BILL ANALYSIS Ó
AB 1580
Page 1
Date of Hearing: May 3, 2016
ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION
Ed Chau, Chair
AB 1580
(Gatto and Irwin) - As Amended April 18, 2016
SUBJECT: Consumer credit reports: security freezes: protected
consumer
SUMMARY: Permits a parent or other legal representative to
freeze a child's credit records with the three major consumer
credit reporting agencies (CRAs), and requires a CRA to create a
record for the protected consumer and impose a security freeze
within 30 days of receiving a request if a file for that person
does not already exist. Specifically, this bill:
1)Requires a CRA to disclose the process for placing and
removing a security freeze, and to place a security freeze on
an account if the protected consumer's representative:
a) Submits a request to the CRA at the address or other
point of contact and in the manner specified by the CRA;
b) Provides sufficient proof of identification;
c) Provides sufficient proof of authority to act on behalf
of the protected consumer; and
AB 1580
Page 2
d) Pays the CRA the requisite fee.
2)Requires a CRA, if it does not have a file on the protected
consumer, to create a record for the protected consumer and to
place the security freeze within 30 days of receiving a
request and to send written confirmation of freeze to within
10 days of placing the freeze.
3)Prohibits the CRA from releasing information from a protected
consumer's frozen report or record until the protected
consumer (or representative) either removes the freeze or the
CRA removes the freeze because of a material misrepresentation
of fact.
4)Requires that in order to remove a freeze, the protected
consumer (or representative) must submit a request for removal
to the CRA, as specified by the CRA and meet the same
requirements specified above for placing a freeze and allows a
consumer to act for him- or herself upon presenting proof of
emancipation or that he or she is at least 16 years old.
5)Allows CRAs to charge a $10 fee for placing or removing a
security freeze, unless the protected consumer is a documented
identity theft victim, the protected consumer is under 16 and
the CRA has an existing record on the protected consumer at
the time of the request, or the request is for a foster child.
6)Allows a CRA to develop procedures for submitting requests for
placement or removal of a freeze by phone, mail, fax, the
Internet or other electronic media.
AB 1580
Page 3
7)Exempts from the security freeze (i.e., permits access to
"frozen" records for) the following:
a) Banks and other lenders who access a consumer's credit
report only for the purpose of reviewing existing accounts
the consumer has with the bank or lender.
b) Resellers of credit report information.
c) Check services or fraud prevention services that issue
check fraud and ETF fraud reports; and deposit account
information services that issue reports on account closures
due to fraud, substantial overdrafts, ATM abuse, or similar
negative information for use by banks who are reviewing
existing consumer accounts.
d) Credit monitoring services when the protected consumer
(or the representatives) has subscribed to the services.
e) The protected consumer himself or herself (or the
representative) upon request.
f) Any state or local agency, law enforcement agency, trial
court, or private collection agency acting pursuant to a
court order, warrant, or subpoena.
g) A child support agency acting under state or federal law
to collect child support.
h) The Department of Health Care Services acting to
investigate Medi-Cal fraud.
AB 1580
Page 4
i) The Franchise Tax Board acting to investigate or collect
delinquent taxes, unpaid court orders, or to fulfill its
other statutory responsibilities.
8)Defines the following terms:
a) "Protected consumer" means an individual who is under
16, incapacitated, or under a county welfare or county
probation department's jurisdiction;
b) "Record" means information that identifies a protected
consumer and that is created by a CRA for this bill and not
for credit decision-making;
c) "Representative" means a person who provides sufficient
proof of authority to act for a protected person, as
specified, and would include a county welfare or probation
department for a child in foster care, but would not
include a foster parent;
d) "Security freeze" means a restriction that a CRA places
on a protected consumer's record or file that prohibits the
CRA from releasing a any report or information about a
protected consumer, except as authorized by the bill.
e) "Sufficient proof of authority" means documentation that
shows a representative has authority to act for a protected
consumer, including: a court order, a valid power of
attorney, a written, notarized statement, or in the case of
a foster child a written communication from a county
welfare or probation department specifying that the
AB 1580
Page 5
protected consumer is under the department's jurisdiction;
f) "Sufficient proof of identification" means documentation
that identifies a protected consumer or a representative,
including: a social security number or card; a certified or
official copy of a birth certificate; a copy of a
California driver's license or identification card or other
government-issued identification; a copy of a utility bill
that shows name and address, or in the case of a foster
child a written communication from a county welfare or
probation department certifying that the protected consumer
is under the department's jurisdiction.
