BILL ANALYSIS Ó
SENATE JUDICIARY COMMITTEE
Senator Hannah-Beth Jackson, Chair
2015-2016 Regular Session
AB 1580 (Gatto)
Version: May 5, 2016
Hearing Date: June 14, 2016
Fiscal: No
Urgency: No
TH
SUBJECT
Consumer Credit Reports: Security Freezes: Protected Consumer
DESCRIPTION
This bill would require a consumer credit reporting agency to
place a security freeze on the credit file of a protected
consumer upon the request of, and submission of specified
information by, the protected consumer's representative, as
specified. This bill would define a protected consumer as any
of the following: an individual who is under 16 years of age at
the time a request for the placement of a security freeze is
made; an incapacitated person or a protected individual for whom
a guardian or conservator has been appointed; or a person under
the jurisdiction of a county welfare department or county
probation department who has been placed in a foster care
setting and is under 16 years of age at the time a request for a
security freeze is made.
BACKGROUND
According to the Federal Trade Commission's (FTC) "Consumer
Sentinel Network Data Book for January - December 2015,"
California had more identity theft complaints-55,305-than any
other state. For every 100,000 people in California, there were
141.3 identity theft complaints. Nationwide, identity theft has
increased more than five-fold during the past 15 years, with the
FTC receiving almost a half-million complaints from consumers in
2015 alone. (Federal Trade Commission, Consumer Sentinel
Network Data Book for January - December 2015 (Feb. 2016)
[as of June 1, 2016].)
Identity theft victims' information can be misused in numerous
ways. One of the most common is the creation of new accounts,
including credit card, utility, or wireless telephone accounts.
But, victims' information can also be used in other, equally
nefarious ways. As the Federal Trade Commission notes:
Once identity thieves have your personal information, they can
drain your bank account, run up charges on your credit cards,
open new utility accounts, or get medical treatment on your
health insurance. An identity thief might even file a tax
return in your name and get your refund. In some extreme
cases, a thief might even give your name to the police during
an arrest. (Federal Trade Commission, Taking Charge: What To
Do If Your Identity Is Stolen (Apr. 2013)
[as of
June 1, 2016].)
A credit file is a report detailing a consumer's credit history,
compiled by a credit reporting agency such as Experian, Trans
Union, or Equifax. The file contains information such as annual
income, outstanding debt, bill-paying history, the number,
types, and age of accounts, current and previous addresses, and
the consumer's Social Security number. Under federal law, a
credit reporting agency may disclose information contained in a
credit report to current and prospective creditors, insurers,
employers, provided the consumer has authorized the disclosure,
and others who have a "legitimate business need" in connection
with a business transaction initiated by the consumer. (15
U.S.C. Sec. 1681b.) Federal law requires consumer reporting
agencies to give consumers one free credit report each year.
(15 U.S.C. Sec. 1681j.)
In 2001, California became the first state in the nation to give
consumers the right to place a "freeze" on their credit reports,
which prohibits a credit reporting agency from releasing a
consumer's credit report without the express authorization of
the consumer while the freeze is in place. (See SB 168 [Bowen,
Ch. 720, Stats. 2001].) Freezes placed on credit reports can be
a useful tool in frustrating the ability of identity thieves to
open new lines of credit using another person's stolen identity.
AB 1580 (Gatto)
Page 3 of ?
Since that time, at least 46 other states have followed
California's lead and enacted security freeze legislation,
limiting disclosure of consumers' credit reports. Under current
law, security freezes are available to any consumer with a
credit report, but individuals who have never had credit in
their names, such as children, may not have a credit report on
file for which a freeze could be placed.
This bill would require a consumer credit reporting agency to
place a security freeze on the credit file of a protected
consumer, including children under the age of 16, upon the
request of, and submission of specified information by, the
protected consumer's representative.
CHANGES TO EXISTING LAW
Existing law , the California Consumer Credit Reporting Agencies
Act (Civ. Code Sec. 1785.1 et seq.) and the Federal Fair Credit
Reporting Act (15 U.S.C. Sec. 1681 et seq.), require consumer
credit reporting agencies to adopt reasonable procedures for
meeting the needs of commerce for consumer credit, personnel,
insurance, hiring of a dwelling unit, and other information in a
manner which is fair and equitable to the consumer, with regard
to the confidentiality, accuracy, relevancy, and proper
utilization of such information. (Civ. Code Sec. 1785.1(d); 15
U.S.C. Sec. 1681(b).)
