BILL ANALYSIS Ó AB 2667 Page 1 Date of Hearing: April 22, 2014 ASSEMBLY COMMITTEE ON JUDICIARY Bob Wieckowski, Chair AB 2667 (Bloom) - As Amended: March 27, 2014 As Proposed to be Amended SUBJECT : "RENT TO OWN" AGREEMENTS: ELECTRONIC DEVICES: MONITORING TECHNOLOGY AND "SPY" SOFTWARE KEY ISSUE : SHOULD THOSE WHO LEASE ELECTRONIC DEVICES SUCH AS LAP TOP COMPUTERS BE ABLE TO SECRETLY TRACK THE WHEREABOUTS OF THEIR CUSTOMERS WITHOUT THEIR CUSTOMERS AT LEAST BEING GIVEN THE CHOICE WHETHER TO BE TRACKED THROUGH CLEAR AND PROMINENT NOTICE AND EXPRESS CONSENT? SYNOPSIS As noted by the author, rental-purchase agreements, typically referred to as "rent to own" agreements, are increasingly pervasive in today's marketplace, especially regarding rapidly improving electronic devices such as lap top computers. However, due to the lack of threshold consumer protections in this area, it has become fertile ground for abuse. This bill seeks to set just a few basic (and many would assume given) privacy floors by, among other things, requiring that before a lessor of electronic devices can track the whereabouts of their customers, they must provide the consumer notice and the opportunity to consent. Additionally, while the version of the bill currently in print prohibits use of monitoring technology in all cases with the exception of fraud, the bill as now proposed to be amended includes provisions allowing the use of tracking technology for providing remote technical assistance to consumers and preventing loss through fraud, recognizing the rent-to-own industry's legitimate uses for monitoring technology in these distinct areas. In considering the reasonableness of this and other privacy provisos in the measure, the Committee may wish to consider that the Federal Trade Commission (FTC), which is the federal agency tasked with deterring deceptive trade practices, has already found such secret monitoring practices by rental companies to violate federal law absent notice and consent. Indeed, in the 2012 case that helped spur the author's and sponsor's concerns AB 2667 Page 2 about these deceptive consumer practices, the FTC ordered seven so-called "rent-to-own" companies and a software manufacturer to cease using secret tracking technology on unsuspecting customers after discovering that rent-to-own retailers were using technology to spy on and photograph consumers. In its complaint the FTC alleged that the companies had used secretly installed software-oftentimes with innocuous names such as "PC Rental Agent"-to monitor consumers' information and track their behavior. The FTC's complaint went so far as to state that the national rent-to-own retailer, Aaron's, Inc., and DesignerWare, LLC, a software manufacturer, had secretly captured images of customers in their homes while they were "engaged in intimate activities." Many of these companies settled, under the terms that they would be prohibited from using monitoring technology that captures keystrokes or screen shots and will not activate the webcam and microphone on a customer's computer, except to provide technical support requested by customers. This measure is compatible with those federal approaches. It seeks to put a stop to this insidious practice and provide additional safeguards under state law for use of geophysical tracking and monitoring technology. According to the author, codifying the FTC's enforcement in California statute seeks to reduce the chance Californians who enter into contracts for rent-to-own electronic devices will have their whereabouts (and even their private activities in their homes) secretly monitored without their knowing and express consent. Due to time constraints, various clarifying amendments suggested by the Committee and accepted by the author will be taken in the Business & Professions Committee. This analysis reflects these amendments. In addition to the bill's sponsor, Consumer Federation of California, the Consumer Attorneys of California, Privacy Rights Clearinghouse, and the American Civil Liberties Union support the bill, stating that the bill, as proposed to be amended, is narrowly drafted to address the inappropriate use of spy software in the rent-to-own industry while still allowing for the use of GPS tracking for fraud prevention. There is no known opposition to the bill as of the writing of this analysis, though the recent amendment clarifications in the measure are new. SUMMARY : Seeks to reflect recent federal regulatory actions and make clear in California law pertaining to the state's "rent to own" business sector that the secret use of geophysical location AB 2667 Page 3 tracking and monitoring technologies on electronic devices is generally prohibited, except with customer notice and consent, and only in carefully bounded circumstances. Specifically, this bill among other things: 1)Prohibits the use of geophysical location tracking technology by lessors under rental-purchase agreements absent express notice and consent, and then only for the purpose of providing remote technical assistance and preventing fraud or loss. 2)Requires that lessors in rental-purchase agreements give clear and prominent notice when geophysical location tracking or monitoring technology is installed or activated. EXISTING LAW : 1) Implements the Karnette Rental-Purchase Act, which among other things, requires lessors in rental-purchase agreements provide price-tag disclosures, a sample rental-purchase contract, and that any rental-purchase advertisement states the total number of payments necessary to acquire ownership. (Civil Code Section 1812.620 et seq.) 2) Provides that the lessor of a piece of personal property must keep a copy of the agreement and evidence of the "cash price" of the personal property leased for 2 years following termination of the agreement. The "cash price" is defined as the price at which retail sellers are selling and consumers are buying the same or similar property for cash in the same trade area as the lessor's place of business. (Civil Code Section 1812.623.) 