EXISTING LAW:
1)Allows an adult consumer to place a security alert on his or
her credit report, so that banks and other lenders get a
warning - before approving new credit - that the consumer may
be a victim of identity theft. (Civil Code (CC) Section
1785.11.1)
2)Allows an adult consumer to prevent identity theft by placing
a security freeze on his or her credit report, so that banks
and other lenders - who may request the consumer's credit
report as part of a credit approval process - are denied
access to the consumer's report, which then prevents the
lender from approving credit. (CC 1785.11.2)
3)Requires a CRA to place a security freeze on a consumer's
credit report no later than three business days after
receiving a written request from the consumer and requires the
(CC 1785.11.2(b))
AB 1580
Page 6
4)Requires a CRA to send a unique personal identification number
(PIN) to a consumer who places a security freeze and establish
a process, so that the consumer may lift the freeze if he or
she wishes to apply for a new loan or credit. (CC
1785.11.2(c)-(f))
5)Allows a CRA to charge a $10 fee for placing, or lifting, a
security freeze, but prohibits charging a fee to proven
identity theft victims, but specifies that no initial fee may
be charged for seniors age 65 or older and that a reduced fee
of $5 applies to seniors when they lift a security freeze.
(CC 1785.11.2(m))
6)Specifies that the security freeze provisions do not apply to:
a) Banks and other lenders who access a consumer's credit
report only for the purpose of reviewing existing accounts
the consumer has with the bank or lender.
b) Any state or local agency, law enforcement agency, trial
court, or private collection agency acting pursuant to a
court order, warrant, or subpoena.
c) A child support agency acting pursuant to Chapter 2
(commencing with Section 17400) of Division 17 of the
Family Code or Title IV-D of the Social Security Act (42
U.S.C. et seq.).
d) The State Department of Health Care Services or its
agents or assigns acting to investigate Medi-Cal fraud.
e) The Franchise Tax Board or its agents or assigns acting
AB 1580
Page 7
to investigate or collect delinquent taxes or unpaid court
orders or to fulfill any of its other statutory
responsibilities.
f) The use of credit information for the purposes of
prescreening as provided for by the federal Fair Credit
Reporting Act.
g) A person or entity administering a credit file
monitoring subscription service to which the consumer has
subscribed.
h) A person or entity for the purpose of providing a
consumer with a copy of his or her credit report upon the
consumer's request.
i) Resellers of credit reporting information.
j) Check services or fraud prevention services that issue
check fraud and electronic transaction fund fraud reports;
and deposit account information services that issue reports
on account closures due to fraud, substantial overdrafts,
ATM abuse, or similar negative information for use by banks
who are reviewing existing consumer accounts. (CC
1785.11.2(l), 1785.11.4, and 1785.11.6)
FISCAL EFFECT: None. This bill is keyed nonfiscal by the
Legislative Counsel.
COMMENTS:
AB 1580
Page 8
1)Purpose of this bill . This bill is intended to help protect
children from identity theft by requiring CRAs to accept
requests from parents or legal representatives to freeze the
credit files or credit records of children under 16 years old,
much the same way adults can currently place a security freeze
on their credit reports. This measure is author-sponsored.
2)Author's statement . According to the author's office, this
bill "will help parents be proactive preventers of child
identity theft by allowing them to freeze their child's credit
record with the three consumer credit reporting agencies.
This legislation creates an avenue to prevent identity thieves
from opening fraudulent accounts in a child's name and ruining
the child's credit at an early age."
"Credit freezing is one of the best tools available to prevent
identity theft. Under current law, consumer credit reporting
agencies are not mandated to, and therefore do not, offer a
clear path to freezing a child's credit report unless the
child's credit has already been stolen. In that case, the
child would have an existing credit file in his or her name
upon which a consumer credit reporting agency could place a
freeze. However, most children do not have an existing credit
file, meaning thieves have open access to a clean credit
history if they steal the Social Security Number of a minor
and use it to open fraudulent credit accounts. Parents or
children often do not notice the fraudulent activity until the
child applies for a student loan, attempts to buy a car, get a
credit card, or rent an apartment and does not qualify due to
bad credit. Parents will be able to sleep better at night
knowing their child's identity is protected."
AB 1580
Page 9
3)Recent child identity theft statistics. In 2014, the U.S.
Department of Justice found that 17.6 million residents over
the age of 16 experienced identity theft, and according to a
Carnegie Mellon CyLab study, children are targeted for
identity theft 51 times more frequently than adults.
