BILL ANALYSIS                                                                                                                                                                                                    



                                                                    AB 1580


                                                                    Page  1





          Date of Hearing:  May 3, 2016


                ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION


                                   Ed Chau, Chair


          AB 1580  
          (Gatto and Irwin) - As Amended April 18, 2016


          SUBJECT:  Consumer credit reports:  security freezes:  protected  
          consumer


          SUMMARY:  Permits a parent or other legal representative to  
          freeze a child's credit records with the three major consumer  
          credit reporting agencies (CRAs), and requires a CRA to create a  
          record for the protected consumer and impose a security freeze  
          within 30 days of receiving a request if a file for that person  
          does not already exist.  Specifically, this bill:  


          1)Requires a CRA to disclose the process for placing and  
            removing a security freeze, and to place a security freeze on  
            an account if the protected consumer's representative: 


             a)   Submits a request to the CRA at the address or other  
               point of contact and in the manner specified by the CRA;


             b)   Provides sufficient proof of identification; 


             c)   Provides sufficient proof of authority to act on behalf  
               of the protected consumer; and








                                                                    AB 1580


                                                                    Page  2







             d)   Pays the CRA the requisite fee. 


          2)Requires a CRA, if it does not have a file on the protected  
            consumer, to create a record for the protected consumer and to  
            place the security freeze within 30 days of receiving a  
            request and to send written confirmation of freeze to within  
            10 days of placing the freeze.


          3)Prohibits the CRA from releasing information from a protected  
            consumer's frozen report or record until the protected  
            consumer (or representative) either removes the freeze or the  
            CRA removes the freeze because of a material misrepresentation  
            of fact.


          4)Requires that in order to remove a freeze, the protected  
            consumer (or representative) must submit a request for removal  
            to the CRA, as specified by the CRA and meet the same  
            requirements specified above for placing a freeze and allows a  
            consumer to act for him- or herself upon presenting proof of  
            emancipation or that he or she is at least 16 years old. 


          5)Allows CRAs to charge a $10 fee for placing or removing a  
            security freeze, unless the protected consumer is a documented  
            identity theft victim, the protected consumer is under 16 and  
            the CRA has an existing record on the protected consumer at  
            the time of the request, or the request is for a foster child.


          6)Allows a CRA to develop procedures for submitting requests for  
            placement or removal of a freeze by phone, mail, fax, the  
            Internet or other electronic media.










                                                                    AB 1580


                                                                    Page  3





          7)Exempts from the security freeze (i.e., permits access to  
            "frozen" records for) the following:  


             a)   Banks and other lenders who access a consumer's credit  
               report only for the purpose of reviewing existing accounts  
               the consumer has with the bank or lender.


             b)   Resellers of credit report information.


             c)   Check services or fraud prevention services that issue  
               check fraud and ETF fraud reports; and deposit account  
               information services that issue reports on account closures  
               due to fraud, substantial overdrafts, ATM abuse, or similar  
               negative information for use by banks who are reviewing  
               existing consumer accounts.


             d)   Credit monitoring services when the protected consumer  
               (or the representatives) has subscribed to the services.


             e)   The protected consumer himself or herself (or the  
               representative) upon request.


             f)   Any state or local agency, law enforcement agency, trial  
               court, or private collection agency acting pursuant to a  
               court order, warrant, or subpoena.


             g)   A child support agency acting under state or federal law  
               to collect child support.


             h)   The Department of Health Care Services acting to  
               investigate Medi-Cal fraud.








                                                                    AB 1580


                                                                    Page  4







             i)   The Franchise Tax Board acting to investigate or collect  
               delinquent taxes, unpaid court orders, or to fulfill its  
               other statutory responsibilities.


