BILL ANALYSIS                                                                                                                                                                                                    



                                                                 SB 909
                                                                 Page  1

          Date of Hearing:   June 29, 2010

                           ASSEMBLY COMMITTEE ON JUDICIARY
                                  Mike Feuer, Chair
                     SB 909 (Wright) - As Amended: June 14, 2010

                              As Proposed to be Amended

           SENATE VOTE  :  22-7

           SUBJECT  :  Investigative Consumer Reporting Agencies: Disclosures

           KEY ISSUE  :  Should job applicants be informed if any portion of  
          an employer-requested background report will be prepared outside  
          of the united states or its territories, where privacy  
          protections may not be as robust as they are in California or  
          within the united states? 

           FISCAL EFFECT  :  As currently in print this bill is keyed  
          non-fiscal.

                                      SYNOPSIS
          
          When a person applies for a job, the prospective employer often  
          provides the applicant's personal information to an  
          investigative consumer reporting agency that then prepares a  
          background report pertaining to certain aspects of the  
          applicant's history and general fitness for the job.  According  
          to the author, the preparation of these reports is increasingly  
          contracted out to businesses that operate outside of the United  
          States.  Because these other countries might not have the same  
          privacy protections that are available under California and  
          federal law, the author believes that job applicants should know  
          if their personal information will be sent offshore for report  
          preparation and, in the event that the personal information is  
          compromised as a result, then the applicant should have an  
          appropriate remedy.  Existing law already provides for the  
          regulation of investigative consumer reporting agencies and  
          imposes liability on both agencies and requesting employers if  
          and when a violation of the regulations causes harm to an  
          applicant.  However, the author contends that existing law does  
          not adequately address the situations in which the reports are  
          prepared overseas and, therefore, potentially beyond the reach  
          of U.S. and California laws.  This bill would require the person  
          procuring the report for employment purposes to provide the job  








                                                                 SB 909
                                                                 Page  2

          applicant with the Internet Web site address of the  
          investigative reporting agency where the applicant can find  
          additional information about the agency's privacy practices,  
          including whether the report will be prepared or processed  
          outside of the United States or one of its territories.  The  
          bill would also require an investigative reporting agency to  
          conspicuously post on its primary Internet Web site its privacy  
          policy, including information about how reports are processed  
          and prepared and whether any part of the preparation is done  
          overseas.  Finally, the bill would specify that an investigative  
          consumer reporting agency is liable to a consumer for harms that  
          result from the preparation of the report outside of the United  
          States.  This measure is supported by "Concerned CRAs," an  
          industry group made up of screening and reporting agencies that  
          oppose sending work outside of the United States.  The June 14  
          amendments to this bill have apparently removed all opposition. 

           SUMMARY :  Requires a person (i.e. a prospective employer) who  
          procures an investigative consumer report for employment  
          purposes to disclose to the consumer (i.e. an applicant) the  
          Internet Web site of the investigative consumer reporting  
          agency.  Requires the agency to conspicuously post on its  
          Internet Web site its privacy policy, including information on  
          whether reports are prepared or processed outside of the United  
          States or its territories.  Specifically,  this bill  :  

          1)Requires, as of January 1, 2012, a person who procures or  
            causes to be prepared an investigative consumer report for  
            employment purposes to notify the consumer of the Internet Web  
            site address of the investigative reporting agency's privacy  
            practices, including whether the consumer's personal  
            information will be sent outside of the United States or its  
            territories for preparation. 

          2)Requires an investigative consumer reporting agency doing  
            business in this state to conspicuously post on its primary  
            Internet Web site a description of its privacy practices with  
            respect to the preparation and processing of investigative  
            consumer reports.  Specifies that the privacy statement shall  
            include, but not be limited to, both of the following:

             a)   A statement entitled "Personal Information Disclosure:  
               United States or Overseas," that indicates whether the  
               personal information will be transferred to third parties  
               outside of the United States or its territories. 








                                                                 SB 909
                                                                 Page  3

             b)   A separate section that includes the name, mailing  
               address, e-mail address, and telephone number of the  
               consumer reporting agency representatives who can assist  
               the consumer with additional information about privacy  
               practices and policies in the event of a compromise of the  
               consumer's information. 

          3)Provides that an investigative consumer reporting agency shall  
            be liable if a consumer is harmed by an unauthorized access of  
            the consumer's personally identifiable information, or act or  
            omission that occurs as a result of the agency negligently  
            preparing or processing a report, or portion thereof, outside  
            of the United States or one of its territories. 

