BILL ANALYSIS                                                                                                                                                                                                    





                             SENATE JUDICIARY COMMITTEE
                         Senator Hannah-Beth Jackson, Chair
                             2015-2016  Regular Session


          AB 1580 (Gatto)
          Version: May 5, 2016
          Hearing Date: June 14, 2016
          Fiscal: No
          Urgency: No
          TH   


                                        SUBJECT
                                           
            Consumer Credit Reports: Security Freezes: Protected Consumer

                                      DESCRIPTION 

          This bill would require a consumer credit reporting agency to  
          place a security freeze on the credit file of a protected  
          consumer upon the request of, and submission of specified  
          information by, the protected consumer's representative, as  
          specified.  This bill would define a protected consumer as any  
          of the following: an individual who is under 16 years of age at  
          the time a request for the placement of a security freeze is  
          made; an incapacitated person or a protected individual for whom  
          a guardian or conservator has been appointed; or a person under  
          the jurisdiction of a county welfare department or county  
          probation department who has been placed in a foster care  
          setting and is under 16 years of age at the time a request for a  
          security freeze is made.  

                                      BACKGROUND  

          According to the Federal Trade Commission's (FTC) "Consumer  
          Sentinel Network Data Book for January - December 2015,"  
          California had more identity theft complaints-55,305-than any  
          other state.  For every 100,000 people in California, there were  
          141.3 identity theft complaints.  Nationwide, identity theft has  
          increased more than five-fold during the past 15 years, with the  
          FTC receiving almost a half-million complaints from consumers in  
          2015 alone.  (Federal Trade Commission, Consumer Sentinel  
          Network Data Book for January - December 2015 (Feb. 2016)  
           [as of June 1, 2016].)

          Identity theft victims' information can be misused in numerous  
          ways.  One of the most common is the creation of new accounts,  
          including credit card, utility, or wireless telephone accounts.   
          But, victims' information can also be used in other, equally  
          nefarious ways.  As the Federal Trade Commission notes:

            Once identity thieves have your personal information, they can  
            drain your bank account, run up charges on your credit cards,  
            open new utility accounts, or get medical treatment on your  
            health insurance.  An identity thief might even file a tax  
            return in your name and get your refund.  In some extreme  
            cases, a thief might even give your name to the police during  
            an arrest.  (Federal Trade Commission, Taking Charge: What To  
            Do If Your Identity Is Stolen (Apr. 2013)  
             [as of  
            June 1, 2016].)

          A credit file is a report detailing a consumer's credit history,  
          compiled by a credit reporting agency such as Experian, Trans  
          Union, or Equifax.  The file contains information such as annual  
          income, outstanding debt, bill-paying history, the number,  
          types, and age of accounts, current and previous addresses, and  
          the consumer's Social Security number.  Under federal law, a  
          credit reporting agency may disclose information contained in a  
          credit report to current and prospective creditors, insurers,  
          employers, provided the consumer has authorized the disclosure,  
          and others who have a "legitimate business need" in connection  
          with a business transaction initiated by the consumer.  (15  
          U.S.C. Sec. 1681b.)  Federal law requires consumer reporting  
          agencies to give consumers one free credit report each year.   
          (15 U.S.C. Sec. 1681j.)

          In 2001, California became the first state in the nation to give  
          consumers the right to place a "freeze" on their credit reports,  
          which prohibits a credit reporting agency from releasing a  
          consumer's credit report without the express authorization of  
          the consumer while the freeze is in place.  (See SB 168 [Bowen,  
          Ch. 720, Stats. 2001].)  Freezes placed on credit reports can be  
          a useful tool in frustrating the ability of identity thieves to  
          open new lines of credit using another person's stolen identity.  







          AB 1580 (Gatto)
          Page 3 of ? 


           Since that time, at least 46 other states have followed  
          California's lead and enacted security freeze legislation,  
          limiting disclosure of consumers' credit reports.  Under current  
          law, security freezes are available to any consumer with a  
          credit report, but individuals who have never had credit in  
          their names, such as children, may not have a credit report on  
          file for which a freeze could be placed.

