Amended in Senate January 28, 2014

Amended in Senate May 24, 2013

Amended in Senate April 1, 2013

Senate BillNo. 383


Introduced by Senator Jackson

February 20, 2013


An act to amend Sections 1747.02 and 1747.08 of the Civil Code, relating to credit cards.

LEGISLATIVE COUNSEL’S DIGEST

SB 383, as amended, Jackson. Credit cards: personal information.

Existing state and federal law regulates the provision of credit and the use of credit cards. The Song-Beverly Credit Card Act of 1971 generally regulates credit card transactions and prohibits a person or entity that accepts credit cards for the transaction of business from requesting, or requiring as a condition to accepting the credit card, that the cardholder write any personal identification information, as defined, upon the credit card transaction form or otherwise. Existing law prohibits a person or entity that accepts credit cards for the transaction of business from requesting, or requiring as a condition to accepting the credit card, that the cardholder provide his or her personal identification information to the person or entity to be written or caused to be written upon the credit card transaction form or otherwise. Notwithstanding those provisions, existing law authorizes a person or entity that accepts credit cards for the transaction of business to require the cardholder, as a condition to accepting the credit card, to provide reasonable forms of positive identification, which may include a driver’s license or a California state identification card, provided that the information is not written or recorded on the credit card transaction form or otherwise. Existing law authorizes the use of ZIP Code information in a sales transaction at a retail motor fuel dispenser or retail motor fuel payment island with an automated cashier that uses the ZIP Code information solely for prevention of fraud, theft, or identity theft.

This bill would authorize a person or entity that accepts credit cards in an online transactionbegin insert involving an electronic downloadable productend insert, as defined, to require a cardholder, as a condition to accepting a credit card as payment in full or inbegin delete part for goods or services,end deletebegin insert part, in an online transaction involving an electronic downloadable product,end insert to provide the billing ZIP Code and street address number associated with the credit card, if used solely for thebegin insert detection, investigation, orend insert prevention of fraud, theft,begin delete orend delete identity theftbegin insert, or criminal activity, or enforcement of terms of saleend insert. The bill would authorize the person or entity accepting the credit card to require a cardholder, as a condition to accepting a credit card as payment in full or in part, in an online transactionbegin insert involving an electronic downloadable productend insert, to provide additional personal information, if it requires that information for thebegin insert detection, investigation, orend insert prevention of fraud, theft,begin delete orend delete identity theft,begin insert or criminal activity, or for enforcement of terms of sale,end insert and the additional personal information is used solely forbegin delete the prevention of fraud, theft, or identity theftend deletebegin insert those purposesend insert. The bill would require that person or entity to destroy or dispose of the ZIP Code, street address number, and any additional personal information it requires in a secure manner after it is no longer neededbegin delete for the prevention of fraud, theft, or identity theftend deletebegin insert those purposesend insert. The bill wouldbegin delete furtherend delete prohibit that person or entity from aggregating the ZIP Code, street address number, or additional personal information it requires with any other personal identification information, as defined, and from sharing the ZIP Code, street address number, or additional personal information it requires with any other person orbegin delete entityend deletebegin insert entity, as specifiedend insert.begin insert The bill, notwithstanding the foregoing provisions, would also authorize a person or entity accepting a credit card in an online transaction involving an electronic downloadable product to request, but not require, personal information if the cardholder actively elects to provide the personal information by opting in to the collection of the information and specified conditions are met.end insert

Vote: majority. Appropriation: no. Fiscal committee: no. State-mandated local program: no.

The people of the State of California do enact as follows:

P3    1

SECTION 1.  

(a) The Legislature finds and declares all of the
2following:

3(1) The Song-Beverly Credit Card Act of 1971 establishes
4privacy and other protections for cardholders. These protections
5prohibit a person, firm, partnership, association, or corporation
6from requesting or requiring a cardholder to provide personal
7 identification information in a credit card transaction, with
8specified, limited exceptions.

9(2) The Song-Beverly Credit Card Act of 1971 applies to credit
10card transactions without reference to the method, platform, or
11technology used to process or to complete the transaction.

12(3) The California Supreme Court, in Apple Inc. v. Superior
13Court (2013) 56 Cal.4th 128, declared the Song-Beverly Credit
14Card Act of 1971 not applicable to an online transaction involving
15a downloadable product. As a result, the privacy protections of the
16act do not apply to those transactions.

17(b) It is the intent of the Legislature to begin delete apply the provisions of
18the Song-Beverly Credit Card Act of 1971 to all online credit card
19transactions, including online transactions involving a
20downloadable productend delete
begin insert advance privacy protections by limiting the
21scope of personally identifiable information that may be required
22to be collected for an online transaction involving an electronic
23downloadable productend insert
.