3) Requires that a lessor in a rental purchase agreement, upon request, provide the consumer with a copy of the proposed rental-purchase agreement prior to its execution. (Civil Code Section 1812.629(c).) 4) Provides that a consumer who is damaged by the lessor's violation of the Karnette Rental-Purchase Act is entitled to recover actual damages; twenty-five percent of the total amount of payments required to obtain ownership, but not less than $100 or more than $1,000; exemplary damages for intentional or willful violations of the Act; reasonable attorney's fees and court costs; and equitable relief as AB 2667 Page 4 the court deems proper. (Civil Code Section 1812.636(a).) FISCAL EFFECT : As currently in print this bill is keyed fiscal. COMMENTS : As noted by the author, rental-purchase agreements, typically referred to as "rent to own" agreements, are increasingly pervasive in today's marketplace, especially regarding rapidly improving electronic devices such as lap top computers. However, due to the lack of threshold consumer protections in this area, it has become fertile ground for abuse. This bill seeks to set just a few basic (and many would assume given) privacy floors by, among other things, requiring that before a lessor of electronic devices can track the whereabouts of their customers, they must provide the consumer notice and the opportunity to consent. Additionally, while the version of the bill currently in print prohibits use of monitoring technology in all cases with the exception of fraud, the bill as now proposed to be amended includes provisions allowing the use of tracking technology for providing remote technical assistance to consumers and preventing loss through fraud, recognizing the rent-to-own industry's legitimate uses for monitoring technology in these distinct areas. According to the author, this bill is needed to stem the abuse of monitoring and geophysical location tracking technology in electronic devices leased under rental-purchase agreements. Under current law, lessors under rental-purchase agreements are not prohibited from requesting security deposit fees to insure against fraud or loss. The author states that consumers have a reasonable expectation that lessors will use security deposits to insure against any losses that may occur in the course of the rental-purchase transaction, and that they will not be secretly spied upon as an unknown cost of participating in the rent-to-own marketplace. The author notes that recent reports about, and federal actions taken in, this growing industry have revealed serious concerns about customer privacy invasions. According to recent reports, electronic devices such as lap top computers are increasingly being leased under rental-purchase agreements, and lessors have been installing invasive geophysical (GPS) location tracking and monitoring technology on these devices. The GPS technology, though useful in obtaining devices in instances of fraud or loss, has often reportedly been included without the consumer's knowledge, and has not been shown to terminate after expiration AB 2667 Page 5 of the lease period. The monitoring technology meanwhile has reportedly been used to determine who is using the device, and in one instance even been used by a lessor to secretly remotely activate a lap top webcam to photograph a customer in his bedroom. FTC Reports That Rent-to-Own Retailers Were Caught "Red Handed" Secretly Spying on Customers : In 2012, the Federal Trade Commission (FTC) ordered seven rental companies and a software manufacturer to cease using monitoring technology on unsuspecting customers after discovering that rent-to-own retailers were using technology to spy on and photograph consumers. In its complaint the FTC alleged that the companies had violated provisions of the Federal Trade Commission Act concerning Unfair and Deceptive Gathering and Disclosure of Consumers' Personal Information by installing software-oftentimes with innocuous names such as "PC Rental Agent"-to monitor consumers' information and track their behavior. The FTC's complaint went so far as to state that the national rent-to-own retailer, Aaron's, Inc., and DesignerWare, LLC, a software manufacturer, had secretly captured images of customers in their homes while they were "engaged in intimate activities." The FTC Chairman, Jon Leibowitz, stated in a press release: "An agreement to rent a computer doesn't give a company license to access consumers' private emails, bank account