          This bill would require a consumer credit reporting agency to  
          place a security freeze on the credit file of a protected  
          consumer, including children under the age of 16, upon the  
          request of, and submission of specified information by, the  
          protected consumer's representative.

                                CHANGES TO EXISTING LAW
           
           Existing law  , the California Consumer Credit Reporting Agencies  
          Act (Civ. Code Sec. 1785.1 et seq.) and the Federal Fair Credit  
          Reporting Act (15 U.S.C. Sec. 1681 et seq.), require consumer  
          credit reporting agencies to adopt reasonable procedures for  
          meeting the needs of commerce for consumer credit, personnel,  
          insurance, hiring of a dwelling unit, and other information in a  
          manner which is fair and equitable to the consumer, with regard  
          to the confidentiality, accuracy, relevancy, and proper  
          utilization of such information.  (Civ. Code Sec. 1785.1(d); 15  
          U.S.C. Sec. 1681(b).)

           Existing law  permits a consumer to place a "security freeze" on  
          his or her credit report, prohibiting consumer credit reporting  
          agencies from releasing the consumer's credit report or any  
          information contained in it unless the consumer expressly  
          authorizes the release.  (Civ. Code Sec. 1785.11.2(a).)
          
           Existing law  requires a credit reporting agency to place a  
          security freeze on a consumer's credit report within three  
          business days after receiving the consumer's request.  (Civ.  
          Code Sec. 1785.11.2(b).)

           Existing law  requires a credit reporting agency to send a  
          written confirmation of the security freeze to the consumer  
          within 10 business days.  The credit reporting agency must also  
          provide the consumer with a unique personal identification  
          number or password to be used by the consumer when he or she  
          authorizes the release of his or her information for a specific  







          AB 1580 (Gatto)
          Page 4 of ? 


          party or period of time.  (Civ. Code Sec. 1785.11.2(c).)

           Existing law  permits a consumer to allow his or her credit  
          report to be accessed for a specific party or period of time  
          while a freeze is in place and requires the consumer to provide  
          specified information to the credit reporting agency so that the  
          freeze may be temporarily lifted.  (Civ. Code Sec.  
          1785.11.2(d).)

           Existing law  requires a credit reporting agency that receives a  
          consumer's request to temporarily lift a freeze to comply with  
          that request within three business days.  (Civ. Code Sec.  
          1785.11.2(e).)

           Existing law  provides that a credit reporting agency may remove  
          or temporarily lift a freeze only upon the consumer's request or  
          if the consumer's credit report was frozen due to a material  
          misrepresentation of fact by the consumer, in which case the  
          credit reporting agency must notify the consumer before removing  
          the freeze.  (Civ. Code Sec. 1785.11.2(g).)

           Existing law  requires that a security freeze must remain in  
          place until the consumer requests that it be removed.  If a  
          consumer requests that the freeze be removed and provides  
          specified information, a credit reporting agency must comply  
          with that request within three business days of receiving the  
          request for removal.  (Civ. Code Sec. 1785.11.2(j).)  Existing  
          law provides that a credit reporting agency must require proper  
          identification, as defined, of a consumer making a request to  
          place or remove a security freeze.  (Civ. Code Sec.  
          1785.11.2(k).)

           This bill  requires a consumer credit reporting agency to place a  
          security freeze on the credit file or record of a protected  
          consumer if the agency receives a request from the protected  
          consumer's representative for the placement of the freeze, and  
          specified information showing proof of identity and authority to  
          act on behalf of the protected consumer.

           This bill  requires a consumer credit reporting agency to create  
          a record for a protected consumer when it receives a request for  
          the placement of a security freeze if the agency does not have a  
          credit file pertaining to the protected consumer.








          AB 1580 (Gatto)
          Page 5 of ? 


           This bill  specifies that within 30 days after receiving a  
          request, a consumer credit reporting agency shall place a  
          security freeze for the protected consumer.  The consumer credit  
          reporting agency must send written confirmation of the security  
          freeze to the protected consumer's representative within 10 days  
          of the placement of the security freeze.