24

SEC. 2.  

Section 1747.02 of the Civil Code is amended to read:

25

1747.02.  

As used in this title:

26(a) “Credit card” means any card, plate, coupon book, or other
27single credit device existing for the purpose of being used from
28time to time upon presentation to obtain money, property, labor,
29or services on credit. “Credit card” does not mean any of the
30following:

31(1) Any single credit device used to obtain telephone property,
32labor, or services in any transaction under public utility tariffs.

33(2) Any device that may be used to obtain credit pursuant to an
34electronic fund transfer, but only if the credit is obtained under an
35agreement between a consumer and a financial institution to extend
36credit when the consumer’s asset account is overdrawn or to
37maintain a specified minimum balance in the consumer’s asset
38account.

P4    1(3) Any key or card key used at an automated dispensing outlet
2to obtain or purchase petroleum products, as defined in subdivision
3(c) of Section 13401 of the Business and Professions Code, that
4will be used primarily for business rather than personal or family
5purposes.

6(b) “Accepted credit card” means any credit card that the
7cardholder has requested or applied for and received or has signed,
8or has used, or has authorized another person to use, for the purpose
9of obtaining money, property, labor, or services on credit. Any
10credit card issued in renewal of, or in substitution for, an accepted
11credit card becomes an accepted credit card when received by the
12cardholder, whether the credit card is issued by the same or a
13successor card issuer.

14(c) “Card issuer” means any person who issues a credit card or
15the agent of that person for that purpose with respect to the credit
16card.

17(d) “Cardholder” means a natural person to whom a credit card
18is issued for consumer credit purposes, or a natural person who
19has agreed with the card issuer to pay consumer credit obligations
20arising from the issuance of a credit card to another natural person.
21For purposes of Sections 1747.05, 1747.10, and 1747.20, the term
22includes any person to whom a credit card is issued for any
23purpose, including business, commercial, or agricultural use, or a
24person who has agreed with the card issuer to pay obligations
25arising from the issuance of that credit card to another person.

26(e) “Retailer” means every person other than a card issuer who
27furnishes money, goods, services, or anything else of value upon
28presentation of a credit card by a cardholder. “Retailer” shall not
29mean the state, a county, city, city and county, or any other public
30agency.

31(f) “Unauthorized use” means the use of a credit card by a
32person, other than the cardholder, (1) who does not have actual,
33implied, or apparent authority for that use and (2) from which the
34cardholder receives no benefit. “Unauthorized use” does not include
35the use of a credit card by a person who has been given authority
36by the cardholder to use the credit card. Any attempted termination
37by the cardholder of the person’s authority is ineffective as against
38the card issuer until the cardholder complies with the procedures
39required by the card issuer to terminate that authority.
40Notwithstanding the above, following the card issuer’s receipt of
P5    1oral or written notice from a cardholder indicating thatbegin delete itend deletebegin insert the
2cardholderend insert
wishes to terminate the authority of a previously
3authorized user of a credit card, the card issuer shall follow its
4usual procedures for precluding any further use of a credit card by
5an unauthorized person.

6(g) “Inquiry” means a writing that is posted by mail to the
7address of the card issuer to which payments are normally tendered,
8unless another address is specifically indicated on the statement
9for that purpose, then to that other address, and that is received by
10the card issuer no later than 60 days after the card issuer transmitted
11the first periodic statement that reflects the alleged billing error,
12and that does all of the following:

13(1) Sets forth sufficient information to enable the card issuer to
14identify the cardholder and the account.

15(2) Sufficiently identifies the billing error.

16(3) Sets forth information providing the basis for the
17cardholder’s belief that the billing error exists.

18(h) “Response” means a writing that is responsive to an inquiry
19and mailed to the cardholder’s address last known to the card
20issuer.

21(i) “Timely response” means a response that is mailed within
22two complete billing cycles, but in no event later than 90 days,
23after the card issuer receives an inquiry.

24(j) “Billing error” means an error by omission or commission
25in (1) posting any debit or credit, or (2) in computation or similar
26error of an accounting nature contained in a statement given to the
27cardholder by the card issuer. “Billing error” does not mean any
28dispute with respect to value, quality, or quantity of goods, services,
29or other benefit obtained through use of a credit card.

30(k) “Adequate notice” means a printed notice to a cardholder
31that sets forth the pertinent facts clearly and conspicuously so that
32a person against whom it is to operate could reasonably be expected
33to have noticed it and understood its meaning.

