Amended in Assembly June 15, 2014

Amended in Senate January 28, 2014

Amended in Senate May 24, 2013

Amended in Senate April 1, 2013

Senate BillNo. 383


Introduced by Senator Jackson

February 20, 2013


An act to amend Sections 1747.02 and 1747.08 of the Civil Code, relating to credit cards.

LEGISLATIVE COUNSEL’S DIGEST

SB 383, as amended, Jackson. Credit cards: personal information.

Existing state and federal law regulates the provision of credit and the use of credit cards. The Song-Beverly Credit Card Act of 1971 generally regulates credit card transactions and prohibits a person or entity that accepts credit cards for the transaction of business from requesting, or requiring as a condition to accepting the credit card, that the cardholder write any personal identification information, as defined, upon the credit card transaction form or otherwise. Existing law prohibits a person or entity that accepts credit cards for the transaction of business from requesting, or requiring as a condition to accepting the credit card, that the cardholder provide his or her personal identification information to the person or entity to be written or caused to be written upon the credit card transaction form or otherwise. Notwithstanding those provisions, existing law authorizes a person or entity that accepts credit cards for the transaction of business to require the cardholder, as a condition to accepting the credit card, to provide reasonable forms of positive identification, which may include a driver’s license or a California state identification card, provided that the information is not written or recorded on the credit card transaction form or otherwise. Existing law authorizes the use of ZIP Code information in a sales transaction at a retail motor fuel dispenser or retail motor fuel payment island with an automated cashier that uses the ZIP Code information solely for prevention of fraud, theft, or identity theft.

This bill would authorize a person or entity that accepts credit cards in an online transaction involving an electronic downloadable product, as defined, to require a cardholder, as a condition to accepting a credit card as payment in full or in part, in an online transaction involving an electronic downloadable product, to providebegin delete the billing ZIP Code and street address number associated with the credit card, if used solely for the detection, investigation, or prevention of fraud, theft, identity theft, or criminal activity, or enforcement of terms of sale. The bill would authorize the person or entity accepting the credit card to require a cardholder, as a condition to accepting a credit card as payment in full or in part, in an online transaction involving an electronic downloadable product, to provide additionalend delete personalbegin insert identificationend insert information,begin insert as defined,end insert if it requires that information for the detection, investigation, or prevention of fraud, theft, identity theft, or criminal activity, or for enforcement of terms of sale, and thebegin delete additionalend delete personalbegin insert identificationend insert information is used solely for those purposes. The bill would require that person or entity to destroy or dispose of thebegin delete ZIP Code, street address number, and any additionalend delete personalbegin insert identificationend insert information it requires in a secure manner after it is no longer neededbegin insert forend insert those purposes. The bill would prohibit that person or entity from aggregatingbegin delete the ZIP Code, street address number, or additional personal information it requires with any otherend delete personal identificationbegin delete information, as defined,end deletebegin insert informationend insert and from sharingbegin delete the ZIP Code, street address number, or additionalend delete personalbegin insert identificationend insert information it requires with any other person or entity, as specified. The bill, notwithstanding the foregoing provisions, would also authorize a person or entity accepting a credit card in an online transaction involving an electronic downloadable product tobegin delete request, but not require, personal information if the cardholder actively elects to provide the personal information by opting in to the collection of the information and specified conditions are metend deletebegin insert require a consumer to establish an account as a condition for purchase of the product and to provide personally identifiable information in connection with that account, as specified. The bill would also authorize a consumer, concurrent with completing a transaction for an electronically downloadable product, to elect to opt in to the collection and use of personally identifiable information provided certain disclosures are made and he or she is permitted to opt out prior to completing the transactionend insert.

Vote: majority. Appropriation: no. Fiscal committee: no. State-mandated local program: no.

The people of the State of California do enact as follows:

P3    1

SECTION 1.  

