BILL NUMBER: SB 909 AMENDED
BILL TEXT
AMENDED IN SENATE MAY 12, 2010
AMENDED IN SENATE MARCH 8, 2010
INTRODUCED BY Senator Wright
JANUARY 27, 2010
An act to amend Sections 1786.16 and 1786.20 of the Civil Code,
relating to personal information.
LEGISLATIVE COUNSEL'S DIGEST
SB 909, as amended, Wright. Investigative consumer reporting
agencies: disclosures.
Existing law requires a person who procures or causes to be
prepared an investigative consumer report for employment purposes
other than suspicion of wrongdoing to meet specified conditions,
including, but not limited to, the name and address of the agency
conducting the investigation, the nature and scope of the
investigation, and information on consumer inspection.
This bill would additionally require a person who procures or
causes to be prepared an investigative consumer report for employment
purposes to provide a consumer with a Disclosure and Request for
Consent for the Information to be Sent Outside of the United States
or its Territories, as specified, if that person knows or should know
that any part of an investigative consumer report will be prepared
or processed outside the United States.
Existing law requires investigative consumer reporting agencies to
establish reasonable procedures to ensure that specified, prohibited
items of information concerning consumers are not part of the
reports they furnish. Existing law generally provides that an
investigative consumer reporting agency or user of information that
fails to comply with any requirement under these provisions with
respect to an investigative consumer report is liable to the consumer
who is the subject of the report for the sum of the greater of
actual damages or $10,000, the costs of the action, reasonable
attorney's fees, and, in certain cases, punitive damages, as
specified.
This bill would additionally require an investigative consumer
reporting agency that prepares or processes in any manner an
investigative consumer report, or portion thereof, outside of the
United States or its territories to make specified disclosures to the
potential user of this information, including, but not limited to,
the country or countries where the report, or portion thereof, will
be prepared or processed. The bill would also prohibit an
investigative consumer reporting agency from transmitting a consumer'
s social security number, except for the last 4 digits, outside of
the United States or its territories. The bill would require these
agencies to adopt and publish conspicuously
post a privacy policy relating to information contained in
reports that are prepared or processed outside of the United States,
as specified. The bill would provide that an investigative consumer
reporting agency is liable to a consumer who is harmed by any act or
omission that occurs outside the United States or its territories, as
specified.
This bill would exempt a person who procures or causes to be
prepared an investigative consumer report and an investigative
consumer reporting agency from these requirements if the requested
information pertains or relates to matters that occurred outside of
the United States or its territories, or was
stored, processed, or prepared outside of the United States or its
territories prior to date the report was requested , or was sent
outside the United States or its territories solely for the purpose
of transmitting or storing data .
Vote: majority. Appropriation: no. Fiscal committee: no.
State-mandated local program: no.
THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:
SECTION 1. Section 1786.16 of the Civil Code is amended to read:
1786.16. (a) Any person described in subdivision (d) of Section
1786.12 shall not procure or cause to be prepared an investigative
consumer report unless the following applicable conditions are met:
(1) If an investigative consumer report is sought in connection
with the underwriting of insurance, it shall be clearly and
accurately disclosed in writing at the time the application form,
medical form, binder, or similar document is signed by the consumer
that an investigative consumer report regarding the consumer's
character, general reputation, personal characteristics, and mode of
living may be made. If no signed application form, medical form,
binder, or similar document is involved in the underwriting
transaction, the disclosure shall be made to the consumer in writing
and mailed or otherwise delivered to the consumer not later than
three days after the report was first requested. The disclosure shall
include the name and address of any investigative consumer reporting
agency conducting an investigation, plus the nature and scope of the
investigation requested, and a summary of the provisions of Section
1786.22.
(2) If, at any time, an investigative consumer report is sought
for employment purposes other than suspicion of wrongdoing or
misconduct by the subject of the investigation, the person seeking
the investigative consumer report may procure the report, or cause
the report to be made, only if all of the following apply:
(A) The person procuring or causing the report to be made has a
permissible purpose, as defined in Section 1786.12.