Existing law permits a consumer to place a "security freeze" on
his or her credit report, prohibiting consumer credit reporting
agencies from releasing the consumer's credit report or any
information contained in it unless the consumer expressly
authorizes the release. (Civ. Code Sec. 1785.11.2(a).)
Existing law requires a credit reporting agency to place a
security freeze on a consumer's credit report within three
business days after receiving the consumer's request. (Civ.
Code Sec. 1785.11.2(b).)
Existing law requires a credit reporting agency to send a
written confirmation of the security freeze to the consumer
within 10 business days. The credit reporting agency must also
provide the consumer with a unique personal identification
number or password to be used by the consumer when he or she
authorizes the release of his or her information for a specific
AB 1580 (Gatto)
Page 4 of ?
party or period of time. (Civ. Code Sec. 1785.11.2(c).)
Existing law permits a consumer to allow his or her credit
report to be accessed for a specific party or period of time
while a freeze is in place and requires the consumer to provide
specified information to the credit reporting agency so that the
freeze may be temporarily lifted. (Civ. Code Sec.
1785.11.2(d).)
Existing law requires a credit reporting agency that receives a
consumer's request to temporarily lift a freeze to comply with
that request within three business days. (Civ. Code Sec.
1785.11.2(e).)
Existing law provides that a credit reporting agency may remove
or temporarily lift a freeze only upon the consumer's request or
if the consumer's credit report was frozen due to a material
misrepresentation of fact by the consumer, in which case the
credit reporting agency must notify the consumer before removing
the freeze. (Civ. Code Sec. 1785.11.2(g).)
Existing law requires that a security freeze must remain in
place until the consumer requests that it be removed. If a
consumer requests that the freeze be removed and provides
specified information, a credit reporting agency must comply
with that request within three business days of receiving the
request for removal. (Civ. Code Sec. 1785.11.2(j).) Existing
law provides that a credit reporting agency must require proper
identification, as defined, of a consumer making a request to
place or remove a security freeze. (Civ. Code Sec.
1785.11.2(k).)
This bill requires a consumer credit reporting agency to place a
security freeze on the credit file or record of a protected
consumer if the agency receives a request from the protected
consumer's representative for the placement of the freeze, and
specified information showing proof of identity and authority to
act on behalf of the protected consumer.
This bill requires a consumer credit reporting agency to create
a record for a protected consumer when it receives a request for
the placement of a security freeze if the agency does not have a
credit file pertaining to the protected consumer.
AB 1580 (Gatto)
Page 5 of ?
This bill specifies that within 30 days after receiving a
request, a consumer credit reporting agency shall place a
security freeze for the protected consumer. The consumer credit
reporting agency must send written confirmation of the security
freeze to the protected consumer's representative within 10 days
of the placement of the security freeze.
This bill specifies that unless a security freeze for a
protected consumer is removed, a consumer credit reporting
agency shall not release the protected consumer's consumer
report, any information derived from the protected consumer's
consumer report, or any record created for the protected
consumer.
This bill states that in order to remove a security freeze, a
protected consumer or a protected consumer's representative must
submit a request for removal of the security freeze to the
consumer credit reporting agency and provide specified
information showing proof of identity and authority to act on
behalf of the protected consumer.
This bill states that a consumer credit reporting agency shall
remove a security freeze for a protected consumer within 30 days
after receiving both the request to remove the freeze and all
required information.
This bill specifies that except as provided, a consumer credit
reporting agency is authorized to charge a reasonable fee, not
exceeding $10, for each placement or removal of a security
freeze for a protected consumer.
This bill excludes certain entities from the above restrictions,
including, among others, a person administering a credit file
monitoring subscription service to which the representative of
the protected consumer has subscribed on behalf of the protected
consumer.
This bill defines a "protected consumer" as an individual who is
any of the following:
under 16 years of age at the time a request for the placement
of a security freeze is made;
an incapacitated person or a protected person for whom a
guardian or conservator has been appointed; or
under the jurisdiction of a county welfare department or
AB 1580 (Gatto)
Page 6 of ?
county probation department, has been placed in a foster care
setting, and is under 16 years of age at the time a request
for placement of a security freeze is made.
This bill defines a "representative" as a person who provides to
a consumer credit reporting agency sufficient proof of authority
to act on behalf of a protected consumer. This bill specifies
that for a protected consumer who has been placed in a foster
care setting, "representative" means either a county welfare
department or its agent or designee, or a county probation
department or its agent or designee, but that it does not mean
the foster parent of a protected consumer who has been placed in
a foster care setting.