34(l) “Secured credit card” means any credit card issued under an
35agreement or other instrument that pledges, hypothecates, or places
36a lien on real property or money or other personal property to
37secure the cardholder’s obligations to the card issuer.

38(m) “Student credit card” means any credit card that is provided
39to a student at a public or private college or university and is
40provided to that student solely based on his or her enrollment in a
P6    1public or private university, or is provided to a student who would
2not otherwise qualify for that credit card on the basis of his or her
3income. A “student credit card” does not include a credit card
4issued to a student who has a cocardholder or cosigner who would
5otherwise qualify for a credit card other than a student credit card.

6(n) “Retail motor fuel dispenser” means a device that dispenses
7fuel that is used to power internal combustion engines, including
8motor vehicle engines, that processes the sale of fuel through a
9remote electronic payment system, and that is in a location where
10an employee or other agent of the seller is not present.

11(o) “Retail motor fuel payment island automated cashier” means
12a remote electronic payment processing station that processes the
13retail sale of fuel that is used to power internal combustion engines,
14including motor vehicle engines, that is in a location where an
15employee or other agent of the seller is not present, and that is
16located in close proximity to a retail motor fuel dispenser.

17(p) “Online transactionbegin insert involving an electronic downloadable
18productend insert
” means a credit card transaction for a product, service,
19subscription, or any other consideration, in which the product,
20service, subscription, or consideration isbegin delete transactedend deletebegin insert providedend insert by
21means of abegin insert download to aend insert computer, telephone, or other electronic
22device.

23

SEC. 3.  

Section 1747.08 of the Civil Code is amended to read:

24

1747.08.  

(a) Except as provided in subdivision (c), a person,
25firm, partnership, association, or corporation that accepts credit
26cards for the transaction of business shall not do any of the
27following:

28(1) Request, or require as a condition to accepting the credit
29card as payment in full or in part for goods or services, the
30cardholder to write any personal identification information upon
31the credit card transaction form or otherwise.

32(2) Request, or require as a condition to accepting the credit
33card as payment in full or in part for goods or services, the
34cardholder to provide personal identification information, which
35the person, firm, partnership, association, or corporation accepting
36the credit card writes, causes to be written, or otherwise records
37upon the credit card transaction form or otherwise.

38(3) Utilize, in any credit card transaction, a credit card form that
39contains preprinted spaces specifically designated for filling in
40any personal identification information of the cardholder.

P7    1(b) For purposes of this section, “personal identification
2 information” means information concerning the cardholder, other
3than information set forth on the credit card, and including, but
4not limited to, the cardholder’s address and telephone number.

5(c) Subdivision (a) does not apply in the following instances:

6(1) If the credit card is being used as a deposit to secure payment
7in the event of default, loss, damage, or other similar occurrence.

8(2) Cash advance transactions.

9(3) If any of the following applies:

10(A) The person, firm, partnership, association, or corporation
11accepting the credit card is contractually obligated to provide
12personal identification information in order to complete the credit
13card transaction.

14(B) The person, firm, partnership, association, or corporation
15accepting the credit card in a sales transaction at a retail motor fuel
16dispenser or retail motor fuel payment island automated cashier
17uses the ZIP Code information solely for prevention of fraud, theft,
18or identity theft.

19(C) The person, firm, partnership, association, or corporation
20accepting the credit card is obligated to collect and record the
21personal identification information by federal or state law or
22regulation.

23(4) If personal identification information is required for a special
24purpose incidental but related to the individual credit card
25transaction, including, but not limited to, information relating to
26shipping, delivery, servicing, or installation of the purchased
27merchandise, or for special orders.

28(d) (1) This section does not prohibit any person, firm,
29partnership, association, or corporation from requiring the
30cardholder, as a condition to accepting the credit card as payment
31in full or in partbegin insert,end insert for goods or services, to provide reasonable forms
32of positive identification, which may include a driver’s license or
33a California state identification card, or where one of these is not
34available, another form of photo identification, provided that none
35of the information contained thereon is written or recorded on the
36credit card transaction form or otherwise. If the cardholder pays
37for the transaction with a credit card number and does not make
38the credit card available upon request to verify the number, the
39cardholder’s driver’s license number or identification card number
40may be recorded on the credit card transaction form or otherwise.