(a) The Legislature finds and declares all of the
2following:

3(1) The Song-Beverly Credit Card Act of 1971 establishes
4privacy and other protections for cardholders. These protections
5prohibit a person, firm, partnership, association, or corporation
6from requesting or requiring a cardholder to provide personal
7 identification information in a credit card transaction, with
8specified, limited exceptions.

9(2) The Song-Beverly Credit Card Act of 1971 applies to credit
10card transactions without reference to the method, platform, or
11technology used to process or to complete the transaction.

12(3) The California Supreme Court, in Apple Inc. v. Superior
13Court (2013) 56 Cal.4th 128, declared the Song-Beverly Credit
14Card Act of 1971 not applicable to an online transaction involving
15a downloadable product. As a result, the privacy protections of the
16act do not apply to those transactions.

17(b) It is the intent of the Legislature to advance privacy
18protections by limiting the scope of personally identifiable
19information that may be required to be collected for an online
20transaction involving an electronic downloadable product.

21

SEC. 2.  

Section 1747.02 of the Civil Code is amended to read:

22

1747.02.  

As used in this title:

23(a) “Credit card” means any card, plate, coupon book, or other
24single credit device existing for the purpose of being used from
25time to time upon presentation to obtain money, property, labor,
26or services on credit. “Credit card” does not mean any of the
27following:

28(1) Any single credit device used to obtain telephone property,
29labor, or services in any transaction under public utility tariffs.

30(2) Any device that may be used to obtain credit pursuant to an
31electronic fund transfer, but only if the credit is obtained under an
P4    1agreement between a consumer and a financial institution to extend
2credit when the consumer’s asset account is overdrawn or to
3maintain a specified minimum balance in the consumer’s asset
4account.

5(3) Any key or card key used at an automated dispensing outlet
6to obtain or purchase petroleum products, as defined in subdivision
7(c) of Section 13401 of the Business and Professions Code, that
8will be used primarily for business rather than personal or family
9purposes.

10(b) “Accepted credit card” means any credit card that the
11cardholder has requested or applied for and received or has signed,
12or has used, or has authorized another person to use, for the purpose
13of obtaining money, property, labor, or services on credit. Any
14credit card issued in renewal of, or in substitution for, an accepted
15credit card becomes an accepted credit card when received by the
16cardholder, whether the credit card is issued by the same or a
17successor card issuer.

18(c) “Card issuer” means any person who issues a credit card or
19the agent of that person for that purpose with respect to the credit
20card.

21(d) “Cardholder” means a natural person to whom a credit card
22is issued for consumer credit purposes, or a natural person who
23has agreed with the card issuer to pay consumer credit obligations
24arising from the issuance of a credit card to another natural person.
25For purposes of Sections 1747.05, 1747.10, and 1747.20, the term
26includes any person to whom a credit card is issued for any
27purpose, including business, commercial, or agricultural use, or a
28person who has agreed with the card issuer to pay obligations
29arising from the issuance of that credit card to another person.

30(e) “Retailer” means every person other than a card issuer who
31furnishes money, goods, services, or anything else of value upon
32presentation of a credit card by a cardholder. “Retailer” shall not
33mean the state, a county, city, city and county, or any other public
34agency.

35(f) “Unauthorized use” means the use of a credit card by a
36person, other than the cardholder, (1) who does not have actual,
37implied, or apparent authority for that use and (2) from which the
38cardholder receives no benefit. “Unauthorized use” does not include
39the use of a credit card by a person who has been given authority
40by the cardholder to use the credit card. Any attempted termination
P5    1by the cardholder of the person’s authority is ineffective as against
2the card issuer until the cardholder complies with the procedures
3required by the card issuer to terminate that authority.
4Notwithstanding the above, following the card issuer’s receipt of
5oral or written notice from a cardholder indicating that the
6cardholder wishes to terminate the authority of a previously
7authorized user of a credit card, the card issuer shall follow its
8usual procedures for precluding any further use of a credit card by
9an unauthorized person.