           EXISTING LAW  :  

          1)Defines "investigative consumer report," under the  
            Investigative Consumer Reporting Agencies Act (Civil Code  
            Section 1786 et seq.), to mean a report in which information  
            on a consumer's character, general reputation, personal  
            characteristics, or mode of living is obtained by any means.   
            Specifies that such reports do not include consumer credit  
            reports pertaining to a consumer's credit worthiness.  (Civil  
            Code Section 1786.2) 

          2)Prescribes the circumstances under which, and the persons to  
            whom, an investigative consumer reporting agency (agency) may  
            furnish a report, including to a person who intends to use the  
            information for employment purposes.  (Civil Code Section  
            1786.12.) 

          3)Sets forth the conditions under which a person may seek an  
            investigative consumer report.  Provides, generally, that a  
            person may procure a report for employment purposes only if  
            the person provides a clear and conspicuous written disclosure  
            that contains the following information: the scope and nature  
            of the report; the contact information of the agency that will  
            prepare the report; and information on the consumer's right to  
            inspect a copy of the report.  Specifies that the consumer  
            must authorize procurement of the report in writing before the  
            report can be sought by the person seeking the report.  (Civil  
            Code Section 1786.16 (a).)

          4)Requires a person who procures an investigative consumer  
            report to provide the consumer a means to indicate his or her  








                                                                 SB 909
                                                                 Page  4

            wish to obtain a copy of the report and, if the consumer  
            wishes to receive a copy of the report, the recipient of the  
            report shall send a copy of the report to the consumer within  
            three business days of the date that the report is provided to  
            the recipient.  (Civil Code Section 1786.16 (b).)

          5)Specifies the items of information that may  not  be included in  
            a report, including information pertaining to bankruptcies,  
            completed lawsuits, unlawful detainer actions, tax liens, and  
            records of arrest or convictions that predate the report by  
            more than seven to ten years, as specified.  (Civil Code  
            1786.18.) 

          6)Requires an investigative consumer reporting agency to  
            maintain reasonable procedures to ensure that reports contain  
            accurate and permissible information and that reports are only  
            provided to persons who are authorized to receive them for a  
            permissible purpose.  (Civil Code Section 1786.20).

          7)Provides that if an agency that prepares a report or a user  
            who procures a report fails to comply with any of the above  
            provisions is liable to the consumer who is the subject of the  
            report for damages, as specified.  (Civil Code Sections  
            1786.50 and 1786.52.) 

           COMMENTS  :  Under existing law, an "investigative consumer  
          reporting agency" is defined as any entity that, for a fee,  
          collects information about a person and prepares an  
          "investigative consumer report" relating to a person's general  
          reputation and personal characteristics.  (Civil Code Section  
          1786 et seq.)  For example, such reports may include information  
          on whether the person has recently (usually within the past 7-10  
          years) filed for bankruptcy, committed a crime, or been subject  
          to an unlawful detainer.  Such reports are typically obtained by  
          employers seeking background on a job applicant, landlords  
          seeking information on prospective tenants, or insurance  
          companies attempting to determine eligibility or calculate  
          appropriate rates for prospective subscribers.  Because of the  
          sensitive nature of the information contained in such reports -  
          and the profound impact that it can have on a person's ability  
          to obtain employment, housing, or insurance - the state has  
          regulated such agencies since 1975.  In general, existing law  
          prescribes the kinds of information that may be contained in  
          such a report, limits the purposes of which such a report can be  
          procured, and subjects both the reporting agency and the person  








                                                                 SB 909
                                                                 Page  5

          procuring the report to prescribed penalties and liabilities for  
          violations.  ("Investigative consumer reports" should not be  
          confused with "consumer credit reports," which generally pertain  
          to a person's credit worthiness and which are regulated under a  
          separate statute.) 