P8    1(2) Notwithstanding subdivision (a), a person, firm, partnership,
2association, or corporation accepting the credit card may require
3a cardholder, as a condition to accepting a credit card as payment
4in full or inbegin delete partend deletebegin insert part,end insert in an onlinebegin delete transaction,end deletebegin insert transaction involving
5 an electronic downloadable product,end insert
to provide the billing ZIP
6Code number and numerical portion of the street address associated
7with the credit card, if used solely for thebegin insert detection, investigation,
8orend insert
prevention of fraud, theft,begin delete orend delete identity theftbegin insert, or criminal activity,
9or for enforcement of terms of saleend insert
. The person, firm, partnership,
10association, or corporation accepting the credit card may require
11a cardholder, as a condition to accepting a credit card as payment
12in full or in part, in an online transactionbegin insert involving an electronic
13downloadable productend insert
, to provide additional personal information,
14if it requires that information for thebegin insert detection, investigation, orend insert
15 prevention of fraud, theft,begin delete orend delete identity theft,begin insert or criminal activity, or
16for enforcement of terms of sale,end insert
and the additional personal
17information is used solely for thebegin insert detection, investigation, orend insert
18 prevention of fraud, theft,begin delete orend delete identity theftbegin insert, or criminal activity, or
19for enforcement of terms of saleend insert
. The person, firm, partnership,
20association, or corporation accepting the credit card shall destroy
21or dispose of the ZIP Code, street address number, and any
22additional personal information it requires pursuant to this
23subdivision in a secure manner after it is no longer needed for the
24begin insert detection, investigation, or end insert prevention of fraud, theft,begin delete orend delete identity
25theftbegin insert, or criminal activity, or for enforcement of terms of saleend insert. The
26person, firm, partnership, association, or corporation accepting the
27credit card shall not aggregate the ZIP Code, street address number,
28or additional personal information it requires pursuant to this
29subdivision with any other personal identification information and
30shall not share the ZIP Code, street address number, or additional
31personal information it requires pursuant to this subdivision with
32any other person, firm, partnership, association, or corporation
33begin insert unless it is required to do so by state or federal law, or is
34contractually obligated to share the information with another
35entity to verify the information, complete the transaction, or for
36the detection, investigation, or prevention of fraud, theft, identity
37theft, or criminal activity, or for enforcement of terms of saleend insert
.

begin insert

38(3) (A) Notwithstanding subdivision (a), a person, firm,
39partnership, association, or corporation may request, but not
40require, personal information from a cardholder as part of an
P9    1online transaction involving an electronic downloadable product,
2as long as the cardholder actively elects to provide the personal
3information by opting in to the collection of the information and
4is contemporaneously notified of all of the following:

end insert
begin insert

5(i) That providing the information is not required to complete
6the transaction.

end insert
begin insert

7(ii) The purpose of the request.

end insert
begin insert

8(iii) The intended use of the information.

end insert
begin insert

9(B) A cardholder shall be provided with an additional
10opportunity to opt out of the collection of the information before
11the online transaction involving an electronic downloadable
12product is completed.

end insert

13(e) Any person who violates this section shall be subject to a
14civil penalty not to exceed two hundred fifty dollars ($250) for the
15first violation and one thousand dollars ($1,000) for each
16subsequent violation, to be assessed and collected in a civil action
17brought by the person paying with a credit card, by the Attorney
18General, or by the district attorney or city attorney of the county
19or city in which the violation occurred. However, no civil penalty
20shall be assessed for a violation of this section if the defendant
21shows by a preponderance of the evidence that the violation was
22not intentional and resulted from a bona fide error made
23notwithstanding the defendant’s maintenance of procedures
24reasonably adopted to avoid that error. When collected, the civil
25penalty shall be payable, as appropriate, to the person paying with
26a credit card who brought the action, or to the general fund of
27whichever governmental entity brought the action to assess the
28civil penalty.

29(f) The Attorney General, or any district attorney or city attorney
30within his or her respective jurisdiction, may bring an action in
31the superior court in the name of the people of the State of
32California to enjoin violation of subdivision (a) and, upon notice
33to the defendant of not less than five days, to temporarily restrain
34and enjoin the violation. If it appears to the satisfaction of the court
35that the defendant has, in fact, violated subdivision (a), the court
36may issue an injunction restraining further violations, without
37requiring proof that any person has been damaged by the violation.
38In these proceedings, if the court finds that the defendant has
39violated subdivision (a), the court may direct the defendant to pay
40any or all costs incurred by the Attorney General, district attorney,
P10   1or city attorney in seeking or obtaining injunctive relief pursuant
2to this subdivision.

3(g) Actions for collection of civil penalties under subdivision
4(e) and for injunctive relief under subdivision (f) may be
5consolidated.

6(h) The changes made to this section by Chapter 458 of the
7Statutes of 1995 apply only to credit card transactions entered into
8on and after January 1, 1996. Nothing in those changes shall be
9construed to affect any civil action that was filed before January
101, 1996.



O

    96