10(g) “Inquiry” means a writing that is posted by mail to the
11address of the card issuer to which payments are normally tendered,
12unless another address is specifically indicated on the statement
13for that purpose, then to that other address, and that is received by
14the card issuer no later than 60 days after the card issuer transmitted
15the first periodic statement that reflects the alleged billing error,
16and that does all of the following:

17(1) Sets forth sufficient information to enable the card issuer to
18identify the cardholder and the account.

19(2) Sufficiently identifies the billing error.

20(3) Sets forth information providing the basis for the
21cardholder’s belief that the billing error exists.

22(h) “Response” means a writing that is responsive to an inquiry
23and mailed to the cardholder’s address last known to the card
24issuer.

25(i) “Timely response” means a response that is mailed within
26two complete billing cycles, but in no event later than 90 days,
27after the card issuer receives an inquiry.

28(j) “Billing error” means an error by omission or commission
29in (1) posting any debit or credit, or (2) in computation or similar
30error of an accounting nature contained in a statement given to the
31cardholder by the card issuer. “Billing error” does not mean any
32dispute with respect to value, quality, or quantity of goods, services,
33or other benefit obtained through use of a credit card.

34(k) “Adequate notice” means a printed notice to a cardholder
35that sets forth the pertinent facts clearly and conspicuously so that
36a person against whom it is to operate could reasonably be expected
37to have noticed it and understood its meaning.

38(l) “Secured credit card” means any credit card issued under an
39agreement or other instrument that pledges, hypothecates, or places
P6    1a lien on real property or money or other personal property to
2secure the cardholder’s obligations to the card issuer.

3(m) “Student credit card” means any credit card that is provided
4to a student at a public or private college or university and is
5provided to that student solely based on his or her enrollment in a
6public or private university, or is provided to a student who would
7not otherwise qualify for that credit card on the basis of his or her
8income. A “student credit card” does not include a credit card
9issued to a student who has a cocardholder or cosigner who would
10otherwise qualify for a credit card other than a student credit card.

11(n) “Retail motor fuel dispenser” means a device that dispenses
12fuel that is used to power internal combustion engines, including
13motor vehicle engines, that processes the sale of fuel through a
14remote electronic payment system, and that is in a location where
15an employee or other agent of the seller is not present.

16(o) “Retail motor fuel payment island automated cashier” means
17a remote electronic payment processing station that processes the
18retail sale of fuel that is used to power internal combustion engines,
19including motor vehicle engines, that is in a location where an
20employee or other agent of the seller is not present, and that is
21located in close proximity to a retail motor fuel dispenser.

22(p) “Online transaction involving an electronic downloadable
23product” means a credit card transaction for a product, service,
24subscription, or any other consideration, in which the product,
25service, subscription, or consideration is provided by means of a
26download to a computer, telephone, or other electronic device.

27

SEC. 3.  

Section 1747.08 of the Civil Code is amended to read:

28

1747.08.  

(a) Except as provided in subdivision (c), a person,
29firm, partnership, association, or corporation that accepts credit
30cards for the transaction of business shall not do any of the
31following:

32(1) Request, or require as a condition to accepting the credit
33card as payment in full or in part for goods or services, the
34cardholder to write any personal identification information upon
35the credit card transaction form or otherwise.

36(2) Request, or require as a condition to accepting the credit
37card as payment in full or in part for goods or services, the
38cardholder to provide personal identification information, which
39the person, firm, partnership, association, or corporation accepting
P7    1the credit card writes, causes to be written, or otherwise records
2upon the credit card transaction form or otherwise.

3(3) Utilize, in any credit card transaction, a credit card form that
4contains preprinted spaces specifically designated for filling in
5any personal identification information of the cardholder.

6(b) For purposes of this section, “personal identification
7 information” means information concerning the cardholder, other
8than information set forth on the credit card, and including, but
9not limited to, the cardholder’s address and telephone number.

