BILL ANALYSIS Ó
AB 1580
Page 1
Date of Hearing: March 14, 2016
ASSEMBLY COMMITTEE ON BANKING AND FINANCE
Matthew Dababneh, Chair
AB 1580
(Gatto & Irwin) - As Amended March 3, 2016
SUBJECT: Consumer credit reports: security freezes: protected
consumer
SUMMARY: Creates a process for the placement or removal of a
security freeze for a protected consumer, as defined.
Specifically, this bill:
1)Defines "protected consumer" as an individual who is either:
a) Under 16 years of age at the time a request is made; or,
b) An incapacitated person or a protected person for whom a
guardian or conservator has been appointed.
2)Requires a consumer credit reporting agency (CCRA) to place a
security freeze for a protected consumer if:
a) The CCRA receives a request from the protected
consumer's representative for the placement of the security
AB 1580
Page 2
freeze; and,
b) The protected consumer's representative does all of the
following:
i) Submits the request to the CCRA;
ii) Provides to the CCRA sufficient proof of
identification of the protected consumer and the
representative;
iii) Provides to the CCRA sufficient proof of authority
to act on behalf of the protected consumer; and,
iv) Pays a fee of no more than $10 to the CCRA.
3)Provides that if a CCRA does not have a file pertaining to a
protected consumer when the CCRA receives a request, the CCRA
shall create a record for the protected consumer.
4)Allows the CCRA 30 days, after receiving a request, to place a
security freeze for a protected consumer.
5)Requires the CCRA to send confirmation to the protected
consumer that the freeze was placed within 10 days of the
freeze being placed.
6)Prohibits a CCRA from releasing the protected consumer's
consumer report or any information derived from the protected
consumer's consumer report unless the security freeze is
AB 1580
Page 3
removed.
7)Requires a security freeze for a protected consumer to remain
in place unless:
a) The protected consumer or the protected consumer's
representative requests that the CCRA remove the security
freeze; or,
b) The protected consumer's security freeze was created
based upon a material misrepresentation of fact by the
protected consumer or the protected consumer's
representative.
8)Provides in order to remove a security freeze, the protected
consumer or the protected consumer's representative shall:
a) Submit the request in the manner specified by the CCRA;
b) If the request is made by the protected consumer, the
protected consumer must provide to the CCRA:
i) Proof that the protected consumer's representative,
to act on behalf of the protected consumer, is no longer
valid; and,
ii) Sufficient proof of identification of the protected
consumer.
c) If the request is made by the representative, the
AB 1580
Page 4
representative must provide to the CCRA:
i) Proof of identification of the protected consumer
and the representative; and,
ii) Sufficient proof of authority to act on behalf of
the protected consumer.
d) Pay a fee, not to exceed $10 to the CCRA.
e) Provides that the CCRA has 30 days to remove a security
freeze after receiving a request.
9)Allows a CCRA to charge a reasonable fee, not to exceed $10
for each placement or removal of a security freeze for a
protected consumer.
a) Prohibits a CCRA from charging a fee if:
i) The protected consumer's representative has received
a report of alleged identity theft; or,
ii) The request for the placement or removal of a
security freeze is for a protected consumer who is under
16 at the time of the request and the CCRA has a report
pertaining to the protected consumer.
10)Provides a number of exemptions to the use of a protected
consumer report which include:
AB 1580
Page 5
a) A person or entity listed in subdivision (l) of Civil
Code Section, 1785.11.2, or Section 1785.11.4 or 1785.11.6;
b) A person administering a credit file monitoring
subscription service to which the protected consumer
subscribed or to which the representative of the protected
consumer subscribed;
c) A person who provided the protected consumer or
representative with a copy of the protected consumer's
credit report; or,
d) A person or entity that maintains or is a database used
solely for one of the following:
i) Criminal record information;
ii) Personal loss history information;
iii) Fraud prevention or protection;
iv) Employment screening; or,
v) Tenant screening.
11)Allows a CCRA to develop procedures involving the use of
telephone, fax, the Internet, or other electronic media to
receive and process a request for a protected consumer credit
AB 1580
Page 6
freeze to be placed or removed.