information, and medical records, or, even worse, webcam photos of people in the privacy of their own homes." Many of these companies settled, under the terms that they would be prohibited from using monitoring technology that captures keystrokes or screen shots and will not activate the webcam and microphone on a customer's computer, except to provide technical support requested by customers. There was however no reported fine for Aaron's, its franchisees ColorTyme and Premier Rental Purchase, and DesignerWare, for this seemingly outrageous abuse of customer privacy. Consumer Privacy At Risk : As the author notes, the FTC complaint revealed that Aaron's had collected "private, confidential and personal details about consumers using rented computers" including passwords, medical records, social security numbers, bank and credit card statements and more. And DesignerWare had not only been able to remotely activate software, but also "log[ged] the consumer user's keystrokes, AB 2667 Page 6 capture[d] screenshots and [took] pictures with the computer's webcam and [sent] the data to DesignerWare servers." Though DesignerWare itself apparently did not access the information, by storing it and sharing it with rent-to-own retailers, not only are consumers at risk of misuse by anyone in possession, but are at risk of identity theft and other serious harms. According to the bill's author and supporters, without consumer notice and consent, these harms may go unrecognized until it is far too late. The companies in possession may no longer exist (DesignerWare's internet website is no longer available) or the harm may be too far removed to determine its source - or for customers to be even aware of its existence. The Federal Trade Commission's Actions Do Not Appear to Provide An Adequate Remedy for Customer Injuries : Prior to the FTC order, a civil class action was brought against Aaron's, Inc. itself (Byrd v. Aaron's, 2011 U.S. Dist. LEXIS 73908 (W.D. Pa. June 16, 2011).) In that case, Aaron's, Inc. reportedly used the "detective mode" program to monitor and store data on a computer rented to a married couple through its store. Mistakenly believing that the couple had defaulted on their payments, an Aaron's representative purportedly visited the couple's home and showed the wife a photo of her husband using the laptop just a few hours earlier, taken by the webcam. However, the Court found that it was "purely conjecture that the other members of the putative class will be subjected to remote access of personal information." In response to such shocking facts, the author states: AB 2667 will put the FTC order, to prohibit the use of monitoring technologies, into California statute - ensuring that all Californians who enter into contracts for a rent-to-own electronic device are protected from the privacy violations that this technology exposes them to. The author further notes that the FTC limitation on redress for such violations leaves consumers vulnerable to continued use of 'detective mode' and other monitoring technologies. Specifically, the magistrate judge in the Byrd decision refused to grant a preliminary injunction, reasoning that the plaintiff class did not present proof of irreparable harm resulting from use of the 'detective mode' program. AB 2667 Page 7 Accordingly, the author contends that the FTC actions, though important, have not yet provided an adequate remedy for consumers who have secretly been exposed to serious breaches of their privacy by employees of rent-to-own companies and third-party monitoring vendors. This measure seeks to address that substantial consumer-protection gap. AUTHOR'S AMENDMENTS : As currently in print, this bill addresses geophysical location tracking and monitoring technology broadly, allowing geophysical location tracking with notice and express consent. The author wishes to make clear what type of notice and consent is required. Additionally, the bill currently prohibits use of monitoring technology in all cases with the exception of fraud. Recognizing that the rent-to-own industry has legitimate uses for monitoring technology, such as providing remote technical assistance and preventing loss, the author wishes to amend the bill to include provisions allowing for these legitimate uses. Specifically, the author wishes to amend the bill in this Committee as seen in the following mock up, and which is reflected in this analysis' description of the bill: SECTION 1. Section 1812.622 of the Civil Code is amended to read: 1812.622. As used in this title: (a) "Advertisement" means a commercial message in any medium that directly or indirectly solicits or promotes one or more specific rental-purchase transactions, excluding instore merchandising aids. This definition does not limit or alter the application of other laws, including Chapter 5 (commencing with Section 17200) of Part 2 and Chapter 1 (commencing with Section 17500) of Part 3, of Division 7 of the Business and Professions Code, to rental-purchase transactions. (b) "Consumer" means a natural person or persons who rent or lease personal property from a lessor pursuant to a rental-purchase agreement or to whom a lessor offers personal property for use pursuant to a rental-purchase agreement. (c) "Lessor" means