10(c) Subdivision (a) does not apply in the following instances:

11(1) If the credit card is being used as a deposit to secure payment
12in the event of default, loss, damage, or other similar occurrence.

13(2) Cash advance transactions.

14(3) If any of the following applies:

15(A) The person, firm, partnership, association, or corporation
16accepting the credit card is contractually obligated to provide
17personal identification information in order to complete the credit
18card transaction.

19(B) The person, firm, partnership, association, or corporation
20accepting the credit card in a sales transaction at a retail motor fuel
21dispenser or retail motor fuel payment island automated cashier
22uses the ZIP Code information solely for prevention of fraud, theft,
23or identity theft.

24(C) The person, firm, partnership, association, or corporation
25accepting the credit card is obligated to collect and record the
26personal identification information by federal or state law or
27regulation.

28(4) If personal identification information is required for a special
29purpose incidental but related to the individual credit card
30transaction, including, but not limited to, information relating to
31shipping, delivery, servicing, or installation of the purchased
32merchandise, or for special orders.

33(d) (1) This section does not prohibit any person, firm,
34partnership, association, or corporation from requiring the
35cardholder, as a condition to accepting the credit card as payment
36in full or in part, for goods or services, to provide reasonable forms
37of positive identification, which may include a driver’s license or
38a California state identification card, or where one of these is not
39available, another form of photo identification, provided that none
40of the information contained thereon is written or recorded on the
P8    1credit card transaction form or otherwise. If the cardholder pays
2for the transaction with a credit card number and does not make
3the credit card available upon request to verify the number, the
4cardholder’s driver’s license number or identification card number
5may be recorded on the credit card transaction form or otherwise.

6(2) Notwithstanding subdivision (a), a person, firm, partnership,
7association, or corporation accepting the credit card may require
8a cardholder, as a condition to accepting a credit card as payment
9in full or in part, in an online transaction involving an electronic
10downloadable product, to provide begin delete the billing ZIP Code number
11and numerical portion of the street address associated with the
12credit card, if used solely for the detection, investigation, or
13prevention of fraud, theft, identity theft, or criminal activity, or
14for enforcement of terms of sale. The person, firm, partnership,
15association, or corporation accepting the credit card may require
16a cardholder, as a condition to accepting a credit card as payment
17in full or in part, in an online transaction involving an electronic
18downloadable product, to provide additionalend delete
personalbegin insert identificationend insert
19 information, if it requires that information for the detection,
20investigation, or prevention of fraud, theft, identity theft, or
21criminal activity, or for enforcement of terms of sale, and the
22begin delete additionalend delete personalbegin insert identificationend insert information is used solely for begin delete23 the detection, investigation, or prevention of fraud, theft, identity
24theft, or criminal activity, or for enforcement of terms of sale.end delete
begin insert those
25purposes.end insert
The person, firm, partnership, association, or corporation
26accepting the credit card shall destroy or dispose of thebegin delete ZIP Code,
27street address number, and any additionalend delete
personalbegin insert identificationend insert
28 information it requires pursuant to this subdivision in a secure
29manner after it is no longer needed for thebegin delete detection, investigation,
30or prevention of fraud, theft, identity theft, or criminal activity, or
31for enforcement of terms of saleend delete
begin insert purposes authorized under this
32 paragraphend insert
. The person, firm, partnership, association, or
33corporation accepting the credit card shall not aggregate the begin delete ZIP
34Code, street address number, or additionalend delete
personalbegin insert identificationend insert
35 information it requires pursuant to this subdivision with any other
36personal identification information and shall not share thebegin delete ZIP
37Code, street address number, or additionalend delete
personalbegin insert identificationend insert
38 information it requires pursuant to this subdivision with any other
39person, firm, partnership, association, or corporation unless it is
40required to do so by state or federal law, or is contractually
P9    1obligated to share the information with another entity to verify the
2information, complete the transaction, or for the detection,
3investigation, or prevention of fraud, theft, identity theft, or
4criminal activity, or for enforcement of terms of sale.

begin delete

5(3) (A) Notwithstanding subdivision (a), a person, firm,
6partnership, association, or corporation may request, but not
7require, personal information from a cardholder as part of an online
8transaction involving an electronic downloadable product, as long
9as the cardholder actively elects to provide the personal information
10by opting in to the collection of the information and is
11contemporaneously notified of all of the following:

12(i) That providing the information is not required to complete
13the transaction.