           This bill  specifies that unless a security freeze for a  
          protected consumer is removed, a consumer credit reporting  
          agency shall not release the protected consumer's consumer  
          report, any information derived from the protected consumer's  
          consumer report, or any record created for the protected  
          consumer.

           This bill  states that in order to remove a security freeze, a  
          protected consumer or a protected consumer's representative must  
          submit a request for removal of the security freeze to the  
          consumer credit reporting agency and provide specified  
          information showing proof of identity and authority to act on  
          behalf of the protected consumer.

           This bill  states that a consumer credit reporting agency shall  
          remove a security freeze for a protected consumer within 30 days  
          after receiving both the request to remove the freeze and all  
          required information.

           This bill  specifies that except as provided, a consumer credit  
          reporting agency is authorized to charge a reasonable fee, not  
          exceeding $10, for each placement or removal of a security  
          freeze for a protected consumer.

           This bill  excludes certain entities from the above restrictions,  
          including, among others, a person administering a credit file  
          monitoring subscription service to which the representative of  
          the protected consumer has subscribed on behalf of the protected  
          consumer.

           This bill  defines a "protected consumer" as an individual who is  
          any of the following:
           under 16 years of age at the time a request for the placement  
            of a security freeze is made;
           an incapacitated person or a protected person for whom a  
            guardian or conservator has been appointed; or
           under the jurisdiction of a county welfare department or  







          AB 1580 (Gatto)
          Page 6 of ? 


            county probation department, has been placed in a foster care  
            setting, and is under 16 years of age at the time a request  
            for placement of a security freeze is made.

           This bill  defines a "representative" as a person who provides to  
          a consumer credit reporting agency sufficient proof of authority  
          to act on behalf of a protected consumer.  This bill specifies  
          that for a protected consumer who has been placed in a foster  
          care setting, "representative" means either a county welfare  
          department or its agent or designee, or a county probation  
          department or its agent or designee, but that it does not mean  
          the foster parent of a protected consumer who has been placed in  
          a foster care setting.
          
                                        COMMENT
           
           1.Stated need for the bill
           
          The author writes:

            Credit freezing is one of the best tools available to prevent  
            identity theft.  Under current law, credit bureaus are not  
            mandated to, and therefore do not, offer a clear path to  
            freeze a child's credit record unless the child has already  
            had his or her credit stolen.  Otherwise, the parent must go  
            through an onerous process to add the child as an authorized  
            user on an existing credit card, which includes a 60 to 90 day  
            wait period, provision of notarized identification documents  
            to credit bureaus, and a confirmation notice.  Similar  
            barriers prevented adults from freezing their own credit  
            reports until new regulations made the process secure and  
            easy.

            According to a Carnegie Mellon study, children are 50 times  
            more likely than adults to have their identities stolen.   
            Child identities are valuable to thieves because children do  
            not have existing credit files, and parents may not notice  
            fraudulent activity until the child applies for a student  
            loan, a job, or a credit card.  Recent security breaches at  
            Anthem and Premera Blue Cross highlight the fact that  
            technological advances make identity theft much easier.  In  
            these breaches alone, hackers stole an estimated 19 million  
            records including names, birth dates, and social security  
            numbers, many belonging to children.







          AB 1580 (Gatto)
          Page 7 of ? 



            AB 1580 will allow a parent, legal guardian or conservator to  
            put a credit freeze in place for a child under the age of 16,  
            or for an incapacitated individual.  To place the freeze, a  
            parent or representative would directly contact the credit  
            bureau and submit the request for a credit freeze in a secure  
            manner.  Representatives would authenticate their identity and  
            prove they can legally act on behalf of the child or  
            individual.  After the request is filed, a protected consumer  
            record will be created, and credit will be frozen within 30  
            days.  A credit bureau will then be prohibited from releasing  
            credit information or customer records for that protected  
            child or individual.