any person or entity that provides or offers to provide personal property for use by consumers pursuant to a rental-purchase agreement. (d) "Rental-purchase agreement," except as otherwise provided in this subdivision, means an agreement between a lessor and a consumer pursuant to which the lessor rents or leases, for valuable consideration, personal property for use by a consumer for personal, family, or household purposes for an initial term AB 2667 Page 8 not exceeding four months that may be renewed or otherwise extended, if under the terms of the agreement the consumer acquires an option or other legally enforceable right to become owner of the property. A rental-purchase agreement is a lease subject to Title 1.5 (commencing with Section 1750) and Title 1.7 (commencing with Section 1790). "Rental-purchase agreement" shall not be construed to be, nor be governed by, and shall not apply to, any of the following: (1) A retail installment sale, as defined in Section 1802.5. (2) A retail installment contract, as defined in Section 1802.6. (3) A retail installment account, as defined in Section 1802.7. (4) A lease or agreement that constitutes a security interest, as defined in Section 1201 of the Commercial Code. (5) A consumer credit contract, as defined in Section 1799.90. (e) "Cash price" means the price of the personal property described in the rental-purchase agreement that the consumer may pay in cash to the lessor at the inception of the rental-purchase agreement to acquire ownership of that personal property. (f) "Cost of rental" means the difference between the total of all periodic payments necessary to acquire ownership under the rental-purchase agreement and the cash price of the rental property that is subject to the rental-purchase agreement. (g) "Fee" means any payment, charge, fee, cost, or expense, however denominated, other than a rental payment. (h) "Appliance" means and includes any refrigerator, freezer, range including any cooktop or oven, microwave oven, washer, dryer, dishwasher, or room air conditioner or air purifier. (i) "Electronic set" means and includes any television, radio, camera, video game, or any type of device for the recording, storage, copying, printing, transmission, display, or playback of any sound or image, but does not include any item that is part of a computer system. (j) "Computer system" means a computer processor and a video monitor, printer, and peripheral items primarily designed for use with a computer. Audio and video devices, which are commonly used for entertainment and into which data may be downloaded from a computer, are not part of a computer system. (k) "Lessor's cost" means the documented actual cost, including actual freight charges, of the rental property to the lessor from a wholesaler, distributor, supplier, or manufacturer and net of any discounts, rebates, and incentives. (l) "Total of payments" means the total amount of periodic payments necessary to acquire ownership of the property that is the subject of the rental-purchase agreement if the consumer AB 2667 Page 9 makes all regularly scheduled payments. (m) "Electronic device" means a desktop or laptop computer, handheld device, tablet, smart phone, or other electronic product or device that has a platform on which to download, install, or run any software program, code, script, or other content. (n) "Clear and prominent notice" means notice presented in an understandable language and syntax, in the predominantly used language for that communication, and that: (1) In textual communications, the required disclosures are separate and apart from any "privacy policy," "data use policy," "terms of service," "end-user license agreement," "lease agreement," or other similar document, and of a type, size, and location sufficiently noticeable for an ordinary consumer to read and comprehend in print that contrasts highly with the background on which they appear. (2) In communications disseminated orally or through audible means, the required disclosures are delivered in a volume and cadence sufficient for an ordinary consumer to hear and comprehend. (3) In communications disseminated through video means, the required disclosures are in writing in a form consistent with paragraph (1) and appear on the screen for a duration sufficient for an ordinary consumer to read and comprehend them, and in the same language as the predominantly used language for that communication. (4) In communications made through interactive media, including the Internet, online services, and software, the required disclosures are unavoidable and presented in a form consistent with paragraph (1), in addition to any audio or video presentation. (o) "Geophysical location tracking technology" means hardware, software, or an application that collects and reports data or information that identifies the precise geophysical location of an item, including, technologies that report the GPS coordinates of an electronic device a computer or other item, the WiFi signals available to or actually used by an electronic device a computer to access the Internet, the telecommunication towers or connections available to or actually used by a computer, the processing of any reported data or information through geolocation