BILL ANALYSIS                                                                                                                                                                                                    



                                                                    AB 1580


                                                                    Page  1





          Date of Hearing:  March 14, 2016


                      ASSEMBLY COMMITTEE ON BANKING AND FINANCE


                               Matthew Dababneh, Chair


          AB 1580  
          (Gatto & Irwin) - As Amended March 3, 2016


          SUBJECT:  Consumer credit reports:  security freezes:  protected  
          consumer


          SUMMARY:  Creates a process for the placement or removal of a  
          security freeze for a protected consumer, as defined.   
          Specifically, this bill:  


          1)Defines "protected consumer" as an individual who is either:


             a)   Under 16 years of age at the time a request is made; or,  



             b)   An incapacitated person or a protected person for whom a  
               guardian or conservator has been appointed.  


          2)Requires a consumer credit reporting agency (CCRA) to place a  
            security freeze for a protected consumer if:


             a)   The CCRA receives a request from the protected  
               consumer's representative for the placement of the security  








                                                                    AB 1580


                                                                    Page  2





               freeze; and, 


             b)   The protected consumer's representative does all of the  
               following:


               i)     Submits the request to the CCRA; 


               ii)    Provides to the CCRA sufficient proof of  
                 identification of the protected consumer and the  
                 representative;


               iii)   Provides to the CCRA sufficient proof of authority  
                 to act on behalf of the protected consumer; and, 


               iv)    Pays a fee of no more than $10 to the CCRA.  


          3)Provides that if a CCRA does not have a file pertaining to a  
            protected consumer when the CCRA receives a request, the CCRA  
            shall create a record for the protected consumer.  


          4)Allows the CCRA 30 days, after receiving a request, to place a  
            security freeze for a protected consumer.  


          5)Requires the CCRA to send confirmation to the protected  
            consumer that the freeze was placed within 10 days of the  
            freeze being placed.  


          6)Prohibits a CCRA from releasing the protected consumer's  
            consumer report or any information derived from the protected  
            consumer's consumer report unless the security freeze is  








                                                                    AB 1580


                                                                    Page  3





            removed. 


          7)Requires a security freeze for a protected consumer to remain  
            in place unless:


             a)   The protected consumer or the protected consumer's  
               representative requests that the CCRA remove the security  
               freeze; or, 


             b)   The protected consumer's security freeze was created  
               based upon a material misrepresentation of fact by the  
               protected consumer or the protected consumer's  
               representative.  


          8)Provides in order to remove a security freeze, the protected  
            consumer or the protected consumer's representative shall:


             a)   Submit the request in the manner specified by the CCRA; 


             b)   If the request is made by the protected consumer, the  
               protected consumer must provide to the CCRA:


               i)     Proof that the protected consumer's representative,  
                 to act on behalf of the protected consumer, is no longer  
                 valid; and, 


               ii)    Sufficient proof of identification of the protected  
                 consumer.  


             c)   If the request is made by the representative, the  








                                                                    AB 1580


                                                                    Page  4





               representative must provide to the CCRA:


               i)     Proof of identification of the protected consumer  
                 and the representative; and, 


               ii)    Sufficient proof of authority to act on behalf of  
                 the protected consumer. 


             d)   Pay a fee, not to exceed $10 to the CCRA.  


             e)   Provides that the CCRA has 30 days to remove a security  
               freeze after receiving a request. 


          9)Allows a CCRA to charge a reasonable fee, not to exceed $10  
            for each placement or removal of a security freeze for a  
            protected consumer.  


             a)   Prohibits a CCRA from charging a fee if:


               i)     The protected consumer's representative has received  
                 a report of alleged identity theft; or, 


               ii)    The request for the placement or removal of a  
                 security freeze is for a protected consumer who is under  
                 16 at the time of the request and the CCRA has a report  
                 pertaining to the protected consumer.  


          10)Provides a number of exemptions to the use of a protected  
            consumer report which include:









                                                                    AB 1580


                                                                    Page  5






             a)   A person or entity listed in subdivision (l) of Civil  
               Code Section, 1785.11.2, or Section 1785.11.4 or 1785.11.6;  



             b)   A person administering a credit file monitoring  
               subscription service to which the protected consumer  
               subscribed or to which the representative of the protected  
               consumer subscribed; 


             c)   A person who provided the protected consumer or  
               representative with a copy of the protected consumer's  
               credit report; or, 


             d)   A person or entity that maintains or is a database used  
               solely for one of the following:


               i)     Criminal record information; 


               ii)    Personal loss history information;


               iii)   Fraud prevention or protection;


               iv)    Employment screening; or,


               v)     Tenant screening.  


          11)Allows a CCRA to develop procedures involving the use of  
            telephone, fax, the Internet, or other electronic media to  
            receive and process a request for a protected consumer credit  








                                                                    AB 1580


                                                                    Page  6





            freeze to be placed or removed.  