(B) The person procuring or causing the report to be made provides
a clear and conspicuous disclosure in writing to the consumer at any
time before the report is procured or caused to be made in a
document that consists solely of the disclosure, that:
(i) An investigative consumer report may be obtained.
(ii) The permissible purpose of the report is identified.
(iii) The disclosure may include information on the consumer's
character, general reputation, personal characteristics, and mode of
living.
(iv) Identifies the name, address, and telephone number of the
investigative consumer reporting agency conducting the investigation.
(v) Notifies the consumer in writing of the nature and scope of
the investigation requested, including a summary of the provisions of
Section 1786.22.
(C) (i) If the person procuring or causing the report to be made
knows, or in the exercise of reasonable care should know, that any
part of an investigative consumer report is to be prepared or
processed outside the United States or its territories, that person
provides a Disclosure and Request for Consent for the Information to
be Sent Outside of the United States or its Territories, which is an
independent document that meets both of the following requirements:
(I) The document provides all of the information described in
paragraphs (1) to (5), inclusive, of subdivision (e) of Section
1786.20.
(II) The title of the document is printed in at least 14-point
boldface type, and the content of the document is printed in at least
12-point type.
(ii) This subparagraph shall not apply if the information to be
obtained pertains or relates to matters that occurred outside of the
United States or its territories, or was stored,
processed, or prepared outside of the United States or its
territories prior to the date the report was requested , or was
sent outside the United States or its territories solely for the
purpose of transmitting or storing data .
(D) The consumer has authorized in writing the procurement of the
report.
(3) If an investigative consumer report is sought in connection
with the hiring of a dwelling unit, as defined in subdivision (c) of
Section 1940, the person procuring or causing the request to be made
shall, not later than three days after the date on which the report
was first requested, notify the consumer in writing that an
investigative consumer report will be made regarding the consumer's
character, general reputation, personal characteristics, and mode of
living. The notification shall also include the name and address of
the investigative consumer reporting agency that will prepare the
report and a summary of the provisions of Section 1786.22.
(4) The person procuring or causing the request to be made shall
certify to the investigative consumer reporting agency that the
person has made the applicable disclosures to the consumer required
by this subdivision and that the person will comply with subdivision
(b).
(5) The person procuring the report or causing it to be prepared
agrees to provide a copy of the report to the subject of the
investigation, as provided in subdivision (b).
(b) Any person described in subdivision (d) of Section 1786.12 who
requests an investigative consumer report, in accordance with
subdivision (a) regarding that consumer, shall do the following:
(1) Provide the consumer a means by which the consumer may
indicate on a written form, by means of a box to check, that the
consumer wishes to receive a copy of any report that is prepared. If
the consumer wishes to receive a copy of the report, the recipient of
the report shall send a copy of the report to the consumer within
three business days of the date that the report is provided to the
recipient, who may contract with any other entity to send a copy to
the consumer. The notice to request the report may be contained on
either the disclosure form, as required by subdivision (a), or a
separate consent form. The copy of the report shall contain the name,
address, and telephone number of the person who issued the report
and how to contact them.
(2) Comply with Section 1786.40, if the taking of adverse action
is a consideration.
(c) Subdivisions (a) and (b) do not apply to an investigative
consumer report procured or caused to be prepared by an employer, if
the report is sought for employment purposes due to suspicion held by
an employer of wrongdoing or misconduct by the subject of the
investigation.
(d) Those persons described in subdivision (d) of Section 1786.12
constitute the sole and exclusive class of persons who may cause an
investigative consumer report to be prepared.