COMMENT
1.Stated need for the bill
The author writes:
Credit freezing is one of the best tools available to prevent
identity theft. Under current law, credit bureaus are not
mandated to, and therefore do not, offer a clear path to
freeze a child's credit record unless the child has already
had his or her credit stolen. Otherwise, the parent must go
through an onerous process to add the child as an authorized
user on an existing credit card, which includes a 60 to 90 day
wait period, provision of notarized identification documents
to credit bureaus, and a confirmation notice. Similar
barriers prevented adults from freezing their own credit
reports until new regulations made the process secure and
easy.
According to a Carnegie Mellon study, children are 50 times
more likely than adults to have their identities stolen.
Child identities are valuable to thieves because children do
not have existing credit files, and parents may not notice
fraudulent activity until the child applies for a student
loan, a job, or a credit card. Recent security breaches at
Anthem and Premera Blue Cross highlight the fact that
technological advances make identity theft much easier. In
these breaches alone, hackers stole an estimated 19 million
records including names, birth dates, and social security
numbers, many belonging to children.
AB 1580 (Gatto)
Page 7 of ?
AB 1580 will allow a parent, legal guardian or conservator to
put a credit freeze in place for a child under the age of 16,
or for an incapacitated individual. To place the freeze, a
parent or representative would directly contact the credit
bureau and submit the request for a credit freeze in a secure
manner. Representatives would authenticate their identity and
prove they can legally act on behalf of the child or
individual. After the request is filed, a protected consumer
record will be created, and credit will be frozen within 30
days. A credit bureau will then be prohibited from releasing
credit information or customer records for that protected
child or individual.
2.Protecting credit of vulnerable populations
Identity theft and credit fraud affect tens of thousands of
Californians every year, including those with diminished
capacity who may be unable to take steps to protect themselves.
This bill would empower specified guardians and conservators to
protect the credit of individuals under their charge. According
to AARP California:
Seniors with substantial mental deficits (e.g. loss of
critical thinking after small pre-frontal lobe strokes) are at
risk of financial ruin by utilizing credit to pay money they
do not have and cannot afford to . . . abusers. AB 1580
provides a minimally invasive but effective way of providing
prompt protection against this risk, pending further
resolution of the underlying issues. The truth of most elder
financial abuse is that after the money is gone, getting it
back is impracticable. Predators pressure at-risk seniors for
funds, including whatever the seniors can borrow. The debts
the elders may incur as a result of the financial abuse can be
devastating, depriving them of the safety and dignity they
deserve.
Similarly, Common Sense Kids Action writes:
Unfortunately, the most attractive targets of identity theft
are those whose futures are most at stake: our children.
Sensitive information about children is widely available, and
data breaches and hacks, including of children's information,
are only likely to grow. Credit freezes are a key tool in
AB 1580 (Gatto)
Page 8 of ?
preventing identity theft and its negative consequences.
While adults in California currently enjoy this right,
children do not. Common Sense Kids Action believes this must
be fixed, particularly given children's greater susceptibility
to identity theft and the devastating harm it can bring for
years to come.
While not prohibited, existing law is arguably unclear
concerning how an individual with diminished capacity, like a
minor, can request to have a security freeze placed on their
credit file. This bill would create a clear process for
guardians and conservators to follow when requesting the
placement of a security freeze in the name of someone placed
under their care.
3.Alternate perspective on protecting children's credit
It should be noted that, with regard to children, opinion is
divided concerning whether security freezes are the best tool
for preventing credit fraud. Experian, one of the three major
credit reporting agencies in the United States, gives the
following advice to members of the public on its Web site:
There seems to be a growing misperception that everyone is
assigned a credit history at birth, just like a Social
Security number. In fact, your children won't have a credit
report until they have credit in their names. Having no
credit report is better protection than having a credit report
with a freeze. If an identity thief applies for credit using
your children's information, the lender will get a response
indicating no credit report exists with those identifiers, and
also may receive an alert that the Social Security number
belongs to a minor.
A notice that the Social Security number is issued to a minor
can tip off the lender to fraud, stop the application and
allow the lender to notify law enforcement. If there were a
credit history and it were frozen, the lender would receive
only a message that the credit file needed to be thawed by the
consumer. The lender would then have to ask the identity
thief to thaw the credit file before the application could be
processed. The identity thief could then explain that he or
she needed to go get the password and could simply walk out of
the bank never to be seen again.