           2.Protecting credit of vulnerable populations
           
          Identity theft and credit fraud affect tens of thousands of  
          Californians every year, including those with diminished  
          capacity who may be unable to take steps to protect themselves.   
          This bill would empower specified guardians and conservators to  
          protect the credit of individuals under their charge.  According  
          to AARP California:

            Seniors with substantial mental deficits (e.g. loss of  
            critical thinking after small pre-frontal lobe strokes) are at  
            risk of financial ruin by utilizing credit to pay money they  
            do not have and cannot afford to . . . abusers.  AB 1580  
            provides a minimally invasive but effective way of providing  
            prompt protection against this risk, pending further  
            resolution of the underlying issues.  The truth of most elder  
            financial abuse is that after the money is gone, getting it  
            back is impracticable.  Predators pressure at-risk seniors for  
            funds, including whatever the seniors can borrow.  The debts  
            the elders may incur as a result of the financial abuse can be  
            devastating, depriving them of the safety and dignity they  
            deserve.

          Similarly, Common Sense Kids Action writes:

            Unfortunately, the most attractive targets of identity theft  
            are those whose futures are most at stake: our children.   
            Sensitive information about children is widely available, and  
            data breaches and hacks, including of children's information,  
            are only likely to grow.  Credit freezes are a key tool in  







          AB 1580 (Gatto)
          Page 8 of ? 


            preventing identity theft and its negative consequences.   
            While adults in California currently enjoy this right,  
            children do not.  Common Sense Kids Action believes this must  
            be fixed, particularly given children's greater susceptibility  
            to identity theft and the devastating harm it can bring for  
            years to come.

          While not prohibited, existing law is arguably unclear  
          concerning how an individual with diminished capacity, like a  
          minor, can request to have a security freeze placed on their  
          credit file.  This bill would create a clear process for  
          guardians and conservators to follow when requesting the  
          placement of a security freeze in the name of someone placed  
          under their care.

           3.Alternate perspective on protecting children's credit
           
          It should be noted that, with regard to children, opinion is  
          divided concerning whether security freezes are the best tool  
          for preventing credit fraud.  Experian, one of the three major  
          credit reporting agencies in the United States, gives the  
          following advice to members of the public on its Web site:
            There seems to be a growing misperception that everyone is  
            assigned a credit history at birth, just like a Social  
            Security number.  In fact, your children won't have a credit  
            report until they have credit in their names.  Having no  
            credit report is better protection than having a credit report  
            with a freeze.  If an identity thief applies for credit using  
            your children's information, the lender will get a response  
            indicating no credit report exists with those identifiers, and  
            also may receive an alert that the Social Security number  
            belongs to a minor.

            A notice that the Social Security number is issued to a minor  
            can tip off the lender to fraud, stop the application and  
            allow the lender to notify law enforcement.  If there were a  
            credit history and it were frozen, the lender would receive  
            only a message that the credit file needed to be thawed by the  
            consumer.  The lender would then have to ask the identity  
            thief to thaw the credit file before the application could be  
            processed.   The identity thief could then explain that he or  
            she needed to go get the password and could simply walk out of  
            the bank never to be seen again.








          AB 1580 (Gatto)
          Page 9 of ? 


            If your children already have credit reports in their names,  
            one of three things has happened.  You have applied for credit  
            in their names and the applications were approved.  You have  
            added them as authorized users or joint account holders on one  
            or more of your accounts.  Or, someone has fraudulently used  
            their information to apply for credit and they are already  
            identity theft victims. . . . One of the few instances in  
            which I would recommend freezing a credit history is if the  
            child is very young and is a victim of identity theft.  It is  
            an extreme situation that may warrant an extreme action.   
            (Experian, Freezing Your Child's Credit History (Aug. 24,  
            2013)  
             [as of June 3, 2016].)

          Experian has not registered a position on AB 1580.

           4.Clarifying Amendments
           
          The author offers the following clarifying amendments to correct  
          references to "consumer reports" in a manner consistent with  
          other provisions of the Consumer Credit Reporting Agencies Act,  
          and to clarify the responsibility of consumer credit reporting  
          agencies to send confirmation of security freeze requests to the  
          protected consumer's address on file with the agency.