12)Requires CCRA to notify the protected consumer within 10 days
if the protected consumer's frozen credit record was released
without proper authorization.
13)Defines "record" as a compilation of information that:
a) Identifies a protected consumer;
b) Was created by a CCRA;
c) Is not otherwise authorized to be created or used to
consider the protected consumer's creditworthiness, credit
standing, credit capacity, character, general reputation,
personal characteristics or mode of living.
14)Defines "representative" as a person who provides to a CCRA
sufficient proof of authority to act on behalf of a protected
consumer.
15)Defines "security freeze":
a) If CCRA does not have a file pertaining to a protected
consumer, a restriction that:
i) Is placed on the protected consumer's record; or,
ii) Prohibits the CCRA from releasing the protected
AB 1580
Page 7
consumer's record.
b) If a CCRA has a file pertaining to a protected consumer,
a restriction that;
i) Is place on the protected consumer's report; or,
ii) Prohibits the CCRA from releasing the protected
consumer's report or any information derived from the
protected consumer's consumer report.
16)Defines "sufficient proof of authority" as documentation that
shows that the representative has authority to act on behalf
of a protected consumer in a financial matter. This
documentation includes, but is not limited to:
a) A court order or relevant enabling document issued by a
court;
b) A legally sufficient and valid power of attorney or a
durable power of attorney; or,
c) A written, notarized statement signed by a
representative that expressly describes the authority of
the representative to act on behalf of a protected
consumer; including a temporary conservator or temporary
guardian.
17)Defines "sufficient proof of identification" as information
or documentation that identifies a protected consumer of a
representative of a protected consumer. This information or
AB 1580
Page 8
documentation includes but is not limited to:
a) A social security number (SSN) or a copy of a social
security card issued by the Social Security Administration;
b) A certified copy or official copy of a birth
certificate;
c) A copy of a driver's license, an identification issued
by the DMV, or any other government-issued identification;
or,
d) A copy of a bill for telephone, sewer, septic tank,
water, electric, oil, or natural gas services, that shows a
name and a home address.
EXISTING STATE LAW:
1)Regulates CCRAs via the Consumer Credit Reporting Agencies
Act. [Civil Code, Section 1785.1 et seq. All further
references are to the Civil Code]
2)Allows a CCRA to charge a consumer who is 65 years of age or
older and who has provided identification confirming his or
her age a fee not to exceed $5 for placement of each freeze,
the removal of the freeze, the temporary lift of the freeze
for a period of time, or the temporary lift of the freeze for
a specific party. [Section 1785.11.2 (m)]
3)Allows a consumer to place a security freeze on his or her
credit report by making a written request by mail to a CCRA.
[Section 1785.11.2(a)]
AB 1580
Page 9
4)Defines "security freeze" as a notice placed in a consumer's
credit report at the consumer's request and, subject to
certain exceptions, prohibits the credit reporting agency from
releasing the credit report or any information from it without
the consumer's express authorization. [Section 1785.11.2]
5)Requires the CCRA to place a security freeze on the consumer's
credit report no later than 3 days after receiving a request,
and within 10 business days must send the consumer written
confirmation of the freeze along with a unique personal
identification or password to be used by the consumer when
authorizing the release of his or her credit for a specific
party or period of time. [Section 1785.11.2(b) (c)].
6)Allows a consumer to request a temporary lift of a security
freeze, if certain conditions are met. A CCRA that receives a
request for a temporary lift of a security freeze is required
to do so within three business days of receiving the request.
[Section 1785.11.2(d) (e) (g)]
7)Provides that a CCRA may develop procedures involving the use
of telephone, fax, the internet, or other electronic media to
receive and process a consumer request to temporarily lift a
security freeze in an expedited manner. [Section
1785.11.2(f)]
8)Requires that, if a consumer requests a security freeze, the
CCRA must inform the consumer of the process for placing and
temporarily lifting a freeze, and the process for allowing
access to information from the consumer's credit report for a
specific party or period of time while a freeze is in place.