          12)Requires CCRA to notify the protected consumer within 10 days  
            if the protected consumer's frozen credit record was released  
            without proper authorization.  


          13)Defines "record" as a compilation of information that:


             a)   Identifies a protected consumer;


             b)   Was created by a CCRA;


             c)   Is not otherwise authorized to be created or used to  
               consider the protected consumer's creditworthiness, credit  
               standing, credit capacity, character, general reputation,  
               personal characteristics or mode of living.  


          14)Defines "representative" as a person who provides to a CCRA  
            sufficient proof of authority to act on behalf of a protected  
            consumer. 


          15)Defines "security freeze":


             a)   If CCRA does not have a file pertaining to a protected  
               consumer, a restriction that:


               i)     Is placed on the protected consumer's record; or, 


               ii)    Prohibits the CCRA from releasing the protected  








                                                                    AB 1580


                                                                    Page  7





                 consumer's record.


             b)   If a CCRA has a file pertaining to a protected consumer,  
               a restriction that;


               i)     Is place on the protected consumer's report; or, 


               ii)    Prohibits the CCRA from releasing the protected  
                 consumer's report or any information derived from the  
                 protected consumer's consumer report. 


          16)Defines "sufficient proof of authority" as documentation that  
            shows that the representative has authority to act on behalf  
            of a protected consumer in a financial matter.  This  
            documentation includes, but is not limited to:


             a)   A court order or relevant enabling document issued by a  
               court; 


             b)   A legally sufficient and valid power of attorney or a  
               durable power of attorney; or, 


             c)   A written, notarized statement signed by a  
               representative that expressly describes the authority of  
               the representative to act on behalf of a protected  
               consumer; including a temporary conservator or temporary  
               guardian. 


          17)Defines "sufficient proof of identification" as information  
            or documentation that identifies a protected consumer of a  
            representative of a protected consumer.  This information or  








                                                                    AB 1580


                                                                    Page  8





            documentation includes but is not limited to: 


             a)   A social security number (SSN) or a copy of a social  
               security card issued by the Social Security Administration;


             b)   A certified copy or official copy of a birth  
               certificate;


             c)   A copy of a driver's license, an identification issued  
               by the DMV, or any other government-issued identification;  
               or, 


             d)   A copy of a bill for telephone, sewer, septic tank,  
               water, electric, oil, or natural gas services, that shows a  
               name and a home address. 


          EXISTING STATE LAW:  


          1)Regulates CCRAs via the Consumer Credit Reporting Agencies  
            Act. [Civil Code, Section 1785.1 et seq.  All further  
            references are to the Civil Code]

          2)Allows a CCRA to charge a consumer who is 65 years of age or  
            older and who has provided identification confirming his or  
            her age a fee not to exceed $5 for placement of each freeze,  
            the removal of the freeze, the temporary lift of the freeze  
            for a period of time, or the temporary lift of the freeze for  
            a specific party.  [Section 1785.11.2 (m)]

          3)Allows a consumer to place a security freeze on his or her  
            credit report by making a written request by mail to a CCRA.    
            [Section 1785.11.2(a)]









                                                                    AB 1580


                                                                    Page  9





          4)Defines "security freeze" as a notice placed in a consumer's  
            credit report at the consumer's request and, subject to  
            certain exceptions, prohibits the credit reporting agency from  
            releasing the credit report or any information from it without  
            the consumer's express authorization.  [Section 1785.11.2]

          5)Requires the CCRA to place a security freeze on the consumer's  
            credit report no later than 3 days after receiving a request,  
            and within 10 business days must send the consumer written  
            confirmation of the freeze along with a unique personal  
            identification or password to be used by the consumer when  
            authorizing the release of his or her credit for a specific  
            party or period of time.  [Section 1785.11.2(b) (c)].

          6)Allows a consumer to request a temporary lift of a security  
            freeze, if certain conditions are met.  A CCRA that receives a  
            request for a temporary lift of a security freeze is required  
            to do so within three business days of receiving the request.   
            [Section 1785.11.2(d) (e) (g)]

          7)Provides that a CCRA may develop procedures involving the use  
            of telephone, fax, the internet, or other electronic media to  
            receive and process a consumer request to temporarily lift a  
            security freeze in an expedited manner.  [Section  
            1785.11.2(f)]

          8)Requires that, if a consumer requests a security freeze, the  
            CCRA must inform the consumer of the process for placing and  
            temporarily lifting a freeze, and the process for allowing  
            access to information from the consumer's credit report for a  
            specific party or period of time while a freeze is in place.   
            [Section 1785.11.2(i)]