          8)Defines the following terms:


             a)   "Protected consumer" means an individual who is under  
               16, incapacitated, or under a county welfare or county  
               probation department's jurisdiction;


             b)   "Record" means information that identifies a protected  
               consumer and that is created by a CRA for this bill and not  
               for credit decision-making;


             c)   "Representative" means a person who provides sufficient  
               proof of authority to act for a protected person, as  
               specified, and would include a county welfare or probation  
               department for a child in foster care, but would not  
               include a foster parent;


             d)   "Security freeze" means a restriction that a CRA places  
               on a protected consumer's record or file that prohibits the  
               CRA from releasing a any report or information about a  
               protected consumer, except as authorized by the bill. 


             e)   "Sufficient proof of authority" means documentation that  
               shows a representative has authority to act for a protected  
               consumer, including: a court order, a valid power of  
               attorney, a written, notarized statement, or in the case of  
               a foster child a written communication from a county  
               welfare or probation department specifying that the  








                                                                    AB 1580


                                                                    Page  5





               protected consumer is under the department's jurisdiction;


             f)   "Sufficient proof of identification" means documentation  
               that identifies a protected consumer or a representative,  
               including: a social security number or card; a certified or  
               official copy of a birth certificate; a copy of a  
               California driver's license or identification card or other  
               government-issued identification; a copy of a utility bill  
               that shows name and address, or in the case of a foster  
               child a written communication from a county welfare or  
               probation department certifying that the protected consumer  
               is under the department's jurisdiction.


          EXISTING LAW:  


          1)Allows an adult consumer to place a security alert on his or  
            her credit report, so that banks and other lenders get a  
            warning - before approving new credit - that the consumer may  
            be a victim of identity theft.  (Civil Code (CC) Section  
            1785.11.1)


          2)Allows an adult consumer to prevent identity theft by placing  
            a security freeze on his or her credit report, so that banks  
            and other lenders - who may request the consumer's credit  
            report as part of a credit approval process - are denied  
            access to the consumer's report, which then prevents the  
            lender from approving credit.  (CC 1785.11.2)


          3)Requires a CRA to place a security freeze on a consumer's  
            credit report no later than three business days after  
            receiving a written request from the consumer and requires the  
             (CC 1785.11.2(b))










                                                                    AB 1580


                                                                    Page  6





          4)Requires a CRA to send a unique personal identification number  
            (PIN) to a consumer who places a security freeze and establish  
            a process, so that the consumer may lift the freeze if he or  
            she wishes to apply for a new loan or credit.  (CC  
            1785.11.2(c)-(f))


          5)Allows a CRA to charge a $10 fee for placing, or lifting, a  
            security freeze, but prohibits charging a fee to proven  
            identity theft victims, but specifies that no initial fee may  
            be charged for seniors age 65 or older and that a reduced fee  
            of $5 applies to seniors when they lift a security freeze.   
            (CC 1785.11.2(m))


          6)Specifies that the security freeze provisions do not apply to:


             a)   Banks and other lenders who access a consumer's credit  
               report only for the purpose of reviewing existing accounts  
               the consumer has with the bank or lender.


             b)   Any state or local agency, law enforcement agency, trial  
               court, or private collection agency acting pursuant to a  
               court order, warrant, or subpoena.


             c)   A child support agency acting pursuant to Chapter 2  
               (commencing with Section 17400) of Division 17 of the  
               Family Code or Title IV-D of the Social Security Act (42  
               U.S.C. et seq.).


             d)   The State Department of Health Care Services or its  
               agents or assigns acting to investigate Medi-Cal fraud.


             e)   The Franchise Tax Board or its agents or assigns acting  








                                                                    AB 1580


                                                                    Page  7





               to investigate or collect delinquent taxes or unpaid court  
               orders or to fulfill any of its other statutory  
               responsibilities.


             f)   The use of credit information for the purposes of  
               prescreening as provided for by the federal Fair Credit  
               Reporting Act.


             g)   A person or entity administering a credit file  
               monitoring subscription service to which the consumer has  
               subscribed.


             h)   A person or entity for the purpose of providing a  
               consumer with a copy of his or her credit report upon the  
               consumer's request. 


             i)   Resellers of credit reporting information.  


             j)   Check services or fraud prevention services that issue  
               check fraud and electronic transaction fund fraud reports;  
               and deposit account information services that issue reports  
               on account closures due to fraud, substantial overdrafts,  
               ATM abuse, or similar negative information for use by banks  
               who are reviewing existing consumer accounts.  (CC  
               1785.11.2(l), 1785.11.4, and 1785.11.6)


          FISCAL EFFECT:  None.  This bill is keyed nonfiscal by the  
          Legislative Counsel.   