lookup services, or any information derived from any combination of the foregoing. (p) "Monitoring technology" means any hardware, software, or application utilized in conjunction with a computer that can cause the computer to capture, monitor, record, or report AB 2667 Page 10 information about user activities without the user's knowledge. by recording keystrokes, clicks, or other user-generated actions, capturing screenshots of the information displayed on a computer monitor or screen, or activating the camera or microphone function of a computer to take photographs or record audio or visual content through the computer's Internet Webcam or microphone. (q) "Remote technical assistance" means the collaborative access by the user and technician to connect to an electronic device for the purpose of providing technical support to the user. (r) "Express consent" mean a clear choice to either agree or not agree to any geophysical location tracking technology or remote technical assistance, and neither option may be highlighted or preselected as a default setting. (s) "Fraud" means an action by the consumer that necessitates the lessors recovery of the electronic device, limited to nonpayment or other violation of the rental-purchase agreement. SEC. 2. Section 1812.650 is added to the Civil Code, to read: 1812.650. (a) A lessor shall provide clear and prominent notice to a consumer and obtain express consent from the consumer at the time the lessor and the consumer enter into a rental-purchase agreement for an electronic device if that device has geophysical location tracking technology installed, and at any time the geophysical location tracking technology is activated . A lessor shall not install geophysical location tracking technology on an electronic device without first providing clear and prominent notice to the consumer and obtaining express consent. (b) A lessor shall not use , sell or share geophysical location tracking technology on an electronic device for any purpose other than the prevention of fraud or loss . (c) Clear and prominent notification must be displayed on an electronic device if geophysical location tracking technology is activated. (c) (d) A lessor shall provide that any geophysical location tracking technology that has been installed on an electronic device, or can be active by the lessor, expires following the lease period, or upon completion of purchase of the electronic device. (e) A lessor shall not use or install monitoring technology on an electronic device for any purpose. (f) A lessor shall provide clear and prominent notice to a AB 2667 Page 11 consumer and obtain express consent from the consumer for the installation of any software that permits the use of remote technical assistance and upon the activation and deactivation of any remote technical assistance when requested by the consumer. (g) A lessor shall not acquire any data when providing remote technical assistance beyond what is necessary to provide assistance to the user and consented by the user. Any data acquired during the period of consumer consented technical assistance shall not be retained, used or sold for any purpose. ARGUMENTS IN SUPPORT : The Consumer Attorneys of California state that: Although rent-to-own retailers are required to provide written contracts to their customers specifying the cost and repayment terms, there is no [requirement] that the retailer notify the consumers of any personal information that may be collected and shared. In recent years, monitoring and geophysical location technology has created serious privacy concerns. [The programs used] allowed these stores to use location services to track and report the physical location of the computer, take screen shots of the computer user's activities, and also take secretive photographs of anyone within view of the computer's webcam. AB 2667 is crucial to protecting consumers' privacy in these situations. The Privacy Rights Clearinghouse writes in strong support, stating in part that: [This bill] is narrowly drafted to address the inappropriate use of spy software in the rent-to-own industry and still allow for the use of GPS tracking for fraud prevention. At the same time, it ensures that other unnecessary monitoring is eliminated. The American Civil Liberties Union also writes in support, stating that: Under current law, rent-to-own companies are not required the notify customers about their rented computers' capacity to secretly monitor and track a AB 2667 Page 12 user's keystrokes, physical location, and computer activity, and take photographs and screenshots using the computers web cam. This bill allows for the use of GPS tracking for fraud prevention while ensuring that other, unnecessary monitoring is eliminated? Prior Related Legislation : AB 722 (Karnette), Chapter 1026, 1994, enacted the Karnette Rental-Purchase Act that stipulated parameters, conditions, and obligations for agreements between rent-to-own dealers and consumers. REGISTERED SUPPORT / OPPOSITION : Support : Consumer Federation of California (sponsor) Consumer Attorneys of California Privacy Rights Clearinghouse American Civil Liberties Union Opposition : None on file Analysis Prepared by : Drew Liebert and Vignesh Ganapathy / JUD. / (916) 319-2334