AB 1580 (Gatto)
Page 9 of ?
If your children already have credit reports in their names,
one of three things has happened. You have applied for credit
in their names and the applications were approved. You have
added them as authorized users or joint account holders on one
or more of your accounts. Or, someone has fraudulently used
their information to apply for credit and they are already
identity theft victims. . . . One of the few instances in
which I would recommend freezing a credit history is if the
child is very young and is a victim of identity theft. It is
an extreme situation that may warrant an extreme action.
(Experian, Freezing Your Child's Credit History (Aug. 24,
2013)
[as of June 3, 2016].)
Experian has not registered a position on AB 1580.
4.Clarifying Amendments
The author offers the following clarifying amendments to correct
references to "consumer reports" in a manner consistent with
other provisions of the Consumer Credit Reporting Agencies Act,
and to clarify the responsibility of consumer credit reporting
agencies to send confirmation of security freeze requests to the
protected consumer's address on file with the agency.
Author's Amendments :
On page 3, in line 15, after "consumer" insert "credit"
On page 3, in line 19, after "consumer" insert "credit"
On page 5, in line 35, strike out "protected consumer's
representative" and insert "address on file"
Support : AARP California; California Attorney General;
California District Attorneys Association; California Public
Interest Research Group; Common Sense Kids Action; Consumer
Attorneys of California; National Association of Social Workers,
California Chapter; Privacy Rights Clearinghouse; Professional
Fiduciary Association of California; Sacramento County District
Attorney; Ventura County Sheriff's Office
Opposition : None Known
HISTORY
AB 1580 (Gatto)
Page 10 of ?
Source : Author
Related Pending Legislation : AB 1723 (Dodd, 2016) would, among
other things, specify that a debt collector shall initiate
review of an account within 10 business days of receiving
specified information that a consumer has become the victim of
identity theft and that the debt being collected is not the
responsibility of the consumer. This bill would additionally
require the debt collector to notify, within 10 business days,
any consumer credit reporting agency to which the debt collector
furnished adverse information pertaining to a creditor's account
that the account is disputed, and would require the debt
collector to send notice of its determination to the debtor no
later than 10 business days after concluding the review. This
bill is pending in the Senate Judiciary Committee.
Prior Legislation :
SB 641 (Wieckowski, Ch. 804, Stats. 2015) added a provision to
the Fair Debt Buying Practices Act to provide consumers, in
limited circumstances involving actions brought by debt buyers,
extended time to file a motion to set aside a default or default
judgment and for leave to defend an action relating to debt, if
the service of summons did not result in actual notice to the
consumer in time to defend the action.
AB 2374 (Hernandez, Ch. 645, Stats. 2012) prohibited credit
reporting agencies from charging specified consumers any fee for
the initial placement of a security freeze, but authorized such
agencies to charge a fee of up to $5 for lifting, removing, or
replacing a security freeze.
AB 372 (Salas, Ch. 151, Stats. 2008) permitted a credit
reporting agency to charge a fee of no more than $5 to a
consumer 65 years of age or older and no more than $10 to other
consumers for a request for a security freeze, removal of the
freeze, or temporary lifting of the freeze for a period of time
or for a specific party.
AB 2043 (Banking and Finance Committee, Ch. 521, Stats. 2006)
authorized specified business entities that become the victims
of identity theft to utilize debt relief protections available
to natural persons who are victimized by identity theft.
AB 1580 (Gatto)
Page 11 of ?
AB 1294 (Wiggins, Ch. 287, Stats. 2003) required a debt
collector to stop collecting a consumer's debt if an alleged
debtor provides the collector with specified information showing
that the debtor is a victim of identity theft, as specified.
SB 168 (Bowen, Ch. 720, Stats. 2001) gave California consumers
the right to place a freeze on their credit reports, which,
while in place, prohibits a credit reporting agency from
releasing the consumer's credit report without the express
authorization of the consumer.
AB 156 (Murray, Ch. 768, Stats. 1997) formally recognized
identity theft as a crime, providing that it is a misdemeanor
for a person to willfully obtain personal identifying
information of another and use that information to obtain, or
attempt to obtain, credit, goods, or services in the name of
another person without the consent of that person.
Prior Vote :
Assembly Floor (Ayes 78, Noes 0)
Assembly Privacy and Consumer Protection Committee (Ayes 11,
Noes 0)
Assembly Banking and Finance Committee (Ayes 12, Noes 0)
**************