          COMMENTS:  










                                                                    AB 1580


                                                                    Page  8





           1)Purpose of this bill  .  This bill is intended to help protect  
            children from identity theft by requiring CRAs to accept  
            requests from parents or legal representatives to freeze the  
            credit files or credit records of children under 16 years old,  
            much the same way adults can currently place a security freeze  
            on their credit reports.  This measure is author-sponsored.   



           2)Author's statement  . According to the author's office, this  
            bill "will help parents be proactive preventers of child  
            identity theft by allowing them to freeze their child's credit  
            record with the three consumer credit reporting agencies.   
            This legislation creates an avenue to prevent identity thieves  
            from opening fraudulent accounts in a child's name and ruining  
            the child's credit at an early age."



            "Credit freezing is one of the best tools available to prevent  
            identity theft.  Under current law, consumer credit reporting  
            agencies are not mandated to, and therefore do not, offer a  
            clear path to freezing a child's credit report unless the  
            child's credit has already been stolen.  In that case, the  
            child would have an existing credit file in his or her name  
            upon which a consumer credit reporting agency could place a  
            freeze.  However, most children do not have an existing credit  
            file, meaning thieves have open access to a clean credit  
            history if they steal the Social Security Number of a minor  
            and use it to open fraudulent credit accounts.  Parents or  
            children often do not notice the fraudulent activity until the  
            child applies for a student loan, attempts to buy a car, get a  
            credit card, or rent an apartment and does not qualify due to  
            bad credit.  Parents will be able to sleep better at night  
            knowing their child's identity is protected."












                                                                    AB 1580


                                                                    Page  9






           3)Recent child identity theft statistics.   In 2014, the U.S.  
            Department of Justice found that 17.6 million residents over  
            the age of 16 experienced identity theft, and according to a  
            Carnegie Mellon CyLab study, children are targeted for  
            identity theft 51 times more frequently than adults.   
            According to the Carnegie Mellon CyLab study, child identities  
            are valuable to thieves because children do not have existing  
            credit files, and parents may not notice fraudulent activity  
            until the child turns 18.  (See  
            www.bjs.gov/content/pub/press/vit14pr.cfm and  
            www.cylab.cmu.edu/files/pdfs/reports/2011/child-identity-theft. 
            pdf)
            In 2015, the security breaches at Anthem and Premera Blue  
            Cross highlight the fact that technological advances make  
            identity theft much easier.  In these breaches alone, hackers  
            stole an estimated 19 million records including names, birth  
            dates, and Social Security numbers, many belonging to  
            children.


           4)Actions in other states.   In 2002, California became the first  
            state in the nation to pass identity theft prevention  
            legislation that both protected the confidentiality of Social  
            Security numbers and for the first time allowed consumers to  
            place a security freeze on their credit reports.  (SB 168  
            (Bowen), Chapter 720, Statutes of 2001)  Since then all other  
            states adopted California's security freeze law.  Since 2001,  
            however, with the growing incidence of child identity theft, a  
            number of states have updated their security freeze laws to  
            allow parents to freeze their minor children's credit records.  
             According to the National Conference of State Legislatures,  
            23 states now allow child security freezes.  According to the  
            author's office, this bill is carefully modeled on the  
            statutory language already in place for the child security  
            freeze laws found in other states. 