          9)Allows, except as specified, a CCRA to charge a fee of no more  
            than $10 to a consumer for each freeze, removal of the freeze,  
            or temporary lift of the freeze for a period of time. [Section  
            1785.11.2(m)]

          10)Prohibits a fee from being charged to place a security freeze  








                                                                    AB 1580


                                                                    Page  10





            for a victim of identity theft who presents a valid police  
            report or valid DMV investigative report [Section  
            1785.11.2(m)]

          11)Requires that whenever a CCRA provides a written disclosure  
            to a consumer that it must also include a notice to a consumer  
            of their rights to receive and correct errors on their credit  
            report, as well as, information on placing a security freeze  
            and credit alert on their credit file. [Section 1785.15]

          EXISTING FEDERAL LAW requires every credit reporting agency to  
          disclose to a consumer, upon request, specific information  
          related to that consumer's credit report, as well as, directions  
          on how to contest information contained within the report. [Fair  
          Credit Reporting Act 15 U.S.C. 1681et seq.]

          FISCAL EFFECT:  None. 


          COMMENTS:  


          Need for the bill:

          According to the Authors:  


            "Most children get a Social Security Number early in their  
            lives. Identity thieves recognize this and recognize that  
            parents are not monitoring their child's credit. For that  
            reason, thieves are targeting children, stealing their  
            identity, and opening credit lines with their Social  
            Security Numbers. AB 1580 is a common-sense proposal that  
            provides parents the tools to proactively protect their  
            child's financial future. It is time for California to  
            step up and join the many states that have passed similar  
            legislation. Parents will be able to sleep better at night  
            knowing their child's identity is protected."









                                                                    AB 1580


                                                                    Page  11






          A study conducted by Carnegie Mellon CyLab found that "It is not  
          simply enough to guard your own identity in the 21st Century you  
          must also guard your child's."  This statement highlights the  
          intent of AB 1580.  Currently, California lacks statutory  
          provisions specific to protected consumers.  Twenty-three other  
          states have a security freeze process in place for protected  
          consumers, where as in most cases a protected consumer is  
          considered to be 16 years of age or younger.  The concept of a  
          protected consumer is fairly new due to the fact protected  
          consumers do not have access to credit therefore should not have  
          a credit file.  If a protected consumer becomes a victim of  
          identity theft they unfortunately do not become aware of this  
          fact until he or she applies for credit as an adult.  


          AB 1580 creates a process where a protected consumer's  
          representative, most likely a parent, has the option to place  
          and remove a security freeze on a protected consumer.  To place  
          the freeze, a parent or representative would directly contact a  
          CCRA and submit the request for a credit freeze by mail. Parents  
          would then authenticate their identity and prove they are  
          legally able to act on behalf of the child. After the request is  
          filed, a record will be created for the child, and the credit  
          record would be frozen within 30 days.  Under the bill, a CCRA  
          would then be prohibited from releasing credit information or  
          customer records for that protected consumer. 


          If a child does not have an existing credit file, this  
          legislation mandates a consumer credit reporting agency to  
          create a credit "record" of the child's personal information for  
          the sole purpose of implementing a credit freeze. A credit file  
          in nature is directly related to credit worthiness, credit  
          standing, and credit capacity, which are used to determine  
          credit eligibility. Unlike a credit file, a credit record is  
          created for identity theft prevention purposes. Therefore,  
          creating and freezing a credit record does not impact a child's  
          eligibility for credit in the future. Out of the 23 states that  








                                                                    AB 1580


                                                                    Page  12





          allow child credit freezing, a majority use the credit record  
          method of implementation. 


          AB 1580 does not allow a security freeze to be temporarily  
          lifted, nor does it supply a Personal Identification Number for  
          the purpose of lifting the freeze.  Research has shown that it  
          is not uncommon for parents or relatives of a child to commit  
          "friendly fraud" and borrow the child's Social Security Number  
          to apply for credit if they do not qualify based on their own  
          credit score. 


          Child Identity Theft:





          According to the Attorney General's Office, child identity theft  
          happens when someone uses a minor child's personal information,  
          such as name and Social Security number, usually to obtain  
          credit or employment. Identity thieves may target children  
          because the crime can go undetected for years, often until the  
          child applies for his or her first loan or credit card.


          Since children have perfectly clean backgrounds, no real credit  
          score to speak of, and their parents do not think to monitor the  
          status of their identity, they make easy targets for identity  
          theft.  Identity theft can have negative effects on a child's  
          credit down the line, and they could have trouble securing  
          student loans, getting a decent job, or even purchasing a  
          cellphone.  The study conducted by Carnegie Melon's CyLab, found  
          that 10.2% of the children reported that someone else had used  
          their Social Security number fraudulently. The worst of these  
          accounts was toward a 16-year-old girl who had reported  
          fraudulent charges of $725,000 under her name.









