BILL NUMBER: SB 909	AMENDED
	BILL TEXT

	AMENDED IN ASSEMBLY  JUNE 30, 2010
	AMENDED IN ASSEMBLY  JUNE 14, 2010
	AMENDED IN SENATE  MAY 12, 2010
	AMENDED IN SENATE  MARCH 8, 2010

INTRODUCED BY   Senator Wright

                        JANUARY 27, 2010

   An act to amend Sections 1786.16 and 1786.20 of the Civil Code,
relating to personal information.


	LEGISLATIVE COUNSEL'S DIGEST


   SB 909, as amended, Wright. Investigative consumer reporting
agencies: disclosures.
   Existing law requires a person who procures or causes to be
prepared an investigative consumer report for employment purposes
other than suspicion of wrongdoing to make specified disclosures to
the consumer, including, but not limited to, the name and address of
the agency conducting the investigation, the nature and scope of the
investigation, and information on consumer inspection.
   This bill would additionally require a person who procures or
causes to be prepared an investigative consumer report for employment
purposes to provide a consumer with the Internet Web site address of
the investigative consumer reporting agency where the consumer may
find additional information about the agency's privacy practices.
   Existing law requires investigative consumer reporting agencies to
establish reasonable procedures to ensure that specified, prohibited
items of information concerning consumers are not part of the
reports they furnish. Existing law generally provides that an
investigative consumer reporting agency or user of information that
fails to comply with any requirement under these provisions with
respect to an investigative consumer report is liable to the consumer
who is the subject of the report for the sum of the greater of
actual damages or $10,000, the costs of the action, reasonable
attorney's fees, and, in certain cases, punitive damages, as
specified.
   This bill would additionally require an investigative consumer
reporting agency to conspicuously post on its primary Internet Web
site information describing its privacy practices with respect to its
preparation and processing of investigative consumer reports. The
bill would provide that an investigative consumer reporting agency is
liable to a consumer who is harmed by any unauthorized access of the
consumer's personally identifiable information, act, or omission
that occurs outside the United States or its territories, as
specified.
   Vote: majority. Appropriation: no. Fiscal committee: no.
State-mandated local program: no.


THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:

  SECTION 1.  Section 1786.16 of the Civil Code is amended to read:
   1786.16.  (a) Any person described in subdivision (d) of Section
1786.12 shall not procure or cause to be prepared an investigative
consumer report unless the following applicable conditions are met:
   (1) If an investigative consumer report is sought in connection
with the underwriting of insurance, it shall be clearly and
accurately disclosed in writing at the time the application form,
medical form, binder, or similar document is signed by the consumer
that an investigative consumer report regarding the consumer's
character, general reputation, personal characteristics, and mode of
living may be made. If no signed application form, medical form,
binder, or similar document is involved in the underwriting
transaction, the disclosure shall be made to the consumer in writing
and mailed or otherwise delivered to the consumer not later than
three days after the report was first requested. The disclosure shall
include the name and address of any investigative consumer reporting
agency conducting an investigation, plus the nature and scope of the
investigation requested, and a summary of the provisions of Section
1786.22.
   (2) If, at any time, an investigative consumer report is sought
for employment purposes other than suspicion of wrongdoing or
misconduct by the subject of the investigation, the person seeking
the investigative consumer report may procure the report, or cause
the report to be made, only if all of the following apply:
   (A) The person procuring or causing the report to be made has a
permissible purpose, as defined in Section 1786.12.
   (B) The person procuring or causing the report to be made provides
a clear and conspicuous disclosure in writing to the consumer at any
time before the report is procured or caused to be made in a
document that consists solely of the disclosure, that:
   (i) An investigative consumer report may be obtained.
   (ii) The permissible purpose of the report is identified.
   (iii) The disclosure may include information on the consumer's
character, general reputation, personal characteristics, and mode of
living.
   (iv) Identifies the name, address, and telephone number of the
investigative consumer reporting agency conducting the investigation.