                                                                    AB 1580


                                                                    Page  10





           5)How would the child security freeze work?   This bill allows a  
            parent, legal guardian or conservator to place a security  
            freeze on behalf of a child under the age of 16 or an  
            incapacitated individual of any age.  To place the freeze, a  
            parent or representative directly contacts a CRA and submits  
            the request for a security freeze by mail.  Representatives  
            then authenticate their identity and prove they are legally  
            able to act on behalf of the protected individual.  After the  
            request is filed, a record is created for the individual and  
            credit is frozen within 30 days.  A CRA then will no longer  
            release credit information or customer records for the  
            protected individual. 





            If an individual does not have an existing credit file, this  
            bill requires CRA to create a credit "record" of the  
            individual's personal information for the sole purpose of  
            implementing a security freeze.  While a traditional credit  
            file is used to determine credit worthiness, a credit record  
            is created under this bill for identity theft prevention  
            purposes when a child or incapacitated person has no existing  
            credit file.  Under current law and under this bill, using a  
            security freeze does not impact a person's eligibility for  
            credit in the future. 


           


          6)Preventing "familial" identity theft.   Unfortunately, it is  
            not uncommon for parents or relatives of a child to commit  
            "friendly fraud" and borrow the child's Social Security number  
            to apply for credit if they do not qualify based on their own  
            credit score.  This bill is specifically designed to prevent  
            familial abuse of a child's identity once it has been locked  
            down.  While a parent may eventually request the freeze be  








                                                                    AB 1580


                                                                    Page  11





            permanently removed, this bill does not allow a child security  
            freeze to be temporarily lifted, so upon placing a security  
            freeze, no PIN or password is issued to the parent, guardian  
            or conservator.



           7)Technical amendments  .  In order to correct a reference to  
            current law, the following technical amendment is needed:



              On page 4, line 17 after "A person or entity listed in"  
            insert





              paragraphs (1) or (2) of





           8)Arguments in support  .  CalPIRG states in support of this bill  
            that it "actively supported the original credit freeze bill in  
            California, SB 168 (Bowen), back in 2001, and credit freezing  
            remains one of the best tools available to prevent identity  
            theft.  According to a Carnegie Mellon study, children are 50  
            times more likely than adults to have their identity stolen.  
            Child identities are valuable to thieves because children do  
            not have existing credit files, and parents may not notice  
            fraudulent activity for years or even decades." 
            "AB 1580 will allow a parent to place a credit freeze for a  
            child under the age of 16. After the request is filed, a  
            record will be created for the child, and credit will be  
            frozen within 30 days. A consumer credit reporting agency will  
            then be prohibited from releasing credit information or  








                                                                    AB 1580


                                                                    Page  12





            customer records for that protected child.  





            "Unfortunately, it is not uncommon for parents or relatives of  
            a child to commit "friendly fraud" and borrow the child's  
            Social Security Number to apply for credit if they do not  
            qualify based on their own credit score.  This legislation  
            specifically prevents friendly fraud because it does not allow  
            the freeze to be temporarily lifted, nor does it supply a  
            Personal Identification Number for the purpose of lifting the  
            freeze. Therefore, this bill is crafted in a way that prevents  
            thieves from finding the key to an otherwise locked down  
            credit record."


           


          9)Related legislation  .  AB 1553 (Irwin) would expand the state's  
            existing security freeze laws to children.  That bill was  
            subsequently gutted and amended to address an unrelated topic.  
               
          REGISTERED SUPPORT / OPPOSITION:




          Support


          AARP California


          California District Attorneys Association (CDAA)










                                                                    AB 1580


                                                                    Page  13





          CALPIRG


          Consumer Attorneys of California


          National Association of Social Workers, California Chapter  
          (NASW-CA)


          Professional Fiduciary Association of California


          Privacy Rights Clearinghouse


          Sacramento County District Attorney's Office


          Ventura County Sheriff's Office




          Opposition


          None on file.




          Analysis Prepared by:Jennie Bretschneider / P. & C.P. / (916)  
          319-2200













                                                                    AB 1580


                                                                    Page  14