[Section 1785.11.2(i)]
9)Allows, except as specified, a CCRA to charge a fee of no more
than $10 to a consumer for each freeze, removal of the freeze,
or temporary lift of the freeze for a period of time. [Section
1785.11.2(m)]
10)Prohibits a fee from being charged to place a security freeze
AB 1580
Page 10
for a victim of identity theft who presents a valid police
report or valid DMV investigative report [Section
1785.11.2(m)]
11)Requires that whenever a CCRA provides a written disclosure
to a consumer that it must also include a notice to a consumer
of their rights to receive and correct errors on their credit
report, as well as, information on placing a security freeze
and credit alert on their credit file. [Section 1785.15]
EXISTING FEDERAL LAW requires every credit reporting agency to
disclose to a consumer, upon request, specific information
related to that consumer's credit report, as well as, directions
on how to contest information contained within the report. [Fair
Credit Reporting Act 15 U.S.C. 1681et seq.]
FISCAL EFFECT: None.
COMMENTS:
Need for the bill:
According to the Authors:
"Most children get a Social Security Number early in their
lives. Identity thieves recognize this and recognize that
parents are not monitoring their child's credit. For that
reason, thieves are targeting children, stealing their
identity, and opening credit lines with their Social
Security Numbers. AB 1580 is a common-sense proposal that
provides parents the tools to proactively protect their
child's financial future. It is time for California to
step up and join the many states that have passed similar
legislation. Parents will be able to sleep better at night
knowing their child's identity is protected."
AB 1580
Page 11
A study conducted by Carnegie Mellon CyLab found that "It is not
simply enough to guard your own identity in the 21st Century you
must also guard your child's." This statement highlights the
intent of AB 1580. Currently, California lacks statutory
provisions specific to protected consumers. Twenty-three other
states have a security freeze process in place for protected
consumers, where as in most cases a protected consumer is
considered to be 16 years of age or younger. The concept of a
protected consumer is fairly new due to the fact protected
consumers do not have access to credit therefore should not have
a credit file. If a protected consumer becomes a victim of
identity theft they unfortunately do not become aware of this
fact until he or she applies for credit as an adult.
AB 1580 creates a process where a protected consumer's
representative, most likely a parent, has the option to place
and remove a security freeze on a protected consumer. To place
the freeze, a parent or representative would directly contact a
CCRA and submit the request for a credit freeze by mail. Parents
would then authenticate their identity and prove they are
legally able to act on behalf of the child. After the request is
filed, a record will be created for the child, and the credit
record would be frozen within 30 days. Under the bill, a CCRA
would then be prohibited from releasing credit information or
customer records for that protected consumer.
If a child does not have an existing credit file, this
legislation mandates a consumer credit reporting agency to
create a credit "record" of the child's personal information for
the sole purpose of implementing a credit freeze. A credit file
in nature is directly related to credit worthiness, credit
standing, and credit capacity, which are used to determine
credit eligibility. Unlike a credit file, a credit record is
created for identity theft prevention purposes. Therefore,
creating and freezing a credit record does not impact a child's
eligibility for credit in the future. Out of the 23 states that
AB 1580
Page 12
allow child credit freezing, a majority use the credit record
method of implementation.
AB 1580 does not allow a security freeze to be temporarily
lifted, nor does it supply a Personal Identification Number for
the purpose of lifting the freeze. Research has shown that it
is not uncommon for parents or relatives of a child to commit
"friendly fraud" and borrow the child's Social Security Number
to apply for credit if they do not qualify based on their own
credit score.
Child Identity Theft:
According to the Attorney General's Office, child identity theft
happens when someone uses a minor child's personal information,
such as name and Social Security number, usually to obtain
credit or employment. Identity thieves may target children
because the crime can go undetected for years, often until the
child applies for his or her first loan or credit card.
Since children have perfectly clean backgrounds, no real credit
score to speak of, and their parents do not think to monitor the
status of their identity, they make easy targets for identity
theft. Identity theft can have negative effects on a child's
credit down the line, and they could have trouble securing
student loans, getting a decent job, or even purchasing a
cellphone. The study conducted by Carnegie Melon's CyLab, found
that 10.2% of the children reported that someone else had used
their Social Security number fraudulently. The worst of these
accounts was toward a 16-year-old girl who had reported
fraudulent charges of $725,000 under her name.