          This bill would amend existing law only as it relates to reports  
           relating to employment  .  According to the author, investigative  
          consumer reporting agencies are increasingly subcontracting the  
          actual assembling and preparation of such reports to "offshore"  
          companies - that is, companies located outside of the United  
          States or its territories.  Because these other countries might  
          not have the same privacy protections that are available under  
          California and federal law, the author believes that job  
          applicants should know if their personal information will be  
          sent offshore for report preparation and, in the event that the  
          personal information is compromised as a result, then the  
          applicant should have an appropriate remedy.  Specifically, this  
          bill would require the person procuring the employment report to  
          provide the consumer with the reporting agency's Internet Web  
          site address so that the consumer can obtain information on the  
          agency's privacy policies, including whether personal  
          information will be sent outside of the United States for  
          processing or preparation.  In addition, the reporting agency  
          will be required to conspicuously post on its primary Internet  
          Web site its privacy policy, including information on whether  
          reports are prepared outside of the United States and its  
          policies in the event that personal information is compromised.   
          Finally, the bill would specify that an investigative consumer  
          reporting agency - which is already generally liable to  
          consumers for harms caused by the acts or omissions of the  
          agency that are in violation of existing regulations -- is also  
          liable to a consumer for harms that result from unauthorized  
          access to the consumer's personal data or other acts or  
          omissions that result from the preparation or processing of the  
          report outside of the United States or its territories.  

           Proposed Technical Amendments  :  As originally in print, the bill  
          required disclosures concerning reports prepared or processed  
          "outside of the United States  or its territories  ."  The most  
          recent amended version refers to reports prepared "outside of  
          the United States" in some parts of the bill and "outside of the  
          United States or its territories" in other parts.  In order to  
          ensure consistency throughout, the author has agreed to take the  
          following amendments in this Committee:








                                                                 SB 909
                                                                 Page  6


             -    On page 4 line 32 after "States" insert: or its  
               territories

             -    On page 8 line 29 after "States" insert: or its  
               territories

           ARGUMENTS IN SUPPORT  :  According to the author, current law "is  
          silent on the issue of background checks being sent offshore for  
          processing and preparation."  The author contends that this is  
          so even though there have been "high profile data thefts  
          reported from workers in off-shore facilities," where California  
          and federal privacy laws do not apply.  This is especially  
          dangerous, the author contends, as the four-billion dollar  
          background screening industry seeks to cut costs by having much  
          of the work done in foreign nations, citing India and the  
          Philippines in particular.  According to the author, this bill  
          will simply ensure that job applicants know if their personal  
          information will be shipped off-shore and, because existing law  
          already requires an applicant to consent before a report is  
          procured, the consumer will have more power over where his or  
          her personal information is sent. 

          "Concerned CRAs" - an industry group made up of several  
          investigating screening and reporting agencies - support this  
          bill.  Several individual member companies of Concerned CRAs  
          write that most members of the industry take seriously their  
          responsibility to protect the confidential nature of the  
          personal information that is entrusted to them.  Most of these  
          companies have already adopted a policy against "off-shoring"  
          because the risk that it poses to an applicant's personal  
          information far outweighs any cost benefits.  Several of the  
          member companies indicate that they believe that this bill will  
          "educate others in our industry to do the same." 

           Related Pending Federal Legislation  :  H.R. 427: "Notify  
          Americans Before Outsourcing Personal Information Act."  This  
          measure would prohibit businesses from transferring personal  
          information of a U.S. citizen to any foreign affiliate or  
          subcontractor in another country without providing notice that  
          the information may be transferred to such affiliate or  
          subcontractor.  This bill also would authorize a private cause  
          of action in a state court to enforce compliance with this Act.   
          This bill is currently in the Subcommittee on House Financial  
          Services. 








                                                                 SB 909
                                                                 Page  7



           REGISTERED SUPPORT / OPPOSITION  :   

           Support 
           
          Concerned CRAs (sponsor)
          AccuCheck Investigations 
          ACUTRAQ
          All Background and People Checks 
          Alliance 2020
          AmericanChecked, Inc.
          Applicant Insight
          APSCREEN
          Ascertain Screening and Investigations 
          Background Profiles
          Baxter Research, Inc. 
          C3 Intelligence
          Data Access, Inc.
          DDS Employee Screening Services
          easyBackgrounds, Inc. 
          Edge Information Management, Inc. 
          Employee Screen IQ 
          Employment Screening Services, Inc.
          Frasco Profiles
          KnowMyHire.com
          Los Angeles District Attorney's Office 
          National Application Processing & Screening, Inc. 
          PreCheck, Inc. 
          Pre-Employment, Inc. 
          Privacy Rights Clearinghouse 
          Proforma Screening Solutions 
          Verifications, Inc. 

           Opposition 
           
          None on file
           

          Analysis Prepared by  :    Thomas Clark / JUD. / (916) 319-2334