any information to a third party. No agent shall
obtain or use any confidential or restricted records for any
purpose other than the reason the information was requested.
(Veh. Code Sec. 1808.47.)
This bill would revise the above exemption to provide that the
prohibition on the release of residence information does not
AB 953 (Eng)
Page 3 of ?
apply to an authorized contractor of the insurance company when
the contractor requests the information for the purpose of
obtaining the address of another motorist or vehicle owner
involved in an accident with the company's insured. This bill
would provide that the information shall not be used or
disclosed for any other purpose or to any other person.
This bill would provide that all information obtained by
insurance companies, or their authorized contractors, from the
department shall be subject to existing state and federal
limitations on the use or disclosure of the information and data
security requirements that are applicable to the principal
(i.e., the insurer).
This bill would specify that the DMV shall enforce use or
disclosure limitations and data security requirements that are
imposed on authorized contractors in compliance with the
department's regulations.
COMMENT
1. Stated need for the bill
The author writes:
AB 953 allows insurance company agents to obtain home address
records from the Department of Motor Vehicles (DMV) with the
same high level of protection that those records already
receive under current law. . . . Under current law, there
is an uncertainty as to whether insurance companies can
authorize collection agencies to use the insurers' access to
DMV records in order to determine the home addresses of, and
thereby make contact with, drivers and vehicle owners who have
been involved in accidents with parties that they insure.
The author further explains, "[the bill] adds authorized agents
and employees under one circumstance only, where another
motorist or vehicle owner is involved in an accident with the
company's insured. The intent is to allow insurance companies
who use a collection agency for account management to authorize
the release directly to the agency rather than asking for it and
then sending it to the agency. This reduces business costs and
risks to privacy from multiple disclosures and transmissions.
The bill also makes it clear that all applicable privacy and
data security requirements must be followed."
AB 953 (Eng)
Page 4 of ?
The California Association of Collectors (CAC), sponsor, writes
that "[a]ddress information is critical to protect consumers by
validating proper identity or preventing fraud and
mis-identification. The bill makes it clear that all existing
privacy and data security laws apply and that DMV enforcement
processes also apply."
CAC indicates that "[c]ollectors get DMV address information now
in this situation to locate the owner, the financially
responsible party in a vehicle accident, when the vehicle may
have been operated by a non owner driver. The collector is
seeking the legally liable party who is financially responsible
for the damages in the accident. They are also seeking to
verify the correct identity to avoid going after the wrong party
and verifying the correct owner because title [to] the vehicle
may have changed several times since the accident."
2. Bill would permit disclosure of address information directly
to authorized contractor of insurance company; additional
protections needed to guard against misuse
a. Disclosure of address information directly to authorized
contractor
Current law's prohibition on the disclosure of residence
address information does not apply to insurance companies when
they are seeking that information to obtain the address of
another motorist or vehicle owner involved in an accident with
the company's insured. This bill would permit a disclosure to
be made by DMV directly to an authorized contractor of the
insurance company, for the purpose of obtaining the address of
another motorist or vehicle owner involved in an accident with
the company's insured.
The intent of this bill is to reduce costs for the insurance
company and contractor when an insurer engages a contractor's
services. For example, an insurer involved in a subrogation
action may need to find the owner of the vehicle involved in
an accident. Under existing law, the insurer must make the
request to DMV for address information and then give that
information to the authorized contractor to locate the vehicle
owner. Under this bill, that contractor could make a request
directly to DMV for information about the motorist or vehicle
owner involved in the accident.
This bill would provide that all information obtained under
AB 953 (Eng)
Page 5 of ?
the bill's exemptions regarding residence information shall be
subject to existing state and federal limitations on the use
or disclosure of the information and data security
requirements which are applicable to the principal. As a
result, existing provisions of law protecting such information
would apply. For example, current law provides that any
residential addresses released by DMV may not be used for
direct marketing or solicitation for the purchase of any
consumer product or service. Other provisions of law relating
more generally to data security such as Civil Code Section
1798.81.5, which requires businesses to maintain reasonable
security procedures and practices, and Civil Code Section
1798.82, which requires notification in the event of a data
breach, would apply to any disclosure.