             Author's Amendments  :

            On page 3, in line 15, after "consumer" insert "credit"
            On page 3, in line 19, after "consumer" insert "credit"
            On page 5, in line 35, strike out "protected consumer's  
            representative" and insert "address on file"
           Support  :  AARP California; California Attorney General;  
          California District Attorneys Association; California Public  
          Interest Research Group; Common Sense Kids Action; Consumer  
          Attorneys of California; National Association of Social Workers,  
          California Chapter; Privacy Rights Clearinghouse; Professional  
          Fiduciary Association of California; Sacramento County District  
          Attorney; Ventura County Sheriff's Office

           Opposition  :  None Known

                                        HISTORY
           







          AB 1580 (Gatto)
          Page 10 of ? 


           Source  :  Author

           Related Pending Legislation  :  AB 1723 (Dodd, 2016) would, among  
          other things, specify that a debt collector shall initiate  
          review of an account within 10 business days of receiving  
          specified information that a consumer has become the victim of  
          identity theft and that the debt being collected is not the  
          responsibility of the consumer.  This bill would additionally  
          require the debt collector to notify, within 10 business days,  
          any consumer credit reporting agency to which the debt collector  
          furnished adverse information pertaining to a creditor's account  
          that the account is disputed, and would require the debt  
          collector to send notice of its determination to the debtor no  
          later than 10 business days after concluding the review.  This  
          bill is pending in the Senate Judiciary Committee.

           Prior Legislation :

          SB 641 (Wieckowski, Ch. 804, Stats. 2015) added a provision to  
          the Fair Debt Buying Practices Act to provide consumers, in  
          limited circumstances involving actions brought by debt buyers,  
          extended time to file a motion to set aside a default or default  
          judgment and for leave to defend an action relating to debt, if  
          the service of summons did not result in actual notice to the  
          consumer in time to defend the action.

          AB 2374 (Hernandez, Ch. 645, Stats. 2012) prohibited credit  
          reporting agencies from charging specified consumers any fee for  
          the initial placement of a security freeze, but authorized such  
          agencies to charge a fee of up to $5 for lifting, removing, or  
          replacing a security freeze.

          AB 372 (Salas, Ch. 151, Stats. 2008) permitted a credit  
          reporting agency to charge a fee of no more than $5 to a  
          consumer 65 years of age or older and no more than $10 to other  
          consumers for a request for a security freeze, removal of the  
          freeze, or temporary lifting of the freeze for a period of time  
          or for a specific party.

          AB 2043 (Banking and Finance Committee, Ch. 521, Stats. 2006)  
          authorized specified business entities that become the victims  
          of identity theft to utilize debt relief protections available  
          to natural persons who are victimized by identity theft.








          AB 1580 (Gatto)
          Page 11 of ? 


          AB 1294 (Wiggins, Ch. 287, Stats. 2003) required a debt  
          collector to stop collecting a consumer's debt if an alleged  
          debtor provides the collector with specified information showing  
          that the debtor is a victim of identity theft, as specified.

          SB 168 (Bowen, Ch. 720, Stats. 2001) gave California consumers  
          the right to place a freeze on their credit reports, which,  
          while in place, prohibits a credit reporting agency from  
          releasing the consumer's credit report without the express  
                                                                              authorization of the consumer.

          AB 156 (Murray, Ch. 768, Stats. 1997) formally recognized  
          identity theft as a crime, providing that it is a misdemeanor  
          for a person to willfully obtain personal identifying  
          information of another and use that information to obtain, or  
          attempt to obtain, credit, goods, or services in the name of  
          another person without the consent of that person.

           Prior Vote  :

          Assembly Floor (Ayes 78, Noes 0)
          Assembly Privacy and Consumer Protection Committee (Ayes 11,  
          Noes 0)
          Assembly Banking and Finance Committee (Ayes 12, Noes 0)

                                   **************