BILL ANALYSIS SB 909 Page 1 Date of Hearing: June 29, 2010 ASSEMBLY COMMITTEE ON JUDICIARY Mike Feuer, Chair SB 909 (Wright) - As Amended: June 14, 2010 As Proposed to be Amended SENATE VOTE : 22-7 SUBJECT : Investigative Consumer Reporting Agencies: Disclosures KEY ISSUE : Should job applicants be informed if any portion of an employer-requested background report will be prepared outside of the united states or its territories, where privacy protections may not be as robust as they are in California or within the united states? FISCAL EFFECT : As currently in print this bill is keyed non-fiscal. SYNOPSIS When a person applies for a job, the prospective employer often provides the applicant's personal information to an investigative consumer reporting agency that then prepares a background report pertaining to certain aspects of the applicant's history and general fitness for the job. According to the author, the preparation of these reports is increasingly contracted out to businesses that operate outside of the United States. Because these other countries might not have the same privacy protections that are available under California and federal law, the author believes that job applicants should know if their personal information will be sent offshore for report preparation and, in the event that the personal information is compromised as a result, then the applicant should have an appropriate remedy. Existing law already provides for the regulation of investigative consumer reporting agencies and imposes liability on both agencies and requesting employers if and when a violation of the regulations causes harm to an applicant. However, the author contends that existing law does not adequately address the situations in which the reports are prepared overseas and, therefore, potentially beyond the reach of U.S. and California laws. This bill would require the person procuring the report for employment purposes to provide the job SB 909 Page 2 applicant with the Internet Web site address of the investigative reporting agency where the applicant can find additional information about the agency's privacy practices, including whether the report will be prepared or processed outside of the United States or one of its territories. The bill would also require an investigative reporting agency to conspicuously post on its primary Internet Web site its privacy policy, including information about how reports are processed and prepared and whether any part of the preparation is done overseas. Finally, the bill would specify that an investigative consumer reporting agency is liable to a consumer for harms that result from the preparation of the report outside of the United States. This measure is supported by "Concerned CRAs," an industry group made up of screening and reporting agencies that oppose sending work outside of the United States. The June 14 amendments to this bill have apparently removed all opposition. SUMMARY : Requires a person (i.e. a prospective employer) who procures an investigative consumer report for employment purposes to disclose to the consumer (i.e. an applicant) the Internet Web site of the investigative consumer reporting agency. Requires the agency to conspicuously post on its Internet Web site its privacy policy, including information on whether reports are prepared or processed outside of the United States or its territories. Specifically, this bill : 1)Requires, as of January 1, 2012, a person who procures or causes to be prepared an investigative consumer report for employment purposes to notify the consumer of the Internet Web site address of the investigative reporting agency's privacy practices, including whether the consumer's personal information will be sent outside of the United States or its territories for preparation. 2)Requires an investigative consumer reporting agency doing business in this state to conspicuously post on its primary Internet Web site a description of its privacy practices with respect to the preparation and processing of investigative consumer reports. Specifies that the privacy statement shall include, but not be limited to, both of the following: a) A statement entitled "Personal Information Disclosure: United States or Overseas," that indicates whether the personal information will be transferred to third parties outside of the United States or its territories. SB 909 Page 3 b) A separate section that includes the name, mailing address, e-mail address, and telephone number of the consumer reporting agency representatives who can assist the consumer with additional information about privacy practices and policies in the event of a compromise of the consumer's information. 3)Provides that an investigative consumer reporting agency shall be liable if a consumer is harmed by an unauthorized access of the consumer's personally identifiable information, or act or omission that occurs as a result of the agency negligently preparing or processing a report, or portion thereof, outside of the United States or one of its territories. EXISTING LAW : 1)Defines "investigative consumer report," under the Investigative Consumer Reporting Agencies Act (Civil Code Section 1786 et seq.), to mean a report in which information on a consumer's character, general reputation, personal characteristics, or mode of living is obtained by any means. Specifies that such reports do not include consumer credit reports pertaining to a consumer's credit worthiness. (Civil Code Section 1786.2) 2)Prescribes the circumstances under which, and the persons to whom, an investigative consumer reporting agency (agency) may furnish a report, including to a person who intends to use the information for employment purposes. (Civil Code Section 1786.12.) 3)Sets forth the conditions under which a person may seek an investigative consumer report. Provides, generally, that a person may procure a report for employment purposes only if the person provides a clear and conspicuous written disclosure that contains the following information: the scope and nature of the report; the contact information of the agency that will prepare the report; and information on the consumer's right to inspect a copy of the report. Specifies that the consumer must authorize procurement of the report in writing before the report can be sought by the person seeking the report. (Civil Code Section 1786.16 (a).) 4)Requires a person who procures an investigative consumer report to provide the consumer a means to indicate his or her SB 909 Page 4 wish to obtain a copy of the report and, if the consumer wishes to receive a copy of the report, the recipient of the report shall send a copy of the report to the consumer within three business days of the date that the report is provided to the recipient. (Civil Code Section 1786.16 (b).) 5)Specifies the items of information that may not be included in a report, including information pertaining to bankruptcies, completed lawsuits, unlawful detainer actions, tax liens, and records of arrest or convictions that predate the report by more than seven to ten years, as specified. (Civil Code 1786.18.) 