14(ii) The purpose of the request.

15(iii) The intended use of the information.

16(B) A cardholder shall be provided with an additional
17opportunity to opt out of the collection of the information before
18the online transaction involving an electronic downloadable product
19is completed.

end delete
begin insert

20(3) (A) Notwithstanding subdivision (a), a person, firm,
21partnership, association, or corporation that provides an electronic
22downloadable product may require a consumer to establish an
23account as a condition for the purchase of an electronic
24downloadable product and may require a consumer to provide
25personally identifiable information to establish, maintain, or update
26that account. Except as provided in subparagraph (B), the personal
27identification information collected pursuant to this subdivision
28may only be used for the establishment, maintenance, or updating
29of the account, or to process a credit card transaction.

end insert
begin insert

30(B) (i) Concurrent with completing a transaction for an
31electronically downloadable product, or when establishing an
32account pursuant to subparagraph (A), a cardholder may elect to
33provide personally identifiable information by opting in to the
34collection and use of that information if he or she is
35contemporaneously notified of the following:

end insert
begin insert

36(I) That providing the information is not required to complete
37the transaction.

end insert
begin insert

38(II) The purpose of the request.

end insert
begin insert

39(III) The intended use of the information.

end insert
begin insert

P10   1(ii) A cardholder shall be provided with an opportunity to opt
2out of the collection of the information before the online transaction
3involving an electronic downloadable product is completed.

end insert

4(e) Any person who violates this section shall be subject to a
5civil penalty not to exceed two hundred fifty dollars ($250) for the
6first violation and one thousand dollars ($1,000) for each
7subsequent violation, to be assessed and collected in a civil action
8brought by the person paying with a credit card, by the Attorney
9General, or by the district attorney or city attorney of the county
10or city in which the violation occurred. However, no civil penalty
11shall be assessed for a violation of this section if the defendant
12shows by a preponderance of the evidence that the violation was
13not intentional and resulted from a bona fide error made
14notwithstanding the defendant’s maintenance of procedures
15reasonably adopted to avoid that error. When collected, the civil
16penalty shall be payable, as appropriate, to the person paying with
17a credit card who brought the action, or to the general fund of
18whichever governmental entity brought the action to assess the
19civil penalty.

20(f) The Attorney General, or any district attorney or city attorney
21within his or her respective jurisdiction, may bring an action in
22the superior court in the name of the people of the State of
23California to enjoin violation of subdivision (a) and, upon notice
24to the defendant of not less than five days, to temporarily restrain
25and enjoin the violation. If it appears to the satisfaction of the court
26that the defendant has, in fact, violated subdivision (a), the court
27may issue an injunction restraining further violations, without
28requiring proof that any person has been damaged by the violation.
29In these proceedings, if the court finds that the defendant has
30violated subdivision (a), the court may direct the defendant to pay
31any or all costs incurred by the Attorney General, district attorney,
32or city attorney in seeking or obtaining injunctive relief pursuant
33to this subdivision.

34(g) Actions for collection of civil penalties under subdivision
35(e) and for injunctive relief under subdivision (f) may be
36consolidated.

37(h) The changes made to this section by Chapter 458 of the
38Statutes of 1995 apply only to credit card transactions entered into
39on and after January 1, 1996. Nothing in those changes shall be
P11   1construed to affect any civil action that was filed before January
21, 1996.



O

    95