SEC. 2. Section 1786.20 of the Civil Code is amended to read:
1786.20. (a) An investigative consumer reporting agency shall
maintain reasonable procedures designed to avoid violations of
Section 1786.18 and to limit furnishing of investigative consumer
reports for the purposes listed under Section 1786.12. These
procedures shall require that prospective users of the information
identify themselves, certify the purposes for which the information
is sought and that the information will be used for no other
purposes, and make the certifications described in paragraph (4) of
subdivision (a) of Section 1786.16. From the effective date of this
title, the investigative consumer reporting agency shall keep a
record of the purposes for which information is sought, as stated by
the user. The investigative consumer reporting agency may assume that
the purpose for which a user seeks information remains the same as
that which a user has previously stated. The investigative consumer
reporting agency shall inform the user that the user is obligated to
notify the agency of any change in the purpose for which information
will be used. An investigative consumer reporting agency shall make a
reasonable effort to verify the identity of a new prospective user
and the uses certified by the prospective user prior to furnishing
the user any investigative consumer reports. An investigative
consumer reporting agency may not furnish an investigative consumer
report to a person unless it has a written agreement that the
investigative consumer reports will be used by that person only for
purposes listed in Section 1786.12.
(b) Whenever an investigative consumer reporting agency prepares
an investigative consumer report, it shall follow reasonable
procedures to assure maximum possible accuracy of the information
concerning the individual about whom the report relates. An
investigative consumer reporting agency shall retain the
investigative consumer report for two years after the report is
provided.
(c) An investigative consumer reporting agency may not make an
inquiry for the purpose of preparing an investigative consumer report
on a consumer for employment purposes if the making of the inquiry
by an employer or prospective employer of the consumer would violate
applicable federal or state equal employment opportunity law or
regulation.
(d) An investigative consumer reporting agency that prepares or
processes in any manner an investigative consumer report, or any
portion thereof, outside of the United States or its territories
shall adopt a privacy protection policy with regard to the
information contained in these reports. The investigative consumer
reporting agency shall publish conspicuously
post, as defined in subdivision (b) of Section 22577 of
the Business and Professions Code, this privacy protection
policy on an Internet Web site.
(e) An investigative consumer reporting agency that prepares or
processes in any manner an investigative consumer report, or any
portion thereof, outside the United States or its territories shall
comply with Sections 1789.81.5 and 1798.82.
(e)
(f) An investigative consumer reporting agency that
prepares or processes in any manner an investigative consumer report,
or any portion thereof, outside of the United States or its
territories, shall disclose this fact to prospective users of the
report. This disclosure shall be made regardless of whether the
report, or portion thereof, was prepared or processed by a
contractor, foreign affiliate, wholly owned entity, or an employee of
the investigative consumer reporting agency. This disclosure shall
be provided in an independent document printed in at least 12-point
type, and shall contain all of the following information:
(1) The country or countries where the report, or portion thereof,
is being prepared or processed.
(2) The specific information about the consumer that is being
transmitted or transferred outside of the United States or its
territories.
(3) A hyperlink to the investigative consumer reporting agency's
privacy protection policy prepared and published pursuant to
subdivision (d).
(4) Contact information, including an a
name, mailing address, e-mail address , and
a telephone number, of a representative of the
investigative consumer reporting agency who can assist a consumer who
is concerned that his or her information has been compromised as a
result of being prepared or processed outside of the Untied
United States or its territories.
(5) A description of the appropriate process for remedying a case
of identity theft in the jurisdiction where the consumer resides,
including the telephone number and mailing address of any agency
responsible for consumer protection locally and nationally.
(f)
(g) An investigative consumer reporting agency shall
be liable to a consumer who is the subject of a report in the event
that the consumer is harmed by any act or omission that occurs
outside the United States or its territories as a result of the
investigative consumer reporting agency preparing or processing an
investigative consumer report, or portion thereof, outside of the
United States or its territories.
(g)
(h) In no event shall an investigative consumer
reporting agency transmit, transfer, or communicate a consumer's
social security number outside of the United States or its
territories without first redacting the number so that only the last
four digits are visible.
(h)
(i) Subdivisions (d) to (g), inclusive, of this section
shall not apply if the information to be obtained pertains or
relates to matters that occurred outside of the United States or its
territories, or was stored, processed, or prepared
outside of the United States or its territories prior to the date
the report was requested , or was sent outside the United States
or its territories solely for the purpose of transmitting or storing
data .