BILL ANALYSIS                                                                                                                                                                                                    



                                                                  SB 909
                                                                  Page  1

          SENATE THIRD READING
          SB 909 (Wright)
          As Amended  August 12, 2010
          Majority vote 

           SENATE VOTE  :22-7  
           
           JUDICIARY           7-0                                         
           
           ----------------------------------------------------------------- 
          |Ayes:|Feuer, Brownley, Evans,   |     |                          |
          |     |Huffman, Jones, Monning,  |     |                          |
          |     |Saldana                   |     |                          |
          |-----+--------------------------+-----+--------------------------|
          |     |                          |     |                          |
           ----------------------------------------------------------------- 
           SUMMARY  :  Requires a person (i.e., a prospective employer) who  
          procures an investigative consumer report for employment  
          purposes to disclose to the consumer (i.e., an applicant) the  
          Internet Web site of the investigative consumer reporting  
          agency.  Requires the agency to conspicuously post on its  
          Internet Web site its privacy policy, including information on  
          whether reports are prepared or processed outside of the United  
          States or its territories.  Specifically,  this bill  :  

          1)Requires, as of January 1, 2012, a person who procures or  
            causes to be prepared an investigative consumer report for  
            employment purposes to notify the consumer of the Internet Web  
            site address of the investigative reporting agency's privacy  
            practices, including whether the consumer's personal  
            information will be sent outside of the United States or its  
            territories for preparation. 

          2)Requires an investigative consumer reporting agency doing  
            business in this state to conspicuously post on its primary  
            Internet Web site a description of its privacy practices with  
            respect to the preparation and processing of investigative  
            consumer reports.  If the agency does not have an Internet Web  
            site, it shall mail a written copy of the information to the  
            consumer upon request.  Specifies that the privacy statement  
            shall include, but not be limited to, both of the following:

             a)   A statement entitled "Personal Information Disclosure:   
               United States or Overseas," that indicates whether the  
               personal information will be transferred to third parties  








                                                                  SB 909
                                                                  Page  2

               outside of the United States or its territories; and,

             b)   A separate section that includes the name, mailing  
               address, e-mail address, and telephone number of the  
               consumer reporting agency representatives who can assist  
               the consumer with additional information about privacy  
               practices and policies in the event of a compromise of the  
               consumer's information. 

          3)Provides that an investigative consumer reporting agency shall  
            be liable if a consumer is harmed by an unauthorized access of  
            the consumer's personally identifiable information, or act or  
            omission that occurs as a result of the agency negligently  
            preparing or processing a report, or portion thereof, outside  
            of the United States or one of its territories. 
           
           FISCAL EFFECT  :  None
           
          COMMENTS  :  Under existing law, an "investigative consumer  
          reporting agency" is defined as any entity that, for a fee,  
          collects information about a person and prepares an  
          "investigative consumer report" relating to a person's general  
          reputation and personal characteristics.  For example, such  
          reports may include information on whether the person has  
          recently (usually within the past 7-10 years) filed for  
          bankruptcy, committed a crime, or been subject to an unlawful  
          detainer.  Such reports are typically obtained by employers  
          seeking background on a job applicant, landlords seeking  
          information on prospective tenants, or insurance companies  
          attempting to determine eligibility or calculate appropriate  
          rates for prospective subscribers.  Because of the sensitive  
          nature of the information contained in such reports - and the  
          profound impact that it can have on a person's ability to obtain  
          employment, housing, or insurance - the state has regulated such  
          agencies since 1975.  In general, existing law prescribes the  
          kinds of information that may be contained in such a report,  
          limits the purposes of which such a report can be procured, and  
          subjects both the reporting agency and the person procuring the  
          report to prescribed penalties and liabilities for violations.   
          ("Investigative consumer reports" should not be confused with  
          "consumer credit reports," which generally pertain to a person's  
          credit worthiness and which are regulated under a separate  
          statute.) 

          This bill would amend existing law only as it relates to reports  








                                                                  SB 909
                                                                  Page  3

           relating to employment  .  According to the author, investigative  
          consumer reporting agencies are increasingly subcontracting the  
          actual assembling and preparation of such reports to "offshore"  
          companies - that is, companies located outside of the United  
          States or its territories.  Because these other countries might  
          not have the same privacy protections that are available under  
          California and federal law, the author believes that job  
          applicants should know if their personal information will be  
          sent offshore for report preparation and, in the event that the  
          personal information is compromised as a result, then the  
          applicant should have an appropriate remedy.  Specifically, this  
          bill would require the person procuring the employment report to  
          provide the consumer with the reporting agency's Internet Web  
          site address so that the consumer can obtain information on the  
          agency's privacy policies, including whether personal  
          information will be sent outside of the United States for  
          processing or preparation.  In addition, the reporting agency  
          will be required to conspicuously post on its primary Internet  
          Web site its privacy policy, including information on whether  
          reports are prepared outside of the United States and its  
          policies in the event that personal information is compromised.  
          If the agency does not have an Internet Web site, it will be  
          required to provide such information in writing upon request by  
          the consumer. Finally, the bill would specify that an  
          investigative consumer reporting agency - which is already  
          generally liable to consumers for harms caused by the acts or  
          omissions of the agency that are in violation of existing  
          regulations -- is also liable to a consumer for harms that  
          result from unauthorized access to the consumer's personal data  
          or other acts or omissions that result from the preparation or  
          processing of the report outside of the United States or its  
          territories.  


           Analysis Prepared by  :    Thomas Clark / JUD. / (916) 319-2334 


                                                               FN: 0005779