6)Requires an investigative consumer reporting agency to maintain reasonable procedures to ensure that reports contain accurate and permissible information and that reports are only provided to persons who are authorized to receive them for a permissible purpose. (Civil Code Section 1786.20). 7)Provides that if an agency that prepares a report or a user who procures a report fails to comply with any of the above provisions is liable to the consumer who is the subject of the report for damages, as specified. (Civil Code Sections 1786.50 and 1786.52.) COMMENTS : Under existing law, an "investigative consumer reporting agency" is defined as any entity that, for a fee, collects information about a person and prepares an "investigative consumer report" relating to a person's general reputation and personal characteristics. (Civil Code Section 1786 et seq.) For example, such reports may include information on whether the person has recently (usually within the past 7-10 years) filed for bankruptcy, committed a crime, or been subject to an unlawful detainer. Such reports are typically obtained by employers seeking background on a job applicant, landlords seeking information on prospective tenants, or insurance companies attempting to determine eligibility or calculate appropriate rates for prospective subscribers. Because of the sensitive nature of the information contained in such reports - and the profound impact that it can have on a person's ability to obtain employment, housing, or insurance - the state has regulated such agencies since 1975. In general, existing law prescribes the kinds of information that may be contained in such a report, limits the purposes of which such a report can be procured, and subjects both the reporting agency and the person SB 909 Page 5 procuring the report to prescribed penalties and liabilities for violations. ("Investigative consumer reports" should not be confused with "consumer credit reports," which generally pertain to a person's credit worthiness and which are regulated under a separate statute.) This bill would amend existing law only as it relates to reports relating to employment . According to the author, investigative consumer reporting agencies are increasingly subcontracting the actual assembling and preparation of such reports to "offshore" companies - that is, companies located outside of the United States or its territories. Because these other countries might not have the same privacy protections that are available under California and federal law, the author believes that job applicants should know if their personal information will be sent offshore for report preparation and, in the event that the personal information is compromised as a result, then the applicant should have an appropriate remedy. Specifically, this bill would require the person procuring the employment report to provide the consumer with the reporting agency's Internet Web site address so that the consumer can obtain information on the agency's privacy policies, including whether personal information will be sent outside of the United States for processing or preparation. In addition, the reporting agency will be required to conspicuously post on its primary Internet Web site its privacy policy, including information on whether reports are prepared outside of the United States and its policies in the event that personal information is compromised. Finally, the bill would specify that an investigative consumer reporting agency - which is already generally liable to consumers for harms caused by the acts or omissions of the agency that are in violation of existing regulations -- is also liable to a consumer for harms that result from unauthorized access to the consumer's personal data or other acts or omissions that result from the preparation or processing of the report outside of the United States or its territories. Proposed Technical Amendments : As originally in print, the bill required disclosures concerning reports prepared or processed "outside of the United States or its territories ." The most recent amended version refers to reports prepared "outside of the United States" in some parts of the bill and "outside of the United States or its territories" in other parts. In order to ensure consistency throughout, the author has agreed to take the following amendments in this Committee: SB 909 Page 6 - On page 4 line 32 after "States" insert: or its territories - On page 8 line 29 after "States" insert: or its territories ARGUMENTS IN SUPPORT : According to the author, current law "is silent on the issue of background checks being sent offshore for processing and preparation." The author contends that this is so even though there have been "high profile data thefts reported from workers in off-shore facilities," where California and federal privacy laws do not apply. This is especially dangerous, the author contends, as the four-billion dollar background screening industry seeks to cut costs by having much of the work done in foreign nations, citing India and the Philippines in particular. According to the author, this bill will simply ensure that job applicants know if their personal information will be shipped off-shore and, because existing law already requires an applicant to consent before a report is procured, the consumer will have more power over where his or her personal information is sent. "Concerned CRAs" - an industry group made up of several investigating screening and reporting agencies - support this bill. Several individual member companies of Concerned CRAs write that most members of the industry take seriously their responsibility to protect the confidential nature of the personal information that is entrusted to them. Most of these companies have already adopted a policy against "off-shoring" because the risk that it poses to an applicant's personal information far outweighs any cost benefits. Several of the member companies indicate that they believe that this bill will "educate others in our industry to do the same." Related Pending Federal Legislation : H.R. 427: "Notify Americans Before Outsourcing Personal Information Act." This measure would prohibit businesses from transferring personal information of a U.S. citizen to any foreign affiliate or subcontractor in another country without providing notice that the information may be transferred to such affiliate or subcontractor. This bill also would authorize a private cause of action in a state court to enforce compliance with this Act. This bill is currently in the Subcommittee on House Financial Services. SB 909 Page 7 REGISTERED SUPPORT / OPPOSITION : Support Concerned CRAs (sponsor) AccuCheck Investigations ACUTRAQ All Background and People Checks Alliance 2020 AmericanChecked, Inc. Applicant Insight APSCREEN Ascertain Screening and Investigations Background Profiles Baxter Research, Inc. C3 Intelligence Data Access, Inc. DDS Employee Screening Services easyBackgrounds, Inc. Edge Information Management, Inc. Employee Screen IQ Employment Screening Services, Inc. Frasco Profiles KnowMyHire.com Los Angeles District Attorney's Office National Application Processing & Screening, Inc. PreCheck, Inc. Pre-Employment, Inc. Privacy Rights Clearinghouse Proforma Screening Solutions Verifications, Inc. Opposition None on file Analysis Prepared by : Thomas Clark / JUD. / (916) 319-2334