AB 1580
Page 13
Among the 13 million consumers whose identities were stolen in
2013, a growing number includes children. One in 40 families
with children under 18 had at least one child whose personal
information was compromised, according to a 2012 survey by the
Identity Theft Assistance Center and the Javelin Strategy &
Research group. The survey revealed that identity thieves most
often steal children's Social Security numbers, since young
children seldom have the credit histories acquired by adults,
such as credit cards, bank accounts, licenses and financial
statements. The same survey also found 17 percent of children
were victimized for a year or longer.
Background:
In California, consumers have the right to put a "security
freeze" on their credit file which can help prevent identity
theft. A security freeze means that the consumer's file cannot
be shared with potential creditors. Most businesses will not
open credit accounts without first checking a consumer's credit
history. If credit files are frozen, even someone who has the
consumer's name and Social Security number would most likely not
be able to get credit in the consumer's name.
Security freezes are designed to prevent a CCRA from releasing a
credit report without the consumer's consent. Using a security
freeze to take control over who is allowed access to the
personal and financial information in a file may delay,
interfere with or prohibit the timely approval of any subsequent
request or application the consumer makes regarding a new loan,
credit, mortgage, insurance, government services or payments,
rental housing, employment, investment, license, cellular
telephone, utilities, digital signature, Internet credit card
transaction or other services, including an extension of credit
at point of sale.
AB 1580
Page 14
When a consumer places a security freeze on their file, the
consumer will be provided a personal identification number or
password to use if the consumer chooses to remove the security
freeze from their file or authorize the temporary release of
their credit report for a specific person or period after the
security freeze is in place. To provide that authorization, the
consumer must contact the CCRA and provide all the following:
Sufficient identification to verify identity, personal
identification number or password provided by the CCRA, a
statement that the consumer chooses to remove the security
freeze from their file or that the consumer authorizes the CCRA
to temporarily release the consumer report.
Previous Legislation:
AB 1658 ((Jones-Sawyer, Chapter 762, Statutes of 2014) This bill
specified the process for placement of a credit freeze for a
child in foster care.
AB 372 ((Salas) Chapter 151, Statutes of 2008) This bill
amended the CCRA Act to provide that a consumer credit
reporting agency may, except as specified, charge a fee of no
more than $5 to a consumer 65 years of age or older and no more
than $10 to other consumers for each security freeze request,
removal of the freeze, temporary lift of the freeze for a
period of time, or temporary lift of a freeze for a specific
party; required a CCRA to place a security freeze on a
consumer's credit report no later than three business days after
receiving a request; allows a consumer to place a security
AB 1580
Page 15
freeze on his or her credit report by making a written request
by regular mail to a CCRA.
AB 1580
Page 16
Recommended Amendments:
Most of these amendments are technical and clarifying. Further
clarification is needed for #11 which is why the committee
recommends deleting this provision and revisiting this issue in
the future.
1)On page 3, line 29, delete "," before that
2) On page 3, line 33, insert "consumer's" after protected
3)On page 3, line 38, delete " to which the protected consumer
has subscribed or "
4)On page 4, line 3, delete "on" and insert "at the"
5)On page 4, line 4, insert after or, "at the request"
6)On page 4, between lines 35-35- insert:
AB 1580
Page 17
"(c) If a protected consumer's representative requests a
security freeze, the consumer credit reporting agency shall
disclose the process for placing and removing a security
freeze."
7)On page 4, line 38, after consumer, insert "."
8)On page 4, delete lines 39-40 and insert:
"(1) The consumer credit reporting agency shall send a
written confirmation of the security freeze to the
protected consumer's representative within 10 days of the
placement of the security freeze.
9)On page 6, line 22, delete "consumer" and insert "consumer's"
10)On page 6, line 23, delete "credit" and insert "security"
11)On page 6, delete lines 24-26
REGISTERED SUPPORT / OPPOSITION:
AB 1580
Page 18
Support
California District Attorneys Association (CDAA)
California Public Interest Research group (CALPIRG)
Consumer Attorneys of California
Privacy Rights Clearinghouse
Opposition
None on file.
Analysis Prepared by:Kathleen O'Malley / B. & F. / (916)
319-3081
AB 1580
Page 19