The bill would also provide that residence information shall
not be used or disclosed for any other purpose or to any other
person. As a result, residence information obtained by an
authorized contractor for the purpose of obtaining the address
of another motorist or vehicle owner involved in an accident
with the company's insured could only be used or disclosed for
that specific purpose.
b. Additional protections needed
Despite the above-described provisions, this bill still raises
the concern that address information obtained for one purpose
could be used for another, despite the clear prohibition not
to do so. California law strictly protects residential
address information contained in DMV records and permits
access only to a court, law enforcement agency, or other
government agency or as permitted in Vehicle Code Sections
1808.22 or 1808.23. Those two sections contain very limited
exceptions allowing certain entities, under penalty of
perjury, access to residence information for certain purposes.
For example, insurers when requesting the information for the
purpose of obtaining the address of another motorist or
vehicle owner involved in an accident with the company's
insured or an attorney who needs the information to represent
a client in a criminal or civil action.
This bill would instead, for the first time, allow "authorized
contractors" including debt collectors to directly obtain from
DMV some of the most confidential information about California
drivers-their home address information. As a result, the
Committee may wish to amend the bill to contain the following
additional protections to protect against potential misuse of
AB 953 (Eng)
Page 6 of ?
this new authority:
Suggested amendments:
1. Require that the authorized contractor is acting on
behalf of the insurer pursuant to a contractual agreement;
2. Provide that the insurer is responsible for any misuse
of the information by the authorized contractor;
3. Strengthen current language in the bill by requiring
that the information may not be used or disclosed for any
other purpose other than the reason the information was
requested;
4. Require that all information received from DMV, and any
copies made of that information, be destroyed pursuant to
Civil Code Section 1798.81 once the authorized contractor
has used the information for the purpose of obtaining the
address of a motorist or vehicle owner involved in an
accident with individuals insured with the insurer;
5. Prohibit the authorized contractor from selling any
information obtained or storing, combining, or linking DMV
information with any database for resale or for any purpose
other than obtaining the address of a motorist or vehicle
owner involved in an accident with individuals insured with
the insurer;
6. Require the authorized contractor to maintain a log to
track the receipt, use, and dissemination of the
information. The log must be immediately available to DMV
upon request and must be maintained for four years from the
date of the request;
7. Require the authorized contractor to maintain a surety
bond in the amount of $50,000, consistent with Vehicle Code
Section 1810.2(c) and California Code of Regulations
Section 350.24; and
8. Provide that an authorized contractor that violates the
bill shall be liable to the DMV for civil penalties up to
$100,000 and, if the contractor is a Commercial Requester,
shall have its requester code suspended for a period of
five years, or revoked.
AB 953 (Eng)
Page 7 of ?
Many of the provisions described above are required already of
entities that have applied for "Commercial Requester" status
from the DMV, which permits some requesters to become
pre-approved to receive address information from the DMV to
accomplish a legitimate business purpose pursuant to specified
statutes. Those Commercial Requester Accounts (CRAs) are
established for applicants who have a legitimate business need
for obtaining DMV information, have paid the appropriate fee,
and provided a $50,000 bond. The DMV indicates that it
enforces the requirements that confidential information be
obtained only for specified reasons and kept secure and
confidential. For example, CRAs must sign a security
agreement and agree to Terms and Conditions, and the
distribution of restricted or confidential information in
violation of law is subject to a penalty up to $100,000. In
addition, DMV indicates that the security agreement must be
signed annually by the CRA's employees. DMV also indicates
that it would require proof of an authorization from the
authorized contractor.
Support : None Known
Opposition : None Known
HISTORY
Source : California Association of Collectors
Related Pending Legislation : SB 433 (Harman), which would have
required that DMV submit a report to the Legislature on January
1, 2011 regarding all requests for address information made to
the department by insurers and financial institutions in 2010,
was returned to the Secretary of the Senate pursuant to Joint
Rule 56.
Prior Legislation : None Known
Prior Vote :
Assembly Transportation Committee (Ayes 14, Noes 0)
Assembly Appropriations Committee (Ayes 17, Noes 0)
Assembly Floor (Ayes 73, Noes 0)
**************
AB 953 (Eng)
Page 8 of ?