                                                                    AB 1580


                                                                    Page  13






          Among the 13 million consumers whose identities were stolen in  
          2013, a growing number includes children.  One in 40 families  
          with children under 18 had at least one child whose personal  
          information was compromised, according to a 2012 survey by the  
          Identity Theft Assistance Center and the Javelin Strategy &  
          Research group. The survey revealed that identity thieves most  
          often steal children's Social Security numbers, since young  
          children seldom have the credit histories acquired by adults,  
          such as credit cards, bank accounts, licenses and financial  
          statements.  The same survey also found 17 percent of children  
          were victimized for a year or longer.


          Background:


          In California, consumers have the right to put a "security  
          freeze" on their credit file which can help prevent identity  
          theft.  A security freeze means that the consumer's file cannot  
          be shared with potential creditors.  Most businesses will not  
          open credit accounts without first checking a consumer's credit  
          history.  If credit files are frozen, even someone who has the  
          consumer's name and Social Security number would most likely not  
          be able to get credit in the consumer's name. 


          Security freezes are designed to prevent a CCRA from releasing a  
          credit report without the consumer's consent.  Using a security  
          freeze to take control over who is allowed access to the  
          personal and financial information in a file may delay,  
          interfere with or prohibit the timely approval of any subsequent  
          request or application the consumer makes regarding a new loan,  
          credit, mortgage, insurance, government services or payments,  
          rental housing, employment, investment, license, cellular  
          telephone, utilities, digital signature, Internet credit card  
          transaction or other services, including an extension of credit  
          at point of sale.









                                                                    AB 1580


                                                                    Page  14





          When a consumer places a security freeze on their file, the  
          consumer will be provided a personal identification number or  
          password to use if the consumer chooses to remove the security  
          freeze from their file or authorize the temporary release of  
          their credit report for a specific person or period after the  
          security freeze is in place. To provide that authorization, the  
          consumer must contact the CCRA and provide all the following:  
          Sufficient identification to verify identity, personal  
          identification number or password provided by the CCRA, a  
          statement that the consumer chooses to remove the security  
          freeze from their file or that the consumer authorizes the CCRA   
          to temporarily release the consumer report.  



          Previous Legislation: 





          AB 1658 ((Jones-Sawyer, Chapter 762, Statutes of 2014) This bill  
          specified the process for placement of a credit freeze for a  
          child in foster care.  





          AB 372 ((Salas) Chapter 151, Statutes of 2008)  This bill  
          amended the CCRA Act to provide that a consumer credit   
          reporting agency may, except as specified, charge a fee of  no  
          more than $5 to a consumer 65 years of age or older and no more  
          than $10 to other consumers for each security freeze request,  
          removal of the freeze, temporary  lift of the freeze for a  
          period of time, or temporary lift  of a freeze for a specific  
          party; required a CCRA to place a security freeze on a   
          consumer's credit report no later than three business days after  
          receiving a request; allows a  consumer to place a security  








                                                                    AB 1580


                                                                    Page  15





          freeze on his or her credit  report by making a written request  
          by regular mail to a CCRA.   













































                                                                    AB 1580


                                                                    Page  16






          Recommended Amendments: 





          Most of these amendments are technical and clarifying.  Further  
          clarification is needed for #11 which is why the committee  
          recommends deleting this provision and revisiting this issue in  
          the future.  


          


          1)On page 3, line 29, delete "," before that



          2) On page 3, line 33, insert "consumer's" after protected



          3)On page 3, line 38, delete " to which the protected consumer  
            has subscribed or "

          4)On page 4, line 3, delete "on" and insert "at the" 



          5)On page 4, line 4, insert  after or, "at the request"



          6)On page 4, between lines 35-35- insert:











                                                                    AB 1580


                                                                    Page  17







            "(c) If a protected consumer's representative requests a  
            security freeze, the consumer credit reporting agency shall  
            disclose the process for placing and removing a security  
            freeze."





          7)On page 4, line 38, after consumer, insert "."



          8)On page 4, delete lines 39-40 and insert:
               "(1) The consumer credit reporting agency shall send a  
                                          written confirmation of the security freeze to the  
               protected consumer's representative within 10 days of the  
               placement of the security freeze.





          9)On page 6, line 22, delete "consumer" and insert "consumer's"



          10)On page 6, line 23, delete "credit" and insert "security"

          11)On page 6, delete lines 24-26



          REGISTERED SUPPORT / OPPOSITION:











                                                                    AB 1580


                                                                    Page  18






          Support


          California District Attorneys Association (CDAA)


          California Public Interest Research group (CALPIRG)


          Consumer Attorneys of California


          Privacy Rights Clearinghouse




          Opposition


          None on file.




          Analysis Prepared by:Kathleen O'Malley / B. & F. / (916)  
          319-3081



















                                                                    AB 1580


                                                                    Page  19