According to the Carnegie Mellon CyLab study, child identities
are valuable to thieves because children do not have existing
credit files, and parents may not notice fraudulent activity
until the child turns 18. (See
www.bjs.gov/content/pub/press/vit14pr.cfm and
www.cylab.cmu.edu/files/pdfs/reports/2011/child-identity-theft.
pdf)
In 2015, the security breaches at Anthem and Premera Blue
Cross highlight the fact that technological advances make
identity theft much easier. In these breaches alone, hackers
stole an estimated 19 million records including names, birth
dates, and Social Security numbers, many belonging to
children.
4)Actions in other states. In 2002, California became the first
state in the nation to pass identity theft prevention
legislation that both protected the confidentiality of Social
Security numbers and for the first time allowed consumers to
place a security freeze on their credit reports. (SB 168
(Bowen), Chapter 720, Statutes of 2001) Since then all other
states adopted California's security freeze law. Since 2001,
however, with the growing incidence of child identity theft, a
number of states have updated their security freeze laws to
allow parents to freeze their minor children's credit records.
According to the National Conference of State Legislatures,
23 states now allow child security freezes. According to the
author's office, this bill is carefully modeled on the
statutory language already in place for the child security
freeze laws found in other states.
AB 1580
Page 10
5)How would the child security freeze work? This bill allows a
parent, legal guardian or conservator to place a security
freeze on behalf of a child under the age of 16 or an
incapacitated individual of any age. To place the freeze, a
parent or representative directly contacts a CRA and submits
the request for a security freeze by mail. Representatives
then authenticate their identity and prove they are legally
able to act on behalf of the protected individual. After the
request is filed, a record is created for the individual and
credit is frozen within 30 days. A CRA then will no longer
release credit information or customer records for the
protected individual.
If an individual does not have an existing credit file, this
bill requires CRA to create a credit "record" of the
individual's personal information for the sole purpose of
implementing a security freeze. While a traditional credit
file is used to determine credit worthiness, a credit record
is created under this bill for identity theft prevention
purposes when a child or incapacitated person has no existing
credit file. Under current law and under this bill, using a
security freeze does not impact a person's eligibility for
credit in the future.
6)Preventing "familial" identity theft. Unfortunately, it is
not uncommon for parents or relatives of a child to commit
"friendly fraud" and borrow the child's Social Security number
to apply for credit if they do not qualify based on their own
credit score. This bill is specifically designed to prevent
familial abuse of a child's identity once it has been locked
down. While a parent may eventually request the freeze be
AB 1580
Page 11
permanently removed, this bill does not allow a child security
freeze to be temporarily lifted, so upon placing a security
freeze, no PIN or password is issued to the parent, guardian
or conservator.
7)Technical amendments . In order to correct a reference to
current law, the following technical amendment is needed:
On page 4, line 17 after "A person or entity listed in"
insert
paragraphs (1) or (2) of
8)Arguments in support . CalPIRG states in support of this bill
that it "actively supported the original credit freeze bill in
California, SB 168 (Bowen), back in 2001, and credit freezing
remains one of the best tools available to prevent identity
theft. According to a Carnegie Mellon study, children are 50
times more likely than adults to have their identity stolen.
Child identities are valuable to thieves because children do
not have existing credit files, and parents may not notice
fraudulent activity for years or even decades."
"AB 1580 will allow a parent to place a credit freeze for a
child under the age of 16. After the request is filed, a
record will be created for the child, and credit will be
frozen within 30 days. A consumer credit reporting agency will
then be prohibited from releasing credit information or
AB 1580
Page 12
customer records for that protected child.
"Unfortunately, it is not uncommon for parents or relatives of
a child to commit "friendly fraud" and borrow the child's
Social Security Number to apply for credit if they do not
qualify based on their own credit score. This legislation
specifically prevents friendly fraud because it does not allow
the freeze to be temporarily lifted, nor does it supply a
Personal Identification Number for the purpose of lifting the
freeze. Therefore, this bill is crafted in a way that prevents
thieves from finding the key to an otherwise locked down
credit record."
9)Related legislation . AB 1553 (Irwin) would expand the state's
existing security freeze laws to children. That bill was
subsequently gutted and amended to address an unrelated topic.
REGISTERED SUPPORT / OPPOSITION:
Support
AARP California
California District Attorneys Association (CDAA)
AB 1580
Page 13
CALPIRG
Consumer Attorneys of California
National Association of Social Workers, California Chapter
(NASW-CA)
Professional Fiduciary Association of California
Privacy Rights Clearinghouse
Sacramento County District Attorney's Office
Ventura County Sheriff's Office
Opposition
None on file.
Analysis Prepared by:Jennie Bretschneider / P. & C.P. / (916)
319-2200
AB 1580
Page 14