   (v) Notifies the consumer in writing of the nature and scope of
the investigation requested, including a summary of the provisions of
Section 1786.22.
   (vi) Notifies the consumer of the Internet Web site address of the
investigative consumer reporting agency, identified in clause (iv),
where the consumer may find information about the investigative
reporting agency's privacy practices including whether the consumer's
personal information will be sent outside the United States  or
its territories  and compliance with subdivision (d) of Section
1786.20. This clause shall become operative on January 1, 2012.
   (C) The consumer has authorized in writing the procurement of the
report.
   (3) If an investigative consumer report is sought in connection
with the hiring of a dwelling unit, as defined in subdivision (c) of
Section 1940, the person procuring or causing the request to be made
shall, not later than three days after the date on which the report
was first requested, notify the consumer in writing that an
investigative consumer report will be made regarding the consumer's
character, general reputation, personal characteristics, and mode of
living. The notification shall also include the name and address of
the investigative consumer reporting agency that will prepare the
report and a summary of the provisions of Section 1786.22.
   (4) The person procuring or causing the request to be made shall
certify to the investigative consumer reporting agency that the
person has made the applicable disclosures to the consumer required
by this subdivision and that the person will comply with subdivision
(b).
   (5) The person procuring the report or causing it to be prepared
agrees to provide a copy of the report to the subject of the
investigation, as provided in subdivision (b).
   (b) Any person described in subdivision (d) of Section 1786.12 who
requests an investigative consumer report, in accordance with
subdivision (a) regarding that consumer, shall do the following:
   (1) Provide the consumer a means by which the consumer may
indicate on a written form, by means of a box to check, that the
consumer wishes to receive a copy of any report that is prepared. If
the consumer wishes to receive a copy of the report, the recipient of
the report shall send a copy of the report to the consumer within
three business days of the date that the report is provided to the
recipient, who may contract with any other entity to send a copy to
the consumer. The notice to request the report may be contained on
either the disclosure form, as required by subdivision (a), or a
separate consent form. The copy of the report shall contain the name,
address, and telephone number of the person who issued the report
and how to contact them.
   (2) Comply with Section 1786.40, if the taking of adverse action
is a consideration.
   (c) Subdivisions (a) and (b) do not apply to an investigative
consumer report procured or caused to be prepared by an employer, if
the report is sought for employment purposes due to suspicion held by
an employer of wrongdoing or misconduct by the subject of the
investigation.
   (d) Those persons described in subdivision (d) of Section 1786.12
constitute the sole and exclusive class of persons who may cause an
investigative consumer report to be prepared.
  SEC. 2.  Section 1786.20 of the Civil Code is amended to read:
   1786.20.  (a) An investigative consumer reporting agency shall
maintain reasonable procedures designed to avoid violations of
Section 1786.18 and to limit furnishing of investigative consumer
reports for the purposes listed under Section 1786.12. These
procedures shall require that prospective users of the information
identify themselves, certify the purposes for which the information
is sought and that the information will be used for no other
purposes, and make the certifications described in paragraph (4) of
subdivision (a) of Section 1786.16. From the effective date of this
title, the investigative consumer reporting agency shall keep a
record of the purposes for which information is sought, as stated by
the user. The investigative consumer reporting agency may assume that
the purpose for which a user seeks information remains the same as
that which a user has previously stated. The investigative consumer
reporting agency shall inform the user that the user is obligated to
notify the agency of any change in the purpose for which information
will be used. An investigative consumer reporting agency shall make a
reasonable effort to verify the identity of a new prospective user
and the uses certified by the prospective user prior to furnishing
the user any investigative consumer reports. An investigative
consumer reporting agency may not furnish an investigative consumer
report to a person unless it has a written agreement that the
investigative consumer reports will be used by that person only for
purposes listed in Section 1786.12.
   (b) Whenever an investigative consumer reporting agency prepares
an investigative consumer report, it shall follow reasonable
procedures to assure maximum possible accuracy of the information
concerning the individual about whom the report relates. An
investigative consumer reporting agency shall retain the
investigative consumer report for two years after the report is
provided.
   (c) An investigative consumer reporting agency may not make an
inquiry for the purpose of preparing an investigative consumer report
on a consumer for employment purposes if the making of the inquiry
by an employer or prospective employer of the consumer would violate
applicable federal or state equal employment opportunity law or
regulation.
   (d) (1) An investigative consumer reporting agency doing business
in this state shall conspicuously post, as defined in subdivision (b)
of Section 22577 of the Business and Professions Code, on its
primary Internet Web site information describing its privacy
practices with respect to its preparation and processing of
investigative consumer reports. The privacy statement shall
conspicuously include, but not be limited to, both of the following:
   (A) A statement entitled "Personal Information Disclosure: United
States or Overseas," that indicates whether the personal information
will be transferred to third parties outside the United States 
or its territories  .
   (B) A separate section that includes the name, mailing address,
e-mail address, and telephone number of the consumer reporting agency
representatives who can assist a consumer with additional
information regarding the consumer reporting agency's privacy
practices or policies in the event of a compromise of his or her
information.
   (2) For purposes of this subdivision, "third party" shall include,
but not be limited to, a contractor, foreign affiliate, wholly owned
entity, or an employee of the investigative consumer reporting
agency.
   (e) An investigative consumer reporting agency shall be liable to
a consumer who is the subject of a report if the consumer is harmed
by any unauthorized access of the consumer's personally identifiable
information, act, or omission that occurs outside the United States
or its territories as a result of the investigative consumer
reporting agency negligently preparing or processing an investigative
consumer report, or portion thereof, outside of the United States or
its territories. Liability shall be in an amount equal to the sum of
(1) any actual damages sustained by the consumer as a result of the
unauthorized access, and (2) in the case of any successful action to
enforce any liability under this section, the costs of the action
together with reasonable attorney's fees, as determined by the court.